# Presentation: 820116

##    Risk-Based Policy & Implementation Guidance
   Program Management Plan
   Subordinate System SSP
   Management Reporting
   Training & Quarterly Workshops
Demonstration Days
   Friday (3/16): 9am - noon
Monday (3/19): 9am - noon

-    Program Management Plan
-    Subordinate System SSP
-    Management Reporting
-    Training & Quarterly Workshops
**Demonstration Days**
**   ****Friday (3/16): 9am - noon**
**Monday (3/19): 9am - noon**

- Cyber Security Assessment & Management
- CSAM Highlight of Capabilities

**Comprehensive FISMA Compliance, Management & Reporting**

***Five Services, One Complete FISMA Solution***

- 1

- 2

- 3

- 4

- 5

##    Risk-Based Policy & Implementation Guidance
Threats and Vulnerabilities
Roles – Responsibilities - Privileges
Standards
   Program Management Plan
   Subordinate System SSP
   Management Reporting
   Training & Quarterly Workshops

**Threats and Vulnerabilities**
**Roles – Responsibilities - Privileges**
**Standards**
-    Program Management Plan
-    Subordinate System SSP
-    Management Reporting
-    Training & Quarterly Workshops

- Cyber Security Assessment & Management
- CSAM

- 1

- 2

- 3

- 4

- 5

##     Threats and Vulnerabilities
Roles – Responsibilities – Privileges
Standards

- Roles – Responsibilities – Privileges
- Standards

- Cyber Security Assessment & Management
- Risk-Based Policy
- & Implementation Guidance

## Threats and Vulnerabilities
    Roles – Responsibilities – Privileges
Standards

- Threats and Vulnerabilities
**    ****Roles – Responsibilities – Privileges**
- Standards

- Cyber Security Assessment & Management
- Risk-Based Policy
- & Implementation Guidance

## Threats and Vulnerabilities
Roles – Responsibilities – Privileges
     Standards

- Roles – Responsibilities – Privileges
-      **Standards**

- Cyber Security Assessment & Management
- Risk-Based Policy
- & Implementation Guidance

**Security Control Set**
-    **Test Cases**
**   ****Expected Results**
**   ****Compliance Guidance  ****       &Descriptions **
**   ****Subject Matter Expertise**
**   **

##     Enterprise System Inventory
Performance Dashboard
Cost Guidance
Document Templates & Templates
PMP Table of Contents

- Performance Dashboard
- Cost Guidance
- Document Templates & Templates
- PMP Table of Contents

- Cyber Security Assessment & Management
- Program Management Plan

## Enterprise System Inventory
    Performance Dashboard
Cost Guidance
Document Templates & Templates
PMP Table of Contents

**    ****Performance Dashboard**
- Cost Guidance
- Document Templates & Templates
- PMP Table of Contents

- Cyber Security Assessment & Management
- Program Management Plan

## Enterprise System Inventory
Performance Dashboard
    Cost Guidance
Document Appendices & Templates
PMP Table of Contents

- Performance Dashboard
**    ****Cost Guidance**
- Document Appendices & Templates
- PMP Table of Contents

- Cyber Security Assessment & Management
- Program Management Plan

**$14,903**

## Enterprise System Inventory
Performance Dashboard
Cost Guidance
    Document Appendices
    & Templates
Table of Contents

- Performance Dashboard
- Cost Guidance
**    ****Document Appendices**
**    ****& Templates**
- Table of Contents

- Cyber Security Assessment & Management
- Program Management Plan

## Enterprise System Inventory
Performance Dashboard
Cost Guidance
Document Appendices
        & Templates
    Table of Contents

- Performance Dashboard
- Cost Guidance
- Document Appendices
-         & Templates
-     **Table of Contents**

- Cyber Security Assessment & Management
- Program Management Plan

**                  ****Enterprise **
**   **_**Program Management Plan**_
-                    **Table of Contents**
-  Missions, Strategic Goals, Objectives, Systems
-  IT Security Management Strategy
-  Core Program Management Approach
-  Organization of the IT Security Program
-  IT Security Program External Guidance
-  IT Security Program External Interfaces
-  Roles & Responsibilities
-  FISMA Reporting
-  Program Implementation
-  IT Security Goals and Action Plans

