![](media/image1.png){width="1.3208333333333333in"
height="1.3923611111111112in"}

**Small Business Administration**

**409 3^rd^ Street, S.W.**

**Washington, DC 20416**

**Small Business Administration**

**Automated Information Systems Security Program**

**SYSTEM SECURITY PLAN**

**TEMPLATE**

**DRAFT**

**March 2006**

**SSP Template Overview**

The attached template has been developed in accordance with
certification and accreditation guidance provided by Office of
Management and Budget (OMB) Circular A-130, *Management of Federal
Information Resources,* Appendix III, Security of Federal Automated
Information Resources; Title III of the E-Government Act, Federal
Information Security Management Act (FISMA) of 2002; and National
Institute of Standards and Technology (NIST) Special Publication (SP)
800-37, *Guide for Security Certification and Accreditation of Federal
Information Systems*, May 2004. It implements the revised format and
content guidance provided by NIST SP 800-18 Revision 1, *Guide for
Developing Security Plans for Federal Information Systems*, February
2006.

The Template includes guidance, highlighted in yellow, sample text in
*italics,* and example figures and tables. As an SSP is developed for a
particular SBA major application or general support system, the
highlighted text, sample text, and example tables and figure should be
removed and replaced with the text, tables, and figure appropriate for
the particular system.

Once an SSP has been drafted, it should be forwarded to the Director, IT
Security for review and comment/input. Once the final is completed, the
plan will be approved by the System Owner Representative and the Chief
Information Security Officer. The final SSP will be validated during the
certification and accreditation of the system and then incorporated as
Attachment A to the C&A Package for the system.

Once approved, an SSP should be updated, as necessary, for changes in
the system or its operating environment. Additionally, the SSP should be
reviewed annually to ensure that it remains current.

![](media/image1.png){width="1.270138888888889in"
height="1.3923611111111112in"}

**Small Business Administration**

**409 3^rd^ Street, S.W.**

**Washington, DC 20416**

**Small Business Administration**

**Automated Information Systems Security Program**

**SYSTEM SECURITY PLAN**

**FOR THE**

**[\<SYSTEM NAME (ACRONYM)\>]{.mark}**

**[\<Date\>]{.mark}**

**[\<Draft or Final\>]{.mark}**

**SYSTEM SECURITY APPROVAL**

**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**

**[\<System Owner's Representative\>]{.mark} Date**

**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**

**[\<Certifying Authority\>]{.mark} Date**

**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**

**[\<Accrediting Authority\>]{.mark} Date**

**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**

**[\<Accrediting Authority\>]{.mark} Date**

**PREFACE**

The objective of the System Security Plan (SSP) is to document the
protection of information technology (IT) resources. All Federal systems
have some level of sensitivity and require protection as part of good
management practice. The protection of a system must be documented in an
SSP. The completion of SSPs is a requirement of the Office of Management
and Budget (OMB) Circular A-130, *Management of Federal Information
Resources*, Appendix III, Security of Federal Automated Information
Resources.

The purpose of the SSP is to provide an overview of the security
requirements of the system and describe the controls in place or planned
for meeting those requirements. The plan also delineates
responsibilities and expected behavior of all individuals who access the
system. The SSP should be viewed as documentation of the structured
process of planning adequate, cost-effective security protection for a
system. This plan reflects input from various personnel with various
responsibilities on the system, including: information owners, the
system administrator, the system operator, and the system security
manager.

**TABLE OF CONTENTS**

PAGE

1.0 SYSTEM IDENTIFICATION [1](#system-identification)

1.1 System Name/Title [1](#system-nametitle)

1.2 System Category [1](#system-category)

1.3 System Owner [2](#system-owner)

1.4 Authorizing Official [2](#authorizing-official)

1.5 Information Contacts [2](#information-contacts)

1.6 Assignment of Security Responsibility
[2](#assignment-of-security-responsibility)

1.7 Information System Operational Status
[3](#information-system-operational-status)

1.8 Information System Type [3](#information-system-type)

1.9 General Description and Purpose
[3](#general-description-and-purpose)

1.10 System Environment [4](#system-environment)

1.11 System Interconnection/Information Sharing 4

1.12 Related Laws, Regulations, and Policies
[5](#related-laws-regulations-and-policies)

2.0 Minimum SECURITY CONTROL MEASURES
[7](#minimum-security-control-measures)

2.1 Management Controls [7](#management-controls)

> 2.1.1 Risk Assessment (RA) [7](#risk-assessment-ra)
>
> 2.1.2 System and Services Acquisition (SA)
> [9](#system-and-services-acquisition-sa)
>
> 2.1.3 Security Configuration Management (CM)
> [10](#security-configuration-management-cm)
>
> 2.1.4 Personnel Security (PS) [10](#personnel-security-ps)
>
> 2.1.5 Planning (PL) [11](#planning-pl)
>
> 2.1.6 Certification, Accreditation, and Security Assessments (CA) 12

2.2 Operational Controls 13

> 2.2.1 Physical and Environmental Protection (PE)
> [13](#physical-and-environmental-protection-pe)
>
> 2.2.2 Media Protection (MP) [14](#media-protection-mp)
>
> 2.2.3 Contingency Planning (CP) [15](#contingency-planning-cp)
>
> 2.2.4 Maintenance (MA) [16](#maintenance-ma)
>
> 2.2.5 System and Information Security (SI)
> [16](#system-and-information-security-si)
>
> 2.2.6 Awareness and Training (AT) [17](#awareness-and-training-at)
>
> 2.2.7 Incident Response (IR) [18](#incident-response-ir)

2.3 Technical Controls [18](#technical-controls)

> 2.3.1 Identification and Authentication (IA)
> [18](#identification-and-authentication-ia)
>
> 2.3.2 Access Control (AC) [19](#access-control-ac)
>
> 2.3.3 System Audit and Accountability (AU)
> [20](#system-audit-and-accountability-au)
>
> 2.3.4 System and Communications Protection (SC)
> [21](#system-and-communications-protection-sc)

APPENDIX A-1: Initial Risk Assessment 23

APPENDIX A-2: Configuration Management Plan 25

APPENDIX A-3: Rules of Behavior and Confidentiality Agreements 27

APPENDIX A-4: System Interconnection Agreements 29

APPENDIX A-5: C&A Documentation 31

**TABLES AND FIGURES**

Table A-1. Information Contacts 2

Table A-2. Major Equipment List 4

Table A-3. Interconnecting Systems 4

Table A-4. FIPS PUB 199 Security Categories 8

Figure A-1. System Architecture 5

# SYSTEM IDENTIFICATION

## System Name/Title

[\<System name and acronym\>]{.mark}

## System Category

**Federal Information Processing Standards Publication (FIPS PUB) 199
Category:**   [\<Select: High, Moderate, or Low\>]{.mark}

