Internal Control Systems [OMB Circular A-123] Management of Federal Information Resources [OMB Circular A-130] Management’s Responsibility for Internal Control [OMB Circular A-123, Revised 12/21/2004] Privacy Act of 1974 as amended [5 USC 552a] Protection of Sensitive Agency Information [OMB M-06-16] Records Management by Federal Agencies [44 USC 31] Responsibilities for the Maintenance of Records About Individuals by Federal Agencies [OMB Circular A-108, as amended] Security of Federal Automated Information Systems [OMB Circular A-130, Appendix III] A NIST Definition of Cloud Computing [NIST SP 800-145] Computer Security Incident Handling Guide [NIST SP 800-61, Revision 2] Contingency Planning Guide for Federal Information Systems [NIST SP 800-34, Revision 1] Engineering Principles for Information Technology Security (A Baseline for Achieving Security) [NIST SP 800-27, Revision A] Guide for Assessing the Security Controls in Federal Information Systems [NIST SP Revision 1] Guide for Developing Security Plans for Federal Information Systems [NIST SP 800-18, Revision 1] Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach [NIST SP 800-37, Revision 1] Guide for Mapping Types of Information and Information Systems to Security Categories [NIST SP 800-60, Revision 1] Guide for Security-Focused Configuration Management of Information Systems [NIST SP 800-128] Information Security Continuous Monitoring for Federal Information Systems and Organizations [NIST SP 800-137] Managing Information Security Risk: Organization, Mission, and Information System View [NIST SP 800-39] Minimum Security Requirements for Federal Information and Information Systems [FIPS Publication 200] Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS Publication 201-2] Recommended Security Controls for Federal Information Systems [NIST SP 800-53, Revision 4] Guide for Conducting Risk Assessments [NIST SP 800-30, Revision 1] Security Considerations in the System Development Life Cycle [NIST SP 800-64, Revision 2] Security Requirements for Cryptographic Modules [FIPS Publication 140-2] Standards for Security Categorization of Federal Information and Information Systems
ID Threat Name Type Description Typical Impact to Data or System Integrity Availability Alteration U, P, E Alteration of data, files, or records. Modification Audit Compromise P An unauthorized user gains access to the audit trail and could cause audit records to be deleted or modified, or prevents future audit records from being recorded, thus masking a security relevant event. Modification or Destruction Unavailable Accurate Records Bomb P An intentional explosion. Modification or Destruction Denial of Service Failure U, E Cut of fiber optic lines, trees falling on telephone lines. Denial of Service Compromising Emanations P Eavesdropping can occur via electronic media directed against large scale electronic facilities that do not process classified National Security Information. Disclosure Cyber Brute Force P Unauthorized user could gain access to the information systems by random or systematic guessing of passwords, possibly supported by password cracking utilities. Disclosure Modification or Destruction Denial of Service Data Disclosure Attack P An attacker uses techniques that could result in the disclosure of sensitive information by exploiting weaknesses in the design or configuration. Disclosure Data Entry Error U Human inattention, lack of knowledge, and failure to cross-check system activities could contribute to errors becoming integrated and ingrained in automated systems. Modification Denial of Service Attack P An adversary uses techniques to attack a single target rendering it unable to respond and could cause denial of service for users of the targeted information systems. Denial of Service
Severe Weather E Naturally occurring forces of nature could disrupt the operation of an information system by freezing, sleet, hail, heat, lightning, thunderstorms, tornados, or snowfall. Destruction Denial of Service Social Engineering P An attacker manipulates people into performing actions or divulging confidential information, as well as possible access to computer systems or facilities. Disclosure Software Tampering P Unauthorized modification of software (e.g. files, programs, database records) that alters the proper operational functions. Modification or Destruction Terrorist P An individual performing a deliberate violent act could use a variety of agents to damage the information system, its facility, and/or its operations. Modification or Destruction Denial of Service Theft P An adversary could steal elements of the hardware. Denial of Service Time and State P An attacker exploits weaknesses in timing or state of functions to perform actions that would otherwise be prevented (e.g. race conditions, manipulation user state). Disclosure Modification Denial of Service Transportation Accidents E Transportation accidents include train derailments, river barge accidents, trucking accidents, and airlines accidents. Local transportation accidents typically occur when airports, sea ports, railroad tracks, and major trucking routes occur in close proximity to systems facilities. Likelihood of HAZMAT cargo must be determined when considering the probability of local transportation accidents. Destruction Denial of Service Unauthorized Facility Access P An unauthorized individual accesses a facility which may result in comprises of confidentiality, integrity, or availability. Disclosure Modification or Destruction Denial of Service
