Isc2 Issep Study Deck

Front 1

What does CNSS stand for?

Back 1

Committee for National Security Systems

Front 2

Why is Executive Order 13231 significant?

Back 2

major milestone document establishing the
President’s intent to secure the national infrastructure

Front 3

What does NIAC stand for?

Back 3

National Infrastructure Advisory Council

Front 4

What does NSTAC stand for?

Back 4

National Security Telecommunications Advisory Committee

Front 5

What does EO 13231 require?

Back 5

that the responsible personnel oversee,
develop, and ensure implementation of policies, principles, standards, and guidelines for the
security of information systems that support the operations under their respective control

Front 6

What does EO 13231 establish?

Back 6

* Voluntary public-private partnership
* Provided the Director OMB increased responsibility
* NIAC
* NSTAC

Front 7

What policy created CNSS?

Back 7

Executive Order 13231

Front 8

What agency chairs the CNSS?

Back 8

DoD

Front 9

What is the effective date of EO 13231?

Back 9

'16 OCT 2001

Front 10

What is the ISSEP definition of availability?

Back 10

Timely, reliable access to data and information services for
authorized users

Front 11

What is the ISSEP definition of integrity?

Back 11

Quality of an IS reflecting the logical correctness and
reliability of the operating system; the logical completeness
of the hardware and software implementing the protection
mechanisms; and the consistency of the data structures
and occurrence of the stored data.

Front 12

What is the ISSEP definition of confidentiality?

Back 12

Assurance that information is not disclosed to unauthorized
individuals, processes, or devices.

Front 13

What is the ISSEP definition of access control?

Back 13

Limiting access to information system resources only to
authorized users, programs, processes, or other systems.

Front 14

What is the ISSEP definition of authentication?

Back 14

Security measure designed to establish the validity of a
transmission, message, or originator, or a means of
verifying an individual's authorization to receive specific
categories of information.

Front 15

What is the ISSEP definition of non-repudiation?

Back 15

Assurance the sender of data is provided with proof of
delivery and the recipient is provided with proof of the
sender's identity, so neither can later deny having
processed the data.

Front 16

What is a National Security System?

Back 16

A system that:
Involves intelligence activities
Involves ctryptologic activities related to national security
Involves command and control of military forces
Involves equipment that is an integral part of a weapon or weapons system
Is critical to the direct fulfillment of military or intelligence missions

Hint 16

There are 5 categories

Front 17

According to NIST, what are the phases of the Systems Development Life Cycle (SDLC)?

Back 17

Initiation
Develop/Acquire
Implement
Ops/Maintenance
Disposal

Hint 17

There are 5 phases

Front 18

What is C&A?

Back 18

The standard DoD approach for:
identifying IS requirements
providing security solutions and
managing the security of DoD ISs

Hint 18

There are 3

Front 19

What are the general phases of C&A?

Back 19

Define Problem
Risk Assessment
Implement Controls
Certification
Accreditation
Ops/Maintenance
Disposal

Hint 19

There are 7

Front 20

What are the phases of the Risk Management Framework?

Back 20

Categorize the IS
Select security controls
Implement security controls
Assess security controls
Authorize IS
Monitor security controls

Hint 20

There are 6

Front 21

With respect to the RMF, what are the contributing factors to categorize the IS?

Back 21

Architecture Description
Organizational Input

Hint 21

There are 2

Front 22

What are the components of the RMF architecture description?

Back 22

Architecture reference models
Segment and solution architectures
Mission and business processes
Information system boundaries

Hint 22

There are 4

Front 23

What are the components of the RMF organizational inputs?

Back 23

Laws and directives
Policy guidance
Strategic goals and objectives
Priorities and resource availability
Supply chain considerations

Hint 23

There are 5

Front 24

What government inputs should be considered when developing security requirements?

Back 24

Statutory (USC, ACT, HR, Title, Public Law)
Regulatory (EO/PD, OMB, Cabinet/Agency Policy)
Processing Standards (FIPS, CNSS, NIST standards)
Guidelines (NIST SPs, STIGs)

Front 25

What is the organizational role and authority of The White House?

Back 25

Executive Office given statutory authority to issue E.O., proclamations,
PDD/HSPD, and similar documents that initiate action, stop action, or require
general notice be given.

Front 26

What is the organizational role and authority of The US Congress?

Back 26

Legislative body responsible for the USC and the general, permanent laws of
the nation that it contains. Congress’s power to authorize the appropriation of federal spending to carry out government activities.

Front 27

What is the organizational role and authority of OMB?

Back 27

Evaluates expenditure effectiveness, and provides oversight of
Administration procurement, fiscal management, information and regulatory
policy

Front 28

What is the organizational role and authority of NSA?

Back 28

Has responsibility for ensuring that all cryptographic methods and systems
used to protect USFG information and systems are sufficiently strong; for
penetrating adversary systems and codes; and to ensure that all national
security information is protected appropriately whether in transit or at rest

Front 29

What is the organizational role and authority of NIST?

Back 29

Has responsibility to ensure that standards and measures are developed to
improve performance, and charged by law with responsibility for information
security standards, metrics, tests, and various other means to support
agencies' missions. Issues SP, FIPS, ITL Bulletins, NISTIR, and other
guidance.

Front 30

What is the organizational role and authority of NIAP?

Back 30

NIAP is an initiative partnership between the NIST and the NSA to evaluate
and attempt to meet the needs and requirements of IT/IA product producers
and consumers to evaluate functionality and pedigree.

Front 31

What does OMB stand for?

Back 31

Office of Management and Budget

Front 32

What does NIST stand for?

Back 32

National Institute of Standards and Technology

Front 33

What does NIAP stand for?

Back 33

National Information Assurance Partnership

Front 34

What is the organizational role and authority of CNSS?

Back 34

Formerly know as NSTISSC, the CNSS provides a participative
forum to examine national policy and promulgates direction,
operational procedures and instructions (CNSSI), and other
forms of authoritative guidance for national security systems.

Front 35

What is the significance of EO 13228?

Back 35

Establishing the Office of Homeland Security and the HS
Council (2001) – Initiates a comprehensive strategy to secure the
US from terrorist attacks.

Front 36

What is the significance of EO 13231?

Back 36

CIP in the Information Age (2001) ~ which states policy
to protect CI against compromise. Renamed NSTISSC to CNSS.

Front 37

What is the significance of HSPD-7?

Back 37

Homeland Security Directive 7 (2003) ~ which directs the
identification and prioritization of CI assets and key resources to
protect them from terrorist attacks. Supersedes PDD-63.

Front 38

What is the significance of HSPD-12?

Back 38

Homeland Security Directive 12 (2004) ~ which directs a
common identification standard that is “secure and reliable” to verify
employee identity.

Front 39

What is Public Law 100-235, Title 101, Statute 1724?

Back 39

The Computer Security Act of 1987

Front 40

What does the Computer Security Act of 1987 establish?

Back 40

~ Improve security/privacy of sensitive information in federal
systems;
~ Federal agencies to establish standards & guidelines
~ Requires that any federal computer system that processes
sensitive information have a customized security plan
(SSAA).
~ Requires that users of those systems undergo security
training.
NIST responsible, NSA to advise.
~ assessing the vulnerability of federal computer systems,
~ developing standards,
~ providing technical assistance with NSA support, and
~ developing training guidelines for federal personnel

Front 41

What is the significance of the Privacy act of 1974?

Back 41

~ Balance the government’s need to maintain
information about individuals with the rights of
individuals
~ Act focuses on four basic policy objectives
– Restrict disclosure
– Increased rights of access to agency records
– Grant individuals the right to seek amendment
– Establish a code of “fair information practices”

Front 42

What is the significance of the Clinger-Cohen Act of 1996?

Back 42

Established that every federal agency must have a CIO
Reformed Information Technology Management
Defined a National Security System

Front 43

What is the significance of OMB Circular A-130 Appendix III, 24 DEC 1985?

Back 43

Management of Federal Information Resources
Mandatory implementation of Computer Security Act and FISMA requirements
Defines adequate security
~Provides specific practices and guidelines for
implementation of the Paperwork Reduction Act
-Established a mandate for agencies to perform their
information resources management in an effective
manner
~Requires accreditation of federal IS’ to operate
based on an assessment on management,
operational, and technical controls

Front 44

What is the definition of adequate security (according to OMB Circular A-130)?

Back 44

“security commensurate with the risk and magnitude of the
harm resulting from the loss, misuse, or unauthorized access to
or modification of information.…provide appropriate
confidentiality, integrity, and availability, through the use of cost-effective
management, personnel, operational, and technical
controls.”

Front 45

What determines a systems criticality?

Back 45

mission

Front 46

What determines a systems sensitivity?

Back 46

confidentiality, integrity and availability

Front 47

What is Public Law 107-347, Title III?

Back 47

The E-Government Act of 2002, Federal Information Security Management Act

Front 48

What does the E-Government Act of 2002 establish?

Back 48

~ OMB has Oversight over E-Government
-Federal Government (Organizations and IG’s) must report
IA status to OMB annually and quarterly
-OMB provides reports to Congress annually
-Congressional Cyber Security Grade
~ NIST publishes Standards and Guidelines
~ All Federal Government must follow NIST C&A
processes, with the exception of Defense and
Intelligence organizations.

Front 49

What does the 2000 update to OMB Circular A-130 add?

Back 49

~ Risk-based approach to assess and react to threat and
vulnerabilities
~ Security Plans and identification and correction of deficiencies
~ Incident Response capabilities
~ Interruption planning and continuity support
~ Technical controls consistent with NIST guidance
~ Periodic review of status and controls
~ Information sharing (MA only) and public access controls
~ Responsibility assignment
~ Periodic reporting of operational and security status

Front 50

What does M-00-13 establish?

Back 50

Privacy Policies and Data Collection on Fed. Websites
A continuation and update of M-99-18 to add the mention of
“cookies” and their impact, and to add as mandatory
compliance with the Children’s Online Privacy Act (COPA-98)
(2000).

Front 51

What does M-01-08 establish?

Back 51

Implementing GISRA (2001) – superseded by FISMA
Provides guidance to agency heads regarding GISRA
implementation

Front 52

What does M-02-01 establish?

Back 52

Guidance for Preparing and Submitting Security Plans
of Action and Milestones (Oct 2001)

Front 53

What are the required components of a POA&M according to OMB?

Back 53

Weakness
POC
Resources Required
Scheduled Completion Date
Milestones with Completion Dates
Changes to Milestones
Indentified in CFO Audit or other review?
Status

Hint 53

There are 8 columns

Front 54

What are the required components of a DIACAP POA&M?

Back 54

Weakness
CAT (Severity Code)
IA Control and Impact Code
POC
Resources Required
Scheduled Completion Date
Milestones with Completion Dates
Changes to Milestones
Indentified in CFO Audit or other review?
Status
Comments

Hint 54

There are 11 columns

Front 55

DoD 5200.28 ~ Title, Date issued and what superseded it?

Back 55

Security Requirements for Automated Information Systems, March 21, 1989
(updated under DOD 8500 series)

Front 56

DoD CIO Policy 10-8460 ~ Title and date

Back 56

Global Information Grid –Network Operations
Aug 24, 2000

Front 57

What are the types of DoD Issuances?

Back 57

~ Directives (DoDD): policy documents that establish
or describe requirements, missions, authorities, etc.
~ Memoranda (from SecDef): they direct
implementation of policy, legislation, EO; becomes
DoDD 180 days later unless subject is classified or
temporary.
~ Instructions (DoDI): describe policy implementation
~ Administrative (DoD AI): support supplement to
DoDI
~ Publication (DoDP): provides procedures for DoDI

Front 58

What is DIAP?

Back 58

Defense-Wide IA Program. Mission is to ensure
that information assets are protected through unified IA
activities using D-in-D approaches in support of GIG
Net-Centricity.

Front 59

What is DISA?

Back 59

Defense Information Systems Agency.
Responsible for all aspects of systems engineering and
support of GIG. Provides IASE as the clearinghouse
location for all DoD IA info.

Front 60

What is NIAD?

Back 60

NSA IA Directorate. Provide required capability
to support survival and success of all DoD missions.

Front 61

What is DARPA?

Back 61

R&D for DoD. Operates the OASIS program
to provide robust capability to enable survival of DoD
AIS against a sophisticated and motivated adversary.

Front 62

What is the high-level list of DoD IA Policy series?

Back 62

~ 8500: General Policy
~ 8510: IA Certification and Accreditation
~ 8520: Security Management
~ 8530: Computer Network Defense
~ 8540: Interconnectivity
~ 8550: Network and Web
~ 8560: IA Monitoring
~ 8570: Education, Training, and Awareness

Hint 62

There are 8

Front 63

Describe DoDP 8500.1

Back 63

Information Assurance (2003)
Supersedes: 5200.28,5200.28M, 5200.28STD
and CIO Memorandum 6-8510.
Applies to all DoD owned or controlled AIS
Establishes policy and assigns responsibilities
to achieve IA goals through Defense-in-Depth
and integrates people, technology, and
operations to support GIG.

Front 64

Describe DoDI 8500.2

Back 64

IA Implementation (2003)
Accompanies: 8500.1 Information Assurance
Provides guidance on how to implement 8500.1
policy to establish layered defenses IAW with
principles underlying GIG and D-in-D, defines
controls for MAC levels, and defines
Robustness levels
~ Basic (~ to CC EAL 2)
~ Medium (~ to CC EAL 4)
~ High (~ to CC EAL 6)

Front 65

Describe DoDD 8570.1

Back 65

IA Training, Certification, and
Workforce Management (2004)
This directive describes the program for training
and certification (qualifications, requirements,
metrics, and more) for ensuring adequate
security knowledge and skill in assigned duty
positions.

Front 66

Describe DoDM 8570.1M

Back 66

IA Workforce Improvement
Program (Change 1, 5/2008)
This manual accompanies DoDD 8570.1, and
provides details necessary to implement the
program.

Front 67

Describe DoDI 500.2-R

Back 67

Mandatory Procedures for Major
Defense Acquisition Programs (MDAPS) & Major
Automated Information System (MAIS) Acquisition
Programs (2001)
This has been superseded effective December
2008, and replaced by DoDI 5000.02., which also
cancels DoDI 5000.2 (2003)
It called for consideration of risks and IA
functions, capabilities, and features to be given
consideration in the acquisition process of COTS
and GOTS products.

Front 68

Describe DoDI 5200.40

Back 68

DITSCAP (1997)
DoD C&A standard that outlines an iterative
four-step process to accomplish the mission of
operational deployment of assured systems:
1. Definition: document al aspects of system context
2. Verification: Compliance status determination
3. Validation: all activities required to prove status
4. Post-Accreditation: Mgmt of SSAA, change, and
continual monitoring of compliance state
(This has been superseded by DoDI 8510.01 DIACAP effective November 2007.)

Front 69

What is the CNSS?

Back 69

NSTISSC was established by NSDD 42a (1990) in order to
implement provisions and requirements of NSDD 42, renamed
to CNSS by EO 13231 in 2001, in order to:
~ Considers technical matters and develop operating
policies, procedures, guidelines, instructions, and
standards;
~ Assess the overall security posture of and disseminate
information on threats to and vulnerabilities of national
security systems;
~ Review and approve all standards, techniques, systems,
and equipment related to the security of national security
systems, and,
~ To examine U.S. national security systems and evaluate
their vulnerability to foreign interception and exploitation,
and oversee mitigating action.

Front 70

What are the CNSS issuance types and purpose?

Back 70

Policy: assigns responsibilities and
establishes criteria (NSTISSP/CNSSP);
Directives: Establish or describe policy,
programs assign authority or
responsibilities (NSTISSD/CNSSD);
Instructions: Describe implementation or
intention of policy (NSTISSI/CNSSI);
Memoranda: To provide guidance or
explanation of policy or other issuance (NSTISSAM/CNSSAM)

Front 71

Describe NTISSP 6

Back 71

Issued 1994, Established the requirement for all
Federal agencies operating NSS to have a C&A
program; implemented through NSTISSI 1000.

Front 72

Describe NSTISSP 7

Back 72

Issued 1995, Specified functional, management, and
technical requirements to produce a secure electronic
messaging system for conduct of official business:
Additional guidance issued to implement by Y2000
To be government-wide interoperable across all NSS
Required this to be accomplished through common
standards and procedures

Front 73

Describe NSTISSP 11

Back 73

Issued 2003, States policy that IA shall be done through
COTS and GOTS products, and that such products are to be
evaluated through CC processes:
~ Must achieve more than simply confidentiality;
~ COTS/GOTS should be used as more readily available;
~ IA achievement must evolve beyond traditional view;
~ OCONUS CC partner evals for EAL 1-4 accepted w/o
NIAP
~ NIAP required as well for EAL 5-7 product requirements
Exceptions allowed:
~ Any COTS/GOTS acquired prior to policy effective date;
~ Recognition of the complexities of technology and
evaluation process

Front 74

Describe NCSC-5

Back 74

Issued 1981, Governs use of crypto-materials in high-risk
environments. Specifies requirements for equipment selection,
use, evacuation, destruction (to prevent loss), P2P keying (no
netting or common-user), and only minimum necessary.

Front 75

Describe NSTISSP 200

Back 75

Issued 1987, sets policy that, in essence, requires all
NSS to comply with C2-level requirements. Defines AIS, TCB,
TCSEC (now must meet EAL 4).

Front 76

Describe NSTISSP 101

Back 76

Issued 1999, Sets national policy that all military voice
radio and sensitive civilian government voice systems must be
secure; threats must be assessed and security implemented
must be commensurate.

Front 77

Describe CNSSP 14

Back 77

Issued 2002, Governs release of IA products and
services to non-USFG members, and specifies methods and
controls by which this can, as appropriate, be done.

Front 78

Describe NSTISSD-500

Back 78

Issued 1993, Specifies requirements for all USFG
departments to implement programs to address ongoing
needs for education, awareness, and training for NSS.

Front 79

Describe NSTISSI 4011

Back 79

Issued 1994, Course content InfoSec profession

Front 80

Describe CNSSI 4012

Back 80

Issued 2004, For senior system managers (DAAs).
Supersedes NSTISSI 4012 (1997)

Front 81

Describe CNSSI 4013

Back 81

Issues 2004, For Sysadmins. Supersedes NSTISSI
4013 (1997)

Front 82

Describe CNSSI 4014

Back 82

Issued 2004, For ISSOs. Supersedes NSTISSI 4014
(1997).

Front 83

Describe NSTISSI 4015

Back 83

Issued 2000, Standards for Systems Certifiers

Front 84

Describe NACSI 6002

Back 84

Issued 1984, Protection of USFG contractor
communications. In essence enforces the requirement for
contractors to protect their communications (contract related)
to the same level as the agency, and then charge
that agency for the cost of meeting those requirements.

Front 85

Describe NSTISSI 7003

Back 85

Issued 1994, Protected distribution systems.
This refers to systems that are used to transmit
unencrypted traffic (NSI) through lower-cleared areas, and
how, when, and where they can be used.

