| 2.3.12-1-1 Ensure the System Security Plan correctly categorizes the system Confidentiality, Integrity, and Availability Impact |
Phase A |
Phase B |
|
Ensure application of the Security Categorization Task. For NSS, the Security Categorization Task (RMF Step is a two-step process which includes 1) determining the impact values: (i) for the information type(s) processed, stored, transmitted, or protected by the information system; and (ii) for the information system. And 2) identifying overlays that apply to the information system and its operating environment to account for additional factors (beyond impact) that influence the selection of security controls. The RMF categorization step, including consideration of legislation, policies, directives, regulations, standards, and organizational mission/business/operational requirements, facilitates the identification of security requirements.
|
AFMAN 63-119 A4.14.1; AFMAN 63-119 A9.1.3.2; AFMAN 63-119 A12.1.4
|
NA
|
Guide for Applying the Risk Management Framework to Federal Information Systems, NIST SP 800-37; CNSSI No. 1253, Security Categorization And Control Selection For National Security Systems; AFMAN 63-119 or equivalent
|
| 2.3.12-1-2 Ensure the system security plan describes the Information System, its security perimeter, and enterprise architecture, and provides an overview of the security controls and the requirements and mechanisms for the meeting those controls |
Phase A |
Phase B |
|
Ensure descriptive information about the information system is documented in the system identification section of the security plan, included in attachments to the plan, or referenced in other standard sources for information generated as part of the system development life cycle. Duplication of information is avoided, whenever possible. The level of detail provided in the security plan is determined by the organization and is typically commensurate with the security categorization of the information system. Information may be added to the system description as it becomes available during the system development life cycle and execution of the RMF tasks. For a list of examples, see NIST SP 800-37 Task 1-2.
|
NA
|
NA
|
Guide for Applying the Risk Management Framework to Federal Information Systems, NIST SP 800-37; CNSSI No. 1253, Security Categorization And Control Selection For National Security Systems
|