example nist 800-53 cybersecurity standardized...

IT IS PROHIBITED TO DISCLOSE THIS DOCUMENT TO THIRD‐PARTIES WITHOUT AN EXECUTED NON‐DISCLOSURE AGREEMENT (NDA)

STANDARDIZED OPERATING PROCEDURES (SOP)

[NIST SP 800 53 REV4 LOW‐MODERATE BASELINES]

ACME Business Consulting, LLC

of 373 IT IS PROHIBITED TO DISCLOSE THIS DOCUMENT TO THIRD‐PARTIES

WITHOUT AN EXECUTED NON‐DISCLOSURE AGREEMENT (NDA)

TABLE OF CONTENTS

OVERVIEW, INSTRUCTIONS & EXAMPLE 12 KEY TERMINOLOGY 12 OVERVIEW 12

Customization Guidance 12 Validating Needs for Procedures / Control Activities 12

UNDERSTANDING CONTROL OBJECTIVES & CONTROLS 12 PROCEDURES DOCUMENTATION 13

NIST National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework 14 Example Procedure 14 Supporting Policies & Standards 17

NIST 800‐53 REV4 CONTROL FAMILIES 18

KNOWN COMPLIANCE REQUIREMENTS 19 STATUTORY REQUIREMENTS 19 REGULATORY REQUIREMENTS 19 CONTRACTUAL REQUIREMENTS 19

MANAGEMENT CONTROLS 20 PROGRAM MANAGEMENT (PM) 20

P‐PM‐1: Information Security Program Plan 20 P‐PM‐2: Senior Information Security Officer 21 P‐PM‐3: Information Security Resources 21 P‐PM‐4: Plan of Action & Milestones (POA&M) Process (Vulnerability Remediation) 22 P‐PM‐5: Information System Inventory 23 P‐PM‐6: Information Security Measures of Performance 23 P‐PM‐7: Enterprise Architecture 24 P‐PM‐8: Critical Infrastructure Plan (CIP) 25 P‐PM‐9: Risk Management Strategy 26 P‐PM‐10: Security Authorization Process 27 P‐PM‐11: Mission / Business Process Definition 27 P‐PM‐12: Insider Threat Program 28 P‐PM‐13: Information Security Workforce 29 P‐PM‐14: Testing, Training & Monitoring 30 P‐PM‐15: Contacts With Security Groups & Associations 31 P‐PM‐16: Threat Awareness Program 31

SECURITY ASSESSMENTS & AUTHORIZATION (CA) 33 P‐CA‐1: Security Assessment & Authorization Policy & Procedures 33 P‐CA‐2: Security Assessments 34

P‐CA‐2(1): Security Assessments | Independent Assessors 34 P‐CA‐2(2): Security Assessments | Specialized Assessments 35 P‐CA‐2(3): Security Assessments | External Organizations 36

P‐CA‐3: System Interconnections 37 P‐CA‐3(3): System Interconnections | Unclassified Non‐National Security System Connections 37 P‐CA‐3(5): System Interconnections | Restrictions on External System Connections 38

P‐CA‐4: Security Certification [withdrawn from NIST 800‐53 rev4] 39 P‐CA‐5: Plan of Action & Milestones (POA&M) 39 P‐CA‐6: Security Authorization 40 P‐CA‐7: Continuous Monitoring 40

P‐CA‐7(1): Continuous Monitoring | Independent Assessment 42 P‐CA‐8: Penetration Testing 42

P‐CA‐8(1): Penetration Testing | Independent Penetration Agent or Team 44 P‐CA‐9: Internal System Connections 44

PLANNING (PL) 46 P‐PL‐1: Security Planning Policy & Procedures 46 P‐PL‐2: System Security Plan (SSP) 46

P‐PL‐2(3): System Security Plan | Plan / Coordinate with Other Organizational Entities 48 P‐PL‐3: System Security Plan Update [withdrawn from NIST 800‐53 rev4] 49 P‐PL‐4: Rules of Behavior 49



P‐PL‐4(1): Rules Of Behavior | Social Media & Social Networking Restrictions 50 P‐PL‐5: Privacy Impact Assessment [withdrawn from NIST 800‐53 rev4] 50 P‐PL‐6: Security‐Related Activity Planning [withdrawn from NIST 800‐53 rev4] 50 P‐PL‐7: Security Concept Of Operations 50 P‐PL‐8: Information Security Architecture 51 P‐PL‐9: Central Management 52

RISK ASSESSMENT (RA) 54 P‐RA‐1: Risk Assessment Policy & Procedures 54 P‐RA‐2: Security Categorization 54 P‐RA‐3: Risk Assessment 55 P‐RA‐4: Risk Assessment Update [withdrawn from NIST 800‐53 rev4] 56 P‐RA‐5: Vulnerability Scanning 56

P‐RA‐5(1): Vulnerability Scanning | Update Tool Capability 57 P‐RA‐5(2): Vulnerability Scanning | Update by Frequency / Prior to New Scan / When Identified 58 P‐RA‐5(3): Vulnerability Scanning | Breadth / Depth of Coverage 59 P‐RA‐5(5): Vulnerability Scanning | Privileged Access 59 P‐RA‐5(6): Vulnerability Scanning | Automated Trend Analysis 60 P‐RA‐5(8): Vulnerability Scanning | Review Historical Audit Logs 60

P‐RA‐6: Technical Surveillance Countermeasures Security 61 SYSTEM & SERVICE ACQUISITION (SA) 63

P‐SA‐1: System & Services Acquisition Policy & Procedures 63 P‐SA‐2: Allocation of Resources 63 P‐SA‐3: System Development Life Cycle (SDLC) 64 P‐SA‐4: Acquisition Process 65

P‐SA‐4(1): Acquisition Process | Functional Properties Of Security Controls 66 P‐SA‐4(2): Acquisition Process | Design & Implementation of Security Controls 66 P‐SA‐4(8): Acquisition Process | Continuous Monitoring Plan 67 P‐SA‐4(9): Acquisition Process | Functions, Ports, Protocols & Services In Use 68 P‐SA‐4(10): Acquisition Process | Use of Approved PIV Products 68

P‐SA‐5: Information System Documentation 69 P‐SA‐6: Software Usage Restrictions [withdrawn from NIST 800‐53 rev4] 70 P‐SA‐7: User‐Installed Software [withdrawn from NIST 800‐53 rev4] 70 P‐SA‐8: Security Engineering Principles 70 P‐SA‐9: External Information System Services 71

P‐SA‐9(1): External Information System Services | Risk Assessments & Organizational Approvals 72 P‐SA‐9(2): External Information System Services | Identification Of Functions, Ports, Protocols & Services 73 P‐SA‐9(3): External Information System Services | Maintain Trust Relationship with Providers 74 P‐SA‐9(4): External Information System Services | Consistent Interests of Consumers and Providers 75 P‐SA‐9(5): External Information System Services | Processing, Storage and Service Location 76

P‐SA‐10: Developer Configuration Management 76 P‐SA‐10(1): Developer Configuration Management | Software / Firmware Integrity Verification 77

P‐SA‐11: Developer Security Testing 78 P‐SA‐11(1): Developer Security Testing | Static Code Analysis 79 P‐SA‐11(2): Developer Security Testing | Threat Analysis & Flaw Remediation 79 P‐SA‐11(8): Developer Security Testing | Dynamic Code Analysis 80

P‐SA‐12: Supply Chain Protection 81 P‐SA‐13: Trustworthiness 82 P‐SA‐14: Criticality Analysis 83 P‐SA‐15: Development Process, Standards & Tools 83

