NIST SP 800-53A Rev. 5 日本語訳

NIST Special Publication 800-53A

Revision 5

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

NIST Special Publication 800-53A

Revision 5

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

January 2022

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems. Such information security standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-53A Revision 5 Natl. Inst. Stand. Technol. Spec. Publ. 800-53A, Rev. 5, 733 pages (January 2022) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

原本PDFの抜粋画像

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Submit comments on this publication to: sec-cert@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations.

This publication provides a methodology and set of procedures for conducting assessments of security and privacy controls employed within systems and organizations within an effective risk management framework. The assessment procedures, executed at various phases of the system development life cycle, are consistent with the security and privacy controls in NIST Special Publication 800-53, Revision 5. The procedures are customizable and can be easily tailored to provide organizations with the needed flexibility to conduct security and privacy control assessments that support organizational risk management processes and are aligned with the stated risk tolerance of the organization. Information on building effective security and privacy assessment plans is also provided with guidance on analyzing assessment results.

Assessment; assessment plan; assurance; control assessment; FISMA; Privacy Act; privacy controls; Open Security Controls Assessment Language; OSCAL; privacy requirements; Risk Management Framework; security controls; security requirements.

This publication was developed by the Joint Task Force Interagency Working Group. The group includes representatives from the civil, defense, and intelligence communities. The National Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from the Department of Commerce, Department of Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency working group whose dedicated efforts contributed significantly to this publication.

HON. John Sherman, Chief Information Officer

Dr. Kelly Fletcher, Principal Deputy Chief Information Officer

David McKeown, Deputy CIO for Cybersecurity and DoD CISO

Mark Hakun, Principal Deputy CIO for Cybersecurity

Kevin Dulany, Director, Cybersecurity Policy and Partnerships

James St. Pierre, Acting Director, Information Technology Laboratory (ITL)

Kevin Stine, Cybersecurity Advisor, ITL

Matthew Scholl, Chief, Computer Security Division

Kevin Stine, Chief, Applied Cybersecurity Division

Victoria Yan Pillitteri, Risk Management Framework Project Leader

Michael E. Waschull, Acting Chief Information Officer

Michael E. Waschull, Deputy Chief Information Officer

C. Matthew Conner, Cybersecurity Group and IC CISO

Cheri Benedict, Director, Security Coordination Center

Mark G. Hakun, Chair

Dominic A. Cussatt, Co-Chair

Kevin Dulany, Tri-Chair—Defense Community

Chris Johnson, Tri-Chair—Intelligence Community

Vicki Michetti, Tri-Chair—Civil Agencies

Victoria Yan Pillitteri, NIST, JTF Leader

McKay Tolboe, DoD

Andy Rovnak, Intelligence Community

Angela Smith, NIST

Katie Isaacson, The MITRE Corporation

Eduardo Takamura, NIST

Dave Myers, Veterans Affairs

Peter Duspiva, Intelligence Community

Jon Boyens, NIST

Randy Gabel, The MITRE Corporation

Kelley Dempsey, NIST

Vicki Michetti, Veterans Affairs

Chris Johnson, Intelligence Community

Ned Goren, NIST

David Black, The MITRE Corporation

Ron Ross, NIST

Naomi Lefkovitz, NIST

Jessica Dickson, NIST

Kaitlin Boeckl, NIST

Pam Miller, The MITRE Corporation

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim Foti, Cristina Ritfeld, Isabel Van Wyk, and the NIST web team for their outstanding administrative support, Chris Enloe for his technical review and insight, and to David Waltermire and Wendell Piez for their contribution to the development of the SP 800-53A assessment tables (both electronic sources, and derivative publications) using Open Security Controls Assessment Language (OSCAL). The authors also wish to recognize the professional staff from the NIST Computer Security Division and Applied Cybersecurity Division, and the representatives from the Federal Chief Information Officer (CIO) Council, Federal Chief Information Security Officer (CISO) Council, and Federal Privacy Council for their ongoing contributions in helping to improve the content of the publication. Finally, the authors gratefully acknowledge the contributions from individuals and organizations in the public and private sectors, both nationally and internationally, whose insightful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication.

The authors wanted to acknowledge the many individuals who contributed to previous versions of Special Publication 800-53A since its inception in 2005. They include Marshall Abrams, Dennis Bailey, Matt Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb Bodeau, Brett Burley, Bill Burr, Dawn Cappelli, Corinne Castanza, Matt Coose, George Dinolt, Donna Dodson, Randy Easter, Kurt Eleam, Jennifer Fabius, Daniel Faigin, Denise Farrar, Harriett Goldman, Peter Gouldmann, Richard Graubart, Jennifer Guild, Sarbari Gupta, Peggy Himes, Bennett Hodge, Cynthia Irvina, Arnold Johnson, Roger Johnson, Lisa Kaiser, Stu Katzke, Sharon Keller, Cass Kelly, Steve LaFountain, Steve Lipner, Bill MacGregor, Tom Macklin, Tom Madden, Erika McCallister, Tim McChesney, Michael McEvilley, John Mildner, Sandra Miravalle, Joji Montelibano, Doug Montgomery, George Moore, Harvey Newstrom, Robert Niemeyer, LouAnna Notargiacomo, Dorian Pappas, Tim Polk, Esten Porter, Karen Quigg, Steve Quinn, Ed Roback, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone, Roger Schell, Matt Scholl, Murugiah Souppaya, Kevin Stine, Gary Stoneburner, Keith Stouffer, Marianne Swanson, Pat Toth, Glenda Turner, Joe Weiss, Richard Wilsher, Mark Wilson, John Woodward, and Carol Woody.

Document Conventions

For the purposes of this document, the term “security and privacy” is universally used since the guidance is applicable to both security and privacy control assessments. For certain systems, however, the guidance may only be relevant for security or privacy. Organizations make their own determinations on when to manage security and privacy control assessments together or separately.

SP 800-53A provides guidance on assessing controls in information security program plans, privacy program plans, system security plans, and privacy plans. Where the guidance refers to all plans listed above, the term “security and privacy plans” is used. If the guidance is specific to a single type of plan (e.g., system security plan), the specific type of plan is specified.

Supplemental Content

The assessment procedures in Chapter 4 are published in multiple data formats, including comma-separated values (CSV), plain text, and Open Security Controls Assessment (OSCAL). The available data formats are accessible from the NIST SP 800-53A Revision 5, publication details page at https://csrc.nist.gov/publications/detail/sp/800-53a/rev-5/final. The OSCAL Content Git Repository is available at https://github.com/usnistgov/oscal-content.

The CSV, plain text, and OSCAL formats represent derivative formats of the (normative) assessment procedures in this publication. If there are any discrepancies between the content in derivative formats and this publication, please contact sec-cert@nist.gov.

Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

COLLABORATION AMONG PUBLIC AND PRIVATE SECTOR ENTITIES

In developing standards and guidelines required by [FISMA], NIST consults with other federal agencies and offices as well as private sector entities to improve information security, avoid unnecessary and costly duplication of effort, and ensure that NIST publications complement the standards and guidelines employed for the protection of national security systems. In addition to its comprehensive public review and vetting process, NIST collaborates with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to establish and maintain a unified framework and common foundation for information security across the Federal Government. A common foundation and framework for information security provides the intelligence, defense, and civilian sectors of the Federal Government and their contractors more uniform and consistent ways to manage risks to organizational operations and assets, individuals, other organizations, and the Nation that result from the operation and use of systems. A common foundation and framework also provides a strong basis for the reciprocal acceptance of security authorization decisions and facilitate information sharing. NIST also works with public and private sector entities to establish and maintain specific mappings and relationships between the security standards and guidelines developed by NIST, the International Organization for Standardization (ISO), and the International Electrotechnical Commission (IEC).