[\<Note: FIPS PUB 199 categories are defined as follows]{.mark}

-   [**High** -- The loss of confidentiality, integrity, or availability
    could be expected to have a severe or catastrophic adverse effect on
    organizational operations, organizational assets, or individuals.
    For example:]{.mark}

```{=html}
<!-- -->
```
-   [Severe degradation in or loss of mission capability to the extent
    and duration that the organization is not able to perform one or
    more of its primary functions]{.mark}

-   [Major damage to organizational assets]{.mark}

-   [Major financial loss]{.mark}

-   [Severe or catastrophic harm to individuals involving loss of life
    or serious life-threatening injury]{.mark}

    -   [**Moderate** -- The loss of confidentiality, integrity, or
        availability could be expected to have a serious adverse effect
        on organizational operations, organizational assets, or
        individuals. For example:]{.mark}

-   [Significant degradation in mission capability to the extent and
    duration that the organization is able to perform its primary
    functions, but with significantly reduced effectiveness]{.mark}

-   [Significant damage to organizational assets]{.mark}

-   [Significant financial loss]{.mark}

-   [Significant harm to individuals that does not involve loss of life
    or serious life-threatening injury]{.mark}

```{=html}
<!-- -->
```
-   [**Low** -- The loss of confidentiality, integrity, or availability
    could be expected to have a limited adverse effect on organizational
    operations, organizational assets, or individuals. For
    example:]{.mark}

```{=html}
<!-- -->
```
-   [Degradation in mission capability to the extent and duration that
    the organization is able to perform its primary functions, but with
    noticeably reduced effectiveness]{.mark}

-   [Minor damage to organizational assets]{.mark}

-   [Minor financial loss]{.mark}

-   [Minor harm to individuals]{.mark}

[Guidance is provided by the National Institute of Standards and
Technology (NIST) Special Publication (SP) 800-60 in mapping information
types and systems to FIPS PUB 199 categories.]{.mark}

[The rationale for the selection as it relates to confidentiality,
integrity, and availability should be explained in Section 2.1.1
(RA-2).\>]{.mark}

## System Owner

[\<Name and title (someone on the management board.)\>]{.mark}

## Authorizing Official

The system will be jointly accredited by:

> [\<Senior Management Authority\>]{.mark}
>
> [\<Title\>]{.mark}
>
> Small Business Administration (SBA)
>
> 409 3^rd^ Street, S.W.
>
> Washington, DC 20416
>
> [\<Phone\>]{.mark}
>
> [[\<E-mail\>]{.mark}](mailto:James.Rivera@sba.gov)

Christine H. Liu

Chief Information Officer

> Small Business Administration
>
> 409 3^rd^ Street, S.W.
>
> Washington, DC 20416
>
> \(202\) 205-6708
>
> [Christine.Liu@sba.gov](mailto:Charles.McClam@sba.gov)

## Information Contacts

The other designated points of contact are identified in Table A-1.

Table A-1. Information Contacts

  -------------- -------------- ----------------- ------------------------
  **System       **Name**       **Position**      **Phone/E-Mail**
  Role**                                          

  []{.mark}                                       

  []{.mark}                                       

  []{.mark}                                       

  []{.mark}                                       
  -------------- -------------- ----------------- ------------------------

## Assignment of Security Responsibility

[\<Name\>]{.mark}

[\<Title\>]{.mark}

[\<Office\>]{.mark}

> [\<Agency\>]{.mark}
>
> [\<Street Address\>]{.mark}
>
> [\<City, State\>]{.mark}

[\<Phone\>]{.mark}

[[\<E-mail\>]{.mark}](mailto:Ethel.Matthews@sba.gov)

[\<Note: Security responsibility will rest with the Chief Information
Security Officer (CISO), unless by a delegation memorandum, the
responsibility has been assigned to a security officer for the
system.\>]{.mark}

## Information System Operational Status

[\<System acronym\>]{.mark} is currently in the [\<specify\>]{.mark}
phase of its system life cycle.

## Information System Type

[\<System acronym\>]{.mark} is a [\<major application (MA) or general
support system (GSS)\>]{.mark} as defined by OMB Circular A-130,
Appendix III.

[\<Note: Definitions are as follows:]{.mark}

[[\<GSS]{.underline}: an interconnected set of information resources
under the same direct management control that shares common
functionality. It normally includes hardware, software, information,
data, applications, communications, and people.\>]{.mark}

[]{.mark}

[[\<MA]{.underline}: an application that requires special attention to
security due to the risk and magnitude of harm resulting from the loss,
misuse, unauthorized access to, or modification of the information in
the applications.\>]{.mark}

## General Description and Purpose

[\<Describe the function or purpose of the system and the information
processes it performs.\>]{.mark}

+-----------------------------------------------------------------------+
| [\<Sample text\>]{.mark}                                              |
|                                                                       |
| *The XYZ System is designed to meet the SBA's business need to        |
| identify and manage lending institutions and other organizations that |
| partner with the SBA. SBA partners provide services, such as          |
| SBA-guaranteed business loans, to the small business community. All   |
| financial institutions must have a formal agreement in place with the |
| SBA before they may process SBA loans. Each partner agreement is      |
| tracked via the XYZ System.*                                          |
|                                                                       |
| *Data on regulated commercial lenders (banks, savings & loan          |
| institutions, credit unions, etc.) is received via replication from   |
| SourceMedia in Chicago; as data is changed in SourceMedia's database  |
| in Chicago, it is automatically transmitted hourly to the XYZ         |
| System's database at SBA Headquarters. This ensures that data on      |
| lenders is up to date with mergers, acquisitions, name changes, etc.* |
|                                                                       |
| *The XYZ System database is accessed in read-only mode by users from  |
| approximately 60 field offices and SBA Headquarters, who access the   |
| system from the SBA's Local Area Network and Wide Area Network        |
| (LAN/WAN) and by the following systems: Entrepreneurial Development   |
| Management Information System (EDMIS-II), Electronic Lending          |
| (E-Lend/E-Tran), Micro-Loans Data Entry (MPERS), Guarantee Purchase   |
| Tracking System (GPTS), and CDC Management Reports.*                  |
|                                                                       |
| *In addition to collecting major information about partners (names,   |
| addresses, contacts, participation agreements, history, etc.), the    |
| XYZ System also assigns Financial Institution Reporting System (FIRS) |
| numbers to lenders and makes this information available to the Loan   |
| Accounting System (LAS) on a FIRS database resident on the SBA        |
| Mainframe -- Eagan. The XYZ System interconnects nightly with the     |
| Mainframe; the data is uploaded to the Mainframe as a flat file.      |
| There is no flow of information from the Mainframe to the XYZ System. |
| The XYZ System does not receive information from any system except    |
| the SourceMedia replication server.*                                  |
+-----------------------------------------------------------------------+

