NIST SP 800-137A 日本語訳

NIST Special Publication 800-137A

Developing an ISCM Program Assessment

Kelley Dempsey Victoria Yan Pillitteri Chad Baer Robert Niemeyer Ron Rudman Susan Urban

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-137A

NIST Special Publication 800-137A

Developing an ISCM Program Assessment

Kelley Dempsey

Victoria Yan Pillitteri

Computer Security Division

Information Technology Laboratory

Chad Baer

Cybersecurity and Infrastructure Security Agency U.S. Department of Homeland Security

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-137A

May 2020

Robert Niemeyer

Ron Rudman

Susan Urban

The MITRE Corporation

McLean, VA

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-137A Natl. Inst. Stand. Technol. Spec. Publ. 800-137A, 78 pages (May 2020) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-137A

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

原本PDFの抜粋画像

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA).

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

This publication describes an approach for the development of Information Security Continuous Monitoring (ISCM) program assessments that can be used to evaluate ISCM programs within federal, state, and local governmental organizations and commercial enterprises. An ISCM program assessment provides organizational leadership with information on the effectiveness and completeness of the organization’s ISCM program, including the review of ISCM strategies, policies, procedures, operations, and analysis of continuous monitoring data. The ISCM assessment approach can be used as presented or as the starting point for an organization-specific methodology. It includes example evaluation criteria and assessment procedures that can be applied to organizations.

assessment; assessment element; assessment methodology; assessment procedure; continuous monitoring; information security continuous monitoring; ISCM program; ISCM program assessment.

The authors wish to thank Jeff Finke and Tracy Teter (The MITRE Corporation), Eduardo Takamura (NIST), and Martin Stanley and Alan McClelland (Cybersecurity and Infrastructure Security Agency) for their detailed reviews of this publication. The authors also gratefully acknowledge the contribution of the Cybersecurity Assurance Branch at the Cybersecurity and Infrastructure Security Agency (CISA), whose members piloted the initial version of the ISCM methodology on which this publication is based, and wish to thank the Cybersecurity Division of CISA for sponsoring the development of this publication. In addition, a special note of thanks goes to Jim Foti, Lorin Smith, Isabel Van Wyk, and the NIST web team for their outstanding administrative support.

Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

To effectively manage cybersecurity risks, organizations require ongoing awareness of their information security posture, vulnerabilities, and threats.¹ To achieve this awareness and better manage risks, organizations implement Information Security Continuous Monitoring (ISCM) capabilities under the direction of an ISCM program. An ISCM program defines, establishes, implements, and operates the various aspects of ISCM to provide the organization with the information necessary to make risk-based decisions regarding security status at all organizational risk management levels (organization level, mission and business process level, and system level).

Organizations need a way to determine and evaluate if an established ISCM program is effectively managing the organization’s security posture commensurate with risk. This publication describes one approach to developing an ISCM program assessment based on evaluation criteria derived from multiple sources, (including NIST Special Publications (SP) 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, SP 800-37, Risk Management Framework for Information Systems and Organizations: A Life Cycle Approach for Security and Privacy, SP 800-39, Managing Information Security Risk: Organization, Mission and Information System View, and Office of Management and Budget (OMB) Circulars and Memoranda). An ISCM program assessment developed under guidance in this publication evaluates the ISCM program itself (i.e., the structure and governance of the ISCM program),not the results of the ISCM program or the continuous monitoring technologies used. An effective ISCM program assessment provides consistent results regardless of the entity conducting the assessment. This publication does not prescribe the assessment of individual controls nor the examination of control assessment results as part of the ISCM program assessment.

The overarching goal of the ISCM program assessment is to provide organizations with recommendations to improve the ISCM program and thereby manage and reduce organizational risk. An ISCM program assessment provides a means for evaluating an organization’s ISCM strategies, policies, procedures, implementations, operational procedures, analytical processes, specific reporting, results presentation, risk assessment and risk scoring, risk response, and the ISCM program improvement process. An ISCM program assessment may be developed by an organization to evaluate its own ISCM program or by an independent assessment organization.

Creating or adopting and using an ISCM program assessment can help reduce overall risk to organizations by identifying gaps in an ISCM program, in the implementation of an ISCM program, or in the operational use of ISCM results. In addition, an ISCM program assessment can indicate the level of readiness for system-level ongoing authorization.

This publication:

Under the Federal Information Modernization Act of 2014 (FISMA) [FISMA2014] and Office of Management and Budget (OMB) Circulars and Memoranda,² federal agencies are directed to implement a program to continuously monitor organizational information security status. A comprehensive continuous monitoring program serves as a risk management and decision support tool used at each level of an organization. Strategies and business objectives at the organizational level direct activities needed at the mission and business levels as well as system level functions and technologies implemented in support of continuous monitoring.

NIST Special Publication (SP) 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations [SP800-137], defines information security continuous monitoring (ISCM) as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. An ISCM program defines, establishes, implements, and operates the various aspects of ISCM to provide the organization with the information necessary to make risk-based decisions regarding security status at all three organizational risk management levels.

To effectively address increasing security challenges, the ISCM program:

This publication, NIST SP 800-137A, provides guidance on how an organization can assess ISCM program completeness and effectiveness, and detect deficiencies in its ISCM program. The goal of the ISCM program assessment is to provide a means for evaluating organizational ISCM program elements, including the review of ISCM strategies, policies, procedures, implementation planning, ISCM metrics, analytical processes, specific results presentation and reporting, risk response, and the ISCM improvement process. The approach used throughout this publication is based on the concepts and principles of [SP800-137] and the ISCM requirements mandated for federal organizations.

The term assessment is used in two ways in this publication. Assessment may refer to the completed action of ISCM program evaluation or to the vehicle that is reused for each evaluation (e.g., a template or blank worksheet). The context in which the term is used conveys the applicable meaning.

Organizations face the continual challenge of providing timely and complete security information with which to make risk-based management decisions, which is the objective of the ISCM program. An effective ISCM program produces timely, security-related information that is accurate and complete for presentation to decision makers at multiple levels of the organization. At the organizational level, it may not be well understood how, where, or why the ISCM program fits into the organization-wide risk management strategy. It is crucial for the organization’s leadership to understand how business needs and capabilities drive the ISCM program. In many cases, capabilities needed for organizational continuous monitoring may already exist within the organization. However, without a comprehensive strategy to formally codify monitoring capabilities as enabling ISCM functions, a true ISCM program does not exist.

Organizations need a method for evaluating what has been planned, developed, or acquired to implement ISCM, particularly if the ISCM program is developed internally. This helps determine whether the organization’s ISCM program is adequate and if the investment is providing value.

To determine the effectiveness of an organization’s ISCM program, the organization develops and uses a formal assessment for evaluation that provides organizational leadership with information about how well the ISCM program meets its intended objectives. An ISCM program assessment may be comprised of evaluation criteria, judgments, and scores about specific aspects of ISCM capabilities as well as conclusions based on an analysis of the collected data. An ISCM program assessment may also provide recommendations to the organization based on assessment results.

Under sponsorship of the Cybersecurity and Infrastructure Security Agency (CISA)⁴ and in conjunction with the National Cybersecurity Center of Excellence (NCCoE)⁵ at NIST, CISA initiated development of an ISCM program assessment process based primarily on [SP800-137], published by the NIST Computer Security Division (CSD).

原本PDFの抜粋画像

The assessment process, which is presented in more detail in the forthcoming NIST Interagency or Internal Report (NISTIR) 8212 [NISTIR8212], was developed for use by CISA and federal agencies. The ISCM program assessment process can be tailored for use by federal agencies, commercial organizations, and non-federal governmental organizations. Using [NISTIR8212] as a guide, an organization may choose to adopt the same approach to evaluating ISCM plans and solutions to supplement the guidance in NIST SP 800-137A.

This publication:

In addition, the guidance presented in this publication can be used to produce an ISCM program assessment to:

This publication serves individuals associated with the continuous monitoring of information security posture and organizational risk management, including:

This publication addresses the entire ISCM program assessment process and is used to evaluate the establishment and operation of ISCM programs across organizations. The assessment of individual controls and the examination of control assessment results is outside of the scope of the ISCM program assessment.

There are many ways to evaluate an organizational program or system against a set of criteria. This publication specifies one approach for developing assessments for doing so based on evaluation criteria derived from multiple sources. The ISCM program assessment evaluates the structure and governance of the ISCM program and does not evaluate the continuous monitoring technologies or implementations themselves. An assessment developed under the guidance provided herein is technology-neutral, flexible, and scalable to be easily adopted by any organization and applied to any type of security monitoring technology. Organizations are encouraged to use the approach specified in this publication as a starting point to develop an assessment to better meet specific organizational needs.