The new format for assessment procedures introduced in Special Publication (SP) 800-53A Revision 4, is further improved in this revision (SP 800-53A Revision 5). The format continues to reflect the decomposition of assessment objectives into more granular determination statements wherever possible, thus providing the capability to identify and assess specific parts of security and privacy controls. Updates to SP 800-53A Revision 5:

The ability to apply assessment and monitoring resources in a targeted and precise manner and simultaneously maximize the use of automation technologies can result in more timely and cost-effective assessment processes for organizations.

Note: NIST [SP 800-53] will be updated accordingly to ensure that the numbering scheme for all security and privacy controls is consistent with the new format introduced in this publication.

Security and privacy control assessments are not about checklists, simple pass/fail results, or generating paperwork to pass inspections or audits. Rather, control assessments are the principal vehicle used to verify that selected security and privacy controls are implemented and meeting stated goals and objectives. Special Publication (SP) 800-53A, Assessing Security and Privacy Controls in Information Systems and Organizations, facilitates security control assessments and privacy control assessments conducted within an effective risk management framework. A major design objective for SP 800-53A is to provide an assessment framework and initial starting point for assessment procedures that are flexible enough to meet the needs of different organizations while providing consistency in conducting control assessments. Control assessment results provide organizational officials with:

The findings identified by assessors are used to determine the overall effectiveness of security and privacy controls associated with systems and their environments of operation and to provide credible and meaningful inputs to the organization’s risk management process. A well-executed assessment helps determine the validity of the controls contained in the organization’s security and privacy plans and subsequently employed in organizational systems and environments of operation. Control assessments facilitate a cost-effective approach to managing risk by identifying weaknesses or deficiencies in systems, thus enabling the organization to determine appropriate risk responses in a disciplined manner that is consistent with organizational mission and business needs.

SP 800-53A is a companion guideline to [SP 800-53] Security and Privacy Controls for Systems and Organizations. Each publication provides guidance for implementing specific steps in the Risk Management Framework (RMF).¹ SP 800-53 and [SP 800-53B] address the Select step of the RMF and provide guidance on security and privacy control selection (i.e., determining the controls needed to manage risks to organizational operations and assets, individuals, other organizations, and the Nation). SP 800-53A addresses the Assess and Monitor steps of the RMF and provides guidance on the security and privacy control assessment processes. SP 800-53A also includes guidance on how to build effective assessment plans and how to analyze and manage assessment results.

SP 800-53A provides a process that allows organizations to tailor the assessment procedures outlined in the guidance. Tailoring involves customizing the assessment procedures to match the characteristics of the system and its environment of operation more closely. The tailoring process described in this guidance gives organizations the flexibility needed to avoid assessment approaches that are unnecessarily complex or costly while simultaneously meeting the assessment requirements and risk management principles established in the RMF. Tailoring decisions are left to the discretion of the organization to maximize flexibility in developing assessment plans – applying the results of risk assessments to determine the extent, rigor, and level of intensity of the assessments needed to provide sufficient assurance about the security and privacy posture of the system.

THE NEED TO ASSESS SECURITY AND PRIVACY CONTROL EFFECTIVENESS

Today’s systems² are complex assemblages of technology (i.e., hardware, software, and firmware), processes, and people working together to provide organizations with the capabilities to process, store, and transmit information in a timely manner in support of various mission and business functions. The degree to which organizations have come to depend upon systems to conduct routine, important, and critical mission and business functions means that the protection of the underlying systems and environments of operation is paramount to the success of the organization. The selection of appropriate security and privacy controls for a system is an important task that can have significant implications on the operations and assets of an organization as well as the welfare of individuals. Security controls are the safeguards or countermeasures prescribed for a system or an organization to protect the confidentiality, integrity, and availability of its system and information and to manage information security risk. Privacy controls are the administrative, technical, and physical safeguards employed within a system or an organization to manage privacy risks and ensure compliance with applicable privacy requirements.³

Once employed within a system, security and privacy controls are assessed to determine their overall effectiveness (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security and privacy requirements for the system and the organization). Understanding the overall effectiveness of implemented security and privacy controls is essential in determining the risk to the organization’s operations and assets, individuals, other organizations, and the Nation resulting from the use of the system.

The purpose of this publication is to provide guidelines for building effective security and privacy assessment plans, as well as a comprehensive set of procedures for assessing the effectiveness of security and privacy controls employed in systems and organizations. The guidelines apply to the security and privacy controls defined in [SP 800-53] (as amended), Security and Privacy Controls for Information Systems and Organizations. The guidelines have been developed to help achieve more secure systems by:

This publication satisfies the requirements of Office of Management and Budget (OMB) Circular A-130 [OMB A-130] and the provisions of the Federal Information Security Modernization Act [FISMA]. The security and privacy guidelines in this publication are applicable to federal systems other than those systems designated as national security systems, as defined in 44 U.S.C., Section 3542. The guidelines have been broadly developed from a technical perspective to complement similar guidelines for national security systems and may be used for such systems with the approval of appropriate federal officials exercising policy authority over such systems. 4

Organizations use this publication in conjunction with approved information security program plans, privacy program plans, system security plans, and privacy plans in developing assessment plans for producing and compiling the information necessary to determine the effectiveness of the security and privacy controls employed in the system and organization. The guidance in this publication has been developed with the intention of enabling organizations to tailor the basic assessment procedures provided. The assessment procedures are used as a starting point for and as input to the assessment plan. In developing effective security and privacy assessment plans, organizations take into consideration existing information about the controls to be assessed (e.g., results from assessments of risk; platform-specific dependencies in the hardware, software, or firmware; and any assessment procedures needed as a result of organization-specific controls not included in [SP 800-53]). 5

The selection of appropriate assessment procedures and the rigor, intensity, and scope of the assessment depend on the following factors:

The assessment process is an information-gathering activity of the as-implemented state of the system or common controls, not a security- or privacy-producing activity. Organizations determine the most cost-effective implementation of the assessment process by applying the results of risk assessments, considering the maturity and quality level of the organization’s risk management processes, and taking advantage of the flexibility in the concepts described in this publication. The use of SP 800-53A as a starting point in the process of defining procedures for assessing the security and privacy controls in systems and organizations promotes the consistent application of security and privacy controls and offers the needed flexibility to customize the assessment based on organizational policies and requirements, known threat and vulnerability information, operational considerations, system and platform dependencies, and tolerance for risk. 8 The information produced during control assessments can be used by an organization to:

Organizations are not expected to employ all of the assessment methods and assessment objects contained within the assessment procedures identified in this publication for the associated security and privacy controls deployed within or available for inheritance by organizational systems. Rather, organizations have the inherent flexibility to determine the level of effort needed and the assurance required for a particular assessment (e.g., which assessment methods and assessment objects are most useful in obtaining the desired results). Determination of the level of effort and required assurance is made based on what is necessary to accomplish the assessment objectives in the most cost-effective manner and with sufficient confidence to support the subsequent determination of the resulting mission or business risk (i.e., risk management). Organizations balance the resources expended on the deployment of security and privacy controls (i.e., safeguards and countermeasures implemented for security and privacy protection) with the resources expended to determine overall control effectiveness, both initially and on an ongoing basis through continuous monitoring programs.