Front 86

Describe NSTISSI 1000

Back 86

Issued 2000, Establishes minimum national
standards for C&A processes, and provides guidance on
how to implement NSTISSP 6. Describes the NIACAP

Front 87

Describe NSTISSAM CompuSec 1-98

Back 87

Issued 1998, Describes the role of
firewalls and other enclave boundary protections IAW with
Defense in Depth principles. Names firewall types: packet,
proxy, and hybrid of these.

Front 88

Describe NSTISSAM CompuSec 1-99

Back 88

Issued 1999,Describes the
decision to transition from TCSEC to CC, recognition of
technology advances and evaluation independence needs.

Front 89

Describe NSTISSAM InfoSec 1-00

Back 89

Issued 2000, States that the policy
shall be that all applications or devices processing as
Unclassified NSS that use crypto must use a form
validated against FIPS 140 or the CC.

Front 90

Describe NSTISSAM InfoSec 2-00

Back 90

Issued 2000, Describes the policy and
a strategy for using the NIAP to evaluate COTS using
commercial labs. All units evaluated must be reviewed by
NIAP for compliance with the CC, and a separate NIAP
evaluation is optional.

Front 91

Describe CNSSAM 1-04

Back 91

Issued 2004, Provides guidance to all agencies
that a multilayer/multivendor approach to IA architecture is
desirable, as long as the overall architecture and
engineering is performed in a sound and well-executed
manner (to ensure optimal integration and interoperability).

Front 92

What is NIST's role in the USFG?

Back 92

Establishes an Information Assurance
Technology Framework (IATF)
Continuing Key Areas:
~ Developing security standards, guidelines, and
associated methods and techniques for information
services, including metrics as in SP 800-53
~ Conduct security research – understand vulnerabilities
and develop new security techniques

Front 93

NIST SP 800-12

Back 93

(1995): Introduction to Computer Security
Basic information and guidance (from OECD) on principles and
practices:
~ Supports org mission and is part of sound management
~ Cost-effective with a comprehensive, integrated approach
~ Responsibility and accountability are explicit

Front 94

NIST SP 800-14

Back 94

Generally Accepted Principles and Practices for Securing Information Technology Systems (GASSP)
(1996) Provides father and deeper explanation and guidance of the
topics introduced in 800-12
Among other things, addresses risk management, SLC
planning, incident response, training and awareness

Front 95

NIST SP 800-16

Back 95

Information Technology Security Training Requirements: A Role~ and Performance-Based Model

Front 96

NIST SP 800-18

Back 96

Guide for Developing Security Plans for Federal Information Systems (SSP)
Complies with and implements OMB A130 Appendix III and CSA 87
SSP Purpose:
~ Describe requirements of the particular AIS
~ Delineate responsibilities and required behaviors of users
Three primary tasks:
~ Preparation of the plan itself
~ Notification and resource identification
~ Plan analysis, update, and acceptance
Defines Major Application (MA) and General Support System (GSS)

Front 97

NIST SP 800-27 REV A

Back 97

Engineering Principles for IT Security, Baseline
Provides a listing of engineering principles (33) to be used to
achieve appropriate levels of InfoSec
Tied very closely to the principles stated in 800-12 and 800-14
Specifies a five phase model for employing these principles:
~ Initiation
~ Development/Acquisition
~ Implementation
~ O&M Phase
~ Disposal

Front 98

NIST SP 800-30

Back 98

Risk Management Guide for Information Technology Systems
1. System Characterization
2. Vulnerability Identification
3. Threat Identification
4. Control Analysis
5. Likelihood Determination
6. Impact Analysis
7. Risk Determination
8. Control Recommendations
9. Results Documentation

Front 99

What steps of SP 800-30 can be performed in parallel?

Back 99

2. Vulnerability Identification
3. Threat Identification

Front 100

NIST SP 800-34 REV 1

Back 100

Contingency Planning Guide for Federal Information Systems

Front 101

NIST SP 800-37 REV 1

Back 101

Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (RMF)

Front 102

NIST SP 800-39

Back 102

Managing Information Security Risk: Organization, Mission, and Information System View (Enterprise Risk)

Front 103

NIST SP 800-40

Back 103

Creating a Patch and Vulnerability Management Program (Vulnerability Management)

Front 104

NIST SP 800-41

Back 104

Guidelines on Firewalls and Firewall Policy

Front 105

NIST SP 800-47

Back 105

Security Guide for Interconnecting Information Technology Systems
~ Establishes guidelines (including tasks and
subtasks) to plan, establish, maintain, and
terminate interconnections between AIS that are
owned and operated by different organizations.
~ Addresses all stages of interconnection lifecycle.
~ Does not address classified AIS.

Front 106

NIST SP 800-50

Back 106

Building an Information Technology Security Awareness and Training Program

Front 107

NIST SP 800-53 REV 3

Back 107

Recommended Security Controls for Federal Information Systems and Organizations
~ Provides a catalogue of security controls for
federal information systems (NSS).
~ Recommends baseline security controls for
federal information systems (IAW FIPS
Publication 199 risk levels)
~ Provides guidelines for agency-directed tailoring
of baseline security controls
Incorporates security controls from many public
and private sector sources
~ CC Part 2
~ ISO/IEC 27001
~ COBIT
~ GAO FISCAM
~ CMS (healthcare)
~ D/CID 6-3 Requirements
~ DoD Policy 8500
~ BITS Functional packages

Front 108

NIST SP 800-53A REV1

Back 108

Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans
Provides guidance for agencies to consistently map
impact levels to information types and sensitivities
and provide methods for evaluating the
effectiveness of deployed controls in IT systems.
Applicable to all Federal AIS other than NSS
Operating as intended
Implemented Effectively
Providing desired outcome

Front 109

NIST SP 800-54

Back 109

Border Gateway Protocol Security

Front 110

NIST SP 800-59

Back 110

Guideline for Identifying an Information System as a National Security System (NSS)

Front 111

NIST SP 800-60

Back 111

Guide for Mapping Types of Information and Information Systems to Security Categories: (2 Volumes)
Volume 1: Guide
Provides guidance for agencies to consistently map
impact levels to information types and sensitivities
Applicable to all Federal AIS other than NSS
Information types are based on OMB Federal
Enterprise Architecture PMO Consolidated
Reference Model, Version 2.3 (2007)
Volume 2: Appendices
Contains Appendices, References, Provisional
impact Assignment levels, Legislative sources, and
Rationale

Front 112

NIST SP 800-61

Back 112

Computer Security Incident Handling Guide

Front 113

NIST SP 800-63

Back 113

Electronic Authentication Guideline

Front 114

NIST SP 800-64

Back 114

Security Considerations in the System Development Life Cycle (SDLC)

Front 115

NIST SP 800-66

Back 115

An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

Front 116

NIST SP 800-70 REV 1

Back 116

National Checklist Program for IT Products: Guidelines for Checklist Users and Developers

Front 117

NIST SP 800-88

Back 117

Guidelines for Media Sanitization

Front 118

NIST SP 800-92

Back 118

Guide to Computer Security Log Management

Front 119

NIST SP 800-94

Back 119

Guide to Intrusion Detection and Prevention Systems (IDPS)

Front 120

NIST SP 800-100

Back 120

Information Security Handbook: A Guide for Managers

Front 121

NIST SP 800-115

Back 121

Technical Guide to Information Security Testing and Assessment

Front 122

NIST SP 800-117

Back 122

Guide to Adopting and Using the Security Content Automation Protocol (SCAP) Version 1.0

Front 123

NIST SP 800-122

Back 123

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

Front 124

NIST SP 800-126 REV 2

Back 124

The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1

Front 125

NIST SP 800-128 (DRAFT)

Back 125

DRAFT Guide for Security Configuration Management of Information Systems

Front 126

NIST SP 800-137 (DRAFT)

Back 126

DRAFT Information Security Continuous Monitoring for Federal Information Systems and Organizations

Front 127

NIST SP 800-55 REV 1

Back 127

Performance Measurement Guide for Information Security

Front 128

NIST SP 800-45 V2

Back 128

Guidelines on Electronic Mail Security

Front 129

FIPS 199

Back 129

Standards for Security Categorization of Federal Information and Information Systems
Establishes standards to be used by Federal agencies to categorize information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels and potential impacts using this general formula:
AIS Impact levels (using a H, M, L scale):
SC (AIS) = {(Conf,impact),(Integ,impact)(Avail,impact)
Result is system high, Moderate or Low.
Using NIST 800-53 provides system Control Baseline

Front 130

What are the FIPS 199 impact levels?

Back 130

Low
Moderate
High

Front 131

What document(s) is/are used to categorize systems for FISMA?

Back 131

FIPS 199

Front 132

What document(s) is/are used to provide mapping guidelines recommending the types of information and information systems to be included in each category described in FIPS 199?

Back 132

NIST SP 800-60

Front 133

What document(s) is/are used to develop minimum information security requirements (i.e., management, operational, and technical security controls) for information and information systems in each category?

Back 133

NISP SP 800-53 and FIPS 200

Front 134

FIPS 200

Back 134

Minimum Security Requirements for Federal Information and Information Systems
Specifies minimum security requirements in 17
areas that are to be met using controls outlined in
SP800-53. These are mandatory.
No provision for waivers is made.
Complements FIPS 199

Front 135

What document(s) is/are used to define how C&A is performed under FISMA?

Back 135

NIST SP 800-37 & NIST SP 800-53A

Front 136

What NIST publications support FISMA?

Back 136

~ FIPS 140: Crypto module requirements
~ FIPS 197: AES
~ FIPS 199: System Categorization
~ FIPS 200: Minimum Security Requirements
FIPS 201
~ SP 800-37: C&A
~ SP 800-53: Minimum Controls
~ SP 800-53A: Verification Procedures
~ SP 800-60: Mapping Guidance

Front 137

FIPS 46

Back 137

DES is permitted on legacy AIS only – and thus is
still relevant to the ISSEP

Front 138

FIPS 81

Back 138

Triple DES is a FIPS approved algorithm of choice.
Encourages transition to TDES as rapidly as prudent strategy and budgets permit

Front 139

FIPS 140

Back 139

Establishes requirements that must be met by
modules to be used or considered for use in SBU
systems, including voice systems.
Describes a hierarchical system of increasing levels;
Has a waiver procedure that allows relief in the
event that a) adverse mission impact or b) financial
impact

Front 140

What are the hierarchy levels of FIPS 140?

Back 140

1: lowest, executable on a general purpose system;
2: Includes 1, adds tamper-evidence features, AIS is EAL2 & up
3: Includes 2, adds mechanisms to prevent Rev-eng, and requires identity-based authentication; EAL3 and up
4: Includes 3, adds environmental protections (temp, voltage); EAL4 and higher

Front 141

FIPS 197

Back 141

Specifies that AES is a FIPS approved algorithm of choice.
For use on SBU, but not classified information and AIS.
Has a waiver procedure that allows relief in the event that a) adverse mission impact or b) financial impact
[For classified and financial data must use Type 1 crypto (AES 256 or better)

Front 142

FIPS 199 low impact characteristics?

Back 142

limited adverse effect

Front 143

FIPS 199 moderate impact characteristics?

Back 143

serious adverse effect

Front 144

FIPS 199 high impact characteristics?

Back 144

sever or catastrophic adverse effect; threat to human life, or result in loss of major assets

Front 145

What key components are considered with each level of impact in FIPS 199?

Back 145

Mission
Financial impact
Asset impact
Personnel security

Front 146

What are options are available to manage risk?

Back 146

~ Risk Assumption
~ Risk Avoidance
~ Risk Limitation
~ Research and Development
~ Risk Transference

Front 147

NIST SP 800-37

Back 147

Guidelines for the Security C & A of Federal Information Systems (2004)
~ Issued by NIST under the authority of FISMA-
2002, and is consistent with OMB A-130.
~ Establishes guidelines (including tasks and
subtasks) to certify and accredit information
systems supporting the executive branch of the
federal government
~ Applicable to non-national security information
systems as defined in the FISMA of 2002
~ Replaces FIPS Publication 102 (withdrawn 2005)

Front 148

What are the SP 800-53 control classes?

Back 148

Management security controls (aka Administrative)
-Policy, standards, baselines, guidelines, procedures
Technical security controls (aka Logical)
~ Hardware, software, firmware components and devices
-Often provides basic support enabling other controls to function correctly
Operational controls (aka Physical)
~ Include leading industry practices and procedural guidance

Front 149

What are the types of controls in each class of 800-53 controls?

Back 149

Preventive
Detective
Corrective
Compensating
Deterrent
Supplemental

Front 150

What are the primary types of 800-53 controls?

Back 150

Preventive
Detective
Corrective

Front 151

What are the secondary types of 800-53 controls?

Back 151

Compensating
Deterrent
Supplemental

Front 152

What are the 800-53 Management Controls?

Back 152

Security Assessment and Authorization (CA)
Planning (PL)
Risk Assessment (RA)
System and Services Acquisition (SA)
Program Management (PM)

Front 153

What are the 800-53 Operational Controls?

Back 153

Awareness and Training (AT)
Configuration Management (CM)
Contingency Planning (CP)
Incident Response (IR)
Maintenance (MA)
Media Protection (MP)
Physical and Environmental Protection (PE)
Personnel Security (PS)
System and Information Integrity (SI)

Front 154

What are the 800-53 Technical Controls?

Back 154

Access Control (AC)
Audit and Accountability (AU)
Identification and Authentication (IA)
System and Communications Protection (SC)

Front 155

What is the Common Criteria?

Back 155

The CC is a collection of generic security requirements
(statements) to aid in the specification of product or
system security attributes (Functional and Assurance)
Common Criteria (CC) approach offers:
~ Security focus to individual network components
~ Software Applications
CC Evaluated Products (EAL/EPL)
~ Evaluate Security Posture
~ Isolate Product by Defining Interface Boundary

Front 156

What is the consumers role in Common Criteria?

Back 156

Support procurement of evaluated products

Front 157

What is the Developers/Integrators role in Common Criteria?

Back 157

Support development to meet requirements

Front 158

What is the evaluators role in Common Criteria?

Back 158

Use the CC as a basis for evaluation of products

Front 159

What is the Auditor/Certifier/Accreditors role in Common Criteria?

Back 159

to support specific needs for security specifications

Front 160

What is Common Criteria derived from?

Back 160

ISO/IEC 15408
Rainbow series was too rigid and did not take many
things into account and expensive evaluations
ITSEC provided more flexibility, but added more
complexity with its attempts
Made up from:
~ TCSEC
~ ITSEC
~ Canadian Trusted Computer Product Evaluation Criteria
(CTCPEC)
~ Federal Criteria from US, UK, Germany, France, Canada

Front 161

What are the Common Criteria evaluation ratings?

Back 161

EAL 1: Functionally tested
EAL 2: Structurally tested
EAL 3: Methodically tested and checked
EAL 4: Methodically designed, tested and reviewed
EAL 5: Semi-formally designed and tested
EAL 6: Semi-formally verified, designed, and tested
EAL 7: Formally verified, designed, and tested

Front 162

What are the components of the Common Criteria?

Back 162

Protection Profile
~ Description of needed security solution
Target of Evaluation
~ Product proposed to provide needed security solution
Security Target
~ Written by vendor explaining security functionality and
assurance mechanisms that meet the needed security
solution
Packages – Evaluation Assurance Levels (EAL)
~ Security requirements are bundled into packages for re-use
~ Reqs to be met to achieve specific EAL ratings

Front 163

What are the sets of requirements used in Common Criteria?

Back 163

Security functional requirements (performance)
Security assurance requirements (pedigree)

Front 164

What areas comprise the security functional requirements of the Common Criteria?

Back 164

~ Identification and authentication
~ Audit
~ Resource utilization
~ Trusted paths/channels
~ User data protection
~ Security management
~ TOE access
~ Communications
~ Privacy
~ Protection of the TOE security functions
~ Cryptographic support

Front 165

What areas comprise the security assurance requirements of the Common Criteria?

Back 165

~ Guidance documents and manuals
~ Configuration management
~ Vulnerability assessment
~ Delivery and operation
~ Life cycle support
~ Assurance maintenance
~ Development
~ Testing

Front 166

What are the steps of the Common Criteria methodology?

Back 166

1. Evaluate the conditions between the evaluated
product and the present situation.
2. Evaluate the differences of the conditions for
regression and/or independent testing.
3. Determine if additional security requirements are
required for the present situation.
4. Analyze the security impact of the interfaces.
5. Performed the testing and/or analysis.

Hint 166

There are 5 steps

Front 167

What is the intended scope/application of the Common Criteria?

Back 167

A paradigm used to specify security properties
of IT products and systems that address
~ unauthorized disclosure (confidentiality, privacy)
~ unauthorized modification (integrity)
~ loss of use (availability)
The basis for comparison of the results of
independent evaluations
Applicable to IT security functions implemented
by hardware, software, and firmware

Front 168

How do consumers use the Common Criteria?

Back 168

They need to document user requirements in the protection profile
~ Part I: structure for PP
~ Part II & III: guidance for formulating and determining reqs

Front 169

How do developers use the Common Criteria?

Back 169

They need to develop security equipments into products
~ Part I: development and formulating reqs
~ Part II & III: interpreting requirements -> commonality

Front 170

How do evaluators use the Common Criteria?

Back 170

They need to prepare the ST for testing
~ Part I: structure for PPs and STs
~ Part II & III: mandatory statement of eval criteria

Front 171

What are the documents that make up the Common Criteria?

Back 171

Part 1 ~ Intro and General Model
Part 2 ~ Security Functional Reqs
Part 3 ~ Security Assurance Reqs

Front 172

How is Part 1 of the Common Criteria organized?

Back 172

Scope, Glossary, Overview
Security Context & CC Approach
Security Concepts, Environment & Objectives
Evaluation Results
Appendix A: History
Appendix B: Specification of Protection Profiles (PPs)
Appendix C: Specification of Security Targets (STs)

Front 173

What is a Protection Profile?

Back 173

~ Answers the question:
“What do I need in a security solution?”
~ Implementation independent for a class of
products or systems
~ Protection Profile authors:
anyone who wants to state IT security needs (e.g.,
commercial consumer, consumer groups)
anyone who supplies products which support IT
security needs…..anyone.
PP makes a statement of implementation
independent security needs
~ a generic OS with DAC, Audit, and I&A

Front 174

What is a Security Target?

Back 174

~ Answers the question:
“What does a developer provide in a security
solution?”
~ Implementation dependent and version specific
~ Security Target authors:
~ Product vendors, developers, integrators
Knowledge of implementation details required
ST defines the implementation dependent
capabilities of a specific product, e.g.
– Microsoft NT 4.0.0.2 (TOE)
– Sun OS 4.7.4 (TOE)

Front 175

What is the Common Criteria security environment?

Back 175

Security Environment defined with consideration
to the:
~ Purpose and function of the TOE
~ Environment in which the TOE operates (IT &
Non-IT)
–IT Environment
– Security services or capabilities provided by IT
systems or products that are not part of the TOE
–Non-IT Environment
– Security implemented by personnel
~ Assets to be protected
Assumptions
~ The security aspects of the environment in which the
TOE will be used or is intended to be used.
Threats
~ The ability to exploit a vulnerability by a threat agent.
Organizational Security Policies (OSPs)
~ A set of rules, procedures, practices, or guidelines
imposed by an organization upon its operations.

Front 176

What is the Common Criteria security objectives?