P‐SA‐15(9): Development Process, Standards & Tools | Use of Live Data 85 P‐SA‐16: Developer‐Provided Training 85 P‐SA‐17: Developer Security Architecture & Design 86 P‐SA‐18: Tamper Resistance & Detection 87

P‐SA‐18(2): Tamper Resistance & Detection | Inspection of Information Systems, Components or Devices 88 P‐SA‐19: Component Authenticity 89 P‐SA‐20: Customized Development of Critical Components 89 P‐SA‐21: Developer Screening 90 P‐SA‐22: Unsupported System Components 91



P‐SA‐22(1): Unsupported System Components | Alternate Sources For Continued Support 91

AWARENESS & TRAINING (AT) 93 P‐AT‐1: Security Awareness & Training Policy & Procedures 93 P‐AT‐2: Security Awareness Training 94

P‐AT‐2(2): Security Awareness Training | Insider Threat 94 P‐AT‐3: Role‐Based Security Training 95 P‐AT‐4: Security Training Records 96 P‐AT‐5: Contacts with Security Groups & Associations [withdrawn from NIST 800‐53 rev4] 97

OPERATIONAL CONTROLS 98 CONTINGENCY PLANNING (CP) 98

P‐CP‐1: Contingency Planning Policy & Procedures 98 P‐CP‐2: Contingency Plan 98

P‐CP‐2(1): Contingency Plan | Coordinate with Related Plans 99 P‐CP‐2(2): Contingency Plan | Capacity Planning 100 P‐CP‐2(3): Contingency Plan | Resume Essential Missions / Business Functions 101 P‐CP‐2(8): Contingency Plan | Identify Critical Assets 101

P‐CP‐3: Contingency Training 102 P‐CP‐4: Contingency Plan Testing 103

P‐CP‐4(1): Contingency Plan Testing | Coordinate with Related Plans 103 P‐CP‐5: Contingency Plan Update [withdrawn from NIST 800‐53 rev4] 104 P‐CP‐6: Alternate Storage Site 104

P‐CP‐6(1): Alternate Storage Site | Separation from Primary Site 105 P‐CP‐6(3): Alternate Storage Site | Accessibility 105

P‐CP‐7: Alternate Processing Site 106 P‐CP‐7(1): Alternate Processing Site | Separation from Primary Site 107 P‐CP‐7(2): Alternate Processing Site | Accessibility 108 P‐CP‐7(3): Alternate Processing Site | Priority of Service 108

P‐CP‐8: Telecommunications Services 109 P‐CP‐8(1): Telecommunications Services | Priority of Service Provisions 110 P‐CP‐8(2): Telecommunications Services | Single Points of Failure 110

P‐CP‐9: Information System Backup 111 P‐CP‐9(1): Information System Backup | Testing for Reliability & Integrity 112 P‐CP‐9(3): Information System Backup | Separate Storage for Critical Information 113 P‐CP‐9(5): Information System Backup | Transfer to Alternate Storage Site 113

P‐CP‐10: Information System Recovery & Reconstitution 114 P‐CP‐10(2): Information System Recovery & Reconstitution | Transaction Recovery 115

P‐CP‐11: Alternate Communications Protocols 115 P‐CP‐12: Safe Mode 116 P‐CP‐13: Alternative Security Measures 117

INCIDENT RESPONSE (IR) 118 P‐IR‐1: Incident Response Policy & Procedures 118 P‐IR‐2: Incident Response Training 118 P‐IR‐3: Incident Response Testing 119

P‐IR‐3(2): Incident Response Testing | Coordination with Related Plans 120 P‐IR‐4: Incident Handling 120

P‐IR‐4(1): Incident Handling | Automated Incident Handling Processes 121 P‐IR‐5: Incident Monitoring 122 P‐IR‐6: Incident Reporting 122

P‐IR‐6(1): Incident Reporting | Automated Reporting 123 P‐IR‐7: Incident Reporting Assistance 124

P‐IR‐7(1): Incident Reporting Assistance | Automation Support of Availability of Information / Support 124 P‐IR‐7(2): Incident Reporting Assistance | Coordination With External Providers 125

P‐IR‐8: Incident Response Plan (IRP) 126 P‐IR‐9: Information Spillage Response 127

P‐IR‐9(1): Information Spillage Response | Responsible Personnel 128 P‐IR‐9(2): Information Spillage Response | Training 128 P‐IR‐9(3): Information Spillage Response | Post‐Spill Operations 129



P‐IR‐9(4): Information Spillage Response | Exposure to Unauthorized Personnel 129 P‐IR‐10: Integrated Information Security Analysis Team 130

MEDIA PROTECTION (MP) 132 P‐MP‐1: Media Protection Policy & Procedures 132 P‐MP‐2: Media Access 132 P‐MP‐3: Media Marking 133 P‐MP‐4: Media Storage 134 P‐MP‐5: Media Transport 135

P‐MP‐5(4): Media Transport | Cryptographic Protection (Encrypting Data In Storage Media) 135 P‐MP‐6: Media Sanitization 136

P‐MP‐6(1): Media Sanitization | Review, Approve, Track, Document & Verify 137 P‐MP‐6(2): Media Sanitization | Equipment Testing 138

P‐MP‐7: Media Use 138 P‐MP‐7(1): Media Use | Prohibit Use Without Owner 139

P‐MP‐8: Media Downgrading 139

PERSONNEL SECURITY (PS) 141 P‐PS‐1: Personnel Security Policy & Procedures 141 P‐PS‐2: Position Risk Designation (Position Categorization) 141 P‐PS‐3: Personnel Screening 142

P‐PS‐3(3): Personnel Screening | Information With Special Protection Measures 143 P‐PS‐4: Personnel Termination 144 P‐PS‐5: Personnel Transfer 145 P‐PS‐6: Access Agreements 145 P‐PS‐7: Third‐Party Personnel Security 146 P‐PS‐8: Personnel Sanctions 147

PHYSICAL & ENVIRONMENTAL PROTECTION (PE) 148 P‐PE‐1: Physical & Environmental Protection Policy & Procedures 148 P‐PE‐2: Physical Access Authorizations 148

P‐PE‐2(2): Physical Access Authorizations | Two Forms of Identification 149 P‐PE‐2(3): Physical Access Authorizations | Restrict Unescorted Access 150

P‐PE‐3: Physical Access Control 150 P‐PE‐4: Access Control For Transmission Medium 151 P‐PE‐5: Access Control For Output Devices 152 P‐PE‐6: Monitoring Physical Access 153

P‐PE‐6(1): Monitoring Physical Access | Intrusion Alarms / Surveillance Equipment 154 P‐PE‐7: Visitor Control [withdrawn from NIST 800‐53 rev4] 154 P‐PE‐8: Visitor Access Records 155 P‐PE‐9: Power Equipment & Power Cabling 155 P‐PE‐10: Emergency Shutoff 156 P‐PE‐11: Emergency Power 157 P‐PE‐12: Emergency Lighting 157 P‐PE‐13: Fire Protection 158

P‐PE‐13(2): Fire Protection | Fire Suppression Devices 159 P‐PE‐13(3): Fire Protection | Automatic Fire Suppression 159

P‐PE‐14: Temperature & Humidity Controls 160 P‐PE‐14(2): Temperature & Humidity Controls | Monitoring with Alarms / Notifications 160

P‐PE‐15: Water Damage Protection 161 P‐PE‐16: Delivery & Removal 162 P‐PE‐17: Alternate Work Site 162 P‐PE‐18: Location of Information System Components 163 P‐PE‐19: Information Leakage 164 P‐PE‐20: Asset Monitoring & Tracking 165

