## CHANGE REQUEST COVER SHEET

## Change Request Number: 05-40 

## 

## Date Received: 4/13/05 (Revised 8/29/05)

**Title:** Information Systems Security Activity Descriptions

# **Name:** David Woodson

**Routing Symbol:** ATO-A, Acquisition and Procurement Policy Branch

**Phone:** 267-7601

**Policy OR Guidance:** Guidance

**Section/Text Location Affected:** Information Systems Security Process
Flowchart

**Summary of Change:** Process flowchart activity descriptions are
modified to reflect and be consistent with the December 2004 update to
AMS policy.

**Reason for Change:** The existing activity descriptions reflect
previous AMS policy and pre-ATO organization. The revision aligns the
activity descriptions with current policy and the ATO organization.

**Development, Review, and/or Concurrence:** Reviewed and approved by
the AIO Office of Information Systems Security.

**Target Audience:** AMS workforce

**Potential Links within FAST for the Change:** Information Systems
Security process flowchart.

#### Attachments: Change pages

### ASAG Briefing Conducted: None

**ASAG Responsibilities:** None

**System Process Flowchart / Information Systems Security**
~(Revised\ 05/2005)~

**Information Systems Security (ISS) Policy.** The FAA is required by
law, Federal Information Security Management Act of 2002 (FISMA), OMB
Circular A-130, and other federal standards to provide security for all
agency information that is collected, stored, processed, disseminated,
or transmitted using agency or non-agency owned information systems. ISS
measures ensure that the correct functioning of information processing
systems is protected from threats to confidentiality, integrity, and
availability. FAA has relatively few information systems that process
\"classified\" information (i.e., information related to national
security). However, almost all agency information systems, including the
Air Traffic Management system, process \"sensitive\" information subject
to federal information security requirements. Sensitive security
information is information that if disclosed, altered, forged, or
rendered unavailable or unreliable, could result in any of the following
(see FAA order 1600.75):

-   Seriously inhibited system operation;

-   Serious and widespread delays;

-   Damage to the public perception of air traffic control; or

-   Expenditure of significant resources by the FAA or users to
    reestablish National Airspace System (NAS) operations;

-   An unwarranted invasion of personal privacy;

-   Revelation of a trade secret or privileged or confidential
    commercial or financial information;

-   Be detrimental to the security of transportation; and

-   Possible loss of life ~(Added\ 01/2004)~

Given the broad scope of legislation and FAA policy requirements, ISS is
a principal concern for virtually every investment program, both
operational and administrative.

**Two-Track Approach for Achieving Information Systems Security.** The
FAA has a two-track approach for achieving agency-wide information
security. First, there is a focused effort to develop economy-of-scale
ISS standards for all information systems in the NAS since they all face
similar threats and require protection. Because the NAS is such a highly
interconnected \"system of systems\", a threat whose attack is
unsuccessful in one area could simply move on to another. Second,
individual systems are designed to be compliant with NAS ISS standards,
while at the same time being tailored to design requirements and
security vulnerabilities that may be highly system-specific. This second
set of activities is intended to ensure individual systems are compliant
with NAS Technical Architecture standards and tailored to specific
vulnerabilities and system design features.

ISS activities occur throughout the acquisition management lifecycle,
and are especially important in the early phases when requirements are
defined and investment programs are initiated. Activity begins in
earnest during concept and requirements definition when preliminary
program requirements are defined, and during initial investment analysis
when alternative solutions to mission need are developed sufficiently to
establish cost, schedule, performance, and benefits estimates. During
final investment analysis, the Investment Analysis Team develops
detailed plans and final requirements for the alternative solution
selected for implementation by the Joint Resources Council (JRC) at the
initial investment decision. ***ISS requirements and costs must be
included in the planning and requirement attachments to the Exhibit 300
Program Baseline, which is developed at this time.*** During solution
implementation, actual hardware, software, and facility components are
designed and acquired that satisfy ISS requirements. The new capability
is tested at the end of solution implementation to determine if it is in
compliance with ISS requirements. When a system is certified as
ISS-compliant, it becomes eligible for an in-service decision. During
in-service management, ISS activities focus on maintaining and operating
systems to minimize information security concerns, and on upgrading
performance as needed for protection against emerging or previously
undefended vulnerabilities. Commercial-off-the-shelf (COTS) products
often harbor ISS vulnerabilities that are discovered only after products
are released. All COTS product vendor websites must be continuously
monitored for announcement of these vulnerabilities, and appropriate
corrections must be implemented according to vendor recommendations. In
some instances, product upgrades may be developed as new threats are
identified. ~(Revised\ 01/2004)~ Figure 1 shows the phases in AMS
lifecycle and the ISS activities that occur in each phase.
~(Revised\ 05/2005)~

**Figure 1- Security Activities during the AMS Phases**
![](media/image1.png){width="7.0in" height="5.25in"}

FAA ISS program policy is contained in FAA Order 1370.82, as amended
([intranet.faa.gov/aio](http://fast.faa.gov/flowcharts/testflow/intranet.faa.gov/aio)).
For additional information regarding ISS policy and guidance, contact
Office of Information Systems Security, AIS-1. Also, see FAA
Certification and Accreditation Program policy contained in the current
version of the FAA ISS Program Handbook, as amended. For more
information contact the Certification and Compliance Division, AIS-300.
Additional requirements must be obtained from the line of business or
staff office information system security manager (ISSM) at:
intranet.faa.gov/aio. ~(Revised\ 05/2005)~

The following activities are executed during the AMS lifecycle
management process so that appropriately secure information systems are
acquired and operated. ~(Revised\ 01/2004)~

**ISS Work Activities During Concept and Requirements Definition**

**(CRD)** ~(Revised\ 05/2005)~

 