Back 176

Objectives establish the basis for the selection of
security requirements (functional & assurance)
Objective are completely based upon the
statement of the Security Environment
Objectives
~ Support Assumptions
~ Counter Threats (eliminate, minimize, monitor)
~ Enforce OSPs
Objectives are the “focal point” of the PP/ST

Front 177

What are Common Criteria security functional requirements?

Back 177

Levied upon functions of the TOE that
support IT security; their behavior can
generally be observed

Front 178

Name the Common Criteria security functional requirements classes

Back 178

~ Security Audit (FAU)
~ Communication (FCO)
~ Cryptographic Support (FCS)
~ User Data Protection (FDP)
~ Identification & Authentication (FIA)
~ Security Management (FMT)
~ Privacy (FPR)
~ Protection of the TOE Security Functions (FPT)
~ Resource Utilization (FRU)
~ TOE Access (FTA)
~ Trusted Path/Channels (FTP)

Front 179

How are Common Criteria security functional requirements organized?

Back 179

Class
Family
Component
Element
FIA_UID.1.1 (class_famly.component.element)

Front 180

What are the types of Common Criteria component relationships?

Back 180

~ Dependency relationship ~ other component support
(functional & assurance)
~ Hierarchy relationship ~ between components within a
class

Front 181

What are the types of Common Criteria operations on functional components?

Back 181

~ Assignment ~ “fill in the blank”
~ Selection ~ “select from a list”
~ Iteration ~ “repetitive use”
~ Refinement ~ “tailor/modify”

Front 182

What is the Common Criteria definition of assurance?

Back 182

Grounds for confidence that an IT
product or system meets its
security objectives.

Front 183

According to Common Criteria, why do we care about assurance?

Back 183

Vulnerabilities arising from …
Requirements
~ Insufficient or ineffective requirements
Construction
~ Incorrect design decisions
~ Errors in implementation
Operation
~ Inadequate controls

Front 184

Name the Common Criteria security assurance requirements classes

Back 184

TOE Assurance:
Configuration Mgt (ACM)
Delivery and Operation (ADO)
Development Docs (ADV)
Guidance Documents (AGD)
Life-Cycle Support (ALC)
Testing (ATE)
Vulnerability Assessment (AVA)
Maintenance of Assurance (AMA)
Specs Assurance:
Protection Profile Eval (APE)
Security Target Eval (ASE)

Front 185

How are Common Criteria security assurance requirements organized?

Back 185

Class
Family
Component
Element
Element Identifier
ADV_LLD.3.1(D,C,E) (class_famly.component.element(element id))

Front 186

What are the Common Criteria assurance packages?

Back 186

Basic Assurance Level ~ EAL 1 & 2
~ Limited vendor involvement
~ Functional & independent testing
Medium Assurance Level ~ EAL 3 & 4
~ Development environment controls
~ High-level design documentation
High Assurance Level ~ EAL 5, 6, & 7
~ Additional CM requirements
~ Analysis based on entire TSF implementation
~ Covert channel analysis
~ Modular and layered TOE design
~ Automated CM
~ Formal methods of functional specification & high-level design

Front 187

What NIST publication is characterized by 8 principles and 14 practices?

Back 187

NISP SP 800-14, Generally accepted Principles and Practices for Securing Information Technology Systems (GASSP)

Front 188

Name the principles of the 800-14

Back 188

1 Computer Security Supports the Mission of the Organization
2 Computer Security is an Integral Element of Sound Management
3 Computer Security Should Be Cost-Effective
4 Systems Owners Have Security Responsibilities Outside Their Own Organizations
5 Computer Security Responsibilities and Accountability Should Be Made Explicit
6 Computer Security Requires a Comprehensive and Integrated Approach
7 Computer Security Should Be Periodically Reassessed
8 Computer Security is Constrained by Societal Factors
Review pages 669-670 of the ISC2 ISSEP book

Front 189

Name the first 7 practices of the 800-14

Back 189

1. Have policies to enforce compliance with
organizational security practices
2. Managing computer security at multiple levels
administered by central oversight
3. Manage organizational risks by assessing
threats and taking steps to reduce their effects
4. Manage security by planning a system’s life
cycle
5. Implement security practices to manage
personnel
6. Prepare for contingencies and disasters
7. Deploy a security incident response system

Front 190

Name the last 7 practices of the 800-14

Back 190

8. Perform security awareness training
9. Apply security principles to all operational
aspects of the organization
10. Implement physical and environmental security
11.Enforce effective user identification and
authentication
12.Control logical access to systems
13.Maintain audit trails
14. Implement cryptography to protect sensitive data
Review pages 671 - 673 of the ISC2 ISSEP

Front 191

What are the phases of the NIST 800-37 C&A process?

Back 191

Initiation
Security Certification
Security Accreditation
Continuous Monitoring

Front 192

What are the key roles of the NIST 800-37?

Back 192

~ Authorizing Official
~ Authorizing Official Designated Representative
~ Senior Agency Information Security Officer
~ Information System Owner
~ Information System Security Officer
~ Certification Agent
~ User Representative

Front 193

According to NIST 800-37, what is role of the authorizing official?

Back 193

~ Reviews and approves the security plan for the
information system
~ Determines residual risk to agency operations or assets
based on information generated during the security
certification
~ Makes security accreditation decisions and signs
associated transmittal letter for accreditation package
(authorizing official only) [GOVT ONLY!!!]
~ Reviews security status reports from continuous
monitoring operations
~ Initiates security reaccreditation actions

Front 194

According to NIST 800-37, what is role of the Senior Agency Information Security Officer?

Back 194

~ Carrying out the Chief Information Officer responsibilities
under FISMA.
~ Possessing professional qualifications, including training and
experience, required to administer the information security
program functions;
~ Primary duty Information System Security.
~ Heading an office with the mission & resources.
~ Serve as the authorizing official's designated representative.
~ Serves as the CIO’s primary liaison to the agency’s
authorizing officials, information system owners, and
information system security officers.

Front 195

According to NIST 800-37, what is role of the Information System Owner?

Back 195

~ Represents the interests of the user community
~ Prepares security plan and conducts risk assessment
~ Informs agency officials of the need for security certification
and accreditation of the information system; ensures
appropriate resources are available
~ Provides the necessary system-related documentation to the
certification agent
~ Prepares plan of action (and milestones) to reduce or
eliminate vulnerabilities in the information system
~ Assembles final security certification package; submits to
authorizing official

Front 196

According to NIST 800-37, what is role of the Information System Security Officer?

Back 196

~ Serves as principal staff advisor to the system owner
on all matters involving the security of the information
system
~ Manages the security aspects of the information
system and, in some cases, oversees the day-to-day
security operations of the system
~ Assists the system owner in:
– Developing and enforcing security policies for the information
system
– Assembling the security certification package
– Managing and controlling changes to the information system
and assessing the security impacts of those changes

Front 197

According to NIST 800-37, what is role of the Certification Agent?

Back 197

~ Provides an independent assessment of the
security plan
~ Evaluates the security controls in the
information system to determine:
– The effectiveness of those controls in a particular
environment of operation
– The vulnerabilities in the system after the
implementation of such controls
~ Provides recommended corrective actions to
reduce or eliminate vulnerabilities in the
information system

Front 198

According to NIST 800-37, what is role of the User Representative?

Back 198

~ Represents the operational interests and
mission needs of the user community
~ Identifies mission and operational
requirements
~ Serves as the liaison for user community
throughout the life cycle of the information
system
~ Assists in the security certification and
accreditation process, when needed

Front 199

What are the tasks of the 800-37?

Back 199

Task 1: Preparation
Task 2: Notification and Resource Identification
Task 3: System Security Plan Analysis, Update, and Acceptance
Task 4: Security Control Assessment
Task 5: Security Certification Documentation
Task 6: Security Accreditation Decision
Task 7: Security Accreditation Documentation
Task 8: Configuration Management and Control
Task 9: Security Control Monitoring
Task 10: Status Reporting and Documentation

Front 200

What tasks are associated with the Initiation Phase of the 800-37?

Back 200

Task 1: Preparation
Task 2: Notification and Resource Identification
Task 3: System Security Plan Analysis, Update, and Acceptance

Front 201

What tasks are associated with the Security Certification Phase of the 800-37?

Back 201

Task 4: Security Control Assessment
Task 5: Security Certification Documentation

Front 202

What tasks are associated with the Security Accreditation Phase of the 800-37?

Back 202

Task 6: Security Accreditation Decision
Task 7: Security Accreditation Documentation

Front 203

What tasks are associated with the Continuous Monitoring Phase of the 800-37?

Back 203

Task 8: Configuration Management and Control
Task 9: Security Control Monitoring
Task 10: Status Reporting and Documentation

Front 204

What are the subtasks of Task 1 of the 800-37?

Back 204

Subtask 1.1: Information System Description
Subtask 1.2: Security Categorization
Subtask 1.3: Threat Identification
Subtask 1.4: Vulnerability Identification
Subtask 1.5: Security Control Identification
Subtask 1.6: Initial Risk Determination

Front 205

List the responsible role, reference and output of 800-37 subtask 1.1

Back 205

Information System Owner, 800-18 + 800-59, first section of the SSP

Front 206

List the responsible role, reference and output of 800-37 subtask 1.2

Back 206

Information System Owner, FIPS 199 + 800-60, security categorization report

Front 207

List the responsible role, reference and output of 800-37 subtask 1.3

Back 207

Information System Owner, 800-30 + 800-60, threat section of RAR

Front 208

List the responsible role, reference and output of 800-37 subtask 1.4

Back 208

Information System Owner, 800-30 + 800-60, vulnerability section of the RAR

Front 209

List the responsible role, reference and output of 800-37 subtask 1.5

Back 209

Information System Owner, FIPS 200 + 800-53, second section of the SSP

Front 210

List the responsible role, reference and output of 800-37 subtask 1.6

Back 210

Information System Owner, 800-30, RAR

Front 211

What are the subtasks of Task 2 of the 800-37?

Back 211

Subtask 2.1: Notification
Subtask 2.2: Planning and Resources

Front 212

List the responsible role, reference and output of 800-37 subtask 2.1

Back 212

Information System Owner, 800-37, SSP

Front 213

List the responsible role, reference and output of 800-37 subtask 2.2

Back 213

Authorizing Official
SAISO/CISO
Information System Owner
Certification Agent, 800-37, Approved SSP

Front 214

What are the subtasks of Task 3 of the 800-37?

Back 214

Subtask 3.1: Security Categorization Review
Subtask 3.2: System Security Plan Analysis
Subtask 3.3: System Security Plan Update
Subtask 3.4: System Security Plan Acceptance

Front 215

List the responsible role, reference and output of 800-37 subtask 3.1

Back 215

Authorizing Official
SAISP/CISO
Certification Agent, 800-60, Approved SecCat

Front 216

List the responsible role, reference and output of 800-37 subtask 3.2

Back 216

Authorizing Official
SAISP/CISO
Certification Agent, 800-18, Draft SSP

Front 217

List the responsible role, reference and output of subtask 3.3

Back 217

Information System Owner, 800-18, Final SSP

Front 218

List the responsible role, reference and output of 800-37 subtask 3.4

Back 218

Authorizing Official
SAISP/CISO, 800-37, Approved SSP

Front 219

What are the subtasks of Task 4 of the 800-37?

Back 219

Subtask 4.1: Documentation and Supporting Materials
Subtask 4.2: Methods and Procedures
Subtask 4.3: Security Assessment
Subtask 4.4: Security Assessment Report

Front 220

List the responsible role, reference and output of 800-37 subtask 4.1

Back 220

Information System Owner
Certification Agent, 800-37, ST&E

Front 221

List the responsible role, reference and output of 800-37 subtask 4.2

Back 221

Certification Agent, 800-53A, ST&E

Front 222

List the responsible role, reference and output of 800-37 subtask 4.3

Back 222

Certification Agent, 800-53A + 800-30, vulnerability assessment report

Front 223

List the responsible role, reference and output of 800-37 subtask 4.4

Back 223

Certification Agent, 800-53A, SAR

Front 224

What are the subtasks of Task 5 of the 800-37?

Back 224

Subtask 5.1: Findings and Recommendations
Subtask 5.2: System Security Plan Update
Subtask 5.3: Plan of Action and Milestones Preparation
Subtask 5.4: Accreditation Package Assembly

Front 225

List the responsible role, reference and output of 800-37 subtask 5.1

Back 225

Certification Agent, 800-53A, SAR

Front 226

List the responsible role, reference and output of 800-37 subtask 5.2

Back 226

Information System Owner, 800-18, SSP

Front 227

List the responsible role, reference and output of 800-37 subtask 5.3

Back 227

Information System Owner, OMB M02-01, POA&M

Front 228

List the responsible role, reference and output of 800-37 subtask 5.4

Back 228

Information System Owner, 800-37 + OMB M02-01, SAR + SSP + POA&M

Front 229

What are the subtasks of Task 6 of the 800-37?

Back 229

Subtask 6.1: Final Risk Determination
Subtask 6.2: Risk Acceptability

Front 230

List the responsible role, reference and output of 800-37 subtask 6.1

Back 230

Authorizing Official, 800-37, Questions

Front 231

List the responsible role, reference and output of 800-37 subtask 6.2

Back 231

Authorizing Official, 800-37, AO ATO Decision Letter

Front 232

What are the subtasks of Task 7 of the 800-37?

Back 232

Subtask 7.1: Security Accreditation Package Transmission
Subtask 7.2: System Security Plan Update

Front 233

List the responsible role, reference and output of 800-37 subtask 7.1

Back 233

Authorizing Official, 800-37, Security Accreditation Package

Front 234

List the responsible role, reference and output of 800-37 subtask 7.2

Back 234

Information System Owner, 800-37, Updated SSP and POA&M

Front 235

What are the subtasks of Task 8 of the 800-37?

Back 235

Subtask 8.1: Documentation of Information System Changes
Subtask 8.2: Security Impact Analysis

Front 236

List the responsible role, reference and output of 800-37 subtask 8.1

Back 236

Information System Owner, 800-37, Change requests

Front 237

List the responsible role, reference and output of 800-37 subtask 8.2

Back 237

Information System Owner, 800-30, Change approvals

Front 238

What are the subtasks of Task 9 of the 800-37?

Back 238

Subtask 9.1: Security Control Selection
Subtask 9.2: Selected Security Control Assessment

Front 239

List the responsible role, reference and output of 800-37 subtask 9.1

Back 239

Information System Owner, 800-53A, Continuous monitoring plan

Front 240

List the responsible role, reference and output of 800-37 subtask 9.2

Back 240

Information System Owner, 800-53A, Continuous monitoring reports

Front 241

What are the subtasks of Task 10 of the 800-37?

Back 241

Subtask 10.1: System Security Plan Update
Subtask 10.2: Plan of Action and Milestones Update
Subtask 10.3: Status Reporting

Front 242

List the responsible role, reference and output of 800-37 subtask 10.1

Back 242

Information System Owner, 800-18 + 800-37, Updated SSP

Front 243

List the responsible role, reference and output of 800-37 subtask 10.2

Back 243

Information System Owner, OMB M02-01, Updated POA&M

Front 244

List the responsible role, reference and output of 800-37 subtask 10.3

Back 244

Information System Owner, 800-37, System security status report to AO

Front 245

According to the IATF, how is IA implemented in the system life cycle?

Back 245

System Life Cycle is a process by which systems are
developed, from pre-concept to deployment and disposal
IA objectives are to achieve levels of confidentiality, integrity
and availability commensurate with the type and value of
data, mission requirements, support organization, etc.
The processes:
~ Generally Accepted System Security Principles (GASSP)
~ Security in the System Life Cycle (SLC)
~ Common IT Security Practices
~ NIST Engineering Principles
~ ISSE, CMM, and IATF

Front 246

List the first 7 NIST Engineering Principles

Back 246

1. Establish a sound security policy as the
“foundation” for design
2. Treat security as an integral part of the overall
design
3. Clearly delineate the physical and logical security
boundaries governed by associated security
policies
4. Reduce risk to an acceptable level
5. Assume that external systems are insecure
6. Identify potential trade-offs between reducing risk
and increased costs and decrease in other aspects
of operational effectiveness
7. Ensure no single point of vulnerability

Front 247

List NIST engineering principles 8 -14

Back 247

8. Implement tailored system security measures to
meet organizational security goals
9. Strive for simplicity
10.Design and operate an IT system to limit
vulnerability and to be resilient in response
11.Minimize the system elements to be trusted
12.Implement security through a combination of
measures distributed physically and logically
13.Provide assurance that the system is, and
continues to be, resilient in the face of expected
threats
14.Limit or contain vulnerabilities

Front 248

List NIST engineering principles 15-20

Back 248

15.Formulate security measures to address multiple
overlapping information domains
16.Isolate public access systems from mission
critical resources
17.Use boundary mechanisms to separate
computing systems and network infrastructures
18.Where possible, base security on open
standards for portability and interoperability
19.Use common language in developing security
requirements
20.Design and implement audit mechanisms to
detect authorized use and to support incident
investigations

Front 249

List NIST engineering principles 21-27

Back 249

21.Design security to allow for regular adoption of
new technology, including a secure and logical
technology upgrade process
22.Authenticate users and processes to ensure
appropriate access control decisions both within
and across domains
23.Use unique identities to ensure accountability
24.Implement least privilege
25.Do not implement unnecessary security
mechanisms
26.Protect data during all the transaction’s phases
27.Strive for operational ease of use

Front 250

List NIST engineering principles 28-33

Back 250

28.Develop and exercise contingency or disaster
recovery procedures to ensure appropriate
availability
29.Consider custom products to achieve adequate
security
30.Ensure security in the shutdown or disposal of a
system
31.Protect against all likely classes of “attacks”
32.Identify and prevent common errors and
vulnerabilities
33.Ensure that developers are trained to develop
secure software

Front 251

Name the 3 IATF key principles

Back 251

1 Always keep Problem and Solution spaces
separate.
~ Problem Space: desired end-product functionality
~ Solution Space: how that functionality will be provided
2 Customer’s mission/business needs defines
Problem.
~ Includes mission, compliance requirements, constraints...
~ Takes into account threats, risks, operational efficiencies...
3 SE and SSE collaborate to define the Solution,
which is driven by the Problem space.
~ Must satisfy operational as well as security requirements
~ Must include trade-offs and flexibility to assure mission
success

Front 252

What are the DODAF architecture views?

Back 252

All view (AV)
Operational view (OV)
Systems view (SV)
Technical view (TV)

Front 253

What does the DODAF OV convey?

Back 253

Information flows
Indentifies what needs to be accomplished and who does it

Front 254

What does the DODAF SV convey?

Back 254

systems and interconnections
Relates systems and characteristics to operational needs

Front 255

What does the DODAF TV convey?

Back 255

rules governing the arrangements, interactions and interdependence of system parts or elements
Prescribes standards and conventions

Front 256

What are the 6 fundamental steps DODAF calls for when building and architecture?

Back 256

1 - Determine the intended use of the architecture
2 - Determine scope of architecture
3 - Determine characteristics to be captured
4 - Determine views and products to be built
5 - Gather data and build the requisite products
6 - Use architecture for intended purpose

Front 257

What is the ISSE process definition?

