Login Form

ISC2 East Bay Chapter

Some Reading Ideas

Risk Management Framework - RMF SP 800-37

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (nist.gov)

Prepare Essential activities to prepare the organization to manage security and privacy risks.

Implement the controls and document how controls are deployed.

Categorize the system and information processed, stored, and transmitted based on impact analysis. 

Assess to determine if the controls are in place, operating as intended, and producing the desired results. 

Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)

Authorize: Senior official makes a risk-based decision to authorize the system (to operate).

Monitor: Continuously monitor control implementation and risks to the system. 
Table 1: RMF Steps Including Resources for Implementers and Supporting NIST Publications *Read More at Risk Management Framework (RMF) Overview - Risk Management | CSRC

Cybersecurity Framework

Cybersecurity Framework (CSF) Framework Core (nist.gov)

Identify –   Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. The activities in the Identify Function are foundational for effective use of the Framework. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. Examples of outcome Categories within this Function include Asset Management; Business Environment; Governance; Risk Assessment; and Risk Management Strategy.

Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include Identity Management and Access Control; Awareness and Training; Data Security; Information Protection Processes and Procedures; Maintenance; and Protective Technology.

Detect – Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables the timely discovery of cybersecurity events. Examples of outcome Categories within this Function include Anomalies and Events; Security Continuous Monitoring; and Detection Processes. 

Respond – Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. Examples of outcome Categories within this Function include Response Planning; Communications; Analysis; Mitigation; and Improvements.

Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact of a cybersecurity incident. Examples of outcome Categories within this Function include Recovery Planning; Improvements; and Communications. 

Read more about NIST Cybersecurity Framework CSF

Process Transformation

Procedure Guidelines and Controls Documentation - Templates

Details
Written by: Robin Basham
Parent Category: Services
Category: Process Transformation

Article Index

Page 16 of 18

Product, Application Development, and Quality Templates

Object Name

Function

Owners

Approve Date

Change Committee Review Board

The Change Committee Review Board Template guides the completion of documentation for the purpose of enterprise or high priority/impact Change Management.

[Name of Chief Technology Officer]

  

Change Review Board Checklist

Checklist identifies validation items before a change control can be approved or closed

    

Emergency Deployment Authorization

Emergency code change requires written approval by Quality, Development, and CTO. The Emergency deployment form represents signed approval by all necessary parties and is submitted to the Network or Data Center Operations prior to emergency deployment of code to production. Emergency change is subject to Change Management policy and is reviewed prior to and post change implementation.

[Name of Chief Security Officer]

  

High-Level Test Plan

Template is used to document high-level aspects of a test plan

[Name of Chief Technology Officer], [Name of Quality Assurance Manager]

  

ICQ Physical Security

Template is used to generate a new unique instance of ICQ Physical Security. Templates, when used, constitute a work product, which is processed and then stored as control evidence in the \\...\PAL\IT Process Asset Library\Process and Procedures\Security Management\Template\ folder

[Name of Chief Security Officer], [Name of Chief Technology Officer]

  

ICQ Security Policy

Template is used to generate a new unique instance of ICQ Security Policy. Templates, when used, constitute a work product, which is processed and then stored as control evidence in the \\...\PAL\IT Process Asset Library\Process and Procedures\Security Management\Template\ folder.

[Name of Chief Security Officer], [Name of Chief Technology Officer]

  

Implementation Planning Template

Provides documentation format for an implementation.

[Name of Process Librarian]

  

Internal Control Testing Template

Template is used to document all aspects of testing an internal control

[Name of Process Librarian]

  

Meeting Agenda and Minutes.dot

  

[Name of Process Librarian]

  

Meeting Form Letter

This letter is linked in the console as a template.

[Name of Process Librarian]

  

Meeting Minutes Template.dot

  

[Name of Process Librarian]

  

Network Change Identification Form

Template is used when changes and/or security violations are found on the network, to systems, or to servers that did not go through the formal change control process.

[Name of Chief Security Officer]

  

Policy Profile

      

Process Profile Template

Template is used to document all areas of a process

[Name of Process Librarian]

  

Program Profile Template

Template is used to document all areas of a program

[Name of Process Librarian]

  

Project Charter

Template is used to document the scope, assurance, and resources of a project

[Name of Process Librarian]

  

Project Plan Definition

Template is used to document all areas of a Project Plan

    

QA Planning Kickoff Check List

Template is used to guide documents and tasks needed prior to QA Planning

    

Request For Exemption

Template is used to document all areas of risk associated with requested exemption

[Name of Chief Security Officer]

June 23, 2005

Request For Removal of Media

Template is used to generate a new unique instance of Request For Removal of Media Template. Templates, when used, constitute a work product, which is processed and then stored as control evidence in the \\...\PAL\IT Process Asset Library\Process and Procedures\Security Management\Template\ folder.