TECHNICAL CONTROLS 167 ACCESS CONTROL (AC) 167

P‐AC‐1: Access Control Policy & Procedures 167 P‐AC‐2: Account Management 168



P‐AC‐2(1): Account Management | Automated System Account Management 169 P‐AC‐2(2): Account Management | Removal of Temporary / Emergency Accounts 169 P‐AC‐2(3): Account Management | Disable Inactive Accounts 170 P‐AC‐2(4): Account Management | Automated Audit Actions 171 P‐AC‐2(5): Account Management | Inactivity Logout 171 P‐AC‐2(7): Account Management | Role Based Schemes (Role‐Based Access Control (RBAC)) 172 P‐AC‐2(9): Account Management | Restrictions on Shared Groups / Accounts 172 P‐AC‐2(10): Account Management | Shared / Group Account Credential Termination 173 P‐AC‐2(12): Account Management | Account Monitoring / Atypical Usage 174

P‐AC‐3: Access Enforcement 174 P‐AC‐4: Information Flow Enforcement – Access Control Lists (ACLs) 176

P‐AC‐4(8): Information Flow Enforcement | Security Policy Filters 177 P‐AC‐4(9): Information Flow Enforcement | Human Reviews 177 P‐AC‐4(21): Information Flow Enforcement | Physical / Logical Separation for Information Flows 178

P‐AC‐5: Separation of Duties 179 P‐AC‐6: Least Privilege 180

P‐AC‐6(1): Least Privilege | Authorize Access to Security Functions 182 P‐AC‐6(2): Least Privilege | Non‐Privileged Access for Non‐Security Functions 182 P‐AC‐6(5): Least Privilege | Privileged Accounts 183 P‐AC‐6(9): Least Privilege | Auditing Use of Privileged Functions 184 P‐AC‐6(10): Least Privilege | Prohibit Non‐Privileged Users from Executing Privileged Functions 184

P‐AC‐7: Unsuccessful Login Attempts 185 P‐AC‐8: System Use Notification (Logon Banner) 186 P‐AC‐9: Previous Logon Notification 187 P‐AC‐10: Concurrent Session Control 188 P‐AC‐11: Session Lock 188

P‐AC‐11(1): Session Lock | Pattern‐Hiding Displays 189 P‐AC‐12: Session Termination 190 P‐AC‐13: Supervision & Review – Access Control [withdrawn from NIST 800‐53 rev4] 190 P‐AC‐14: Permitted Actions Without Identification or Authorization 190 P‐AC‐15: Automated Marking [withdrawn from NIST 800‐53 rev4] 191 P‐AC‐16: Security Attributes 191 P‐AC‐17: Remote Access 192

P‐AC‐17(1): Remote Access | Automated Monitoring / Control 193 P‐AC‐17(2): Remote Access | Protection of Confidentiality / Integrity Using Encryption 193 P‐AC‐17(3): Remote Access | Managed Access Control Points 194 P‐AC‐17(4): Remote Access | Privileged Commands & Access 194 P‐AC‐17(9): Remote Access | Disconnect / Disable Remote Access 195

P‐AC‐18: Wireless Access 196 P‐AC‐18(1): Wireless Access | Authentication & Encryption 197

P‐AC‐19: Access Control For Mobile Devices 197 P‐AC‐19(5): Access Control For Mobile Devices | Full Device / Container‐Based Encryption 199

P‐AC‐20: Use of External Information Systems 199 P‐AC‐20(1): Use of External Information Systems | Limits of Authorized Use 200 P‐AC‐20(2): Use of External Information Systems | Portable Storage Devices 201

P‐AC‐21: Information Sharing 201 P‐AC‐22: Publicly Accessible Content 202 P‐AC‐23: Data Mining Protection 203 P‐AC‐24: Access Control Decisions 204 P‐AC‐25: Reference Monitor 204

AUDIT & ACCOUNTABILITY (AU) 206 P‐AU‐1: Audit & Accountability Policy & Procedures 206 P‐AU‐2: Auditable Events 207

P‐AU‐2(3): Auditable Events | Reviews & Updates 208 P‐AU‐3: Content of Audit Records 209

P‐AU‐3(1): Content Of Audit Records | Additional Audit Information 209 P‐AU‐4: Audit Storage Capacity 210 P‐AU‐5: Response To Audit Processing Failures 211



P‐AU‐6: Audit Review, Analysis & Reporting 211 P‐AU‐6(1): Audit Review, Analysis & Reporting | Process Integration 212 P‐AU‐6(3): Audit Review, Analysis & Reporting | Correlate Audit Repositories 213 P‐AU‐6(4): Audit Review, Analysis & Reporting | Central Review & Analysis 213

P‐AU‐7: Audit Reduction & Report Generation 214 P‐AU‐7(1): Audit Reduction & Report Generation | Automatic Processing 215

P‐AU‐8: Time Stamps 215 P‐AU‐8(1): Time Stamps | Synchronization With Authoritative Time Source 216

P‐AU‐9: Protection of Audit Information 217 P‐AU‐9(2): Protection of Audit Information | Audit Backup on Separate Physical Systems / Components 218 P‐AU‐9(4): Protection of Audit Information | Access by Subset of Privileged Users 218

P‐AU‐10: Non‐Repudiation 219 P‐AU‐11: Audit Record Retention 219

P‐AU‐11(1): Audit Record Retention | Long‐Term Retrieval Capability 220 P‐AU‐12: Audit Generation 221 P‐AU‐13: Monitoring For Information Disclosure 222 P‐AU‐14: Session Audit 222 P‐AU‐15: Alternate Audit Capability 223 P‐AU‐16: Cross‐Organizational Auditing 224

CONFIGURATION MANAGEMENT (CM) 225 P‐CM‐1: Configuration Management Policy & Procedures 225 P‐CM‐2: Baseline Configurations 225

P‐CM‐2(1): Baseline Configuration | Reviews & Updates 227 P‐CM‐2(2): Baseline Configuration | Automation Support for Accuracy / Currency 228 P‐CM‐2(3): Baseline Configuration | Retention Of Previous Configurations 229 P‐CM‐2(6): Baseline Configuration | Development & Test Environments 229 P‐CM‐2(7): Baseline Configuration | Configure Systems, Components or Devices for High‐Risk Areas 230

P‐CM‐3: Configuration Change Control 231 P‐CM‐3(2): Configuration Change Control | Test, Validate & Document Changes 231

P‐CM‐4: Security Impact Analysis 232 P‐CM‐5: Access Restriction For Change 233

P‐CM‐5(1): Access Restrictions For Change | Automated Access Enforcement / Auditing 234 P‐CM‐5(3): Access Restrictions For Change | Signed Components 234 P‐CM‐5(5): Access Restrictions For Change | Limit Production / Operational Privileges (Incompatible Roles) 235

P‐CM‐6: Configuration Settings 235 P‐CM‐6(1): Configuration Settings | Automated Central Management / Application / Verification 237

P‐CM‐7: Least Functionality 238 P‐CM‐7(1): Least Functionality | Periodic Review 239 P‐CM‐7(2): Least Functionality | Prevent Program Execution 239 P‐CM‐7(4): Least Functionality | Unauthorized Software (Blacklisting) 240 P‐CM‐7(5): Least Functionality | Authorized Software (Whitelisting) 241