This publication is intended to serve a diverse group of system and information security and privacy professionals, including:

SP 800-53A is designed to support [SP 800-37], Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. In particular, the assessment procedures contained in this publication and the guidelines provided for developing security and privacy assessment plans for organizational systems directly support the assessment and monitoring activities that are integral to the risk management process. The integral activities include providing near real-time security- and privacy-related information to organizational officials regarding the ongoing security and privacy state of their systems and organizations.

Organizations are encouraged to take advantage of the control assessment results and associated assessment documentation, artifacts, and evidence available for system components from previous assessments, including independent third-party testing, evaluation, and validation.¹² Product testing, evaluation, and validation may be conducted on cryptographic modules and general-purpose information technology products, such as operating systems, database systems, firewalls, intrusion detection systems, web browsers, web applications, smart cards, biometrics devices, personal identity verification devices, network devices, and hardware platforms using national and international standards. If a system component product is identified as providing support for the implementation of a particular control in [SP 800-53], then evidence produced during the product testing, evaluation, and validation processes (e.g., security or privacy specifications, analyses and test results, validation reports, and validation certificates)¹³ is used to the extent that it is applicable. The applicable product testing evidence can be combined with the assessment-related evidence obtained from the application of the assessment procedures in this publication to cost-effectively produce the information necessary to determine whether the security and privacy controls are effective in their application.

The remainder of this publication is organized as follows:

BASIC CONCEPTS ASSOCIATED WITH SECURITY AND PRIVACY CONTROL ASSESSMENTS

This chapter describes the basic concepts associated with assessing the security and privacy controls in organizational systems and the environments in which those systems operate, including the integration of assessments into the system development life cycle, the importance of an organization-wide strategy for conducting assessments, the development of effective assurance cases to help increase grounds for confidence in the effectiveness of security and privacy controls, and the format and content of assessment procedures. A fundamental design objective for SP 800-53A is to provide a flexible assessment framework and a starting point for assessment procedures to be used by different organizations and systems while providing a repeatable approach to facilitate consistency in conducting control assessments.

Security and privacy assessments can be carried out throughout system development life cycle phases¹⁴ to increase grounds for confidence that the security and privacy controls employed within or inherited by a system are effective in their application. The guidance in this publication provides a comprehensive set of assessment procedures to support security and privacy assessment activities throughout the system development life cycle. For example, security and privacy assessments are routinely conducted during the development/acquisition and implementation phases of the life cycle. Conducting assessments during the development/acquisition and implementation phases helps ensure that the required controls for the system are designed and developed consistent with risk management goals, correctly implemented, and consistent with the established organizational information security and privacy architecture before the system enters the operations and maintenance phase. Security and privacy assessments conducted in pre-operational system development life cycle phases include design and code reviews, application scanning, regression testing, and ensuring that applicable privacy laws and policies are adhered to and that privacy protections are embedded in the design of the system.

Security- and privacy-related weaknesses and deficiencies identified early in the system development life cycle can be resolved more quickly and cost-effectively than deficiencies identified in subsequent phases of the life cycle. Early identification of security- and privacy-related weaknesses and deficiencies in the selected security and privacy controls facilitates determination and implementation of appropriate risk responses and allows for effectiveness of control implementations to be validated during system design and testing.

Security and privacy assessments are also conducted during the operations and maintenance phase of the life cycle to ensure that the controls continue to be effective in the operational environment and protect against constantly evolving risks. Organizations assess all security and privacy controls employed within and inherited by the system during the initial system authorization. Following the initial authorization, the organization assesses all implemented security and privacy controls on an ongoing basis in accordance with its Information Security Continuous Monitoring (ISCM) strategy and privacy continuous monitoring strategy.¹⁵ The ongoing assessment and monitoring of controls use the assessment procedures defined in this publication. The frequency of such assessments and monitoring is determined by the organization, system owner, and/or common control provider and is approved by the authorizing official. Finally, at the end of the life cycle, security and privacy assessments are conducted to ensure that important organizational information, including personally identifiable information, are purged from the system prior to disposal and organizational retention schedules are adhered to.

Organizations are encouraged to develop a broad-based, organization-wide strategy for conducting security and privacy assessments to facilitate more cost-effective and consistent assessments across the inventory of systems. Maximizing the number of common controls employed within an organization significantly reduces the costs of development, implementation, and assessment of security and privacy controls; allows organizations to centralize and automate control assessments and amortize the cost of those assessments across all systems in the organization; and increases the consistency of security and privacy control implementations.

An organization-wide approach to identifying common controls early in the application of the RMF facilitates a more global strategy for assessing those common controls and sharing assessment results with system owners and authorizing officials. The sharing of assessment results among key organizational officials across system boundaries has many important benefits, including:

Organizations can also promote a more focused and cost-effective assessment process by developing specific assessment procedures that are tailored to their specific environments of operation and requirements (instead of relegating assessment procedure development tasks to individual control assessors or assessment teams) and by providing organization-wide tools, templates, and techniques to support more consistent assessments throughout the organization. 16

The roles responsible for conducting control assessments may include system owners, common control providers, system security and privacy officers, independent assessors, auditors, and Inspectors General with oversight by the authorizing official(s).¹⁷ There is also significant involvement in the assessment process of other parties within the organization who have a vested interest in the outcome of assessments. Other interested parties include mission and business owners and information owners/stewards (when those roles are filled by someone other than the system owner). It is imperative that system owners and common control providers identify and coordinate with other parties in the organization that have an interest in control assessments to help ensure that the organization’s core missions and business functions are adequately addressed in the assessment of security and privacy controls.

Organizations carefully consider the potential impacts of employing the assessment procedures defined in this publication when assessing the security and privacy controls in operational systems. Certain assessment procedures – particularly those that directly impact the operation or function of the hardware, software, or firmware components of a system – may inadvertently affect the routine processing, transmission, or storage of information that supports organizational missions or business functions. For example, a critical system component may be taken offline for assessment purposes, or a component may suffer a fault or failure during the assessment process. Organizations take the necessary precautions to ensure that organizational missions and business functions continue to be supported by systems and that any potential impacts to operational effectiveness resulting from assessment activities are considered in advance.

Building an effective assurance case¹⁸ for security and privacy control effectiveness is a process that involves compiling evidence from a variety of activities conducted during the system development life cycle that the controls employed in the system are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security and privacy requirements of the system and the organization and presenting the evidence in a manner that decision makers are able to use effectively in making risk-based decisions about the operation or use of the system (i.e., to manage risk). The evidence described above comes from the implementation of the security and privacy controls in the system and inherited by the system (i.e., common controls) and from the assessments of that implementation. Ideally, the assessor builds on previously developed materials that started with the specification of the organization’s information security and privacy needs and was further developed during the design, development, and implementation of the system. The materials developed while implementing security and privacy throughout the life cycle of the system provide the initial evidence for an assurance case.

