Scribd Logo
Upload

Welcome to Scribd!

  • CA-NISTSteps v7

    Uploaded by

    kunalahuja3333
    9 views1 page
    The document outlines 10 tasks across 5 phases of the NIST 800-37 risk management framework: 1) Phase 1 includes 3 initiation tasks - preparing documentation, categorizing the system's confidentiality, integrity and availability levels, and analyzing security controls and risks. 2) Phase 2 contains 2 certification tasks - assessing security controls and documenting security certification. 3) Phase 3 has 3 accreditation tasks - making an accreditation decision, documenting it, and transmitting the security accreditation package. 4) Phase 4 involves 3 monitoring tasks - managing configuration, monitoring controls, and reporting status. 5) Phase 5 is operations and maintenance, with the system owner primarily responsible for ongoing risk management

    Original Description:

    Original Title

    CA-NISTSteps_v7

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document outlines 10 tasks across 5 phases of the NIST 800-37 risk management framework: 1) Phase 1 includes 3 initiation tasks - preparing documentation, categorizing the system's confidentiality, integrity and availability levels, and analyzing security controls and risks. 2) Phase 2 contains 2 certification tasks - assessing security controls and documenting security certification. 3) Phase 3 has 3 accreditation tasks - making an accreditation decision, documenting it, and transmitting the security accreditation package. 4) Phase 4 involves 3 monitoring tasks - managing configuration, monitoring controls, and reporting status. 5) Phase 5 is operations and maintenance, with the system owner primarily responsible for ongoing risk management

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as ppt, pdf, or txt
    9 views1 page

    CA-NISTSteps v7

    Uploaded by

    kunalahuja3333
    The document outlines 10 tasks across 5 phases of the NIST 800-37 risk management framework: 1) Phase 1 includes 3 initiation tasks - preparing documentation, categorizing the system's confidentiality, integrity and availability levels, and analyzing security controls and risks. 2) Phase 2 contains 2 certification tasks - assessing security controls and documenting security certification. 3) Phase 3 has 3 accreditation tasks - making an accreditation decision, documenting it, and transmitting the security accreditation package. 4) Phase 4 involves 3 monitoring tasks - managing configuration, monitoring controls, and reporting status. 5) Phase 5 is operations and maintenance, with the system owner primarily responsible for ongoing risk management

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as ppt, pdf, or txt
    of 1

    NIST 800-37 Risk Management & Certification and Accreditation Tasks

    Phase 1 – Task 1 Phase 1 – Task 2 Phase 1 – Task 3 Phase 2 – Task 4 Phase 2 – Task 5

    Initiation Initiation Initiation Certification Certification


    Notify Officials & Analyze, Update
    Prepare Assess & Evaluate Document Security
    Identify & Accept System
    Documentation Security Controls Certification
    Resources Security Plan
    Integration & Test Integration & Test
    Initiation Phase 1 Planning Phase 3 Multiple Phases 4-6
    Phase 7 Phase 7
    1. Describe the System 1. Notify Program Officials 1. Review Security C.I.A. 1. Prepare Documentation & 1. Provide Findings and
    2. Categorize its C.I.A. 2. Identify Resources Needed Categorizations Supporting Materials Recommendations
    3. Identify Threats to it and Plan execution of 2. Analyze Security Plan 2. Review Methods and 2. Update Security Plan
    4. Identify its Vulnerabilities Activities 3. Update Security Plan Test Procedures 3. Prepare Plan of Action &
    5. Identify In-Place and 4. Obtain Authorizing 3. Assess & Evaluate In- Milestones
    Planned Security Controls Official Acceptance of Place Security Controls 4. Assemble Accreditation
    6. Determine its Initial Risks Security Plan 4. Report Security Package
    Assessment Results

    Phase 3 – Task 6 Phase 3 – Task 7 Phase 4 – Task 8 Phase 4 – Task 9 Phase 4 – Task 10

    Accreditation Accreditation Monitoring Monitoring Monitoring


    Make Security
    Document Security Manage & Control Monitor Security Report & Document
    Accreditation
    Accreditation Configuration Controls Status
    Decision
    Integration & Test Integration & Test
    O&M Phase 9 O&M Phase 9 O&M Phase 9
    Phase 7 Phase 7
    1. Determine Final Risk 1. Transmit Security 1. Document System 1. Select In-Place Security 1. Update Security Plan
    Levels Accreditation Package Changes Controls 2. Update Plan of Action
    2. Accept Residual Risk 2. Update Security Plan 2. Analyze Security 2. Assess Selected & Milestones
    Impacts Security Controls 3. Report Status

    Primary Responsibility
    Phases System Owner
    Certification Agent
    NIST 800-37
    Authorizing Official
    SDLC System Owner

    You might also like