Certified Authorizaion Professional - Nist And Other Docs Needed To Know.

Front 1

SP800-18

Back 1

Guide for Developing Security Plans for Federal Information Systems

Front 2

SP800-30

Back 2

Guide for Conducting
Risk Assessments

Front 3

SP800-34

Back 3

Contingency Planning Guide for Federal Information Systems

Front 4

SP800-37

Back 4

Guide for Applying the Risk Management Framework to Federal Information Systems

Front 5

SP800-39

Back 5

Managing Information
Security Risk
(Organization, Mission, and Information System View)

Front 6

SP800-40

Back 6

Creating a Patch and Vulnerability Management Program

Front 7

SP800-41

Back 7

Guidelines on Firewalls and Firewall Policy

Front 8

SP800-47

Back 8

Security Guide for Interconnecting Information Technology Systems

Front 9

SP800-50

Back 9

Building an Information Technology Security Awareness and Training Program

Front 10

SP800-53

Back 10

Security and Privacy Controls for Federal Information Systems
and Organizations

Front 11

SP800-53A

Back 11

Guide for Assessing the Security
Controls in Federal Information Systems and Organizations

Front 12

SP800-55

Back 12

Performance Measurement Guide for Information Security

Front 13

SP800-59

Back 13

Guideline for Identifying an Information System as a National Security System

Front 14

SP800-60

Back 14

Guide to Categorizing Information Systems

Front 15

SP800-61

Back 15

Computer Security Incident Handling Guide

Front 16

SP800-64

Back 16

System Development Life Cycle

Front 17

SP800-83

Back 17

Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Front 18

SP800-88

Back 18

Guidelines for Media Sanitization

Front 19

SP800-92

Back 19

Guide to Computer Security Log Management

Front 20

SP800-100

Back 20

Information Security Handbook: A Guide for Managers

Front 21

SP800-115

Back 21

Technical Guide to Information Security Testing and Assessment

Front 22

SP800-122

Back 22

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

Front 23

SP800-128

Back 23

Configuration Management of Information Systems

Front 24

SP800-137

Back 24

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

Front 25

SP800-144

Back 25

Security and Privacy in the CLOUD

Front 26

5 U.S.C. 552a-Privacy Act of 1974

Back 26

Information gathered on individuals should only be used for the purpose for which it was collected

Front 27

CNSS Instruction No. 1253A

Back 27

Security Control Overlays Template  (Used for Security Categorization and Control Selection for National Security Systems)

Front 28

FIPS 199

Back 28

Standards for Security Categorization of Federal Information and Information Systems

Front 29

FIPS 200

Back 29

Minimum Security Requirements for Federal Information and Information Systems  (Selecting Security Controls)

Front 30

OMB M-06-15

Back 30

Safeguarding Personally Identifiable Information

Front 31

OMB M-06-19

Back 31

Reporting Incidents involving PII

Front 32

OMB Circular A-11

Back 32

Preparation, Submission, and Execution of the Budget

Front 33

OMB Circular A-123

Back 33

Management's Responsibility for Internal Control

Front 34

OMB Circular A-130  (Management of Federal Information Resources)

Back 34

Must have:

1.  Security plan

2.  Emergency Response Capabilities

3.  One person responsible for security

4.  Reports to Congress

5.  Security awareness training

6.  Reg. review and improvement of contingency plans

Front 35

Section 3541 Title 44 U.S.C. - Federal Information Security Management Act of 2002

Back 35

Requires:

1. Security Program

2. Annual Security Review

3. Annual Reporting

4. Defines National Security Systems

 

Front 36

E-Government Act of 2002

Back 36

The origin of the requirement for a Privacy Impact Assessment  (P.I.A.)

 

Front 37

Clinger-Cohen Act of 1996 (Also known as I.T. Management Reform Act)

Back 37

Required each Agency to have a process to maximize value and assess and manage risks of I.T. investments

Front 38

The Computer Security Act of 1987

Back 38

Says:

1. Computer Security Plan should be made

2. Identify computers containing sensitive info.

3. Need Security awareness training for individuals