During the assessment process, assessors obtain the evidence needed to allow the appropriate organizational officials to make objective determinations about the effectiveness of the security and privacy controls and the overall security and privacy state of the system. The assessment evidence needed to make such determinations can be obtained from a variety of sources, including information technology product and system assessments and – in the case of privacy assessments – documentation such as privacy impact assessments and Privacy Act system of record notices. Product assessments (also known as product testing, evaluation, and validation) are typically conducted by independent, third-party testing organizations. Assessments examine the security and privacy functions of products and established configuration settings. Assessments can be conducted to demonstrate compliance with industry, national, or international information security and privacy standards and developer/vendor claims. Since many information technology products are assessed by commercial testing organizations and then subsequently deployed in millions of systems, product assessments can be carried out at a greater level of depth and provide deeper insights into the security and privacy capabilities of the particular products.

System and common control assessments are typically conducted by system developers, system integrators, system owners, common control providers, assessors, auditors, Inspectors General, and organizational information security and privacy personnel. The assessors or assessment teams bring together available information about the system or common control, such as the results from individual component product assessments, information in the system security and privacy plans, other system/common control documentation, or previous assessment results, and conduct additional system-level or common control assessments using a variety of methods and techniques. System and common control assessments are used to compile and evaluate the evidence needed by organizational officials to determine how effectively the security and privacy controls employed in systems mitigate risks to organizational operations and assets, individuals, other organizations, and the Nation. The results of assessments conducted using system-specific and organization-specific assessment procedures derived from the guidelines in this publication contribute to compiling the necessary evidence to determine security and privacy control effectiveness in accordance with the assurance requirements documented in security and privacy plans.

Assurance Evidence from Developmental and Operational Activities

Organizations obtain security and privacy assurance by the actions taken by system developers, implementers, operators, maintainers, and assessors. Actions by individuals and/or groups during the development/operation of systems produce security and privacy evidence that contributes to the assurance, or measures of confidence, in the security and privacy functionality needed to deliver the security and privacy capability. The depth and coverage of these actions (as described in Appendix C) also contribute to the efficacy of the evidence and measures of confidence. The evidence produced by developers, implementers, operators, assessors, and maintainers during the system development life cycle (e.g., design/development artifacts and assessment results) contributes to the understanding of the effectiveness of security and privacy controls implemented by organizations.

The strength of the security and privacy functionality¹⁹ plays an important part in achieving the desired capabilities and subsequently satisfying the security and privacy requirements of organizations. System developers can increase the strength of security and privacy functionality by employing well-defined security and privacy policies and procedures, structured and rigorous design and development techniques, and sound system, security, and privacy engineering techniques as part of the system development process. The artifacts generated by development activities (e.g., functional specifications, system design documentation, and the results of testing and code analysis) can provide important evidence that systems and their components are more reliable and trustworthy. Security and privacy evidence can also be generated from testing conducted by independent, third-party assessment organizations and other assessment activities conducted by government and private sector organizations.²⁰

In addition to the evidence produced in the development environment, organizations can produce evidence from the operational environment that contributes to the assurance of functionality and security and privacy capabilities. Operational evidence includes records of remediation actions, the results of security incident reporting (including breaches involving personally identifiable information), and the results of organizational continuous monitoring activities. Such evidence helps determine the effectiveness of deployed security and privacy controls, changes to systems and environments of operation, and compliance with legislation, policies, directives, regulations, and standards. Security and privacy evidence – whether obtained from development or operational activities – helps organizations determine the extent to which their systems are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting stated security and privacy requirements, thus providing greater assurance in the system’s security and privacy capabilities.

The depth and coverage of security and privacy evidence can affect the level of assurance in the functionality implemented. Depth and coverage are attributes associated with assessment methods and the generation of security and privacy evidence.²¹ Assessment methods can be applied to support developmental and operational assurance. For developmental assurance, depth is associated with the rigor, level of detail, and formality of the artifacts produced during system design and development. The level of detail available in development artifacts can affect the type of testing, evaluation, and analysis conducted during the system development life cycle (e.g., basic testing, comprehensive testing, and focused testing, static/dynamic analysis). For operational assurance, the depth attribute addresses the rigor and level of detail for the assessment. In contrast, the coverage attribute is associated with the assessment methods employed during development and operations, addressing the scope and breadth of assessment objects included in the assessments (e.g., number and types of tests conducted on source code).

An assessment procedure consists of a set of assessment objectives, each with an associated set of potential assessment methods and assessment objects. An assessment objective includes one or more determination statements related to the [SP 800-53] control under review. The determination statements are linked to the content of the control (i.e., the security and privacy control functionality) to ensure the traceability of assessment results back to the fundamental control requirements. The application of an assessment procedure to a control produces assessment findings.²² Assessment findings reflect or are subsequently used to help determine the overall effectiveness of the control and help the authorizing official make an informed, risk-based decision on whether to place the system into operation or continue its operation.

Assessment objects identify the specific items being assessed as part of a given control and include specifications, mechanisms, activities, and individuals. Specifications are the document-based artifacts (e.g., policies, procedures, plans, system security and privacy requirements, functional specifications, architectural designs) associated with a system or common control. Mechanisms are the specific hardware, software, or firmware safeguards and countermeasures employed within a system or common control.²³ Activities are the specific protection-related actions supporting a system or common control that involve people (e.g., conducting system backup operations, monitoring network traffic, exercising a contingency plan). Individuals or groups of individuals are people applying the specifications, mechanisms, or activities described above.

Assessment methods define the nature of the assessor actions and include examine, interview, and test.

In all three assessment methods, the results are used to make specific determinations called for in the determination statements and thereby achieve the objectives for the assessment procedure. A complete description of assessment methods and assessment objects is provided in Appendix C.

Assessment methods have a set of associated attributes – depth and coverage – which help define the level of effort for the assessment. The attributes are hierarchical in nature, providing the means to define the rigor and scope of the assessment for the increased assurances that may be needed for some systems.

The appropriate depth and coverage attribute values for a particular assessment method are based on the assurance requirements specified by the organization and are an important component of protecting information commensurate with risk (i.e., risk management). As assurance requirements increase with regard to the development, implementation, and operation of controls within or inherited by the system, the rigor and scope of the assessment activities (as reflected in the selection of assessment methods and objects and the assignment of depth and coverage attribute values) tend to increase as well.²⁴ Appendix C provides a detailed description of assessment method attributes and attribute values.

The assessment objectives are numbered sequentially, first in accordance with the numbering scheme in [SP 800-53] and, subsequently, where necessary to further granularize the security or privacy control requirements to facilitate assessment. Square bracketed sequential numbers, as opposed to parentheses, are used to indicate that the control from SP 800-53 has been further granularized (e.g., AC-17a.[01], AC-17a.[02], AC-17a.[03]).

Figure 1 illustrates an example assessment procedure developed to assess the effectiveness of control AC-17. The assessment objective for AC-17 is derived from the base control statement described in [SP 800-53]. AC-17a.[01] is an example of a determination statement for a control item that is further granularized from SP 800-53. AC-17b. is an example of a determination statement for a control item that corresponds directly with the SP 800-53 control. Potential assessment methods and objects are added to each assessment procedure. Not all assessment procedures include all three potential assessment methods (i.e., examine, interview, test). The organization determines the assessment methods needed to provide the level of assurance required by the organization.

