FISMA and the Risk Management Framework by Gantz, Stephen D. -- Read -- Imperial Library of Trantor

Index

Cover image Title page Table of Contents Copyright Dedication Trademarks Acknowledgements About the Author Chapter 1. Introduction

Introduction FISMA Applicability and Implementation FISMA Provisions Strengths and Shortcomings of FISMA Structure and Content Relevant Source Material Summary References

Chapter 2. Federal Information Security Fundamentals

Information Security in the Federal Government Certification and Accreditation Organizational Responsibilities Relevant Source Material Summary References

Chapter 3. Thinking About Risk

Understanding Risk Trust, Assurance, and Security Risk Associated with Information Systems Relevant Source Material Summary References

Chapter 4. Thinking About Systems

Defining Systems in Different Contexts Perspectives on Information Systems Establishing Information System Boundaries Maintaining System Inventories Relevant Source Material Summary References

Chapter 5. Success Factors

Prerequisites for Organizational Risk Management Managing the Information Security Program Compliance and Reporting Organizational Success Factors Measuring Security Effectiveness Relevant Source Material Summary References

Chapter 6. Risk Management Framework Planning and Initiation

Planning Planning the RMF Project Prerequisites for RMF Initiation Establishing a Project Plan Roles and Responsibilities Getting the Project Underway Relevant Source Material Summary References

Chapter 7. Risk Management Framework Steps 1 & 2

Purpose and Objectives Standards and Guidance Step 1: Categorize Information System Step 2: Select Security Controls Relevant Source Material Summary References

Chapter 8. Risk Management Framework Steps 3 & 4

Working with Security Control Baselines Roles and Responsibilities Step 3: Implement Security Controls Step 4: Assess Security Controls Relevant Source Material Summary References

Chapter 9. Risk Management Framework Steps 5 & 6

Preparing for System Authorization Step 5: Authorize Information System Step 6: Monitor Security Controls Relevant Source Material Summary References

Chapter 10. System Security Plan

Purpose and Role of the System Security Plan Structure and Content of the System Security Plan Developing the System Security Plan Managing System Security Using the SSP Relevant Source Material Summary References

Chapter 11. Security Assessment Report

Security Assessment Fundamentals Performing Security Control Assessments The Security Assessment Report in Context Relevant Source Material Summary References

Chapter 12. Plan of Action and Milestones

Regulatory Background Structure and Content of the Plan of Action and Milestones Weaknesses and Deficiencies Producing the Plan of Action and Milestones Maintaining and Monitoring the Plan of Action and Milestones Relevant Source Material Summary References

Chapter 13. Risk Management

Risk Management Three-Tiered Approach Components of Risk Management Information System Risk Assessments Relevant Source Material Summary References

Chapter 14. Continuous Monitoring

The Role of Continuous Monitoring in the Risk Management Framework Continuous Monitoring Process Technical Solutions for Continuous Monitoring Relevant Source Material Summary References

Chapter 15. Contingency Planning

Introduction to Contingency Planning Contingency Planning and Continuity of Operations Information System Contingency Planning Developing the Information System Contingency Plan Operational Requirements for Contingency Planning Relevant Source Material Summary References

Chapter 16. Privacy

Privacy Requirements for Federal Agencies Under FISMA and the E-Government Act Federal Agency Requirements Under the Privacy Act Privacy Impact Assessments Protecting Personally Identifiable Information (PII) Other Legal and Regulatory Sources of Privacy Requirements Relevant Source Material Summary References

Chapter 17. Federal Initiatives

Network Security Cloud Computing Application Security Identity and Access Management Other Federal Security Management Requirements Relevant Source Material Summary References

Appendix A. References

References

Appendix B. Acronyms

Acronyms and Abbreviations

Appendix C. Glossary

Glossary

Index