+-------------+-------------+-------------+---------------------------+
| **Activity: |             |             |                           |
| Gain        |             |             |                           |
| Familiarity |             |             |                           |
| with ISS    |             |             |                           |
| Elements of |             |             |                           |
| NAS         |             |             |                           |
| Technical   |             |             |                           |
| Ar          |             |             |                           |
| chitecture\ |             |             |                           |
| ISS-1**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **R         | **Product** | **Approval\ | **Tools and Aids**        |
| esponsible\ |             | Authority** |                           |
| Agent**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| Security    | ISS         | ISS         | FAA Enterprise            |
| systems     | elements of | Manager(s)  | Architecture              |
| engineering | NAS         | for the     |                           |
| member of   | Technical   | lines of    | Line of business / staff  |
| the CRD     | A           | business    | office specific guidance  |
| Team        | rchitecture | producing   | ~(Revised\ 05/2005)~      |
|             |             | and         |                           |
|             |             | operating   |                           |
|             |             | the system  |                           |
|             |             | or upgrade  |                           |
|             |             | being       |                           |
|             |             | acquired    |                           |
+-------------+-------------+-------------+---------------------------+
| **[Descri   |             |             |                           |
| ption]{.und |             |             |                           |
| erline}:**\ |             |             |                           |
| The CRD     |             |             |                           |
| Team must   |             |             |                           |
| be          |             |             |                           |
| thoroughly  |             |             |                           |
| familiar    |             |             |                           |
| with        |             |             |                           |
| Information |             |             |                           |
| System      |             |             |                           |
| Security    |             |             |                           |
| elements of |             |             |                           |
| the         |             |             |                           |
| Enterprise  |             |             |                           |
| Ar          |             |             |                           |
| chitecture. |             |             |                           |
| This        |             |             |                           |
| a           |             |             |                           |
| rchitecture |             |             |                           |
| contains    |             |             |                           |
| both the    |             |             |                           |
| "as-is" and |             |             |                           |
| "to-be"     |             |             |                           |
| repr        |             |             |                           |
| esentations |             |             |                           |
| of          |             |             |                           |
| automation  |             |             |                           |
| in the FAA  |             |             |                           |
| including   |             |             |                           |
| the         |             |             |                           |
| National    |             |             |                           |
| Airspace    |             |             |                           |
| System.     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **Activity: |             |             |                           |
| Gain        |             |             |                           |
| Familiarity |             |             |                           |
| with FAA    |             |             |                           |
| Security    |             |             |                           |
| Policy and  |             |             |                           |
| Process\    |             |             |                           |
| ISS-2**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **R         | **Product** | **Approval\ | **Tools and Aids**        |
| esponsible\ |             | Authority** |                           |
| Agent**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| Security    | FAA         | ISSM(s) for | [ISS Policy, FAA Order    |
| systems     | Security    | the lines   | 1370.82](javascript:p     |
| engineering | Policy and  | of business | ankshar('http://www1.faa. |
| member of   | Process     | producing   | gov/aio/common/documents/ |
| the CRD     |             | and         | HTMLfiles/1370_82.htm'))  |
| Team        |             | operating   |                           |
|             |             | the system  | ISS Policies, FAA 1370    |
|             |             | or upgrade  | series                    |
|             |             | being       |                           |
|             |             | acquired    | [ISS Program              |
|             |             |             | Handbook ](javasc         |
|             |             |             | ript:pankshar('http://int |
|             |             |             | ranet.faa.gov/aio/common/ |
|             |             |             | documents/InfoSec/ISS_Han |
|             |             |             | dbook_v3_signature.htm')) |
|             |             |             | (*Intranet Only)*         |
|             |             |             |                           |
|             |             |             | NIST special publication  |
|             |             |             | 800-series and FIPS 199   |
+-------------+-------------+-------------+---------------------------+
| **[Descri   |             |             |                           |
| ption]{.und |             |             |                           |
| erline}:**\ |             |             |                           |
| The CRD     |             |             |                           |
| Team must   |             |             |                           |
| become      |             |             |                           |
| thoroughly  |             |             |                           |
| familiar    |             |             |                           |
| with        |             |             |                           |
| Information |             |             |                           |
| System      |             |             |                           |
| Security    |             |             |                           |
| Policy (FAA |             |             |                           |
| Or          |             |             |                           |
| der1370.82, |             |             |                           |
| as amended) |             |             |                           |
| and the ISS |             |             |                           |
| Program     |             |             |                           |
| Handbook,   |             |             |                           |
| and         |             |             |                           |
| applicable  |             |             |                           |
| guidance    |             |             |                           |
| and         |             |             |                           |
| standards   |             |             |                           |
| issued by   |             |             |                           |
| the         |             |             |                           |
| National    |             |             |                           |
| Institute   |             |             |                           |
| of          |             |             |                           |
| Standards   |             |             |                           |
| and         |             |             |                           |
| Technology  |             |             |                           |
| (NIST).     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
|             |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **Activity: |             |             |                           |
| Interpret / |             |             |                           |
| Tailor      |             |             |                           |
| Security    |             |             |                           |
| Policy and  |             |             |                           |
| Re          |             |             |                           |
| quirements\ |             |             |                           |
| ISS-3**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **R         | **Product** | **Approval\ | **Tools and Aids**        |
| esponsible\ |             | Authority** |                           |
| Agent**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| Security    | ISS         | Line of     | ISS Program Handbook      |
| systems     | r           | business    |                           |
| engineering | equirements | ISSM and    | NIST SP 800-30, 800-18,   |
| member of   | for         | AIS- 300    | 800-26, and 800-37        |
| the CRD     | alternative |             |                           |
| Team with   | solutions   |             | Line of business or staff |
| support     |             |             | office policy,            |
| from the    |             |             | requirements, or          |
| Office of   |             |             | guidelines                |
| Information |             |             | ~(Revised\ 05/2005)~      |
| Systems     |             |             |                           |
| Security    |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **[Descri   |             |             |                           |
| ption]{.und |             |             |                           |
| erline}:**\ |             |             |                           |
| The CRD     |             |             |                           |
| Team        |             |             |                           |
| tailors ISS |             |             |                           |
| r           |             |             |                           |
| equirements |             |             |                           |
| for the     |             |             |                           |
| proposed    |             |             |                           |
| investment  |             |             |                           |
| o           |             |             |                           |
| pportunity. |             |             |                           |
| The nature  |             |             |                           |
| of the      |             |             |                           |
| tailoring   |             |             |                           |
| depends on: |             |             |                           |
|             |             |             |                           |
| -   The     |             |             |                           |
|             |             |             |                           |
| anticipated |             |             |                           |
|     user    |             |             |                           |
|             |             |             |                           |
|   community |             |             |                           |
|     (e.g.,  |             |             |                           |
|     FAA     |             |             |                           |
|     users   |             |             |                           |
|     only or |             |             |                           |
|     other   |             |             |                           |
|             |             |             |                           |
|  government |             |             |                           |
|     or      |             |             |                           |
|     non     |             |             |                           |
| -government |             |             |                           |
|     users); |             |             |                           |
|             |             |             |                           |
| -   The     |             |             |                           |
|             |             |             |                           |
|    relative |             |             |                           |
|             |             |             |                           |
| sensitivity |             |             |                           |
|     of the  |             |             |                           |
|             |             |             |                           |
| information |             |             |                           |
|     and     |             |             |                           |
|     fu      |             |             |                           |
| nctionality |             |             |                           |
|     being   |             |             |                           |
|             |             |             |                           |
|  threatened |             |             |                           |
|     (e.g.,  |             |             |                           |
|     highly  |             |             |                           |
|             |             |             |                           |
|   sensitive |             |             |                           |
|     or      |             |             |                           |
|             |             |             |                           |
| innocuous); |             |             |                           |
|             |             |             |                           |
| -   The     |             |             |                           |
|     system  |             |             |                           |
|     a       |             |             |                           |
| rchitecture |             |             |                           |
|     and     |             |             |                           |
|             |             |             |                           |
|    intended |             |             |                           |
|             |             |             |                           |
|    platform |             |             |                           |
|             |             |             |                           |
| safeguards; |             |             |                           |
|     and     |             |             |                           |
|             |             |             |                           |
| -           |             |             |                           |
|   Pertinent |             |             |                           |
|     ISS     |             |             |                           |
|     en      |             |             |                           |
| vironmental |             |             |                           |
|     factors |             |             |                           |
|     (e.g.,  |             |             |                           |
|     power   |             |             |                           |
|             |             |             |                           |
| reliability |             |             |                           |
|             |             |             |                           |
|  problems). |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **Activity: |             |             |                           |
| Incorporate |             |             |                           |
| ISS         |             |             |                           |
| R           |             |             |                           |
| equirements |             |             |                           |
| into the    |             |             |                           |
| Preliminary |             |             |                           |
| Program     |             |             |                           |
| R           |             |             |                           |
| equirements |             |             |                           |
| Attachment\ |             |             |                           |
| ISS-4**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **R         | **Product** | **Approval\ | **Tools and Aids**        |
| esponsible\ |             | Authority** |                           |
| Agent**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| Security    | ISS         | ISSM,       | [ISS Program              |
| systems     | r           | Service     | Handbook](javascr         |
| engineering | equirements | Team leader | ipt:pankshar('http://intr |
