User:Shawndouglas/sandbox/sublevel3

CA-1 Security assessment and authorization policy and procedures

This control recommends the organization develop, document, disseminate, review, and update security assessment and authorization policies and procedures. It asks organizations to not only address the purpose, scope, roles, responsibilities, and enforcement of security assessment and authorization action but also to address how those policies and procedures will be implemented, reviewed, and updated.

Additional resources:

NIST Special Publications 800-12, Rev. 1, pages 60–61
NIST Special Publications 800-37, Rev. 1
NIST Special Publications 800-53A, Rev. 4
NIST Special Publications 800-100, pages 96–112
LIMSpec 7.1, 7.2

CA-2 Security assessments

This control recommends the organization develop, document, disseminate, review, and update a security assessment plan. This plan is focused on helping the organization ensure the assessment procedures, environment, team, roles, and responsibilities are defined and the security controls are correctly implemented, operating as intended, and meeting the established security requirements. The assessments should happen at defined frequency. Additionally, the organization is encouraged to report on the results of the implemented plan and corresponding assessments, disseminating the results to authorized personnel or roles.

Additional resources:

NIST Special Publications 800-37, Rev. 1
NIST Special Publications 800-39
NIST Special Publications 800-53A, Rev. 4
NIST Special Publications 800-115
NIST Special Publications 800-137
No LIMSpec comp (organizational policy rather than system specification)

CA-2 (1) Security assessments: Independent assessors

This control enhancement recommends the organization employ some type of independent assessment team with a predetermined level of required independence to conduct security control assessments. that Ensuring the team is free from perceived or actual conflict of interest is important, and NIST adds that "[o]rganizations recognize that assessments performed for purposes other than direct support to authorization decisions are, when performed by assessors with sufficient independence, more likely to be useable for such decisions, thereby reducing the need to repeat assessments."

Additional resources:

NIST Special Publications 800-115, pages 6-5 and 6-6
No LIMSpec comp (organizational policy rather than system specification)

CA-3 System interconnections

This control recommends the organization should explicitly authorize, document, review, and update interconnection security agreements (ISA) or system-based security plans, as they relate to the interconnection of information systems in the organization. Separately, in NIST SP 800-47, at D-1, NIST defines an ISA an an established agreement between owner-operators of connected IT systems to document and agree to the technical requirements associated with any interconnections between the organizations' systems. However, NIST notes, "[i]f interconnecting systems have the same authorizing official, organizations do not need to develop interconnection security agreements. Instead, organizations can describe the interface characteristics between those interconnecting systems in their respective security plans."

Additional resources:

NIST Special Publications 800-47
NIST Special Publications 800-100, pages 46–58
No LIMSpec comp (organizational policy rather than system specification)

CA-5 Plan of action and milestones

This control recommends the organization develop and update a security authorization-related plan of action and milestones for the documentation of planned remedial actions and vulnerability resolutions. These key security authorization documents should be reviewed and updated at a defined frequency, based off the results of security control assessments, security impact analyses, and continuous monitoring results.

Additional resources:

NIST Special Publications 800-37, Rev. 1
No LIMSpec comp (organizational policy rather than system specification)

CA-6 Security authorization

This control recommends the organization assign a manager or member of senior leadership as an "authorizing official" that essentially approves the system to be put into operation based on the results of security assessments and accepts responsibility for the risks associated with operation. The authorization should also be updated at a defined frequency. It's important to note that this control is described by NIST as being an "inherently federal responsibility and therefore, authorizing officials must be federal employees." If applying this control to non-federal systems, there is still plenty of sense in designating a key individual in the organization as responsible for making the call post-security assessment of allowing the system to go live, as well as accepting the risks of putting the system into operation. The same principle can be applied to major security upgrades and reconfiguration of existing systems.

Additional resources:

NIST Special Publications 800-37, Rev. 1
NIST Special Publications 800-137
No LIMSpec comp (organizational policy rather than system specification)

CA-7 Continuous monitoring

This control recommends the organization develop a continuous monitoring program and implementation strategy. The program should define the metrics required for organizational performance indicators, as well as how often those metrics are applied and assessed for functionality and sufficiency. How the information is analyzed and correlated, how the organization responds to those activities, and how they are reported (who and when) must also be addressed. Metrics should follow the SMART principle of being specific, measurable, actionable, relevant, and focused on a timely nature.

Additional resources:

NIST Special Publications 800-37, Rev. 1
NIST Special Publications 800-39
NIST Special Publications 800-53A, Rev. 4
NIST Special Publications 800-115
NIST Special Publications 800-137
No LIMSpec comp (organizational policy rather than system specification)

CA-9 Internal system connections

This control recommends the organization essentially create a systems map, documenting how the various parts of the system should interconnect—as well as the characteristics of the connection and the nature of the information transported through it—and explicitly authorizing the interconnection to occur. This includes connections through mobile devices, printers, computers, sensors, and servers. It may be useful to classify components of the system that have common characteristics or configurations to make authorizations (as classes) easier.

Additional resources: