NIST Updates RMF to Incorporate Privacy Considerations
Interesting press release just put out stating that NIST is updating the RMF to incorporate privacy considerations. Full release can be found here.
RMF Training Coming Back to Pensacola Florida
From May 7 – 10, 2018, IT Dojo will be bringing RMF for DoD IT training to Pensacola, FL! Our last course that ran there a few months ago was in such high demand that we decided to come back! This instructor-led course will get you up to speed on what to expect as you…
NIST 171—What’s That?
By Kathryn Daily, CISSP, RDRP If you heard a whooshing sound on New Years Eve, that was probably the deadline for compliance with NIST 171 flying by. A lot of you might be asking “What is NIST 171?” NIST 171 is a set of requirements documented in the NIST Special Publication 800-171 (Protecting Controlled Unclassified…
Top Ten—Differences Between RMF and CSF
By P. Devon Schall, CISSP, RDRP I was reading an article recently about Cybersecurity Framework (CSF) and the continued confusion with Risk Management Framework (RMF). In the research, the consensus was the majority of government IT professionals don’t fully understand CSF or RMF and find it easy to confuse the two. As a follow up…
Understanding the Authorization Decision
By Lon Berman, CISSP of BAI Information Security If you ask most system owners about the desired outcome of their RMF efforts, they will readily tell you “we are expecting the Authorizing Official (AO) to sign an Authorization to Operate (ATO) for our system.” But how much do they really know about what goes into…
Security Control Spotlight—Contingency Planning
By Kathryn M. Daily, CISSP of BAI Information Security In this issue we will shine the spotlight on the Contingency Planning (CP) family of security controls. First, we’ll show you how the controls dictate the subject areas that need to be addressed in the organization/system’s disaster recovery and business continuity plans. Second, you’ll learn how…
RMF Training in Virginia Beach is Filling up!
Attention information assurance and cyber security professionals in Hampton Roads! IT Dojo is running an RMF for DoD IT training course in the Virginia Beach/Norfolk area July 11 – 14. Seating is limited, but this course is guaranteed to run! We have delivered this course to hundreds of individuals throughout the country and the response…
Top Ten—RMF “Lessons Learned”
By Lon J. Berman, CISSP BAI Information Security I recently had the pleasure of consulting for a DoD program that successfully navigated the RMF process and received a full three year Authorization to Operate (ATO). In lieu of … or in addition to … a victory party, the team decided it would be productive to…
Security Control Baseline “Tabletop Review”
By Lon J. Berman, CISSP at BAI Information Security Let’s take a look at some strategies for reviewing the Security Control Baseline and creating “action plans” for implementation. The “Raw Materials” An effective review starts with the right materials. You’ll need two spreadsheets to work with: Security Controls Assessment Procedures (CCIs) Using the Security Controls…
Security Control Spotlight—STIGs and Controls
By Kathryn M. Farrish, CISSP at BAI Inc. One of the primary goals of the RMF life cycle is for a system to achieve and maintain compliance with a baseline of Security Controls in accordance with NIST SP 800-53 and CNSSI 1253. Security controls provide specific safeguards in numerous subject areas (aka. “families”), including access…