## System Environment 

[\<Provide a description of the technical system. Include a system
diagram and identification of major system components (hardware,
software, and communications equipment), including version/model
numbers. Include text callouts for Table A-2 and Figure A-1.\>]{.mark}

Table A-2. Major Equipment List

  ----------------- --------------- ------------------- ----------------------
  **Equipment       **Equipment**   **Function**        **Software/Version**
  Name**                                                

                                                        

                                                        

                                                        

                                                        

                                                        
  ----------------- --------------- ------------------- ----------------------

## System Interconnection/Information Sharing

+-----------------------------------------------------------------------+
| [\<Example Table\>]{.mark}                                            |
|                                                                       |
| Table A-3. Interconnecting Systems                                    |
|                                                                       |
| +--------+------------+----------+-----+-----+------------+-----+     |
| | *      | **Type of  | **In     | **F | **  | **A        | **  |     |
| | *Inter | Interco    | ter-conn | IPS | C&A | ccrediting | Org |     |
| | facing | nnection** | ection** | PUB | St  | A          | an- |     |
| | Sy     |            |          | 19  | atu | uthority** | iza |     |
| | stem** |            | *        | 9** | s** |            | tio |     |
| |        |            | *Authori |     |     |            | n** |     |
| |        |            | zation** |     |     |            |     |     |
| +--------+------------+----------+-----+-----+------------+-----+     |
+-----------------------------------------------------------------------+
| []{.mark}                                                             |
|                                                                       |
| +------------------------------------------------------------------+  |
| | +------+-----------+----------+----+-----+-----------+----+      |  |
| | | *SBA | *Intranet | *C&A     | *H | *   | *Jerry E. | *O |      |  |
| | | LAN/ | (AT&T     | Package  | ig | Acc | Williams* | CI |      |  |
| | | WAN* | managed   | for the  | h* | red |           | O* |      |  |
| | |      | frame     | XYZ      |    | -it |           |    |      |  |
| | |      | relay     | System*  |    | ed* |           |    |      |  |
| | |      | network   |          |    |     |           |    |      |  |
| | |      | and       |          |    |     |           |    |      |  |
| | |      | dedicated |          |    |     |           |    |      |  |
| | |      | lines)*   |          |    |     |           |    |      |  |
| | +------+-----------+----------+----+-----+-----------+----+      |  |
| | | *    | *SBA      | *C&A     | *H | *   | *Thomas   | *O |      |  |
| | | Loan | LAN/WAN*  | Package  | ig | Acc | Dumaresq* | CF |      |  |
| | | Ac   |           | for the  | h* | red |           | O* |      |  |
| | | coun |           | XYZ      |    | -it | *Calvin   |    |      |  |
| | | ting |           | System*  |    | ed* | Jenkins*  | *  |      |  |
| | | Sys  |           |          |    |     |           | OD |      |  |
| | | tem* |           |          |    |     | *Herbert  | A* |      |  |
| | |      |           |          |    |     | L.        |    |      |  |
| | |      |           |          |    |     | Mitchell* | *  |      |  |
| | |      |           |          |    |     |           | OC |      |  |
| | |      |           |          |    |     | *Jerry E. | A* |      |  |
| | |      |           |          |    |     | Williams* |    |      |  |
| | |      |           |          |    |     |           | *O |      |  |
| | |      |           |          |    |     |           | CI |      |  |
| | |      |           |          |    |     |           | O* |      |  |
| | +------+-----------+----------+----+-----+-----------+----+      |  |
| | | *ED  | *SBA      | *C&A     | *  | *Ac |           |    |      |  |
| | | MIS* | LAN/WAN*  | Package  | Mo | cre |           |    |      |  |
| | |      |           | for the  | d- | d-i |           |    |      |  |
| | |      |           | XYZ      | er | tat |           |    |      |  |
| | |      |           | System*  | at | ion |           |    |      |  |
| | |      |           |          | e* | Pe  |           |    |      |  |
| | |      |           |          |    | ndi |           |    |      |  |
| | |      |           |          |    | ng* |           |    |      |  |
| | +------+-----------+----------+----+-----+-----------+----+      |  |
| | | *MP  | *SBA      | *C&A     | *  | *   | *James    | *  |      |  |
| | | ERS* | LAN/WAN*  | Package  | Mo | Acc | Rivera*   | OF |      |  |
| | |      |           | for the  | d- | red |           | A* |      |  |
| | |      |           | XYZ      | er | -it | *Steven   |    |      |  |
| | |      |           | System*  | at | ed* | Galvan*   | *O |      |  |
| | |      |           |          | e* |     |           | CI |      |  |
| | |      |           |          |    |     |           | O* |      |  |
| | +------+-----------+----------+----+-----+-----------+----+      |  |
| | | *G   | *SBA      | *C&A     | *  | *   |           |    |      |  |
| | | PTS* | LAN/WAN*  | Package  | -* | \** |           |    |      |  |
| | |      |           | for the  |    |     |           |    |      |  |
| | |      |           | XYZ      |    |     |           |    |      |  |
| | |      |           | System*  |    |     |           |    |      |  |
| | +------+-----------+----------+----+-----+-----------+----+      |  |
| +------------------------------------------------------------------+  |
|                                                                       |
| \* Covered by the HQ DSS accreditation                                |
+-----------------------------------------------------------------------+

![](media/image2.wmf)

##  {#section .unnumbered}

##  {#section-1 .unnumbered}

##  {#section-2 .unnumbered}

##  {#section-3 .unnumbered}

##  {#section-4 .unnumbered}

##  {#section-5 .unnumbered}

##  {#section-6 .unnumbered}

##  {#section-7 .unnumbered}

##  {#section-8 .unnumbered}

##  {#section-9 .unnumbered}

## Related Laws, Regulations, and Policies 

The following Federal laws, directives, regulations, and SBA policy
provide guidance pertaining to the security of SBA automated information
systems (AISs):

-   Privacy Act of 1974 (Public Law \[PL\] 93-579, United States Code
    \[U.S.C.\] 552A)

-   Freedom of Information Act (5 U.S.C.522)