| member of   | for the     |             | anet.faa.gov/aio/common/d |
| the CRD     | preliminary |             | ocuments/InfoSec/ISS_Hand |
| Team        | Program     |             | book_v3_signature.htm'))  |
|             | R           |             |                           |
|             | equirements |             |                           |
|             | attachment  |             | [FAA NAS System           |
|             | to the      |             | Protection Profile ]()    |
|             | Exhibit 300 |             |                           |
|             | Program     |             | Line of business or staff |
|             | Baseline    |             | office implementation     |
|             |             |             | guidelines                |
|             |             |             | ~(Revised\ 05/2005)~      |
+-------------+-------------+-------------+---------------------------+
| **[Descri   |             |             |                           |
| ption]{.und |             |             |                           |
| erline}:**\ |             |             |                           |
| The CRD     |             |             |                           |
| Team works  |             |             |                           |
| with the    |             |             |                           |
| Office of   |             |             |                           |
| Information |             |             |                           |
| System      |             |             |                           |
| Security to |             |             |                           |
| incorporate |             |             |                           |
| preliminary |             |             |                           |
| ISS         |             |             |                           |
| r           |             |             |                           |
| equirements |             |             |                           |
| into the    |             |             |                           |
| preliminary |             |             |                           |
| Program     |             |             |                           |
| R           |             |             |                           |
| equirements |             |             |                           |
| attachment  |             |             |                           |
| to the      |             |             |                           |
| Exhibit 300 |             |             |                           |
| Program     |             |             |                           |
| Baseline.   |             |             |                           |
| These       |             |             |                           |
| preliminary |             |             |                           |
| r           |             |             |                           |
| equirements |             |             |                           |
| are the     |             |             |                           |
| basis for   |             |             |                           |
| development |             |             |                           |
| and         |             |             |                           |
| evaluation  |             |             |                           |
| of          |             |             |                           |
| alternative |             |             |                           |
| solutions   |             |             |                           |
| to mission  |             |             |                           |
| need. At    |             |             |                           |
| this stage, |             |             |                           |
| ISS         |             |             |                           |
| r           |             |             |                           |
| equirements |             |             |                           |
| may be      |             |             |                           |
| high-level  |             |             |                           |
| and         |             |             |                           |
| incomplete, |             |             |                           |
| but they    |             |             |                           |
| must        |             |             |                           |
| reflect the |             |             |                           |
| security of |             |             |                           |
| the FAA.    |             |             |                           |
| Section 3   |             |             |                           |
| of the NAS  |             |             |                           |
| System      |             |             |                           |
| Protection  |             |             |                           |
| Profile     |             |             |                           |
| provides    |             |             |                           |
| security    |             |             |                           |
| objectives, |             |             |                           |
| which must  |             |             |                           |
| be          |             |             |                           |
| considered  |             |             |                           |
| in          |             |             |                           |
| association |             |             |                           |
| with the    |             |             |                           |
| high-level  |             |             |                           |
| system      |             |             |                           |
| design and  |             |             |                           |
| potential   |             |             |                           |
| vuln        |             |             |                           |
| erabilities |             |             |                           |
| and         |             |             |                           |
| threats.    |             |             |                           |
|             |             |             |                           |
| **ISS Work  |             |             |                           |
| Activities  |             |             |                           |
| During      |             |             |                           |
| Initial     |             |             |                           |
| Investment  |             |             |                           |
| Analysis**  |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **Activity: |             |             |                           |
| Evaluate    |             |             |                           |
| ISS         |             |             |                           |
| Capability  |             |             |                           |
| of          |             |             |                           |
| Alternative |             |             |                           |
| Solutions   |             |             |                           |
| to Mission  |             |             |                           |
| Need\       |             |             |                           |
| ISS-5**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **R         | **Product** | **Approval\ | **Tools and Aids**        |
| esponsible\ |             | Authority** |                           |
| Agent**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| Security    | Evaluation  | A/ISSM(s),  | [ISS Program              |
| systems     | of the ISS  | ISS         | Handbook](javasc          |
| engineering | capability  | Ce          | ript:pankshar('http://int |
| member of   | of          | rtifier(s), | ranet.faa.gov/aio/common/ |
| the         | alternative |             | documents/InfoSec/ISS_Han |
| Investment  | solutions   | AIS-300,    | dbook_v3_signature.htm')) |
| Analysis    | to mission  | Designated  |                           |
| Team        | need        | Approving   | NIST SP 800-series        |
|             |             | Authority   |                           |
|             |             | (DAA)       | Line of business or staff |
|             |             |             | office implementation     |
|             |             |             | guidance                  |
|             |             |             | ~(Revised\ 05/2005)~      |
+-------------+-------------+-------------+---------------------------+
| **[Descri   |             |             |                           |
| ption]{.und |             |             |                           |
| erline}:**\ |             |             |                           |
| The         |             |             |                           |
| Investment  |             |             |                           |
| Analysis    |             |             |                           |
| Team        |             |             |                           |
| defines,    |             |             |                           |
| analyzes,   |             |             |                           |
| and         |             |             |                           |
| evaluates a |             |             |                           |
| number of   |             |             |                           |
| alternative |             |             |                           |
| solutions   |             |             |                           |
| to mission  |             |             |                           |
| need during |             |             |                           |
| initial     |             |             |                           |
| investment  |             |             |                           |
| analysis.   |             |             |                           |
| As part of  |             |             |                           |
| this        |             |             |                           |
| evaluation, |             |             |                           |
| the         |             |             |                           |
| Investment  |             |             |                           |
| Analysis    |             |             |                           |
| Team        |             |             |                           |
| develops an |             |             |                           |
| ISS         |             |             |                           |
| technical   |             |             |                           |
| description |             |             |                           |
| of          |             |             |                           |
| hardware,   |             |             |                           |
| software,   |             |             |                           |
| and         |             |             |                           |
| com         |             |             |                           |
| munications |             |             |                           |
| in          |             |             |                           |
| sufficient  |             |             |                           |
| detail to   |             |             |                           |
| allow       |             |             |                           |
| potential   |             |             |                           |
| vuln        |             |             |                           |
| erabilities |             |             |                           |
| to be       |             |             |                           |
| identified  |             |             |                           |
| and         |             |             |                           |
| assessed.   |             |             |                           |
|             |             |             |                           |
| Evaluating  |             |             |                           |
| the ISS     |             |             |                           |
| capability  |             |             |                           |
| of each     |             |             |                           |
| alternative |             |             |                           |
| solution    |             |             |                           |
| involves    |             |             |                           |
| the         |             |             |                           |
| following   |             |             |                           |
| four steps  |             |             |                           |
| which are   |             |             |                           |
| described   |             |             |                           |
| in detail   |             |             |                           |
| in the ISS  |             |             |                           |
| Program     |             |             |                           |
| Handbook:   |             |             |                           |
|             |             |             |                           |
| -   Vu      |             |             |                           |
| lnerability |             |             |                           |
|     ide     |             |             |                           |
| ntification |             |             |                           |
|     and     |             |             |                           |
|             |             |             |                           |
| assessment; |             |             |                           |
|             |             |             |                           |
| -   Risk    |             |             |                           |
|             |             |             |                           |
| assessment; |             |             |                           |
|             |             |             |                           |
| -   Risk    |             |             |                           |
|             |             |             |                           |
|  mitigation |             |             |                           |
|     plan;   |             |             |                           |
|     and     |             |             |                           |
|             |             |             |                           |
| -           |             |             |                           |
|    Residual |             |             |                           |
|     risk    |             |             |                           |
|             |             |             |                           |
|  assessment |             |             |                           |
|             |             |             |                           |
| These steps |             |             |                           |
| are         |             |             |                           |
| conducted   |             |             |                           |
| to the      |             |             |                           |
| appropriate |             |             |                           |
| level of    |             |             |                           |
| detail,     |             |             |                           |
| which is    |             |             |                           |
| less than   |             |             |                           |
| the vendor  |             |             |                           |
| will        |             |             |                           |
| perform     |             |             |                           |
| during      |             |             |                           |
| solution    |             |             |                           |
| impl        |             |             |                           |
| ementation, |             |             |                           |
| but         |             |             |                           |
| sufficient  |             |             |                           |
| to gain     |             |             |                           |
| confidence  |             |             |                           |
| in the ISS  |             |             |                           |
| capability  |             |             |                           |
| of each     |             |             |                           |
| alternative |             |             |                           |
| solution to |             |             |                           |
| meet the    |             |             |                           |
| security    |             |             |                           |
| r           |             |             |                           |
| equirements |             |             |                           |
| developed   |             |             |                           |
| in the      |             |             |                           |
| preliminary |             |             |                           |
| Program     |             |             |                           |
| R           |             |             |                           |
| equirements |             |             |                           |
| attachment  |             |             |                           |
| to the      |             |             |                           |
| Exhibit 300 |             |             |                           |