It is assumed that the reader is familiar with the ISCM concepts described in [SP800-137] and has a working-level understanding of the NIST Risk Management Framework (RMF) as defined and amended in [SP800-37]. It is also assumed that the reader is familiar with risk management processes across the organization and organizational levels as defined and amended in NIST SP 800-39 [SP800-39], Managing Information Security Risk: Organization, Mission, and Information System View.

The remainder of this NIST Special Publication is organized as follows:

This section explains the fundamentals of the ISCM program assessment, a management process that provides a view into the adequacy and effectiveness of the:

The fundamentals presented in this section are integrated into an assessment process in Section 3.

The development process of the ISCM program assessment does not seek to evaluate the organization, its missions/business processes, and systems for every ISCM concept presented in [SP800-137]. Rather, the ISCM program assessment determines if the concepts, along with ISCM requirements levied on federal organizations by FISMA and OMB, are sufficiently addressed to permit a determination of ISCM program robustness.⁷ It should be noted that each organization or assessor developing an ISCM program assessment from the guidance in this publication is likely to produce different assessment criteria depending on what is important to the organization or assessor.

ISCM is an organization-wide responsibility first, then a system-level responsibility [SP800-37], which includes mission and business processes as well. Organization-wide continuous monitoring efforts begin with organizational leadership defining a comprehensive, organization-wide ISCM strategy that directly supports decision making within the risk executive function (RE(f)) and includes consistently managed metrics linked to each organizational risk management level.⁸ Only when an ISCM strategy is defined and adopted at the organizational level and intrinsically linked to the RE(f) can the ISCM program be established with the appropriate breadth and depth to provide all levels of the organization with clearly defined responsibilities. The organizational level strategy is supported by system-level ISCM strategies and, optionally, mission/business process ISCM strategies.

ISCM encompasses all of the people, policies, processes, technologies, and standards that are used to perform the continuous monitoring function. ISCM is an enabling process that supports or provides organizational sustainment in the face of cybersecurity threats and risks.

An adequately developed ISCM program identifies the specific activities at each level of the organization that enable an organization-wide ISCM function. To effectively support the overall ISCM effort, ISCM activities are consistently developed, deployed, and sustained with explicit mapping to the ISCM strategic objectives and risk management strategy for the entire organization.

The following subsections summarize important ISCM concepts and introduce how the ISCM program assessment relates to each concept. For additional information on developing and implementing ISCM, see [SP800-137].

ISCM goals include detection of anomalies and changes in the organization’s environments of operation and systems, visibility into assets, awareness of vulnerabilities and threats, knowledge of security control effectiveness, and security posture. To meet ISCM goals, tools, technologies, and manual and automated methods are implemented within the context of an ISCM architecture designed to deliver the required information in the appropriate context, at the right level of detail, and at the right frequencies. The key outcome of the ISCM program is to enable the collection, integration, analysis, and presentation of security-related information from all systems and their environments of operation across the organization to inform risk-based decision making.⁹

An effective ISCM program identifies manual and automated monitoring processes in the organization-wide ISCM strategy, integrates the processes and associated outputs, and incorporates results into a view of situational awareness. Where manual processes are used, the processes are verified so that they are repeatable and enable a consistent implementation. Automated processes, including the use of automated support tools, can make continuous monitoring more consistent, efficient, accurate, and cost-effective.

An effective ISCM program facilitates ongoing authorization and reauthorization decisions for systems [SP800-37], as discussed in Section 2.1.7. Security-related information collected during continuous monitoring is used to make updates to the authorization package and supporting artifacts for each applicable system. Updated artifacts provide evidence that the baseline controls continue to safeguard the system as originally planned.

NIST SP 800-137 organizes the ISCM process into six steps, as depicted in Figure 1 and explained below. It is important to note that any effort or process intended to support ongoing monitoring of information security across an organization begins with the development of a comprehensive ISCM strategy that encompasses technologies, processes, procedures, operating environments, and people.

Figure 1 – ISCM Process

The six ISCM steps are referred to as “process steps” in this publication and are:

The organization-wide, system-level, and optional mission/business process ISCM strategies are defined in the ISCM Define step. The organization-wide and optional mission/business process ISCM strategies are addressed in the RMF Prepare step for Level 1 and Level 2, and the system-level ISCM strategy is addressed in the RMF Select step for Level 3 (see [SP800-37]).¹⁰

ISCM applies to all three organizational risk management levels¹¹ defined in [SP800-39]:

Security-related information is obtained and acted on at Level 3, and is communicated to Levels 1 and 2 to be incorporated into organization-wide and mission/business process risk determinations. The ISCM program assessment verifies the flow of information between levels.

The RMF, defined by [SP800-37], is a disciplined and structured process that integrates information security and risk management activities into the system development life cycle for organizations and systems. Implementation of the ISCM program may rely on artifacts and processes implemented as part of the RMF and also provides input to the RMF steps to understand and manage risk. The assessment approach and assessment elements address any potential overlap and/or relationships.

The RMF Monitor step describes continuous monitoring, which is a critical part of the risk management process. Organizational continuous monitoring requirements can be met through implementation of ISCM, and ISCM can provide results that used in the identification of and risk response. In addition, an organization’s overall security architecture and accompanying security program are monitored through ISCM to ensure that organization-wide operations remain within an acceptable level of risk, despite any changes that occur. Timely, relevant, and accurate security-related information is vital, particularly when resources are limited and organizations must prioritize their efforts.

At Level 3, the RMF Monitor step and ISCM activities are closely aligned. The assessment methods relevant for implemented controls are the same, whether the assessments are performed solely in support of system authorization (the RMF Authorize step) or in support of a broader, more comprehensive continuous monitoring effort. System-level officials and staff conduct assessments and monitoring, analyzing results on an ongoing basis. The information obtained is leveraged at the organization, mission/business processes, and system levels to support risk management.

Although frequency requirements may differ, each organizational level receives the benefit of security-related information that is current and applicable to affected processes. RMF Monitor activities that are performed within the context of the ISCM program and support system risk determination on an ongoing basis are foundational for ongoing authorization (OA). When the ISCM program is found to be adequate for determining risk across all (or part) of the organization, ISCM supports OA across all (or part) of the organization. The ISCM program assessment verifies that applicable ISCM results, which may include relevant metrics, are made available to the OA process to make decisions about system authorization. OA is discussed in Section 2.1.7.

ISCM governance is part of overall organizational governance, which provides oversight to organizations by specifying authorities, responsibilities, accountability, and governing processes and procedures that facilitate implementation, enforcement, and continuous improvement of the ISCM governing processes. Governance, including ISCM governance, establishes lines of accountability throughout the organization at all risk-management levels.

ISCM governance is a conceptual organizing and planning structure for managing risk. It is linked to one or more senior officials or staff, such as the RE(f) or other accountable senior official (e.g., senior accountable official for risk management, senior agency information security officer [SAISO], senior agency official for privacy, and chief information officer [CIO]). The part of information security governance structure that addresses ISCM is aligned with other governance structures to ensure compatibility with established management practices within the organization and to increase overall effectiveness.

The ISCM program assessment verifies that ISCM governance policies and processes exist and are being followed. At Level 1, an assessment verifies that senior leaders recognize the importance of managing information security risk and establish appropriate governance structures relative to ISCM for managing such risk. The organization-wide ISCM strategy captures the ISCM governance structures.

Where the organization has decentralized governance (e.g., because of divergent mission or business needs or operating environments), mission/business process areas (Level 2)—while remaining consistent with the organization-wide ISCM strategy—may establish their own ISCM policies and processes, in whole or in part, particularly as they relate to risk management and information security decisions. With the decentralized governance model, it is important that the different levels of the organization share ISCM information as it relates to risk management decisions.

Metrics determined through ISCM provide important information about the security posture across the organization and relative to individual systems and inform the risk management process. See [SP800-137] for more information on ISCM metrics.¹²

The ISCM program assessment accommodates organization-defined metrics. The ISCM program assessment verifies that the ISCM program addresses the specification, development, maintenance, and sustainment of metrics. The ISCM program assessment also verifies that the organization: (i) specifies frequencies of collecting metrics data; (ii) determines metrics from data at Levels 1, 2, and 3; and (iii) applies the metrics as needed to make risk-based decisions. In addition, the ISCM program assessment verifies that ISCM metrics are reported to designated officials at each level who review the relevant metrics.