-   Federal Managers Financial Integrity Act of 1982 (PL 97-225, 31
    U.S.C. 1352)

-   Paperwork Reduction Act of 1986 (44 U.S.C. 35)

-   Electronic Communications Privacy Act of 1986 (PL 99-508)

-   Computer Fraud and Abuse Act of 1986, (PL 99-474, 18 U.S.C. 1030)

-   Information Technology Management Reform Act of 1996 (Clinger-Cohen
    Act) (Division E of PL 104-106, 4 U.S.C. 35)

-   Title III of the E-Government Act (PL 107-347): Federal Information
    Security Management Act of 2002 (FISMA)

-   Office of Management and Budget (OMB) Circular A-123, *Management
    Accountability and Control*, Attachment Section II, June 21, 1995

-   OMB Circular A-127, *Financial Management Systems*, revised July 23,
    1993

-   OMB Circular A-130, Appendix III, Transmittal #4, *Security of
    Federal Automated Information Resources*, February 8, 1996

-   SBA Standard Operating Procedure (SOP) 90-47.2, Automated
    Information Systems Security Program

-   Current SBA Procedural Notices (PNs) relating to security

-   Presidential Decision Directive (PDD) 67, Continuity of Government
    (COG) and Continuity of Operations (COOP) Plans Practices for
    Securing Critical Information and Information Systems and Networks,
    1988

-   Executive Order (EO) 12656, Assignment of Emergency Preparedness
    Responsibilities (COOP Plans), November 18, 1988, as amended by EO
    13074

-   EO 13011, Federal Information Technology, July 16, 1996

-   Homeland Security Presidential Directive (HSPD) 7, December 17, 2003

-   FIPS PUBs, including:

```{=html}
<!-- -->
```
-   FIPS PUB 199, *Standards for Security Categorization of Federal
    Information and Information Systems*

-   FIPS PUB 200, *Minimum Security Requirements for Federal Information
    and Information Systems*

```{=html}
<!-- -->
```
-   NIST SPs, including:

```{=html}
<!-- -->
```
-   NIST SP 800-18, Revision 1, *Guide for Developing Security Plans for
    Federal Information Systems*

-   NIST SP 800-37, *Guide for the Security Certification and
    Accreditation of Federal information Systems*

-   NIST SP 800-53, *Recommended Security Controls for Federal
    Information Systems*, and referenced supplemental guidance documents

-   NIST SP 800-60, *Guide for Mapping types of Information and
    Information Systems to Security Categories*

> [\<Update reference list and/or insert other references, as
> appropriate.\>]{.mark}

# Minimum SECURITY CONTROL MEASURES

## [\<This section should describe the implementation of the FIPS PUB 200/NIST SP 800-53 security controls as tailored for the SBA and for this specific system. Controls for each SSP should be selected based upon the FIPS PUB category of the system. They may be further tailored in accordance with NIST SP 800-53 guidance. An MS Access database of the SBA baseline security controls, NIST SP 800-53 minimum controls tailored based upon SBA policy, is available from IT Security.]{.mark} {#this-section-should-describe-the-implementation-of-the-fips-pub-200nist-sp-800-53-security-controls-as-tailored-for-the-sba-and-for-this-specific-system.-controls-for-each-ssp-should-be-selected-based-upon-the-fips-pub-category-of-the-system.-they-may-be-further-tailored-in-accordance-with-nist-sp-800-53-guidance.-an-ms-access-database-of-the-sba-baseline-security-controls-nist-sp-800-53-minimum-controls-tailored-based-upon-sba-policy-is-available-from-it-security. .unnumbered}

## [In subsections 2.1, 2.2, and 2.3, this template lists all of the controls for each of the NIST SP 800-53 control families (e.g., RA, SA, CM, etc.). During the tailoring process, it may be determined that some controls will not be selected for implementation based on the FIPS PUB 199 level of the system and should be so designated. It may be determined that some controls are not be applicable to the system (e.g., they relate to a technology not used by the system) and should be so designated. Some controls may be determined to be common to multiple systems. For common controls, refer to the SSP for GSS C&A Package. Common controls should be identified in the paragraph title along with the office responsible for management of the controls, e.g., "Risk Assessment Policy and Procedures (RA-1, Common Control Managed by OCIO)."]{.mark}  {#in-subsections-2.1-2.2-and-2.3-this-template-lists-all-of-the-controls-for-each-of-the-nist-sp-800-53-control-families-e.g.-ra-sa-cm-etc..-during-the-tailoring-process-it-may-be-determined-that-some-controls-will-not-be-selected-for-implementation-based-on-the-fips-pub-199-level-of-the-system-and-should-be-so-designated.-it-may-be-determined-that-some-controls-are-not-be-applicable-to-the-system-e.g.-they-relate-to-a-technology-not-used-by-the-system-and-should-be-so-designated.-some-controls-may-be-determined-to-be-common-to-multiple-systems.-for-common-controls-refer-to-the-ssp-for-gss-ca-package.-common-controls-should-be-identified-in-the-paragraph-title-along-with-the-office-responsible-for-management-of-the-controls-e.g.-risk-assessment-policy-and-procedures-ra-1-common-control-managed-by-ocio. .unnumbered}

## [Controls relating to policies and procedures managed by OCIO have been pre-filled into the template. These descriptions should be supplemented with any procedural controls that may have been established for the particular system or for a particular hosting facility. Upon request, IT Security will also develop/provide descriptions for any additional IT Security-managed controls applicable to particular systems.\>]{.mark} {#controls-relating-to-policies-and-procedures-managed-by-ocio-have-been-pre-filled-into-the-template.-these-descriptions-should-be-supplemented-with-any-procedural-controls-that-may-have-been-established-for-the-particular-system-or-for-a-particular-hosting-facility.-upon-request-it-security-will-also-developprovide-descriptions-for-any-additional-it-security-managed-controls-applicable-to-particular-systems. .unnumbered}

## Management Controls

This section describes the management control measures that are intended
to meet the protection requirements of [\<system acronym\>]{.mark}.
Management controls focus on the management of the computer security
system and the management of risk for the system. The types of control
measures shall be consistent with the need for protection of the
[\<MA/GSS\>]{.mark}.

### Risk Assessment (RA)

Risk Assessment Policy and Procedures (RA-1, Common Control Managed by
OCIO)

It is SBA policy to ensure that the balance of risks, vulnerabilities,
threats, and countermeasures achieves a residual level of risk that is
acceptable based on the sensitivity or criticality of the individual
information technology (IT) system. In accordance with SOP 90-47.2, it
is the System Owner's responsibility to prepare or oversee the
preparation of periodic risk assessments. Initial risk assessments are
performed in the design phase and updated periodically thereafter.
Support is provided by the Chief Information Security Officer (CISO).