| Program     |             |             |                           |
| Baseline.   |             |             |                           |
|             |             |             |                           |
|             |             |             |                           |
|             |             |             |                           |
| **ISS Work  |             |             |                           |
| Activities  |             |             |                           |
| During      |             |             |                           |
| Final       |             |             |                           |
| Investment  |             |             |                           |
| Analysis**  |             |             |                           |
|             |             |             |                           |
| The         |             |             |                           |
| following   |             |             |                           |
| ISS         |             |             |                           |
| activities  |             |             |                           |
| are drawn   |             |             |                           |
| from the    |             |             |                           |
| ISS Program |             |             |                           |
| Handbook.   |             |             |                           |
| They turn   |             |             |                           |
| ISS         |             |             |                           |
| r           |             |             |                           |
| equirements |             |             |                           |
| into a      |             |             |                           |
| sound       |             |             |                           |
| imp         |             |             |                           |
| lementation |             |             |                           |
| strategy    |             |             |                           |
| and         |             |             |                           |
| detailed    |             |             |                           |
| planning.   |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **Activity: |             |             |                           |
| Incorporate |             |             |                           |
| ISS         |             |             |                           |
| R           |             |             |                           |
| equirements |             |             |                           |
| into Final  |             |             |                           |
| Program     |             |             |                           |
| R           |             |             |                           |
| equirements |             |             |                           |
| Attachment\ |             |             |                           |
| ISS-6**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **R         | **Product** | **Approval\ | **Tools and Aids**        |
| esponsible\ |             | Authority** |                           |
| Agent**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| IAT systems | Final ISS   | ISSM,       | [ISS Program Handbook]()  |
| engineering | r           | AIS-300     |                           |
| specialist  | equirements |             | [NAS Protection           |
| with        |             |             | P                         |
| assistance  |             |             | rofile](javascript:panksh |
| by the      |             |             | ar('http://www1.faa.gov/a |
| Office of   |             |             | io/common/documents/HTMLf |
| Security &  |             |             | iles/NAS_PP_Tmp_v1.htm')) |
| Hazardous   |             |             |                           |
| Materials   |             |             | NIST SP 800 37, Guidance  |
| and Office  |             |             | on Certification and      |
| of          |             |             | Accreditation             |
| Information |             |             |                           |
| Systems     |             |             | NIST SP 800-65,           |
| Security    |             |             | Integrating Security into |
|             |             |             | the Capital Planning and  |
|             |             |             | Investment Control        |
|             |             |             | Process                   |
|             |             |             |                           |
|             |             |             | OMB Circular A-11,        |
|             |             |             | Exhibit 300, Guidance on  |
|             |             |             | Capital Investment        |
|             |             |             | Business Cases            |
|             |             |             |                           |
|             |             |             | Line of business or staff |
|             |             |             | office guidance           |
|             |             |             | ~(Revised\ 05/2005)~      |
+-------------+-------------+-------------+---------------------------+
| **[Descri   |             |             |                           |
| ption]{.und |             |             |                           |
| erline}:**\ |             |             |                           |
| By the end  |             |             |                           |
| of the      |             |             |                           |
| investment  |             |             |                           |
| analysis,   |             |             |                           |
| the         |             |             |                           |
| Investment  |             |             |                           |
| Analysis    |             |             |                           |
| Team will   |             |             |                           |
| have        |             |             |                           |
| defined a   |             |             |                           |
| set of      |             |             |                           |
| final       |             |             |                           |
| r           |             |             |                           |
| equirements |             |             |                           |
| (including  |             |             |                           |
| Information |             |             |                           |
| System      |             |             |                           |
| Security    |             |             |                           |
| req         |             |             |                           |
| uirements). |             |             |                           |
| The final   |             |             |                           |
| Program     |             |             |                           |
| R           |             |             |                           |
| equirements |             |             |                           |
| attachment  |             |             |                           |
| to the      |             |             |                           |
| Exhibit 300 |             |             |                           |
| Program     |             |             |                           |
| Baseline    |             |             |                           |
| reflects    |             |             |                           |
| the final   |             |             |                           |
| set of ISS  |             |             |                           |
| r           |             |             |                           |
| equirements |             |             |                           |
| that will   |             |             |                           |
| be          |             |             |                           |
| satisfied   |             |             |                           |
| during      |             |             |                           |
| solution    |             |             |                           |
| impl        |             |             |                           |
| ementation. |             |             |                           |
| An updated  |             |             |                           |
| risk        |             |             |                           |
| assessment  |             |             |                           |
| identifies  |             |             |                           |
| any         |             |             |                           |
| remaining   |             |             |                           |
| ISS risks   |             |             |                           |
| that will   |             |             |                           |
| **not** be  |             |             |                           |
| protected.  |             |             |                           |
| These       |             |             |                           |
| residual    |             |             |                           |
| risks must  |             |             |                           |
| be          |             |             |                           |
| explicitly  |             |             |                           |
| a           |             |             |                           |
| cknowledged |             |             |                           |
| and         |             |             |                           |
| accepted by |             |             |                           |
| the         |             |             |                           |
| operators   |             |             |                           |
| of the      |             |             |                           |
| system at   |             |             |                           |
| the final   |             |             |                           |
| investment  |             |             |                           |
| decision.   |             |             |                           |
| These       |             |             |                           |
| residual    |             |             |                           |
| risks must  |             |             |                           |
| be          |             |             |                           |
| considered  |             |             |                           |
| during any  |             |             |                           |
| preplanned  |             |             |                           |
| product     |             |             |                           |
| i           |             |             |                           |
| mprovements |             |             |                           |
| or other    |             |             |                           |
| system      |             |             |                           |
| upgrades    |             |             |                           |
| and         |             |             |                           |
| en          |             |             |                           |
| hancements. |             |             |                           |
| All         |             |             |                           |
| residual    |             |             |                           |
| risks must  |             |             |                           |
| be          |             |             |                           |
| documented  |             |             |                           |
| and risk    |             |             |                           |
| assessment  |             |             |                           |
| updated as  |             |             |                           |
| specified   |             |             |                           |
| in FAA      |             |             |                           |
| policies,   |             |             |                           |
| re          |             |             |                           |
| quirements, |             |             |                           |
| and         |             |             |                           |
| imp         |             |             |                           |
| lementation |             |             |                           |
| guidelines. |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **Activity: |             |             |                           |
| Incorporate |             |             |                           |
| ISS Cost,   |             |             |                           |
| Schedule,   |             |             |                           |
| Per         |             |             |                           |
| formance, \ |             |             |                           |
| Benefits    |             |             |                           |
| into the    |             |             |                           |
| Exhibit 300 |             |             |                           |
| Program     |             |             |                           |
| Baseline\   |             |             |                           |
| ISS-7**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| **R         | **Product** | **Approval\ | **Tools and Aids**        |
| esponsible\ |             | Authority** |                           |
| Agent**     |             |             |                           |
+-------------+-------------+-------------+---------------------------+
| Security    | Exhibit 300 | Service     | [ISS Program              |
| systems     | Program     | Team leader | Handbook](javasc          |
| engineering | Baseline    |             | ript:pankshar('http://int |
| member of   | containing  | Business    | ranet.faa.gov/aio/common/ |
| the         | ISS         | case        | documents/InfoSec/ISS_Han |
| Investment  | p           | analysis    | dbook_v3_signature.htm')) |
| Analysis    | erformance, | member of   |                           |
| Team        | costs,      | the         | OMB Circular A-11.        |
|             | schedule,   | Investment  | Exhibit 300 Guidance,     |
|             | and         | Analysis    | Federal Enterprise        |
|             | benefits    | Team        | Architecture Performance  |
|             |             |             | Reference Model           |
|             |             |             |                           |
|             |             |             | NIST SP 800-65,           |
|             |             |             | Integrating Security into |
|             |             |             | the Capital Planning and  |
|             |             |             | Investment Control        |
|             |             |             | Process                   |
|             |             |             |                           |
|             |             |             | NIST SP 800-55, ISS       |
|             |             |             | Metrics                   |
+-------------+-------------+-------------+---------------------------+
| **[Descri   |             |             |                           |
| ption]{.und |             |             |                           |
| erline}:**\ |             |             |                           |
| The         |             |             |                           |
| Investment  |             |             |                           |
| Analysis    |             |             |                           |
| Team        |             |             |                           |
| develops an |             |             |                           |
| Exhibit 300 |             |             |                           |
| Program     |             |             |                           |
| Baseline    |             |             |                           |
| that sets   |             |             |                           |
| out the     |             |             |                           |
| p           |             |             |                           |
| erformance, |             |             |                           |
| cost,       |             |             |                           |
| schedule,   |             |             |                           |
| and benefit |             |             |                           |
| baselines   |             |             |                           |
| to be       |             |             |                           |
| achieved.   |             |             |                           |
| Information |             |             |                           |
| System      |             |             |                           |
| Security    |             |             |                           |
| p           |             |             |                           |
| erformance, |             |             |                           |
| cost        |             |             |                           |
| schedule,   |             |             |                           |
| and benefit |             |             |                           |
| factors     |             |             |                           |
| ***must***  |             |             |                           |
| be          |             |             |                           |
| included.   |             |             |                           |
+-------------+-------------+-------------+---------------------------+