P‐CM‐8: Information System Component Inventory 241 P‐CM‐8(1): Information System Component Inventory | Updates During Installations / Removals 242 P‐CM‐8(3): Information System Component Inventory | Automated Unauthorized Component Detection 243 P‐CM‐8(5): Information System Component Inventory | No Duplicate Accounting of Components 243

P‐CM‐9: Configuration Management Plan 244 P‐CM‐10: Software Usage Restrictions 245

P‐CM‐10(1): Software Usage Restrictions | Open Source Software 246 P‐CM‐11: User‐Installed Software 246

IDENTIFICATION & AUTHENTICATION (IA) 248 P‐IA‐1: Identification & Authentication Policy & Procedures 248 P‐IA‐2: Identification & Authentication (Organizational Users) 248

P‐IA‐2(1): Identification & Authentication (Organizational Users) | Network Access to Privileged Accounts 249 P‐IA‐2(2): Identification & Authentication (Organizational Users) | Network Access to Non‐Privileged Accounts 250 P‐IA‐2(3): Identification & Authentication (Organizational Users) | Local Access to Privileged Accounts 250 P‐IA‐2(5): Identification & Authentication (Organizational Users) | Group Authentication 251 P‐IA‐2(8): Identification & Authentication (Organizational Users) | Network Access to Privileged Accounts ‐ Replay Resistant

252



P‐IA‐2(9): Identification & Authentication (Organizational Users) | Network Access to Non‐Privileged Accounts ‐ Replay Resistant 252

P‐IA‐2(11): Identification & Authentication (Organizational Users) | Remote Access – Separate Device 253 P‐IA‐2(12): Identification & Authentication (Organizational Users) | Acceptance of PIV Credentials 254

P‐IA‐3: Device Identification & Authentication 254 P‐IA‐4: Identifier Management (User Names) 255

P‐IA‐4(4): Identifier Management | Identity User Status 256 P‐IA‐5: Authenticator Management (Passwords) 257

P‐IA‐5(1): Authenticator Management | Password‐Based Authentication 258 P‐IA‐5(2): Authenticator Management | PKI‐Based Authentication 259 P‐IA‐5(3): Authenticator Management | In‐Person or Trusted Third‐Party Registration 260 P‐IA‐5(4): Authenticator Management | Automated Support For Password Strength Determination 261 P‐IA‐5(5): Authenticator Management | Change Authenticators Prior to Delivery 261 P‐IA‐5(6): Authenticator Management | Protection of Authenticators 262 P‐IA‐5(7): Authenticator Management | No Embedded Unencrypted Static Authenticators 263 P‐IA‐5(11): Authenticator Management | Hardware Token‐Based Authentication 263

P‐IA‐6: Authenticator Feedback 264 P‐IA‐7: Cryptographic Module Authentication 264 P‐IA‐8: Identification & Authentication (Non‐Organizational Users) 265

P‐IA‐8(1): Identification & Authentication (Non‐Organizational Users) | Acceptance of PIV Credentials from Other Organizations 266

P‐IA‐8(2): Identification & Authentication (Non‐Organizational Users) | Acceptance of Third‐Party Credentials 266 P‐IA‐8(3): Identification & Authentication (Non‐Organizational Users) | Use of FICAM‐Approved Products 267 P‐IA‐8(4): Identification & Authentication (Non‐Organizational Users) | Use of FICAM‐Issued Profiles 268

P‐IA‐9: Service Provider Identification & Authentication (Vendors) 268 P‐IA‐10: Adaptive Identification & Authentication 269 P‐IA‐11: Re‐Authentication 269

MAINTENANCE (MA) 271 P‐MA‐1: Maintenance Policy & Procedures 271 P‐MA‐2: Controlled Maintenance 271 P‐MA‐3: Maintenance Tools 272

P‐MA‐3(1): Maintenance Tools | Inspect Tools 273 P‐MA‐3(2): Maintenance Tools | Inspect Media 274 P‐MA‐3(3): Maintenance Tools | Prevent Unauthorized Removal 274

P‐MA‐4: Non‐Local Maintenance 275 P‐MA‐4(2): Non‐Local Maintenance | Document Non‐Local Maintenance 276 P‐MA‐4(6): Non‐Local Maintenance | Cryptographic Protection 276

P‐MA‐5: Maintenance Personnel 277 P‐MA‐5(1): Maintenance Personnel | Individuals Without Appropriate Access 278

P‐MA‐6: Timely Maintenance 278 SYSTEM & COMMUNICATION PROTECTION (SC) 280

P‐SC‐1: System & Communication Policy & Procedures 280 P‐SC‐2: Application Partitioning 280 P‐SC‐3: Security Function Isolation 281

P‐SC‐3(5): Security Function Isolation | Layered Structures (Defense In Depth) 282 P‐SC‐4: Information In Shared Resources 283 P‐SC‐5: Denial of Service (DoS) Protection 284 P‐SC‐6: Resource Priority 284 P‐SC‐7: Boundary Protection 285

P‐SC‐7(3): Boundary Protection | Access Points 286 P‐SC‐7(4): Boundary Protection | External Telecommunications Services 287 P‐SC‐7(5): Boundary Protection | Deny by Default & Allow by Exception (Access Control List) 287 P‐SC‐7(7): Boundary Protection | Prevent Split Tunneling for Remote Devices 288 P‐SC‐7(8): Boundary Protection | Route Traffic To Authenticated Proxy Servers 289 P‐SC‐7(12): Boundary Protection | Host‐Based Protection 289 P‐SC‐7(13): Boundary Protection | Isolation of Security Tools / Mechanisms / Support Components (Security Subnet) 290 P‐SC‐7(18): Boundary Protection | Fail Secure 291 P‐SC‐7(20): Boundary Protection | Dynamic Isolation / Segregation (Sandboxing) 292



P‐SC‐8: Transmission Confidentiality and Integrity 293 P‐SC‐8(1): Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection 294

P‐SC‐9: Transmission Confidentiality [withdrawn from NIST 800‐53 rev4] 294 P‐SC‐10: Network Disconnect 294 P‐SC‐11: Trusted Path 295 P‐SC‐12: Cryptographic Key Establishment & Management 296

P‐SC‐12(1): Cryptographic Key Establishment & Management | Availability 296 P‐SC‐12(2): Cryptographic Key Establishment & Management | Symmetric Keys 297 P‐SC‐12(3): Cryptographic Key Establishment & Management | Asymmetric Keys 298

P‐SC‐13: Use of Cryptography 298 P‐SC‐14: Public Access Protections [withdrawn from NIST 800‐53 rev4] 299 P‐SC‐15: Collaborative Computing Devices 299 P‐SC‐16: Transmission of Security Attributes 300 P‐SC‐17: Public Key Infrastructure (PKI) Certificates 300 P‐SC‐18: Mobile Code 301 P‐SC‐19: Voice Over Internet Protocol (VOIP) 302 P‐SC‐20: Secure Name / Address Resolution Service (Authoritative Source) 303 P‐SC‐21: Secure Name / Address Resolution Service (Recursive or Caching Resolver) 304 P‐SC‐22: Architecture & Provisioning For Name / Address Resolution Service 304 P‐SC‐23: Session Authenticity 305 P‐SC‐24: Fail In Known State 306 P‐SC‐25: Thin Nodes 306 P‐SC‐26: Honeypots 307 P‐SC‐27: Platform‐Independent Applications 308 P‐SC‐28: Encrypting Data At Rest 309

