ezesecops/rmf-ato-core huggingface dataset:
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.6 NETWORK MANAGEMENT

D.1.6 NETWORK MANAGEMENT

Network configuration management tools include host discovery, inventory, change control,
performance monitoring, and other network device management capabilities. Some network
configuration management tools automate device configuration and validate device compliance
against pre-configured policies. Network management tools may be able to discover unauthorized
hardware and software on the network, such as a rogue wireless access point.
The implementation and effective use of network management technologies can assist
organizations in automating the implementation, assessment, and continuous monitoring of
several NIST SP 800-53 security controls including AC-4, Information Flow Enforcement; AC-
17, Remote Access; AC-18, Wireless Access; CA-7, Continuous Monitoring; CM-2, Baseline
Configuration; CM-3, Configuration Change Control; CM-4, Security Impact Analysis; CM-6,
Configuration Settings; CM-8, Information System Component Inventory; SC-2, Application
Partitioning; SC-5, Denial of Service Protection; SC-7, Boundary Protection; SC-10, Network
Disconnect; SC-32, Information System Partitioning; and SI-4, Information System Monitoring.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.7 LICENSE MANAGEMENT

D.1.7 LICENSE MANAGEMENT

Similar to systems and network devices, software and applications are also a relevant data source
for ISCM. Software asset and licensing information may be centrally managed by a software
asset management tool to track license compliance, monitor usage status, and manage the
software asset life cycle. License management tools offer a variety of features to automate
inventory, utilization monitoring and restrictions, deployment, and patches for software and
applications.
The implementation and effective use of license management technologies can assist
organizations in automating the implementation, assessment, and continuous monitoring of
several NIST SP 800-53 security controls including CA-7, Continuous Monitoring; CM-8,
Information System Component Inventory; and SA-6, Software Usage Restrictions.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.8 INFORMATION MANAGEMENT

D.1.8 INFORMATION MANAGEMENT

There are vast quantities of digital information stored across the myriad of systems, network
devices, databases, and other assets within an organization. Managing the location and transfer of
information is essential to protecting the confidentiality, integrity, and availability of the data.
Data loss is the exposure of proprietary, sensitive, or classified information through either data
theft or data leakage. Data theft occurs when data is intentionally stolen or exposed, as in cases of
espionage or employee disgruntlement. Data leakage is the inadvertent exposure of data, as in the
case of a lost or stolen laptop, an employee storing files using an Internet storage application, or
an employee saving files on a USB drive to take home.
An effective data loss prevention (DLP) strategy includes data inventory and classification; data
metric collection; policy development for data creation, use, storage, transmission, and disposal;
and tools to monitor data at rest, in use, and in transit. There are a variety of tools available for
DLP. Typical network and security tools such as network analysis software, application firewalls,
and intrusion detection and prevention systems can be used to monitor data and its contents as it
is transmitted. Specially purposed DLP software also exists with features such as port and
endpoint control, disk and file encryption, and database transaction monitoring. These tools may
be specialized network traffic monitors or software agents installed on desktops, laptops, and
servers. DLP tools have built-in detection and mitigation measures such as alerting via email,
logging activities, and blocking transmissions.
The implementation and effective use of DLP technologies can assist organizations in automating
the implementation, assessment, and continuous monitoring of several NIST SP 800-53 security
controls including AC-4, Information Flow Enforcement; AC-17, Remote Access; CA-3,
Information System Connections; CA-7, Continuous Monitoring; CM-7, Least Functionality; SC-
9, Transmission Confidentiality; and SI-12, Information Output Handling and Retention.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.9 SOFTWARE ASSURANCE

D.1.9 SOFTWARE ASSURANCE

The NIST Software Assurance Metrics and Tool Evaluation (SAMATE) project defines software
assurance as the "planned and systematic set of activities that ensures that software processes and
products conform to requirements, standards, and procedures from NASA Software Assurance
Guidebook and Standard to help achieve:
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.2 TECHNOLOGIES FOR AGGREGATION AND ANALYSIS

D.2 TECHNOLOGIES FOR AGGREGATION AND ANALYSIS

Aggregation and analysis technologies are those that have the capability to collect raw data from
one or more security controls or other direct data gathering technologies and correlate, analyze,
and represent the raw data in a way that provides a more meaningful perspective on the
effectiveness of security control implementation across part or all of an organization than would
data from any single technology.
This section discusses common types of aggregation and analysis technologies and their role in
supporting an ISCM capability. They include SIEM and management dashboards.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.2 TECHNOLOGIES FOR AGGREGATION AND ANALYSIS > D.2.1 SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM)