Back 257

Discovering users’ requirements and designing systems
that meet the requirements effectively and securely

Front 258

What are the 6 elements of the systems engineering process?

Back 258

Discover Needs
Refine Requirements
Design Architecture
Detailed Design
Implement System
Assess Effectiveness

Front 259

What are the 6 elements of the systems security engineering process?

Back 259

Discover system protection needs
Define system security requirements
Design system security architecture
Develop detailed security design
Implement system security
Assess system security effectiveness

Front 260

What is the Information Assurance Technology Framework?

Back 260

Provides an integrated process (involving technical
and non-technical aspects) for developing and
deploying IT systems with intrinsic and appropriate
security measures in order to meet the organization’s
mission.
It defines the requirements for the TCB hardware,
software, and firmware, and applies the processes to
achieve a layered protection architectural strategy
known as “Defense in Depth”, to defend the:
~ Computing Environment
~ Enclave Boundary
~ Network and Infrastructure
~ Supporting Infrastructures

Front 261

What 3 areas does the IATF technical process focus on?

Back 261

~ People - those authorized to perform to work
~ Technology – the tools and technologies used
~ Operations – the processes and activities

Front 262

What is the goal of IATF?

Back 262

“Defense in Depth” implementation

Front 263

What are the principles of defense in depth?

Back 263

Defense in multiple places: to protect against internal and
external threats
Layered defenses: to ensure adversaries must negotiate
multiple impediments to gain access and achieve attack
goals
Security robustness: the assurance and relative strength
of the security component against anticipated threats
Deploy KMI/PKI: deployment of robust key management
infrastructures and PKI technologies
Deploy intrusion detection systems: use of IDS and
similar technologies to detect intrusions, evaluate information
and results, and take or support taking action.

Front 264

What is the technology goal of defense in depth?

Back 264

Appropriate tools and technologies must be
acquired and applied prudently to achieve program
goals:
~ Security policy and principles
~ IA architectures and standards
~ IA Architecture framework areas
~ Specification criteria for product selection
~ IA criteria (security, interoperability, and PKI)
~ Acquisition and integration of evaluated products
~ System risk assessments

Front 265

What are the focus areas of defense in depth?

Back 265

Defend the computing environment
~ Clients, servers, applications, and other AIS
components
Defend the enclave boundaries
~ A collection of AIS under single authority/policy
~ Assume highest mission assurance category
Defend the networks & infrastructure
~ Networks and support systems providing
interconnection between locations or enclaves
Defend the supporting infrastructures
~ Defense with KMI/PKI with detect-response capability
(IDS/IPS/IDP)

Front 266

What does defense in depth seek to protect?

Back 266

~ People
~ Technology
~ Operations

Front 267

What must management commit to for defense in depth to work?

Back 267

Management must demonstrate its commitment
to achieving success in IA programs through
~ Policies and procedures
~ Roles and Responsibilities
~ Commitment of resources
~ Training and awareness
~ Physical security and countermeasures
~ Personnel security programs and controls
~ Personal accountability
~ Sanctions and penalties

Front 268

What must be performed to make defense in depth work for operations?

Back 268

The activities required to perform and maintain the
effective security posture are daily, and include
~ Visible and enforced current security policy
~ Certification and accreditation
~ Readiness assessments
~ Security assessments
~ Infrastructure protection
~ Security management
~ Key management
~ Monitoring and reacting to threats
~ Attack sensing and warning response
~ Recovery and reconstitution

Front 269

What is the general approach to defense in depth?

Back 269

~ Conduct risk assessments.
~ Deploy cost-effective, risk-based security.
~ Use commercial off-the-shelf (COTS) products.
~ Education, training, and awareness.
~ Continuous monitoring.
~ Employ multiple means of threat mitigation.
~ Implement a robust IA posture to cope with the
unexpected.
~ Only trustworthy personnel have access.
~ Have effective incident response plan.

Front 270

What is a countermeasure?

Back 270

A targeted control [response] to a single threat

Front 271

What are the 3 categories of information according to IATF?

Back 271

Public
Private
Classified

Front 272

What is the IATF definition of an information system?

Back 272

An “Information System”:
~ Also referred to as: Automated Information System
(AIS), Information Technology System
~ “Any equipment or interconnected system or subsystem
of equipment that is used in the automatic acquisition,
storage, manipulation, management, movement,
control, display, switching, interchange, transmission or
reception of data and includes computer software,
firmware, and hardware.”

Front 273

What is the IATF definition of a security engineer?

Back 273

“A Security Engineer, through engineering
discipline and process, helps build
dependable systems in the face of malice,
error, or mischance.”
“As a discipline, it focuses on tools,
processes, and methods needed to design,
implement, and test complete systems, and to
adapt existing systems as their environment
evolves.”

Front 274

What is the IATF definition of a threat?

Back 274

The likelihood that the impact of an unwanted
incident will be realized

Front 275

What is the IATF definition of a vulnerability?

Back 275

An inherent or intrinsic flaw or weakness in a
system, its subsets, or components (hardware,
software, or firmware) that can be exploited by a
threat

Front 276

What is the IATF definition of impact?

Back 276

An adverse operational impairment or loss caused by the
materialization of a threat

Front 277

What is the IATF definition of risk?

Back 277

The quantification of a) probability that a threat will
materialize and cause impact, or b) the estimate of
potential financial loss (exposure) an organizational unit
might experience in a scenario

Front 278

What is the IATF definition of trust?

Back 278

~ All protection mechanisms work cohesively to process
sensitive data for all authorized users and maintain the
required level of protection
~ Consistent enforcement of policy through all states

Front 279

What is the IATF definition of assurance?

Back 279

~ Degree of confidence that the system will act in a
correct and predictable manner in all possible
computing situations
~ Known inputs produce expected results through all
states

Front 280

What is the engineering definition of a system?

Back 280

a combination of elements designed to
function as a unit to perform a function

Front 281

What is the engineering definition of a structure?

Back 281

formulation of systems or processes
to perform a function or achieve an objective

Front 282

What is the engineering definition of a function?

Back 282

a description of work that a system
must perform to meet customer requirements

Front 283

What is the engineering definition of a purpose?

Back 283

knowledge used to perform a function

Front 284

Study slide 199

Back 284

Study slide 199

Front 285

Study slide 200

Back 285

Study slide 200

Front 286

What is the equation for an instance of risk?

Back 286

instance = threat x vulnerability x impact

Front 287

What are the parts of the NSTISSI-4009 Risk Management Cycle?

Back 287

~ Identify and value assets in context
~ Assess the risk/threat environment
~ Develop Risk Management Plan
~ Implement Risk Management Actions
~ Monitor to ensure continued correct
performance and operation
~ Periodically re-evaluate the risk
environment and act as required

Front 288

What are the risk management actions of Phase 1 of the SLC?

Back 288

Phase 1 (Initiation) – Identified risks are used to support the
development of the system requirements, including
security requirements, and a security concept of operations
(strategy)

Front 289

What are the risk management actions of Phase 2 of the SLC?

Back 289

Phase 2 (Development/Acquisition) – The risks identified
during this phase can be used to support the security
analyses of the IT system that may lead to architecture and
design tradeoffs during system development

Front 290

What are the risk management actions of Phase 3 of the SLC?

Back 290

Phase 3 (Implementation) – The risk management process
supports the assessment of the system implementation
against its requirements and within its modeled operational
environment. Decisions regarding risks identified must be
made prior to system operation

Front 291

What are the risk management actions of Phase 4 of the SLC?

Back 291

Phase 4 (Operation/Maintenance) – Risk management
activities are performed for periodic system
reauthorization (or reaccreditation) or whenever major
changes are made to an IT system in its operational,
production environment (i.e., new system interfaces)

Front 292

What are the risk management actions of Phase 5 of the SLC?

Back 292

Phase 5 (Disposal) – Risk management activities are
performed for system components that will be disposed of
or replaced to ensure that the hardware and software are
properly disposed of, that residual data is appropriately
handled, and that system migration is conducted in a
secure and systematic manner

Front 293

What are the inputs to step 1 of the SP 800-30 Risk Assessment Activities?

Back 293

~ Hardware
~ Software
~ Systems interfaces
~ Data and information
~ People
~ Systems mission

Front 294

What are the inputs to step 2 of the SP 800-30 Risk Assessment Activities?

Back 294

~ History of system attack
~ Data from intelligence agencies, NIPC, OIG, FedCIRC, mass media

Front 295

What are the inputs to step 3 of the SP 800-30 Risk Assessment Activities?

Back 295

~ Reports from prior risk assessments
~ Any audit comments
~ Security requirements
~ Security test results

Front 296

What are the inputs to step 4 of the SP 800-30 Risk Assessment Activities?

Back 296

~ Current controls
~ Planned controls

Front 297

What are the inputs to step 5 of the SP 800-30 Risk Assessment Activities?

Back 297

~ Threat-source motivation
~ Threat capacity
~ Nature of vulnerability
~ Current controls

Front 298

What are the inputs to step 6 of the SP 800-30 Risk Assessment Activities?

Back 298

~ Mission impact analysis
~ Asset criticality assessment
~ Data criticality
~ Data Sensitivity

Front 299

What are the inputs to step 7 of the SP 800-30 Risk Assessment Activities?

Back 299

~ Likelihood of threat exploitation
~ Magnitude of impact
~Adequacy of planned or current controls

Front 300

What are the outputs to step 1 of the SP 800-30 Risk Assessment Activities?

Back 300

~ System boundary
~ System functions
~ System and data criticality
~ System and data sensitivity

Front 301

What are the outputs to step 2 of the SP 800-30 Risk Assessment Activities?

Back 301

~ Threat statement

Front 302

What are the outputs to step 3 of the SP 800-30 Risk Assessment Activities?

Back 302

~ List of potential vulnerabilities

Front 303

What are the outputs to step 4 of the SP 800-30 Risk Assessment Activities?

Back 303

~ List of current and planned controls

Front 304

What are the outputs to step 5 of the SP 800-30 Risk Assessment Activities?

Back 304

Likelihood rating

Front 305

What are the outputs to step 6 of the SP 800-30 Risk Assessment Activities?

Back 305

Impact rating

Front 306

What are the outputs to step 7 of the SP 800-30 Risk Assessment Activities?

Back 306

Risks and associated risk levels

Front 307

What are the outputs to step 8 of the SP 800-30 Risk Assessment Activities?

Back 307

Recommended controls

Front 308

What are the outputs to step 9 of the SP 800-30 Risk Assessment Activities?

Back 308

Risk Assessment Report

Front 309

What is the DoD 500.2-R definition of Systems Engineering?

Back 309

The systems engineering process shall:
~ Transform approved operational requirements into an
integrated system design solution through concurrent
consideration of all life-cycle needs
~ Ensure the integration of all operational, functional, and
physical interfaces, and that system definition and
design reflect the requirements for all system elements
~ Characterize and manage technical risks
~ Apply engineering principles to identify security
vulnerabilities and contain information assurance as
well as enforce protection risks associated with these
vulnerabilities

Front 310

What is security engineering?

Back 310

It is the application of traditional
systems engineering processes to the specific
problems and issues regarding assurance and
security of systems and information.

Front 311

What are the goals of security engineering?

Back 311

~ Understand Security Risks
~ Establish Security Needs
~ Develop Security Guidance
~ Determine Acceptable Risks
~ Establish Assurance

Front 312

Who practices security engineering?

Back 312

~ Developers
~ Product vendors
~ Integrators
~ Buyers
~ Security evaluation organizations
~ System administrators
~ Consulting/service organizations

Front 313

When is security engineering practiced?

Back 313

throughout all phases of the SDLC

Front 314

What activities should be included/considered in security engineering?

Back 314

Operations Security
Information Security
Network Security
Physical Security
Personnel Security
Administrative Security
Communications Security
Emanations Security
Computer Security

Front 315

What are the system lifecycle phases of IEEE-1220?

Back 315

1. Development: the initial phases of planning and executing system
definition tasks required to meet the evolving customer need
2. Manufacturing: the activities necessary to produce models and
prototypes to demonstrate the planned design functionality
3. Test: performance validation of prototype or the pre-commission
version of the produced solution to measure customer satisfaction
4. Distribution: delivery and commissioning of the produced solution
in the planned operational environment(s)
5. Operations: the produced solution performing as
intended/expected
6. Support: sustaining maintenance of the produced solution
7. Training: all tasks, tools, and technologies employed to prepare
and sustain human knowledge and proficiency in the produced
solution
8. Disposal: the disposal, retirement, or recycling of the original
produced solution in a secure and environmental sound manner

Front 316

What is the goal of activity 1 of the IATF ISSE process?

Back 316

Discover Information Protection Needs
Ascertain why the system needs to be built – what
needs the system must fulfill.

Front 317

What is the goal of activity 2 of the IATF ISSE process?

Back 317

Define System Security Requirements
Define the system in terms of what the system
needs to be able to do.

Front 318

What is the goal of activity 3 of the IATF ISSE process?

Back 318

Define System Security Architecture
Use previously documented information to choose
the types of security components that will perform
specific security function. This process is the core
of designing the security architecture.

Front 319

What is the goal of activity 4 of the IATF ISSE process?

Back 319

Develop Detailed Security Design
Based on the security architecture, begin to design the system to
be able to do what it needs to.

Front 320

What is the goal of activity 5 of the IATF ISSE process?

Back 320

Implement System Security
Build/Implement the system so it does what it is
suppose to do.

Front 321

What is the goal of activity 6 of the IATF ISSE process?

Back 321

Assess Security Protection Effectiveness
Assess the degree to which the system, as it is
defined, designed, and implemented, meets the
needs. This assessment activity occurs during and
with all the other activities in the ISSE process.

Front 322

What is the goal of activity 7 & 8 of the IATF ISSE process?

Back 322

Plan and Manage Technical Effort
~ Planning the technical effort occurs throughout the
ISSE process.
~ ISSE must review each of the following areas to
scope support to the customer in conjunction with
the other activities.
~ Requires a unique skill set, and is likely to be
assigned to senior-level personnel.

Front 323

List the tasks and subtasks of IATF ISSE Activity 1

Back 323

Task - 01.1 Analyze organizations mission
Task - 01.2 Determine relationship and importance of information to mission
Task - 01.3 Identify legal and regulatory requirements
Task - 01.4 Identify classes of threats
Task - 01.5 Determine impacts
Task - 01.6 Identify security services
Task - 01.7 Document the information protection needs
Task - 01.8 Document security management roles and responsibilities
Task - 01.9 Identify design constraints
Task - 01.10 Assess information protection effectiveness
Subtask - 01.10.1 Provide/present documented information protection needs to the customer
Subtask - 01.10.2 Obtain concurrence from the customer in the information protection needs
Task - 01.11 Support system C&A
Subtask - 01.11.1 Identify DAA/Accreditor
Subtask - 01.11.2 Identify Cert Authority/Certifier
Subtask - 01.11.3 Identify C&A and acquisition processes to be applied
Subtask - 01.11.4 Ensure accreditors and certifiers concurrence in the information protection needs

Front 324

List the tasks and subtasks of IATF ISSE Activity 7

Back 324

Task - 07.1 Estimate the project scope
Task - 07.2 Identify resources and availability
Task - 07.3 Identify roles and responsibilities
Task - 07.4 Estimate project costs
Task - 07.5 Develop project schedule
Task - 07.6 Identify technical activities
Task - 07.7 Identify deliverables
Task - 07.8 Define management interfaces
Task - 07.9 Prepare technical management plan
Task - 07.10 Review project plan
Task - 07.11 Obtain customer agreement

Front 325

List the tasks and subtasks of IATF ISSE Activity 8

Back 325

Task - 08.1 Direct technical effort
Task - 08.2 Track project resources
Task - 08.3 Track technical parameters
Task - 08.4 Monitor progress of technical activities
Task - 08.5 Ensure quality of deliverables
Task - 08.6 Manage configuration elements
Task - 08.7 Review project performance
Task - 08.8 Report project status

Front 326

What are the ISSE duties during Initiation?

Back 326

The need for a system is expressed and the purpose
of the system is documented:
~ Discover information protection needs
~ Define system security requirements
~ Categorize/characterize the system (as intended in final
form)
~ Conduct a Sensitivity Assessment
~ Prepare a Security Plan (initial very general working plan)
~ Initiate Risk Assessment activities
All items are documented and become part of the
system history and build baseline documentation.

Front 327

What tasks must the ISSE complete while Discovering Information Protection Needs?

Back 327

~ Develop an understanding of the customer’s mission or
business
~ Help the customer determine what information
management is needed to support the mission or
business
~ Create a model of that information management, with
customer concurrence
~ Document the results as the basis for defining
information systems that will satisfy the customer’s
needs

Front 328

What are the key documents/components produced when discovering information protection needs?

Back 328

Business/Mission
~ Mission Needs Statement (MNS)
~ Concept of Operations (CONOPS)
Information Management Model (IMM)
~ Users or members
~ Rules, privileges, roles, and responsibilities
~ Information objects being managed
Information Protection Policy (IPP)
~ Protection needs that support Mission/Business
~ Security service requirements

Front 329

What constitutes the requirements baseline?

Back 329

To determine the customer’s needs:
~ Define the mission need
~ Define the information management to create an
Information Management Model (IMM)
~ Define the Information Protection Policy (IPP)
Results become the basis for creating an Information
Management Policy that meets the customer’s needs

Front 330

What is Harm To Information (HTI)?

Back 330

considers the value of
the information and the degree of harm to the
mission if the information were disclosed, modified,
destroyed, or unavailable when needed

Front 331

What are Potentially Harmful Events (PHE)?

Back 331

considers the
existence of malicious adversaries, their degree of
motivation, and the potential for accidents and
natural disasters

Front 332

What is an Information Management Policy?

Back 332

The ISSEP documents:
~ Information threats
~ Security services and priorities
~ Roles and responsibilities
Information Protection Policy
(IPP) basis for IMP
Information Management
Policy (IMP)
~ Information Flow
~ Access and Privileges

Front 333

What are the parts of the requirements hierarchy?

Back 333

~ Business Mission
~ Functions
~ Architecture
~ Components
~ Design
~ Specifications
~ Implementation

Front 334

List the parts of the requirements hierarch from most abstract to most specific.

Back 334

~ Business Mission
~ Functions
~ Architecture
~ Components
~ Design
~ Specifications
~ Implementation

Front 335

What are the ISSE duties during Development or Acquisition phase?

Back 335

The system is designed, purchased, programmed,
developed, or otherwise constructed
~ Design system security architecture
~ Develop detailed security design
~ Incorporate Security Requirements Into Specifications
~ Make-Buy decisions are made:
– Procurement (component or turn-key)
– Program
– Build
All items are documented and become part of the system history
and build baseline documentation. Previously recorded items
are updated or replaced as required to ensure accuracy.

Front 336

What tasks must the ISSE complete while defining system security requirements?

Back 336

The ISSEP defines a solution set that satisfies
the information protection needs of the IPP
A solution set consists of:
~ The System Context
~ A Concept of Operations (CONOPS)
~ The System Requirements

Front 337

What are the ISSE duties during the Implementation phase?

