OT-16-20078_Information_Assurance_(IA)_Test_Plan_(Attachment_04).pdf

DATA ITEM DESCRIPTION

Title: Information Assurance (IA) Test Plan

Number: OT-16-20078 AMSC Number: N/A DTIC Applicable: N/A

Preparing Activity: AS/PMA-213

Applicable Forms: NI A

Approval Date: 20160804 ~ Limitation: N68335-16-R-0023 GIPDEP Applicable: N/A

Project Number: N/A

Use/Relationship: The IA Test Plan will be used by the government to manage IA testing that will assist in accreditation of the Commercial Off the Shelf (COTS) Integrated Logistic Support (ILS) to comply with the new Risk Management Framework IA policy.

This Data Item Description (DID) contains the format and content preparation instructions for the data resulting from the work task specified in the contract Statement of Work (SOW). This DID is for one time use for solicitation N68335-16-R-0023.

Requirements:

1.0 Reference Documents:

NIST SP 800-37 Rev 1

NIST SP 800-137

NIST SP 800-30 Rev 1

NIST SP 800-39

NIST SP 800-53 Rev 4

NIST SP 800-53A Rev 4

CNNSI 1253

Guide for Applying the Risk Management Framework to Federal Information Systems, dated February 2010

Information Security Continuous Monitoring for Federal Information Systems and Organizations, dated September 2011

Guide for Conducting Risk Assessments

Managing Information Security Risk: Organization, Mission, and Information System View, dated March 2011

Security and Privacy Controls for Federal Information Systems and Organizations, dated April 2013

Assessing Security and Privacy Controls in Federal Information Systems and Organizations, dated December 2014

2.0 Format: The IA Test Plan shall be presented in a format similar to that of Figure 1.

3.0 Content. The plan shall contain the following Sections:

a. Introduction

b. System Nomenclature

c. A description of the system/subsystem being tested

d. Security Testing Boundary Diagram

e. Identify the applicable DISA approved Test Tools . f. Assumptions regarding test procedures, test conditions and test environment

g. Personnel Responsibility Matrix which identifies names, official job titles, and functions and responsibilities

OT-16-20078

h. The Security Test Procedures that address:

(1) Determining the risks and threat levels of the existing security implementations

(2) Network discovery procedures via automated tools

(3) Operating System discovery procedures via automated tools

( 4) Discovering ports, protocols and services via automated tools

(5) Conduct vulnerability scan via automated tools

(6) Host Based Testing

(7) Application Testing

(8) Manual testing via applicable Security Technical Implementation Guide (STIG)

(9) Addressing Information Assurance Controls as shown in Table 1 for Confidentiality -Moderate, Integrity-Low, Availability - Low

i. Justification for any False Positives

4.0 Media Requirement. The IA Test Plan electronic media shall be Microsoft Office Word.

5.0 End of OT-16-20078.

DI-MGMT-81844

Figure 1

INFORMATION ASSURANCE FINDINGS MATRIX

Finding Configuration Affected

Tracking Nameand Internet Estimated

Number Nomenclature Protocol Network Finding or Consequence Engineering Completion Status of Fix Address Name Vulnerability or Impact Risk Rating Recommendation Response Date Verification Comments