P‐SC‐28(1): Encrypting Data at Rest | Cryptographic Protection 309 P‐SC‐29: Heterogeneity 310 P‐SC‐30: Concealment & Misdirection 311 P‐SC‐31: Covert Channel Analysis 311 P‐SC‐32: Information System Partitioning 312 P‐SC‐33: Transmission Preparation Integrity [withdrawn from NIST 800‐53 rev4] 313 P‐SC‐34: Non‐Modifiable Executable Programs 313 P‐SC‐35: Honeyclients 313 P‐SC‐36: Distributed Processing & Storage 314 P‐SC‐37: Out‐of‐Band Channels 315 P‐SC‐38: Operations Security 315 P‐SC‐39: Process Isolation 316 P‐SC‐40: Wireless Link Protection 317 P‐SC‐41: Port & I/O Device Access 318 P‐SC‐42: Sensor Capability & Data 319

P‐SC‐42(3): Sensor Capability & Data | Prohibit Use of Devices 319 P‐SC‐43: Usage Restrictions 320 P‐SC‐44: Detonation Chambers 321

SYSTEM & INFORMATION INTEGRITY (SI) 322 P‐SI‐1: System & Information Integrity Policy & Procedures 322 P‐SI‐2: Flaw Remediation (Software Patching) 323

P‐SI‐2(1): Flaw Remediation | Centralized Management 324 P‐SI‐2(2): Flaw Remediation | Automated Flaw Remediation Status 324 P‐SI‐2(3): Flaw Remediation | Time To Remediate Flaws / Benchmarks For Corrective Action 325

P‐SI‐3: Malicious Code Protection (Malware) 326 P‐SI‐3(1): Malicious Code Protection | Central Management 327 P‐SI‐3(2): Malicious Code Protection | Automatic Updates 327 P‐SI‐3(6): Malicious Code Protection | Testing / Verification 328 P‐SI‐3(7): Malicious Code Protection | Nonsignature‐Based Detection 329

P‐SI‐4: Information System Monitoring 329 P‐SI‐4(1): Information System Monitoring | System‐Wide Intrusion Detection Systems 330 P‐SI‐4(2): Information System Monitoring | Automated Tools for Real‐Time Analysis 331 P‐SI‐4(4): Information System Monitoring | Inbound & Outbound Communications Traffic 332



P‐SI‐4(5): Information System Monitoring | System Generated Alerts 332 P‐SI‐4(14): Information System Monitoring | Wireless Intrusion Detection 333 P‐SI‐4(16): Information System Monitoring | Correlate Monitoring Information 334 P‐SI‐4(23): Information System Monitoring | Host‐Based Devices 334

P‐SI‐5: Security Alerts, Advisories & Directives 335 P‐SI‐6: Security Functionality Verification 336 P‐SI‐7: Software, Firmware & Information Integrity 336

P‐SI‐7(1): Software, Firmware & Information Integrity | Integrity Checks 337 P‐SI‐7(7): Software, Firmware & Information Integrity | Integration of Detection & Response 338

P‐SI‐8: Spam Protection 338 P‐SI‐8(1): Spam Protection | Central Management 339 P‐SI‐8(2): Spam Protection | Automatic Updates 340

P‐SI‐9: Information Input Restrictions [withdrawn from NIST 800‐53 rev4] 340 P‐SI‐10: Input Data Validation 340 P‐SI‐11: Error Handling 341 P‐SI‐12: Information Output Handling & Retention 343 P‐SI‐13: Predictable Failure Analysis 344 P‐SI‐14: Non‐Persistence 344 P‐SI‐15: Information Output Filtering 345 P‐SI‐16: Memory Protection 346 P‐SI‐17: Fail‐Safe Procedures 346

PRIVACY CONTROLS 348 AUTHORITY & PURPOSE (AP) 348

P‐AP‐1: Authority To Collect 348 P‐AP‐2: Purpose Specification 348

ACCOUNTABILITY, AUDIT & RISK MANAGEMENT (AR) 350 P‐AR‐1: Governance & Privacy Program 350 P‐AR‐2: Privacy Impact & Risk Assessment 350 P‐AR‐3: Privacy Requirements For Contractors & Service Providers 351 P‐AR‐4: Privacy Monitoring & Auditing 352 P‐AR‐5: Privacy Awareness & Training 353 P‐AR‐6: Privacy Reporting 354 P‐AR‐7: Privacy‐Enhanced System Design & Development 354 P‐AR‐8: Accounting of Disclosures 355

DATA QUALITY & INTEGRITY (DI) 357 P‐DI‐1: Data Quality 357 P‐DI‐2: Data Integrity 357

DATA MINIMIZATION & RETENTION (DM) 359 P‐DM‐1: Minimization Of Personal Data (PD) 359 P‐DM‐2: Data Retention & Disposal 359 P‐DM‐3: Minimization Of PD Used In Testing, Training & Research 360

INDIVIDUAL PARTICIPATION & REDRESS (IP) 362 P‐IP‐1: Consent 362 P‐IP‐2: Individual Access 362 P‐IP‐3: Redress 363 P‐IP‐4: User Feedback Management 364

SECURITY (SE) 365 P‐SE‐1: Inventory Of Personal Data (PD) 365 P‐SE‐2: Privacy Incident Response 365

TRANSPARENCY (TR) 367 P‐TR‐1: Privacy Notice 367 P‐TR‐2: Safe Harbor 367 P‐TR‐3: Dissemination of Privacy Program Information 368

USE LIMITATION (UL) 370 P‐UL‐1: Internal Use 370 P‐UL‐2: Information Sharing With Third Parties 370

GLOSSARY: ACRONYMS & DEFINITIONS 372



ACRONYMS 372 DEFINITIONS 372

RECORD OF CHANGES 373



OVERVIEW, INSTRUCTIONS & EXAMPLE

KEY TERMINOLOGY With the Cybersecurity Standardized Operating Procedures (CSOP), it is important to understand a few key terms:

Procedure / Control Activity: Procedures represent an established way of doing something, such as a series of actions conducted in a specified order or manner. Some organizations refer to procedures as “control activities” and the terms essentially synonymous. In the CSOP, the terms procedure or control activity can be used interchangeably.

Process Owner: This is the name of the individual or team accountable for the procedure being performed. This identifies the accountable party to ensure the procedure is performed. This role is more oversight and managerial.

o Example: The Security Operations Center (SOC) Supervisor is accountable for his/her team to collect log files, perform analysis and escalate potential incidents for further investigation.

Process Operator: This is the name of the individual or team responsible to perform the procedure’s tasks. This identifies the responsible party for actually performing the task. This role is a “doer” and performs tasks.

o Example: The SOC analyst is responsible for performing daily log reviews, evaluating anomalous activities and responding to potential incidents in accordance with the organization’s Incident Response Plan (IRP).

OVERVIEW The Cybersecurity Standardized Operating Procedures (CSOP) is a catalog of procedure/control activity statements. These are templates that require slight modification to suit the specific needs of the organization,

CUSTOMIZATION GUIDANCE The content of the CSOP does require a certain level of customization by any organization, since every organization has some difference in available people, processes or technology that can be leveraged to perform these procedures/control activities. Essentially, we’ve done the heavy lifting in developing the template and pre‐populating a significant amount of content. Our target is about 80% of the content as part of the template that would leave the remaining 20% for customization with specifics that only the organization would know, such as the organization calls the change management group the Change Advisory Board (CAB) instead of the Change Control Board (CCB). Those little changes in roles, titles, department naming, technologies in use are all content that just needs to be filled into the template to finalize the procedures/control activities.

