Task 2 RMF_System and Services Acquisition Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

System and Services Acquisition Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. DoD Instruction 8510.01, "Risk Management Framework (RMF) for DoD Information Technology (IT)"

ii. DoD Directive 5000.01, “The Defense Acquisition System”

iii. DoD Instruction 5000.02, “Operation of the Defense Acquisition System”

iv. DoD Instruction 8580.1, “Information Assurance (IA) in the Defense Acquisition System”

v. NIST Special Publication 800-100, "Information Security Handbook: A Guide for Managers"

vi. NIST Special Publication 800-64 Revision 2, "Security Considerations in the System Development Life Cycle"

Table of Contents

Table 1 - SP-800-53v4 Compliance Matrix 1

FOR OFFICIAL USE ONLY

{ACRONYM} {DATE}

SYSTEM AND SERVICES ACQUISITION PLAN

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

The purpose of this System and Services Acquisition Plan is to manage the design, development, and maintenance of the {ACRONYM} security infrastructure, and to protect its information.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

The following Assessment Procedures have not been allocated by NIST:

Table 1 - SP-800-53v4 Compliance Matrix

2.0 SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES

DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1, which address system and services acquisition.

3.0 ALLOCATION OF RESOURCES

Resource allocation for {ACRONYM} security includes funding for the initial system or information system service acquisition and funding for the sustainment of the system/service.

{ACRONYM} security requirements are documented in the Control Selection Form and Security Assessment Plan (SAP), which was created and approved during RMF Step 2 – Select Security Controls.

{ACRONYM} requires the following resources to implement and maintain cybersecurity requirements:

Has {ACRONYM} identified and individual line item to support cybersecurity requirements?

☐ No

☐ Yes

4.0 SYSTEM DEVELOPMENT LIFE CYCLE

A well-defined system development life cycle provides the foundation for the successful development, implementation, and operation of information systems.

Does {ACRONYM} perform development activities?

☐ No

☐ Yes

If Yes, reference Enclosure 1 “System Development Lifecycle”

5.0 ACQUISITION PROCESS

The acquisition process ensures that the technologies and architecture used by {ACRONYM} comply with DoD requirements.

{ACRONYM} will utilize the Incident Response Plan (IRP) to:

· respond to attempts to obtain either unavailable or nonexistent documentation for information system, system component, or information system service

· document attempts to obtain either unavailable or nonexistent documentation for information system, system component, or information system service

· record actions to obtain either unavailable or nonexistent documentation for information system, system component, or information system service All {ACRONYM} components, or information system service documentation will be distributed to at a minimum, the ISSO, ISSM, and SCA.

All {ACRONYM} components, or information system service documentation will be stored and handled in accordance with the Physical and Environmental Protection Plan.

5.1 Architecture Characteristics

The {ACRONYM} contains the following security characteristics:

Are DoD approved PKI tokens implemented for identify verification?

☐ No

☐ Yes

Describe the PKI implementation, or lack thereof.

Does {ACRONYM} utilize commercially provided IA and IA-enabled IT products?

☐ No

☐ Yes

If Yes, have the products been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type?

☐ No

☐ Yes

If No, do the products rely on FIPS-validated cryptographic modules?

☐ No

☐ Yes

5.2 Design Information

Design information provides the developer with the list of security controls that must be implemented for {ACRONYM}.

Does {ACRONYM} perform development activities?

☐ No

☐ Yes

If no, delete the following information.

If Yes, then within the {ACRONYM} Design Document, is the following information defined:

5.3 Contracts and Agreements

Does {ACRONYM} perform development activities?

☐ No

☐ Yes

If Yes, then within the {ACRONYM} contracts/agreements, is the following information defined:

6.0 INFORMATION SYSTEM DOCUMENTATION

This section details the implementation and operation of security controls associated with {ACRONYM} components, and information system services.

SYSTEM NAME} will utilize the Incident Response Plan (IRP) to:

· respond to attempts to obtain either unavailable or nonexistent documentation for information system, system component, or information system service

· document attempts to obtain either unavailable or nonexistent documentation for information system, system component, or information system service

· record actions to obtain either unavailable or nonexistent documentation for information system, system component, or information system service All {ACRONYM} components, or information system service documentation will be distributed to at a minimum, the ISSO, ISSM, and SCA.

All {ACRONYM} components, or information system service documentation will be stored and handled in accordance with the Physical and Environmental Protection Plan.

Does {ACRONYM} perform development activities?