ISCM benefits the organization by facilitating OA, which streamlines the system authorization process and supports a more automated ability to make near real-time risk-based decisions on whether to continue system authorization. OA is defined as the subsequent (follow-on) risk determinations and risk acceptance decisions taken at agreed-upon and documented frequencies in accordance with the organization’s mission/business requirements and organizational risk tolerance. OA is fundamentally related to the ongoing understanding and acceptance of security risk and is dependent on a robust ISCM program.

Organizations make OA decisions for systems by leveraging security-related information gathered through the ISCM capability. A robust ISCM program defines, establishes, and implements a continuous process by which manual, automated, and procedural tools can be used to manage and govern the risks of operating authorized systems.

The ISCM program assessment verifies that ISCM information is available for making OA decisions. The ISCM program assessment verifies that:

An ISCM program assessment provides organizational leadership with information on the effectiveness and completeness of the organization’s ISCM program. ISCM program assessment results include an indication of how well the assessed organization (e.g., entire organization, mission/business process, or system) meets the evaluation criteria. Assessment results give indications of ISCM program adequacy and consistency. Results may also include recommendations for ISCM program design, implementation, operation, and governance that may need improvement.

The ISCM program assessment process is an information-gathering and evidence-analyzing activity. The information gathered and evidence examined can be used by an organization to:

The foundation of the ISCM program assessment is a set of assessment elements and their usage for making judgments about the ISCM program by the ISCM program assessor. An ISCM program assessment determines whether or how well the ISCM capability meets the requirements and objectives of ISCM as specified by the assessment elements.

The ISCM program assessment leverages the control assessment process performed on common controls, hybrid controls, and system-specific controls. The organization is evaluated on whether it has implemented the control assessment process. This publication does not prescribe the assessment of individual controls nor the examination of control assessment results as part of the ISCM program assessment. Organizations may incorporate additional assessment elements to evaluate the assessment of individual controls or the control assessment process, if desired, as part of the ISCM program assessment tailoring process. The rest of this section explains the components of the ISCM program assessment.

The ISCM program assessment defines the evaluation criteria applied to each aspect of the ISCM program being assessed (e.g., security status monitoring policy and procedures, common control assessment policy, configuration management procedures, security status reporting). The evaluation criteria defined by this publication establish the assessment element as the central component. ISCM program assessment elements are statements about various attributes of the ISCM program that are evaluated by the assessor. Each ISCM program assessment element is grounded in one of the six ISCM process steps summarized in Section 2.1.2. The complete set of ISCM program assessment elements is presented in the [Catalog] along with the attributes of each element. The following are examples of assessment elements:

ISCM-relevant statements extracted from the sources but that originally spanned more than one ISCM step are expressed as separate assessment elements—one (unique) element for each applicable process step. The assessment elements were also developed from other ISCM functionality and principles, such as those suggested by developer, operator, and assessor experience and federal guidance.

The [Catalog] provided with this publication is an extensive set of ISCM program assessment elements and is considered to be the minimum set of elements needed for a comprehensive ISCM program assessment. However, an assessment may be limited by the number of ISCM process steps or by the risk management level. Assessment elements that apply to any excluded ISCM process steps are not included in the set of assessment elements presented to the assessor.

Selection of elements depends on the scope of the assessment (explained in Section 2.3.2), which may be limited by the risk management level(s) or the ISCM process step as defined in Section 2.1.2. Two examples of limited-scope assessment with the selection of assessment elements are:

Some assessment elements of the ISCM program assessment are partially outside of the scope of the ISCM program. Such elements evaluate the use of information from the RMF process (e.g., current risk levels, risk tolerance level, threat and vulnerability information) while other elements evaluate the ISCM program’s capability to send security-related information (e.g., security status reports, security metrics) to inform the organization’s implementation of the RMF. A few assessment elements may overlap with certain [SP800-53] controls, but the ISCM program assessment does not consider or re-evaluate the effectiveness of individual controls.

The assessment elements and assessment procedures provided with this publication can be used by organizations or assessors as a starting point for developing assessments that produce evidence with the assurance needed to evaluate ISCM programs and determine if ISCM requirements embodied in the assessment criteria are met.

The assessment elements can also be used as requirements for an ISCM program under development. The elements can be used to guide the ISCM program design in terms of functionality and policies and procedures needed. The elements can also be used to evaluate an ISCM plan or design, such as ISCM technical architecture, operational procedures, and ISCM strategies.

The sources of ISCM program assessment elements are:

The sources are fully attributed in Appendix C and referenced in the Source Attribute column in the [Catalog]. Note that there may be multiple sources from which an assessment element was derived for an ISCM program assessment element.

The ISCM Program Assessment Element Catalog [Catalog] provides 128 assessment elements, each of which has an assessment procedure and other attributes as part of the element catalog entry. A total of 89 (70 %) of the assessment elements are derived from [SP800-137] and 39 (30 %) from the other listed sources.

原本PDFの抜粋画像

Each ISCM program assessment element has attributes to aid in the evaluation of the ISCM program implementation. Attributes are reflected in the ISCM Program Assessment Element Catalog as columns of a table. The following attributes are provided in the [Catalog] for each ISCM Program assessment element:

Each ISCM program assessment element has associated guidance in the form of the discussion attribute that provides supplemental guidance to assist in judgments about the assessment element and to clarify possible ambiguities in assessment element wording, potential assessment objects, what to look for with respect to specific objects, and sources of additional information. The discussion attribute and associated guidance is described in Section 3.3.

The ISCM Program Assessment Element Catalog [Catalog] is an information base in tabular form of all assessment elements defined for the ISCM program assessment. The rows in the Catalog contain the assessment elements with their attributes.

ISCM program assessment elements may be linked together to provide traceability from one element to one or more other elements related to the Parent attribute and based on a particular aspect of the ISCM program (e.g., security status monitoring or ISCM metrics). Assessment elements linked together to provide traceability are called a chain. Chains show the parent/child relationship of elements spanning two or more ISCM process steps.

Assessors may find it beneficial to trace paths through assessment elements by chains as they examine or interview assessment objects at the three organizational risk management levels. For example, one type of artifact or one set of interview questions covering a chain of assessment elements focuses on a narrow subject area (e.g., ISCM strategies) to help assessors make judgments more efficiently.

Figure 2 shows four examples of chains of similar assessment elements, each originating from the Define Step (element 1-032). The character string in the upper left corner of each element provides unique identification of an individual assessment element (with the first numeric character being the ISCM process step).

Figure 2 – Example of Chains

In the example of four chains in Figure 2, one chain—consisting of assessment elements 1-032, 2-016, and 3-019—links together assessment elements involving the completeness of ISCM-relevant data to be collected. The second chain—consisting of assessment elements 1-032, 2-017, and 3-020—links together assessment elements involving the timeliness of ISCM-relevant data. The third chain, consisting of 1-032 and 3-041, deals with automating this data. The fourth chain, consisting of 1-032 and 6-013, involves using this data in the review and update of the ISCM program.

In following the first chain (i.e., 1-032, 2-016, and 3-019), the first block is linked to the second, and the second block is linked to the third. An assessor may request artifacts that address the completeness of data collected, as specified in each assessment element of the chain as applicable. The artifacts may then be used to make judgments about all three assessment elements. In following the second chain, the sub-chain (2-017 and 3-020) has the same parent as the first chain (1-032) but is linked based on the timeliness of the data collected, and an assessor may request artifacts that address the timeliness of data collected. As with the first chain, the artifacts may then be used to make judgments about all three assessment elements in the chain, and similarly for the third chain. The assessor may request a demonstration of automated functionality or artifacts documenting automation. For the fourth chain, the assessor may request artifacts illustrating how data is used to evaluate the ISCM program.

Diagrams of the traceability chains are contained in the [Catalog]. These diagrams are arranged by ISCM aspect, such as chains addressing ISCM strategy management, metrics, and control assessment rigor. Assessing elements by aspect (subject), as represented by chains, can yield useful information, particularly when the assessment is scored according to that ISCM aspect or when deficiencies are to be identified in that aspect of ISCM, such as ISCM-relevant metrics.

The ISCM program assessment accommodates all aspects of the ISCM program and is grounded in the principles of [SP800-137]. Properties of the ISCM program assessment include:

The ISCM program assessment includes a framework for making judgments, which are responses made by the assessor to the assessment elements. This section outlines the types of judgments and the ways judgments can be made.

An aspect of the ISCM program (e.g., ISCM strategy or ISCM outputs/reports) is evaluated against a set of assessment elements, which may be a chain of elements as explained in Section 2.2.5. For each element considered, a judgment results from the assessor’s response in choosing from a set of predefined judgment values, examples of which are presented below.

