DI-MGMT-82000 Tailored for M67854-18-R-2023 A008.pdf

DATA ITEM DESCRIPTION

Title: DOD Information Assurance Certification and Accreditation Process (DIACAP) and

Risk Management Framework (RMF) Deliverable Data

Number: DI-MGMT-82000 Approval Date: 20151014

AMSC Number: 9594 Limitation:

DTIC Applicable: GIDEP Applicable:

Office of Primary Responsibility: AS Project Number: MGMT-2015-021

Applicable Forms:

Use/relationship: The DIACAP and RMF Deliverable Data will be used to satisfy the requirements of the DIACAP and/or RMF process.

This Data Item Description (DID) contains the format, content, and intended use information for the data product resulting from the work task described by the contract.

Requirements:

1. Format. The DIACAP and/or RMF artifacts shall be delivered in a format approved by the

Government’s Designated Accrediting Authority (DAA), Authorizing Official (AO), or Information

Systems Security Manager (ISSM).

2. Content. The content of the DIACAP and/or RMF artifacts shall contain the necessary artifacts required by the DAA, AO, or ISSM to successfully achieve Platform IT Risk Approval (PRA), Interim Authority to Test (IATT), Interim Authority to Operate (IATO), or Authority to Operate

(ATO).

2.1 Introduction. This section shall contain a narrative of the DIACAP/RMF package content.

2.1.1 IATT Request. The IATT Request shall use the approved DAA, AO, or ISSM format. The

IATT Request shall identify the ‘who’, ‘what’, ‘why’, ‘where’, ‘when’, and ‘how’ of the requested

Test event. IATT Request shall be delivered not less than 30 days prior to the start of the Test

Event.

2.1.2 Certification and Accreditation (C&A) or Security Plan. The C&A or Security Plan shall use the approved DAA, AO, or ISSM format. The C&A Plan shall contain at a minimum, System

Information, Mission Description, Concept of Operations (CONOPS), Environment, Operating and

Computing Environment, Physical Security Measures, Facilities Descriptions, Threat Analysis, System Architecture Description, Components, Configurations, Accreditation Boundaries, Connection Process Guide (CPG) Compliant Network Diagrams, External Interfaces and Data Flow, Internal Data Flow, Contingency Plan, Incident Response Plan, User Descriptions and Clearances, Security Roles, Hardware Lists, Software Lists, Ports, Protocols, and Services (PPS), Configuration

Management Plan, Information Assurance Vulnerability Management (IAVM) Plan, and C&A Tasks and Milestones. The C&A Plan shall be approved and signed by the ISSM, User Rep, Program

Manager (PM), and DAA or AO.

Source: https://assist.dla.mil -- Downloaded: 2017-10-25T00:41Z Check the source to verify that this is the current version before use.

jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out

Eddie Cross-Out

Eddie Cross-Out

Eddie Cross-Out

DI-MGMT-82000

2.1.3 C&A Project Plan. The C&A Project Plan shall use the approved DAA, AO, or ISSM format.

The C&A Project Plan shall be approved and signed by the ISSM, Echelon II Representative, and

PM. The C&A Project Plan shall define the various C&A Tasks and Milestones needed to achieve

PRA, IATT, IATO, or ATO.

2.1.4 Collaboration Brief. The Collaboration Brief shall use the approved DAA, AO, or ISSM format. The Collaboration Brief is submitted with the DIACAP/RMF package and is used to describe the System and System Risk during the Collaboration meeting.

2.1.5 DIACAP Implementation Plan (DIP). The DIP shall use the approved DAA, AO, or ISSM format. The DIP shall be used during the DIP Concurrence meeting with the Echelon II, Navy CA, and ODAA. The DIP shall define which IA Controls (IACs) will be ‘Implemented’, ‘Inherited’, ‘Non-Compliant’, or ‘Not Applicable’. The DIP shall be approved by the DAA, AO, and ISSM prior to execution of the IA Test Plan.

2.1.6 PIT Implementation Plan (PIP). The PIP shall use the approved DAA, AO, or ISSM format.

The PIP shall be used during the PIT Concurrence meeting with the Echelon II, Navy CA, and

ODAA. The PIP shall define which IACs will be ‘Implemented’, ‘Inherited’, ‘Non-Compliant’, or

‘Not Applicable’. The PIP shall be approved by the DAA, AO, and ISSM prior to execution of the

IA Test Plan.

2.1.7 IA Test Plan. The IA Test Plan shall use the approved DAA, AO, or ISSM format. The IA

Test Plan shall define all required Vulnerability Scans, Security Technical Implementation Guides

(STIGs), Security Readiness Guides (SRGs), Secure Content Automation Protocol (SCAP) benchmarks, and IA Controls or Security Overlays to be applied to the System. The IA Test Plan shall be approved by the DAA, AO, and ISSM during the DIP or PIP Concurrence Meeting.

