FA8770-RFI-18-IMLCI_Ref_A)_NIST_SP_800-37_rev_1.pdf

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-37r1

NIST Special Publication 800-37 Revision 1

Guide for Applying the Risk Management Framework to

Federal Information Systems A Security Life Cycle Approach

JOINT TASK FORCE

TRANSFORMATION INITIATIVE

http://dx.doi.org/10.6028/NIST.SP.800-37r1

NIST Special Publication 800-37 Revision 1

Guide for Applying the Risk Management Framework to

Federal Information Systems A Security Life Cycle Approach

JOINT TASK FORCE

TRANSFORMATION INITIATIVE

Computer Security Division Information Technology Laboratory

National Institute of Standards and Technology

February 2010

INCLUDES UPDATES AS OF 06-05-2014: PAGE IX

U.S. Department of Commerce Gary Locke, Secretary

Patrick D. Gallagher, Director

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems Revision 1 A Security Life Cycle Approach

Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Management Act (FISMA), Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections.

Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.

This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-37 Revision 1 Natl. Inst. Stand. Technol. Spec. Publ. 800-37 Revision 1, 102 pages (February 2010)

CODEN: NSPUE2

Comments on this publication may be submitted to:

Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Electronic Mail: sec-cert@nist.gov

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Computer Security Division publications are available at http://csrc.nist.gov/publications.

PAGE ii mailto:sec-cert@nist.gov http://csrc.nist.gov/publications

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Abstract

This publication provides guidelines for applying the Risk Management Framework (RMF) to federal information systems. The six-step RMF includes security categorization, security control selection, security control implementation, security control assessment, information system authorization, and security control monitoring. The RMF promotes the concept of near real-time risk management and ongoing information system authorization through the implementation of robust continuous monitoring processes, provides senior leaders the necessary information to make cost-effective, risk-based decisions with regard to the organizational information systems supporting their core missions and business functions, and integrates information security into the enterprise architecture and system development life cycle. Applying the RMF within enterprises links risk management processes at the information system level to risk management processes at the organization level through a risk executive (function) and establishes lines of responsibility and accountability for security controls deployed within organizational information systems and inherited by those systems (i.e., common controls).

Keywords

Risk management, risk assessment, security authorization, security control, system development life cycle, Risk Management Framework, security control assessment, continuous monitoring, ongoing authorization, security categorization, security control selection, security plan, security assessment report, plan of action and milestones, security authorization package, authorization to operate, common control, information system owner/steward, senior information security officer, common control provider, authorizing official.

PAGE iii

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

Compliance with NIST Standards and Guidelines

In accordance with the provisions of FISMA,1 the Secretary of Commerce shall, on the basis of standards and guidelines developed by NIST, prescribe standards and guidelines pertaining to federal information systems. The Secretary shall make standards compulsory and binding to the extent determined necessary by the Secretary to improve the efficiency of operation or security of federal information systems. Standards prescribed shall include information security standards that provide minimum information security requirements and are otherwise necessary to improve the security of federal information and information systems.

• Federal Information Processing Standards (FIPS) are approved by the Secretary of Commerce and issued by NIST in accordance with FISMA. FIPS are compulsory and binding for federal agencies.2 FISMA requires that federal agencies comply with these standards, and therefore, agencies may not waive their use.

• Special Publications (SPs) are developed and issued by NIST as recommendations and guidance documents. For other than national security programs and systems, federal agencies must follow those NIST Special Publications mandated in a Federal Information Processing Standard. FIPS 200 mandates the use of Special Publication 800-53, as amended. In addition, OMB policies (including OMB Reporting Instructions for FISMA and Agency Privacy Management) state that for other than national security programs and systems, federal agencies must follow certain specific NIST Special Publications.3

• Other security-related publications, including interagency reports (NISTIRs) and ITL Bulletins, provide technical and other information about NIST's activities. These publications are mandatory only when specified by OMB.

• Compliance schedules for NIST security standards and guidelines are established by OMB in policies, directives, or memoranda (e.g., annual FISMA Reporting Guidance).

1 The E-Government Act (P.L. 107-347) recognizes the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA), emphasizes the need for organizations to develop, document, and implement an organization-wide program to provide security for the information systems that support its operations and assets.

2 The term agency is used in this publication in lieu of the more general term organization only in those circumstances where its usage is directly related to other source documents such as federal legislation or policy.

