Login Form

Some Reading Ideas

Risk Management Framework - RMF SP 800-37

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (nist.gov)

Prepare Essential activities to prepare the organization to manage security and privacy risks.

Implement the controls and document how controls are deployed.

Categorize the system and information processed, stored, and transmitted based on impact analysis. 

Assess to determine if the controls are in place, operating as intended, and producing the desired results. 

Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)

Authorize: Senior official makes a risk-based decision to authorize the system (to operate).

Monitor: Continuously monitor control implementation and risks to the system. 
Table 1: RMF Steps Including Resources for Implementers and Supporting NIST Publications *Read More at Risk Management Framework (RMF) Overview - Risk Management | CSRC

Cybersecurity Framework

Cybersecurity Framework (CSF) Framework Core (nist.gov)

Identify –   Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. The activities in the Identify Function are foundational for effective use of the Framework. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. Examples of outcome Categories within this Function include Asset Management; Business Environment; Governance; Risk Assessment; and Risk Management Strategy.

Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include Identity Management and Access Control; Awareness and Training; Data Security; Information Protection Processes and Procedures; Maintenance; and Protective Technology.

Detect – Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables the timely discovery of cybersecurity events. Examples of outcome Categories within this Function include Anomalies and Events; Security Continuous Monitoring; and Detection Processes. 

Respond – Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. Examples of outcome Categories within this Function include Response Planning; Communications; Analysis; Mitigation; and Improvements.

Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact of a cybersecurity incident. Examples of outcome Categories within this Function include Recovery Planning; Improvements; and Communications. 

Read more about NIST Cybersecurity Framework CSF

Regulatory Compliance Standards and Frameworks

NERC CIP - IP-011

Details
Written by: NERC
Parent Category: Resources
Category: Regulatory Compliance Standards and Frameworks

Article Index

Page 3 of 3

IP-011.1 Implement one or more documented information protection program(s) IP-011 IP-011.1

Each Responsible Entity shall implement one or more documented information protection program(s) that collectively includes each of the applicable requirement parts of Information Protection. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning].
Evidence for the information protection program must include the applicable requirement parts of Information Protection and additional evidence to demonstrate implementation as described in the Measures section.

IP-011.2 Implement one or more documented process(es) for BES Cyber Asset Reuse and Disposal IP-011 IP-011.2

Each Responsible Entity shall implement one or more documented process(es) that collectively include the applicable requirement parts of BES Cyber Asset Reuse and Disposal. [Violation Risk Factor: Lower] [Time Horizon: Operations Planning].
Evidence must include each of the applicable documented processes that collectively include each of the applicable requirement parts of BES Cyber Asset Reuse and Disposal and additional evidence to demonstrate implementation as described in the Measures section.

PS-014.1 Perform an initial risk assessment and subsequent risk assessments of Transmission stations and Transmission substations PS-014 PS-014.1

Each Transmission Owner shall perform an initial risk assessment and subsequent risk assessments of its Transmission stations and Transmission substations (existing and planned to be in service within 24 months) that meet the criteria specified in Applicability Section 4.1.1. The initial and subsequent risk assessments shall consist of a transmission analysis or transmission analyses designed to identify the Transmission station(s) and Transmission substation(s) that if rendered inoperable or damaged could result in instability, uncontrolled separation, or Cascading within an Interconnection. [VRF: High; Time-Horizon: Long-term Planning]
Examples of acceptable evidence may include, but are not limited to, dated written or electronic documentation of the risk assessment of its Transmission stations and Transmission substations (existing and planned to be in service within 24 months) that meet the criteria in Applicability Section 4.1.1 as specified in Requirement 014.1. Additionally, examples of acceptable evidence may include but are not limited to, dated written or electronic documentation of the identification of the primary control center that operationally controls each Transmission station or Transmission substation identified in the Requirement 014.1 risk assessment as specified in Requirement 014.1, Part 1.2.