**\
ISS Activities during the Solution Implementation Phase**

  ----------------- ----------------- ----------------- -----------------
  **Activity:                                           
  Develop the ISS                                       
  Section of the                                        
  System                                                
  Specification\                                        
  ISS-8**                                               

  **Responsible\    **Product**       **Approval\       **Tools and
  Agent**                             Authority**       Aids**
  ----------------- ----------------- ----------------- -----------------

+----------------+-----------------+-----------------+-----------------+
| Service Team   | ISS             | Specification   | [ISS Program    |
| systems        | requirements in | Control Board   | Handbook](j     |
| engineering    | the System      |                 | avascript:panks |
| specialist     | Specification   |                 | har('http://int |
| working with   |                 |                 | ranet.faa.gov/a |
| the Office of  |                 |                 | io/common/docum |
| Security &     |                 |                 | ents/InfoSec/IS |
| Hazardous      |                 |                 | S_Handbook_v3_s |
| Materials and  |                 |                 | ignature.htm')) |
| Office of      |                 |                 |                 |
| Information    |                 |                 | [FAA NAS System |
| Systems        |                 |                 | Protection      |
| Security       |                 |                 | Profile](ja     |
|                |                 |                 | vascript:panksh |
|                |                 |                 | ar('http://www1 |
|                |                 |                 | .faa.gov/aio/co |
|                |                 |                 | mmon/documents/ |
|                |                 |                 | HTMLfiles/NAS_P |
|                |                 |                 | P_Tmp_v1.htm')) |
|                |                 |                 |                 |
|                |                 |                 | Line of         |
|                |                 |                 | business /      |
|                |                 |                 | staff office    |
|                |                 |                 | guidance        |
|                |                 |                 | ~(Rev           |
|                |                 |                 | ised\ 05/2005)~ |
+----------------+-----------------+-----------------+-----------------+

