VERSION HISTORY/CHANGE RECORD Change Number Person Posting Change Change Reason for Change Page Number of Change Revision 1 Changes – March 22, 2006 1 Bo Berlas Included the OWASP Web Application Penetration Checklist and the OWASP Testing Project documents as embedded objects into Appendix C – GSA Risk Assessment Security Requirements. To provide a usable checklist for testing the OWASP Top Ten Vulnerabilities. 14 Revision 2 Changes – February 13, 2007 1 Bo Berlas Various updates to reflect changes in A&A process FINAL publishing of NIST 800-53 on 12/2006 4-10 2 Bo Berlas Updated Appendix A: Risk Assessment Report Format RA and SA are now combined into a single RA/SA report. 11 3 Bo Berlas Updated Appendix B: GSA Security Assessment Test Procedures Updated Assessment test procedures based on FINAL publishing of NIST 800-53 on 12/2006 15 4 Bo Berlas Updated Appendix C: Plan of Action and Milestone (POA&M) Template Attached new POA&M template for FY 2007. 16 5 Bo Berlas Updated Appendix D: Risk Assessment / Security Assessment Plan Template Updated assessment plan template to reflect combining of RA and SA reports. 17 Revision 3 Changes – March 20, 2007 1 Bo Berlas Changed reference to OWASP Top Ten from 2007 Release Candidate 1 back to the 2004 Update. OWASP Top Ten, 2007 RC1 has not been finalized. GSA will adopt the OWASP Top Ten, 2007 Update upon final publication. 6 2 Bo Berlas New database scanning requirement. App Detective or similar tool should be used to test database security configurations. 7 Revision 4 Changes – October 16, 2007 1 Bo Berlas Updated policy reference. GSA IT Security Policy was updated June 2007. 6 2 Bo Berlas Changed reference to OWASP Top Ten from the 2004 Update to the current 2007 Update. The 2007 Top Ten lists current web application vulnerabilities. 7 3 Bo Berlas Replaced the FY 2007 POA&M Reporting Template with the FY 2008 template. New OMB Quarterly POA&M Reporting Requirements 17 Revision 5 Changes – July 15, 2010 1 Bo Berlas Update the A&A process to be consistent with NIST 300-37 and the Risk Management Framework Updates required to ensure agency compliance. Various 2 Bo Berlas Inserted Roles and Responsibilities relating to A&A from the GSA IT Security Policy Identify A&A Roles and Responsibilities 3
3 Bo Berlas New implementation guidance for NIST 800-53 controls. To facilitate implementation of required controls 25 4 Bo Berlas New NIST 800-53 assessment test cases Required to facilitate assessment of NIST 800-53 controls Appendix C 5 Bo Berlas New OCISO A&A Review SOP Documents the process for submission of A&A packages to the OCISO and the detailed procedural steps performed by the OCISO to verify A&A compliance. Appendix E 6 Bo Berlas New guidance for A&A of Minor Systems To facilitate assessment of minor systems. 22 Revision 6 Changes – December 16, 2010 1 Bo Berlas Updated references for Certification, Accreditation, and Certification and Accreditation (C&A) to Assessment, Authorization, and Assessment and Authorization (A&A), respectively. To be consistent with the current terminology in NIST 800-37. Throughout 2 Bo Berlas Inserted guidance for forming sections 1-10 of the SSP for cloud computing system SSPs. To address cloud specific security challenges. 12 Revision 7 Changes – May 31, 2011 1 Bo Berlas Updated references to A&A to security authorization process and authorization package or A&A package to security authorization package. To be consistent with the current terminology in NIST 800-37. Throughout 2 Bo Berlas Inserted guidance for review of minimal impact SaaS solutions. To document required review activities for such systems. 25 3 Bo Berlas Updated Appendix E to include a revised OCISO Security Authorization Package Review SOP. To reflect current version of the SOP. 48 Revision 8 Changes – November 25, 2015 1 Lewis/ Sitcharing Changes made throughout the document to reflect NIST and GSA requirements Updated to reflect and implement the most current NIST 800-53-Rev4 and GSA requirements Various Revision 9 Changes – May 19, 2016 1 Wilson/ Klemens Restructuring of the document, modifications to specific process descriptions. Updated to reflect current acceptance of risk process and rename Minor Application process to Subsystem process and revise its description. Restructuring and editing throughout. Various Revision 10 Changes – April 10, 2017 1 Desai/ Klemens Clarifying system definitions and penetration testing requirements. Included definitions of Federal and Contractor systems. Clarified when systems are required to have penetration tests as part of their assessment. Sections 1.2, 4.1.7
2 Klemens Update and edit document. Updating of hyperlinks, editing of document, updates to align with other GSA documents. Throughout Revision 11 Changes – October 10, 2017 1 Dean/ Feliksa/ Klemens Update hyperlinks and minor editorial changes. Hyperlinks were updated so outdated, superseded documents would not be provided. Minor edits to clarify current GSA processes. Throughout Revision 12 Changes – January 17, 2018 1 Feliksa/ Klemens Integrate the NIST Cybersecurity Framework (CSF), update A&A process and POA&M information, remove Cloud Controls. Comply with Executive Order 13800, update processes based on revised procedures, streamline document by moving cloud controls. Throughout