Exhibit 1 - NAVCYBERFOR C A Team DIACAP Checklist V3.0.xlsx

XLSX spreadsheet 86 KB Posted Dec 20, 2011

Attached to: GTMO DIACAP CERTIFICATION
Solicitation number: N70272-12-Q-0005
Issued by: Department of the Navy Installations Command Naval Computer and Telecommunications

About this file

From the source

DIACAP CHECKLIST

View the file

Other files

File	Type	Posted
PASS APPLICATION blank.pdf	PDF	Dec 20, 2011
Standard Form 85P.pdf	PDF	Dec 20, 2011
GTMO	—	Dec 20, 2011

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Sheet1

SITE/COMMAND FULL NAME SYSTEM FULL NAME SYSTEM ACRONYM SYSTEM VERSION# UIC

C/U Platform Request Type CCSD DITPR-DON DADMS ID FAM Status Legacy CARS Case#

NATO Wireless NNPI MAC Level Mission Criticality PPS PIA Date E-Authentication Risk Assess. Annual Security Review Date Contingency Plan Test Date Impact Date

Program Manager IAM User Rep

Validator		UFFC CIO1 Rep		Jean Simmons
DOCUMENTS	VERSION	YES/NO	COMMENTS
SIP	No
Version	3.5	Yes/No
If Line Items Not Applicable Is N/A Annotated		Yes/No			No
Is Compliance Annotated in Line 42a-42i (Line 42 should be blank; box is just a header)		Yes/No			Yes
Impact Statement Annotated		Yes/No
DIACAP Team Roles Completed		Yes/No
C&A Plan	No
Plan is Dated & Version Listed On Cover Page (Date and Version Match Change Page/Version History)		Yes/No
Accreditation Type Annotated (Annotated either on the cover and /or within the document; Type Accreditation, Site Accreditation or System Accreditation)		Yes/No			No
Mission Description (Primary Mission Statement of the System/Site)		Yes/No			No
CONOPS Summary (If Type Accreditation ensure Fielding Sites or Plan is Annotated)		Yes/No			No
User Description and Clearances (Ensure # of users and Foreign National Info is Annotated)		Yes/No			Yes
NATO (If Applicable)		Yes/No			Yes
Operating and Computing Environment		Yes/No			Yes
Physical Security Measures/Facility		Yes/No
Threat Analysis (Ensure TEMPEST and COMSEC is annotate if applicable)		Yes/No
Security Roles (Ensure IAM is annotated/defined and if applicable, note the Guest Role)		Yes/No
System Architecture Diagram (Ensure NTD 08-08 Compliance)		Yes/No
Accreditation Boundary Diagram		Yes/No
Building and Location Annotated		Yes/No
Server/Components Name Annotated (Include Make, Model & Firmware Version Number)		Yes/No
IP Addresses Annotated		Yes/No
Cross Domain Solutions Annotated		Yes/No
Circuit Identifiers Annotated		Yes/No
Routers Depicted		Yes/No
Switches Depicted		Yes/No
IDS/Firewall Depicted		Yes/No
Any External Interfaces Other Than CCSD Depicted		Yes/No
Data Flow Diagram (In-Bound, Outbound or Both)		Yes/No
Hardware List		Yes/No
Device Name, Manufacture, Model#, Firmware		Yes/No
IA Enabled		Yes/No
CC Eval and Purpose		Yes/No
If Not Applicable, Annotated		Yes/No
Software List		Yes/No
Application		Yes/No
Version		Yes/No
IA Enabled		Yes/No
CC Eval		Yes/No
FAM Status		Yes/No
DADMS#		Yes/No
If Not Applicable, Annotated		Yes/No
Ports, Protocols and Services (PPS) Depicting Internal Ports from External Ports Acceptable; Include HBSS Port(s) if Applicable)		Yes/No
Port		Yes/No
Protocol		Yes/No
Description/Service		Yes/No
Classification		Yes/No
Boundary Crossed		Yes/No
Direction-Inbound/Outbound/Both		Yes/No
DoDI 8551.1 and NTD 08'10 Compliant		Yes/No
Configuration Management Plan Annotate IAVM Process/Plan; Who is Responsible for Patch Management Process; Patch Distribution and Patch Implementation)		Yes/No
C&A Tasks and Milestones		Yes/No
Contingency Plan (Annotate Business Continuity Plan, Disaster Recovery Plan and Incident Response Plan)		Yes/No
Implementation Plan	No
Ensure Correct IACs were used per the MAC and CL		Yes/No
Implementation Status (Ensure Yes and No is Annotated in Boxes; Appropriately and All Boxes are Annotated; Planned Box is Only Annotated in Activity One		Yes/No
Responsible Entity		Yes/No			Yes
Resources		Yes/No			No
Estimated Completion Date (Date Needed in Est; should be length of Accreditation after Activity One)		Yes/No
Comments (If Inherited, Enter the Specific; If N/A, Enter the Justification)		Yes/No
Ensure Traceability with other IAC Documents		Yes
Test Plan	No
All Applicable Tests Performed & Annotated (If Not Completed, Automatic CAT I Finding from Navy ODAA)		Yes/No
60 Days or Less from when Uploaded to IATS		Yes/No			Yes
Retina Scans Test Engine No Older than Two Versions Back Remediation Report and Executive Summary No Access Should Show 0 in Executive Report All Audits Must Be Checked IP Addresses Match C&A Plan, Test Plan and Reports All Ports are Accounted for on PPS Table or Explained		Yes/No			No