  --------------------------------- ----------------- ----------------- -----------------
  **[Description]{.underline}:**\                                       
  The Service Team develops a                                           
  System Specification, which                                           
  includes Information System                                           
  Security requirements, as a                                           
  prelude to seeking a vendor                                           
  through the source selection                                          
  process. The Service Team may                                         
  choose to include residual ISS                                        
  requirements as options in the                                        
  System Specification to allow                                         
  vendors to bid system designs                                         
  that meet these requirements as                                       
  part of a best-value award by the                                     
  FAA. If so, satisfaction of these                                     
  residual requirements must be                                         
  identified as an evaluation                                           
  factor in the Screening                                               
  Information Request. Requirements                                     
  met by other NAS or                                                   
  infrastructure systems such as                                        
  telecommunications and                                                
  corresponding engineering and                                         
  development tasks are deleted                                         
  from the tailored Security                                            
  Requirements list in accordance                                       
  with the results of the risk                                          
  analysis and decision by the DAA,                                     
  ISSM, Certification and                                               
  Accreditation (C&A) Agent,                                            
  Service Team leader, and end-user                                     
  representative. Often, residual                                       
  ISS requirements are stated in a                                      
  lower level of detail than                                            
  previously written. The NAS                                           
  System Protection Profile                                             
  provides more detailed                                                
  requirements that can be tailored                                     
  to meet system requirements.                                          

  **Activity: Develop ISS                                               
  Implementation Strategy for Part                                      
  1 of the Implementation Strategy                                      
  and Planning Attachment\                                              
  ISS-9**                                                               

  **Responsible\                    **Product**       **Approval\       **Tools and
  Agent**                                             Authority**       Aids**
  --------------------------------- ----------------- ----------------- -----------------

+----------------+-----------------+-----------------+-----------------+
| Service Team   | ISS strategy in | Service Team    | [NIST SP 800-14 |
| systems        | Part 1 of the   | leader          | Guideline on    |
| engineer       | Implementation  |                 | Security        |
| working with   | Strategy and    | System security | Information     |
| the Office of  | Planning        | engineer        | Systems         |
| Internal       | attachment to   |                 | ](javascript:pa |
| Security and   | the Exhibit 300 | Office of       | nkshar('http:// |
| Office of      | Program         | Investigation   | csrc.nist.gov/p |
| Information    | Baseline for    | (ASN) personnel | ublications/')) |
| Systems        | satisfying ISS  |                 |                 |
| Security       | requirements    | Office of       | [NIST SP 800-27 |
|                |                 | Internal        | Engineering     |
|                |                 | Security (AIN)  | Principles for  |
|                |                 | physical        | ISS             |
|                |                 | security        | ](javascript:pa |
|                |                 | specialists     | nkshar('http:// |
|                |                 |                 | csrc.nist.gov/p |
|                |                 | Affected lines  | ublications/')) |
|                |                 | of business     |                 |
|                |                 | A/ISSM(s)       | NIST SP 800-36, |
|                |                 |                 | Guide to        |
|                |                 |                 | Selecting       |
|                |                 |                 | Security        |
|                |                 |                 | Products        |
|                |                 |                 |                 |
|                |                 |                 | NIST SP 800-50, |
|                |                 |                 | Security        |
|                |                 |                 | Awareness and   |
|                |                 |                 | Training        |
|                |                 |                 | Programs        |
|                |                 |                 |                 |
|                |                 |                 | NIST SP 800-53, |
|                |                 |                 | Guide to        |
|                |                 |                 | Security        |
|                |                 |                 | Controls        |
|                |                 |                 |                 |
|                |                 |                 | Line of         |
|                |                 |                 | business /      |
|                |                 |                 | staff office    |
|                |                 |                 | guidance        |
|                |                 |                 | ~(Rev           |
|                |                 |                 | ised\ 05/2005)~ |
+----------------+-----------------+-----------------+-----------------+

  --------------------------------- ----------------- ----------------- -----------------
  **[Description]{.underline}:**\                                       
  The Service Team decides how best                                     
  to implement Information System                                       
  Security requirements, and                                            
  summarizes this approach in Part                                      
  1 of the Implementation Strategy                                      
  and Planning attachment to the                                        
  Exhibit 300 Program Baseline.                                         

  **Activity: Develop ISS Tasks for                                     
  Part 2 of the Implementation                                          
  Strategy and Planning Attachment\                                     
  ISS-10**                                                              

  **Responsible\                    **Product**       **Approval\       **Tools and
  Agent**                                             Authority**       Aids**
  --------------------------------- ----------------- ----------------- -----------------

+----------------+-----------------+-----------------+-----------------+
| Service Team   | ISS tasks in    | Service Team    | ISS Program     |
| systems        | Part 2 of the   | leader          | Handbook        |
| engineer       | Implementation  |                 |                 |
| working with   | Strategy and    | System security | Line of         |
| the Office of  | Planning        | engineer        | business /      |
| Security and   | attachment to   |                 | staff office    |
| Hazardous      | the Exhibit 300 | ASN personnel   | guidance        |
| Materials and  | Program         | security        | ~(Rev           |
| Office of      | Baseline for    | specialist      | ised\ 05/2005)~ |
| Information    | executing the   |                 |                 |
| Systems        | ISS strategy    | AIN physical    |                 |
| Security       |                 | security        |                 |
|                |                 | specialist      |                 |
|                |                 |                 |                 |
|                |                 | Lines of        |                 |
|                |                 | business        |                 |
|                |                 | A/ISSM(s)       |                 |
+----------------+-----------------+-----------------+-----------------+

