Incident Response
Federal agencies are required by law to report incidents to the US Computer Readiness Team (CERT) office in DHS and must have a formal incident response capability. Incident Response Methodology…
Plan of Action and Milestones POAMs
A POAM is a plan that describes specific measures to be taken to correct deficiencies found during a security control assessment. The POAM should identify: An organizational strategy for developing…
Rules of Behavior
Any information security policy and Site Security Plan (SSP) should contain a section known as “Rules of Behavior” that establishes appropriate use and behavior of system users and the consequences…
Policy and Procedure
Each of the seventeen families of security controls found in 800-53 contain a first control that requires the development of policy and procedures for that specific family of controls. Here…
Awareness and Training
KEY NIST DOCS:800-50
Site Security Plan SSP Overview
The security planning process eventually produces a Site Security Plan, known as the “Security Plan” or SSP. The security plan provides an overview of the security requirements of the system…
Assurance is the Reason to Trust
We want to trust that the measures we take to protect our information systems are working. But we need concrete reasons to hold that trust. We need proof that our…
Security Metrics
It is a mantra of quality improvement methodology that you can’t manage what you don’t measure. Security metrics are the measurements that allow management of information security. As function and…
Overlays of Tailored Security Controls
Tailoring security controls involves adapting the generic baseline sets of security controls to better fit a specific operating environment. Here is a list of tailoring activities: Once tailoring changes have…
Tailoring Security Controls
The NIST Risk Management Framework (RMF) is a six step process as follows: The second step begins with selecting a baseline of controls. This is done automatically, according to the…