3 While federal agencies are required to follow certain specific NIST Special Publications in accordance with OMB policy, there is flexibility in how agencies apply the guidance. Federal agencies apply the security concepts and principles articulated in the NIST Special Publications in accordance with and in the context of the agency’s missions, business functions, and environment of operation. Consequently, the application of NIST guidance by federal agencies can result in different security solutions that are equally acceptable, compliant with the guidance, and meet the OMB definition of adequate security for federal information systems. Given the high priority of information sharing and transparency within the federal government, agencies also consider reciprocity in developing their information security solutions. When assessing federal agency compliance with NIST Special Publications, Inspectors General, evaluators, auditors, and assessors consider the intent of the security concepts and principles articulated within the specific guidance document and how the agency applied the guidance in the context of its mission/business responsibilities, operational environment, and unique organizational conditions.

PAGE iv

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

Acknowledgements

This publication was developed by the Joint Task Force Transformation Initiative Interagency Working Group with representatives from the Civil, Defense, and Intelligence Communities in an ongoing effort to produce a unified information security framework for the federal government.

The Project Leader, Ron Ross, from the National Institute of Standards and Technology, wishes to acknowledge and thank the senior leadership team from the U.S. Departments of Commerce and Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency working group whose dedicated efforts contributed significantly to the publication. The senior leadership team, working group members, and their organizational affiliations include:

U.S. Department of Defense Office of the Director of National Intelligence Cheryl J. Roby Honorable Priscilla Guthrie Acting Assistant Secretary of Defense for Networks Intelligence Community and Information Integration/ Chief Information Officer DoD Chief Information Officer

Gus Guissanie Sherrill Nicely Acting Deputy Assistant Secretary of Defense Deputy Intelligence Community for Cyber, Identity, and Information Assurance Chief Information Officer

Dominic Cussatt Mark J. Morrison Senior Policy Advisor Deputy Associate Director of National

Intelligence for IC Information Assurance

Roger Caslow Lead, C&A Transformation

National Institute of Standards and Technology Committee on National Security Systems Cita M. Furlani Cheryl J. Roby Director, Information Technology Laboratory Acting Chair, Committee on National Security

Systems

William C. Barker Eustace D. King Chief, Computer Security Division CNSS Subcommittee Co-Chair (DoD)

Ron Ross William Hunteman FISMA Implementation Project Leader CNSS Subcommittee Co-Chair (DoE)

Joint Task Force Transformation Initiative Interagency Working Group

Ron Ross Gary Stoneburner Dominic Cussatt Kelley Dempsey NIST, JTF Leader Johns Hopkins APL Department of Defense NIST

Marianne Swanson Jennifer Fabius Greene Dorian Pappas Arnold Johnson NIST MITRE Corporation National Security Agency NIST

Stuart Katzke Peter Williams Peter Gouldmann Christian Enloe Booz Allen Hamilton Booz Allen Hamilton Department of State NIST

In addition to the above acknowledgments, a special note of thanks goes to Peggy Himes and Elizabeth Lennon for their superb technical editing and administrative support. The authors also wish to recognize Beckie Bolton, Marshall Abrams, John Gilligan, Richard Graubart, Esten Porter, Karen Quigg, George Rogers, John Streufert, and Glenda Turner for their exceptional contributions in helping to improve the content of the publication. And finally, the authors gratefully acknowledge and appreciate the significant contributions from individuals and organizations in the public and private sectors, nationally and internationally, whose thoughtful and constructive comments improved the overall quality and usefulness of this publication.

PAGE v

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

DEVELOPING COMMON INFORMATION SECURITY FOUNDATIONS

COLLABORATION AMONG PUBLIC AND PRIVATE SECTOR ENTITIES

In developing standards and guidelines required by FISMA, NIST consults with other federal agencies and the private sector to improve information security, avoid unnecessary and costly duplication of effort, and ensure that its publications are complementary with the standards and guidelines employed for the protection of national security systems. In addition to a comprehensive public review and vetting process, NIST is collaborating with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to establish a unified information security framework for the federal government.

A common foundation for information security will provide the Civil, Defense, and Intelligence sectors of the federal government and their contractors, more cost-effective and consistent ways to manage information security-related risk to organizational operations and assets, individuals, other organizations, and the Nation. The unified framework will also provide a strong basis for reciprocal acceptance of authorization decisions and facilitate information sharing. NIST is also working with many public and private sector entities to establish mappings and relationships between the security standards and guidelines developed by NIST and the International Organization for Standardization and International Electrotechnical Commission (ISO/IEC).