Back 337

The system is tested and installed or fielded
~ Install and configure selected controls and
countermeasures
~ Enable and test all controls required in the design
documentation
~ Verification and validation of controls functionality
~ Security Testing
All items are documented and become part of the system
history and build baseline documentation. Previously
recorded items are refined, updated or replaced as
required to ensure accuracy.
~ Design system security architecture

Front 338

What tasks must the ISSE complete while designing system security architecture?

Back 338

~ Performs functional analysis of potential architectures
to meet requirements from Step 2
~ Allocates security services
~ Selects security mechanisms
~ Identifies elements of the system to be protected
~ Allocates security functions to those elements
~ Describes the relationships between the elements

Front 339

What tasks must be performed as part of the detailed design?

Back 339

~ Design must satisfy customer-specified design
constraints and the security requirements
~ Design should project the schedule and cost of
long-lead items and life-cycle support
~ Design should be under configuration control
~ Design should include a revised security
CONOPS
~ Trade-offs must consider priorities, cost, schedule,
performance, and residual security risks
~ Failures to satisfy security requirements must be
reported to C&A authorities

Front 340

What tasks must the ISSE complete when developing a detailed security design?

Back 340

~ Allocating security mechanisms to system security
design elements
~ Identifying candidate products
~ Qualifying element and system interfaces
~ Developing system specifications

Front 341

When does the Operations & Maintenance phase official being?

Back 341

When the AO signs and issues the ATO

Front 342

What are the ISSE duties during the Operation & Maintenance phase?

Back 342

The system is being modified by the addition or
removal of components, features, or changes in
them:
~ Security Operations and Administration
~ Operational Assurance and measurement
~ Audits and Monitoring and subsequent corrective actions
~ Assessment of controls effectiveness
~ Configuration and change management
All items are documented and become part of the system
history and operational baseline documentation. Previously
recorded items are updated or replaced as required to ensure
accuracy.

Front 343

What factors should be considered when selecting components?

Back 343

~ Current and future availability
~ Cost
~ Form factor
~ Reliability
~ Potential risk to system due to component failure
~ Conformance to design specifications
~ Compatibility with existing components
~ Satisfying evaluation criteria

Front 344

What tasks must the ISSE complete during implementation?

Back 344

~ Provides inputs to C&A process activities
~ Reviews evolving system life cycle support plans
~ Reviews operational procedures for users
~ Reviews maintenance training for administrators
~ Assesses information protection measures in
preparation for the final system effectiveness
assessment

Front 345

What tasks must the ISSE complete testing?

Back 345

~ Participation in the testing of protection mechanisms
and functions
~ Verification that the system implementation does
protect against the threats identified in the original
threat assessment
~ Application information protection assurance
mechanisms related to system implementation and
testing practices
~ Continuing risk management
~ Supporting the C&A processes

Front 346

What tasks must the ISSE complete during the disposal phase?

Back 346

This involves the final disposition of data,
hardware, and software
~ Information archiving
~ Data transferral to new operational environment
~ Media Sanitization
~ Retirement or destruction
~ Recycling
All items are documented and become part of the system
history and operational baseline documentation. Previously
recorded items are updated or replaced as required to
ensure accuracy.

Front 347

Why use the CMM approach?

Back 347

Accepted way of defining practices and improving
capability
Increasing use in acquisition as an indicator of
capability
ROI for software indicates success

Front 348

Why was the SSE-CMM developed?

Back 348

Objective:
~ advance security engineering as a defined,
mature, and measurable discipline
Project Goal:
~ Develop a mechanism to enable:
– selection of appropriately qualified security
engineering providers
– focused investments in security engineering
practices
– capability-based assurance

Front 349

List the organizational capability measures?

Back 349

~ Level 1 (Performed Informally)
1.1 Base Practices are Performed
~ Level 2 (Planned and Tracked)
2.1 Planning Performance
2.2 Disciplined Performance
2.3 Verifying Performance
2.4 Tracking Performance
~ Level 3 (Well-Defined)
3.1 Defining a Standard Process
3.2 Perform the Defined Process
3.3 Coordinate the Process
~ Level 4 (Quantitatively Controlled)
4.1 Establishing Measurable Quality Goals
4.2 Objectively Managing Performance
~ Level 5 (Continuously Improving)
5.1 Improving Organizational Capability
5.2 Improving Process Effectiveness

Front 350

How does the SSE-CMM define best practices at the domain level?

Back 350

~ process areas
~ base practices

Front 351

How does the SSE-CMM define best practices at the organizational capability level?

Back 351

~ implementation of process areas
~ institutionalization of process areas

Front 352

What are the SSE-CMM process categories?

Back 352

Engineering processes
Project processes
Organizational Processes

Front 353

What are the SSE-CMM organizational process areas?

Back 353

~ Define Organization’s Security Engineering Process
~ Improve Organization’s Security Engineering
Process
~ Manage Security Product Line Evolution
~ Manage Security Engineering Support Environment
~ Provide Ongoing Skills and Knowledge
~ Coordinate with Suppliers

Front 354

What are the SSE-CMM project process areas?

Back 354

~ Ensure Quality
~ Manage Configurations
~ Manage Program Risk
~ Monitor and Control Technical Effort
~ Plan Technical Effort

Front 355

What are the SSE-CMM engineering technical "base" process areas?

Back 355

PA01 – Administer Security Controls
PA02 – Assess Security Impacts
PA03 – Assess Security Risk (to CIA and other information assets)
PA04 – Assess Threat
PA05 – Assess Vulnerability
PA06 – Build Assurance Argument
PA07 – Coordinate Security
PA08 – Monitor Security Posture
PA09 – Provide Security Input
PA10 – Specify Security Needs
PA11 – Verify and Validate Security

Front 356

What are the classes of attacks?

Back 356

~ Passive attacks can result in the disclosure of data to an
attacker without the knowledge of the user
~ Active attacks include attempts to circumvent protection
features to execute a deliberate attack
~ Close-in attacks occur when an attacker is in physical
close proximity to resources to launch an attack
~ Insider attacks can be malicious or non-malicious:
– Malicious insiders intend to deliberately attack an asset
– Non-malicious attacks typically result from lack of knowledge
~ Distribution attacks focus on the malicious modification
of resources during production or distribution

Front 357

What is the first line of defense for a passive attack?

Back 357

Link and network layer and
encryption and traffic flow
security

Front 358

What is the first line of defense for a active attack?

Back 358

Defend the enclave
boundaries

Front 359

What is the first line of defense for a insider attack?

Back 359

Physical and personnel
security

Front 360

What is the first line of defense for a close-in attack?

Back 360

Physical and personnel
security

Front 361

What is the first line of defense for a distribution attack?

Back 361

Trusted software development
and distribution

Front 362

What is the second line of defense for a passive attack?

Back 362

Security-enabled
applications

Front 363

What is the second line of defense for a active attack?

Back 363

Defend the computing
environment

Front 364

What is the second line of defense for a insider attack?

Back 364

Authenticated access
controls, audit

Front 365

What is the second line of defense for a close-in attack?

Back 365

Technical surveillance
countermeasures

Front 366

What is the second line of defense for a distribution attack?

Back 366

Run time integrity
controls

Front 367

What is the major goal of C&A?

Back 367

Enabling more consistent, comparable, and
repeatable assessments of security controls in federal
information systems

Front 368

What are the objectives of C&A?

Back 368

To achieve more secure information systems
within the federal government by:
~ Enabling more consistent, comparable, and
repeatable assessments of security controls in federal
information systems
~ Promoting a better understanding of agency-related
mission risks resulting from the operation of information
systems
~ Creating more complete, reliable, and trustworthy
information for authorizing officials in order to facilitate
more informed accreditation decisions

Front 369

What is the NSTISSI 4009 definition of Certification?

Back 369

“The comprehensive evaluation of the technical
and non-technical security features of an AIS and
other safeguards, made in support of the
accreditation process, to establish the extent to
which a particular design and implementation
meets a specified set of security requirements.”

Front 370

What are the characteristics of certification?

Back 370

Formal process for testing systems against a set of
security requirements
Performed by an independent reviewer instead of
someone who was involved with building or
operating the system
The amount of rigor employed may vary depending
on the system level or operational context.

Front 371

What is accreditation?

Back 371

The decision given by the designated senior agency
official to authorize operation of an information
system:
~ In a particular security mode
~ Using a prescribed set of controls
~ Against a defined threat
~ At an acceptable level of risk
~ For a specific period of time
The official explicitly accepts the risk to agency
assets based on the implementation of these
security conditions.
[remember the phrase "and the nation"]

Front 372

What is the NSTISSI 4009 definition of Accreditation?

Back 372

“A formal declaration by the DAA that an AIS is
approved to operate in a particular security mode
using a prescribed set of safeguards.”

Front 373

What are the significant benefits of C&A?

Back 373

More consistent, comparable, and repeatable
security evaluations
More complete, reliable technical information for
information system accreditation authorities, leading
to better understanding of complex systems and
associated risks and vulnerabilities
Greater availability of competent certification
services for customers
Assessments by accredited organizations can
form the basis for cyber insurance policy decisions

Front 374

What is the NSTISSI 4009 definition of an Automated Information System (AIS)?

Back 374

“Any equipment or interconnected system or
subsystem of equipment used in the automatic
acquisition, storage, manipulation, management,
movement, control, display, switching, interchange,
transmission or reception of data and includes
computer software, firmware, and hardware.”

Front 375

What is Information Assurance?

Back 375

Measures that protect and defend information and
information systems by ensuring their
availability, integrity, confidentiality,
authentication and non-repudiation.
This includes providing for restoration of information
systems by incorporating the following capabilities:
protection,
detection, and
reaction.

Front 376

What is Availability?

Back 376

Timely, reliable access to data and information services for
authorized users.

Front 377

What is Integrity?

Back 377

Quality of an IS reflecting the logical correctness and
reliability of the operating system; the logical completeness
of the hardware and software implementing the protection
mechanisms; and the consistency of the data structures and
occurrence of the stored data.

Front 378

What is confidentiality?

Back 378

Assurance that information is not disclosed to unauthorized
individuals, processes, or devices.

Front 379

What is Access Control?

Back 379

Limiting access to information system resources only to
authorized users, programs, processes, or other systems.

Front 380

What is Authentication?

Back 380

Security measure designed to establish the validity of a
transmission, message, or originator, or a means of verifying
an individual's authorization to receive specific categories of
information.

Front 381

What is Non-Repudiation?

Back 381

Assurance the sender of data is provided with proof of
delivery and the recipient is provided with proof of the
sender's identity, so neither can later deny having processed
the data.

Front 382

What are the accreditation options?

Back 382

1 - System: accreditation evaluates a major system
application or a clearly defined independent
system.
2 - Type: accreditation evaluates a common application
or system that is distributed to a number of
different locations.
3 - Site: accreditation evaluates applications and
systems at a specific, self-contained location.

Front 383

What are C&A artifacts?

Back 383

System policies, documentation, plans, test
procedures, test results, and other evidence that
express or enforce the information assurance (IA)
posture of the DoD IS, make up the certification and
accreditation (C&A) information, and provide evidence
of compliance with the assigned IA controls.

Front 384

What is C&A from the DoD's perspective?

Back 384

The standard DoD approach for:
~ identifying information security
requirements,
~ providing security solutions, and
~ managing the security of DoD
information systems.

Front 385

What are the general steps of the C&A process?

Back 385

~ Define problem
~ Risk assessment
~ Implement controls
~ Certification
~ Accreditation
~ Ops/maintenance
~ Disposal

Front 386

What Acts support C&A?

Back 386

Privacy Act of 1974
Computer Security Act of 1987
Clinger-Cohen Act of 1996
~ Information Technology Management Reform Act
~ Defines National Security Systems
NIST SP800-59

Front 387

What Government document requires C&A?

Back 387

OMB Circular A-130
~ Management of Federal Information Resources,
Appendix III, December 24, 1985
~ Mandatory implementation of Computer Security Act
and FISMA requirements – 3-year reviews
~ Defines "adequate security"

Front 388

What is "adequate security"?

Back 388

“security commensurate with the risk and magnitude of the
harm resulting from the loss, misuse, or unauthorized access to
or modification of information.…provide appropriate
confidentiality, integrity, and availability, through the use of cost effective
management, personnel, operational, and technical
controls.”

Front 389

What executive order mandates C&A?

Back 389

Executive Order 13231, 16 October 2001
Critical Infrastructure Protection in the Information Age

Front 390

What law is the most recent overarching requirement for C&A?

Back 390

FISMA
~ (Federal Information Security Management Act) -
Title III of E-Government Act of 2002 (Public Law
107-347)
~ OMB has Oversight over E-Government
– Federal Government (Organizations and IG’s) must report
IA status to OMB annually and quarterly
– OMB provides reports to Congress annually
– Congressional Cyber Security Grade
~ NIST publishes Standards and Guidelines
~ All Federal Government must follow NIST C&A
processes, with the exception of Defense and
Intelligence organizations.

Front 391

What does DITSCAP stand for?

Back 391

Defense Information Technology Security
Certification and Accreditation Process

Front 392

What instruction created DITSCAP?

Back 392

DoDI 5200.40, 30 December 1997
~ Applies to all DoD systems

Front 393

What are the phases of DITSCAP?

Back 393

o Definition
o Verification
o Validation
o Post-accreditation

Front 394

What document further defined DITSCAP?

Back 394

DoD 8510.1-M DITSCAP Application Manual, July 00
~ Implementation guidance
~ Deliverable format

Front 395

What is the document created by DITSCAP called?

Back 395

System Security Authorization Agreement (SSAA)

Front 396

What activities occur in phase 1 of DITSCAP/NIACAP?

Back 396

~ Determine requirements
~ Define boundaries
~ Tailor the process & scope the effort
~ Draft the SSAA

Front 397

What activities occur in phase 2 of DITSCAP/NIACAP?

Back 397

~ System development activities
~ Initial certification analysis
~ Document results in SSAA

Front 398

What activities occur in phase 3 of DITSCAP/NIACAP?

Back 398

~ Test installed system
~ Evaluate procedural, physical, personnel, CM etc. procedures
~ Document results

Front 399

What activities occur in phase 4 of DITSCAP/NIACAP?

Back 399

~ Operate the system
~ Security operations
~ CM & change control
~ Maintain SSAA

Front 400

What does NIACAP stand for?

Back 400

National Information Assurance Certification and
Accreditation Process

Front 401

What instruction created NIACAP?

Back 401

NSTISSI No. 1000, April 2000
Applies to all National Security Systems (NSSs)

Front 402

What are the phases of NIACAP?

Back 402

Definition
Verification
Validation
Post-accreditation

Front 403

What is the document created by NIACAP called?

Back 403

System Security Authorization Agreement (SSAA)

Front 404

What document defines the NIST C&A process?

Back 404

Guide for the Security Certification and
Accreditation of Federal Information Systems
NIST 800-37, May 2004
~ Applies to all Federal Systems

Front 405

What are the phases of the NIST C&A process (800-37)?

Back 405

Initiation
Certification
Accreditation
Continuous Monitoring

Front 406

What are the key documents produced in the NIST C&A process (800-37)?

Back 406

SSP – System Security Plan, NIST SP800-18
ST&E – Security Test and Evaluation – NIST SP800-53A
SAR – System Assessment Report – NIST 800-37
POA&M – Program of Actions & Milestones – OMB 02-1

Front 407

What does DIACAP stand for?

Back 407

DoD Information Assurance Certification and
Accreditation Process

Front 408

What are the major components of DIACAP?

Back 408

~ Process (DoDI 8510)
~ Automation (eMASS)
~ Guidance and Collaboration (Knowledge Service)

Front 409

What instruction created DIACAP?

Back 409

DoDI 8510.01, 28 November 2007
~ Applies to all DoD systems

Front 410

What are the phases of DIACAP?

Back 410

~ Initiation and Planning IA C&A
~ Implement and Validate Assign IA Controls
~ Make Certification Determination and Accreditation Decision
~ Maintain Authorization to Operate and Conduct Reviews
~ Decommission

Front 411

What are the key documents produced by DIACAP?

Back 411

~ System Identification Profile (SIP) [Description/Registration]
~ DIACAP Implementation Plan (DIP) [Implement/Validate]
~ POA&M [correction/mitigation]
~ Scorecard [risk assessment]

Front 412

What are the supporting resources for DIACAP?

Back 412

Knowledge Service
eMASS and other tools

Front 413

What is the NSTISSI 4009 definition of Program Manager?

Back 413

“The PM represents the interests of the AIS, and is
responsible for the AIS throughout its lifecycle; ensures
the security requirements are integrated in order to
achieve an acceptable level of risk as documented in the
SSAA, and keeps all participants informed of AIS lifecycle
actions, security requirements and user needs.”

Front 414

What is the NSTISSI 4009 definition of Designated Approving Authority?

Back 414

“The primary government official responsible for
implementing system security. An executive with the
authority to formally assume responsibility for
operating an AIS or network at an acceptable level of
risk, and to balance the needs of the system with the
security risks.”

Front 415

What is the NSTISSI 4009 definition of User Representative?

Back 415

“Official with the authority to formally assume
responsibility for operating an AIS or network
at an acceptable level of risk.”

Front 416

What is the NSTISSI 4009 definition of Information Systems Security Officer?

Back 416

“Person responsible to the designated approving
authority who ensures that security of an
information system is implemented through its
design, development, operation, maintenance,
and secure disposal stages.”

Front 417

What is the DoDI 5200.40 definition of System Security Authorization Agreement?

Back 417

“A description of the system mission, target environment,
target architecture, security requirements, and applicable
data access policies. It also describes the applicable set
of planning and certification actions, resources, and
documentation required to support the certification and
accreditation. It is the vehicle that guides the
implementation of INFOSEC requirements and the
resulting certification and accreditation actions.”

Front 418

What does the SSAA document?

Back 418

~ The operating environment and the threat
~ The AIS security architecture and the C&A
boundary of the AIS to be accredited
~ The agreement among the parties involved
~ All requirements necessary for accreditation
~ Condenses and consolidates the documentation
requirements (CONOPS, tests, etc)
~ The overall C&A plan (NIACAP/DITSCAP)
~ The test plans, results, and residual risk
~ The baseline security configuration document

Front 419

What are the characteristics of an SSAA?

Back 419

~ Describes the operating environment and threat
~ Describes the system security architecture
~ Establishes the C&A boundary of the system
~ Documents the formal agreement among the DAA,
certifier, program manager, and user representative
~ Documents all requirements necessary for accreditation
~ Documents test plans and procedures, certification
results, and residual risk
~ Forms the baseline security configuration document

Front 420

What are the main tasks of DITSCAP phase 1?

Back 420

~ Define system functions, requirements, and
interfaces
~ Define information category and classification
~ Prepare the system architecture description
~ Identify principle C&A roles & responsibilities
~ Define C&A level of effort
~ Draft SSAA
~ Agree on the method for implementing security
requirements (documented in SSAA)

Front 421

What are the phases of the 800-37 Rev 1?

Back 421

~ Categorize
~ Select
~ Implement
~ Assess
~ Authorize
~ Monitor

Front 422

What are the key deliverables of the 800-37 Rev 1?

Back 422

SSP, SAR, POA&M

Front 423

In the Definition phase of DITSCAP (Determine mission needs), what documents/information is needed?

