10.20.1RA-1 – Risk Assessment Policy and Procedures
Program-specific policies and procedures shall be included in the specific security controls listed below. There is no requirement for the Program to develop additional policy to meet the -1 control.
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
The ISSM shall work with Program in determining the appropriate security categorization as part of the initial preparatory actions prior to selecting and tailoring the security controls.
The organization:
Categorizes information and the information system in accordance with applicable federal laws, Executive Orders, and directives, policies, regulations, standards, and guidance
Click here to enter text.
Documents the security categorization results (including supporting rationale) in the SSP for the information system
Click here to enter text.
Ensures that the security categorization decision is reviewed by the SCA and approved by the AO/AO-Representative
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
The Risk Assessment Report (RAR) is part of the required Body of Evidence (BoE) provided to the DAO as the basis of the authorization to operate decision. The RAR should be initiated prior to or during Step 1, Security Categorization.
The organization:
Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits
Click here to enter text.
Documents risk assessment results in the Risk Assessment Report (RAR)
Click here to enter text.
Reviews risk assessment results at least annually
Click here to enter text.
Disseminates risk assessment results to the SCA for initial review and to the AO/AO-Representative for final approval
Click here to enter text.
Updates the risk assessment at least annually or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
Information revealing specific vulnerabilities (other than the known vulnerabilities of widely available commercial products) and the compiled results of vulnerability analyses for systems shall be classified in accordance with the Program SCG.
Organizations shall use vulnerability assessment tools, such as the SCAP Security Scanner (SCC) with current benchmarks. The ISSM/ISSO shall analyze vulnerability scans to determine true vs. false positives. True vulnerabilities identified as part of a scan shall be added to the POA&M.
The organization:
Scans for vulnerabilities in the information system and hosted applications at least quarterly and when new vulnerabilities potentially affecting the system/applications are identified and reported
Click here to enter text.
Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: Enumerating platforms, software flaws, and improper configurations; Formatting checklists and test procedures; and Measuring vulnerability impact
Click here to enter text.
Analyzes vulnerability scan reports and results from security control assessments
Click here to enter text.
Remediates legitimate vulnerabilities based on guidance provided by the IAVM Program or AO in accordance with an organizational assessment of risk
Click here to enter text.
Shares information obtained from the vulnerability scanning process and security control assessments with the AO/AO-Representative and the SCA to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies)
Click here to enter text.
Updates the POA&M with true vulnerabilities identified during scanning
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.
Click here to enter text.
CONTINUOUS MONITORING STRATEGY
Click here to enter text.
10.20.4.2RA-5(2) – Vulnerability Scanning: Update by Frequency/Prior to New Scan/When Identified
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
The organization updates the information system vulnerabilities scanned as new automated tool scripts are issued; within 30 days prior to running scans; prior to a new scan; when new vulnerabilities are identified and reported. This control supports insider threat mitigation.
Click here to enter text.
CONTINUOUS MONITORING STRATEGY
Click here to enter text.
10.20.4.3RA-5(4) – Vulnerability Scanning: Discoverable Information
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
The organization determines what information about the information system is discoverable by adversaries and subsequently documents the information, determines potential risk, and takes corrective action to mitigate the vulnerabilities.
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
Organizations shall provide privileged access authorization to all systems and infrastructure components for vulnerability scanning activities to facilitate more thorough scanning.
Click here to enter text.
CONTINUOUS MONITORING STRATEGY
Click here to enter text.
10.20.4.5RA-5(7) – Vulnerability Scanning: Automated Detection and Notification of Unauthorized Components – WITHDRAWN Incorporated into CM-8
