New IT security guidelines focus on real-time risk management
Connecting state and local government leaders
Guidance for assessing IT security controls required under FISMA has been revised by NIST to emphasize real-time risk management and to harmonize security requirements across government.
The National Institute of Standards and Technology has released revised guidelines for assessing security controls for government information technology systems to emphasize real-time risk management.
Special Publication 800-53A, Revision 1, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, is part of an interagency effort to not only improve situational awareness of IT security, but also to harmonize security requirements across government for national security and civilian systems.
The controls are required under the Federal Information Security Management Act for civilian IT systems not designated as vital to national security. NIST produces standards and guidance for FISMA compliance, but these standards now are being coordinated with other agencies to create a single set of security requirements.
Related stories:
Better cybersecurity depends on better information management
Continuous monitoring guidance under way at NIST
The updated guidelines incorporate best practices in information security from the military and intelligence communities, as well as civilian agencies, and include security control assessment procedures for both national security and non-national security systems. The document is intended to support a variety of assessment activities in all phases of the system life cycle, including development, implementation, and operation.
“A common foundation for information security will provide the intelligence, defense and civil sectors of the federal government and their contractors, more uniform and consistent ways to manage the risk to organizational operations and assets, individuals, other organizations, and the nation,” NIST officials wrote in introducing the publication. “A common foundation for information security will also provide a strong basis for reciprocal acceptance of security authorization decisions and facilitate information sharing.”
SP 800-53A Rev. 1 is the third publication developed by the Joint Task Force Transformation Initiative Working Group, composed of representatives from NIST, the departments of Defense and State, the Office of the Director of National Intelligence, and the Committee on National Security systems. The 399-page document is a companion to the recently revised SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations, and both are part of a broader Risk Management Framework for IT security.
SP 800-53 Rev. 3 covers selection of appropriate IT security controls for risk management, and SP 800-53A Rev. 1 covers the assessment and monitoring of the controls. Assessing security controls after they have been put in place is an essential part of the risk management process.
“The findings produced by assessors are used to determine the overall effectiveness of the security controls associated with an information system (including system-specific, common and hybrid controls) and to provide credible and meaningful inputs to the organization’s risk management process,” the document states.
Significant changes in the new publication include updated assessment procedures for security controls; elimination of the Extended Assessment Procedure; establishing a simpler common nomenclature for some attributes; and elimination of some designators in the assessment procedures catalog to give greater flexibility in selecting appropriate assessment methods.
The added flexibility is intended to allow organizations to tailor and supplement basic assessment procedures and avoid unnecessarily complex or costly efforts, at the same time meeting FISMA requirements and maintaining consistency, according to NIST.
A companion effort to the assessment guidelines is the Assessment Case Development Project. This project is developing a representative set of assessment cases to provide organizations and assessors examples of each of the assessment procedures in the publication; and to provide a vehicle for ongoing review to promote continuous improvement. It also should help establish a basis for reciprocity among various communities of interest. The project is described in Appendix H of SP 800-53A.
NIST and the task force plan to update Web-based assessment cases described in Appendix H. Use of these cases and their predefined actions is not required, and agencies also have the flexibility of using more generalized procedures laid out elsewhere in the publication.
This article was corrected July 1, 2010. The third publication developed by the Joint Task Force Transformation Initiative Working Group was misidentified. It is SP 800-53A Rev. 1 The "A" was added.