PAGE vi

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

Table of Contents

CHAPTER ONE INTRODUCTION

1.1 BACKGROUND

1.2 PURPOSE AND APPLICABILITY

1.3 TARGET AUDIENCE

1.4 ORGANIZATION OF THIS SPECIAL PUBLICATION

CHAPTER TWO THE FUNDAMENTALS

2.1 INTEGRATED ORGANIZATION-WIDE RISK MANAGEMENT

2.2 SYSTEM DEVELOPMENT LIFE CYCLE

2.3 INFORMATION SYSTEM BOUNDARIES

2.4 SECURITY CONTROL ALLOCATION

CHAPTER THREE THE PROCESS

3.1 RMF STEP 1 – CATEGORIZE INFORMATION SYSTEM

3.2 RMF STEP 2 – SELECT SECURITY CONTROLS

3.3 RMF STEP 3 – IMPLEMENT SECURITY CONTROLS

3.4 RMF STEP 4 – ASSESS SECURITY CONTROLS

3.5 RMF STEP 5 – AUTHORIZE INFORMATION SYSTEM

3.6 RMF STEP 6 – MONITOR SECURITY CONTROLS

APPENDIX A REFERENCES ............................................................................................ A-1 APPENDIX B GLOSSARY ................................................................................................ B-1 APPENDIX C ACRONYMS ............................................................................................... C-1 APPENDIX D ROLES AND RESPONSIBILITIES .................................................................... D-1 APPENDIX E SUMMARY OF RMF TASKS ........................................................................... E-1 APPENDIX F SECURITY AUTHORIZATION ......................................................................... F-1 APPENDIX G CONTINUOUS MONITORING ......................................................................... G-1 APPENDIX H OPERATIONAL SCENARIOS .......................................................................... H-1 APPENDIX I SECURITY CONTROLS IN EXTERNAL ENVIRONMENTS ....................................... I-1

PAGE vii

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

Prologue

“…Through the process of risk management, leaders must consider risk to US interests from adversaries using cyberspace to their advantage and from our own efforts to employ the global nature of cyberspace to achieve objectives in military, intelligence, and business operations… “

“…For operational plans development, the combination of threats, vulnerabilities, and impacts must be evaluated in order to identify important trends and decide where effort should be applied to eliminate or reduce threat capabilities; eliminate or reduce vulnerabilities; and assess, coordinate, and deconflict all cyberspace operations…”

“…Leaders at all levels are accountable for ensuring readiness and security to the same degree as in any other domain…"

-- THE NATIONAL STRATEGY FOR CYBERSPACE OPERATIONS

OFFICE OF THE CHAIRMAN, JOINT CHIEFS OF STAFF, U.S. DEPARTMENT OF DEFENSE

PAGE viii

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

Errata

The following changes have been incorporated into Special Publication 800-37, Revision 1.

Errata updates include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature.

DATE TYPE CHANGE PAGE

06-05-2014 Substantive Added Abstract Section. iii 06-05-2014 Substantive Added Keywords Section. iii

06-05-2014 Substantive

Added “The information system owner and information owner/steward consider results from the initial risk assessment as a part of the security categorization decision. The security categorization decision is consistent with the organization’s risk management strategy to identify potential impact to mission/business functions resulting from the loss of confidentiality, integrity, and/or availability.” to Task 1-1, Supplemental Guidance.

06-05-2014 Editorial Moved “The results of the security categorization process influence the selection of appropriate security controls for the information system and also, where applicable, the minimum assurance requirements for that system.” to the beginning of new paragraph 2, Task 1-1, Supplemental Guidance.

06-05-2014 Substantive Changed “executive (function)” to “management strategy” in Task 1-1, Supplemental Guidance. 21

06-05-2014 Substantive Deleted “concerning the risk management strategy for the organization” from Task 1-1, Supplemental Guidance. 21

06-05-2014 Editorial

Moved “The organization may consider decomposing the information system… into multiple subsystems to more efficiently and effectively allocate security controls to the system. One approach is to categorize each identified subsystem (including dynamic subsystems). Separately categorizing each subsystem does not change the overall categorization of the information system. Rather, it allows the constituent subsystems to receive a separate allocation of security controls from NIST Special Publication 800-53 instead of deploying higher-impact controls across every subsystem. Another approach is to bundle smaller subsystems into larger subsystems within the information system, categorize each of the aggregated subsystems, and allocate security controls to the subsystems, as appropriate.

Security categorization information is documented in the system identification section of the security plan or included as an attachment to the plan.” to end of Task 1-1, Supplemental Guidance.

06-05-2014 Substantive Added “(informed by the initial risk assessment)” to Milestone Checkpoint #1. 23

06-05-2014 Substantive

Deleted “The security control selection process includes, as appropriate: (i) choosing a set of baseline security controls; (ii) tailoring the baseline security controls by applying scoping, parameterization, and compensating control guidance; (iii) supplementing the tailored baseline security controls, if necessary, with additional controls and/or control enhancements to address unique organizational needs based on a risk assessment (either formal or informal) and local conditions including environment of operation, organization-specific security requirements, specific threat information, cost-benefit analyses, or special circumstances; and (iv) specifying minimum assurance requirements, as appropriate. Organizations document in the security plan, the decisions (e.g., tailoring, supplementation, etc.) taken during the security control selection process, providing a sound rationale for those decisions.” from Task 2-2, Supplemental Guidance, paragraph 1.