FIGURE 1: ASSESSMENT PROCEDURE FOR A CONTROL

Another example of granularization to support control assessments is the case of a privacy control requirement not being applicable to a particular system (e.g., the system does not process personally identifiable information); assessors can disregard such non-applicable requirements and still find that the control is satisfied. Figure 2 provides an example of control CM-04[25], which is further granularized to address security impacts in CM-04[01] and privacy impacts in CM-04[02].

FIGURE 2. ASSESSMENT PROCEDURE FOR A CONTROL FURTHER GRANULARIZED TO FACILITATE ASSESSMENT

Additionally, determination statements for organization-defined parameters (ODPs) are listed first and separately from the determination statements for each control item within each control or control enhancement to enable the assessor to quickly determine whether the ODPs are defined or selected by the organization. ODPs appear first in the determination statements, and each include a unique identifier associated with the control to facilitate a more efficient and streamlined assessment. ODPs include:

The ODP numbering convention is “XX-nn_ODP”, where XX is the two-character control family abbreviation, and nn is the control number (with a leading zero for single digits) followed by

Figure 3 provides an example of an assessment procedure for control CM-02 that includes two assignment operations: CM-02_ODP[01] and CM-02_ODP[02].

FIGURE 3. ASSESSMENT PROCEDURE FOR CONTROL WITH ORGANIZATION-DEFINED PARAMETER: ASSIGNMENT OPERATIONS

Figure 4 provides an example of an assessment procedure for a control, MP-07, that includes assignment operations and a selection operation. Selection operations include a list of potential parameter values that the organization chooses from and instructions to select one or more parameters. The list of parameter values is identified using braces { }, with each potential parameter value separated with a semicolon. When the ODP for a selection operation is referenced in a subsequent determination statement, the ODP unique identifier and phrase “SELECTED PARAMETER VALUE(S)” is surrounded by < >.

FIGURE 4. ASSESSMENT PROCEDURE FOR CONTROL WITH ORGANIZATION-DEFINED PARAMETER: SELECTION OPERATION

Figure 5 provides an example of an assessment procedure for a control, CA-03, that includes an ODP that consists of a selection operation with an embedded assignment operation. The selection operation, CA-03(01)_ODP[01], identifies a list of parameters to choose from, including another ODP. The assignment operation for CA-03(01)_ODP[02] is only defined if the organization selects the ODP from the list of parameters. When the ODP for a selection operation is referenced in a subsequent determination statement, the ODP unique identifier and phrase “SELECTED PARAMETER VALUE(S)” is surrounded by < >. In this scenario, if the embedded assignment operation is selected, it becomes the “SELECTED PARAMETER VALUE(S)”.

FIGURE 5. ASSESSMENT PROCEDURE FOR CONTROL WITH ORGANIZATION-DEFINED PARAMETERS: SELECTION OPERATION WITH EMBEDDED ASSIGNMENT OPERATION

Although not explicitly noted with each assessment method in the assessment procedure, the attribute values of depth and coverage²⁶ are assigned by the organization and specified within the assessment plan (e.g., the level of rigor for documentation review, the number of similar assessment objects to test). The assessor/assessment team applies the depth and coverage attributes in the execution of the assessment method against an assessment object to provide the level of assurance required by the organization.

If the control has any enhancements as designated by sequential parenthetical numbers (for example, AC-17(01) for the first enhancement for AC-17), assessment objectives are developed for each enhancement using the same process used for the base control. The resulting assessment objectives are numbered sequentially in the same way as the assessment procedure for the base control – first in accordance with the numbering scheme in [SP 800-53] and, subsequently, using bracketed sequential numbers to further apportion control enhancement requirements to facilitate assessments (e.g., AC-17(01), AC-17(02), AC-17(03)).

Figure 6 illustrates an example of an assessment procedure developed to assess the effectiveness of the first enhancement to security control AC-17, AC-17(01).

FIGURE 6: ASSESSMENT PROCEDURE FOR CONTROL ENHANCEMENT

CONDUCTING EFFECTIVE SECURITY AND PRIVACY CONTROL ASSESSMENTS

This chapter describes the process of assessing the security and privacy controls in organizational systems and environments of operation. The process to assess controls includes:

Additionally, this chapter describes assessing security and privacy capabilities.²⁷

FIGURE 7. OVERVIEW OF PROCESS TO CONDUCT EFFECTIVE SECURITY AND PRIVACY CONTROL ASSESSMENTS

Table 1 provides a summary of the purpose, roles, and expected outcomes of the Prepare for Security and Privacy Control Assessments Step.

TABLE 1. PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS SUMMARY

Conducting security and privacy control assessments can be difficult, challenging, and resource intensive. Security and privacy control assessments may be conducted by different organizational entities with distinct oversight responsibilities. However, success requires the cooperation and collaboration of all parties with a vested interest in the organization’s information security or privacy posture, including control assessors, system security and privacy officers, system owners, common control providers, authorizing officials, chief information officers, senior information security officers, senior agency officials for privacy/chief privacy officers, chief executive officers/heads of agencies, security and privacy staffs, Inspectors General, and OMB. Establishing an appropriate set of expectations before, during, and after an assessment is paramount to achieving an acceptable outcome (i.e., producing information necessary to help the authorizing official make a credible, risk-based decision on whether to place the system into operation or continue its operation).

Thorough preparation by the organization and assessors is an important aspect of conducting effective security and privacy control assessments. Preparatory activities address a range of issues relating to the cost, schedule, and performance of the assessment. From an organizational perspective, preparing for a security and privacy control assessment includes the following key activities:

Control assessors/assessment teams begin preparing for their respective assessments by:

In preparation for the assessment of security and privacy controls, the necessary background information is assembled and made available to the assessors or assessment team.³⁰ To the extent necessary to support the specific assessment, and depending upon whether security controls or privacy controls are being assessed, the organization identifies and arranges access to elements of the organization responsible for developing, documenting, disseminating, reviewing, and updating:

The availability of essential documentation as well as access to key organizational personnel and the system or common control being assessed are paramount to a successful assessment.

Organizations consider both the technical expertise and level of independence required in selecting security and privacy control assessors.³² Organizations ensure that assessors possess the required skills and technical expertise to successfully carry out assessments of system-specific, hybrid, and common controls.³³ Skills and expertise includes knowledge of and experience with the specific hardware, software, and firmware components employed by the organization. An independent assessor is any individual capable of conducting an impartial assessment of security and privacy controls employed within or inherited by a system. Impartiality implies that security and privacy control assessors are free from any perceived or actual conflicts of interest with respect to the development, operation, and/or management of the system or the determination of security and privacy control effectiveness.³⁴ The authorizing official or designated representative determines the required level of independence for assessors based on the results of the security categorization process for the system (in the case of security control assessments) and the risk to organizational operations and assets, individuals, other organizations, and the Nation. The authorizing official determines whether the level of assessor independence is sufficient to provide confidence that the assessment results produced are sound and can be used to make a risk-based decision on whether to place the system or common control into operation or continue its operation.

