Difference between revisions of "User:Shawndouglas/sandbox/sublevel3"

From LIMSWiki
Jump to navigationJump to search
Line 1: Line 1:
====CM-1 Configuration management policy and procedures====
====CP-1 Contingency planning policy and procedures====
This control recommends the organization develop, document, disseminate, review, and update configuration management policies and procedures. It asks organizations to not only address the purpose, scope, roles, responsibilities, and enforcement of configuration management action but also to address how those policies and procedures will be implemented, reviewed, and updated.  
This control recommends the organization develop, document, disseminate, review, and update contingency planning policies and procedures. It asks organizations to not only address the purpose, scope, roles, responsibilities, and enforcement of contingency planning action but also to address how those policies and procedures will be implemented, reviewed, and updated.  


'''Additional resources''':
'''Additional resources''':
* [https://csrc.nist.gov/publications/detail/sp/800-12/rev-1/final NIST Special Publications 800-12, Rev. 1], page 61
* [https://csrc.nist.gov/publications/detail/sp/800-12/rev-1/final NIST Special Publications 800-12, Rev. 1], pages 61–62
* [https://csrc.nist.gov/publications/detail/sp/800-100/final NIST Special Publications 800-100], pages 131–37
* [https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final NIST Special Publications 800-34, Rev. 1]
* [https://csrc.nist.gov/publications/detail/sp/800-100/final NIST Special Publications 800-100], pages 78–83
* [https://www.limswiki.org/index.php/LII:LIMSpec/Maintaining_Laboratory_Workflow_and_Operations#7._Document_management LIMSpec 7.1, 7.2]
* [https://www.limswiki.org/index.php/LII:LIMSpec/Maintaining_Laboratory_Workflow_and_Operations#7._Document_management LIMSpec 7.1, 7.2]


====CM-2 Baseline configuration====
====CP-2 Contingency plan====
This control recommends the organization develop, document, and maintain a baseline configuration of the information system and its components, including their network topology and logical placement within the system. The end result should fully reflect the existing enterprise architecture.
This control recommends the organization develop, document, disseminate, review, and update a contingency plan for the system. As part of this process, the organization should identify its business and cybersecurity goals, as well as its processes, particularly goals and processes that have been marked as critical or essential to overall operations. The plan should also address the importance of keeping those goals and processes intact despite any disruption, as well as any recovery objectives, restoration priorities, and responsible parties (including their roles and contact information). The plan should be reviewed and approved by key personnel, and reviewed again at a determined frequency, with any changes resulting in updating, communicating, and protecting the revised plan.


'''Additional resources''':
'''Additional resources''':
* [https://csrc.nist.gov/publications/detail/sp/800-128/final NIST Special Publications 800-128]
* [https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final NIST Special Publications 800-34, Rev. 1]
* No LIMSpec comp (organizational policy rather than system specification)
* No LIMSpec comp (organizational policy rather than system specification)


====CM-3 Configuration change control====
====CP-3 Contingency training====
This control recommends the organization develop a series of configuration change control steps to ensure that system upgrades and modifications cause little to no impact in the overall cybersecurity strength of the system. NIST specifically recommends the organization determine which system changes are linked to configuration control, review and approve proposed changes, document and retain those decisions, implement the approved changes, and audit and review the changes.
This control recommends the organization supply the appropriate training concerning contingency plan enactment to the relevant system users at a defined frequency, when the system changes significantly, or when a user takes on a contingency role or responsibility.


'''Additional resources''':
'''Additional resources''':
* [https://www.us-cert.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-CCM.pdf Carnegie Mellon University Configuration and Change Management]
* [https://csrc.nist.gov/publications/detail/sp/800-16/final NIST Special Publications 800-16]
* [https://csrc.nist.gov/publications/detail/sp/800-128/final NIST Special Publications 800-128]
* [https://csrc.nist.gov/publications/detail/sp/800-50/final NIST Special Publications 800-50]
* No LIMSpec comp (organizational policy rather than system specification)
* [https://www.limswiki.org/index.php/LII:LIMSpec/Maintaining_Laboratory_Workflow_and_Operations#8._Resource_management LIMSpec 8.3, 8.5, and 8.7]
 
====CM-3 (2) Configuration change control: Test, validate, and document changes====
This control enhancement recommends the organization test, validate, and document changes to the system before actual implementation on the live system. Operational hardware systems may have to be taken offline or replicated as closely as feasible to test; software systems can often be tested in a separate test environment. In all cases, the organization seeks to minimize impact on active system operations.
 