VALIDATING NEEDS FOR PROCEDURES / CONTROL ACTIVITIES Procedures are not meant to be documented for the sake of generating paperwork ‐ procedures are meant to satisfy a specific operational need that are complied with:

If procedures exist and are not tied to a standard, then management should review why the procedure is in place. A procedure that lacks a mapping to a standard may indicate “mission creep” and represent an opportunity to reassign the

work or cease performing the procedure.

UNDERSTANDING CONTROL OBJECTIVES & CONTROLS As part of the CSOP, you will see Control Objectives and Controls for each of the CSOP procedures:

The origin of the Control Objective is ComplianceForge’s Digital Security Program (DSP) that consolidates multiple statutory, regulatory and contractual requirements into a single control objective.

The origin of the Controls is the Secure Controls Framework (SCF) that is an open source set of cybersecurity and privacy controls.

Note ‐ The footnotes at the bottom of the page and the accompanying Excel spreadsheet provide mapping between the control objectives, controls and leading frameworks, including statutory, regulatory and contractual obligations.



PROCEDURES DOCUMENTATION The objective of the CSOP is to provide management direction and support for cybersecurity in accordance with business requirements, as well as relevant laws, regulations and contractual obligations. Procedures should be both clearly‐written and concise.

Procedure documentation is meant to provide evidence of due diligence that standards are complied with. Well‐managed procedures are critical to a security program, since procedures represents the specific activities that are

performed to protect systems and data.

Procedures service a critical function in cybersecurity. Most other documentation produces evidence of due care considerations, but procedures are unique where procedures generate evidence of due diligence.

From a due care and due diligence perspective, it can be thought of this way: Certain standards require processes to exist (due care – evidence demonstrates standards exist). Performing the activities outlined in a procedure and documenting the work that was performed satisfies the

intent of the standard (due diligence – evidence demonstrates the standard is operating effectively). The diagram shown below helps visualize the linkages in documentation that involve written procedures:

CONTROL OBJECTIVES exist to support POLICIES; STANDARDS are written to support CONTROL OBJECTIVES; PROCEDURES are written to implement the requirements that STANDARDS establish; CONTROLS exist as a mechanism to assess/audit both the existence of PROCEDURES / STANDARDS and how well their

capabilities are implemented and/or functioning; and METRICS exist as a way to measure the performance of CONTROLS.

Documentation Flow Example.



NIST NATIONAL INITIATIVE FOR CYBERSECURITY EDUCATION (NICE) CYBERSECURITY WORKFORCE FRAMEWORK The CSOP leverages the NIST NICE Cybersecurity Workforce Framework.1 The purpose of this framework is that work roles have an impact on an organization’s ability to protect its data, systems and operations. By assigning work roles, it helps direct the work of employees and contractors to minimize assumptions about who is responsible for certain cybersecurity and privacy tasks. The CSOP uses the work roles identified in the NIST NICE Cybersecurity Workforce Framework to help make assigning the tasks associated with procedures/control activities more efficient and manageable. Keep in mind these are merely recommendations and are fully editable for every organization – this is just a helpful point in the right direction!

NIST NICE Cybersecurity Workforce Framework – Work Categories

EXAMPLE PROCEDURE This example is a configuration procedure P‐CM‐2 (Baseline Configurations). PLEASE NOTE THE PROCESS CRITERIA SECTION SHOWN BELOW CAN BE DELETED & IS NOT PART OF THE PROCEDURE The process criteria sections exist only to be a useful tool to help build out the procedures by establishing criteria and creating a working space to capture key components that impacts the procedure. Process Criteria:

Process Owner: name of the individual or team accountable for the procedure being performed o Example: The process owner for system hardening at ACME is the cybersecurity director, John Doe.

Process Operator: name of the individual or team responsible to perform the procedure’s tasks. o Example: The process operator for system hardening at ACME is split between several teams:

Network gear is assigned to network admins. Servers are assigned to server admins. Laptops, desktops and mobile devices are assign to the End User Computing (EUC) team.

Occurrence: how often does the procedure need to be conducted? is it something that needs to be performed annually, semi‐annually, quarterly, monthly, bi‐weekly, weekly, daily, continuous or as needed?

o Example: Generally, system hardening is an “as needed” process that happens when new operating systems are released or when new technology is purchased. However, there should still be an annual review to ensure that appropriate baseline configurations exist and are current to what is deployed at ACME.

Scope of Impact: what is the potential impact of the procedure? does it affect a system, application, process, team, department, user, client, vendor, geographic region or the entire company?

o Example: The scope affects the entire company. Any deviations to the secure baselines are handled on an individual basis.

Location of Additional Documentation: if applicable, is there a server, link or other repository where additional documentation is stored or can be found

o Example: Baseline configurations, benchmarks and STIGs are located on server XYZ123 in the folder called “Secure Baselines” and it is available for read‐only for all users.

Performance Target: if applicable, is there a Service Level Agreement (SLA) or targeted timeline for the process to be completed?

o Example: There are no SLAs associated with baseline configurations. Technology in Use: if applicable, what is the name of the application/system/service used to perform the procedure?

o Example: The following classes of systems and applications are in scope for this procedure: Server‐Class Systems Workstation‐Class Systems Network Devices Databases

1 NIST NICE Cybersecurity Workforce Framework ‐ https://www.nist.gov/itl/applied‐cybersecurity/nice/resources/nice‐cybersecurity‐workforce‐framework



Control Objective: The organization develops and controls configuration standards for all system components that are consistent with industry‐accepted system hardening standards. 2 [the control objective is meant to address the statutory, regulatory and contractual requirements identified in the footnote (see bottom of page in the footer section)] Control: Mechanisms exist to develop, document and maintain secure baseline configurations for technology platform that are consistent with industry‐accepted system hardening standards. [control wording comes directly from the Secure Controls Framework (SCF) control #CFG‐02. The SCF is a free resource that can be downloaded from https://www.securecontrolsframework.com] Procedure / Control Activity: Systems Security Developer [SP‐SYS‐001], in conjunction with the Technical Support Specialist [OM‐STS‐001] and Security Architect [SP‐ARC‐002]:

(1) Uses vendor‐recommended settings and industry‐recognized secure practices to ensure baseline system hardening configuration for all ACME‐owned or managed assets comply with applicable legal, statutory, and regulatory compliance obligations.

(2) Where technically feasible, technology platforms align with industry‐recommended hardening recommendations, including but not limited to:

a. Center for Internet Security (CIS) benchmarks; b. Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs); or c. Original Equipment Manufacturer (OEM) security configuration guides.

(3) Ensures that system hardening includes, but is not limited to: a. Technology platforms that include, but are not limited to:

i. Server‐Class Systems 1. Microsoft Server 2003 2. Microsoft Server 2008 3. Microsoft Server 2012 4. Microsoft Server 2016 5. Red Hat Enterprise Linux (RHEL) 6. Unix 7. Solaris

ii. Workstation‐Class Systems 1. Microsoft XP 2. Microsoft 7 3. Microsoft 8 4. Microsoft 10 5. Apple 6. Fedora (Linux) 7. Ubuntu (Linux) 8. SuSe (Linux)

iii. Network Devices 1. Firewalls 2. Routers 3. Load balancers 4. Virtual Private Network (VPN) concentrators 5. Wireless Access Points (WAPs) 6. Wireless controllers 7. Printers 8. Multi‐Function Devices (MFDs)

iv. Mobile Devices 1. Tablets 2. Mobile phones 3. Other portable electronic devices

v. Databases 1. MySQL 2. Windows SQL Server 3. Windows SQL Express

2 NIST 800‐53 rev4 P‐CM‐2 & P‐CM‐6 | FedRAMP | NIST 800‐171 3.4.1 & 3.4.2 | PCI DSS 1.1 & 1.1.1 | NIST CSF PR.P‐IP‐1 | DFARS 252.204‐7008 | CSC 3.1 | CCM GRM‐01 & IVS‐07 | COBIT5 BAI10.02 | NISPOM 8‐202, 8‐311 & 8‐610