Gold Disk Scan Must Utilize Platinum Policy Ensure Correct Server Type Scanned All Unknowns Reviewed and Annotated Accordingly		Yes/No
STIGs/SRRs Checklist Raw Test Reports Must Utilize for any Test Pertaining to System/Application or Site that is not Automated		Yes/No
Traceability with Components in C&A Plan		Yes/No
Validation Report	No
Source Annotated in Inherited From Box		Yes/No
Not Applicable Justification Provided in Comments		Yes/No			Yes
Actual Results Box Status Annotated Correctly Example:		Yes/No			No
Applied Mitigation Annotated for each weakness (Mitigation should justify the Residual Risk entered in the CAT column and will be used on the POA&M )		Yes/No
CAT (Residual Risk Annotated as CAT I, II or III. If no mitigation applied, Raw Risk (Original DISA Severity Category) is used.		Yes/No
POA&M (Validator provides a recommendation on the finding if applicable and suggested mitigation actions for PM if no immediate mitigation applied or avail.		Yes/No
Risk Analysis Annotated by Validator Correctly Example:		Yes/No
If No Finding, No Action Needed		Yes/No
Ensure Traceability with other IAC Documents		Yes/No
POA&M	No
Ensure Header is Completed Correctly & Fully		Yes/No
Non-Compliant, Inherited Non-Compliant, False Positive and N/A IACs Should be Annotated		Yes/No			No
Date Last Updated (Must be Changed to Coincide with Last Date Document Content was Changed/Edited)		Yes/No			Yes
Weakness (Detailed Weakness Statement Pertaining to Specific Finding Provided)		Yes/No
CAT (Ensure Residual Risk or DIACAP Severity is Annotated)		Yes/No
IA Control (IA Control Associated/Assigned IRT Tools/STIGS/Checklists Used)		Yes/No
POC (Office or Organization Responsible for Resolving Weakness)		Yes/No
Resources Required (Annotate Funding, Manpower or Material; What’s Required to Resolve Weakness and Justify Security Costs)		Yes/No
Scheduled Completion Date (Date When Weakness will be Resolved; Should NOT be Changed nor Altered once entered; If CAT II, for an ATO MUST have Completion Date within 180 Days of Accreditation Decision w/Adequate Mitigation Plan or Milestones.)		Yes/No
Milestones w/Completion Dates (Specific Steps & Dates Required to Correct Weakness Entered Here; Entries Should Not Change Nor Be Deleted) Example:		Yes/No
Milestone Changes (Milestone Completion Dates Annotated Here)		Yes/No
Source Identifying Weakness (Identify Tool Utilized to Test the IAC and Specific Test/Audit ID) Example:		Yes/No
Status (Ongoing, Completed or Risk Accepted and Date) Example:		Yes/No
Comments Ensure Residual Risk or DIACAP Severity is Annotated Ensure Mitigation Statements are Sufficient and Adequate Request for ODAA to Accept Risk may be Annotated Here Ensure that “Zero-Day” Mitigation is used if possible to Lower Risk Ensure Adequate Explanation Provided for False Positives		Yes/No
N/A IA Controls If Applicable, Should be Reported in POA&M		Yes/No
Inherited Findings If Applicable, Should be Reported on Inherited Findings Tab		Yes/No
False Positives If Applicable, Should be Reported on False Positives Tab		Yes/No
Ensure Traceability with other IAC Documents (Particularly Implementation and Scorecard)		Yes/No
SCORECARD	No
Ensure Header is Completed Correctly & Fully Overall Risk Level Should Be Annotated Last Update Date is Entered Accreditation Information (Blank; For ODAA Use) Ensure Last Update Column is filled out		Yes/No			No
Ensure Traceability with other IAC Documents		Yes/No			Yes
ARTIFACTS	No
Retina Scans Test Engine No Older than Two Versions Back Remediation Report and Executive Summary No Access Should Show 0 in Executive Report All Audits Must Be Checked IP Addresses Match C&A Plan, Test Plan and Reports All Ports are Accounted for on PPS Table or Explained		Yes/No			No
Gold Disk Scan Must Utilize Platinum Policy Ensure Correct Server Type Scanned All Unknowns Reviewed and Annotated Accordingly		Yes/No			Yes
STIGs/SRRs Checklist Raw Test Reports Must Utilize for any Test Pertaining to System/Application or Site that is not Automated		Yes/No
S&S Document		Yes/No
C&A Package Signature Page		Yes/No
Contingency Plan		Yes/No
Contingency Plan Signature Page		Yes/No
Privacy Impact Assessment (If Applicable)		Yes/No
ARTIFACTS FOR CLASSIFIED	No
SCQ		Yes/No			No
PDS Compliancy Letter		Yes/No			Yes
Space Certification Letter		Yes/No
COMMENTS:

OLD IATS - NEW IATS -

Exhibit 1 &P

Sheet2

Sheet3 image1.png image2.png image3.png image4.png image5.png

File details come from the government source that posted it. Updated Nov 14, 2017.