A central point for collection of information that relates to computer security. Including, but not limited to, security advisories from the major vendors, major data breaches, “phishing” alerts, commentary regarding staffing levels. etc. etc.
final version of SP-800-53A revision 1
June 30, 2010 at 1:02 pm #104429
news release form NIST
NIST announces the publication of Special Publication 800-53A, Revision 1, Guide for Assessing the Security Controls in Federal Information Systems and Organizations.
June 29, 2010
Special Publication 800-53A, Revision 1, provides guidelines for developing security assessment plans and associated security control assessment procedures that are consistent with Special Publication 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations, August 2009 (including updates as of May 1, 2010). This publication represents the third in a series of publications being developed under the auspices of the Joint Task Force Transformation Initiative, a partnership that includes NIST, the Intelligence Community (IC), the Department of Defense (DOD), and the Committee on National Security Systems (CNSS). The mission of the Joint Task Force is to develop a unified information security framework for the federal government and its contractors. The updated security assessment guideline incorporates best practices in information security from the DOD, IC, and Civil agencies and includes security control assessment procedures for both national security and non national security systems. The guideline for developing security assessment plans is intended to support a wide variety of assessment activities in all phases of the system development life cycle including development, implementation, and operation.
The important changes in Special Publication 800-53A, Revision 1, are part of a larger strategic initiative to focus on enterprise-wide, near real-time risk management—that is, managing risks from information systems in dynamic environments of operation that can adversely affect organizational operations and assets, individuals, other organizations, and the Nation. The increased flexibility in the selection of assessment methods, assessment objects, and depth and coverage attribute values empowers organizations to place the appropriate emphasis on the security control assessment process at every stage in the system development life cycle to include a robust continuous monitoring process. For example, carrying out an increased level of assessment early in the system development life cycle can provide significant benefits by identifying weaknesses and deficiencies in the information system early and facilitate more cost-effective solutions. Alternatively, allowing organizations to customize their assessment activities during continuous monitoring can place the right emphasis on the assessment of those security controls providing the greatest return on investment, adjusting to varying operational environments and threats. As always, communities of interest may establish certain floors or ceilings on the level of assessment activities based on mission/business needs.
Finally, NIST in coordination with its partners in the Joint Task Force, plans to update and post to the FISMA Implementation Project web site, Assessment Cases for the assessment procedures in Appendix F as described in Special Publication 800-53A, Appendix H, providing organizations and assessors with additional detail in conducting specific assessments of federal information systems. NIST will provide ongoing progress reports regarding updates for the assessment cases.
You must be logged in to reply to this topic.