Back 423

~ System Requirements and Capabilities
~ System Mission, Function, Interfaces
~ Organizations operating system
~ Operational environment
~ Information types and classifications
~ Expected System Life Cycle
~ System User Characteristics
~ Intended system/network interfaces

Front 424

What actions are required in Task 1 of DITSCAP Definition: Determine Mission Needs?

Back 424

Registration begins with preparing the business, mission, or operational
functional description as well as system description and system identification.
The information collected during the preparation activity is evaluated and
applicable information assurance requirements are determined.

Front 425

What actions are required in Task 2 of DITSCAP Definition: Determine Mission Needs?

Back 425

Inform the DAA, Certifier, and user representative that the system will
require C&A support (register the system).

Front 426

What actions are required in Task 3 of DITSCAP Definition: Determine Mission Needs?

Back 426

Prepare the environment and threat description. Threats should be assessed
against the specific business functions and system description to determine
the required protection. The threat, and subsequent vulnerability assessments,
must be used in establishing and selecting the IA policy objectives that will
counter the threat.

Front 427

What actions are required in Task 4 of DITSCAP Definition: Determine Mission Needs?

Back 427

Prepare system architecture description, describe the C&A boundaries, and
document relationships with external systems or equipment.

Front 428

What actions are required in Task 5 of DITSCAP Definition: Determine Mission Needs?

Back 428

Determine the system security requirements. The risk management and
vulnerability assessment actions commence. A risk management process may
also be installed in an effective, understandable, and repeatable manner.

Front 429

What actions are required in Task 6 of DITSCAP Definition: Determine Mission Needs?

Back 429

Tailor the C&A tasks, determine the level of effort, and prepare a C&A plan.
The C&A team determines the level of effort by evaluating the security
requirements and the degree of assurance needed in areas such as
confidentiality, integrity, availability, and accountability. The planned level of
effort is targeted at addressing the security requirements and fulfilling the
mission of the program.

Front 430

What actions are required in Task 7 of DITSCAP Definition: Determine Mission Needs?

Back 430

Identify organizations involved in C&A and the resources required.

Front 431

What actions are required in Task 8 of DITSCAP Definition: Determine Mission Needs?

Back 431

Develop the draft SSAA during the registration activities to consider the
program’s system development approach and life cycle stage, existing
documentation and environment, architecture and business functions, and
documentation on users and data classification and categorization.

Front 432

In the Definition phase of DITSCAP (Registration), what information is needed?

Back 432

Information collected
Security requirements determined
Threat Assessment started
Level of effort of C&A determined
Prepare system description with boundaries
Determine acquisition strategy & life cycle
Assess impact of life cycle on certification

Front 433

In the Definition phase of DITSCAP (Registration), what tasks must be performed?

Back 433

Determine classification and types of information
Determine clearances and access requirements
Identify system class and security requirements
Identify organizations supporting DITSCAP
Tailor DITSCAP activities
Determine scope, level of effort, and schedule

Front 434

In the Definition phase of DITSCAP (negotiation), who needs to participate?

Back 434

Key members are:
~ Designated Approving Authority
~ Program Manager
~ Certifying Agent
~ User Representative
Information Systems Security Officer
Strategy agreed upon
~ Not a bargaining session!
~ Everyone understands roles
~ No surprises

Front 435

In the Definition phase of DITSCAP (negotiation), what needs to happen?

Back 435

Clearly defines
~ Requirements
~ Approach
~ Level of Activity
Approval of SSAA
~ Designated Approving Authority
~ Program Manager
~ User Representative

Front 436

What are the objectives of the DITSCAP SSAA?

Back 436

~ Phase 1 End Product (refined in later phases)
~ Document the formal agreement among the DAA,
the CA, the user representative, and the program
manager
~ Document all requirements necessary for
accreditation
~ Document all security criteria for use throughout
the IT system life-cycle
~ Minimize documentation requirements by
consolidating applicable information into the
SSAA
~ Document the DITSCAP plan

Front 437

What are the main tasks of DITSCAP phase 2?

Back 437

~ System Architecture Analysis
~ Software Design Analysis
~ Network Connection Rule Compliance
~ Integrity Analysis of Integrated Products
~ Life Cycle Management Analysis
~ Security Requirements Validation Procedures
~ Vulnerability Evaluation
~ Refine/modify SSAA

Front 438

In the Verification phase of DITSCAP, what are the goals?

Back 438

Verify system compliance with requirements
Refine the SSAA, if needed
Refine analysis
~ System development
~ Modifications
~ Certifications
Review and refine SSAA, if necessary
~ Hardware details
~ Software details
Certification analysis
~ Corresponds to Life Cycle activity
~ Verification by analysis, investigation, comparison

Front 439

In the Verification phase of DITSCAP, what are the certification actions?

Back 439

System Architecture
Analysis
Software Design Analysis
Network Connection Rule
Compliance
Product Integrity Analysis
Life Cycle Management
Vulnerability Assessment
Actions Completion gives:
~ Documented security specification
~ Comprehensive test plan
~ All interconnection requirements
implemented
Vulnerability assessment impacts
Configuration Management
~ “Good configuration management builds good
security; good security application establishes
good configuration management.”

Front 440

In the Verification phase of DITSCAP, what are the completion actions?

Back 440

Review certification analysis results upon
conclusion of each life cycle development
milestone
Significant deviation from SSAA, revert to
Definition Phase to resolve problems

Front 441

What are the main tasks of DITSCAP phase 3?

Back 441

~ ST&E* (Implementation of security reqs, I&A, AC, Audits…)
~ Penetration Testing (Exploitation, Insider/Outsider)
~ COMSEC Compliance Evaluation (reqs, integration)
~ System Management Analysis (Maintain Mgmt/CM/Arch)
~ Contingency Plan Evaluation (Backup, COOP…)
~ Site Accreditation Survey (SSAA compliance, environment)
~ Risk Management Review (acceptable risks to CIAA**)
~ Develop Certification Report and Recommendation for
Accreditation:
– System Certified: Yes or No (based on meeting SSAA reqs)
– If Certified, Recommend: IATO or full accreditation
~ Ends with accreditation decision from DAA

Front 442

In the Validation phase of DITSCAP, what are the goals?

Back 442

~ Review the SSAA to ensure requirements and
agreements are current
~ Evaluation of the IT system
~ Formal system certification test and security
accreditation actions

Front 443

In the Validation phase of DITSCAP, what are the evaluation actions?

Back 443

~ System Security Testing and Evaluation
~ Penetration Testing
~ TEMPEST (EMSEC) and Red/Black Verification
~ Validation System Management Analysis
~ Site Accreditation Surveys
~ Personnel Security
~ Physical Security
~ Environmental Security
~ Contingency Plan Examination
~ Risk Management Review
~ Recommendation and documentation to DAA
Security Findings
Deficiencies
Risks of Operation

Front 444

In the Validation phase of DITSCAP, what are the possible accreditation decisions?

Back 444

Denial
IATO
ATO

Front 445

What are the main tasks of DITSCAP phase 4?

Back 445

Review configuration & security management
~ Follow change mgmt documented in SSAA
~ Determine if system security mgmt continues to support
mission and architecture
Conduct risk management review
~ Assess if risk to CIAA is being maintained at an
acceptable level
Conduct compliance validation if needed
~ Ensure continued compliance w/SSAA reqs, current
threat assessment, and concept of operations
Maintain SSAA

Front 446

What are the roles and responsibilities of NIACAP?

Back 446

~ DAA – Designated Approving Authority
~ Program Manager
~ Certifier
~ User Representative

Front 447

What NIACAP establish?

Back 447

NIACAP establishes a standard national process
to certify and accredit systems that will maintain
the IA of a system

Front 448

What are the NIACAP levels of certification?

Back 448

~ Level 1: Basic security review
~ Level 2: Minimum analysis
~ Level 3: Detailed analysis
~ Level 4: Comprehensive analysis
Level is determined by criticality, C.I.A.
requirements, business mission, CI involvement,
data processed, user types, accountability and other
factors. The higher on such scales, the more
comprehensive the C&A.

Front 449

Why was DIACAP established?

Back 449

Providing a standard C&A approach.
Giving guidance on managing and disseminating
enterprise standards and guidelines for:
~ IA design, implementation, configuration, validation,
operational sustainment, and reporting.
~ Implementing and maintaining security through the
IS’s Life-Cycle
Accommodating diverse information systems in a
dynamic environment.

Front 450

What is a DIACAP SIP?

Back 450

System Identification Profile (SIP)
The SIP is compiled during:
~ DIACAP registration
~ Maintained throughout the system life
cycle.
Provides detailed description of:
~ System mission
~ Components and Information
~ Location and Environment
~ Connections
~ Players

Front 451

What is a DIACAP DIP?

Back 451

DIACAP Implementation Plan (DIP)
Contains the IS’s:
~ Assigned IA controls
~ Implementation status
~ Responsible entities
~ Resources
~ Estimated completion date
The plan may reference:
~ Supporting implementation material
~ Artifacts

Front 452

What does the DICAP DIP do?

Back 452

How each assigned IA control is implemented
Implementation follows guidelines described in the
DIACAP KS

Front 453

What information is included in the DIACAP DIP?

Back 453

IA Control #
IA Control Subject Area
IA Control Name
IA Control Text (Requirement)
Threat/Vulnerability/ Countermeasure
General Implementation Guidance
System-specific Guidance Resource

Front 454

What is a DIACAP Scorecard?

Back 454

~ Summary report that succinctly conveys
information on the IA posture of the
system in a format that can be
exchanged electronically.
~ Documents the accreditation decision
and must be signed, either manually or
with a DoD PKI-certified digital signature.
~ The Scorecard contains a listing of all IA
controls and their status of either C, NC,
or NA.
~ Additional data elements may be
specified by CIOs, DAAs, or other
enterprise users of the Scorecard

Front 455

What is a DICAP POA&M?

Back 455

~ Is a management tool.
~ Primary purpose assist agencies in
identifying, assessing, prioritizing, and
monitoring security weaknesses found in
programs and systems, along with the
progress of corrective efforts for those
vulnerabilities.
~ OMB requires agencies to prepare IT
Security POA&Ms for all programs and
systems in which an IT security
weakness has been found.
~ Agency CIOs must report their progress
on at least a quarterly basis to OMB.

Front 456

What tasks are part of DIACAP Activity 1?

Back 456

Initiate and Plan IA C&A
~ Create the System Identification Plan (SIP)
~ Register system with DoD Component IA Program
~ Assign IA controls
~ Assemble DIACAP Team
~ Initiate DIACAP Implementation Plan (DIP)

Front 457

What tasks are part of DIACAP Activity 2?

Back 457

Implement and Validate Assigned IA Controls
~ Execute DIP
~ Conduct validation activities
~ Plan of Action and Milestones (POA&M)
~ Compile validation results in DIACAP Scorecard

Front 458

What tasks are part of DIACAP Activity 3?

Back 458

Make Certification Determination and
Accreditation Decision
~ Make certification determination
~ Make accreditation decision

Front 459

What tasks are part of DIACAP Activity 4?

Back 459

Maintain Authorization to Operate and Conduct
Reviews
~ Maintain situational awareness
~ Maintain IA posture
~ Conduct annual reviews
~ Initiate reaccreditation

Front 460

What tasks are part of DIACAP Activity 5?

Back 460

Decommission
~ Retire the system
~ Update/remove registration with DoD Component IA
Program

Front 461

What is the GIG?

Back 461

Global Information Grid
Globally interconnected, end-to-end set of information
capabilities, associated processes, and personnel for
collecting, processing, storing, disseminating, and
managing information for all.
Provides capabilities from all locations, interfaces to
coalition, allied, and non-DoD users and systems.

Front 462

What does the GIG support?

Back 462

Supports National Security, Intelligence Community
and DoD Mission Areas (MA) functions:
~ Enterprise Information Environment MA (EIEMA)
~ Business MA (BMA)
~ Warfighting MA (WMA)
~ Defense Intelligence MA (DIMA)

Front 463

What is the DICAP TAG?

Back 463

Technical Advisory Group (TAG)
~ A formally chartered body established by ASD-NII
and DoD CIO to examine and address common
C&A issues, including changes to the baseline IA
controls, across the DoD Component IA
programs, IA Communities of Interest (COIs), and
other GIG entities.
~ The DIACAP TAG also maintains configuration
control and management of the DIACAP and all
its supporting content on the DIACAP KS.

Front 464

What is the role of the DIACAP IA Senior Leadership?

Back 464

IA Senior Leadership (IASL)
~ Provides the integrated planning, coordination,
and oversight of the Department's IA programs to
assure the availability, integrity, authentication,
confidentiality, and non-repudiation of the
Department's mission essential and mission
support information and the reliability DII.

Front 465

What does the DIACAP apply to?

Back 465

DIACAP applies to DoD-owned information
systems and DoD-controlled information systems
operated by a contractor or other entity on behalf of
the DoD that receive, process, store, display, or
transmit DoD information, regardless of
classification or sensitivity

Front 466

What does the DIACAP NOT apply to?

Back 466

DIACAP does not apply to DoD systems that
process:
~ Sensitive Compartmented Information (SCI)
~ Special Access Program (SAP) information
~ Nuclear Command and Control Extremely Sensitive
Information (NC2-ESI)

Front 467

What are the DIACAP roles and responsibilities?

Back 467

Principal Accrediting Authority (PAA)
PAA Representative
Designated Approving Authority (DAA)
Heads of DoD Components
Chief Information Officer (CIO)
Senior Information Assurance Official (SIAO)
Certifying Authority (CA)
– (e.g., validators, analysts, CA representatives (CAR)).
Program Executive Officer (PEO)
Program/System Manager (PM/SM)
Information Assurance Manager (IAM)
Information Assurance Officer (IAO)
User Representative (UR)

Front 468

What is the PAA?

Back 468

The senior official representing the interests of a
GIG MA regarding C&A
~ Represent the interests of the MA and, as required,
issue accreditation guidance specific to the MA,
consistent with this Instruction.
~ Appoint flag-level (e.g., general officer, senior
executive) PAA Representatives to the DISN/GIG
Flag Panel.
~ Resolve accreditation issues within their respective
MAs and work with other PAAs to resolve issues
among MAs, as needed.
~ Designate DAAs for MA ISs, if required, in
coordination with appropriate DoD Components.

Front 469

What is the PAA Representative?

Back 469

Appointed by PAA
~ Serve as a member of the DISN/GIG Flag Panel.
~ Provide MA-related guidance to DAAs, Milestone
Decision Authorities (MDA), the DSAWG, and the
DIACAP TAG.
~ Advise the corresponding MA PAAs and assist the DoD
CIO and SIAO in assessing the effectiveness of GIG IA
capabilities.

Front 470

What do the Heads of DoD Components do to support DIACAP?

Back 470

~ Ensures DoD ISs under their purview comply
with the DIACAP.
~ Operates only accredited ISs.
~ Complies with all accreditation decisions,
including denial of authorization to operate
(DATO), and enforce authorization termination
dates (ATD).
~ Ensures that an annual assessment of the DoD
Component IA program is conducted.
~ Appoints DAAs for DoD ISs under their purview.

Front 471

What is the role of the DAA in DIACAP?

Back 471

The official with the authority to formally assume
responsibility for operating a system at an acceptable
level of risk.
~ ATO
~ IATO
~ DATO
~ IATT
Responsible for the Mission and Resources
Must be a Government Employee

Front 472

What is the role of the CIO in DIACAP?

Back 472

Appoints the DoD Component SIAO.
Ensures
~ Implementation and validation of IA controls through the
DIACAP are incorporated in the IS’s life-cycle
management processes.
~ C&A status of the ISs are visible to the ASD(NII)/DoD CIO
and PAAs.
~ Collaboration and cooperation between the DoD
Component IA program and the PAA and DAA structure.
~ PM or SM is identified for each IS.
Establishes and manages an IT Security POA&M
program.

Front 473

What is the role of the SIAO in DIACAP?

Back 473

Senior IA Officer (SIAO)
~ Establishes and enforces the DoD Component IA
program’s C&A process.
~ The single IA coordinator for joint or Defense-wide
programs that are deploying ISs to DoD Component
enclaves
~ Ensures participation in the DIACAP TAG.
~ Tracks C&A status of Component ISs.
~ Establishes and manages a coordinated IA
certification process.
~ Is the certifying authority (CA) or formally delegating
CA for ISs and oversees CA experts.

Front 474

What is the role of the PM, SM and PEO in DIACAP?

Back 474

~ Implements the DIACAP for assigned DoD ISs.
~ Plans and budgets for IA controls implementation,
validation, and sustainment throughout the
system life cycle, including timely and effective
configuration and vulnerability management.
~ Develops, tracks, resolves, and maintains the
DIACAP Implementation Plan (DIP) for assigned
ISs.
~ Enforces DAA accreditation decisions for hosted
or interconnected DoD ISs.

Front 475

What is the role of the PM, SM and PEO in DIACAP?

Back 475

Ensures that:
~ Each assigned DoD ISs has a designated IA manager
(IAM) with the support, authority, and resources to
satisfy their responsibilities.
~ Information system security engineering is employed to
implement or modify the IA component of the system
architecture in compliance with the IA component of the
GIG Architecture and to make maximum use of
enterprise IA capabilities and services.
~ IT Security POA&M development, tracking, and
resolution.
~ Annual reviews of assigned ISs required by FISMA are
conducted.

Front 476

What is the role of the user representative in DIACAP?

Back 476

~ Represents the operational interests of the user
community in the DIACAP.
~ Supports the IA controls assignment and
validation process to ensure user community
needs are met.

Front 477

Who are the members of the certifying team in DIACAP?

Back 477

Certifying Authority (CA)
~ The senior official having the authority and
responsibility for the certification of information
systems governed by a DoD Component IA program.
~ Make the certification recommendation to the DAA
~ Can be the SIAO.
CA Representative/Analyst
~ Delegated the responsibility of reviewing and
assessing the DIACAP package for compliance and
risk.
Validator
~ Individual responsible for conducting a validation
procedure.

Front 478

What is the role of the ISSE in DIACAP?

Back 478

Information Systems Security Engineer
~ An individual that performs the Information Systems
Security Engineering functions.
~ Works with system architects, engineers, and
developers to ensure that IA controls are designed
and implemented into a system throughout the
development process.

Front 479

What is the role of the IAM in DIACAP?

Back 479

~ Support the PM or SM in implementing DIACAP.
~ Advise and inform the DoD Component IA program
on ISs C&A status and issues.
~ Comply with the DoD Component IA program’s
information and process requirements.
~ Provide direction to the IA Officer (IAO).
~ Coordinate with the organization’s SM to ensure
issues affecting the organization’s overall security
are addressed appropriately.
~ Similar to the IA title Information Systems Security
Manager (ISSM) used else where.

Front 480

What is the role of the IAO in DIACAP?

Back 480

~ An individual responsible to the IAM for ensuring
that the appropriate operational IA posture is
maintained for a DoD information system or
organization.
~ While the title IAO is favored within the DoD, it
may be used interchangeably with other IA titles
(e.g., Information Systems Security Officer,
Information Systems Security Custodian, Network
Security Officer, or Terminal Area Security
Officer).

Front 481

What are the DIACAP risks?