Risk assessment procedures are described in the SBA's Certification and
Accreditation (C&A) Program Description. Procedures for periodic
vulnerability assessments of the SBA's resources are documented in the
Vulnerability Assessment Team Charter. Supplemental procedures are
required for outsourced systems.

[Security Categorization (RA-2)]{.underline}

The FIPS PUB 199 security category for [\<System Acronym\>]{.mark} has
been determined using guidance provided by NIST SP 800-60. The system
category assignment has been approved by the System Owner's
Representative and the Director, Information Security. The definitions
established by FIPS PUB 199 for each category are listed in Table A-4.

Table A-4. FIPS PUB 199 Security Categories

  -------------- -------------------------------------------------------------
  **Category**   **Definition**

  Low            Loss of confidentiality, integrity, or availability would
                 have a **limited** adverse impact and might: (1) cause a
                 degradation in mission capability to an extent and duration
                 that the organization is able to perform its primary
                 functions, but with noticeably reduced effectiveness; (2)
                 result in minor damage to organizational assets; (3) result
                 in minor financial loss; or (4) result in minor harm to
                 individuals.

  Moderate       Loss of confidentiality, integrity, or availability would
                 have a **serious** adverse impact and might: (1) cause a
                 significant degradation in mission capability to an extent
                 and duration that the organization is able to perform its
                 primary functions, but with significantly reduced
                 effectiveness; (2) result in significant damage to
                 organizational assets; (3) result in significant financial
                 loss; or (4) result in significant harm to individuals that
                 does not involve loss of life or serious life-threatening
                 injuries.

  High           Loss of confidentiality, integrity, or availability would
                 have a **severe or catastrophic** adverse impact and might:
                 (1) cause a severe degradation in or loss of mission
                 capability to an extent and duration that the organization is
                 not able to perform one or more of its primary functions; (2)
                 result in major damage to organizational assets; (3) result
                 in major financial loss; or (4) result in severe or
                 catastrophic harm to individuals involving loss of life or
                 serious life-threatening injuries.
  -------------- -------------------------------------------------------------

The category assigned for [\<System Acronym\>]{.mark} is
[\<category\>]{.mark}. The rationale is as follows:

-   **Confidentiality --** [\<level\>]{.mark}

[\<Explain\>]{.mark}

-   **Integrity --** [\<level\>]{.mark}

[\<Explain\>]{.mark}

-   **Availability --** [\<level\>]{.mark}

[\<Explain\>]{.mark}

Risk Assessment (RA-3)

Risk assessments follow NIST SP 800-30 methodology. [\<State one of the
following: "The most recent Risk Assessment Report for \<System
Acronym\> was completed \<date\>"; or, "An initial Risk Assessment is
included as Appendix A1".\>]{.mark}

[Risk Assessment Update (RA-4)]{.underline}

A risk assessment update is performed at least every three years and
additionally as required by changes to the system or its operating
environment.

[Vulnerability Scanning (RA-5)]{.underline}

The SBA has a Vulnerability Assessment Team (VAT) to perform regular
vulnerability assessments of the SBA's network and all critical systems
agencywide to secure its infrastructure. Scanning procedures use the
Foundstone Enterprise tool and rely upon nondestructive, network
vulnerability checking policies. Scans are conducted at least quarterly
and additionally as needed to support C&A.

[\<For outsourced systems and other systems that execute their own
vulnerability scans, this section should be replaced or expanded to
cover the implementation of this control for the system.\>]{.mark}

### System and Services Acquisition (SA)

[System and Services Acquisition Policy and Procedures (SA-1, Common
Control Managed by OCIO)]{.underline}

Security policies for the SBA's automated data processing (ADP)
contracts are defined in SOP 90-47.2. Policies require that contracts
that involve processing SBA data at the contractor's facility must
require administrative, technical, and physical security measures to
protect sensitive data from unauthorized disclosure or misuse and to
prevent unauthorized access to the system. The contractor must be
required to describe in his proposal the specific measures that will be
taken to comply with SBA policies. The SBA reserves the right to inspect
the contractor's security measures, data handling procedures, and other
security safeguards to determine the security posture of the
contractor's facility.

SOP 90-47.2 also defines policies regarding contractor personnel,
whether working in SBA facilities or in their own facility. Policies
cover requirements for separation of duties, background investigations,
awareness and training, rules of behavior, and confidentiality
agreements.

[Allocation of Resources (SA-2)]{.underline}

[Life Cycle Support (SA-3)]{.underline}

[Acquisitions (SA-4)]{.underline}

[Information System Documentation (SA-5)]{.underline}

[Software Usage Restrictions (SA-6)]{.underline}

[User Installed Software (SA-7)]{.underline}

[Security Design Principles (SA-8)]{.underline}

[Outsourced Information System Services (SA-9)]{.underline}

[Developer Configuration Management (SA-10)]{.underline}

[Developer Security Testing (SA-11]{.underline})

### Security Configuration Management (CM)

[Configuration Management Policies and Procedures (CM-1, Hybrid Control
Managed by OCIO and OGCBD)]{.underline}

As required by SOP 90-47.2, new systems and modifications to existing
systems must comply with the SBA's System Development Methodology (SDM).
In the SDM, configuration management plans are developed in the Initiate
Project phase; change control activities are initiated in the Define
Project phase and continue over the life cycle of the system.

The Configuration Management Plan for [\<System Acronym\>]{.mark} is
provided as Appendix [A2]{.mark}.

[Baseline Configuration (CM-2)]{.underline}

[Configuration Change Control (CM-3)]{.underline}

[Monitoring Configuration Changes (CM-4)]{.underline}

[Access Restrictions for Changes (CM-5)]{.underline}

[Configuration Settings (CM-6)]{.underline}.

[Least Functionality (CM-7)]{.underline}

### Personnel Security (PS)

[Personnel Security Policy and Procedures (PS-1, Common Controls Managed
by OCIO, OIG, and OHCM)]{.underline}

The SBA has implemented a personnel security program in accordance with
OMB Circular A-130, Appendix III, and Office of Personnel Management
guidance (5 CFR Parts 731 and 732). SOP 90-47.2 defines the SBA's
information security policies regarding personnel security for employees
and contractors. Policies cover requirements for separation of duties,
background investigations, awareness and training, rules of behavior,
and confidentiality agreements.

Detailed policies and procedures regarding background investigations and
position sensitivity classification are documented by Office of the
Inspector General (OIG) SOP 90-21 and Office of Human Capital Management
SOP 35-00.2A.