+----------------+-----------------+----------------+-----------------+
| **[            |                 |                |                 |
| Description]{. |                 |                |                 |
| underline}:**\ |                 |                |                 |
| The Service    |                 |                |                 |
| Team defines   |                 |                |                 |
| the tasks      |                 |                |                 |
| needed to      |                 |                |                 |
| implement      |                 |                |                 |
| Information    |                 |                |                 |
| System         |                 |                |                 |
| Security       |                 |                |                 |
| requirements,  |                 |                |                 |
| and records    |                 |                |                 |
| them in Part 2 |                 |                |                 |
| of the         |                 |                |                 |
| Implementation |                 |                |                 |
| Strategy and   |                 |                |                 |
| Planning       |                 |                |                 |
| attachment to  |                 |                |                 |
| the Exhibit    |                 |                |                 |
| 300 Program    |                 |                |                 |
| Baseline.      |                 |                |                 |
|                |                 |                |                 |
| # ISS Work     |                 |                |                 |
|  Activities Du |                 |                |                 |
| ring Solution  |                 |                |                 |
| Implementation |                 |                |                 |
|                |                 |                |                 |
| The following  |                 |                |                 |
| Information    |                 |                |                 |
| System         |                 |                |                 |
| Security       |                 |                |                 |
| activities     |                 |                |                 |
| drawn from the |                 |                |                 |
| ISS Program    |                 |                |                 |
| Handbook       |                 |                |                 |
| support        |                 |                |                 |
| program        |                 |                |                 |
| execution as   |                 |                |                 |
| the product is |                 |                |                 |
| designed,      |                 |                |                 |
| acquired,      |                 |                |                 |
| tested, and    |                 |                |                 |
| deployed to    |                 |                |                 |
| the field.     |                 |                |                 |
+----------------+-----------------+----------------+-----------------+
| **Activity:    |                 |                |                 |
| Award Prime    |                 |                |                 |
| Contract\      |                 |                |                 |
| ISS-11**       |                 |                |                 |
+----------------+-----------------+----------------+-----------------+
| **Responsible\ | **Product**     | **Approval\    | **Tools and     |
| Agent**        |                 | Authority**    | Aids**          |
+----------------+-----------------+----------------+-----------------+

+----------------+-----------------+-----------------+-----------------+
| Service Team   | Prime contract  | Source          | FISMA, Federal  |
| contracting    |                 | selection       | Information     |
| officer        |                 | official        | Security        |
|                |                 | (typically the  | Management Act  |
|                |                 | Service Team    | of 2002         |
|                |                 | leader unless   |                 |
|                |                 | otherwise       | ISS Program     |
|                |                 | designated by   | Handbook,       |
|                |                 | the JRC)        | appendices for  |
|                |                 |                 | Security Plans  |
|                |                 |                 | and Security    |
|                |                 |                 | S               |
|                |                 |                 | elf-Assessments |
|                |                 |                 | (NIST-SP8       |
|                |                 |                 | 00-compliant)\_ |
+----------------+-----------------+-----------------+-----------------+

  --------------------------------- ----------------- ----------------- -----------------
  **[Description]{.underline}:**\                                       
  A Screening Information Request                                       
  is issued after approval of the                                       
  System Specification. If the                                          
  contract involves provision of                                        
  information technology (IT)                                           
  equipment or software to FAA or                                       
  use of FAA IT resources, the                                          
  Service Team must use the                                             
  contractor's current security                                         
  risk assessment (NIST SP800-26 or                                     
  30) in the Information System                                         
  Security Plan (NIST SP 800-18),                                       
  as part of the selection process.                                     
  In any case, the winning proposal                                     
  must be capable of satisfying all                                     
  ISS requirements in the System                                        
  Specification (ISS-8).                                                

  **Activity: Complete ISS Portion                                      
  of System Design\                                                     
  ISS-12**                                                              

  **Responsible\                    **Product**       **Approval\       **Tools and
  Agent**                                             Authority**       Aids**
  --------------------------------- ----------------- ----------------- -----------------

+----------------+-----------------+-----------------+-----------------+
| Prime          | ISS capability  | Affected lines  | [ISS Program    |
| contractor\    | resident in     | of business     | Handbook](j     |
| Designated     | system design   | A/ISSM(s)       | avascript:panks |
| System         |                 |                 | har('http://int |
| Security       | COTS equipment  |                 | ranet.faa.gov/a |
| Engineer       | defined and     |                 | io/common/docum |
|                | tailored to     |                 | ents/InfoSec/IS |
|                | address ISS     |                 | S_Handbook_v3_s |
|                | requirements    |                 | ignature.htm')) |
|                |                 |                 |                 |
|                |                 |                 | NIST SP 800-63, |
|                |                 |                 | Security        |
|                |                 |                 | Considerations  |
|                |                 |                 | in the ISS      |
|                |                 |                 | Development     |
|                |                 |                 | Lifecycle       |
|                |                 |                 |                 |
|                |                 |                 | Line of         |
|                |                 |                 | business /      |
|                |                 |                 | staff office    |
|                |                 |                 | guidance        |
|                |                 |                 | ~(Rev           |
|                |                 |                 | ised\ 05/2005)~ |
+----------------+-----------------+-----------------+-----------------+

  --------------------------------- -------------- ------------------------ -----------------
  **[Description]{.underline}:**\                                           
  After contract award, the prime                                           
  contractor implements most                                                
  Information System Security                                               
  activities with the Service Team                                          
  overseeing contractor activity.                                           
  The Service Team ensures the                                              
  emerging design is fully                                                  
  compliant with ISS requirements                                           
  in the System Specification                                               
  through such activities as the                                            
  Preliminary Design Review,                                                
  Critical Design Review, and                                               
  System Test and Evaluation.                                               

  **Activity: Complete Final System                                         
  Description\                                                              
  ISS-13**                                                                  

  **Responsible\                    **Product**    **Approval\              **Tools and
  Agent**                                          Authority**              Aids**
  --------------------------------- -------------- ------------------------ -----------------

+-------------+-------------+-----------------------+-----------------+
| Prime       | Final       | Service Team leader   | Line of         |
| contractor  | system      | or designated         | business /      |
|             | description | official (e.g.,       | staff office    |
|             |             | Quality Reliability   | guidance        |
|             |             | Officer)              | ~(Rev           |
|             |             |                       | ised\ 05/2005)~ |
|             |             | Affected lines of     |                 |
|             |             | business A/ISSM(s)    |                 |
+-------------+-------------+-----------------------+-----------------+

  --------------------------------- ----------------- -------------------- -----------------
  **[Description]{.underline}:**\                                          
  The contractor prepares the final                                        
  \"as built\" technical                                                   
  description of the system. Among                                         
  other items, the technical                                               
  description defines the                                                  
  capability of the system in                                              
  response to ISS requirements in                                          
  the System Specification.                                                

  **Activity: Conduct Information                                          
  Security Testing\                                                        
  ISS-14**                                                                 

  **Responsible\                    **Product**       **Approval\          **Tools and
  Agent**                                             Authority**          Aids**
  --------------------------------- ----------------- -------------------- -----------------

+-------------+-----------------+--------------------+-----------------+
| Service     | Information     | Service Team       | [ISS Program    |
| Team test   | Security Test   | leader             | Handbook](j     |
| specialist  | Report          |                    | avascript:panks |
| System      | Certification   | Certification and  | har('http://int |
| security    | request         | Accreditation      | ranet.faa.gov/a |
| engineer    |                 | Agent (AIS-300 for | io/common/docum |
|             |                 | AIS-1)             | ents/InfoSec/IS |
|             |                 |                    | S_Handbook_v3_s |
|             |                 |                    | ignature.htm')) |
|             |                 |                    |                 |
|             |                 |                    |                 |
|             |                 |                    |                 |
|             |                 |                    |                 |
+-------------+-----------------+--------------------+-----------------+

