Lead: A/E Documents/Models/Tools: Construction Design Documents / Building Information Model (BIM) / CAD CSET GrassMarlin Draft Baseline System Security Plan (SSP) IT Contingency Plan and CONOPS (ITCP) drawings, and specifications. At 90% design create initial SSP and baseline security risk assessment. drawings, and specifications. At 90% design create initial SSP and baseline secuirty risk assessment. Construction Test and Development (T&D) and Patch Management Environments (Virtual or Physical) Lead: Construction/System Integrator Documents/Models/Tools: VM Kali Linux SamuraiSTFU Conduct CS build and patch activities without impacting the organization’s production systems (test and development environment typically provided by vendor). Validate and verify the upgrade/modernization/ patch is ready to support the additional systems without impacting the organization’s production systems (test and development environment typically provided by vendor). 4 – 6 weeks Construction Build/Configure Servers Build and/or configure servers to properly operate the CS solution. Build and/or configure servers to properly operate the CS solution. 1 – 2 weeks Construction Install Supporting Software Lead: Construction/System Integrator Install supporting software on CS servers. Install supporting software on CS servers. 1 – 2 weeks Construction Configure Supporting Software Lead: Construction/System Integrator Documents/Models/Tools: STIGS SCAP Configure CS software to meet unique needs. After the operating system is loaded, apply hardening criteria (STIGs), run Security Content Automated Protocol tool, perform factory acceptance testing (FAT) on major Configure CS software to meet unique needs. After the operating system is loaded, apply hardening criteria (STIGS), run Security Content Automated Protocol tool, perform FAT on major system components and 1 – 2 weeks validated
Continuous Monitoring Kali Linux SamuraiSTFU Penetration Testing Scope and ROE (if required) Jump-Kit Rescue CD system components and devices, perform initial penetration testing. devices, perform initial penetration testing. Construction Implement and assess security controls Lead: construction/system integrator Documents/Models/Tools: CSET SSP Security Assessment Report (SAR) Plan of Action & Milestones (POAM) ITCP Incident Response Procedures (IRP) Penetration Testing Scope and ROE (if required) Jump-Kit Rescue CD Conduct RMF Steps 3 and 4 by applying controls identified during the requirements and design phase, by assessing the adequacy and effectiveness of security controls, and by documenting findings in the security assessment report. Create draft approval package. Conduct RMF Steps 3 and 4 by applying controls identified during the requirements and design phase, by assessing the adequacy and effectiveness of security controls, and by documenting findings in the security assessment report. Create draft approval package. 12 – 20 weeks Conduct testing on initial build Lead: construction/system integrator Documents/Models/Tools: Kali Linux SamuraiSTFU Test CS solution in a test and development environment to ensure system errors are found, corrected before solution is deployed on network. Test CS solution in a test and development environment to ensure system errors are found, corrected before solution is deployed on network. 2 – 4 weeks Construction - conduct pilot implementation deployment Lead: construction/system integrator Documents/Models/Tools: Kali Linux SamuraiSTFU OIT IT Repository Pilot implementation of CS solution on a small subset of user base to evaluate solution against real-world requirements. Conduct site acceptance testing, and if required final penetration testing, and create final approval package. Conduct site acceptance testing, and if required final penetration testing, and create final approval package. Varies with size of deployment (number of facilities and
additionally provide hardware and software lists in Microsoft Excel 2010 or .cvs format and the network diagram in editable AutoCAD 2010 format. Request an editable version of the NAVFAC ICS Checklist from the government, and annotate with information required by the checklist, as well as the date and name of the government representative who witnessed validation of each item. (Demonstrate to the satisfaction of the government that system components are in compliance with the NAVFAC ICS Checklist and Security Controls documentation prior to commissioning. Facilitate government testing of the system via network scans and Security Template Implementation Guide (STIG) testing, and provide support for interpreting scan and STIG test results as needed). Complete ICS Inventory (to include the following attributes, in tabular format): General Information Location Information Hardware Details Operating System and Platform Network Information (Actual Function, not potential function) Miscellaneous Activity Assigned Unique ID Facility Name Device Type Embedded OS (Yes / No) MAC Address(es) Custodian Name Barcode or Identifier NFAID Device Sub-Type OS Vendor IP Address(es) Comments Region Commodity Device Function Operating System (O/S) Upstream Device Custodian Organization Installation Floor Manufacturer O/S Version Protocols In Use Custodian Phone Special Area (Option DNAl) Room Product Line Platform Vendor Host Name Location Model # Platform Product Line System Type Serial # Platform Functional System or Equipment Control Remote Connectivity: (Wired / Wireless / None) Platform Version