For the set of assessment elements applicable to the scope of an ISCM program assessment, all elements are judged. Section 2.3.2 explains scoping of the ISCM program assessment.

Judgment values vary depending on the level of granularity of evaluation that the organization needs and that the assessor can achieve. While specific judgment values for an assessment are not prescribed in this guidance, the default judgment value set consistent with NIST guidance is the two-value set, Satisfied or Other than Satisfied or, equivalently, True/False.¹⁴

For the default set of judgments, each determination statement within an assessment procedure (described in Section 3.3) produces one of the following judgments: Satisfied or Other than Satisfied. The assessment provides for annotations or notes that explain any Other than Satisfied judgment (i.e., what portions of an assessment element prevent a Satisfied judgment). For example, an annotation can document partially completed ISCM aspects so that an organization can track what has been completed and what is lacking. Note that the companion document [Catalog] is established based on the default, two-value set of judgments.

Organizations may also choose to employ a more granular approach to findings by introducing a Partially Satisfied category for assessments. Finer-grain annotations can be employed with the two-value judgments to give more precise reasons for Other Than Satisfied judgments (See Section (see Section 3.3.2 for more detail). Annotations may include a discussion of conditions or situations that do not yield straightforward judgments. Annotations may be assisted by a tool or may be manually recorded during the assessment.

An example of more granular judgment values is:

Mostly/Completely True Somewhat True Neither True Nor False Mostly False Completely False

In this example, all of the judgments are annotatable, even Mostly/Completely True where the evidence shows the element is mostly but not completely true. The organization may use the annotated reasons for the two-value set or a finer granularity set of judgment values to: (i) identify shortfalls, (ii) indicate what further actions are required to completely satisfy the determination statement, and (iii) help prioritize potential responses. It is expected that the set of annotations are used to develop the set of recommendations in the assessment results report.

Section 3.3 explains assessment elements, which contain guidance on how to arrive at a judgment. The ISCM program assessment element contains the assessment element text (i.e., the assessment criteria) and a set of attributes, two of which are the assessment procedure and the discussion used in making judgments. The assessment procedure attribute consists of one or more assessment objectives derived from the assessment element text and potential assessment methods and objects. The discussion attribute provides supplemental guidance relevant to the assessment element and may provide additional details about special situations or dependencies that the assessor may need to consider (see Section 3.3).

Once the evidence¹⁵ is obtained or interviews are conducted with the identified potential stakeholders, the assessor makes a judgment about whether the ISCM program meets a given assessment element. The assessor selects one of the possible judgment values defined for the assessment element as the judgment. The two-value judgment set indicates whether the assessment is Satisfied while the multi-valued, finer grained value set indicates how well the assessment element is met (e.g., somewhat true, mostly false).

Figure 3 shows the process for making judgments for an assessment element using the available information.

Figure 3 – Process for Making Judgments

The Not Applicable (N/A) judgment is not defined for the ISCM program assessment in this publication. It is important to ensure that each assessment element is applicable to the entire organization to the maximum extent. This means that the N/A judgment is not implemented as a judgment value even when some ISCM program assessment functions or aspects are not implemented in the ISCM program (e.g., external service providers are not used), but there are assessment elements to evaluate external service in the assessment.

Since all assessment elements are addressed and not tailored out of an assessment, the following considerations are relevant to the ISCM program assessment:

If an ISCM program assessment element is not applicable to the organization or system, it is first addressed in the applicable strategy, and all elements related to that particular subject are judged to be Satisfied. If the strategy does not address the subject, all elements related to that subject are judged to be Other than Satisfied.

Depending on the size and complexity of the organization, ISCM program assessment information may be collected from multiple parts of the organization (e.g., multiple missions/business processes and/or systems), analyzed, and aggregated into a single judgment for a single organizational risk management level. Multiple assessors can produce multiple assessments that are limited in scope to a part of the organization (e.g., a single mission/business process, a single system).

For multiple ISCM program assessments at the same risk management level (i.e., by multiple assessors), the organization or assessors decide how to combine multiple judgments for the same assessment element. Multiple judgments for the same assessment element can occur, for example, if the assessors meet separately with each mission/business process. It is also a result of using a distributed self-assessment, as described in Section 2.3.1. There can be significant differences in assessment results across one risk management level. Examples of methods for combining judgments within one organizational risk management level are:

Each applicable assessment element is judged separately at each applicable risk management level being assessed as described above.

[SP800-137] describes how the three risk management levels work together to address various aspects of ISCM. The concepts there may apply to one or two levels (usually adjacent levels) or to all three levels, depending on the organizational structure and how the organization-wide and system-level ISCM strategies are applied. As a result, each assessment element is evaluated across one or more levels. For example, one element may be evaluated for Level 1 only, while another is evaluated for Levels 1 and 2. For each element, multiple evaluations are combined into a corresponding single judgment regardless of how many levels are being evaluated.

When judgments from two or more levels are combined to get the resultant judgment, a method, rule, or algorithm is needed to ensure that judgments are combined consistently. This publication does not prescribe a means to combine judgments. Each organization defines a combining mechanism that meets its needs.

One or more assessments are conducted for each of the levels involved. Results are combined into a single judgment for each level as described in Section 2.2.8. Results for each of the levels are then reconciled into a single judgment according to organization-defined rules. As an example of a method of combining levels, the following sample rules, based on one of the decision matrices shown in the three figures below, are used:

Rule 1. If the assessment element is applicable to only one level, that level’s judgment is the final judgment for the element. Rule 2. If the assessment element is applicable to exactly two levels, use the decision matrix from Table 1, Table 2, or Table 3. Rule 3. If the assessment element is applicable to all three levels:

a. Apply Rule 2 to Levels 2 and 3; then b. Apply Rule 2 to Level 1 and the result from Rule 3a.

Note that it is not necessary to use a decision matrix with any of the rules above. A simple rule may be used instead, such as, when combining two judgment values, select the worst-case value as the resultant judgment (or select the majority judgment¹⁶ or use another method).

Table 1 shows an example decision matrix that an assessment may use for combining two levels of judgments using Rules 2 or 3 above. In this example, the approach for combining two levels with different values is to apply the worst-case method, which results in an Other than Satisfied judgment in three of the four cases.

Table 1 – Combining Judgments from Two Levels (Unbiased) 17

Table 2 presents an alternative matrix for combining two levels that gives priority to the higher level, which has a broader view of the actual business of the organization. Rules 2 and 3 remain the same using the matrix of Table 2; however, the outcome of applying any of the rules is different from the outcome of the Table 1 matrix.

Table 2 – Combining Judgments from Two Levels (Higher level bias)

Table 3 presents another alternative matrix for combining two levels that gives priority to the lower level, which may be closer to what is actually occurring in the organization. Rules 2 and 3 remain the same with the matrix of Table 3. However, the outcome of applying any of the rules is different from the matrices of Tables 1 and 2.

Table 3 – Combining Judgments from Two Levels (Lower level bias)

Within an assessment, a score indicates how well the ISCM capability meets its objectives and reflects risk to the organization. Judgments made using the assessment elements may be assigned a score, which is a numerical value representing the judgment that can then be used to calculate assessment results. Scores are assigned to each judgment value, and the resultant score for the organization is computed using the scores of each assessment element. In other words, the assessment score is the sum of all of the element judgment scores.

The scores may facilitate informed decision-making by organizational leadership regarding the ISCM program and where organizational resources can best be applied to improve the program to reduce risk. Scoring is optional and may be used with the binary and multi-gradation judgment types discussed in Section 2.2.7. Scoring may also be used to aggregate ISCM program assessment scores from across the organization into a single, summary score for the entire organization.

Using the default binary judgment values, each assessment element is assigned one of two possible scores as shown in Table 4.

Table 4 – Example of Default Judgment Value Scoring

An assessment element score can optionally be multiplied by a weighting factor, which is a numerical value that results in a higher score for that assessment element. Different weights can be assigned to different assessment elements based on the criticality of a given element to an organization. In other words, an organization may create a scheme of weight assignments (i.e., multiple weight factors for multiple priorities of differing importance). Section 2.2.11 explains factors that may affect the criticality of an assessment element.

As with any type of numeric scoring, the result can be expressed as a percentage by dividing the score by the best possible score.

Assessment elements can be identified as critical or non-critical, which may impact how the elements are scored. ISCM program assessment elements may be deemed critical under the following conditions:

Over the lifetime of an assessment, the designation of critical assessment elements may change to reflect new national cybersecurity priorities, goals, and issues. In addition, critical assessment elements may vary from one organization to another, depending on factors such as the organization’s risk tolerance.

If scoring is performed, ISCM program assessment results include the scoring results for each assessment element combined into a single score for the organization or for the part of the organization being assessed. Reports may be broken out by overall organization, individual organizational parts, organizational level, or specific assessment element attributes, such as the source of the assessment element, various aspects or categories (e.g., strategy, metrics, governance, criticality of findings), individual scores by assessment element, or other grouping meaningful to the organization.

Assessment results include recommendations based on the data collected and analyzed. Some recommendations are formed automatically from judgment results with potential assistance from an assessment tool, while others are made by a manual decision process by the assessors. Organizations or third-party assessors optionally add their own recommendations based on their considerations of the assessment element judgments.

Assessment results can be presented in the assessment report in several different ways depending on the intended use (e.g., radar charts, diagrams, and tables summarizing results of judgment). Results can also be incorporated into displays of assessment scores that give various views of the results. Results in the form of metrics may be reported to various organizational officials (e.g., CIO, SAISO, RE(F), AO) where they may be used to inform risk-based decisions.

The overarching goal of the ISCM program assessment is to provide organizations with recommendations to improve the ISCM program and thereby manage and reduce organizational risk. There are different ways to characterize the ISCM program assessment process, including type of assessment and type of assessors, depth and duration of the assessment, and expected results of the assessment.

There are two types of ISCM program assessment engagements: third-party assessments and self-assessments.

Third-party assessments. Third-party assessments are conducted by third-party assessors who are independent of the organization being evaluated. Third-party assessments may be:

Third-party assessments are typically conducted over more than one session and facilitated as follows: the responses from a set of participants are discussed, and the consensus response is decided and noted, such as by entering it into a tool or repository of results by the assessors.

Self-assessments. Self-assessments may be conducted by the staff of the organization or sub-organization being evaluated and as either a distributed or facilitated self-assessment. Self-assessments rely on an objective view of the target and can inform the organization or part of the organization of shortcomings in the ISCM capability early in the development of the ISCM program.

The self-assessment may be conducted as a distributed assessment where:

Alternatively, the self-assessment may be conducted like a facilitated assessment where one staff member or team with subject matter expertise facilitates discussion in a group, and the consensus response is decided and noted, such as by entering the response into a tool or repository of results.

The extent of the ISCM program assessment is flexible in terms of which process steps it addresses. The assessment can stop at any step or logical stopping point or can evaluate a portion of an organization rather than the entire organization. The ISCM program assessment has the following characteristics that define the ISCM program assessment scope:

Stop at the Define Step (focus on ISCM program strategy); o Stop at the Establish Step (focus on ISCM program design); o Stop at the Implement Step (focus on ISCM implementation); o Exclude the Review/Update Step (a process improvement step that reflects a o relatively mature ISCM program); or Include all Steps (a full ISCM program assessment). o

The ISCM program assessment is flexible enough to allow an assessment to be suspended temporarily at a specific point. Assessment suspension may be beneficial for various reasons (e.g., to make improvements to the ISCM program before continuing). If desired, the assessors may assist the organization in addressing any shortcomings found.

The expected outcome of the ISCM program assessment is the improvement of the security posture of the organization and risk reduction. To this end, the ISCM program assessment produces actionable recommendations to improve the ISCM program, such as in the areas of ISCM program design, implementation, operation, and governance. The primary output of the ISCM program assessment is a report of findings to the organization, which includes the following, as applicable:

In addition, a separate report on the engagement may be made for the assessment organization by the evaluated organization’s staff with the objective of improving the ISCM program assessment process.

This section describes the component parts of an assessment and the overall ISCM program assessment process. The ISCM program assessment process defines how to evaluate the organizational ISCM capability, including: (i) the activities carried out by organizations and assessment bodies to prepare for ISCM program assessments, (ii) the development of the ISCM program assessment plan, (iii) the conduct of ISCM program assessments and the analysis and reporting of assessment results, and (iv) post-assessment report analysis and follow-on activities.

A successful ISCM program assessment requires consideration of the needs of all parties with a vested interest in the organization’s ISCM capability, including system owners, authorizing officials, chief information officers, chief information security officers, senior agency officials for privacy/chief privacy officers, chief executive officers/heads of agencies, security and privacy staff, Inspectors General or other auditing bodies, the RE(f), and the senior accountable official for risk management. Establishing an appropriate set of expectations before, during, and after an assessment is paramount to achieving an acceptable outcome—that is, producing information necessary to help the organization’s leadership make an informed decision about whether the ISCM program is adequate to meet the organization’s needs. The decision may impact authorization decisions to place systems into operation or continue operation (ongoing authorization). Figure 7 shows the overall process, and details are described in subsequent sections.

While an assessment relies on a manual process implemented by assessors, it leverages input from automated ISCM processes as evidence to be used in making judgments. For example, ISCM-produced reports may be supplied to the assessor by an organizational dashboard or security information and event management (SIEM) component; the assessor then uses the ISCM-produced reports to make judgments against one or more specific assessment elements. The assessor (or a tool, if available) then collects and aggregates judgment results from assessment participants at all applicable levels to produce an organization-wide judgment, which is the basis for the assessment findings.

The ISCM program assessment developed under guidance of this publication evaluates the ISCM program itself, not the results of the operational ISCM program. The ISCM program assessment does not have the objectives of: (i) retesting security control effectiveness or operational procedures, (ii) evaluating ISCM implementations, or (iii) validating specific outputs of the ISCM program. The ISCM program assessment does not generally review results of individual control assessments but rather verifies that control assessments are performed in accordance with the ISCM strategy at the organization-specified frequencies for all parts of the organization under assessment.

Repeatability of the ISCM program assessment process is a desirable property to help ensure consistency in results. The guidance in this publication, through the use of the ISCM program assessment elements described in Section 3.3, helps to ensure repeatability in conducting assessments by providing assessor guidance on potential assessment objects to examine, what to look for during the examination, the assessment objective for evaluating each individual assessment element, and the personnel roles to interview. In addition, the discussion attribute of the each ISCM assessment element provides guidance on how to make judgments about assessment elements and may specify the valid judgment values that the assessor can select.

Section 3.5 addresses how the organization or assessor may tailor the approach presented in Section 3 to achieve an assessment that meets organizational and assessor needs.

An ISCM program assessment is focused directly on evaluating the ISCM program as defined and implemented within the organization and not on evaluating the individual, lower-level components of an ISCM capability, such as individual common, hybrid, and system-specific controls. The ISCM program assessment verifies the existence of the subject of the assessment element (e.g., to verify that specified procedures for performing certain actions at specified frequencies are followed). The ISCM program assessment does not evaluate individual automated, manual, or operational functions of the ISCM capability.

原本PDFの抜粋画像

The ISCM Program Assessment Plan guides the execution of the ISCM program assessment. The ISCM Program Assessment Plan documents decisions made during the Plan step of the ISCM program assessment process (as described in Section 3.2) and is developed as follows:

The ISCM Program Assessment Plan specifies but is not limited to the following:

Figure 4 – ISCM Program Assessment Process

The ISCM program assessment is conducted by means of an engagement process, which is a logical, methodical approach to the assessment based on existing assessment approaches. There are three steps in the ISCM program assessment process:

Each ISCM program assessment engagement is tailored based on the needs of the organization and the applicable assessment elements. The ISCM program assessment may be a self-assessment or a third-party assessment, as explained in Section 2.3.1. Figure 4 illustrates the activities within each of the three major engagement steps of the ISCM program assessment.

The Plan Step of the ISCM program assessment defines the assessment process and formalizes the conduct of a program assessment as illustrated in Figure 5.

Figure 5 – ISCM Program Assessment Process (Plan)

Planning activities address a range of important issues relating to the type of engagement (self-assessment or third-party assessment), cost, schedule, staffing, and logistics of the ISCM program assessment. Planning assumes that each assessment element is applicable to one or more organizational levels. A judgment about an element is made by participants from only one applicable level independently from the judgments made by participants at any other applicable level.

To achieve a comprehensive ISCM program assessment, assessment leaders ensure that all areas of ISCM to be considered are evaluated by knowledgeable staff, as follows:

Prior to detailed planning, it is helpful to review an initial set of foundational artifacts (e.g., the organization-wide ISCM strategy and an organization chart). Then, based on relevant information from the initial set of artifacts, the ISCM Program Assessment Plan is updated to adjust the following:

The organization performs the following key planning activities:

As part of establishing the scope of the assessment, the organization may determine that a partial assessment (as described in Section 2.3.2) is appropriate; that is, the plan may limit the number of process steps or parts of the organization to be assessed. Once the engagement has been approved by the organization, relevant artifacts are provided to the assessment team, which decreases the assessment duration by enabling the team to examine detailed background information prior to the kick-off meeting.

The assessment team begins preparing by:

Organization and assessment leadership jointly perform the following activities:

A kick-off meeting is conducted to confirm engagement decisions, answer questions, resolve logistical issues, and address any additional concerns. Attendees of the kick-off meeting include the following organizational personnel: organizational senior leaders (CIO, SAISO/CISO, RE[F]), mission/business owners, system owners, system security officers, other staff selected to participate in or support the ISCM program assessment, and administrative support staff, including logistics and facility points of contact. Assessment organization leaders and senior assessor personnel from the assessment organization also attend the kick-off meeting.

The ISCM program assessment is conducted according to the ISCM Program Assessment Plan, which may have been modified during the kick-off meeting. The availability of artifacts and access to organization personnel relevant to the ISCM program and the systems in scope for the assessment are paramount to a successful ISCM program assessment. Figure 6 illustrates the Conduct Step of the ISCM program assessment process.

Figure 6 – ISCM Program Assessment Process (Conduct)

The goal of the Conduct Step is to understand how well the organization’s ISCM program:

Basic spreadsheet, presentation, and word processing technologies are available and useful to maintain and present the body of assessment elements and raw data from the assessment to assessors and organization leadership. There may be commercially available tools that are oriented toward system and organization program assessments based on specific assessment criteria that can be used to support an assessment; however, this publication does not endorse any commercial information technology products, applications, or systems.

Organizations can deploy tools to meet assessment needs and use the assessment elements in this publication as the basis of an assessment tool, including use of assessment elements as the requirements base of a tool.²⁰ Assessment tools can be developed to support judgment decisions, including collaboration methods, Delphi model, voting by assessors, and surveying knowledgeable personnel.

ISCM program assessment information is obtained from organizational staff and ISCM outputs (reports) rather than interacting directly with the ISCM capability. Interviews are conducted with personnel from all organizational levels based on organization structure, roles, and scope of assessment to capture relevant information and make judgments about assessment elements.

While automation is the primary method of collecting ISCM security-related information about control effectiveness, some controls are monitored manually. Thus, the ISCM program assessment also obtains ISCM results produced from manually collected data. The evidence obtained for the ISCM program assessment includes but is not limited to:

If appropriate, previous ISCM program assessment results may be reused as part of the information for the current ISCM program assessment (e.g., Inspector General reports, audits, vulnerability scans, physical security inspections, prior security or privacy assessments, developmental testing and evaluation, and vendor flaw remediation activities).

Collected information is manually analyzed by the assessment staff, and findings are entered into the repository or assessment tool being utilized, which may be capable of creating graphs and charts. Information analysis leads to judgments about the degree to which the ISCM program meets each relevant assessment element.

Judgments are made at each organizational level to determine the ISCM program’s adequacy for a given assessment element at that level. If there are multiple judgments made at one level by individuals or groups working in parallel, the judgments are aggregated into a single judgment for that level by the assessor, as described in Sections 2.2.8 and 2.2.9. For example, an assessor may aggregate judgments made at the system level into a single judgment encompassing all judgments about all systems assessed for a particular assessment element.

As the ISCM program assessment engagement progresses, the assessors review artifacts, interview staff, and analyze the information gathered. Each day may end with a short discussion with the appropriate organization contacts to clarify and confirm any findings, ask any further questions, and confirm activities for the following day.

System-level ISCM program assessments can be conducted by or supported by system developers, system integrators, security control assessors, system auditors, system owners, the security staffs of organizations, and AOs and AO staff. The ISCM program assessors bring together available information about each system under review. If necessary, assessors conduct enhanced, system-level assessments by modifying assessment procedures and methods within the assessment element to collect additional or unique information about systems with respect to the ISCM program.

Mission/business process ISCM program assessments can be conducted or supported by mission/business owners, common controls providers, security control assessors, and CISO staff security specialists. The organization-wide ISCM program assessment can be conducted or supported by staff of the organization’s CIO, SAISO/CISO, and RE(f).

Once there is a single judgment about an assessment element from each applicable organizational level, the judgments are combined as necessary into a single judgment for a given element. When all elements have a single judgment, the Conduct Step concludes.

The Report Step (Figure 7) is the last step of the engagement process that includes participation by the assessors. The Report Step of the ISCM program assessment defines the output-oriented part of the ISCM program assessment.

Figure 7 – ISCM Program Assessment Process (Report)

During the Report Step of an engagement, assessors create a draft report of the assessment findings. ISCM program assessment conclusions are manually made by the assessors based on the analyzed information. Assessors make recommendations for improving ISCM programs based on the conclusions from the ISCM program assessment, as may be documented in the annotations for assessment judgments that are not Satisfied (or True). The assessment process produces qualitative results and recommendations to assist the organization in focusing subsequent efforts to improve the ISCM program. The organization is given a draft report of findings and recommendations. The draft report is reviewed by organizational leadership, including the executive sponsor, to correct any errors and to clarify misunderstandings or ambiguities. Based on feedback from the organization, the assessor produces an updated, final report. The ISCM program assessment report is described in Section 2.2.12.

The organization is accountable for responding to ISCM program assessment findings. The organization analyzes the findings in the ISCM program assessment final report, determines the appropriate responses, prioritizes response actions in accordance with organizational risk tolerance, and assigns the role(s) responsible for executing response actions and a time frame for completion. Planned response actions may be documented in system-, mission/business process-, or organization-level plans of action and milestones or in an organization-defined format. ISCM program-related documents (e.g., ISCM strategies, policies, etc.) are also updated to reflect any changes resulting from findings and organizational response to findings. Organizations may also validate completed response actions by having the related ISCM program assessment element(s) reassessed.

The ISCM program assessment element defines the evaluation criteria applied to each aspect of the ISCM program being assessed. In order to determine if an ISCM program assessment element is Satisfied, assessors use the associated assessment procedure to obtain and review evidence. The assessment procedures apply to the same organizational levels as the assessment elements.

When an ISCM program assessment element is added or modified for a specific assessment of the organization, the corresponding assessment procedure information is created or modified. Other attributes, such as discussion, are also added or modified. Section 3.5 explains how to tailor the ISCM program assessment process, including the assessment elements.

The ISCM program assessment elements promote repeatability of the ISCM program assessment process and offer the necessary flexibility to customize assessments based on scope, organizational structure, policies and procedures, operational considerations, system and network architecture, and tolerance for risk.

The information fields of the assessment element, including contextual information or attributes²¹ of the assessment element, are defined below.

Each assessment objective includes a determination statement related to the assessment element text. The determination statement (i.e., “Determine if…”) refers to the content of the assessment element text and determines whether or how well the evaluated aspect of the ISCM program meets the underlying ISCM principle or requirement specified in the applicable source for that element. The application of an assessment procedure to an aspect of the ISCM program under evaluation produces an assessment finding, which reflects whether or how well the assessment element is met.

The assessment procedure contains a specification of the suggested assessment methods and the objects to which the methods are applied. The assessment method defines the nature and extent of the assessor’s actions. The potential assessment methods relevant to ISCM program assessment are:

The organization and the assessor coordinate with respect to the evidence needed to provide the level of assurance²² about ISCM program effectiveness desired by the organization. In all three assessment methods, the evidence is used in making specific determinations called for in the determination statements to confirm the objectives of the assessment procedures.

Assessment objects are the potential items (evidence) to which an assessment method is applied. Assessment objects can include specifications, mechanism outputs, activities, and individuals that help the assessor make judgments about whether or how well the assessment element is Satisfied by an aspect of the ISCM program. Specifications are document-based artifacts, such as:

Mechanism outputs are reports or notifications from specific hardware, software, or firmware monitoring functions or safeguards employed within a system or operating environment, such as:

Activities are the monitoring-related actions associated with a system that involve people, such as:

Organizations are not expected to employ all assessment methods and objects contained within the assessment procedures; rather, organizations have the flexibility to choose methods and objects, and to determine the level of effort needed and the assurance required for an assessment (i.e., which assessment methods and assessment objects are deemed to be the most useful in obtaining the desired results).

Table 5 shows the format of the assessment element and its attributes, as defined in the Assessment Element Catalog [Catalog].

Table 6 shows an example of an assessment element from the [Catalog].

Each assessment element in the Assessment Element [Catalog] applicable to the ISCM program assessment is acted upon (executed) by the assessor. The primary object in the assessment element is the assessment procedure, as defined in the previous section. The assessment objective is a re-statement of the assessment element, and the assessor makes a judgment of the degree to which a particular aspect of the ISCM program satisfies the element.

Each determination statement contained within an assessment objective of the assessment element (as shown in Table 6) produces, for example, one of the following judgments for the two-value judgment set (described in Section 2.2.6): Satisfied or Other than Satisfied. A finding of Satisfied indicates that for the portion of the ISCM program being assessed, the assessment information obtained (i.e., evidence collected) indicates that the assessment objective for that assessment element has been met and produces an acceptable result. For a finding of Other than Satisfied, the assessment provides for annotated reasons that explain the judgment (i.e., what portions of an assessment element prevent a Satisfied judgment). The reasons inform the organization of shortfalls in the ISCM program that may need to be addressed. A finding of Other than Satisfied may also indicate that the assessor was unable to obtain sufficient information to make the determination called for in the determination statement.

For assessment findings that are Other than Satisfied, organizations may choose to define subcategories of findings that indicate the severity or criticality of the weaknesses or deficiencies discovered and the potential adverse effects on organizations. Defining such subcategories can help to establish priorities for needed risk mitigation actions. Regardless of whether the organization defines subcategories, assessment results include sufficient information about shortfalls to indicate what further actions are required to completely satisfy the determination statement.

Table 5 – Assessment Element Format

Table 6 – Example Assessment Element

Figure 8 illustrates the use of the assessment element using the example element presented in Table 6.

Use of Example Assessment Item Information

原本PDFの抜粋画像

Steps 1 through 4 explain how the information fields of the example assessment element in Table 6 are used to arrive at a judgement about the example assessment element.

There is an ISCM program derived from the organization-wide ISCM strategy.

Use the POTENTIAL ASSESSMENT METHODS on the OBJECTS as follows:

To obtain evidence to make a judgement about the ISCM ASSESSMENT OBJECTIVE below:

Determine if there is an ISCM program derived from the organization-wide ISCM strategy.

Figure 8 – Use of Example Assessment Item Information

Each assessment element is applied in a similar manner for each element in the [Catalog] and for each applicable organizational level. Results (judgments) for each assessment element are combined across multiple organizational levels when the element applies to more than one level, as described in Section 2.2.9. The assessment elements offered with this publication in the [Catalog] generally do not inform the assessor of how to make the actual judgment (e.g., Satisfied or Other than Satisfied) since criteria for satisfying an ISCM program assessment element may vary among systems, missions, and organizations. The assessment procedures lead the assessor to the judgment decision point in accordance with the assessment objective after applying the assessment methods to the suggested objects (the evidence). The assessment methodology defined here verifies the subject or topic of the assessment element (e.g., strategies, policies, procedures, the actions of following procedures, and ISCM reports) as specified in the assessment element text. Execution of each assessment element every time the ISCM program assessment is conducted in the manner explained in Figure 8 helps ensure the repeatability of the ISCM program assessment process.[Catalog]

While the assessment [Catalog] includes the minimum set of ISCM program assessment elements, the organization—in conjunction with the assessor—may add assessment elements, or if the ISCM program assessment is limited by the number of ISCM process steps (as described in Section 2.3.2), assessment elements may be deleted or bypassed for a particular ISCM program assessment engagement. Section 3.5 explains how to tailor the ISCM program assessment process.

The ISCM program assessment does not repeat or augment control assessments (conducted in accordance with [SP800-53A]) but verifies that the control assessments are conducted according to each assessment element’s conditions (e.g., at specified frequencies).

Tailoring is a cooperative process between the assessor and the evaluated organization that is undertaken to meet the organization’s needs. The steps of the assessment process (as described in Section 3.2) and the assessment itself may be tailored. Tailoring helps adapt the assessment to unique organizational situations, such as a limited (incremental) assessment for an immature ISCM program. Tailoring also helps facilitate adoption of the assessment across the entire organization where the sub-organizations may vary in degree of implementation or risk environment. Assessment elements and assessment procedures are flexible enough to be tailored to meet the organization’s needs.

Tailoring the ISCM program assessment may be needed based on an organization’s specific implementation of the ISCM program. For example, the assessment for federal agencies is tailored in a way that helps determine whether organizational ISCM programs meet the federal ISCM requirements from the authoritative sources. ISCM program assessment tailoring is coordinated with the assessment organization to ensure that the ISCM program assessment still verifies the required aspects of ISCM. All tailoring decisions are documented in the ISCM Program Assessment Plan.

Tailoring the ISCM Program Assessment Scope. At the start of the tailoring activity, decisions about the scope of the ISCM program assessment are made, such as which systems and system components (e.g., user endpoints, servers, networking components) are to be assessed with respect to the ISCM program implementation to provide credible assessment evidence. Tailoring the ISCM program assessment scope involves understanding the organization’s ISCM requirements and constraints and modifying the assessment elements where necessary. For example, tailoring may be based on organizational structure (e.g., number and size of sub-organizations) or ISCM maturity, such as disparity in ISCM maturity among mission/business processes).

The scope of the assessment is determined by the organization’s leadership. Assessment elements are tailored out of the catalog for a narrower scope (e.g., if the assessment is limited or incremental by the number of ISCM process steps), as described in Sections 2.3.2 and 3.4). The assessment scope may also be limited to specific risk management levels (e.g., for a Level 1-only [organizational] scope or a Level 3-only [system-level] scope).

Tailoring the Assessment Elements. Tailoring could result in modifications to fields/attributes for the assessment elements. Assessment elements may be reworded to incorporate concepts created by new technologies or techniques. The assessment element set may be tailored by creating additional elements or modified by rewording, as described in Section 2.2.7.

If the ISCM program assessment is assisted by a tool, the tailoring of individual assessment elements may be problematic if the tool is not designed for modification of the assessment elements and their attributes.

The ISCM program assessment may provide the organization with recommendations to improve the ISCM program, including areas of ISCM program design, implementation, operation, and governance. At the conclusion of an assessment, the assessors present a draft report, and after discussion with organization leadership, a final report that resolves any differences of opinion between the assessors and the organization is presented to the organization. See Sections 2.2.12 and 3.2.3 for more information on reporting ISCM program assessment results.

The ISCM program assessment process may be intense and short-lived, or it may continue at a lower level of effort. Organizational personnel may meet with the assessment team after conclusion of the assessment. Follow-on collaboration may also involve meetings with the organizational staff and assessment team.

Post-assessment engagement. The ISCM program assessment may be repeated at predetermined intervals, such as when certain milestones occur in the development of the organization’s ISCM program or when response actions from a previous assessment are completed to verify closure of the action. A follow-on assessment may be expanded in scope as the organization’s ISCM program gains maturity.

[44 USC 3544] Title 44 U.S. Code, Sec. 3544, Definitions. 2006 ed. https://www.govinfo.gov/app/details/USCODE-2008-title44/USCODE-2008-title44-chap35-subchapIII-sec3544

[Catalog] National Institute of Standards and Technology (2020) ISCM Assessment Procedures Catalog. Available at https://csrc.nist.gov/publications/detail/sp/800-137a/final

[CNSSI 4009] Committee for National Security Systems (2015) Committee on National Security Systems (CNSS) Glossary. (National Security Agency, Ft. Meade, MD) CNSS Instruction (CNSSI) 4009. Available at https://www.cnss.gov/CNSS/issuances/Instructions.cfm

[CSF 1.1] National Institute of Standards and Technology (2018) Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards and Technology, Gaithersburg, MD). https://doi.org/10.6028/NIST.CSWP.04162018

[FISMA2014] Federal Information Security Modernization Act of 2014, Pub. L. 113-283, 128 Stat. 3073.https://www.govinfo.gov/app/details/PLAW-113publ283

[ISCMA Reqs] DHS Information Security Continuous Monitoring Assessment (ISCMA) Requirements.

[NISTIR8212] T.B.D. ([forthcoming]) Methodology for Assessing Information Security Continuous Monitoring Programs. (National Institute of Standards and Technology, Gaithersburg, MD), Draft NIST Interagency or Internal Report (IR) 8212. Available upon release at https://csrc.nist.gov/publications

[OMB A-130] Office of Management and Budget (2016) Managing Information as a Strategic Resource. (The White House, Washington, DC), OMB Circular A-130, July 28, 2016. Available at https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf

[OMB M-11-33] Office of Management and Budget (2011) FY 2011 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management. (The White House, Washington, DC), OMB Memorandum M-04-04, September 14, 2011. Available at https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/m11-33.pdf

Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37, Rev. 2. https://doi.org/10.6028/NIST.SP.800-37r2

Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: Organization, Mission, and Information System View. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-39. https://doi.org/10.6028/NIST.SP.800-39

Joint Task Force Transformation Initiative (2013) Security and Privacy Controls for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 4, Includes updates as of January 22, 2015. https://doi.org/10.6028/NIST.SP.800-53r4

Joint Task Force Transformation Initiative (2014) Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53A, Rev. 4, Includes updates as of December 18, 2014. https://doi.org/10.6028/NIST.SP.800-53Ar4

Chew E, Swanson M, Stine K, Bartol N, Brown A, Robinson W (2008) Performance Measurement Guide for Information Security. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-55. https://doi.org/10.6028/NIST.SP.800-55r1

Dempsey KL, Chawla NS, Johnson LA, Johnston R, Jones AC, Orebaugh AD, Scholl MA, Stine KM (2011) Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-137. https://doi.org/10.6028/NIST.SP.800-137

Selected acronyms and abbreviations used in this publication are defined below.

AO — Authorizing Official

CISA — Cybersecurity and Infrastructure Security Agency

CISO — Chief Information Security Officer

CIO — Chief Information Officer

CSF — Cybersecurity Framework

FISMA — Federal Information Security Modernization Act

ISCM — Information Security Continuous Monitoring

ISSO — Information System Security Officer

NCCoE — National Cybersecurity Center of Excellence

NIST — National Institute of Standards and Technology

NISTIR — NIST Interagency or Internal Report

RE(f) — Risk Executive (function)

RMF — Risk Management Framework

OA — Ongoing Authorization

OMB — Office of Management and Budget

SAISO — Senior Agency Information Security Officer

SIEM — Security Information and Event Management

SISO — Senior Information Security Officer

aspect — The subject or topic of an assessment element that is associated with a portion of the ISCM program under assessment.

assessment — Depending on the context: (a) A completed or planned action of evaluation of an organization, a mission or business process, or one or more systems and their environments; or (b) The vehicle or template or worksheet that is used for each evaluation.

assessment element — A specific ISCM concept to be evaluated in the context of a specific ISCM Process Step.

assessment element attribute — An item of information that is specifically applicable to an assessment element, such as the source for the assessment element or risk management level to which the element applies.

assessment element text — A statement that should be true for a well-implemented ISCM program. This statement is the evaluation criteria part of an assessment element.

assessment method [SP800-53A] — One of three types of actions (i.e., examine, interview, test) taken by assessors in obtaining evidence during an assessment.

assessment objective [SP800-53A] — A set of determination statements that expresses the desired outcome for the assessment of a security control, privacy control, or control enhancement.

assessment procedure [SP800-53A] — A set of assessment objectives and an associated set of assessment methods and assessment objects.

catalog — The collection of all assessment elements.

chain — Two or more assessment elements that are linked by a common aspect of ISCM. Each chain has an assessment element in Program Step 1, DEFINE, called the root, which has no predecessor or parent element.

continuous monitoring [SP800-37] — Maintaining ongoing awareness to support organizational risk decisions.

distributed self-assessment — The least formal type of assessment; the element judgments are based on the evaluations by small groups that work in parallel.

element — A statement about an ISCM concept that is true for a well-implemented ISCM program.

evaluation criteria — The standards by which accomplishments of technical and operational effectiveness or suitability characteristics may be assessed. Evaluation criteria are a benchmark, standard, or factor against which conformance, performance, and suitability of a technical capability, activity, product, or plan is measured.

external assessment engagement — Formal engagement led by a third-party assessment organization.

facilitated self-assessment — Less formal than an internal assessment engagement, the element judgments determined by participant consensus on each element for a given level.

high value asset — Those information resources, mission/business processes, and/or critical programs that are of particular interest to potential or actual adversaries.

internal assessment engagement — Formal engagement led by a team within the organization that determines element judgments.

information security continuous monitoring (ISCM) program [SP800-137] — A program established to collect information in accordance with organizational strategy, policies, procedures, and pre-established metrics, utilizing readily available information in part through implemented security controls.

information security continuous monitoring (ISCM) strategy — A strategy that establishes an ISCM program.

judgment — The association of one of the preconfigured evaluation choices with an element from the context of a specific organizational level.

judgment value — Predefined values that represent the possible choices that an assessor makes in judging whether or how well the gathered information satisfies an assessment element.

parent assessment element — The assessment element in a prior process step from which the current element was derived.

practitioner experience — A source of ISCM assessment elements based on the experience of individuals (practitioners) with experience in designing, implementing, and operating ISCM capabilities, as well as security engineering experience.

process step — A reference to one of the 6 steps in the ISCM process defined in NIST SP 800-137.

risk executive (function) [SP800-37] — An individual or group within an organization that helps to ensure that: (i) security risk-related considerations for individual information systems, including the authorization decisions for those systems, are viewed from an organization-wide perspective with regard to the overall strategic goals and objectives of the organization in carrying out its missions and business functions; and (ii) managing risk from individual information systems is consistent across the organization, reflects organizational risk tolerance, and is considered along with other organizational risks affecting mission/business success.

Risk Management Framework (RMF) step — A reference to one of the 6 steps in the Risk Management Framework process defined in SP 800-37.

risk management level — One of three organizational levels defined in NIST SP 800-39: Level 1 (organizational level), Level 2 (mission/business process level), or Level 3(system level).

risk tolerance [SP800-137] — The level of risk an entity is willing to assume in order to achieve a potential desired result.

robustness [CNSSI 4009] — When applied to ISCM, a property that an ISCM capability is sufficiently accurate, complete, timely, and reliable for providing security status information to organization decision-makers to enable them to make risk-based decisions. The ability of an information assurance (IA) entity to operate correctly and reliably across a wide range of operational conditions and to fail gracefully outside of that operational range.

security controls [SP800-53] — A safeguard or countermeasure prescribed for an information system or an organization designed to protect the confidentiality, integrity, and availability of its information and to meet a set of defined security requirements.

Senior Agency Information Security Officer (SAISO) [44 USC 3544] — Official responsible for carrying out the chief information officer (CIO) responsibilities under the Federal Information Security Management Act (FISMA) and who serves as the CIO’s primary liaison to the agency’s authorizing officials, information system owners, and information systems security officers. Note: Also known as senior information security officer (SISO) or chief information security officer (CISO).

Senior Information Security Officer (SISO) — See Senior Agency Information Security Officer (SAISO)

System Security Officer (SSO) [SP800-37] — Individual assigned responsibility by the senior agency information security officer, authorizing official, management official, or information system owner for maintaining the appropriate operational security posture for an information system or program

tailoring [SP800-53, adapted] — Similar in concept to tailoring baselines as described in SP 800-53, a cooperative process that modifies part of a set of assessment elements by: (i) changing the scope of the assessment or risk management level, (ii) adding or eliminating assessment elements, or (iii) modifying the attributes of an assessment element.

Traceability Chains

This Appendix presents the traceability chains (see Section 2.2.5) for the catalog of assessment elements provided with this publication. The string in the upper left of each element of the diagram provides unique identification of an individual assessment element.

Figure 9 – ISCM Strategy Management Traceability Chain

Figure 10 – System-level Strategy Traceability Chain

Figure 11 – ISCM Program Management Traceability Chain

Figure 12 – Control Assessment Rigor Traceability Chain

Figure 13 – Security Status Monitoring Traceability Chain

Figure 14 – Common Control Assessment Traceability Chain

Figure 15 – System-specific Control Assessment Traceability Chain

Figure 16 – ISCM Results Included in Risk Assessment Traceability Chain

Figure 17 – Threat Information Traceability Chain

Figure 18 – External Service Providers Traceability Chain

Figure 19 – Security-focused Configuration Management Traceability Chain

Figure 20 – Impact of Changes to Systems and Environments Traceability Chain

Figure 21 – External Security Service Providers Traceability Chain

Figure 22 – Security Monitoring Tools Traceability Chain

Figure 23 – Sampling Traceability Chain

Figure 24 – Risk Response Traceability Chain

Figure 25 – Ongoing Authorization Traceability Chain

Figure 26 – Acquisition Decisions Traceability Chain

Figure 27 – ISCM Resources Traceability Chain

Figure 28 – ISCM Training Traceability Chain

Figure 29 – Metrics Traceability Chain

Figure 30 – Security Status Reporting Traceability Chain

Figure 31 – Data Traceability Chain

Figure 32 – ISCM Program Governance Traceability Chain