'''Additional resources''':
* [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#34._System_administration LIMSpec 34.15]
 
====CM-4 Security impact analysis====
This control recommends the organization perform security impact analysis on the system to determine the extent of potentially undesirable consequences upon implementing proposed changes. This typically requires one or more individuals explicitly familiar with the system, the organization's security plans, and the system's architecture documents. Some revelations may also come from enacting security control CM-3 (2).
 
'''Additional resources''':
* [https://www.us-cert.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-CCM.pdf Carnegie Mellon University Configuration and Change Management]
* [https://csrc.nist.gov/publications/detail/sp/800-128/final NIST Special Publications 800-128]
* No LIMSpec comp (organizational policy rather than system specification)
 
====CM-5 Access restrictions for change====
This control recommends the organization define, document, approve, and enforce all the physical and logical access restrictions associated with making changes to the system configuration. Doing so creates a base policy that helps ensure "only qualified and authorized individuals [can] access information systems for purposes of initiating changes, including upgrades and modifications."
 
'''Additional resources''':
* [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#32._Configuration_management LIMSpec 32.22]
 
====CM-5 (1) Access restrictions for change: Automated access enforcement and auditing====
This control enhancement recommends the system allow for the configuration and automated enforcement of access restrictions, as well as the auditing of associated enforcement actions.
 
'''Additional resources''':
* [https://www.limswiki.org/index.php/LII:LIMSpec/Maintaining_Laboratory_Workflow_and_Operations#9._Compliance_management LIMSpec 9.2], [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#32._Configuration_management 32.22, and 32.31]
 
====CM-6 Configuration settings====
This control recommends the organization develop and implement a complete set of configuration settings for the hardware, software, and firmware that make up the information system. Those settings should ultimately reflect restrictions consistent with operational requirements and organizational policy. Additionally, the organization should perform change control on the settings, such that suggested deviations are not detrimental to the system and overall cybersecurity goals.
 
'''Additional resources''':
* [https://nvd.nist.gov/ncp/repository NIST National Vulnerability Database's National Checklist Program Repository]
* [https://csrc.nist.gov/publications/detail/sp/800-70/rev-4/final NIST Special Publications 800-70, Rev. 4]
* [https://csrc.nist.gov/publications/detail/sp/800-128/final NIST Special Publications 800-128]
* No LIMSpec comp (organizational policy rather than system specification)
 
====CM-7 Least functionality====
This control recommends the organization configure the system to apply the principle of "least functionality." As Georgetown University describes it, "[t]he principle of least functionality provides that information systems are configured to provide only essential capabilities and to prohibit or restrict the use of non-essential functions, such as ports, protocols, and/or services that are not integral to the operation of that information system."<ref name="UISO_UIS203">{{cite web |url=https://security.georgetown.edu/config-mgt-policy/least-functionality-guidelines/ |title=UIS.203.7 Least Functionality Guidelines |work=UIS.203 Configuration Management Policy |publisher=University Information Security Office, Georgetown University |accessdate=23 July 2020}}</ref> NIST also notes that "[o]rganizations can utilize network scanning tools, intrusion detection and prevention systems, and end-point protections such as firewalls and host-based intrusion detection systems to identify and prevent the use of prohibited functions, ports, protocols, and services."
 
'''Additional resources''':
* [https://security.georgetown.edu/config-mgt-policy/least-functionality-guidelines/ Georgetown University UIS.203.7 Least Functionality Guidelines]
* [https://www.limswiki.org/index.php/LII:LIMSpec/Security_and_Integrity_of_Systems_and_Operations#32._Configuration_management LIMSpec 32.18]


====CM-8 Information system component inventory====
====CP-4 Contingency plan testing====
This control recommends the organization develop and document a complete inventory of the various components within the authorization boundary of the system. That inventory should accurately portray the current system, have sufficient detail for accountability, and be detailed at a granular enough level for convenient tracking and reporting. The organization should also review and update the inventory in a defined frequency.
This control recommends the organization develop and regularly use testing methods to test the system contingency plan for its effectiveness, as well as how well prepared system users are to execute the plan. The organization should review the results of such tests and apply corrective action, if needed.