PAGE ix

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

DATE TYPE CHANGE PAGE

06-05-2014 Substantive

Added “After selecting the applicable security control baseline, organizations apply the tailoring process to align the controls more closely with the specific conditions within the organization (i.e., conditions related to organizational risk tolerance, missions/business functions, information systems, or environments of operation).

The tailoring process includes: (i) identifying and designating common controls in initial security control baselines; (ii) applying scoping considerations to the remaining baseline security controls; (iii) selecting compensating security controls, if needed; (iv) assigning specific values to organization-defined security control parameters via explicit assignment and selection statements; (v) supplementing baselines with additional security controls and control enhancements, if needed;

and (vi) providing additional specification information for control implementation, if needed. Organizations use risk assessments to inform and guide the tailoring process for organizational information systems and environments of operation.

Threat data from risk assessments provide critical information on adversary capabilities, intent, and targeting that may affect organizational decisions regarding the selection of additional security controls, including the associated costs and benefits. Risk assessment results are also leveraged when identifying common controls to help determine if such controls available for inheritance meet the security requirements for the system and its environment of operation (including analyses for potential single points of failure).” to Task 2-2, Supplemental Guidance, paragraph 1.

06-05-2014 Substantive Deleted “selected” from item (iii) in Task 2-3, Supplemental Guidance. 26

06-05-2014 Substantive Deleted “selecting security controls to be monitored post deployment and for” from Task 2-3, Supplemental Guidance, paragraph 2. 26

06-05-2014 Substantive Changed “of such monitoring” to “with which security controls are monitored post deployment” in Task 2-3, Supplemental Guidance, paragraph 2. 26

06-05-2014 Substantive Changed “selection” to “frequency” in Task 2-3, Supplemental Guidance, paragraph

2. 26

06-05-2014 Substantive Changed “are assessed as frequently as necessary consistent with the criticality of the function and capability of the monitoring tools” to “may require more frequent assessment” in Task 2-3, Supplemental Guidance, paragraph 2.

06-05-2014 Substantive Deleted “selection of specific security controls to be monitored and the” from Task 2-3, Supplemental Guidance, paragraph 3. 26

06-05-2014 Substantive Deleted “such” from Task 2-3, Supplemental Guidance, paragraph 3. 26

06-05-2014 Substantive Added “NIST Special Publication 800-137 provides additional guidance on continuous monitoring and continuous monitoring strategies.” to Task 2-3, Supplemental Guidance, paragraph 4.

06-05-2014 Editorial Changed “;” to “,” after 800-53 in Task 2-3, References. 26 06-05-2014 Substantive Added “800-137” to Task 2-3, References. 26 06-05-2014 Substantive Deleted “and supplemented” from Milestone Checkpoint #2. 27

06-05-2014 Substantive Added “Early integration of information security requirements into the system development life cycle is the most cost-effective method for implementing the organizational risk management strategy at Tier 3.” to Task 3-1, Supplemental Guidance, paragraph 1.

06-05-2014 Substantive Added “Risk assessment may help inform decisions regarding the cost, benefit, and risk trade-offs in using one type of technology versus another for control implementation.” to Task 3-1, Supplemental Guidance, paragraph 1.

06-05-2014 Substantive Added “Risk assessment may help determine how gaps in protection needs between systems and common controls affect the overall risk associated with the system, and how to prioritize the need for compensating or supplementary controls to mitigate specific risks.” to Task 3-1, Supplemental Guidance, paragraph 2.

06-05-2014 Editorial Change “make” to “support” in Task 4-1, Supplemental Guidance, paragraph 2. 30

PAGE x

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

DATE TYPE CHANGE PAGE

06-05-2014 Substantive Added “or that are discovered post-development. Such weaknesses and deficiencies are potential vulnerabilities if exploitable by a threat source.” to Task 4- 4, Supplemental Guidance, paragraph 1.

06-05-2014 Substantive Added “provide important information that” to Task 4-4, Supplemental Guidance, paragraph 1. 32

06-05-2014 Editorial Change “facilitate” to “facilitates” in Task 4-4, Supplemental Guidance, paragraph

1. 32

06-05-2014 Substantive Added “, based on an initial or updated assessment of risk,” to Task 4-4, Supplemental Guidance, paragraph 1. 32

06-05-2014 Editorial

Moved “An updated assessment of risk (either formal or informal) based on the results of the findings produced during the security control assessment and any inputs from the risk executive (function), helps to determine the initial remediation actions and the prioritization of such actions.” in Task 4-4, Supplemental Guidance, paragraph 1.