PS-014.2 Have an unaffiliated third party verify the risk assessment PS-014 PS-014.2

Each Transmission Owner shall have an unaffiliated third party verify the risk assessment performed under Requirement 014.1. The verification may occur concurrently with or after the risk assessment performed under Requirement 014.1. [VRF: Medium; Time-Horizon: Long-term Planning]
Examples of acceptable evidence may include, but are not limited to, dated written or electronic documentation that the Transmission Owner completed an unaffiliated third-party verification of the Requirement 014.1 risk assessment and satisfied all of the applicable provisions of Requirement 014.2, including, if applicable, documenting the technical basis for not modifying the Requirement 014.1 identification as specified under Part 2.3. Additionally, examples of evidence may include but are not limited to, written or electronic documentation of procedures to protect information under Part 2.4.

PS-014.3 Notify the Transmission Operator regarding the identification and the date of completion of Requirement 014.2 PS-014 PS-014.3

For a primary control center(s) identified by the Transmission Owner according to Requirement 014.1, Part 1.2 that a) operationally controls an identified Transmission station or Transmission substation verified according to Requirement 014.2, and b) is not under the operational control of the Transmission Owner: the Transmission Owner shall, within seven calendar days following completion of Requirement 014.2, notify the Transmission Operator that has operational control of the primary control center of such identification and the date of completion of Requirement 014.2. [VRF: Lower; TimeHorizon: Long-term Planning]
Examples of acceptable evidence may include, but are not limited to, dated written or electronic notifications or communications that the Transmission Owner notified each Transmission Operator, as applicable, according to Requirement 014.3.

PS-014.4 Conduct an evaluation of the potential threats and vulnerabilities of a physical attack on each Transmission station(s), Transmission substation(s), and primary control center(s) PS-014 PS-014.4

Each Transmission Owner that identified a Transmission station, Transmission substation, or a primary control center in Requirement 014.1 and verified according to Requirement 014.2, and each Transmission Operator notified by a Transmission Owner according to Requirement 014.3, shall conduct an evaluation of the potential threats and vulnerabilities of a physical attack to each of their respective Transmission station(s), Transmission substation(s), and primary control center(s) identified in Requirement 014.1 and verified according to Requirement 014.2. The evaluation shall consider the following: [VRF: Medium; Time-Horizon: Operations Planning, Long-term Planning]
Examples of evidence may include, but are not limited to, dated written or electronic documentation that the Transmission Owner or Transmission Operator conducted an evaluation of the potential threats and vulnerabilities of a physical attack to their respective Transmission station(s), Transmission substation(s) and primary control center(s) as specified in Requirement 014.4.

PS-014.5 Develop and implement a documented physical security plan(s) of each Transmission station(s), Transmission substation(s), and primary control center(s) PS-014 PS-014.5

Each Transmission Owner that identified a Transmission station, Transmission substation, or primary control center in Requirement 014.1 and verified according to Requirement 014.2, and each Transmission Operator notified by a Transmission Owner according to Requirement 014.3, shall develop and implement a documented physical security plan(s) that covers their respective Transmission station(s), Transmission substation(s), and primary control center(s). The physical security plan(s) shall be developed within 120 calendar days following the completion of Requirement 014.2 and executed according to the timeline specified in the physical security plan(s). The physical security plan(s) shall include the related parts. [VRF: High; Time Horizon: Long-term Planning]
Examples of evidence may include, but are not limited to, dated written or electronic documentation of its physical security plan(s) that covers their respective identified and verified Transmission station(s), Transmission substation(s), and primary control center(s) as specified in Requirement 014.5, and additional evidence demonstrating execution of the physical security plan according to the timeline specified in the physical security plan.

