03.12 Security Assessment and Monitoring

Statement

Assess the security requirements for the system and its environment of operation {{ insert: param, A.03.12.01.ODP.01 }} to determine if the requirements have been satisfied.

Guidance

By assessing the security requirements, organizations determine whether the necessary safeguards and countermeasures are implemented correctly, operating as intended, and producing the desired outcome. Security assessments identify weaknesses in the system and provide the essential information needed to make risk-based decisions. Security assessment reports document assessment results in sufficient detail as deemed necessary by the organization to determine the accuracy and completeness of the reports. Security assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted.

Assessment objective

the security requirements for the system and its environment of operation are assessed {{ insert: param, A.03.12.01.ODP.01 }} to determine if the requirements have been satisfied.

Assessment method

• security assessment and monitoring policy and procedures procedures for security assessment planning security assessment plan security assessment report system security plan other relevant documents or records

Assessment method

• personnel with security assessment responsibilities personnel with information security responsibilities

Assessment method

• mechanisms for supporting security assessments, processes for security assessment plan development, or security assessment reporting

Statement

• a. Develop a plan of action and milestones for the system:

  • 01. To document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments and

  • 02. To reduce or eliminate known system vulnerabilities.

• b. Update the existing plan of action and milestones based on the findings from:

  • 01. Security assessments,

  • 02. Audits or reviews, and

  • 03. Continuous monitoring activities.

Guidance

Plans of action and milestones (POAMs) are important documents in organizational security programs. Organizations use POAMs to describe how unsatisfied security requirements will be met and how planned mitigations will be implemented. Organizations can document system security plans and POAMs as separate or combined documents in any format. Federal agencies may consider system security plans and POAMs as inputs to risk-based decisions on whether to process, store, or transmit CUI on a system hosted by a nonfederal organization.

Assessment objective

a plan of action and milestones for the system is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments.

Assessment objective

a plan of action and milestones for the system is developed to reduce or eliminate known system vulnerabilities.

Assessment objective

the existing plan of action and milestones is updated based on the findings from security assessments.

Assessment objective

the existing plan of action and milestones is updated based on the findings from continuous monitoring activities.

Assessment objective

the existing plan of action and milestones is updated based on the findings from audits or reviews.

Assessment method

• security assessment and monitoring policy and procedures procedures for plans of action and milestones security assessment plan security assessment report security assessment evidence plan of action and milestones system security plan other relevant documents or records

Assessment method

• personnel with plans of action and milestones development and implementation responsibilities personnel with information security responsibilities

Assessment method

• mechanisms for developing, implementing, and maintaining plans of action and milestones

Statement

Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.

Guidance

Continuous monitoring at the system level facilitates ongoing awareness of the system security posture to support risk management decisions. The terms continuous and ongoing imply that organizations assess and monitor their systems at a frequency that is sufficient to support risk-based decisions. Different types of security requirements may require different monitoring frequencies.

Assessment objective

a system-level continuous monitoring strategy is developed.

Assessment objective

a system-level continuous monitoring strategy is implemented.

Assessment objective

ongoing monitoring is included in the continuous monitoring strategy.

Assessment objective

security assessments are included in the continuous monitoring strategy.

Assessment method

• security assessment and monitoring policy and procedures organizational continuous monitoring strategy system-level continuous monitoring strategy procedures for continuous monitoring of the system procedures for configuration management security assessment report plan of action and milestones system monitoring records configuration management records impact analyses status reports system security plan other relevant documents or records

Assessment method

• personnel with continuous monitoring responsibilities personnel with information security responsibilities system administrators

Assessment method

• mechanisms for implementing continuous monitoring mechanisms for supporting response actions for assessment and monitoring results mechanisms for supporting security status reporting

Statement

• a. Approve and manage the exchange of CUI between the system and other systems using {{ insert: param, A.03.12.05.ODP.01 }}.

• b. Document interface characteristics, security requirements, and responsibilities for each system as part of the exchange agreements.

• c. Review and update the exchange agreements {{ insert: param, A.03.12.05.ODP.02 }}.

Guidance

Information exchange applies to information exchanges between two or more systems, both internal and external to the organization. Organizations consider the risks related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security requirements or policies. The types of agreements selected are based on factors such as the relationship between the organizations exchanging information (e.g., government to government, business to business, government to business, government or business, or government or business to individual) and the level of access to the organizational system by users of the other system. The types of agreements can include information exchange security agreements, interconnection security agreements, memoranda of understanding or agreement, service-level agreements, or other types of agreements. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (e.g., service providers, contractors, system developers, and system integrators). The types of information contained in exchange agreements include the interface characteristics, security requirements, controls, and responsibilities for each system.

Assessment objective

the exchange of CUI between the system and other systems is approved using {{ insert: param, A.03.12.05.ODP.01 }}.

Assessment objective

the exchange of CUI between the system and other systems is managed using {{ insert: param, A.03.12.05.ODP.01 }}.

Assessment objective

interface characteristics for each system are documented as part of the exchange agreements.

Assessment objective

security requirements for each system are documented as part of the exchange agreements.

Assessment objective

responsibilities for each system are documented as part of the exchange agreements.

Assessment objective

exchange agreements are reviewed {{ insert: param, A.03.12.05.ODP.02 }} .

Assessment objective

exchange agreements are updated {{ insert: param, A.03.12.05.ODP.02 }} .

Assessment method

• access control policy and procedures procedures for system connections system and communications protection policy and procedures system interconnection security agreements information exchange security agreements service-level agreements memoranda of understanding or agreements non-disclosure agreements system design documentation enterprise architecture security architecture system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with development, implementation, and approval responsibilities for system interconnection agreements personnel who manage systems to which the exchange agreements apply personnel with information security responsibilities