The SBA HSPD-12 policies for hiring new personnel will be covered by a
FIPS PUB 200 implementation PN, which is currently under review.

[Position Categorization (PS-2)]{.underline}

[Personnel Screening (PS-3)]{.underline}

[Personnel Termination (PS-4)]{.underline}

[Personnel Transfer (PS-5)]{.underline}

[Access Agreements (PS-6)]{.underline}

[[\<Reference the Rules of Behavior and Confidentiality Agreements
provided as Appendix A3.\>]{.underline}]{.mark}

[Third Party Personnel Security (PS-7)]{.underline}

[Personnel Sanctions (PS-8)]{.underline}

### Planning (PL)

[Security Planning Policies and Procedures (PL-1, Common Control Managed
by OCIO)]{.underline}

As required by SOP 90-47.2, new systems and modifications to existing
systems must comply with the SBA's SDM. In the SDM, a security plan is
initially developed during the Define System phase. During the C&A
process, the SSP will be validated and updated. C&A procedures are
described in the SBA's C&A Program Guide.

In accordance with FIPS PUB 200, minimum security controls for all
Federal IT systems must be selected during the planning process from
NIST SP 800-53, based upon the FIPS PUB 199 security category of the
system. An implementing PN has been prepared and is under review for
publication. Full implementation is required within all Federal agencies
by March 9, 2007.

[System Security Plan (PL-2)]{.underline}

[System Security Plan Update (PL-3]{.underline}

[Rules of Behavior (PL-4)]{.underline}

[Privacy Impact Assessment (PL-5)]{.underline}

### Certification, Accreditation, and Security Assessments (CA)

Certification, Accreditation, and Security Policies and Procedures
(CA-1, Common Control Managed by OCIO)

The SBA has implemented a security C&A program in accordance with OMB
Circular A-130, Appendix III, and NIST SP 800-37, *Guideline for
Computer Security Certification and Accreditation*. SBA SOP 90-47.2
assigns responsibilities for ensuring that only certified and accredited
systems are put into production. Procedures for C&A are described in the
C&A Program Description. The SBA C&A methodology used follows the
guidance provided by NIST SP 800-37.

[Security Assessments (CA-2)]{.underline}

The System Owner performs a self-assessment of system security controls
annually with the support of the Office of the Chief Information Officer
(OCIO). Beginning in Fiscal Year 2006, these self-assessments will be
designed to determine the extent to which the NIST SP 800-53 minimum
security controls are implemented correctly, operating as intended, and
producing the desired results with regard to the system's security
requirements. Prior to FY 2006, self-assessments were performed based
upon NIST SP 800-26 control objectives.

[Information System Connections (CA-3)]{.underline}

OMB Circular A-130, Appendix III, requires agencies to obtain written
management authorization before connecting an AIS to any other system.
The written authorization should define the rules of behavior and
controls that must be maintained for the system. Authorization is based
upon a determination of acceptable risk by the Accrediting Authority.
Guidance on format and required contents for an interconnection
agreement is provided by NIST SP 800-47. Each interconnection agreement
for the [\<System Acronym\>]{.mark} is documented in Appendix A-3.

[Security Certification (CA-4)]{.underline}

Security certification is defined as a comprehensive assessment of the
management, operational, and technical security controls in an
information system, made in support of security accreditation, to
determine the extent to which the controls are implemented correctly,
operating as intended, and producing the desired outcome with respect to
meeting security requirements for the system. SBA procedures for
security certification follow NIST SP 800-37 guidance. [\<State one of
the following: "The most recent certification of the \<System Acronym\>
was completed on \<date\>"; or, "An initial certification is
\<planned/in progress\>."\>]{.mark}

Plan of Action and Milestones (CA-5)

The SBA maintains a FISMA database that is used to produce FISMA Plan of
Action and Milestones (POA&M) reports. Vulnerabilities, countermeasure
planning data, and milestones are updated upon completion of
self-assessments, C&A Packages, continuous monitoring activities, and
audit reports. Status is updated at least quarterly.

[Security Accreditation (CA-6, Common Control Managed by OCIO
)]{.underline}

Accreditation is an official management decision made by a senior agency
official to authorize operation of an information system and to
explicitly accept risk to agency operations, agency assets, or
individuals, based on the agreed-upon set of security controls. The
system [\<is/will be\>]{.mark} jointly accredited by the [\<System
Accrediting Authority\>]{.mark} and the Chief Information Officer (CIO).
The accreditation is required at least every 3 years and additionally as
appropriate based upon changes to the system or its operating
environment. Re-accreditation may also be triggered by changes in
security policy or regulations. [\<State one of the following: "The most
recent accreditation was completed on \<date\>"; or, "The \<System
Acronym\> is \<currently/will be\> undergoing its initial certification
and accreditation."\>]{.mark}

[Continuous Monitoring (CA-7)]{.underline}

Continuous monitoring is performed in accordance with a continuous
monitoring plan approved by the System Owner's Representative and the
CISO. This plan is included as Attachment [\<X\>]{.mark} to this C&A
Package.

## Operational Controls

Operational controls include physical and environmental protection,
emergency planning, audit and variance detection, and maintenance of
application software, documentation, and periodic checks for viruses.

### Physical and Environmental Protection (PE)

[Physical and Environmental Protection Policies and Procedures (PE-1,
Common Control, Managed by OCIO)]{.underline}

The SBA's information security policies relating to physical and
environmental controls are documented in SOP 90-47.2. Requirements
include the following:

-   The responsibility of day-to day security management of a facility
    processing SBA data must be assigned to a specific individual
    knowledgeable in ADP technology and computer security methodology.

-   Automated physical security controls must be in place to limit
    physical access to only authorized personnel.

-   A list of authorized personnel must be maintained and access
    revalidated at least quarterly.

-   Physical, as well as technical, controls must be implemented to
    safeguard computer media.

-   Data-processing facilities must be equipped with auxiliary
    power-generating equipment that will provide sufficient power to
    allow graceful system shutdown in the event of a power failure.

The SBA HSPD-12 policies regarding physical access to secured areas will
be covered by a FIPS PUB 200 implementation PN, which is currently under
review.

