N/A Contractor’s Report of Sales for RMF Services Attachment H (Excel Spreadsheet) Contractor’s Report of for RMF Services GSA CO Quarterly 3.1.1 FIPS 199 Security Categorization NIST NIST SP (Volume I and II) In accordance with the FISMA, Federal Information Processing Standard (FIPS) Publication 199 provides the standard for categorizing Federal information and Federal information systems. System categorization is based on the potential impact of a disruption to an information system. The disruption could have a limited (low), serious (moderate), or catastrophic (high) adverse effect on the ability to continue daily operations, safeguard assets, protect individuals, and/or accomplish the organization and Federal mission requirements. Reference NIST site for best practices Task Order COR TBD by Task Order 3.1.1 Threat Assessment NIST SP The threat assessment is tailored to the individual organization and its processing environment (e.g., computing habits). In general, information on natural threats (e.g., floods, earthquakes, storms) is readily available. A threat assessment lists potential threats that are applicable to the IT system being evaluated. Reference NIST site for best practices Task Order COR TBD by Task Order 3.1.2 System Definition Document This document records a description of the system, boundaries, type of information, system type, PIA and e-Authentication requirements, etc. This is usually done prior to the development of a security plan. Reference NIST site for best practices Task Order COR TBD by Task Order
3.1.3 Registration NIST SP The registration identifies the information system (and subsystems, if appropriate) in the system inventory and establishes a relationship between the information system and the parent or governing organization that owns, manages, and/or controls the system. Reference NIST site for best practices Task Order COR TBD by Task Order 3.2.1 Updated Security Control Selection Documentation NIST SP The updated security control selection documentation includes, as appropriate: (i) updated tailored baseline security controls by applying scoping, parameterization, and compensating control guidance; (ii) updated supplemented, tailored baseline security controls, if necessary, with additional controls or control enhancements to address unique organizational needs based on a risk assessment and local conditions; and (iii) updated minimum assurance requirements. Reference NIST site for best practices. Task Order COR TBD by Task 3.2.1 System Security Plan The system security plan is a formal document that provides an overview of the security requirements for the information system and describes the security controls in place or planned for meeting those requirements. This deliverable takes the System Definition Document and the original and updated Security Control Selection Documentation and builds the SSP with that information. Reference NIST site for best practices. Task Order COR TBD by Task Order
The issue resolution provides an audit trail, accelerates the C&A, and documents management accountability. 4.3.3 Continuous Monitoring Report NIST SP , NIST SP The continuous monitoring report, provides the results of continuous monitoring of the security controls in the information system to determine the extent to which the controls are implemented correctly, continue to operate as intended, and continue to produce the desired outcome with respect to meeting the system security requirements. Reference NIST site for best practices. Task Order COR TBD by Task Order 4.3.3 Plan of Action & Milestones NIST SP OMB M-02-01 The plan of action and milestones, which is prepared by the information system owner, describes the measures that have been implemented or planned: (i) to correct any deficiencies noted during the assessment of the security controls; and (ii) to reduce or eliminate known vulnerabilities in the information system. Task Order COR TBD by Task 4.3.3 Updated System Security Plan The updated system security plan is a formal document that provides updates to the overview of the security requirements for the information system and describes the updated security controls in place or planned for meeting those requirements. Reference NIST site for best practices. Task Order COR TBD by Task 4.4.3 Privacy Threshold Analysis A Privacy Threshold Analysis (PTA) can be used to determine whether a PIA is needed. The PTA should include whether or not the system exists or is new, if the system collects, maintains, or shares information in the identifiable form, if that the information is about the public, and specific attributes about that information. Once complete, the Privacy Act Officer will review the PTA and determine if a PIA is required. Task Order COR TBD by Task Order