[Name of Chief Security Officer], [Name of Chief Technology Officer]

  

Requirements Completeness Checklist

Template is used to guide the review of requirements to assure completeness across all areas.

, [Name of Product or Project Management Director]

  

Risk Criteria

Template is used to generate a new unique instance of Risk Criteria Template. Templates, when used, constitute a work product, which is processed and then stored as control evidence in the \\...\PAL\IT Process Asset Library\Process and Procedures\Security Management\Template\ folder.

    

RunBook Security Section What to Describe

Template is used to generate a new unique instance of RunBook Security Section What to Describe Template: (For financial/high-risk servers). Templates, when used, constitute a work product, which is processed and then stored as control evidence in the \\...\PAL\IT Process Asset Library\Process and Procedures\Security Management\Template\ folder.

[Name of Chief Security Officer], [Name of Chief Technology Officer]

  

Secure Email and File Transfer

Template is used to document electronic security regarding email and file transfer.

[Name of Chief Security Officer]

  

Security Infrastructure Plan

The purpose of the Security Infrastructure Plan is to establish strategic, tactical and annual information security plans for COMPANY.

[Name of Chief Security Officer]

  

Security Program and Program Test Profile

Template is used to generate a new unique instance of Security Program and Program Test Profile Template. Templates, when used, constitute a work product, which is processed and then stored as control evidence in the \\...\PAL\IT Process Asset Library\Process and Procedures\Security Management\Template\ folder.

    

Situation Evaluation Form

Template is used to used to capture and fully develop and analyze security risks.

[Name of Chief Security Officer]

  

Software Requirement Specifications Template

Template is used to document all requirements for software

Thom Gray, [Name of Product or Project Management Director]

  

RunBook Template

The RunBook or System Documentation book contains information necessary to run and maintain a core business system. In the event of emergency staffing change, this document serves to guide a new employee through the support of this system.

    

System Operational Requirement

Template is used to document all operational requirements for a system

    

Test Plan Template

Template is used to document all areas of a Test Plan

    

User Access Program Checklist

Template is used to generate a new unique instance of User Access Controls Work Program Template. Templates, when used, constitute a work product, which is processed and then stored as control evidence in the \\...\PAL\IT Process Asset Library\Process and Procedures\Security Management\Template\ folder.

[Name of Chief Security Officer], [Name of Chief Technology Officer]

  

Employee Warning Notice

Template is used to warn an employee when they do something inappropriate and how to improve.

    

Job Analysis Questionnaire

Job Analysis Questionnaire template is used to describe employee's responsibilities and duties among other things.

    

Job Description Template

Template is used to provide a brief description of the general nature of the position, an overview of why the job exists, and what the job is to accomplish.

    

[Name of the core product or service] R# Internal Release Notes

The purpose of these release notes is to describe the feature enhancements and fixes that were included in [Name of core product or service] Release ###.

    

Which Tool Stores Process and Work Instruction information?

Process Engineering manages a list of all Work Instructions and Processes in the Facilitated Compliance Management Object table. There are a variety of reports that summarize the function for all processes as well as provide an overview of all process flow diagrams.

FCM Front Menu

Figure 22. Facilitated Compliance Management provides summary reports for many object types

Tools Report

Figure 23. Facilitated Compliance Management Allows Process Librarian to capture and catalog all process objects

Flow Diagram

EnterpriseGRC Solutions, Inc. Consultants are famous for documentation

Visio on Steroids

When Do I Use a Flow Diagram?

Flow Diagrams are developed to provide a high-level summary of steps in any process or procedure. They are "High Level", not vague. Controls are also listed in Flow Diagrams, further demonstrating constraints that either prevent error or reinforce correct movement. Key control template objects are created by process engineering in response to the current controls in scope for audit. These items detail all aspects that control a process.