Back 481

Risks are assessed to determine the impact upon:
~ Integrity (MAC)
~ Availability (MAC)
~ Confidentiality (CL)

Front 482

What is a Mission Assurance Category?

Back 482

Applicable to DoD information systems, the
mission assurance category (MAC) reflects the
importance of information relative to the
achievement of DoD goals and objectives,
particularly the warfighters' combat mission.
MACs are primarily used to determine the
requirements for availability and integrity.
The DoD has three defined MAC Levels:
~ MAC I
~ MAC II
~ MAC III

Front 483

What are the details of MAC I?

Back 483

Availability (HIGH), Integrity (HIGH), Most Stringent Protection Measures

Front 484

What are the details of MAC II?

Back 484

Availability (MEDIUM), Integrity (HIGH), Beyond Best Practices

Front 485

What are the details of MAC III?

Back 485

Availability (BASIC), Integrity (BASIC), Commensurate with Commercial Best Practices

Front 486

What are the Confidentiality Levels (CLs)?

Back 486

Classified:
~ Kept secret in the interest of national defense or foreign
policy.
~ Includes Confidential, Secret, and Top Secret.
Sensitive:
~ could adversely affect the national interest or the conduct
of Federal programs, or the privacy of individuals.
Public:
~ has been reviewed and approved for public release by
the information owner.

Front 487

What types of information are recognized by DIACAP?

Back 487

Sensitive
~ Controlled Unclassified Information (CUI)
~ Loss of confidentiality, integrity, availability, could
have serious, sever, or catastrophic adverse impact [includes critical infrastructure data]
~ Types:
Personnel, Financial, Payroll, Operational,
Medical, and Privacy Act [PII]
Non-Sensitive
~ Approval must be gained prior to release

Front 488

What EO defines classified information?

Back 488

EO 12356

Front 489

What is the damage the loss of "top secret" would cause?

Back 489

cause exceptionally grave damage to the national
security

Front 490

What is the damage the loss of "secret" would cause?

Back 490

cause serious damage to the national security

Front 491

What is the damage the loss of "confidential" would cause?

Back 491

cause damage to the national security

Front 492

What are confidentiality levels used for?

Back 492

Used to establish requirements for:
~ individual security clearances or background
investigations requirements
~ access approvals
~ need-to-know determinations
~ interconnection controls and approvals
~ acceptable methods by which users may access the
system (e.g., intranet, Internet, wireless)
~ appropriate security controls

Front 493

What are the details of CL: Classified?

Back 493

Robustness (HIGH), Security: NSA-approved cryptography
and key management

Front 494

What are the details of CL: Sensitive?

Back 494

Robustness (MEDIUM), Security: NIST/FIPS approved
cryptography and NSA approved
key management

Front 495

What are the details of CL: Public?

Back 495

Robustness (BASIC), Security: NIST/FIPS-approved
cryptography and key
management

Front 496

What are DIACAP IS Controls?

Back 496

An objective IA condition of integrity, availability or
confidentiality achieved through the application of
specific safeguards or through the regulation of
specific activities that is expressed in a specified
format, i.e., a control number, a control name, control
text, and a control class.
Specific management, personnel, operational, and
technical controls are applied to each DoD information
system to achieve an appropriate level of integrity,
availability, and confidentiality in accordance with
reference OMB A-130.

Front 497

What are the objective conditions for DIACAP IA Controls?

Back 497

~ objective condition is testable
~ compliance is measurable, and
~ activities required to achieve the IA Control are
assignable and thus accountable.

Front 498

How are DIACAP IA controls assigned?

Back 498

Assignment of the controls are made according
with:
~ MAC
~ CL

Front 499

How are DIACAP IA controls laid out?

Back 499

Are laid out in:
~ IA Control Subject Areas
~ IA Control Names

Front 500

List the DIACAP IA control areas, their acronym and number of controls?

Back 500

Security Design and Configuration, DC, 31
Identification and Authentication, IA, 9
Enclave and Computing Environment, EC, 48
Boundary Defense, EB, 8
Physical and Environmental, PE, 27
Personnel, PR, 7
Continuity, CO, 24
Vulnerability and Incident Management, VI, 3

Front 501

Study slide 398

Back 501

Study slide 398

Front 502

Study slide 399

Back 502

Study slide 399

Front 503

What is the robustness level of a DIACAP MAC I system?

Back 503

HIGH

Front 504

What is the robustness level of a DIACAP MAC II system?

Back 504

MEDIUM

Front 505

What is the robustness level of a DIACAP MAC III system?

Back 505

BASIC

Front 506

How are DIACAP IA control robustness levels numbered?

Back 506

1 -3 where 3 is HIGH robustness. The opposite of MAC levels

Front 507

List the DIACAP IA controls associated with Security Design and Configuration

Back 507

Procedural Review DCAR-1 Availability
Acquisition Standards DCAS-1 Confidentiality
Best Security Practices DCBP-1 Integrity
Control Board DCCB-2 Integrity
Configuration Specification DCCS-2 Integrity
Compliance Testing DCCT-1 Availability
Dedicated IA Services DCDS-1 Integrity
Functional Architecture for AIS Applications DCFA-1 Integrity
HW Baseline DCHW-1 Availability
Interconnection Documentation DCID-1 Integrity
IA Impact Assessment DCII-1 Integrity
IA for IT Services DCIT-1 Integrity
Mobile Code DCMC-1 Integrity
Non-repudiation DCNR-1 Integrity

Front 508

List the DIACAP IA controls associated with Security Design and Configuration

Back 508

Partitioning the Application DCPA-1 Integrity
IA Program and Budget DCPB-1 Availability
Public Domain Software Controls DCPD-1 Availability
Ports, Protocols, and Services DCPP-1 Availability
CM Process DCPR-1 Integrity
IA Documentation DCSD-1 Availability
System Library Management Controls DCSL-1 Integrity
Security Support Structure Partitioning DCSP-1 Integrity
Software Quality DCSQ-1 Integrity
Specified Robustness – Medium DCSR-2 Confidentiality
System State Changes DCSS-2 Integrity
SW Baseline DCSW-1 Availability

Front 509

What guidance/instructions are reference for the DIACAP IA controls?

Back 509

DoD 5200.1-R, "DoD Information Security Program," January
1997, i.e., Storage, Access, Classification, etc.
DoD Directive C-5200.5 COMSEC activities
ASD(C3I) Memorandum, dated June 4, 2001, "Disposition of
Unclassified DoD Computer Hard Drives."
DoD Directive S-5200.19, DoD TEMPEST
DoD Instruction O-8530.2, defines reportable incidents,
outlines a standard operating procedure for incident
response.
IATF, IA Technical Framework, Protection Profile Consistency
Guidance for High, Medium, and Basic Robustness
NIST FIPS 140-2, validated cryptography

Front 510

What is a compensating control?

Back 510

Management, operational, and technical controls
employed in lieu of recommended controls that
provides equivalent or comparable protection for an
information system.

Front 511

What is a DIACAP CAT Severity Code?

Back 511

Indicates:
~ Risk level associated with non-compliance, and
~ Urgency with which corrective action must be
completed.
CA assigns the CAT codes to a system security
weakness during certification analysis.
How serious are these codes:
~ A CAT I rating for a MAC I or MAC II must, at a
minimum, be classified CONFIDENTIAL.
~ CAT II weaknesses must be reviewed for their
classification level.

Front 512

What are Category I Severity Code Weakness?

Back 512

Allows:
~ Primary security protections to be bypassed.
~ Immediate access by unauthorized personnel or
unauthorized assumption of super-user privileges.
Only Component CIO can
~ authorize operation of a system with a Cat I weakness
and then only through an IATO.
System must be
~ critical to military operations and failure to deploy will
preclude mission accomplishment.
~ Copy of authorization must be sent to DoD SIAO.

Front 513

What are Category II Severity Code Weakness?

Back 513

A weakness that can lead to unauthorized system
access or activity.
Usually are corrected or mitigated to a point where
any residual risk is acceptable.
Can be granted an ATO
~ Only when clear evidence exists that that deficiency
can be mitigated within 180 days of the accreditation
decision.
~ Only one 180 day extension allowed.
DAA
~ Will normally issue a DATO if not corrected or
mitigated in 360 consecutive days.

Front 514

What are Category III Severity Code Weakness?

Back 514

CAT III
~ One that if corrected will improve the system’s IA
posture.
DAA
~ Will determine if these types of weaknesses will be
corrected or if the risk will be accepted.
CAT IIIs accepted by DAA will be documented in
the POA&M:
~ Marked N/A in the scheduled completion date column.
~ Note acceptance by DAA in the milestone column
~ Note risk accepted in the status column

Front 515

What are the types of DIACAP packages?

Back 515

Comprehensive Package
~ Used for the CA recommendation
~ Includes all the information resulting from the DIACAP
process
Executive Package
~ Less than the Comprehensive package
~ Used for an accreditation decision
~ Provided to others in support of accreditation or other
decisions, such as connection approval
Actual Artifact Formats:
~ Each DAA will determine what information is
necessary to make an accreditation decision and what
format they want it presented in.

Front 516

What documents constitute a DIACAP Comprehensive Package?

Back 516

SIP, DIP, Supporting Certification Documentation, Scorecard, POA&M

Front 517

What documents constitute a DIACAP Executive Package?

Back 517

SIP, Scorecard, POA&M

Front 518

What is the DICAP Knowledge Service?

Back 518

~ A Web-based, DoD PK-enabled DIACAP
knowledge resource that provides current GIG
IA C&A.
~ A library of tools, diagrams, process maps,
documents, etc., to support and aid in execution
of the DIACAP.
~ A collaboration workspace for the DIACAP user
community to develop, share and post lessons
learned & best practices.
~ A source for IA news and events and other IA related
information resources.

Front 519

What is included in the validation procedures?

Back 519

IA Control #
Procedure Name
Procedure Objective
Procedure Script
Expected Results

Front 520

What is a STIG?

Back 520

Security Technical Implementation Guides (STIG)
~ Provides the guidance needed to development, integration,
and updating of secure applications.
~ Subjects: development, design, testing, maintenance,
configuration management, education, and training.

Front 521

What are the families of STIGs?

Back 521

~ Infrastructure
~ Operating System
~ Database
~ Web and Application Services
~ Desktop Application

Front 522

What is technical project management?

Back 522

Project Management is a structured, pro-active
management approach for finite undertakings
that produce a unique product, service, or other
result.

Front 523

What are the characteristics of technical project management?

Back 523

It is characterized by the application of
knowledge, skills, tools, and techniques in
detailed planning and execution of the endeavor.

Front 524

How is technical project management accomplished?

Back 524

It is accomplished through integrated and
logically flowing processes to perform initiating,
planning, executing, monitoring, controlling, and
close-out activities while balancing competing
demands for quality, scope, schedule, and cost.

Front 525

What is a project framework?

Back 525

The Project Framework illustrates and
combines all elements necessary to begin,
manage, and conclude a project. It starts as a
skeleton with basic contents and evolves and
expands as the project proceeds.

Front 526

What is a scope statement?

Back 526

A formal definition agreed to by all stakeholders
in the project, describing what is to be done,
why it is being undertaken, who will be engaged
to do the work and when the whole venture
should be completed.

Front 527

What is milestone identification?

Back 527

Refers to the process of identifying those
discrete steps in a project which represent
major steps of achievement, and are
generally tied to progress payments.

Front 528

What is a work breakdown structure?

Back 528

This step consists of both the decomposition
of all the work associated with milestone
achievement into individual work tasks, as
well as the identification of all dependencies.

Front 529

What is a baseline project plan?

Back 529

This is the final set of project documents which
collectively represents the foundation
“agreement” from which work will proceed to its
desired end-product or solution. Changes to
the baseline should be managed carefully and
precisely to avoid unwanted or unforeseen
impacts.

Front 530

What are change management procedures?

Back 530

Formal change management is vital in order to
avoid unplanned or unmanaged impacts
occurring that adversely effect the project
schedule or resource profiles. All changes
considered must be reviewed and formally
agreed to by all parties after discussing issues
and risks, and before proceeding with the
proposed modifications. Prevents “scope
creep”.

Front 531

Define activity

Back 531

A discrete element of work performed during the course of a
project. Has measured duration, cost, and resource
requirements. Often subdivided into tasks.

Front 532

Define baseline

Back 532

Officially approved version of the plan (cost, schedule, or
technical) for a project, a work package, or an activity, plus or
minus approved scope changes. Normally altered or
updated through changes in scope, funding, schedule,
requirements, etc. through the Change Management
process.

Front 533

Define critical path

Back 533

Series of activities that determines the duration of the project.
In a deterministic model, the critical path is usually defined as
those activities with float equal to zero. It is the longest path
through the project. See critical path method.

Front 534

Define critical path method (CPM)

Back 534

A network analysis technique used to assess the degree of
flexibility (float) through multiple scheduling paths in project
duration in order to determine overall project duration, and
task start/end dates (early-late).

Front 535

Define decision tree analysis

Back 535

The decision tree is a diagram that describes a decision
under consideration and the implications of choosing one or
another of the available alternatives, incorporating risk,
value, scheduling and potential outcomes variables

Front 536

Define deliverable

Back 536

A measurable, tangible, verifiable outcome, result, or item
that must be produced to complete a project or part of a
project.

Front 537

Define deming cycle

Back 537

Another name for the “Plan-Do-Check-Act” model popularized by W.
Edwards Deming as a continual quality management tool.

Front 538

Define dependency

Back 538

An action, input, or outcome (cost, schedule, or other factor)
that creates a cause-and-effect relationship between two or
more aspects of a project. Can result in a slippage,
acceleration, overrun, or similar result in the effected element.

Front 539

Define estimate

Back 539

An assessment of the likely quantitative result; as in cost,
schedule, outcome, plus or minus some percent or ROM.

Front 540

Define life-cycle costing

Back 540

The concept of including acquisition, operating, and disposal
costs when evaluating various alternatives.

Front 541

Define network analysis

Back 541

The process of identifying early and late start and finish dates for
the uncompleted portions of project activities. See also critical
path method, program evaluation and review technique, and
graphical evaluation and review technique.

Front 542

Define pareto diagram

Back 542

A histogram, ordered by frequency of occurrence, that shows
how many results were generated by each identified cause.

Front 543

Define PERT chart

Back 543

The term is commonly used to refer to a project network
diagram.

Front 544

Define PERT

Back 544

Program Evaluation and Review Technique (PERT):
An event-oriented network analysis technique used to estimate
program duration when there is uncertainty in the individual
activity duration estimates. PERT applies the CPM using
durations that are computed by a weighted average of optimistic,
pessimistic, and most likely duration estimates. PERT computes
the standard deviation of the completion date from those of the
path’s activity durations. Also known as the Method of Moments
Analysis.

Front 545

Define project

Back 545

A temporary endeavor undertaken to create a unique product,
service, or result.

Front 546

Define project life-cycle

Back 546

A collection of generally sequential project phases whose
name and number are determined by the control needs of
the organization or organizations involved in the project.

Front 547

Define project network diagram

Back 547

Any schematic display of the logical relationships of project
activities. Always drawn from left to right to reflect project
chronology. Often referred to as a PERT chart.

Front 548

Define project plan

Back 548

A formal, approved document used to guide both project execution and
project control. The primary uses of the project plan are to document
planning assumptions and decisions, facilitate communication among
stakeholders, and document approved scope, cost, and schedule
baselines. A project plan may be produced or presented in a summary or
detail form.

Front 549

Define project risk management

Back 549

The systematic process of identifying, analyzing, and responding to
project risk (produced by any element that threatens to cause adverse
impact to cost, schedule, resource utilization, or overall project failure). It
includes the processes of risk management planning, risk identification,
qualitative risk analysis, quantitative risk analysis, risk response planning,
and risk monitoring and control.

Front 550

Define project schedule

Back 550

The planned dates for performing activities and the planned
dates for meeting milestones.

Front 551

Define project scope

Back 551

The work that must be done to deliver a product with the
specified features and functions. Also, The sum of the products
and services to be provided as a project. See project scope and
product scope.

Front 552

Define schedule control

Back 552

Controlling changes to the project schedule.

Front 553

Define scope change control

Back 553

Controlling changes to project scope (“creep”) so that the rate of
change does not exceed the rate of progress.

Front 554

Define stakeholder

Back 554

Individuals and organizations that are actively involved in the
project, or whose interests may be positively or negatively
affected as a result of project execution or project completion.
They may also exert influence over the project and its results.

Front 555

Define statement of work (SOW)

Back 555

A narrative description of products or services to be supplied
under contract.

Front 556

Define task

Back 556

A generic term for work that is not included in the work
breakdown structure, but potentially could be a further
decomposition of work by the individuals responsible for that
work. Also, lowest level of effort on a project.

Front 557

Define work breakdown structure (WBS)

Back 557

A deliverable-oriented grouping of project elements that
organizes and defines the total work scope of the project. Each
descending level represents an increasingly detailed definition of
the project work.

Front 558

Define work package

Back 558

A deliverable at the lowest level of the work breakdown structure,
when that deliverable may be assigned to another project
manager to plan and execute. This may be accomplished
through the use of a subproject where the work package may be
further decomposed into activities.

Front 559

Technical Project Management Roles and Responsibilities (provider/project): System Owner

Back 559

System owner – verifier of product design and purpose. Has
overall accountability for system (final result). Has the
CHECKPOINT FUNCTION to APPROVE changes in scope,
products, results, functionality, etc.

Front 560

Technical Project Management Roles and Responsibilities (provider/project): User POC

Back 560

User POC – represents intended end-user community and
provides conduit for communication, approval, and changes.
Has the CHECKPOINT FUNCTION to APPROVE.

Front 561

Technical Project Management Roles and Responsibilities (provider/project): Project Manager

Back 561

Project Manager – overall responsibility for project work,
progress and control, staffing and resource utilization.

Front 562

Technical Project Management Roles and Responsibilities (provider/project): Planner

Back 562

Planner – provides administrative support of planning effort.
Collects metrics to report status of “planned to actual”
regarding resources, cost, and schedules.

Front 563

Technical Project Management Roles and Responsibilities (provider/project): Quality Manager

Back 563

Quality Manager – owns QM plan and all QA activities.
Has CHECKPOINT FUNCTION to APPROVE items
impacting QA

Front 564

Technical Project Management Roles and Responsibilities (provider/project): Configuration Manager

Back 564

Configuration Manager – owns CM plan and related
activity

Front 565

Technical Project Management Roles and Responsibilities (provider/project): Testers

Back 565

Testers – conduct full range of tests for product
performance at various stages (SUT, IVTE, etc), and final
acceptance testing to assure ultimate success

Front 566

Technical Project Management Roles and Responsibilities (USFG/customer): Federal Technical Monitor

Back 566

Federal Technical Monitor – has responsibility to oversee
and assure SOW composition, project cost-control, timely
performance, standards compliance, plans analysis,
approvals, stakeholder coordination and representation

Front 567

Technical Project Management Roles and Responsibilities (USFG/customer): Federal Program Manager

Back 567

Federal Program Manager – general oversight of program
and assurance of funding, plan approval, deliverables
acceptance and approval, issue escalation and resolution

Front 568

Technical Project Management Roles and Responsibilities (USFG/customer): Federal Project Manager

Back 568

Federal Project Manager – daily involvement in
performance or oversight of configuration management,
change, management, requirements management, risk
management, and QA.