Independent security and privacy control assessment services can be obtained from other elements within the organization or be contracted to a public or private sector entity outside of the organization. In special situations (e.g., when the organization that owns the system or common control is small or the organizational structure requires that the security or privacy control assessment be accomplished by individuals who are in the developmental, operational, and/or management chain of the system owner), independence in the assessment process can be achieved by ensuring that the assessment results are carefully reviewed and analyzed by an independent team of experts to validate the completeness, consistency, and veracity of the results.³⁵

Table 2 provides a summary of the purpose, roles, and expected outcomes of the Develop Security and Privacy Assessment Plans Step.

TABLE 2. DEVELOP SECURITY AND PRIVACY PLANS SUMMARY

The security assessment plan and privacy assessment plan provide the objectives for the security and privacy control assessments, respectively, as well as a detailed roadmap of how to conduct such assessments. The assessment plans may be developed as one integrated plan or as distinct plans, depending upon organizational needs. The following steps are considered by assessors when developing plans to assess the security and privacy controls in organizational systems or common controls available for inheritance:

The security plan and privacy plan provide an overview of the security and privacy requirements for the system and organization and describe the security controls and privacy controls in place or planned for meeting those requirements. For the assessment of common controls that are not implemented by a system, a document equivalent to the security or privacy plan may be used. The assessor starts with the security or privacy controls described in the security or privacy plan and considers the purpose of the assessment. A security or privacy control assessment can be a complete assessment of all controls in a system (e.g., during an initial system authorization process), a partial assessment of the controls in a system (e.g., during system development as part of a targeted assessment resulting from changes affecting specific controls or where controls were previously assessed and the results accepted in the reciprocity process), or a common control assessment.

For partial assessments, system owners and common control providers collaborate with organizational officials with an interest in the assessment (e.g., senior information security officers, senior agency officials for privacy/chief privacy officers, mission/information owners, Inspectors General, and authorizing officials) to determine which controls are to be assessed. The determination of the controls to be assessed depends on the purpose of the assessment. For example, during the initial phases of the system development life cycle, specific controls may be selected for assessment to promote the early detection of weakness and deficiencies and a more cost-effective approach to risk response. After the initial authorization to operate has been granted, targeted assessments may be necessary when changes are made to the system, specific security or privacy controls, common controls, or the environment of operation. In such cases, the focus of the assessment is on the controls that may have been affected by the change.

SP 800-53A provides assessment procedures for each security and privacy control and control enhancement in [SP 800-53]. For each control in the security plan and privacy plan to be included in the assessment, assessors select the corresponding assessment procedure from Chapter 4. The selected assessment procedures can vary from assessment to assessment based on the current content of the security plans and privacy plans and the purpose of the assessment (e.g., complete assessment, partial assessment, common control assessment).

In a manner similar to how the controls from [SP 800-53] are tailored for the organization’s mission, business functions, characteristics of the system, and operating environment, organizations tailor the assessment procedures in Chapter 4 to meet specific organizational needs. Organizations have the flexibility to perform the tailoring process at the organization level for all systems or common controls, at the individual system level, or using a combination of organization-level and system-specific approaches. Control assessors determine if the organization provides additional tailoring guidance prior to initiating the tailoring process. Assessment procedures are tailored by:

Organizations can specify, document, and configure their systems in a variety of ways, and the content and applicability of existing assessment evidence varies. This variety may result in the need to apply a mixture of assessment methods to assessment objects to generate the assessment evidence needed to determine whether the security and privacy controls are effective in their application. Additionally, as described in Section 2.3 and Section 2.4, the number and type of assessment methods and assessment objects needed to provide the required assurance varies based on the depth and coverage needed for the assessment. Therefore, the assessment methods and objects provided with each assessment procedure are termed potential to reflect the need to choose the specific methods and objects most appropriate for a specific assessment. The assessment methods and objects chosen are those deemed necessary to produce the evidence needed to make the determinations described in the determination statements in support of assurance requirements and the associated management of risk. The potential methods and objects in the assessment procedure are provided as a resource to assist in the selection of appropriate methods and objects and not with the intent of limiting the selection. Organizations use their judgment when selecting assessment methods and associated assessment objects. Organizations select those methods and objects that most cost-effectively manage risk and contribute to making the determinations associated with the assessment objective.³⁸ The quality of assessment results is based on the soundness of the rationale provided for selecting the methods and objects, not the specific set of methods and objects applied. It is not necessary, in most cases, to apply every assessment method to every assessment object to obtain the desired assurance.

In addition to selecting appropriate assessment methods and objects, each assessment method (i.e., examine, interview, and test) is associated with the depth and coverage attributes described in Appendix C. The attribute values identify the rigor (depth) and scope (coverage) of the assessment procedures executed by the assessor. The values selected by the organization are based on the characteristics of the system being assessed (including assurance requirements) and the specific determinations to be made. The depth and coverage attribute values are associated with the assurance requirements specified by the organization (i.e., the rigor and scope of the assessment increases in direct relationship with the assurance requirements, which in turn increase in direct relationship with the adverse impact of loss).

Assessors note which security and privacy controls (or parts of such controls) in security plans or privacy plans are designated as common controls.³⁹ Since the assessment of common controls is the responsibility of the organizational entity that developed and implemented the controls (i.e., common control provider), the assessment procedures in Chapter 4 are also used to assess common controls. The results from the common control assessment are made available to organizational systems and system owners that elect to inherit the common controls.⁴⁰

Another consideration in assessing common controls is awareness of system-specific aspects of a control that are not covered by the organizational entities responsible for the common aspects of the control. Such controls are referred to as hybrid controls. For example, CP-02, the contingency planning security control, may be considered a hybrid control by the organization if there is a contingency plan developed by the organization for all organizational systems. System owners are expected to adjust or tailor the organization-developed contingency plan when there are specific aspects of the plan that need to be defined for the particular system where the control is employed. For each hybrid control, assessors include in security assessment plans or privacy assessment plans the portions of the assessment procedures from Chapter 4 related to the parts of the control that are system-specific to ensure that, along with the results from common control assessments, all aspects of the control are assessed.

In system security and privacy plans, common controls or portions of hybrid controls implemented and maintained by the common control provider are indicated as “inherited” with a reference to the common control provider. The system owner is not responsible for assessing common controls or the inherited portion of hybrid controls. Common controls are assessed separately and are not reassessed at the system level by each system that inherits them. However, the assessor verifies if the system does, in fact, inherit and utilize the common control as indicated in the system security plans and privacy plans. The assessment of common controls (for the common control provider) is carried out using the same process as a system control assessment.

The assessment procedures in SP 800-53A may be adapted to address system-, platform-, or organization-specific dependencies. For example, the assessment of a Linux implementation of control IA-02 for the identification and authentication of users might include an explicit examination of any key-based, “password-less” login capability and potential risks inherent from any deficiency in key management, account management, system and boundary protection, physical and environmental protection, and other safeguards to prevent identification and authentication bypass by unauthorized users or processes acting on behalf of users.

Reuse of assessment results from previously accepted or approved assessments is considered in the body of evidence for determining overall security and privacy control effectiveness. Previously accepted or approved assessments include assessments of inherited common controls that are managed by the organization and support multiple systems, assessments of security or privacy controls that are reviewed as part of the control implementation (e.g., CP-02 requires a review of the contingency plan), or security-related information generated by the organization’s ISCM program. The acceptability of reusing assessment results in a security control assessment or privacy control assessment is coordinated with and approved by the users of the assessment results. It is essential that system owners and common control providers collaborate with authorizing officials and other appropriate organizational officials to determine the acceptability of using previous assessment results. When considering the reuse of assessment results and the value of those results to the current assessment, assessors determine the credibility of the assessment evidence, the appropriateness of previous analysis, and the applicability of the assessment evidence to current system operating conditions. If previous assessment results are reused, the date and type of the original assessment are documented in the assessment plan and assessment report.

