Introduction: The National Institute of Standards and Technology (NIST) replaced the former NIST Special Publication 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems with NIST Special Publication 800-37 Revisi

RMF To-Do List

RMF Tasks Status (done/not done)

Discuss how you determined the status of each task. Consider the following: If done, is it complete? Where is it located? If not done, what are the recommendations for completing? Where should the results be saved?

External documents needed for task

RMF Step 1: Categorize Information Systems 1.1 Security Categorization Using either FIPS 199 or CNSS 1253, categorize the information system. The completed categorization should be included in the security plan.

Not done As highlighted in the risk assessment, there is no security plan done (p.18). Add the security categorization information to the security plan.

The security categorization that was completed in the risk assessment can be included in the security plan. The full categorization can be found on pp. 14-16. The categorization done in the risk analysis is based on FIPS 199.

FIPS 199 for nonnational security systems, CNSS 1253 for national security systems

1.2 Information System Description Is a description of the information system included in the security plan? 1.3 Information System Registration Identify offices that the information system should be registered with. These can be organizational or management offices. RMF Step 2: Select Security Controls

2.1 Common Control Identification Describe common security controls in place in the organization. Are the controls included in the security plan? 2.2 Security Control Selection Are selected security controls for the information system documented in the security plan? 2.3 Monitoring Strategy What security control monitoring strategies should be used to protect the information system and its environment of operation? 2.4 Security Plan Approval Has the security plan been reviewed and approved? RMF Step 3: Implement Security Controls 3.1 Security Control Implementation Have the security controls specified in the security plan been implemented? 3.2 Security Control Documentation Has the security control implementation been documented?

RMF Step 4: Assess Security Controls 4.1 Assessment Preparation Has a plan to assess the security controls been developed? 4.2 Security Control Assessment Have the security controls defined in the security assessment plan been assessed? 4.3 Security Assessment Report Has the security assessment report from the security control assessment been completed? 4.4 Remediation Actions What remediation actions on security controls need to be taken based on the findings and recommendations of the security assessment report? RMF Step 5: Authorize Information System

5.1 Plan of Action and Milestones Is there a completed plan of action and milestones based on the findings and recommendations of the security assessment report excluding any remediation actions taken? 5.2 Security Authorization Package Has the security package been authorized and submitted to the authorizing official? 5.3 Risk Determination What is the risk to organizational operations, organizational assets, individuals, and other organizations? 5.4 Risk Acceptance Is the risk to organizational operations, organizational assets, individuals, and other organizations acceptable? RMF Step 6: Monitor Security Controls

6.1 Information System and Environment Changes What is the security impact of changes to the information system and its environment of operation? 6.2 Ongoing Security Control Assessments Which security controls from the subset of the technical, management, and operational security controls should be assessed? 6.3 Ongoing Remediation Actions What remediation actions need to be taken based on results of monitoring activities? 6.4 Key Updates Has the security plan, assessment report, and plan of action been updated based on the continuous monitoring process?

6.5 Security Status Reporting Has a security status report been given to the authorizing officials?