D.2.1 SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM)

To enhance the ability to identify inappropriate or unusual activity, organizations may integrate
the analysis of vulnerability scanning information, performance data, network monitoring, and
system audit record (log) information through the use of SIEM tools. SIEM tools are a type of
centralized logging software that can facilitate aggregation and consolidation of logs from
multiple information system components. SIEM tools can also facilitate audit record correlation
and analysis. The correlation of audit record information with vulnerability scanning information
is important in determining the veracity of the vulnerability scans and correlating attack detection
events with scanning results.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
53 security controls including AC-5, Separation of Duties; AU-2, Auditable Events; AU-6, Audit > D.2.2 MANAGEMENT DASHBOARDS

D.2.2 MANAGEMENT DASHBOARDS

A security management dashboard (or security information management console) consolidates
and communicates information relevant to the organizational security status in near real-time to
security management stakeholders. Personnel with responsibility for information security range
from a technical system administrator, to the SISO, to the risk executive (function). The security
management dashboard presents information in a meaningful and easily understandable format
that can be customized to provide information appropriate to those with specific roles and
responsibilities within the organization.
To maximize the benefits of management dashboards, it is important to obtain acceptance and
support from upper-level management, define useful and quantifiable organization-specific
performance metrics that are based on information security policies and procedures, and ensure
the availability of meaningful performance data.
The implementation and effective use of management dashboards can assist organizations in
automating the implementation, assessment, and continuous monitoring of several NIST SP 800-
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
53 security controls including AC-5, Separation of Duties; CA-6, Security Authorization, CA-7, > D.3 AUTOMATION AND REFERENCE DATA SOURCES

D.3 AUTOMATION AND REFERENCE DATA SOURCES

Managing the security of systems throughout an organization is challenging for several reasons.
Most organizations have many systems to patch and configure securely, with numerous pieces of
software (operating systems and applications) to be secured on each system. Organizations need
to conduct continuous monitoring of the security configuration of each system and be able to
determine the security posture of systems and the organization at any given time. Organizations
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.3.1 SECURITY CONTENT AUTOMATION PROTOCOL (SCAP)

D.3.1 SECURITY CONTENT AUTOMATION PROTOCOL (SCAP)

SCAP is a suite of specifications50
For more information, please refer to NIST DRAFT SP 800-126, as amended, The Technical Specification for the
Security Content Automation Protocol (SCAP): SCAP Version 1.1.
that standardizes the format and nomenclature by which
security software products communicate security flaw and security configuration information.
SCAP is a multipurpose protocol that supports automated vulnerability and patch checking,
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Section 2.4. NIST SP 800-37, as amended, describes the interaction of the risk executive (function) in the context > OVERVIEW

OVERVIEW

Architecture Description
Architecture Reference Models
Segment and Solution Architectures
Mission and Business Processes
Information System Boundaries
Organizational Inputs
Laws, Directives, Policy Guidance
Strategic Goals and Objectives
Priorities and Resource Availability
Supply Chain Considerations
Repeat as necessary
Step 6
MONITOR
Security Controls
Step 2
SELECT
Security Controls
Step 3
IMPLEMENT
Security Controls
Step 4
ASSESS
Security Controls
Step 5
AUTHORIZE
Information S ys tem
Step 1
CATEGORIZE
Information S ys tem
requirements. Sampling of information system security objects, rather than 100 percent
inspection, can also be an efficient and effective means of monitoring, particularly in cases where
monitoring is not automated. Important considerations in determining sample sizes and
monitoring frequencies are discussed in Chapter Three.
Monitoring frequencies (e.g., annually, quarterly, monthly, daily) are not static, and they are not
uniform across all metrics. Security control assessment and monitoring frequencies, for example,
are adjusted to support changes in organizational information systems or their environments of
operation, including emerging information on security threats and vulnerabilities. The priorities
for ISCM vary and are adjusted in response to security incidents, to identify problems with
security control implementations, or to evaluate changes to systems and system components that
are determined to have a significant impact on security. An ISCM strategy can deliver dynamic
updates of security-related data to support system authorizations conducted at any interval.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX A > REFERENCES