In certain situations, it may be necessary to supplement previous assessment results under consideration for reuse with additional assessment activities to fully address the current assessment objectives. For example, if an independent evaluation of an information technology product did not test a particular configuration setting that is employed by the organization in a system, then the assessor may need to supplement the original test results with additional testing to cover that configuration setting for the current system environment. The decision to reuse assessment results is documented in the security assessment plan or privacy assessment plan and the final security assessment report or privacy assessment report, and it is consistent with legislation, policies, directives, standards, and guidelines.

The following items are considered when validating previous assessment results for reuse:

The assessment procedures in Chapter 4 need to be adjusted, as appropriate, to accommodate the assessment of external systems.⁴¹ Because the organization does not always have direct control over the security or privacy controls used in external systems or sufficient visibility into the development, implementation, and assessment of those controls, alternative assessment approaches may need to be applied, resulting in the need to tailor the assessment procedures described in Chapter 4. Where required assurances of agreed-upon security or privacy controls within a system are documented in contracts or service-level agreements, assessors review the contracts or agreements and tailor the assessment procedures as appropriate to assess the security or privacy controls or the security and privacy control assessment results provided through contracts or agreements. In addition, assessors consider any other assessments that have been conducted or are in the process of being conducted for external systems that are relied upon with regard to protecting the system under assessment. Applicable information from these assessments, if deemed reliable, is incorporated into the security assessment report or privacy assessment report, as appropriate.

Based on organizational policies, mission or business function requirements, and an assessment of risk, organizations may choose to develop and implement additional (organization-specific) controls or control enhancements for their systems that are beyond the scope of [SP 800-53]. Such controls are documented in the security plan and privacy plan as controls not found in SP 800-53. To assess the controls not found in SP 800-53, assessors use the guidelines in Chapter 2 to develop assessment procedures for those controls and control enhancements. The assessment procedures developed are subsequently integrated into the assessment plan, as appropriate.

Assessors have flexibility in organizing assessment plans that meet the needs of the organization and that provide the best opportunity for obtaining the necessary evidence to determine security or privacy control effectiveness while reducing overall assessment costs. Combining and consolidating assessment procedures is one area where flexibility can be applied. During the assessment of a system, assessment methods are applied numerous times to a variety of assessment objects within a particular family of controls. To save time, reduce assessment costs, and maximize the usefulness of assessment results, assessors review the selected assessment procedures for the control families and combine or consolidate the procedures (or parts of procedures) whenever possible or practicable. For example, assessors may consolidate interviews with key organizational officials who deal with a variety of security- or privacy-related topics. Assessors may have other opportunities for significant consolidation and cost savings by examining all policies and procedures from the families of security controls and privacy controls at the same time or by organizing groups of related policies and procedures that could be examined as a unified entity. Obtaining and examining configuration settings from similar hardware and software components within the system is another example that can provide significant assessment efficiencies.

An additional area for consideration in optimizing the assessment process is the sequence in which controls are assessed. The assessment of some controls before others may provide useful information that facilitates understanding and more efficient assessments of other controls. For example, controls such as CM-2 (Baseline Configuration), CM-8 (System Component Inventory), PL-2 (System Security and Privacy Plans), RA-2 (Security Categorization), and RA-3 (Risk Assessment) produce general descriptions of the system. Assessing related controls early in the assessment process may provide a basic understanding of the system that can aid in assessing other controls. In SP 800-53, the discussion section for each control identifies related controls that can provide useful information for organizing the assessment procedures. For example, AC-19 (Access Control for Mobile Devices) lists controls MP-4 (Media Storage) and MP-5 (Media Transport) as being related to AC-19. Since AC-19 is related to MP-4 and MP-5, the sequence in which assessments are conducted for AC-19, MP-4, and MP-5 may facilitate the reuse of assessment information from one control in assessing other related controls.

After selecting the assessment procedures (including developing necessary procedures not contained in the SP 800-53A catalog of procedures), tailoring the procedures for system/platform-specific and organization-specific conditions, optimizing the procedures for efficiency, and addressing the potential for unexpected events that may impact the assessment, the assessment plan is finalized and the schedule is established, including key milestones for the assessment process. Once the assessment plan is completed, the plan is reviewed and approved by appropriate organizational officials⁴² to ensure that the plan is complete, consistent with the security and privacy objectives of the organization and the organization’s assessment of risk, and cost-effectively manages risk with regard assessment methods and objects, depth and coverage attributes, and to the resources allocated for the assessment.

Table 3 provides a summary of the purpose, roles, and expected outcomes of the Conduct Security and Privacy Control Assessments Step.

TABLE 3. CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS SUMMARY

After the assessment plan is approved by the organization, the assessor(s) or assessment team executes the plan in accordance with the agreed-upon schedule. Determining the size and organizational makeup of the assessment team (i.e., skill sets, technical expertise, and assessment experience of the individuals composing the team) is one of the risk management decisions made by the organization requesting and initiating the assessment. The results of control assessments are documented in assessment reports, which are key inputs in the authorization package developed by system owners and common control providers for authorizing officials.⁴³ Assessment reports include information from assessors (in the form of assessment findings) that is necessary to determine the effectiveness of the security and privacy controls employed within the system.⁴⁴ Assessment reports are an important factor in an authorizing official’s determination of risk. Organizations may choose to develop an assessment summary from the detailed findings that are generated by assessors during the security control assessments and privacy control assessments. An assessment summary can provide an authorizing official with an abbreviated version of an assessment report that focuses on the highlights of the assessment, synopsis of key findings, and recommendations for addressing weaknesses and deficiencies in the security or privacy controls assessed. Appendix E provides information on the recommended content of assessment reports.

Assessment objectives are achieved by applying the designated assessment methods to selected assessment objects and compiling or producing the evidence necessary to make the determination associated with each assessment objective. Each determination statement⁴⁵ contained within an assessment procedure executed by an assessor produces one of the following findings:

A finding of “satisfied” indicates that – for the portion of the control addressed by the determination statement – the assessment objective for the control has been met and produces a fully acceptable result.

A finding of “other than satisfied” indicates – for the portion of the control addressed by the determination statement – potential anomalies in the operation or implementation of the control that may need to be addressed by the organization. A finding of “other than satisfied” may also indicate that the assessor was unable to obtain sufficient information to make the determination called for in the determination statement for reasons specified in the assessment report. For assessment findings that are “other than satisfied”, organizations may choose to define subcategories of findings indicating the severity and/or criticality of the weaknesses or deficiencies discovered and the potential adverse effects on organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation. Defining such subcategories can help to establish priorities for needed risk mitigation actions.

Assessor findings are an unbiased, factual reporting of what was found concerning the control assessed. For each finding of “other than satisfied”, assessors indicate which parts of the control are affected by the finding (i.e., aspects of the control that were deemed not satisfied or were not able to be assessed) and describe how the actual state of the control differs from the planned or expected/desired state. The potential for compromises to confidentiality, integrity, and availability or privacy risks due to “other than satisfied” findings are also noted by the assessor in the assessment report.

