OT-16-20077_Information_Assurance_(IA)_Test_Report_-_(Attachment_03).pdf

DATA ITEM DESCRIPTION

Title: Information Assurance (IA) Test Report

Number: OT-16-20077 AMSC Number: N/A DTIC Applicable: N/A Preparing Activity: AS/PMA-213 Applicable Forms: NIA

Approval Date: 20160804 ~ Limitation: N68335-16-R-0023 GIPDEP Applicable: N/ A Project Number: N/A

Use/Relationship: The IA Test Report will be used by the government to document IA testing that will assist in accreditation of the Commercial Off the Shelf (COTS) Integrated Logistic Support (ILS) to comply with the new Risk Management Framework IA policy.

This Data Item Description (DID) contains the format and content preparation instructions for the data resulting from the work task specified in the contract Statement of Work (SOW). This DID is for one time use for solicitation N68335-16-R-0023.

Requirements:

1. 0 Reference Documents:

NIST SP 800-37 Rev 1

NIST SP 800-137

NIST SP 800-30 Rev 1

NIST SP 800-39

NIST SP 800-53 Rev 4

NIST SP 800-53A Rev 4

Guide for Applying the Risk Management Framework to Federal Information Systems, dated February 2010

Information Security Continuous Monitoring for Federal Information Systems and Organizations, dated September 2011

Guide for Conducting Risk Assessments

Managing Information Security Risk: Organization, Mission, and Information System View, dated March 2011 Security and Privacy Controls for Federal Information Systems and Organizations, dated April 2013

Assessing Security and Privacy Controls in Federal Information Systems and Organizations, dated December 2014

2.0 Format. The IA Test Report shall be in the contractor's format.

3.0 Content: The report shall address the following sections:

a. Introduction

b. System Nomenclature

c. Purpose of the test

d. A description of the system/subsystem being tested.

e. Security Testing Boundary Diagram

f. Indicated Network topology with Test Points

g. Identify the DISA approved Test Tools used

h. Assumptions regarding test procedures, test conditions and test environment

OT-16-20077

i. Justification for any false positives and the following as shown in Figure 1:

(1) Finding Tracking Number

(2) Configuration Name and Nomenclature

(3) Affected Internet Protocol Address

(4) Network Node Name

(5) Title of STIG Reference including STIG Version

(6) STIG Reference Paragraph

(7) Applicable IA Controls

(8) Vulnerability Findings

(9) Rationale why compliance is not met

(10) Severity Risk Rating (Cat I, II, III)

(11) Consequence or Impact of vulnerability

(12) Recommendation for correcting the findings

( 13) Engineering Response

(14) Estimated Completion Date

(15) Status of Fix Verification

4.0 Media Requirement. The electronic media for the IA test report shall be Microsoft Word.

5.0 End of OT-16-20077.

DI-MGMT-81843

Figure 1

INFORMATION ASSURANCE FINDINGS MATRIX

Affected

Configuration Internet

Finding Protocol Network Finding or Consequence or Risk Engineering Estimated Status of Fix Tracking Nameand Number Nomenclature Address Name Vulnerability Impact Rating Recommendations Response Completion Date Verification Comments