Following are my favorite choices for simple Process Objects and some suggestions for using Visio to capture and automate their properties

 p change managementp change measurement and evaluation

See or download "Sample of A Business Process" in Word 2016 (please virus scan all downloads)

Visio Shapes and Custom Properties for Evidence of Process Controls

Process Objects

Process Identification Attributes

 Process Title and Scope

Document Title, Scope, Revision, Release Date, Editors, Affirmation Team
Always Sequence 0.0

Parent

 Parent Process Owners Scope

Reference to other process documents and to full processes outside of the scope of the current document.
Part of processes sequence

Activity

 Activity Attributes including controls

Identifies process activity, noting control issues and potential gaps, owners and event sequence.
Part of processes sequence

decision

 Decision

Decision point and criteria for movement
Part of processes sequence

Grouping

 group

Grouping allows representation of simultaneous events
Sequence should parent-child the subgroup of activities

Loop Limit

 Loop Limit - Versus Automation Hell

Loop limits usually reflect key controls
Various Data Types - All are important Information Objects Data Management: What data is used, how is it classified, retained, transferred, accessed
inputs and outputs are controls Exit and entrance criteria are in input and output rows. They are all forms of measurement and control. Data Management: What data is used, how is it classified, retained, transferred, accessed
Start and End are triggers that are measured Terminator and Start of Process - Only one start and finish

List of external documents used to complete the process, the status of use in controls evidence, creation frequency, description of use Sequence is always 9.9 so that all data sources are clustered to the bottom of the process report.
Control Object Attributes Controls on process

Exit and entrance criteria for movement from one activity to the next. Where criteria for movement is monitored by a system and is critical to control activity, this should be filled in. Where this is true, there would be an expected control.
Database attributes are very important Database Controls are very important

Trigger and Exit criteria
The sequence is always 0.1 so that all triggers and exit criteria are clustered to the top of the process report.

 

Hits: 6745
Main Menu

FIPS PUB 200 Minimum Security Requirements

FIPS PUB 200 Minimum Security Requirements - Visit FIPS 200, Minimum Security Requirements for Federal Info and Info Systems | CSRC (nist.gov)
  • Access Control (AC)
  • Awareness and Training (AT)
  • Audit and Accountability (AU)
  • Certification, Accreditation, and Security Assessments (CA)
  • Configuration Management (CM)
  • Contingency Planning (CP)
  • Identification and Authentication (IA)
  • Incident Response (IR)

Read FIPS PUB 200 Minimum Security Requirements
  • Maintenance (MA)
  • Media Protection (MP)
  • Physical and Environmental Protection (PE)
  • Planning (PL)
  • Personnel Security (PS)
  • Risk Assessment (RA)
  • System and Services Acquisition (SA)
  • System and Communications Protection (SC)
  • System and Information Integrity (SI)

Standards.gov | NIST

Standards.gov | NIST
Documentary Standards can specify the definition of terms; classifications of components; delineation of procedures; specification of dimensions, materials, processes, products, systems, services, or practices; test methods and sampling procedures; or descriptions of fit and measurements of size or strength. Under the National Technology Transfer and Advancement Act (NTTAA), NIST is assigned the responsibility to coordinate federal, state, and local documentary standards and conformity assessment activities.
Standards.gov | Federal Use of Standards | Standards Incorporated by Reference (SIBR) | Industry Standards | International Standards | Military Standards | Standards Issued or Adopted by Federal Agencies | Standards Search Engines | Voluntary Product Standards

NIST Reading

Whether you're preparing for Cybersecurity certification, working with government standards, or simply starting your career in compliance, these are the NIST Federal Information Processing Standards (FIPS), Special Publication (SP), and Interagency Report (IR) topics you need to know. (The Perils of Mount Must Read™ Confessions of a Cliff Note Junky) These resources go onto the "Mountain of Must Read". If you don't recognize the standard reference, you've missed critical understanding. As of 2022, this is the minimum NIST alphabet. All of these documents are found at https://csrc.nist.gov/publications/ Be very careful about static content. Look at links before you launch them. Never use alternate sites for the Computer Security Resource Center. Get the full list here <NIST Reading Extended>

FIPS Publication 140-2 Security Requirements for Cryptographic Modules [FIPS 140-2]
FIPS Publication 199 Standards for Security Categorization of Federal Information and Information Systems [FIPS 199]
FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems [FIPS 200]
FIPS Publication 201-1 Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS 201-1]		 NISTIR 8212 ISCMA: An Information Security Continuous Monitoring Program Assessment
NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems [SP 800-18]
NIST SP 800-30 Risk Management Guide for Information Technology Systems [NIST SP 800-30]
NIST SP 800-34 Contingency Planning Guide for Federal Information Systems [SP 800-34]

US Cert CISA Tweets