☐ No

☐ Yes

If Yes, then within the {ACRONYM} contracts/agreements, is the following information defined:

7.0 SECURITY ENGINEERING PRINCIPLES

Security engineering principles are primarily applied to new development information systems or systems undergoing major upgrades. For legacy systems, organizations apply security engineering principles to system upgrades and modifications to the extent feasible, given the current state of hardware, software, and firmware within those systems.

Security engineering principles include, developing layered protections; establishing sound security policy, architecture, and controls as the foundation for design; incorporating security requirements into the system development life cycle; delineating physical and logical security boundaries; ensuring that system developers are trained on how to build secure software; tailoring security controls to meet organizational and operational needs; performing threat modeling to identify use cases, threat agents, attack vectors, and attack patterns as well as compensating controls and design patterns needed to mitigate risk; and reducing risk to acceptable levels, thus enabling informed risk management decisions, Is {ACRONYM} a new development effort?

☐ No

☐ Yes

If yes,

8.0 EXTERNAL INFORMATION SYSTEM SERVICES

External information system services are services that are implemented outside of the authorization boundaries of organizational information systems. This includes services that are used by, but not a part of, organizational information systems.

FISMA and OMB policy require that organizations using external service providers that are processing, storing, or transmitting federal information or operating information systems on behalf of the federal government ensure that such providers meet the same security requirements that federal agencies are required to meet.

Does {ACRONYM} acquire or outsource information security services?

☐ No

☐ Yes

9.0 DEVELOPER CONFIGURATION MANAGEMENT

This section applies to internal information systems development and integration. The quality and completeness of the configuration management activities conducted by developers as evidence of applying effective security safeguards is considered. Safeguards include, for example, protecting from unauthorized modification or destruction, the master copies of all material used to generate security-relevant portions of the system hardware, software, and firmware.

Configuration items that are placed under configuration management (if existence/use is required by other security controls) include: the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and software/firmware source code with previous versions; and test fixtures and documentation.

Does {ACRONYM} perform system development?

☐ No

☐ Yes

10.0 DEVELOPER SECURITY TESTING AND EVALUATION

Developmental security testing/evaluation occurs at all post-design phases of the system development life cycle. Such testing/evaluation confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.

Does {ACRONYM} perform system development?

☐ No

☐ Yes

11.0 SUPPLY CHAIN PROTECTION

Information systems (including system components that compose those systems) need to be protected throughout the system development life cycle (i.e., during design, development, manufacturing, packaging, assembly, distribution, system integration, operations, maintenance, and retirement). Protection of organizational information systems is accomplished through threat awareness, by the identification, management, and reduction of vulnerabilities at each phase of the life cycle and the use of complementary, mutually reinforcing strategies to respond to risk.

Is {ACRONYM} a “covered system” IAW DoDI 5200.44?

☐ No

☐ Yes

12.0 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS

Development tools include, for example, programming languages and computer-aided design (CAD) systems. Reviews of development processes can include, for example, the use of maturity models to determine the potential effectiveness of such processes. Maintaining the integrity of changes to tools and processes enables accurate supply chain risk assessment and mitigation, and requires robust configuration control throughout the life cycle (including design, development, transport, delivery, integration, and maintenance) to track authorized changes and prevent unauthorized changes.

Does {ACRONYM} perform system development?

☐ No

☐ Yes

13.0 COMPONENT AUTHENTICITY

Anti-counterfeiting policy and procedures support tamper resistance and provide a level of protection against the introduction of malicious code.

{ACRONYM} follows DoDI 4140.67, "DoD Counterfeit Prevention Policy" as its documented anti-counterfeit policy, which implements the following:

· detect counterfeit components from entering the information system

· prevent counterfeit components from entering the information system

· report counterfeit information system components to source of counterfeit component, at a minimum, USCYBERCOM. And/or at a minimum, the ISSO, ISSM, and PM

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as all personnel.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as all personnel.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.

DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.

DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.

DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.

DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as every 5 years.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.

DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.

DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.

Automatically compliant with this CCI because they are covered at the DoD level

High Moderate Low

High Moderate Low

High Moderate Low

High Moderate Low

High Moderate Low

High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documented configuration items to ensure the organization being inspected/assessed defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.

DoD has determined the configuration items are not appropriate to define at the Enterprise level.

Section 9

High Moderate Low

High Moderate Low

High Moderate Low

High Moderate Low

High Moderate Low

High Moderate Low

The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service report security flaws and flaw resolution within the system, component, or service findings to at a minimum, the ISSO and ISSM.

DoD has defined the personnel as at a minimum, the ISSO and ISSM.

Section 9

High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel as at a minimum, the ISSO and ISSM.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has determined the independence criteria is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the specific code is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the processes, procedures, and/or techniques are not appropriate to define at the…