PS-014.6 Have an unaffiliated third party review the evaluation of Requirement 014.4 and the security plan(s) developed under Requirement 014.5 PS-014 PS-014.6

Each Transmission Owner that identified a Transmission station, Transmission substation, or primary control center in Requirement 014.1 and verified according to Requirement 014.2, and each Transmission Operator notified by a Transmission Owner according to Requirement 014.3, shall have an unaffiliated third party review the evaluation performed under Requirement 014.4 and the security plan(s) developed under Requirement 014.5. The review may occur concurrently with or after completion of the evaluation performed under Requirement 014.4 and the security plan development under Requirement 014.5. [VRF: Medium; Time-Horizon: Long-term Planning]
Examples of evidence may include, but are not limited to, written or electronic documentation that the Transmission Owner or Transmission Operator had an unaffiliated third party review the evaluation performed under Requirement 014.4 and the security plan(s) developed under Requirement 014.5 as specified in Requirement 014.6 including, if applicable, documenting the reasons for not modifying the evaluation or security plan(s) in accordance with a recommendation under Part 6.3. Additionally, examples of evidence may include but are not limited to, written or electronic documentation of procedures to protect information under Part 6.4.

Hits: 1578
Main Menu

FIPS PUB 200 Minimum Security Requirements

FIPS PUB 200 Minimum Security Requirements - Visit FIPS 200, Minimum Security Requirements for Federal Info and Info Systems | CSRC (nist.gov)
  • Access Control (AC)
  • Awareness and Training (AT)
  • Audit and Accountability (AU)
  • Certification, Accreditation, and Security Assessments (CA)
  • Configuration Management (CM)
  • Contingency Planning (CP)
  • Identification and Authentication (IA)
  • Incident Response (IR)

Read FIPS PUB 200 Minimum Security Requirements
  • Maintenance (MA)
  • Media Protection (MP)
  • Physical and Environmental Protection (PE)
  • Planning (PL)
  • Personnel Security (PS)
  • Risk Assessment (RA)
  • System and Services Acquisition (SA)
  • System and Communications Protection (SC)
  • System and Information Integrity (SI)

Standards.gov | NIST

Standards.gov | NIST
Documentary Standards can specify the definition of terms; classifications of components; delineation of procedures; specification of dimensions, materials, processes, products, systems, services, or practices; test methods and sampling procedures; or descriptions of fit and measurements of size or strength. Under the National Technology Transfer and Advancement Act (NTTAA), NIST is assigned the responsibility to coordinate federal, state, and local documentary standards and conformity assessment activities.
Standards.gov | Federal Use of Standards | Standards Incorporated by Reference (SIBR) | Industry Standards | International Standards | Military Standards | Standards Issued or Adopted by Federal Agencies | Standards Search Engines | Voluntary Product Standards

NIST Reading

Whether you're preparing for Cybersecurity certification, working with government standards, or simply starting your career in compliance, these are the NIST Federal Information Processing Standards (FIPS), Special Publication (SP), and Interagency Report (IR) topics you need to know. (The Perils of Mount Must Read™ Confessions of a Cliff Note Junky) These resources go onto the "Mountain of Must Read". If you don't recognize the standard reference, you've missed critical understanding. As of 2022, this is the minimum NIST alphabet. All of these documents are found at https://csrc.nist.gov/publications/ Be very careful about static content. Look at links before you launch them. Never use alternate sites for the Computer Security Resource Center. Get the full list here <NIST Reading Extended>

FIPS Publication 140-2 Security Requirements for Cryptographic Modules [FIPS 140-2]
FIPS Publication 199 Standards for Security Categorization of Federal Information and Information Systems [FIPS 199]
FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems [FIPS 200]
FIPS Publication 201-1 Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS 201-1]		 NISTIR 8212 ISCMA: An Information Security Continuous Monitoring Program Assessment
NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems [SP 800-18]
NIST SP 800-30 Risk Management Guide for Information Technology Systems [NIST SP 800-30]
NIST SP 800-34 Contingency Planning Guide for Federal Information Systems [SP 800-34]

US Cert CISA Tweets