Front 569

What are the program manager responsibilities?

Back 569

The PM has the lead for all activities involving:
~ Cost
~ Schedule
~ Performance
~ Security
The PM works directly with:
~ Development
~ Maintenance
~ Configuration management
~ Quality Assurance
~ Test verification and validation

Front 570

What is necessary for successful implementation?

Back 570

early planning

Front 571

What are the steps for SSE planning?

Back 571

~ Definition of program requirements
~ Development of a Program Management Plan (PMP)
~ Identification of SSE requirements
~ Preparation of a detailed Systems Engineering
Management Plan (SEMP)

Front 572

What are the ISSEP planning phase activities?

Back 572

~ Reviewing, setting, and agreeing to project scope
~ Defining appropriate management structure
~ Assessing and determining resource requirements
~ Developing schedules and discovering dependencies
~ Setting performance milestones and metrics

Front 573

List the specific planning phase tasks (steps 1-3)?

Back 573

1. Estimation of project scope: must be as concise and as
accurate as possible (will evolve). Must include
assessment of complexity regarding human, technology,
and other factors.
2. Identification of resources and constraints: this will
include skills, technology, physical assets, and requires
addressing the question of “in-house” or “out-source”.
3. Identifying roles and responsibilities: clearly
establishing who will do what, skill levels, rotation, etc.

Front 574

List the specific planning phase tasks (steps 4-6)?

Back 574

4. Estimation of project cost: As much art as science.
Should use cost models where feasible and historical cost
where possible. WBS are used to collect and estimate
cost factors.
5. Developing schedules: Setting start-finish dates for
optimistic, pessimistic, and probable completion.
6. Identify Technical Activities: Define the work at the
task level, sequencing and linking, establishing methods
and materials required.

Front 575

List the specific planning phase tasks (steps 7-9)?

Back 575

7. Identify deliverables: Must have clear definitions of
WHAT is due, required content, format, and success
criteria.
8. Define Management Interfaces: Communications
planning and channels must be established as early as
possible for flow of PM information on all subjects.
9. Preparation of Technical Mgmt. Plan (TEMP): Included
in the overall PMP and SEMP, and integrates technical
execution with overall systems engineering and PM.

Front 576

List the specific planning phase tasks (steps 10-11)?

Back 576

10. Review of overall Project Mgmt. Plan (PMP): This
overarching plan integrates consistently and coherently all aspects of
project execution, schedule, and resource. All actions and changes roll
up into this from subsidiary plans. It evolves and changes as the project
moves forward.
11. Obtain customer agreement: All aspects must be in
accordance with customer requires and expectations, and includes:
~ Environmental analysis
~ Feasibility analysis
~ Scope, requirements, and deliverables verification
~ Customer approval

Front 577

What process groups are part of the management phase of technical management?

Back 577

controlling
executing

Front 578

What are management phase activities?

Back 578

~ Managing change: requesting, implementing, rejecting
~ Managing configurations: documents, deliverables, etc.
~ Managing corrective actions: identifying, applying
~ Managing updates: scope, PMP, performance plans, etc.
~ Managing expectations: effective, timely communication
~ Managing risk: identifying, tracking, mitigating

Front 579

List the specific management phase tasks (steps 1-3)?

Back 579

1. Directing technical effort: the management of the
actual technical (engineering, designing, etc) work and
production of deliverables.
2. Tracking resources: Using all necessary tools and
feedback mechanisms to ensure timely accurate
knowledge of the “planned to actual” consumption rates.
3. Tracking performance: Continuous awareness and
access to performance metrics (cost, schedule, earned
value, customer satisfaction) to ensure timely action

Front 580

List the specific management phase tasks (steps 4-6)?

Back 580

4. Monitoring progress: Evaluation of overall progress
toward completion of short-term, mid-term, and long-term
objectives and deliverables IAW plans and requirements.
5. Ensuring quality: Evaluation of quality indicators to
ensure timely awareness and correction of issues and
unacceptable variances.
6. Managing Configuration elements: Continuous
management and control of changes to baselines,
documentation, products, and other items.

Front 581

List the specific management phase tasks (steps 7-8)?

Back 581

7. Evaluation of performance: Review and assessment of
overall aspects of performance in technical, schedule,
cost, human resources, and other areas of performance
measurement for the project.
8. Status reporting: providing all stakeholders with timely
progress reports, including status of technical changes,
cost profiles, staffing/skills requirements, quality
indicators, schedule changes or slippage, scope
changes, and corrective actions.

Front 582

What does project monitoring provide?

Back 582

Project Monitoring activities provide for metrics
collection, evaluation, comparison, and reporting on
all aspects of project performance to stakeholders
(includes owners, sponsors, staff, and others).

Front 583

What does effective and timely monitoring provide?

Back 583

Effective and timely monitoring is crucial to
facilitating problem resolution, corrective action
planning and execution, and provides the analytical
basis for understanding and correcting variances to
baseline.

Front 584

What three project management activities occur in parallel?

Back 584

Managing Project Execution
Milestone Achievement
Continuous Risk Assessments

Front 585

What is managing project execution?

Back 585

This is the part where the Project Manager
assumes ownership and accountability for
project success. He uses “referent” authority to
influence all the key participants and steer the
whole venture towards a successful conclusion.

Front 586

What is milestone achievement?

Back 586

To the extent that milestones are generally
achieved in a serial rather than a parallel
fashion, one milestone must normally be fully
completed before the next can commence.
Consequently, the project manager is obliged to
focus heavily on whatever is the current
milestone. Remember - payments are
frequently tied to milestone achievement.

Front 587

What is continuous risk assessments?

Back 587

In line with a highly preventive management
approach, continual risk assessments need to
be carried out to identify risk categories, risk
events, likelihood of occurrence, priorities for
attention and mitigation strategies.

Front 588

What is project closeout?

Back 588

This step is extremely important because
close-out and final payment can often be
difficult, if not planned properly. Some tips
below on how to close-out effectively.
~ Understand the acceptance criteria for close-out.
~ Initiate early talks to gain clear visibility of any concerns.
~ Work to ensure that problem areas are cleared up in time.
~ Seek opportunities for the client to gain leverage after
completion.
~ Avoid paying sub-contractors until customer accepted work.
~ Do lessons learned exercise to capture improvement ideas.
~ Be sure to thank all the outstanding contributors.

Front 589

What are the prescribed technical management documents?

Back 589

~ Statement of Work (SOW)
~ Project/Program Management Plan (PMP)
~ The Systems Engineering Management Plan (SEMP)
~ Work Breakdown Structure (WBS)
~ Statement of Milestones
~ Cost, Schedule, Resource and other projections
~ Quality Management Plan (QMP or QA Plan)
~ Configuration Management Plan (CMP)
~ Project Risk Management Plan (RMP)

Front 590

What is a Statement of Work (SOW)?

Back 590

The SOW provides the details regarding what is to
be performed or delivered as a result/product:
~ Summary statement of the tasks to be accomplished
~ Identification of the input requirements from other tasks
~ References to applicable specifications, standards,
procedures, and related documentation
~ Description of specific results to be achieved and a
proposed schedule of delivery
Often is used to measure contractual obligations
and compliance.

Front 591

What is a Program Management Plan (PMP)?

Back 591

The PMP covers all the planning a high level and
leads to low-level planning for specific activities

Front 592

What are the major components of a PMP?

Back 592

~ Systems Engineering Management Plan (SEMP)
~ Security Systems Engineering Plan (SSEP)
~ Work Breakdown Structure (WBS)
~ Costing and budgeting plans
~ Testing plans

Front 593

What is a Systems Engineering Management Plan (SEMP)?

Back 593

The SEMP is the integrated “living” master plan that
provides the central repository that binds together
all subordinate plans, tasks, and other work
elements. It contains:
~ Who is doing a thing or things
~ What things are done, in progress, to start…
~ When these things will start, or finish
~ Where the people, resources, documentation etc. are
~ How things are being organized and accomplished
(The RFP/SOW contain and outline the “why” )

Front 594

In general what is included in the SEMP?

Back 594

~ Baselines for cost, schedule, and resources
~ Requirements analysis and Planned Deliverables
~ Standards and procedures (e.g. ISO, MIL, NIST)
~ Business case trade-offs, cost-effectiveness analyses
~ Project taxonomy and glossary
~ Organizational structure (internal and external relationships)
~ Allocations & constraints (resource, technical, scheduling, etc)
~ Design requirements validation (Is it what we want?)
~ Functional analysis and verification (Does it do what it is
supposed to do?)
~ Life-cycle support information and considerations (transition
and operational)

Front 595

What is a Work Breakdown Structure (WBS)?

Back 595

WBS describes how all the essential tasks of the
project will be defined (including dependencies),
assigned, and scheduled to members of the team.

Front 596

In general, who many hierarchical activity levels are assigned to a WBS and what are they?

Back 596

3 levels
~ Level 1 – Identifies the entire program scope of work
to be produced
~ Level 2 – Identifies the various activities and
categories of the entire program
~ Level 3 – Identifies the specific tasks of each category

Front 597

What is a statement of milestones?

Back 597

Statement of Milestones derives from the SOW,
and describes in detail:
~ What is to be delivered by which activities and to
whom
~ What the agreed deliverable content will be
~ The schedule on which the milestone will be
achieved
All of which is subject to alteration and variance by
change or environmental factors

Front 598

What is cost control?

Back 598

Cost control requires effective management,
including:
~ Cost estimating
~ Cost accounting
~ Cost monitoring
~ Cost analysis and reporting
~ Control functions

Front 599

What is schedule estimating?

Back 599

Schedule Estimating requires knowledge of
technical task execution and interdependencies,
and uses:
~ Activity definition (what must be done)
~ Activity sequencing (order, precursors, successors)
~ Resource requirements and estimation
~ Activity duration
~ Input requirements and output expectations
~ Risk factors to schedule, cost, flow

Front 600

What is a Quality Management Plan?

Back 600

The QMP is the authoritative plan (integrates upward into
the SEMP) that provides the central control for how
“quality” is to be achieved throughout the project and in the
final delivered product(s) and deliverables.

Front 601

What is the definition of quality?

Back 601

“Quality” is defined as “the degree to which a set of
inherent characteristics [of performance, of appearance, or
other] satisfy a set of requirements”.

Front 602

What is quality management?

Back 602

“Quality Management” is the process by which
stakeholder needs, wants, and expectations are
transformed into requirements that can then be executed
and met by the project. “Quality Control” processes
monitor and track this.

Front 603

What are the components of a QMP?

Back 603

The QMP will contain the framework necessary to
implement, monitor, correct, and report on this aspect of
overall project management and deliverables:
~ Standards to be employed (i.e. ISO 9000 or 10006)
~ Data elements and metrics to be collected
~ Analytical processes to be used (stat, financial, etc)
~ Benchmarks, comparators, KPI, CSF and other
analytics
~ Corrective Action Plans and progress reports
~ An interface to the Change Management process to
assure awareness and capture of impacts to the SEMP

Front 604

What is a configuration management plan (CMP)?

Back 604

The CMP is the authoritative plan (that integrates upward
into the SEMP) that provides the central control for how
changes (in their infinite variety) will be identified, evaluated,
escalated, implemented, tracked and controlled continuously
throughout the SEMP execution.

Front 605

Why must change be managed?

Back 605

Change as a factor having impact on all aspects of the
project must be recognized as inevitable, but must be
managed to avoid unacceptable deviations and adverse
impact to schedule, cost, quality, or other factors that
ultimately compromise achievement of project objectives.

Front 606

What are the components of a CMP?

Back 606

CMP as used by DoD describes a process with five
components regarding configuration items (CI) and managing
the potential impact of change to operations:
~ Management and Planning: approved and documented in
PMP
~ CI Identification: selection criteria and documentation
~ Configuration Control: the CM process to ensure no
unmanaged change occurs
~ Status Accounting: the system for tracking change to
baseline
~ Verification and Audit: provides interface and feedback to
QA/QM

Front 607

What is a risk management plan (RMP)?

Back 607

RMP describes the plan (that integrates upward into the
SEMP) for identifying risks, threats-agents, physical,
environmental, and other sources of risk are anticipated or
identified throughout the project lifecycle, including:
~ Assessment and review processes and responsible
roles
~ Reporting and documentation, including CM input
~ Controls and countermeasures use to mitigate,
reduce, and avoid
The RMP uses NIST SP 800-30 and OMB A130 as base
requirements and guidance.

Front 608

What is a Test and Evaluation Master Plan (TEMP)?

Back 608

Test and Evaluation Master Plan (TEMP) – Overall
description of test objectives:
~ Requirements for testing
~ Data to be collected and measured
~ Categories of tests
~ Methods and procedures to be used
~ Resources required for tests

Front 609

What are the general types of tests documented in a TEMP?

Back 609

General types of tests:
~ Preproduction (from initial stages forward)
~ Acceptance (customer acceptance and approval)
~ Operational (O&M SLC support)

Front 610

What is DT&E?

Back 610

Developmental testing (DT&E):
~ Analytical: conducted very early in SLC using
automated techniques and simulation
~ Type 1: laboratory bench-testing, intended to verify
performance and physical characteristics

Front 611

What is OT&E?

Back 611

Operational testing (OT&E):
~ Type 2: done in latter stages of detailed design (SUT)
~ Type 3: performed at initial qualification and prior to
completion of production (IVT&E)
~ Type 4: performed during operations and lifecycle
support phases

Front 612

What is a PERT schedule?

Back 612

The Program Evaluation and Review Technique
(PERT) is a scheduling tool that defines the critical
path (in red) through a project (zero float or slack)

Front 613

Draw a PERT node and example PERT schedule with critical path

Back 613

Check slide 501

Front 614

What is a Requirements Traceability Matrix (RTM)?

Back 614

Facilitates derivation of requirements from sources
(laws, FIPS, project needs, etc), showing source,
object, rationale, verification, validation, and execution,
traceable from the result back to the source

Front 615

What is a Gnatt chart?

Back 615

Gantt Charts depict project schedules and milestones in a
horizontal calendar, and shows task linkage, dependencies,
start-finish relationships, task overlap, slack and other project
attributes graphically (most often used PM tool)

Front 616

Name the development models recognized by ISSEP

Back 616

Water fall model
Vee model
Spiral model

Front 617

What are the pros and cons of the waterfall development model?

Back 617

PRO: Structured and understandable
CON: Rigid and not flexible
CON: Hard to manage complex projects

Front 618

What are the pros and cons of the Vee development model?

Back 618

PRO: Like IATF
PRO: Very flexible for adapting new stuff
CON: Lots of documentation

Front 619

What are the pros and cons of the spiral development model?

Back 619

PRO: Very flexible - prototyping
CON: Needs strong management
CON: Prone to “Production Paradox”

Front 620

What are the basic forms of risk?

Back 620

~ Project Risk [criticality]: systematic and non-systematic risk
factors that specifically threaten the timely, correct, and
cost-effective completion of the project
~ IT Risk [sensitivity]: normal factors of risk that threaten to disrupt
the CIA attributes of the IT involved (either as product
or as support to the project.

Front 621

Why is unmanaged change a risk?

Back 621

The rate of unmanaged change will eventually exceed the
rate of progress and endanger the project.

Front 622

What are the sources of change?

Back 622

Change has various sources: some is necessary, some
otherwise. Change is a serious risk factor of positive and
negative dimensions, and if not controlled can result in:
~ Increased cost
~ Scope creep
~ Schedule slippage
~ Excessive resource consumption
~ Unacceptable deliverables (content or quality)
~ Overall failure to complete on time, on budget, or at all

Front 623

What are the SSE-CMM project and organization process areas?

Back 623

PA12 – Ensure Quality
PA13 – Manage Configuration
PA14 – Manage Project Risk (threats to project success)
PA15 – Monitor and Control Technical Effort
PA16 – Plan Technical Effort
PA17 – Define Organization’s SE Process
PA18 – Improve Organization’s SE Process
PA19 – Manage Product Line Evolution
PA20 – Manage SE Support Environment
PA21 - Provide On-going skills and knowledge
PA22 - Coordinate with Suppliers

Front 624

What is the CMM IDEAL model?

Back 624

This model from C-M corresponds to an implementation
approach for achievement of the CMM levels:
I – Initiating: Lays foundation quality and process
improvements (CCM-1)
D – Diagnosing: Methods determine “AS IS” relative to
the “TO BE” (CMM-2)
E – Establishing: Planning how to attain the chosen
level of maturity (CMM-3)
A – Acting: Executing the plan and achieving the
desired results (CMM-4)
L – Learning: Continually improving what you do and
how you do it (CMM-5)

Front 625

What do the early phase levels of CMM provide?

Back 625

Early phase levels and processes lay foundations for
committed organizations to begin building in managerial,
technological, and operational structures and controls to
enable growth, advancement, and achievement of the higher
levels

Front 626

What are the early phase levels of CMM?

Back 626

Levels 1 & 2

Front 627

What do the later phase levels of CMM provide?

Back 627

Institutionalize processes, methods, techniques and tools to
continue building managerial, technological, and operational
structures and controls to maintain advancements and
continually learn and improve

Front 628

What are the later phase levels of CMM?

Back 628

Levels 3 - 5

Front 629

What are the major sections of an IEEE 1220 SEMP?

Back 629

I Scope
II Applicable Documents
III Systems Engineering Process (SEP) Application
IV Transitioning Critical Technologies
V Integration of Systems Engineering Effort
VI Additional Systems Engineering Activities
VII Notes
Appendices

Front 630

What are the subsections of section III of an IEEE 1220 SEMP?

Back 630

Systems Engineering Process Planning
Requirements Baseline Validation
Functional Analysis
Functional Verification
Synthesis
Design Verification
Systems Analysis
Control

Front 631

What are the subsections of section V of an IEEE 1220 SEMP?

Back 631

Organizational Structure
Required Systems Engineering Integration Tasks

Front 632

What are the subsections of section VI of an IEEE 1220 SEMP?

Back 632

Long-lead Items
Design to Cost
Value Engineering
Systems Integration Design
Interface with Other Life-cycle Support Functions
Safety Plan
Other Plans and Controls

Front 633

What are the subsections of section VII of an IEEE 1220 SEMP?

Back 633

General Background Information
Acronyms and Abbreviations
Glossary

Front 634

What are the subsections of section "Systems Engineering Process Planning" of an IEEE 1220 SEMP?

Back 634

Major Deliverable and Results
Integrated Database
Specification Baseline
Process Inputs
Technical Objectives
System Breakdown Structure (SBS)
Training
Standards and Procedures
Resource Allocation
Constraints
Work Authorization
Requirements Analysis

Front 635

What are the subsections of section "Systems Analysis" of an IEEE 1220 SEMP?

Back 635

Trade-off Analysis
System/Cost-Effectiveness Analysis
Risk Management

Front 636

What are the subsections of section "Control" of an IEEE 1220 SEMP?

Back 636

Design Capture
Interface Management
Data Management
Systems Engineering Master Schedule
Technical Performance Measurement
Technical Reviews
Supplier Control
Requirements Traceability