# Presentation: 791001

## Identifying Step One of Information Security Role-Based Training -  Who Has Significant Security Responsibilities?

- 5th FISSEA Workshop
- August 30, 2006
- NIST, Gaithersburg, MD

- www.fissea.org or http://csrc.nist.gov/fissea

## FISMA Says . . .

- The head of each agency shall . . . delegate to the agency Chief Information Officer . . . training and overseeing personnel with ***significant responsibilities for information security*** . . .
- The head of each agency shall . . . ensure that the agency has trained personnel sufficient to assist the agency with complying with . . .

## FISMA: Train People with Significant Responsibilities . .

- Who?
- CIO?
- CISO & Security Staff?
- System Owners?
- Application Owners?
- Data Owners?
- Contractors?

## FISMA: Train People with Significant Responsibilities . .

- Who?
- Network Administrators?
- System Administrators?
- Server (e.g., mail, web) Administrators?
- Records Management Officials?
- Law Enforcement Officials?
- General Counsel?

## FISMA: Train People with Significant Responsibilities . . 

- How to Decide?
- Where should it be documented?
- Policy?
- Position Descriptions?
- Performance or Security Plans?
- Contingency Plans, COOPs?
- IG Reports?  (Wait for IG Report?)
- Just Makes Sense?
- Good Security Practice?  (Get Buy-in)

## NIST Guidance

- Updating NIST SP 800-16
- Looking at Job Functions
- Primary consideration
- Secondary consideration
- Will be vetted through public review and comment period(s) -- and possibly workshops

## OPM CFR 930.301(1997, updated 6/2004) Says . . .

- Develop awareness and training plan
- All users of federal information systems must be exposed to awareness materials at least annually
- Identify employees with significant information security responsibilities and provide role-specific training in accordance with NIST standards and guidance

## OPM CFR 930.301 Also Says . . .Agencies Must Train . . .

- Executives
- Program and functional managers
- CIOs, IT security program managers, auditors, and other security oriented personnel (e.g., system and network administrators, and system/ application security officers)
- IT function management and operations personnel

## DoD 8570.1-M IA Workforce Improvement Program, Ch. 7

- DoD components must identify all positions and personnel (military, civilian, and contractors) with IA responsibilities
- Positions and personnel will be assigned
- IA category
- IA level
- Documented in the appropriate database(s).

## DoD 8570.1-M IA Workforce Improvement Program

- Two categories: functional and managerial
- Three levels: based on functional skill requirements and system environment focus
- IA workforce categories and levels do not necessarily correlate to civilian grades, military ranks, or any specific occupational classification standard.

## Workforce Planning

- Workforce planning is ...looking at what an organization needs to accomplish in a given period of time;
- what knowledge, skills, and experience are required to get the job done;
- and how large and what type of workforce is required to provide that mix of knowledge, skills, and experience
- Workforce Planning Guide, U.S. Department of Transportation, April 1999.

## Workforce Planning

- Identify competencies needed in the workforce, both in the present and the future
- Select and develop the workforce
- Anticipate change rather than being surprised by events
- Address present and anticipated workforce issues
- Workforce Planning and Professional Development Task Force Final Report, Dec. 2000
- http://www.fhwa.dot.gov/reports/workforce/

## Workforce Planning

- Current HR information systems do not break down position series into specific categories and specialties
- A breakdown of data is needed for meaningful analysis of information security skills and turnover for workforce planning
- Ask operational units to provide key data for each full-time permanent position

## Workforce Planning

- _Core functions_
- Manage
- Acquire
- Design & Develop
- Implement & Operate
- Review & Evaluate

- _Core positions_
- Executives
- System Owners
- Program & Functional Managers
- IT Security Personnel
- IT Personnel
- Security Personnel

## Workforce Planning

|  | Manage | Acquire | Design & Develop | Implement & Operate | Review & Evaluate | SSR |
| --- | --- | --- | --- | --- | --- | --- |
|  | Time/
Resp  | Time/
Resp  | Time/
Resp  | Time/
Resp  | Time/
Resp  |  |
| Executives |  |  |  |  |  |  |
| Director |  |  |  |  |  | Y/N |
| Deputy Director |  |  |  |  |  | Y/N |
| Program/
Functional Managers |  |  |  |  |  |  |
| Division Chief |  |  |  |  |  | Y/N |
| Branch Chief |  |  |  |  |  | Y/N |

- Key:
- Time Requirements 0-30% Low, 30-60% Medium, 70-100% High
- Responsibility Requirements:  Low/Medium/High

## Workforce Planning

- What’s the goal?
- Right people with the right skills are in the right place at the right time
- Having the right people prepared for the right positions at the needed time

## Panel Presentations

- Lou Numkin, IRS
- Cheryl Seaman, NIH
- Wade Sharp, BAH/NRO
- Ty Cooper, OGE
- Gretchen Morris, RSIS/NSA
- Question/Answer with Panelists

## Ideas, Thoughts, and Experiences

- Discussion Topics
- What three items do you think are necessary in order to identify the personnel and positions with significant security responsibilities?
- What tools would be helpful or necessary to do this?

## THANK YOU!

- Mark Wilson, CISSP
- Computer Security Division, NIST
- NIST Liaison to FISSEA (301) 975-3870
- mark.wilson@nist.gov
- http://csrc.nist.gov

- Susan Hansche, CISSP-EP
- Nortel Government Solutions
- Program Manager for Department of State IA Training Program
- (703) 205-2811
- hansches@state.gov

- FISSEA Workshop Contacts