06-05-2014 Substantive Added “the security control assessor reassesses” to Task 4-4, Supplemental Guidance, paragraph 1. 33

06-05-2014 Substantive Deleted “are reassessed” from Task 4-4, Supplemental Guidance, paragraph 1. 33

06-05-2014 Substantive Added “Did the assessor reassess the remediated controls for effectiveness to provide the authorization official with an unbiased, factual security assessment report on the weaknesses or deficiencies in the system?” to Milestone Checkpoint #4?

06-05-2014 Substantive Changed “mitigation” to “response” in Task 5-3, Supplemental Guidance, paragraph 1. 35

06-05-2014 Substantive

Added “After risk determination, organizations can respond to risk in a variety of ways, including: (i) accepting risk; (ii) avoiding risk; (iii) mitigating risk; (iv) sharing risk; (v) transferring risk; or (vi) a combination of the above. Decisions on the most appropriate course of action for risk response include some form of prioritization.

Some risks may be of greater concern than other risks. In that case, more resources may need to be directed at addressing higher-priority risks than at other lower-priority risks. This does not necessarily mean that the lower-priority risks are ignored. Rather, it could mean that fewer resources are directed at the lower-priority risks (at least initially), or that the lower-priority risks are addressed at a later time. A key part of the risk decision process is the recognition that regardless of the risk decision, there typically remains a degree of residual risk. Organizations determine acceptable degrees of residual risk based on organizational risk tolerance.” to Task 5-3, Supplemental Guidance, paragraph 1.

06-05-2014 Editorial Moved “Authorization termination dates are influenced by federal and/or organizational policies which may establish maximum authorization periods.” to second paragraph in Task 5-4, Supplemental Guidance.

06-05-2014 Substantive

Deleted “For example, if the maximum authorization period for an information system is three years, then an organization establishes a continuous monitoring strategy for assessing a subset of the security controls employed within and inherited by the system during the authorization period. This strategy allows all security controls designated in the respective security plans to be assessed at least one time by the end of the three-year period. This also includes any common controls deployed external to organizational information systems.” from Task 5-4, Supplemental Guidance, paragraph 3.

06-05-2014 Substantive

Added “As risk assessments are updated and refined, organizations use the results to modify security plans based on the most recent threat and vulnerability information available. Updated risk assessments provide a foundation for prioritizing/planning risk responses.” to Task 6-1, Supplemental Guidance, paragraph 2.

06-05-2014 Substantive Deleted “a selected subset of” from Task 6-2. 38

PAGE xi

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

DATE TYPE CHANGE PAGE

06-05-2014 Substantive Deleted “Organizations assess all security controls employed within and inherited by the information system during the initial security authorization.” from Task 6-2, Supplemental Guidance.

06-05-2014 Editorial Added “(i.e., during continuous monitoring)” after “initial authorization” to Task 6-2, Supplemental Guidance. 39

06-05-2014 Substantive Changed “a subset of the” to “all” in Task 6-2, Supplemental Guidance. 39

06-05-2014 Substantive Added “employed within and inherited by the information system” to Task 6-2, Supplemental Guidance. 39

06-05-2014 Editorial Deleted “during continuous monitoring” after “on an ongoing basis” from Task 6-2, Supplemental Guidance. 39

06-05-2014 Substantive Deleted “selection of appropriate security controls to monitor and the” from Task 6- 2, Supplemental Guidance. 39

06-05-2014 Editorial Changed “are” to “is” in Task 6-2, Supplemental Guidance. 39

06-05-2014 Substantive Added “in support of ongoing authorization and” to Task 6-2, Supplemental Guidance. 39

06-05-2014 Substantive Added “800-137” to Task 6-2, References. 39 06-05-2014 Editorial Changed “Publication” to “Publications” in Task 6-2, References. 39 06-05-2014 Editorial Changed “Decommissioning” to “Disposal” in Task 6-7, Title. 41 06-05-2014 Editorial Changed “decommissioning” to “disposal” in Task 6-7. 41

06-05-2014 Editorial Changed “decommissioning” to “disposal” in Task 6-7, Supplemental Guidance, two instances. 41

06-05-2014 Substantive Added “National Institute of Standards and Technology Special Publication 800- 128, Guide for Security-Focused Configuration Management of Information Systems, August 2011.” to Appendix A, References.

A-2

06-05-2014 Substantive Added “National Institute of Standards and Technology Special Publication 800- 137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, September 2011.” to Appendix A, References.

A-2

06-05-2014 Editorial Added definition of “Continuous Monitoring” to Appendix B, Glossary. B-3 06-05-2014 Editorial Added definition of “Risk Assessor” to Appendix B, Glossary. B-8 06-05-2014 Substantive Added “and control enhancements” to Appendix D, Section D.13, paragraph 1. D-7 06-05-2014 Substantive Deleted “a selected subset of” from Appendix E, Task 6-2. E-4 06-05-2014 Editorial Changed “Decommissioning” to “Disposal” in Appendix E, Task 6-7, Title. E-5 06-05-2014 Editorial Changed “decommissioning” to “disposal” in Appendix E, Task 6-7. E-5

06-05-2014 Substantive Added “Organizations provide an official designation (including any approvals required) for information systems that have transitioned from initial authorization to operate into an ongoing authorization approach.” to Appendix F, Section F.4, paragraph 1.