REFERENCES

LEGISLATION
1. E-Government Act [includes FISMA] (P.L. 107-347), December 2002.
POLICIES, DIRECTIVES, INSTRUCTIONS
1. Office of Management and Budget, Circular A-130, Appendix III, Transmittal
Memorandum #4, Management of Federal Information Resources, November 2000.
2. Office of Management and Budget Memorandum M-02-01, Guidance for Preparing and
Submitting Security Plans of Action and Milestones, October 2001.
3. Cyber Security Research and Development Act of 2002.
GUIDELINES
Introduction to Computer Security: The NIST Handbook, October 1995.
Contingency Planning Guide for Federal Information Systems, May 2010.
Guide for Applying the Risk Management Framework to Federal Information Systems: A
Security Life Cycle Approach, February 2010.
Information Security Risk: Organization, Mission, and Information System View, March
2011.
Creating a Patch and Vulnerability Management Program, November 2005.
Recommended Security Controls for Federal Information Systems and Organizations,
August 2009.
Assessing the Security Controls in Federal Information Systems and Organizations:
Building Effective Security Assessment Plans, June 2010.
Performance Measurement Guide for Information Security, July 2008.
Computer Log Management, September 2006.
The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP
Version 1.1,February 2011.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Section 2.4. NIST SP 800-37, as amended, describes the interaction of the risk executive (function) in the context

Section 2.4. NIST SP 800-37, as amended, describes the interaction of the risk executive (function) in the context

of the RMF.
Figure 2-2. Risk Management Framework
The output of a strategically designed and well-managed organization-wide ISCM program can
be used to maintain a system's authorization to operate and keep required system information and
data (i.e., System Security Plan together with Risk Assessment Report, Security Assessment
Report, and POA&M) up to date on an ongoing basis. Security management and reporting tools
may provide functionality to automate updates to key evidence needed for ongoing authorization
decisions. ISCM also facilitates risk-based decision making regarding the ongoing authorization
to operate information systems and security authorization for common controls by providing
evolving threat activity or vulnerability information on demand. A security control assessment
and risk determination process, otherwise static between authorizations, is thus transformed into a
dynamic process that supports timely risk response actions and cost-effective, ongoing
authorizations. Continuous monitoring of threats, vulnerabilities, and security control
effectiveness provides situational awareness for risk-based support of ongoing authorization
decisions. An appropriately designed ISCM strategy and program supports ongoing authorization
of type authorizations, as well as single, joint, and leveraged authorizations.21
ISCM in support of ongoing assessment and authorization has the potential to be resource-
intensive and time-consuming. It is impractical to collect security-related information and assess
every aspect of every security control deployed across an organization at all times. A more
practical approach is to establish reasonable assessment frequencies for collecting security-related
information. The frequency of assessments should be sufficient to assure adequate security
commensurate with risk, as determined by system categorization and ISCM strategy
See NIST SP 800-37, as amended, for a discussion of authorization types.
Starting
Point
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > THE PROCESS

THE PROCESS

Defining an ISCM Strategy and Implementing an ISCM Program
his chapter describes the process for developing an ISCM strategy and implementing an
ISCM program including activities at the organization, mission/business process, and
information systems tiers. A well-designed ISCM strategy encompasses security control
assessment, security status monitoring, and security status reporting in support of timely risk-
based decision making throughout the organization. It also incorporates processes to assure that
response actions are taken. An organization's strategy for action based on the data collected is as
important (if not more important) than collecting the data. The process for developing an ISCM
strategy and implementing an ISCM program is as follows:
•
Define an ISCM strategy based on risk tolerance that maintains clear visibility into assets,
awareness of vulnerabilities, up-to-date threat information, and mission/business impacts.
•
Establish an ISCM program determining metrics, status monitoring frequencies, control
assessment frequencies, and an ISCM technical architecture.
•
Implement an ISCM program and collect the security-related information required for
metrics, assessments, and reporting. Automate collection, analysis, and reporting of data
where possible.
•
Analyze the data collected and Report findings, determining the appropriate response. It may
be necessary to collect additional information to clarify or supplement existing monitoring
data.
•
Respond to findings with technical, management, and operational mitigating activities or
acceptance, transference/sharing, or avoidance/rejection.
•
Review and Update the monitoring program, adjusting the ISCM strategy and maturing
measurement capabilities to increase visibility into assets and awareness of vulnerabilities,
further enable data-driven control of the security of an organization's information
infrastructure, and increase organizational resilience.
This process is depicted below in Figure 3- 1.
T
Figure 3-1. ISCM Process
Risk tolerance, enterprise architecture, security architecture, security configurations, plans for
changes to the enterprise architecture, and available threat information provide data that is
fundamental to the execution of these steps and to ongoing management of information security-
related risks. Security-related information is analyzed for its relevance to organizational risk
management at all three tiers.
The balance of this chapter discusses the process of ISCM, providing detail on topics not covered
by existing guidelines and referencing existing guidelines where appropriate. Primary roles,
supporting roles, expected inputs, and expected outputs are given for each process step as a guide.
Roles and responsibilities will vary across organizations as will implementation-level details of
an ISCM program.
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix C. Glossary > Note