'''Additional resources''':
'''Additional resources''':
* [https://csrc.nist.gov/publications/detail/sp/800-128/final NIST Special Publications 800-128]
* [https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final NIST Special Publications 800-34, Rev. 1]
* [https://csrc.nist.gov/publications/detail/sp/800-84/final NIST Special Publications 800-84]
* No LIMSpec comp (organizational policy rather than system specification)
* No LIMSpec comp (organizational policy rather than system specification)


====CM-10 Software usage restrictions====
====CP-9 Information system backup====
This control recommends the organization make an effort to track the use of software and associated documentation to ensure both are being used legally and within contract agreements. The organization should also control against and document instances of software or documentation being copied, distributed, or used in an unauthorized fashion.
This control recommends the organization back up the system's user-level and system-level information, as well as system documentation, at defined frequencies. The organization should make efforts to protect the confidentiality, integrity, and availability of any data backups.


'''Additional resources''':
'''Additional resources''':
* No LIMSpec comp (organizational policy rather than system specification)
* [https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final NIST Special Publications 800-34, Rev. 1]
* [https://www.limswiki.org/index.php/LII:LIMSpec/Technology_and_Performance_Improvements#27._Systems_integration LIMSpec 27.11]


====CM-11 User-installed software====
====CP-10 Information system recovery and reconstitution====
This control recommends the organization develop, document, and enforce policies governing if and when users may install software within the system. This includes monitoring for policy compliance at a defined frequency. Enforcement may be procedural, automated, or both.
This control recommends the organization retain the capability of recovering and reconstituting the system to a recent known state in the wake of a system disruption, compromise, or failure. This may be done in an automatic or manual fashion.


'''Additional resources''':
'''Additional resources''':
* No LIMSpec comp (organizational policy rather than system specification)
* [https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final NIST Special Publications 800-34, Rev. 1]
 
* [https://www.limswiki.org/index.php/LII:LIMSpec/Technology_and_Performance_Improvements#27._Systems_integration LIMSpec 27.11]
==References==
{{Reflist}}

Revision as of 20:44, 16 February 2022

CP-1 Contingency planning policy and procedures

This control recommends the organization develop, document, disseminate, review, and update contingency planning policies and procedures. It asks organizations to not only address the purpose, scope, roles, responsibilities, and enforcement of contingency planning action but also to address how those policies and procedures will be implemented, reviewed, and updated.

Additional resources:

CP-2 Contingency plan

This control recommends the organization develop, document, disseminate, review, and update a contingency plan for the system. As part of this process, the organization should identify its business and cybersecurity goals, as well as its processes, particularly goals and processes that have been marked as critical or essential to overall operations. The plan should also address the importance of keeping those goals and processes intact despite any disruption, as well as any recovery objectives, restoration priorities, and responsible parties (including their roles and contact information). The plan should be reviewed and approved by key personnel, and reviewed again at a determined frequency, with any changes resulting in updating, communicating, and protecting the revised plan.

Additional resources:

CP-3 Contingency training

This control recommends the organization supply the appropriate training concerning contingency plan enactment to the relevant system users at a defined frequency, when the system changes significantly, or when a user takes on a contingency role or responsibility.

Additional resources:

CP-4 Contingency plan testing

This control recommends the organization develop and regularly use testing methods to test the system contingency plan for its effectiveness, as well as how well prepared system users are to execute the plan. The organization should review the results of such tests and apply corrective action, if needed.

Additional resources:

CP-9 Information system backup

This control recommends the organization back up the system's user-level and system-level information, as well as system documentation, at defined frequencies. The organization should make efforts to protect the confidentiality, integrity, and availability of any data backups.

Additional resources:

CP-10 Information system recovery and reconstitution

This control recommends the organization retain the capability of recovering and reconstituting the system to a recent known state in the wake of a system disruption, compromise, or failure. This may be done in an automatic or manual fashion.

Additional resources:

Retrieved from "https://www.limswiki.org/index.php?title=User:Shawndouglas/sandbox/sublevel3&oldid=46482"