4. Oracle 5. DB2

b. Enforcing least functionality, which includes but is not limited to: i. Allowing only necessary and secure services, protocols, and daemons; ii. Removing all unnecessary functionality, which includes but is not limited to:

1. Scripts; 2. Drivers; 3. Features; 4. Subsystems; 5. File systems; and 6. Unnecessary web servers.

c. Configuring and documenting only the necessary ports, protocols, and services to meet business needs; d. Implementing security features for any required services, protocols or daemons that are considered to be

insecure, which includes but is not limited to using secured technologies such as Secure Shell (SSH), Secure File Transfer Protocol (S‐FTP), Transport Layer Security (TLS), or IPSec VPN to protect insecure services such as NetBIOS, file‐sharing, Telnet, and FTP;

e. Installing and configuring appropriate technical controls, such as: i. Antimalware; ii. Software firewall; iii. Event logging; and iv. File Integrity Monitoring (FIM), as required; and

f. As applicable, implementing only one primary function per server to prevent functions that require different security levels from co‐existing on the same server (e.g., web servers, database servers, and DNS should be implemented on separate servers).

(4) Documents and validates security parameters are configured to prevent misuse. (5) Authorizes deviations from standard baseline configurations in accordance with ACME’s change management processes,

prior to deployment, provisioning, or use. (6) Validates and refreshes configurations on a regular basis to update their security configuration in light of recent

vulnerabilities and attack vectors. Unless a technical or business reason exists, standardized images are used to represent hardened versions of the underlying operating system and the applications installed on the system.

(7) On at least an annual basis, during the 2nd quarter of the calendar year, reviews the process for non‐conforming instances. As needed, revises processes to address necessary changes and evolving conditions. Whenever the process is updated:

a. Distributes copies of the change to key personnel; and b. Communicates the changes and updates to key personnel.

(8) If necessary, requests corrective action to address identified deficiencies. (9) If necessary, validates corrective action occurred to appropriately remediate deficiencies. (10) If necessary, documents the results of corrective action and notes findings. (11) If necessary, requests additional corrective action to address unremediated deficiencies.



SUPPORTING POLICIES & STANDARDS While there are no policies and standards included in the CSOP, the CSOP is designed to provide a 1‐1 relationship with ComplianceForge’s NIST 800‐53‐based Written Information Security Program (WISP) that contains policies, control objectives, standards and guidelines. Cybersecurity documentation is comprised of six (6) main parts:

(1) Core policy that establishes management’s intent; (2) Control objective that identifies leading practices; (3) Standards that provides quantifiable requirements; (4) Controls identify desired conditions that are expected to be met; (5) Procedures / Control Activities establish how tasks are performed to meet the requirements established in standards and

to meet controls; and (6) Guidelines are recommended, but not mandatory.

Cybersecurity Documentation Hierarchy



NIST 800‐53 REV4 CONTROL FAMILIES

# FIPS 199 Focus Family Identifier

1 Management Security Assessment & Authorization CA

2 Management Planning PL

3 Management Program Management PM

4 Management Risk Assessment RA

5 Management System & Services Acquisition SA

6 Operational Contingency Planning CP

7 Operational Incident Response IR

8 Operational Media Protection MP

9 Operational Awareness & Training AT

10 Operational Personnel Security PS

11 Operational Physical & Environmental Protection PE

12 Technical Access Control AC

13 Technical Audit & Accountability AU

14 Technical Configuration Management CM

15 Technical Identification & Authentication IA

16 Technical Maintenance MA

17 Technical System & Communications Protection SC

18 Technical System & Information Integrity SI

19 Privacy Authority & Purpose AP

20 Privacy Accountability, Audit & Risk Management AR

21 Privacy Data Quality & Integrity DI

22 Privacy Data Minimization & Retention DM

23 Privacy Individual Participation & Redress IP

24 Privacy Security SE

25 Privacy Transparency TR

26 Privacy Use Limitation UL



SECURITY ASSESSMENTS & AUTHORIZATION (CA)

P‐CA‐1: SECURITY ASSESSMENT & AUTHORIZATION POLICY & PROCEDURES Process Criteria: (this process criteria section (yellow text field) can be deleted, but it will be useful in populating a System Security Plan (SSP) or other system‐related documentation – it is meant to be a useful tool to help build the procedure by establishing criteria and creating a working space to capture key components that impacts the procedure)

Process Owner: name of the individual or team accountable for the procedure being performed Process Operator: name of the individual or team responsible to perform the procedure’s tasks Occurrence: how often does the procedure need to be conducted? is it something that needs to be performed annually,

semi‐annually, quarterly, monthly, bi‐weekly, weekly, daily, continuous or as needed? Scope of Impact: what is the potential impact of the procedure? does it affect a system, application, process, team,

department, user, client, vendor, geographic region or the entire company? Location of Additional Documentation: if applicable, is there a server, link or other repository where additional

documentation is stored or can be found Performance Target: if applicable, is there a Service Level Agreement (SLA) or targeted timeline for the process to be

completed? Technology in Use: if applicable, what is the name of the application/system/service used to perform the procedure?

Control Objective: The organization develops, disseminates, reviews and updates:

Formal, documented security assessment and authorization policies that address purpose, scope, roles, responsibilities, management commitment and compliance; and

Processes to facilitate the implementation of the security assessment and authorization policies and associated security assessment and authorization controls.

Procedure / Control Activity: Systems Security Manager [OV‐MGT‐001], in conjunction with Security Architect [SP‐ARC‐002] and Executive Cyber Leadership [OV‐EXL‐001]:

(1) Uses industry‐recognized secure practices to ensure controls are sufficient for conducting cybersecurity assessments that includes:

a. A formal, documented cybersecurity assessment program. b. Processes to facilitate the implementation of cybersecurity assessments. c. Processes to review systems in production, since production systems may deviate significantly from the functional

and design specifications created during the requirements and design phases of the Secure Development Life Cycle (SDLC). Therefore, threat and vulnerability analysis needs to address new vulnerabilities created as a result of those changes have been reviewed and mitigated:

i. Addressing new threats and vulnerabilities on an ongoing basis and ensures these applications are protected against known attacks by either of the following methods:

1. Reviewing applications via manual or automated application vulnerability security assessment tools or methods, at least annually and after any change; or

2. Installing an application firewall. ii. Verifying that public‐facing web applications are reviewed (using either manual or automated

vulnerability security assessment tools or methods), as follows: 1. At least annually; 2. After any changes; 3. By an organization that specializes in application security; 4. That all vulnerabilities are corrected; and 5. That the application is re‐evaluated after the corrections.

