DI-MGMT-82135 Tailored for M67854-18-R-2023 A009.pdf

DATA ITEM DESCRIPTION

Title: Naval Aviation Cybersecurity Risk Management Framework (RMF) Assessment and

Authorization Products, and CYBERSAFE Objective Quality Evidence, Assessment &

Authorization (A&A) Products

Number: DI-MGMT-82135 Approval Date: 20170726

AMSC Number: N9834 Limitation: N/A

DTIC Applicable: N/A GIDEP Applicable: N/A

Preparing Activity: AS Project Number: MGMT-2017-034

Applicable Forms: N/A

Use/relationship: This Data Description (DID) Item contains the format, content and intended use for the Cybersecurity Risk Management Framework (RMF) Assessment & Authorization

(A&A) products to be provided in support of the (state your program name).

This DID contains the format, content, and intended use information for the data product resulting from the work task.

Requirements:

1. Referenced documents: The applicable issue of the documents cited herein, including their approval dates and dates of any applicable amendments, notices, and revisions, shall be as specified in the contract.

1.1. DoDI 8500.01

1.2. DoDI 8510.01

2. Format: Contractor’s Format Acceptable

3. Content: The following products shall be provided in support of RMF A&A IAW DoDI

8500.01 and DoDI 8510.01. The provided products will be incorporated by the Government into the overall air system A&A package. Products shall be classified IAW the (Program

Name) Security Classification Guide provided as Government Furnished Information (GFI).

3.1. RMF System Security Plan – The Security Plan describes the security controls in place or planned for meeting cybersecurity requirements. The security plan will include expected implementation status, current implementation status, responsible entities, resources, and estimated completion dates. The Security Plan will also include a compiled list of system characteristics or qualities required for system registration (if required), key security-related documents such as a risk assessment, privacy impact assessment, system interconnection agreements, contingency plan, security configurations, configuration management plan, software lists, and hardware list.

Source: https://assist.dla.mil -- Downloaded: 2017-11-07T17:54Z Check the source to verify that this is the current version before use.

Eddie Cross-Out

DI-MGMT-82135

Reference the draft System Security Plan document provided as GFI.

3.2. Security Assessment Plan – For content, reference the following documents provided as

GFI:

3.2.1. National Institute of Standards and Technology Special Publication 800-53A, “Guide for Assessing the Security Controls in Federal Information Systems and

Organizations: Building Effective Security Assessment Plans”

3.2.2. Security Assessment Plan Template: The template includes information related to test objectives; schedule; limitations; personnel; related tests; location; equipment;

configurations; satisfactory/unsatisfactory criteria; entrance/exit criteria; logistics;

qualifications/certifications; security considerations; and test procedures.

3.3. Risk Assessment Report (RAR) – The focus of a risk assessment is to determine if there is residual risk associated with the security controls found to be non-compliant during the contractor’s assessment, leaving vulnerability. The Risk Assessment Report is used to capture any findings that will not be corrected prior to the control assessment in the Assess Phase and to communicate the contractor’s risk assessment results to the

Government to inform the final air system RMF authorization. Reference the GFI document “USN RMF RAR” for further content guidance.

3.4. Plan of Action and Milestones (POA&M) - The POA&M addresses all vulnerabilities identified during the contractor’s security control assessment. It will include:

3.4.1. Identify tasks that need to be accomplished to remediate or mitigate vulnerabilities

3.4.2. Specify resources required to accomplish the elements of the planned tasks

3.4.3. Include milestones for completing tasks and their scheduled completion dates

3.5. Security Assessment Report: The output and end result of the security control assessment is the security assessment report, which documents the assurance case for the system and is one of three key documents in the security authorization package developed by system owners and common control providers for authorizing officials.

The security assessment report to be provided per this CDRL includes the Contractor’s assessment of the findings to determine the effectiveness of the security controls employed within or inherited by the system. The security assessment report will include an assessment summary from the detailed findings that are generated during the security control assessment. The assessment summary will provide an abbreviated version a of

Security Assessment Report focusing on the highlights of the assessment, synopsis of key findings, and/or recommendations for addressing weaknesses and deficiencies in the security controls. The following elements are included in security assessment reports:

3.5.1. System name;

3.5.2. Security categorization;

3.5.3. Site(s) and/or systems assessed and assessment date(s);

3.5.4. Assessor’s name/identification;

Source: https://assist.dla.mil -- Downloaded: 2017-11-07T17:54Z Check the source to verify that this is the current version before use.

Eddie Cross-Out

DI-MGMT-82135

3.5.5. Previous assessment results (if reused);

3.5.6. Security control or control enhancement designator;

3.5.7. Selected assessment methods and objects;

3.5.8. Depth and coverage attributes values;

3.5.9. Assessment finding summary (indicating satisfied or other than satisfied

3.5.10. Assessor comments (weaknesses or deficiencies noted); and

3.5.11. Assessor recommendations (priorities, remediation, corrective actions, or improvements).

3.6. Information System Continuous Monitoring Strategy (ISCM) – The ISCM Strategy describes the system including the continuous monitoring requirements, system architecture, and interfaces. The ISCM Strategy also identifies key personnel, continuous monitoring tools, supporting processes, communication plan, and the continuous improvement plan.

End of DI-MGMT-82135

Source: https://assist.dla.mil -- Downloaded: 2017-11-07T17:54Z Check the source to verify that this is the current version before use.