[Physical Access Authorization (PE-2)]{.underline}

[Physical Access Control (PE-3)]{.underline}

[Access Control for Transmission Media (PE-4)]{.underline}

[Access Control and Display Medium (PE-5)]{.underline}

[Monitoring Physical Access (PE-6)]{.underline}

[Visitor Control (PE-7)]{.underline}

[Access Logs (PE-8)]{.underline}

[Power and Equipment Power Cabling (PE-9)]{.underline}

[Emergency Shutoff (PE-10)]{.underline}

[Emergency Power (PE-11)]{.underline}

[Emergency Lighting (PE-12)]{.underline}

[Fire Protection (PE-13)]{.underline}

[Temperature and Humidity Controls (PE-14)]{.underline}

[Water Damage Protection (PE-15)]{.underline}

[Delivery and Removal (PE-16)]{.underline}

[Alternate Work Site (PE-17)]{.underline}

### Media Protection (MP)

[Media Protection Policies and Procedures (MP-1, Common Control, Managed
by OCIO)]{.underline}

SBA policies regarding media access and the approved sanitization
methods and regarding

maintenance of sanitization action log are documented in SOP 90-47.2.
Magnetic media must be sanitized (i.e., information on such media must
be removed) prior to disposal by overwriting, degaussing, or
destruction. A log of who completed sanitization actions must be
maintained.

[Media Access (MP-2)]{.underline}

[Media Labeling (MP-3)]{.underline}

[Media Storage (MP-4)]{.underline}

[Media Transport (MP-5)]{.underline}

[Media Sanitization (MP-6)]{.underline}

[Media Destruction and Disposal (MP-7)]{.underline}

### Contingency Planning (CP)

[Contingency Planning Policy and Procedures (CP-1, Common Control,
Managed by OCIO)]{.underline}

SOP 90-47.2 documents the SBA's contingency planning policies.
Procedures are defined in the SBA Headquarters COOP Plan and similar
documents for other facilities. The Director of Information Security is
responsible for developing and maintaining the SBA Headquarters COOP
Plan, which provides detailed policies, responsibility assignment, and
procedures for the recovery and restoration of predefined critical
functions, relocation of personnel, and recovery of data following a
disaster disruption. The System Owner's Representative is responsible
for development and maintenance of business impact analyses and system
recovery plans/procedures for assigned systems. Document templates and
assistance are available from the Director of Information Security. The
Director of Information Security maintains the central files for
contingency planning documents. These are backed up and stored off-site.

[Contingency Plan (CP-2)]{.underline}

[Contingency Training (CP-3)]{.underline}

[Contingency Plan Testing (CP-4)]{.underline}

[Contingency Plan Update (CP-5)]{.underline}

[Alternate Storage Site (CP-6)]{.underline}

[Alternate Processing Site (CP-7)]{.underline}

[Telecommunications Services (CP-8)]{.underline}

[Information System Backup (CP-9)]{.underline}

[Information System Recovery and Reconstruction (CP-10)]{.underline}

### Maintenance (MA)

[System Maintenance Policy and Procedures (MA-1, Common Control, Managed
by OCIO)]{.underline}

SBA policy, documented in SOP 90-47.2, requires that applications follow
the SBA's SDM over the life cycle of the system. The SDM requires
independent validation and verification testing of maintenance change
solutions before they are placed into a production environment. A
historical record of the software and hardware changes should be
maintained, which helps ensure that only authorized changes are made to
the system. Version control should be used and a central library of
software programs should be maintained.

[Periodic Maintenance (MA-2)]{.underline}

[Maintenance Tools (MA-3)]{.underline}

[Remote Maintenance (MA-4)]{.underline}

[Maintenance Personnel (MA-5)]{.underline}

[Timely Maintenance (MA-6)]{.underline}

### System and Information Security (SI)

[System and Information Integrity Policy and Procedures (SI-1, Common
Control, Managed by OCIO)]{.underline}

SBA policy, documented in SOP 90-47.2, requires the following to protect
system and information security:

-   Effective virus protection

-   Timely security patches and updates

-   Timely correction or remediation of deficiencies found during
    periodic information security audits and internal reviews of
    security controls

-   Vulnerability assessments of Agency ADP resources

-   Periodic security test and evaluation for GSSs and MAs

-   Development and implementation of standard configuration guides

The SBA's Secure Baseline Configuration Standards have been developed to
providing detailed guidance for administrators for the following major
components of the SBA architecture:

-   Sybase and Oracle database management systems (DBMSs)

-   Solaris and Windows servers

-   Cisco -- IOS

-   Check Point Firewall 1

[Flaw Remediation (SI-2)]{.underline}

[Malicious Code Protection (SI-3)]{.underline}

[Intrusion Detection Tools and Techniques (SI-4)]{.underline}

[Security Alerts and Advisories (SI-5)]{.underline}

[Security Functionality Verification (SI-6)]{.underline}

[Software and Information Integrity (SI-7)]{.underline}

[Spam and Spyware Protection (SI-8)]{.underline}

[Information Input Restrictions (SI-9)]{.underline}

[Information Input Accuracy, Completeness, and Validity
(SI-10)]{.underline}

[Error Handling (SI-11)]{.underline}

[Information Output Handling and Retention (SI-12)]{.underline}

### Awareness and Training (AT)

[Security Awareness and Training Policy and Procedures (AT-1, Common
Control, Managed by OCIO)]{.underline}

SBA policy, documented in SOP 90-47.2, requires security awareness
training for both employees and contractors. There are two SBA courses
available: one for general users and one for District Security Officers
(DSOs), Information Resource Managers (IRMs), and the Field Support Team
(FST). OCIO issues an annual Information Notice to remind all employees
of the annual training requirement. OCIO maintains a database of
training completion. For users accessing via the LAN/WAN, this database
is automatically updated whenever a user successfully completes
training. For other users, such as outsourcing contractors, training
completion must be reported annually.

[Security Awareness (AT-2)]{.underline}

[Security Training (AT-3)]{.underline}

[Security Training Records (AT-4)]{.underline}

### Incident Response (IR)

[Incident Response Policy and Procedures (IR-1, Common Control, Managed
by OCIO)]{.underline}

SOP 90-47.2 establishes roles and responsibilities for reporting,
responding to, and investigation of security incidents. A Computer
Emergency Response Team (CERT) has been established to investigate
security-related incidents under the supervision of the Director,
Information Security. The SBA's CERT guide describes the composition of
the CERT and provides an overview of CERT procedures. It is available
from OCIO's home page on the SBA intranet.

[Incident Response Training (IR-2)]{.underline}

[Incident Response Testing (IR-3)]{.underline}

[Incident Handling (IR-4)]{.underline}

[Incident Monitoring (IR-5)]{.underline}

[Incident Reporting (IR-6)]{.underline}

[Incident Response Assistance (IR-7)]{.underline}

## Technical Controls

Technical controls that have been installed within [\<System
acronym\>]{.mark} operating environments provide the capabilities to
identify users, maintain access control, and monitor user activities.

