03.15.01E Security Architecture

Statement

• Develop a security architecture for the system that:

  • Describes the security requirements and approach to be taken for protecting the confidentiality, integrity, and availability of CUI,

  • Describes how the architecture is integrated into and supports the enterprise architecture, and

  • Describes any assumptions about, and dependencies on, external systems and services.

• Review and update the security architecture {{ insert: param, A.03.15.01E.ODP.01 }} to reflect changes in the enterprise architecture.

• Reflect planned security architecture changes in system security plans, concept of operations, criticality analysis, organizational procedures, and procurements and acquisitions.

Guidance

The security architecture at the system level is consistent with the organization-wide security architecture, which is integral to and developed as part of the enterprise architecture. The security architecture includes an architectural description, the allocation of security functionality (i.e., safeguards and countermeasures), security-related information for external interfaces, information being exchanged across the interfaces, and the protection mechanisms associated with each interface. The architectures can also include other information, such as user roles and the access privileges assigned to each role; security requirements; types of information processed, stored, and transmitted by the system; cybersecurity supply chain risk management (CSCRM) requirements; restoration priorities of information and system services; and other protection needs. With the use of modern computing technologies, it is becoming less common for organizations to control all information resources. There may be key dependencies on external services and service providers. Describing such dependencies as part of the security architecture is necessary for developing a comprehensive CUI protection strategy. Establishing, documenting, and maintaining a baseline configuration for organizational systems under configuration control is critical to implementing and maintaining an effective security architecture. Guidance on developing trustworthy, secure, and cyber-resilient systems using systems security engineering practices and security design concepts is provided in SP 800-160v2 .23. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

a security architecture for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of CUI is developed.

Assessment objective

a security architecture for the system that describes how the security architecture is integrated into and supports the enterprise architecture is developed.

Assessment objective

a security architecture for the system that describes any assumptions about and dependencies on external systems and services is developed.

Assessment objective

the security architecture is reviewed and updated {{ insert: param, A.03.15.01E.ODP.01 }} to reflect changes in the enterprise architecture.

Assessment objective

planned security architecture changes are reflected in system security plans, concept of operations, criticality analyses, organizational procedures, procurements, and acquisitions.

Assessment method

• Security planning policy procedures addressing information security architecture development procedures addressing information security architecture reviews and updates enterprise architecture documentation information security architecture documentation system security plan security CONOPS for the system records of information security architecture reviews and updates other relevant documents or records

Assessment method

• Personnel with security planning and plan implementation responsibilities personnel with information security responsibilities personnel with information security architecture development responsibilities

Assessment method

• Mechanisms supporting and/or implementing the development, review, and update of the information security architecture processes for developing, reviewing, and updating the information security architecture

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final