##    System Security Plan (SSP)
Scope
Category
Inheritance (common controls)
Artifacts
POA&Ms

- Scope
- Category
- Inheritance (common controls)
- Artifacts
- POA&Ms

- Cyber Security Assessment & Management
- Subordinate System SSP

**               ****SSP**
- Risk Assessment
- Threats-Impact
- Risk Control Requirements
- (Linked to policy (SRTM)

- 1. System Identification
- 2. System Operational Status
- 3. General Description/ Purpose
- 4. System Environment
- 5. System Interconnections/Information Sharing
- 6. Sensitivity of Information Handled
- 7. Planning for Security in the Life Cycle
- 8. Security Control Measures

- Appendix D: Requirements (RTM)
- Appendix E: ST&E Plan And Procedures
- Appendix F: Certification Results
- Appendix G: Risk Assessment (RA) Results
- Appendix H: Certifier’s Recommendation
- Appendix I:   System Security Policy
- Appendix J:  System Rules of Behavior (ROB)
- Appendix K: Security Operating Procedures
- Appendix L: Contingency Plan(s)
- Appendix M: Security Awareness Training Plan
- Appendix O: Incident Response Plan
- Appendix P: MOA/Service Level Agreements (SLA)
- Appendix Q: Configuration Management Plan
- Appendix R: Accreditation Statement & Documentation
- Appendix S & T: Hardware & Software Listings
- Appendix U: C&A Schedule

**SSP Appendices**

**SSP**

## SSP
    Scope
Category
Inheritance (common controls)
Artifacts
POA&Ms

-     **Scope**
- Category
- Inheritance (common controls)
- Artifacts
- POA&Ms

- Cyber Security Assessment & Management
- Subordinate System SSP

**RTM Factor scoping**

## SSP
Scope
    Category
Inheritance (common controls)
Artifacts
POA&Ms

- Scope
**    ****Category**
- Inheritance (common controls)
- Artifacts
- POA&Ms

- Cyber Security Assessment & Management
- Subordinate System SSP

**800-60 Reference material**

## SSP
Scope
Category
    Inheritance (common controls)
Artifacts
POA&Ms

- Scope
- Category
**    ****Inheritance (common controls)**
- Artifacts
- POA&Ms

- Cyber Security Assessment & Management
- Subordinate System SSP

## SSP
Scope
Category
Inheritance (common controls)
    Artifacts
POA&Ms

- Scope
- Category
- Inheritance (common controls)
**    ****Artifacts**
- POA&Ms

- Cyber Security Assessment & Management
- Subordinate System SSP

## SSP
Scope
Category
Inheritance (common controls)
Artifacts
    POA&Ms

- Scope
- Category
- Inheritance (common controls)
- Artifacts
**    ****POA&Ms**

- Cyber Security Assessment & Management
- Subordinate System SSP

**AUTO-GENERATED POA&Ms**

## SSP
Scope
Category
Inheritance (common controls)
Artifacts
    POA&Ms

- Scope
- Category
- Inheritance (common controls)
- Artifacts
**    ****POA&Ms**

- Cyber Security Assessment & Management
- Subordinate System SSP

## SSP
Scope
Category
Inheritance (common controls)
Artifacts
    POA&Ms

- Scope
- Category
- Inheritance (common controls)
- Artifacts
**    ****POA&Ms**