### Identification and Authentication (IA)

[Identification and Authentication Policy and Procedures (IA-1, Common
Control, Managed by OCIO)]{.underline}

SOP 90-47.2 requires a unique user ID and password for each account.
Detailed policies and procedures regarding password usage and management
are documented. Password management standards are mandatory and apply to
all individual organizations and entities that process, store, or
transmit SBA information.

[User Identification and Authentication (IA-2)]{.underline}

[Device Identification and Authentication (IA-3)]{.underline}

[Identifier Management (IA-4)]{.underline}

[Authenticator Management (IA-5)]{.underline}

[Authenticator Feedback (IA-6)]{.underline}

[Cryptographic Module Authentication (IA-7)]{.underline}

### Access Control (AC)

[Access Control Policies and Procedures (AC-1, Common Control, Managed
by OCIO)]{.underline}

SOP 90-47.2 identifies responsibilities for securing access to the SBA's
IT resources and Agency policy regarding implementation of minimum
security controls. The SBA's Secure Baseline Configuration Standards
provide detailed guidance for administrators in configuring access
controls for the following major components in the SBA's architecture:

-   Sybase and Oracle DBMSs

-   Solaris and Windows servers

-   Cisco -- IOS

-   Check Point Firewall 1

[Account Management (AC-2)]{.underline}

[Access Enforcement (AC-3)]{.underline}

[Information Flow Enforcement (AC-4)]{.underline}

[Separation of Duties (AC-5)]{.underline}

[Least Privilege (AC-6)]{.underline}

[Unsuccessful Logon Attempts (AC-7)]{.underline}

[System Use Notification (AC-8)]{.underline}

[Previous Logon Notification (AC-9)]{.underline}

[Concurrent Session Control (AC-10)]{.underline}

[Session Lock (AC-11)]{.underline}

[Session Timeout (AC-12)]{.underline}

[Supervision and Review -- Access Control (AC-13)]{.underline}

[Permitted Actions Without Identification or Authentication
(AC-14)]{.underline}

[Automated Marking (AC-15)]{.underline}

[Automated Labeling (AC-16)]{.underline}

[Remote Access (AC-17)]{.underline}

[Wireless Access Restrictions (AC-18)]{.underline}

[Access Control for Portable and Mobile Devices (AC-19)]{.underline}

[Personally Owned Information Systems (AC-20)]{.underline}

### System Audit and Accountability (AU)

[Audit and Accountability Policy and Procedures (AU-1, Common Control,
Managed by OCIO)]{.underline}

SOP 90-47.2 identifies responsibilities for audit administration and
review. The SBA's Secure Baseline Configuration Standards provide
detailed guidance for administrators in configuring audit features for
the following major components in the SBA's architecture:

-   Sybase and Oracle DBMSs

-   Solaris and Windows servers

-   Cisco -- IOS

-   Check Point Firewall 1

There must be a separation of duties between personnel who administer
access control functions and personnel who administer the audit trail.

[Auditable Events (AU-2)]{.underline}

[Content of Audit Records (AU-3)]{.underline}

[Audit Storage Capacity (AU-4)]{.underline}

[Audit Processing (AU-5)]{.underline}

[Audit Monitoring, Analysis, and Reporting (AU-6)]{.underline}

[Audit Retention and Report Generation (AU-7)]{.underline}

[Time Stamps (AU-8)]{.underline}

[Protection of Audit Information (AU-9)]{.underline}

[Non-Repudiation (AU-10)]{.underline}

[Audit Retention (AU-11)]{.underline}

### System and Communications Protection (SC)

[System and Communications Policy and Procedures (SC-1, Common Control,
Managed by OCIO)]{.underline}

SOP 90-47.2 identifies responsibilities for system and communication
protection. Privacy policies documented by SOP 40-04.3 establish the
Agency's policies for implementing requirements of the Privacy Act. The
SBA's Secure Baseline Configuration Standards provide detailed guidance
for administrators in configuring features to protect systems and
communications assets in the SBA's architecture.

[Application Partitioning (SC-2)]{.underline}

[Security Function Isolation (SC-3)]{.underline}

[Information Remnants (SC-4)]{.underline}

[Denial of Service Protection (SC-5)]{.underline}

[Resource Priority (SC-6)]{.underline}

[Boundary Protection (SC-7)]{.underline}

[Transmission Integrity (SC-8)]{.underline}

[Transmission Confidentiality (SC-9)]{.underline}

[Network Disconnect (SC-10)]{.underline}

[Trusted Path (SC-11)]{.underline}

[Cryptographic Key Establishment and Management (SC-12)]{.underline}

[Use of Validated Cryptography (SC-13)]{.underline}

[Public Access Protections (SC-14)]{.underline}

Collaborative Computing (SC-15)

[Transmission of Security Parameters (SC-16)]{.underline}

Public Key Infrastructure Certificates (SC-17)

Mobile Code (SC-18)

[Voice over Internet Protocol (SC-19)]{.underline}

**APPENDIX A-1**

**Initial Risk Assessment**

[]{.mark}

[**\<**Insert a risk analysis that identifies potential threats and
potential impacts and addresses known vulnerabilities. NIST SP 800-30
methodology applies for determining levels of risk.\>]{.mark}

**APPENDIX A-2**

**Configuration Management Plan**

[]{.mark}

[\<Insert the system Configuration Management Plan.\>]{.mark}

**APPENDIX A-3**

**Rules of Behavior and Confidentiality Agreements**

[]{.mark}

[\<Insert the Rules of Behavior established for the system and the
confidentiality agreement for the system (if used).\>]{.mark}

**APPENDIX A-4**

**System Interconnection Agreements**

[]{.mark}

[\<Insert Memoranda of Understanding (MOUs) / System Interconnection
Agreements for system interconnections.\>]{.mark}

**APPENDIX A-5**

**C&A Documentation**

[]{.mark}

[\<Insert a list of C&A documents, indicating the document titles and
dates. IT Security will need a copy of each document. If any are company
proprietary, so that a copy cannot be provided, identify the location
and point of contact who can provide access to that document.]{.mark}

[]{.mark}

[List key documents such as the following:]{.mark}

[]{.mark}

-   [Privacy Impact Assessment]{.mark}

-   [Business Impact Analysis]{.mark}

-   [Contingency Plan]{.mark}

-   [Backup and Recovery Procedures (if not in the contingency
    plan)]{.mark}

-   [Incident Response Plan]{.mark}

-   [Security Awareness and Training Plan]{.mark}

-   [Security Configuration Checklists\>]{.mark}