2.1.8 PIT Designation Request. The PIT Designation Request shall use the approved DAA, AO, or

ISSM format. The PIT Designation Request is the formal request to the DAA or AO that the System shall be designated as Platform IT (versus an Information System (IS)). The PIT Designation

Request shall be approved and a PIT Designation Letter shall be signed by the DAA or AO prior to the execution of the IA Test Plan.

2.1.9 PIT Determination Brief. The PIT Determination Brief shall use the approved DAA, AO, or

ISSM format. The PIT Determination Brief shall be used in conjunction with the PIT Designation

Request to formally request the System be designated Platform IT (versus and Information System).

2.1.10 Plan of Action and Milestones (POA&M). The POA&M shall use the approved DAA, AO, or ISSM format. The POA&M shall be considered a ‘living’ document and shall regularly be updated throughout the entire lifecycle of the System through Decommission. The POA&M shall contain all Not Applicable IA Controls, All Non-Compliant IA Controls, and all Non-Compliant

Vulnerability Findings as identified in the Vulnerability Scans, STIGs, SRGs, and SCAP

Benchmarks. At a minimum, the POA&M shall be updated monthly.

2.1.11 Privacy Impact Assessment (PIA). The PIA shall use the approved DAA, AO, or ISSM format. The PIA shall be approved and signed by the ISSM, PM, and the Command PIA Officer.

2.1.12 Vulnerability Scans. In accordance with the approved IA Test Plan, the System shall be scanned using the approved vulnerability scanning tools as identified by the DAA, AO, or ISSM.

Source: https://assist.dla.mil -- Downloaded: 2017-10-25T00:41Z Check the source to verify that this is the current version before use.

jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec

DI-MGMT-82000

The vulnerability scanner shall be updated with the latest signatures and scanning engines prior to the execution of each vulnerability scan. At a minimum, vulnerability scans shall be conducted monthly against the System. Non-compliant findings shall be documented in the System POA&M on a minimum monthly basis. At a minimum, vulnerability scans shall be submitted electronically to the

ISSM or uploaded into the DIACAP/RMF package. Vulnerability scans shall be handled in accordance with the System’s classification level. Vulnerability reports shall be in a format approved by the DAA, AO, or ISSM.

2.1.13 STIGs, SRGs, SCAP Benchmarks. In accordance with the approved IA Test Plan, the

System shall be hardened using the required and approved STIGs, SRGs, and SCAP Benchmarks.

Non-compliant STIG, SRG, and SCAP Benchmark findings shall be documented in the System

POA&M on a minimum monthly basis. Updates to the STIGs, SRGs, and SCAP Benchmarks are released on a monthly, quarterly, and yearly basis. Updates to the STIGs, SRGs, and SCAP

Benchmarks shall be implemented into the System as they are released. Non-compliant STIG, SRG, and SCAP Benchmark findings shall be documented in the System POA&M on a minimum monthly basis. STIG, SRG, and SCAP Benchmark artifacts shall be provided in a format approved by the

DAA, AO, or ISSM. STIG, SRG, and SCAP Benchmark artifacts shall be handled in accordance with the System’s classification level. At a minimum, STIG, SRG, and SCAP Benchmarks shall be submitted electronically to the ISSM or uploaded into the DIACAP/RMF Package on a minimum monthly basis.

2.1.14 Scorecard. The Scorecard shall use the approved DAA, AO, or ISSM format. The

Scorecard shall be maintained and updated on a minimum monthly basis.

2.1.15 Contingency Plan. The Contingency Plan shall use the approved DAA, AO, or ISSM format.

The Contingency Plan shall be submitted in conjunction with the System’s C&A Plan. The

Contingency Plan shall be approved and signed by the PM, ISSM, and DAA or AO.

2.1.16 IAVM Plan. The IAVM Plan shall use the approved DAA, AO, or ISSM format. The IAVM

Plan shall be submitted in conjunction with the System’s C&A Plan. The IAVM Plan shall be approved and signed by the PM, ISSM, and DAA or AO.

2.1.17 Cyber Security Waivers. Cyber Security Waivers shall use the approved DAA, AO, or ISSM format. All Cyber Security Waivers shall be approved and signed by the ISSM, PM, and First Flag or Equivalent prior to submission to the DAA or AO.

END OF: DI-MGMT-82000

Source: https://assist.dla.mil -- Downloaded: 2017-10-25T00:41Z Check the source to verify that this is the current version before use.

jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out SWSC LANT Updates POA&M jenningsec Cross-Out jenningsec Cross-Out jenningsec Cross-Out jenningsec