  --------------------------------- -------------------- ----------------- -----------------
  **[Description]{.underline}:**\                                          
  Near the end of development, the                                         
  system undergoes a battery of                                            
  testing to ensure it complies                                            
  correctly and completely with                                            
  each Information System Security                                         
  requirement in the System                                                
  Specification. In addition, the                                          
  system as a whole is subjected to                                        
  Security Test and Evaluation                                             
  (ST&E) to assess compliance with                                         
  ISS specifications and its                                               
  overall resistance to attack on                                          
  information security. The                                                
  information security test report                                         
  contains the results of ST&E, as                                         
  well as all test plans and                                               
  procedures. The report also                                              
  identifies types of testing that                                         
  have not been done (e.g., due to                                         
  cost or complexity), but which                                           
  could nonetheless be of concern                                          
  to the FAA, such as the effects                                          
  of electromagnetic interference,                                         
  radio frequency jamming, and                                             
  communications message flooding.                                         
  The results of ST&E are provided                                         
  with the rest of the evolved                                             
  Security Certification &                                                 
  Accreditation Package (risk                                              
  analyses).                                                               

  **Activity: Approve the Sensitive                                        
  Application Certification (SAC)                                          
  Report\                                                                  
  ISS-15**                                                                 

  **Responsible\                    **Product**          **Approval\       **Tools and
  Agent**                                                Authority**       Aids**
  --------------------------------- -------------------- ----------------- -----------------

+-------------+--------------------+-----------------+-----------------+
| Security    | Authority to       | Designated      | [ISS Program    |
| engineer    | Operate (ATO) or   | approving       | Handbook](j     |
|             | interim ATO        | authority       | avascript:panks |
|             |                    |                 | har('http://int |
|             |                    |                 | ranet.faa.gov/a |
|             |                    |                 | io/common/docum |
|             |                    |                 | ents/InfoSec/IS |
|             |                    |                 | S_Handbook_v3_s |
|             |                    |                 | ignature.htm')) |
|             |                    |                 |                 |
|             |                    |                 | 1370.82, as     |
|             |                    |                 | amended         |
+-------------+--------------------+-----------------+-----------------+

+-----------------------------------------------------------------------+
| **[Description]{.underline}:**\                                       |
| The Designated Approving Authority (DAA) certifies the new system as  |
| ISS-compliant and ready to enter operational service via signing the  |
| Authority To Operate (ATO) certificate (template in ISS Program       |
| Handbook) with the ISSM, AIS-1, Service Team leader and a user        |
| representative. The ATO becomes the cover sheet for the SCAP that     |
| contains:                                                             |
|                                                                       |
| -   Security requirements and high-level ISS design documents;        |
|                                                                       |
| -   ISS assurance measures (including all ISS test procedures and     |
|     results);                                                         |
|                                                                       |
| -   Security Plan for development, operations and maintenance; and    |
|                                                                       |
| -   Operations and training materials pertaining to system ISS        |
|     capability.                                                       |
|                                                                       |
| The report also thoroughly discusses residual ISS risks present in    |
| the system at the time of the in-service decision.                    |
+-----------------------------------------------------------------------+

**\
ISS Work Activities During In-Service Management **

The following Information System Security activities are drawn from the
ISS Program Handbook. They are executed during in-service management
when activity shifts to operating and maintaining the new capability in
the field. There may also be product upgrades or pre-planned product
improvements to resolve residual ISS requirements or respond to emerging
threats or vulnerabilities.

  ---------------- -------------------- ----------------- -----------------
  **Activity:                                             
  Introduce                                               
  Product                                                 
  Improvements\                                           
  ISS-16**                                                

  **Responsible\   **Product**          **Approval\       **Tools and
  Agent**                               Authority**       Aids**
  ---------------- -------------------- ----------------- -----------------

+-------------+--------------------+-----------------+-----------------+
| Service     | Product upgrades   | Designated      | [ISS Program    |
| Team leader |                    | in-service      | Handbook](j     |
|             | ISS element of the | decision        | avascript:panks |
| ISS Manager | NAS or non-NAS     | authority       | har('http://int |
|             | change proposal    |                 | ranet.faa.gov/a |
|             |                    | NAS or non-NAS  | io/common/docum |
|             |                    | change proposal | ents/InfoSec/IS |
|             |                    | approval        | S_Handbook_v3_s |
|             |                    | authority       | ignature.htm')) |
|             |                    |                 |                 |
|             |                    |                 | FAA Order       |
|             |                    |                 | 1370.82, as     |
|             |                    |                 | amended         |
|             |                    |                 |                 |
|             |                    |                 | Line of         |
|             |                    |                 | business /      |
|             |                    |                 | staff office    |
|             |                    |                 | guidance        |
|             |                    |                 | ~(Rev           |
|             |                    |                 | ised\ 05/2005)~ |
+-------------+--------------------+-----------------+-----------------+

+-----------------------------------------------------------------------+
| **[Description]{.underline}:**\                                       |
| The Service Team may develop product upgrades to resolve new          |
| vulnerabilities as they emerge or to satisfy residual requirements,   |
| In some cases, upgrades can be executed through available sustainment |
| funding and the Service Team need not return to the JRC. When         |
| additional funding is required, the Service Team prepares for a       |
| re-baselining investment decision to obtain approval and funding.     |
|                                                                       |
| All modifications to in-service hardware and software require         |
| approval of a NAS Change Proposal (or equivalent for non-NAS          |
| investments) according to procedures found on the Configuration       |
| Management website. This website can be accessed from FAST at         |
| http://fast.faa.gov. Information System Security is a key element of  |
| these change proposals. The lead for the ISS portion of the change    |
| proposal is the ISS Manager within the line of business seeking the   |
| change. The ISS Manager for the NAS resides in ATO-W, Technical       |
| Operations, while the ISS Manager for ATO non-NAS systems resides in  |
| ATO-A. Guidance pertaining to information security for NAS and        |
| non-NAS change proposals is found at                                  |
| <http:/                                                               |
| /intranet.faa.gov/faaemployees/org/linebusiness/ato_online/ato_issp>. |
|                                                                       |
| Annually, every fielded system undergoes a security self-assessment   |
| compliant with NIST SP 800-26, and an update to its Information       |
| System Security Plan compliant with NIST SP 800-18. At three-year     |
| intervals, even if no changes have taken place, each fielded system   |
| undergoes the FAA C&A process to verify it is still operating         |
| securely. If any or the sum of multiple product improvements affect   |
| information system security, the Service Team must recertify the      |
| system to ensure it is still operating securely.                      |
+-----------------------------------------------------------------------+