F-6

06-05-2014 Substantive Changed “adequately mitigate;” to “effectively respond to” in Appendix F, Section F.4, paragraph 2. F-6

06-05-2014 Editorial Moved “Formal reauthorization actions occur at the discretion of the authorizing official in accordance with federal or organizational policy.” from Appendix F, Section F.4, paragraph 2 to new Section F.5, Reauthorization, paragraph 1.

F-6

06-05-2014 Substantive Deleted “If a formal reauthorization action is required, organizations maximize the use of security and risk-related information produced during the continuous monitoring and ongoing authorization processes currently in effect.” from Appendix F, Section F.4, paragraph 2.

F-6

06-05-2014 Substantive Added “NIST Special Publication 800-137 provides additional guidance for Information Security Continuous Monitoring Programs.” to Appendix F, Section F.4, footnote 71.

F-6

PAGE xii

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

DATE TYPE CHANGE PAGE

06-05-2014 Substantive Deleted “Unless otherwise handled by continuous monitoring and ongoing authorization, event-driven reauthorizations can occur when there is a significant change to an information system or its environment of operation.” from Appendix F, Section F.4, paragraph 4.

F-7

06-05-2014 Substantive

Added “When an information system is under ongoing authorization, the system may be authorized for ongoing operation on a time-driven or event-driven basis, leveraging the security-related information generated by the continuous monitoring program. The system is reviewed and authorized for ongoing operation on a time-driven basis in accordance with the authorization frequency determined as part of the continuous monitoring strategy. The system is reviewed and authorized for ongoing operation on an event-driven basis when pre-defined (trigger) events occur or at the discretion of the authorizing official. Whether the authorization for ongoing operation is time-driven or event-driven, the authorizing official acknowledges ongoing acceptance of identified risks. The organization determines the level of formality required for such acknowledgement by the authorizing official.” to Appendix F, Section F.4, paragraph 3.

F-7

06-05-2014 Editorial Added new Section F.5, Reauthorization, to Appendix F. F-7

06-05-2014 Substantive Added “If a formal reauthorization action is required, organizations maximize the use of security and risk-related information produced as part of the continuous monitoring processes currently in effect.” to Appendix F, new Section F.5, paragraph 1.

F-7

06-05-2014 Editorial Changed “Reauthorization actions” to “Formal reauthorization actions” in Appendix F, new Section F.5, paragraph 1. F-7

06-05-2014 Substantive Added “(if one is specified)” to Appendix F, new Section F.5, paragraph 1. F-7

06-05-2014 Substantive

Added “If the information system is under ongoing authorization (i.e., a continuous monitoring program is in place that monitors all implemented common, hybrid, and system-specific controls with the frequency specified in the continuous monitoring strategy), time-driven reauthorizations may not be necessary. However, if the continuous monitoring program is not yet comprehensive enough to fully support ongoing authorization, a maximum authorization period can be specified by the authorizing official.” to Appendix F, new Section F.5, paragraph 1.

F-7

06-05-2014 Substantive

Added “For security control assessments associated with reauthorization, organizations leverage security-related information generated by the existing continuous monitoring program and fill in any gaps with manual or procedural assessments. Organizations may also supplement automatically-generated information with manually/procedurally-generated assessment information in situations where greater assurance is needed.” to Appendix F, new Section F.5, paragraph 2.

F-7

06-05-2014 Substantive

Deleted “For example, if the maximum authorization period for an information system is three years, then an organization establishes a continuous monitoring strategy for assessing a subset of the security controls employed within and inherited by the system during the authorization period. This strategy allows all security controls designated in the respective security plans to be assessed at least one time by the end of the three-year period. This also includes any common controls deployed external to organizational information systems.” from Appendix F, new Section F.5, paragraph 2.