- Cyber Security Assessment & Management
- Subordinate System SSP

##     Enterprise
System
Regulatory
Ad hoc

**    ****Enterprise**
- System
- Regulatory
- Ad hoc

- Cyber Security Assessment & Management
- Management Reporting

**FISMA REPORTS**

**AGENCY DASHBOARD**
**(PERFORMANCE METRIX & **
**COMPLIANCE STATUS)**

##     Enterprise
System
Regulatory
Ad hoc

- System
- Regulatory
- Ad hoc

- Cyber Security Assessment & Management
- Management Reporting

**FISMA REPORTS**

**AUDIT LOGS**

## Enterprise
    System
Regulatory
Ad hoc

- Enterprise
**    ****System**
- Regulatory
- Ad hoc

- Cyber Security Assessment & Management
- Management Reporting

**SYSTEM SECURITY PLAN**
**(WITH HYPERLINKS)**

## Enterprise
    System
Regulatory
Ad hoc

- Enterprise
**    ****System**
- Regulatory
- Ad hoc

- Cyber Security Assessment & Management
- Management Reporting

## Enterprise
System
     Regulatory
Ad hoc

- System
-      **Regulatory**
- Ad hoc

- Cyber Security Assessment & Management
- Management Reporting

**PTA**

**PIA**

## Enterprise
System
Regulatory
     Ad hoc

- System
- Regulatory
-      **Ad hoc**

- Cyber Security Assessment & Management
- Management Reporting

## Training

- Annual Training Requirement

- Leadership Track

- Response Track

- Planning Track

- IT Security
- Operations and
- Technology Track

- CIO, AO
- CISO CA

- ALL

- ISSM, ISSO

- ALL

- ISSM, ISSO
- SA

- Resp for FS

- Resp for SE

- Resp for AD

- Resp for CP

- Resp for IR

- Quarterly

- CSAM Toolkit*Cyber Sec. Assessment & Mgmt*

- CA, ISSM,
- ISSO, SA,
- Aud., User
- Reps

## CSAM C&A Web Architecture

**CSAM C&A Web ****Architecture**

**SQL Server 2005**

**Database**

**Application**

**Web Server**

**CSAM C&A Client Website**
** ****ASP.NET 2.x Website**
** ****Runs on IIS 5.1 or later**
** ****Uses Crystal Reports Runtime**
** ****Browsers: Internet Explorer**
**                     ****Netscape**

**SSP Generator Application**
-   VB.NET Application
-   **Processes SSP Requests**
-   **Returns Completed SSP to Database**
-   Uses Microsoft Word to Generate Documents

**C&A Web Daily Process**
-   VB.NET Application
-   Removes Temporary Files when no longer needed
-   Nightly processing to run account management
-    and POA&M approval routines.

## TrustedAgent Architecture

- OS: Windows Server Platform
- Database: Oracle 8i,9i, 10g
- Web/App Server: Tomcat 4.x, 5.x, JRUN 4.x, IIS 5+, Apache1.3+
- Browser: Internet Explorer 5.5+, Netscape 7.1+

- Memory: 4 GB+
- Disk space: 100 GB+
- Processing: 2 CPUs; 2+ GHz or higher processing speed each

**Industry Standard!  Scalable Technology!**

## Familiarization Demonstrations:
 Friday, March 16th:  9am – noon
 Monday, March 19th:  9am – noon
Target audience: SSC Solutions Decision Makers
                              C&A Functional Users
                              IT Configuration Technicians
For further information* :
 DOJLOBCSAM@usdoj.gov
Ken Gandola			Jim Leahy
    202-353-0081			202-353-8741
    Kenneth.d.gandola@usdog.gov	james.t.leahy@usdoj.gov

-  **Friday, March 16th**:  9am – noon
-  **Monday, March 19th**:  9am – noon
- _Target audience_: SSC Solutions Decision Makers
-                               C&A Functional Users
-                               IT Configuration Technicians
_**For further information* **_**:**
-  _[DOJLOBCSAM@usdoj.gov](mailto:DOJLOBCSAM@usdoj.gov)_
**Ken Gandola**			**Jim Leahy**
-     202-353-0081			202-353-8741
-     _[Kenneth.d.gandola@usdog.gov](mailto:Kenneth.d.gandola@usdog.gov)__	__james.t.leahy@usdoj.gov_

- Cyber Security Assessment & Management
- CSAM

- * Please have agency project leads coordinate inputs for your agency or identify
-  your position and project role with your inquiry.

**Reservations Required**