Note: The security plan and the privacy plan may be integrated into one consolidated system artifact. privacy program plan A formal document that provides an overview of an agency's privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the Senior Agency Official for Privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks. [SP800-37] from [OMBA-130] See information security program plan. privacy requirements A requirement that applies to an information system or an organization that is derived from applicable laws, executive orders, directives, policies, standards, regulations, procedures, and/or mission/business needs with respect to privacy. [SP800-37]
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix C. Glossary > Note

Note: The term "privacy requirement" can be used in a variety of contexts, from high-level policy activities to low-level implementation activities in system development and engineering disciplines. privacy risk The likelihood that individuals will experience problems resulting from data processing, and the impact should they occur. [NISTPF] privacy risk management A cross-organizational set of processes for identifying, assessing, and responding to privacy risks. [NISTPF] risk management The program and supporting processes to manage risk to agency operations (including mission, functions, image, reputation), agency assets, individuals, other organizations, and the Nation, and includes establishing the context for risk-related activities; assessing risk; responding to risk once determined; and monitoring risk over time. [OMBA-130] security A condition that results from the establishment and maintenance of protective measures that enable an organization to perform its mission or critical functions despite risks posed by threats to its use of systems. Protective measures may involve a combination of deterrence, avoidance, prevention, detection, recovery, and correction that should form part of the organization's risk management approach. [SP800-37] security plan A formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. The system security plan describes the system components that are included within the system, the environment in which the system operates, how the security requirements are implemented, and the relationships with or connections to other systems. [SP800-53]
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > 1.1. Publication Scope

1.1. Publication Scope

This publication focuses on the development of system plans that address system-level security,
privacy, and C-SCRM requirements that are derived from enterprise, organization, and
mission/business process requirements. The guidelines in this publication can be extended to:
• Common control providers that provide implementation details for controls available to
be inherited by other systems;
• Requirements identified in [SP800-171] and [SP800-172] for the development of system
security plans for nonfederal organizations protecting Controlled Unclassified
Information (CUI); and
• Organizations developing system plans for service offerings from cloud service
providers, including software as a service (SaaS), platform as a service (PaaS), and
infrastructure as a service (IaaS).
System plans are required for federal systems in accordance with Office of Management and
Budget (OMB) Circular A-130 [OMBA-130] and the provisions of the Federal Information
Security Modernization Act (FISMA) of 2014 [FISMA].3 Nonfederal organizations - including
private and small businesses, academic institutions, and state, local, and tribal governments -
may utilize the guidelines provided in this publication to support their risk management
programs.
The guidelines provided can support training for individuals in roles that are responsible for the
development and maintenance of system plans. Organizations can leverage the example plans,
provided as supplemental materials, to develop localized plan templates. Third-party templates
are available4 to address planning requirements for specific organizations or industry sectors.
2 The NIST Open Security Controls Assessment Language [OSCAL] is designed to standardize the representation, implementation, and
assessment of controls using machine-readable data formats (e.g., XML, JSON, YAML). These OSCAL representations can be used in conjunction
with the other OSCAL schemas to represent structured and machine-readable system plan information, control assessment plans, and
assessment results, which facilitate the continuous assessment and monitoring of system controls. Initially designed for security assessment,
OSCAL has been proven suitable for the machine-readable representation of other control types (e.g., privacy, supply chain, accessibility,
safety) and to support their continuous assessment and monitoring.
3 [FISMA] includes privacy protections in the definition for confidentiality, as indicated in [44 USC3552].
4 [SP1318] identifies https://ndisac.org/dibscc/cyberassist/cybersecurity-maturity-model-certification/level-2/ca-l2-3-12-4/,
https://www.fedramp.gov/rev5/documents-templates/ as potential sources for applicable system plan templates.