Unauthorized Systems Access P An unauthorized user accesses a system or data. Disclosure Modification or Destruction Volcanic Activity E A crack, perforation, or vent in the earth’s crust followed by molten lava, steam, gases, and ash forcefully ejected into the atmosphere. For a list of volcanoes in the U.S. see: . Destruction Denial of Service Table 3-3 – Potential Threats
Likelihood Impact Low Moderate High High Low Moderate High Moderate Low Moderate Moderate Low Low Low Low Table 3-6 – Risk Exposure Ratings <3PAO and CSP names> reviewed all identified weaknesses and assigned a risk to the weakness based on table 3-6. All identified scan risks have been assigned the risk identified by the scanning tool. Documenting the results of security control testing creates a record of the security posture for the system at a given moment in time. The record can be reviewed for risk-based decision making and to create plans of action to mitigate risks. The Federal Information Security Management Act (FISMA) requires that a Plan of Action and Milestones (POA&M) (using the format guidance prescribed by OMB) be developed and utilized as the primary mechanism for tracking all system security weaknesses and issues. <CSP> will leverage the SAR to create a Plan of Action and Milestones (POA&M) for <Information System Name>. The POA&M is a mitigation plan designed to address specific residual security weaknesses and includes information on costing, resources, and target dates This section describes all security weaknesses found during testing. The following elements for each security weakness are reported. Identifier Name Source of Discovery Description Affected IP Address/Hostname/Database Applicable Threats Likelihood (before mitigating controls/factors) Impact (before mitigating controls/factors) Risk Exposure (before mitigating controls/factors) Risk Statement Mitigating Controls/Factors
D – The <tool name, version> vulnerability scanner was used to scan the <system name> databases. <number>% percent of all databases were scanned. The following raw scan results files are included: <List files here include Title, Filename (including extension)> IP Address Hostname Software & Version Function Comment
Table D-1 – Inventory of Databases Scanned ID # IP Address Scanner Severity Level Finding False Positive Explanation 1-FP-DS 2-FP-DS 3-FP-DS Table D-2 – Database Scans: False Positive Reports E – The <tool name, version> vulnerability scanner was used to scan the <system name> web applications. <number>% of all web applications were scanned.
Total <#> <#> Table F-2 – Final Summary of System Security Risks Table F-3, Open POA&Ms, shows the number of POA&Ms with Ongoing status as of <date>. The third column shows POA&Ms identified as closed in the <date> POA&M that not had been validated by the AO or by <3PAO>. The Duplicate Open POA&M Entries column shows POA&M items where the same vulnerability, typically from scanning was open under different vulnerability IDs and can be consolidated. Adding the POA&Ms with ongoing status column to the POA&Ms closed but not validated and subtracting the duplicate open POA&Msresults in the numbers in the Open POA&Ms column (as of <date>. Severity POA&Ms with Ongoing Status as of <date> POA&Ms Closed (as of <date>) but not Validated by AO or 3PAO Duplicate Open POA&M Entries Open POA&Ms (as of <date>) High Moderate Low Total Table F-3 – Open POA&Ms Table F-4, Summary of Existing POA&Ms, shows the number of Open POA&Ms as of <date> from Table F-3. Some of these POA&Ms can be closed as a result of testing performed by <3PAO> during this annual assessment The number of open POA&Ms minus the number of POA&Ms closed through testing results in the total number of remaining POA&Ms that need to be carried
forward through continuous monitoring for the <system name> Severity Open POA&Ms (as of <date>) POA&Ms Closed Through Testing Total Remaining POA&Ms from <date> Submission High Moderate Low Total Table F-4 – Summary of Existing POA&Ms Table F-5 Summary of Vulnerabilities to be Carried Forward contains the total remaining POA&Ms from the <date> submission from table F-3 in the first column. The number of findings identified in this annual assessment is contained in the Annual Assessment Findings column. The next column shows the number of SAR findings that are duplicates of existing POA&Ms. The difference of these columns yields the number of unique findings from the annual assessment. Adding the number of unique findings to the total remaining POA&Ms from the <date> submission results in the number of total remaining vulnerabilities to be addressed by <CSP> from both the POA&M and this annual assessment. Severity Total Remaining POA&Ms from <date> Submission Annual Assessment Findings Duplicates with Existing POA&Ms Unique Findings from the Annual Assessment Total Remaining Vulnerabilities High Moderate
Low Total Table F-5 – Summary of Vulnerabilities to be Carried Forward Identifier Product/Embedded Component Description Assessment Methodology Description UN0001 Table F-6 – Summary of Unauthenticated Scans No additional automated tools were used during the <system name> annual assessment. & The <Scanner Name, Vendor, & Version #> was used to scan the <Information System Name>. The <Scanner Name, Vendor, & Version #> was used to scan the <Information System Name>. & IP Address Function Finding False Positive Explanation