F-7

06-05-2014 Substantive Deleted “thus supporting the concept of ongoing authorization” from Appendix F, new Section F.5, paragraph 2. F-7

PAGE xiii

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

DATE TYPE CHANGE PAGE

06-05-2014 Editorial

Moved “In the event that there is a change in authorizing officials, the new authorizing official reviews the current authorization decision document, authorization package, and any updated documents created as a result of the ongoing monitoring activities. If the new authorizing official is willing to accept the currently documented risk, then the official signs a new authorization decision document, thus formally transferring responsibility and accountability for the information system or the common controls inherited by organizational information systems and explicitly accepting the risk to organizational operations and assets, individuals, other organizations, and the Nation. If the new authorizing official is not willing to accept the previous authorization results (including identified level of risk), a reauthorization action may need to be initiated or the new authorizing official may instead establish new terms and conditions for continuing the original authorization, but not extend the original authorization termination date. In all situations where there is a decision to reauthorize an information system or the common controls inherited by organizational information systems, the maximum reuse of authorization information is strongly encouraged to minimize the time and expense associated with the reauthorization effort.” from Appendix F, Section F.4, paragraph 5 to new Section F.5, paragraph 3.

F-7

06-05-2014 Editorial Added new Section F.6, Event-Driven Triggers, to Appendix F. F-8

06-05-2014 Substantive

Added “Organizations may define event-driven triggers (i.e., indicators and/or prompts that cause a pre-defined organizational reaction) for both ongoing authorization and reauthorization. Event-driven triggers include, but are not limited to: (i) new threat/vulnerability/impact information; (ii) an increased number of findings, weaknesses, and/or deficiencies from the continuous monitoring program;

(iii) new missions/business requirements; (iv) a change in the Authorizing Official;

(v) a significant change in risk assessment findings; (vi) significant changes to the information system, common controls, or the environment of operation; or (vii) organizational thresholds being exceeded.” to Appendix F, new Section F.6.

F-8

06-05-2014 Editorial Changed “F.5” to “F.7” in Appendix F. F-8

06-05-2014 Editorial Changed “F.6” to “F.8” in Appendix F. F-9

06-05-2014 Substantive Deleted “Continuous monitoring is a proven technique to address the security impacts on an information system resulting from changes to the hardware, software, firmware, or operational environment.” from Appendix G, paragraph 1.

G-1

06-05-2014 Substantive Added “The following sections provide a general overview of some fundamental concepts associated with continuous monitoring. NIST Special Publication 800-137 provides additional guidance on the development and implementation of information security continuous monitoring programs.” to Appendix G, paragraph 1.

G-1

06-05-2014 Substantive Deleted “including the potential need to change or supplement the control set, taking into account any proposed/actual changes to the information system or its environment of operation” from Appendix G, Section G.1, paragraph 1.

G-1

06-05-2014 Editorial Changed “will require” to “requires” in Appendix G, Section G.1, paragraph 3. G-2

06-05-2014 Substantive

Changed “Configuration management and control processes for organizational information systems” to “Defining a continuous monitoring strategy based on risk tolerance that maintains clear visibility into assets, awareness of vulnerabilities, up-to-date threat information, and mission/business impacts” in Appendix G, Section G.1, paragraph 4.

G-2

06-05-2014 Substantive

Changed “Security impact analyses on proposed or actual changes to organizational information systems and environments of operation” to “Establishing and implementing a continuous monitoring program that includes monitoring all implemented controls at the organization-defined frequency” in Appendix G, Section G.1, paragraph 4.

G-2

06-05-2014 Editorial Moved footnote 84 marking to first sentence in Appendix G, Section G.1, paragraph 4; deleted “)” from footnote 84. G-2

PAGE xiv

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

DATE TYPE CHANGE PAGE

06-05-2014 Editorial Moved footnote 85 marking from third bullet to second bullet in Appendix G, Section G.1, paragraph 4. G-2

06-05-2014 Substantive Changed “Assessment of selected security controls (including system-specific, hybrid, and common controls) based on the organization-defined continuous monitoring strategy” to “Analyzing and reporting findings to appropriate organizational officials” in Appendix G, Section G.1, paragraph 4.

G-2

06-05-2014 Editorial Moved footnote 86 marking from fourth bullet to third bullet in Appendix G, Section G.1, paragraph 4. G-2

06-05-2014 Substantive Changed “Security status reporting to appropriate organizational officials” to “Responding to findings with mitigation, acceptance, transference/sharing, or avoidance/rejection” in Appendix G, Section G.1, paragraph 4.

G-2

06-05-2014 Substantive Changed “Active involvement by authorizing officials in the ongoing management of information system-related security risks” to “Reviewing and updating the continuous monitoring strategy and program to increase visibility into assets and awareness of vulnerabilities” in Appendix G, Section G.1, paragraph 4.

G-2

06-05-2014 Substantive

Deleted “With regard to configuration management and control, it is important to document the proposed or actual changes to the information system and its environment of operation and to subsequently determine the impact of those proposed or actual changes on the overall security state of the system. Information systems and the environments in which those systems operate are typically in a constant state of change (e.g., upgrading hardware, software, or firmware;

redefining the missions and business processes of the organization; discovering new threats). Documenting information system changes as part of routine SDLC processes and assessing the potential impact those changes may have on the security state of the system is an essential aspect of continuous monitoring, maintaining the current authorization, and supporting a decision for reauthorization when appropriate.” from Appendix G, Section G.1, paragraph 5.