(2) On at least an annual basis, during the [1st, 2nd, 3rd, 4th] quarter of the calendar year, reviews the process for non‐conforming instances. As needed, revises processes to address necessary changes and evolving conditions. Whenever the process is updated:





P‐CA‐2: SECURITY ASSESSMENTS Process Criteria: (this process criteria section (yellow text field) can be deleted, but it will be useful in populating a System Security Plan (SSP) or other system‐related documentation – it is meant to be a useful tool to help build the procedure by establishing criteria and creating a working space to capture key components that impacts the procedure)






Control Objective: The organization:18

Assesses the security controls in systems to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting the security requirements for the system;

Produces a security assessment report that documents the results of the assessment; and Provides the results of the security control assessment, in writing, to the senior cybersecurity official or officially designated

representative. Procedure / Control Activity: Governance Manager [XX‐GRC‐001], in coordination with Governance Specialist [XX‐GRC‐002]:

1. Implements appropriate physical, administrative and technical means to implement a Control Validation Testing (CVT) program to validate cybersecurity and privacy controls are:

a. Implemented correctly; b. Operating as intended; and c. Producing the desired outcome with respect to meeting the security requirements for the system, application or

process. 2. Interfaces with Program Manager [OV‐PMA‐001] and IT Project Manager [OV‐PMA‐002] to maintain situational awareness

of projects/initiatives in the development pipeline to ensure that CVT activities are embedded within the Secure Development Life Cycle (SDLC) for the project/initiative.

3. Assesses the security controls applied to assets to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.

4. Provides the results of the security control assessment, in writing, to Asset Owner [XX‐AST‐001] and Systems Security Manager [OV‐MGT‐001].

5. On at least an annual basis, during the [1st, 2nd, 3rd, 4th] quarter of the calendar year, reviews the process for non‐conforming instances. As needed, revises processes to address necessary changes and evolving conditions. Whenever the process is updated:


6. If necessary, requests corrective action to address identified deficiencies. 7. If necessary, validates corrective action occurred to appropriately remediate deficiencies. 8. If necessary, documents the results of corrective action and notes findings. 9. If necessary, requests additional corrective action to address unremediated deficiencies.

P‐CA‐2(1): SECURITY ASSESSMENTS | INDEPENDENT ASSESSORS Process Criteria: (this process criteria section (yellow text field) can be deleted, but it will be useful in populating a System Security Plan (SSP) or other system‐related documentation – it is meant to be a useful tool to help build the procedure by establishing criteria and creating a working space to capture key components that impacts the procedure)

Process Owner: name of the individual or team accountable for the procedure being performed Process Operator: name of the individual or team responsible to perform the procedure’s tasks

18 MA201CMR17 17.03(2)(h) | OR646A.622(b)(B)(i)‐(iv) | NIST CSF ID.P‐RA‐1, PR.P‐IP‐7, DE.DP‐1, DE.DP‐2, DE.DP‐3, DE.DP‐4, DE.DP‐5 & RS.CO‐3



P‐IR‐3(2): INCIDENT RESPONSE TESTING | COORDINATION WITH RELATED PLANS Process Criteria: (this process criteria section (yellow text field) can be deleted, but it will be useful in populating a System Security Plan (SSP) or other system‐related documentation – it is meant to be a useful tool to help build the procedure by establishing criteria and creating a working space to capture key components that impacts the procedure)






Control Objective: The organization coordinates incident response testing with organizational elements responsible for related plans. Procedure / Control Activity: Systems Security Manager [OV‐MGT‐001], in conjunction with Asset Owner [XX‐AST‐001], Cyber Defense Incident Responder [PR‐CIR‐001] and Integrated Security Incident Response Team (ISIRT) Leader [XX‐CIR‐002]:

(1) Implements appropriate administrative means to ensure identify key personnel associated with related plans (e.g., Business Continuity Plan (BCP), Disaster Recovery Plan (DRP), etc.).

(2) Coordinates incident response testing with appropriate personnel responsible for related plans. (3) On at least an annual basis, during the [1st, 2nd, 3rd, 4th] quarter of the calendar year, reviews the process for non‐

conforming instances. As needed, revises processes to address necessary changes and evolving conditions. Whenever the process is updated:



P‐IR‐4: INCIDENT HANDLING Process Criteria: (this process criteria section (yellow text field) can be deleted, but it will be useful in populating a System Security Plan (SSP) or other system‐related documentation – it is meant to be a useful tool to help build the procedure by establishing criteria and creating a working space to capture key components that impacts the procedure)






Control Objective: The organization: 71

Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication and recovery;

Coordinates incident handling activities with contingency planning activities; and

71 PCI DSS 12.5.3 | NIST CSF DE.AE‐2, DE.AE‐3, DE.AE‐4, DE.AE‐5, RS.AN‐1, RS.AN‐2, RS.AN‐3, RS.AN‐4, RS.CO‐3, RS.CO‐4, RS.IM‐1, RS.IM‐2, RS.MI‐1, RS.MI‐2, RS.RP‐1, RC.RP‐1, RC.IM‐1, RC.IM‐2 & RC.CO‐3 | NY DFS 500.16



Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training and testing/exercises and implements the resulting changes accordingly.

Procedure / Control Activity: Cyber Defense Incident Responder [PR‐CIR‐001], in conjunction with Integrated Security Incident Response Team (ISIRT) Leader [XX‐CIR‐002]:

(1) Leverages ACME’s Integrated Incident Response Program (IIRP) to: a. Investigate notifications from detection systems. b. Identify and assess the severity and classification of incidents. c. Define appropriate actions to take in response to the incident, in accordance with ACME’s Incident Response Plan

(IRP). d. Respond with appropriate remediation actions to minimize impact and ensure the continuation of business

functions. e. As necessary, update the IRP, based on lessons learned from the incident.




P‐IR‐4(1): INCIDENT HANDLING | AUTOMATED INCIDENT HANDLING PROCESSES Process Criteria: (this process criteria section (yellow text field) can be deleted, but it will be useful in populating a System Security Plan (SSP) or other system‐related documentation – it is meant to be a useful tool to help build the procedure by establishing criteria and creating a working space to capture key components that impacts the procedure)






Control Objective: The organization employs automated mechanisms to support the incident handling process. Procedure / Control Activity: Cyber Defense Incident Responder [PR‐CIR‐001], in conjunction with Integrated Security Incident Response Team (ISIRT) Leader [XX‐CIR‐002]:

(1) Uses vendor‐recommended settings and industry‐recognized secure practices to employ automated mechanisms to support the incident handling process. Automated mechanisms supporting incident handling processes include, for example, online incident management systems.






P‐IR‐5: INCIDENT MONITORING Process Criteria: (this process criteria section (yellow text field) can be deleted, but it will be useful in populating a System Security Plan (SSP) or other system‐related documentation – it is meant to be a useful tool to help build the procedure by establishing criteria and creating a working space to capture key components that impacts the procedure)






Control Objective: The organization tracks and documents system security incidents. 72 Procedure / Control Activity: Systems Security Manager [OV‐MGT‐001], in conjunction with Systems Security Analyst [OM‐ANA‐001], Integrated Security Incident Response Team (ISIRT) Leader [XX‐CIR‐02 and Cyber Defense Incident Responder [PR‐CIR‐001]:

(1) Implements appropriate physical, administrative and technical means to implement mechanisms to monitor for cybersecurity incidents.

(2) Maintains situational awareness through aggregating and correlating event data from multiple sources and sensors: a. Helpdesk / service desk incidents; b. Security Incident Event Manager (SIEM); c. File Integrity Monitor (FIM); d. Data Loss Prevention (DLP); e. Intrusion Detection System / Intrusion Prevention System (IDS / IPS); and f. Network Access Control (NAC).




P‐IR‐6: INCIDENT REPORTING Process Criteria: (this process criteria section (yellow text field) can be deleted, but it will be useful in populating a System Security Plan (SSP) or other system‐related documentation – it is meant to be a useful tool to help build the procedure by establishing criteria and creating a working space to capture key components that impacts the procedure)






72 PCI DSS 12.5.2 | NIST CSF DE.AE‐3, DE.AE‐5, RS.AN‐1 & RS.AN‐4