G-2

06-05-2014 Substantive

Added “Continuous monitoring is a tactic in a larger strategy of organization-wide risk management. Organizations increase situational awareness through enhanced monitoring capabilities and subsequently increase insight into and control of the processes used to manage organizational security.” to Appendix G, Section G.1, paragraph 5.

G-2

06-05-2014 Substantive Changed “Selection of Security Controls for Monitoring” to “Frequency of Security Control Monitoring” in Appendix G, Section G.2, Title. G-2

06-05-2014 Substantive Deleted “selecting which security controls to monitor and for” from Appendix G, Section G.2, paragraph 1. G-2

06-05-2014 Editorial Changed “such” to “security control” in Appendix G, Section G.2, paragraph 1. G-2

06-05-2014 Editorial Changed “are” to “is” in Appendix G, Section G.2, paragraph 1. G-2

06-05-2014 Editorial Changed “reflect” to “reflects” in Appendix G, Section G.2, paragraph 1. G-2

06-05-2014 Substantive Changed “selection” to “frequency” in Appendix G, Section G.2, paragraph 1, two instances. G-2

06-05-2014 Substantive Changed “controls to be monitored and the frequency of the monitoring process” to “control monitoring” in Appendix G, Section G.2, paragraph 1. G-2

06-05-2014 Substantive Deleted “Priority for security control monitoring is given to the controls that have the greatest volatility and the controls that have been identified in the organization’s plan of action and milestones.” from Appendix G, Section G.2, paragraph 2.

G-3

06-05-2014 Substantive

Added “While a comprehensive discussion of considerations for determining monitoring frequencies is provided in NIST Special Publication 800-137, it is important to note that security controls that have the greatest volatility and the controls that have been identified in the organization’s plan of action and milestones are typically monitored more frequently.” to Appendix G, Section G.2, paragraph 2.

G-3

PAGE xv

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

DATE TYPE CHANGE PAGE

06-05-2014 Editorial Deleted “, therefore,” from Appendix G, Section G.2, paragraph 2. G-3

06-05-2014 Substantive Added “and therefore, require more frequent monitoring” to Appendix G, Section G.2, paragraph 2. G-3

06-05-2014 Substantive Added “Such controls may also require more frequent monitoring.” to Appendix G, Section G.2, paragraph 2. G-3

06-05-2014 Substantive Deleted “Organizations also consider specific threat information including known attack vectors (i.e., specific vulnerabilities exploited by threat sources) when selecting the set of security controls to monitor and the frequency of such monitoring.” from Appendix G, Section G.2, paragraph 2.

G-3

PAGE xvi

Special Publication 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

CHAPTER ONE

INTRODUCTION

THE NEED FOR INFORMATION SECURITY AND MANAGING RISK

rganizations4 depend on information technology and the information systems5 that are developed from that technology to successfully carry out their missions and business functions. Information systems can include as constituent components, a range of diverse computing platforms from high-end supercomputers to personal digital assistants and cellular telephones. Information systems can also include very specialized systems and devices (e.g., telecommunications systems, industrial/process control systems, testing and calibration devices, weapons systems, command and control systems, and environmental control systems). Federal information and information systems6 are subject to serious threats that can have adverse impacts on organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation7 by compromising the confidentiality, integrity, or availability of information being processed, stored, or transmitted by those systems.

Threats to information and information systems include environmental disruptions, human or machine errors, and purposeful attacks. Cyber attacks on information systems today are often aggressive, disciplined, well-organized, well-funded, and in a growing number of documented cases, very sophisticated. Successful attacks on public and private sector information systems can result in serious or grave damage to the national and economic security interests of the United States. Given the significant and growing danger of these threats, it is imperative that leaders at all levels of an organization understand their responsibilities for achieving adequate information security and for managing information system-related security risks.8

1.1 BACKGROUND

NIST in partnership with the Department of Defense (DoD), the Office of the Director of National Intelligence (ODNI), and the Committee on National Security Systems (CNSS), has developed a common information security framework for the federal government and its contractors. The intent of this common framework is to improve information security, strengthen risk management processes, and encourage reciprocity among federal agencies. This publication, developed by the Joint Task Force Transformation Initiative Working Group, transforms the traditional Certification and Accreditation (C&A) process into the six-step Risk Management Framework (RMF). The revised process emphasizes: (i) building information security capabilities into federal information systems through the application of state-of-the-practice management, operational, and technical security controls; (ii) maintaining awareness of the security state of information systems on an ongoing basis though enhanced monitoring processes; and (iii)

4 The term organization is used in this publication to describe an entity of any size, complexity, or positioning within an organizational structure…