Risk determination and acceptance activities are conducted by the organization post-assessment as part of the risk management strategy established by the organization. Post-assessment risk management activities involve the senior leadership of the organization, such as heads of agencies, mission and business owners, information owners/stewards, risk executive (function), and authorizing officials in consultation with appropriate organizational support staff (e.g., senior information security officers, senior agency officials for privacy/chief privacy officers, chief information officers, system owners, common control providers, and assessors). Security control assessment and privacy control assessment results are documented at a level of detail appropriate for the assessment in accordance with the reporting format prescribed by organizational policy, NIST guidelines, and OMB policy. The reporting format is appropriate for the type of assessment conducted (e.g., self-assessments by system owners and common control providers, independent verification and validation, independent assessments supporting the authorization process, automated assessments, or independent audits or inspections).

System owners and common control providers rely on the expertise and technical judgment of assessors to assess the security and privacy controls in the system and inherited by the system and provide recommendations on how to respond to the control assessment results (e.g., accept risk, reject risk, mitigate risk by correcting weaknesses or deficiencies in the controls and reducing or eliminating identified vulnerabilities). The assessment results produced by the assessor (i.e., findings of “satisfied” or “other than satisfied”, identification of the parts of the security or privacy control that did not produce a satisfactory result, and a description of resulting potential for compromises to the system or its environment of operation) are provided to system owners and common control providers in the initial security assessment reports and privacy assessment reports. System owners and common control providers may choose to act on selected recommendations of the assessor before the assessment reports are finalized if there are specific opportunities to correct weaknesses or deficiencies in the security or privacy controls or to correct and/or clarify misunderstandings or interpretations of assessment results.⁴⁶ Security or privacy controls that are modified, enhanced, or added during this process are reassessed by the assessor prior to the production of the final assessment reports.

Table 4 provides a summary of the purpose, roles, and expected outcomes of the Analyze Assessment Report Results Step.

TABLE 4. ANALYZE ASSESSMENT REPORT RESULTS SUMMARY

The results of control assessments ultimately influence control implementations, the content of security plans and privacy plans, and the respective plans of action and milestones. Accordingly, system owners and common control providers review the security assessment reports, privacy assessment reports, and updated risk assessment documentation and artifacts and – with the concurrence of designated organizational officials (e.g., authorizing officials, chief information officer, senior information security officer, senior agency officials for privacy/chief privacy officers, mission/information owners) – determine the appropriate steps required to respond to those weaknesses and deficiencies identified during the assessment. By using the labels of “satisfied” and “other than satisfied”, the reporting format for the assessment findings provides organizational officials with visibility into specific weaknesses and deficiencies in security or privacy controls within the system or inherited by the system and facilitates a disciplined and structured approach to responding to risks in accordance with organizational priorities. For example, system owners or common control providers in consultation with designated organizational officials may decide that certain assessment findings marked as “other than satisfied” present no significant risk to the organization and can be accepted. Conversely, system owners or common control providers may decide that certain findings marked as “other than satisfied” are significant and require remediation actions. In all cases, the organization reviews each assessment finding of “other than satisfied” and applies its judgment with regard to the severity of the finding and whether it is significant enough to warrant further investigation or remedial action.⁴⁷

Senior leadership involvement in the mitigation process may be necessary to ensure that the organization’s resources are effectively allocated in accordance with organizational priorities, provide resources first to the systems that support the most critical and sensitive missions for the organization, or correct the deficiencies that pose the greatest degree of risk. Ultimately, the assessment findings and any subsequent response actions (informed by the updated risk assessment) trigger updates to the key artifacts used by authorizing officials to determine the security and privacy risks of the system and its suitability for authorization to operate. The artifacts include security plans and privacy plans, security assessment reports and privacy assessment reports, and the respective plans of action and milestones.

In accordance with [SP 800-53], organizations may define a set of security and privacy capabilities as a precursor to the security and privacy control selection process. The concept of capability⁴⁸ recognizes that the protection of individuals’ privacy and information being processed by systems seldom derives from a single security or privacy safeguard or countermeasure. In most cases, such protection results from the selection and implementation of a set of mutually reinforcing security and privacy controls. Each control contributes to the overall organization-defined capability with some controls potentially contributing to a greater degree and other controls contributing to a lesser degree. For example, organizations may wish to define a capability for secure remote authentication. A secure remote authentication capability can be achieved by the implementation of a set of security controls from SP 800-53 (i.e., IA-02(01), IA-02(02), IA-02(08)], and SC-08(01)).

Security and privacy capabilities can address a variety of areas, including technical means, physical means, procedural means, or any combination thereof. By employing the capability concept, organizations can obtain greater visibility into and a better understanding of the relationships (i.e., dependencies) among controls, the effects of specific control failures on organization-defined capabilities, and the potential severity of control weaknesses or deficiencies. However, when specific capabilities are affected by the failure of particular security and privacy controls, the capability approach may add complexity to assessments and necessitate root cause failure analysis to determine which control or controls are contributing to the failure. The greater the number of controls included in an organization-defined capability, the more difficult it may be to ascertain the root cause of failures. There may also be interactions among defined capabilities, which may contribute to the complexity of assessments. If it is found that a control is neither contributing to a defined capability nor to the overall security and privacy of the system, the organization revisits the RMF Select step, tailors the control set, and documents the rationale in the system security plan or privacy plan.

Traditionally, assessments have been conducted on a control-by-control basis and produce results that are characterized as pass (i.e., control satisfied) or fail (i.e., control not satisfied). However, the failure of a single control or, in some cases, the failure of multiple controls may not affect the overall security and privacy capability required by an organization. This is not to say that such controls do not contribute to the security or privacy of the system and/or organization (as defined by the security requirements and privacy requirements during the initiation phase of the system development life cycle) but rather that such controls may not support the particular security or privacy capability. Furthermore, every implemented security and privacy control may not necessarily support or need to support an organization-defined capability.

When organizations employ the concept of capabilities, automated and manual assessments account for all security and privacy controls that comprise the security and privacy capabilities. Assessors are aware of how the controls work together to provide such capabilities. In this way,

Ultimately, authorization decisions (i.e., risk acceptance decisions) are made based on the degree to which the desired security and privacy capabilities have been effectively achieved and are meeting the security and privacy requirements defined by an organization. Risk-based decisions are directly related to organizational risk tolerance that is defined as part of an organization’s risk management strategy.

The grouping of controls into security and privacy capabilities necessitates root cause analyses to determine if the failure of a particular security or privacy capability can be traced to the failure of one or more security or privacy controls based on the established relationships among controls. The structure of the assessment procedures in this publication with the token-level decomposition and labelling of assessment objectives linked to the specific content of security and privacy controls supports such root cause analysis. Thus, assessments of security and privacy controls (defined as part of capabilities) can be tailored based on the guidance in Section 3.2.3 and [SP 800-137] to define the resource expenditures (e.g., frequency and level of effort) associated with such assessments. This additional precision in assessments is essential to supporting the continuous monitoring strategies developed by organizations and the ongoing authorization decisions of senior leaders.

Figure 8 summarizes the security and privacy control assessment process, including the activities carried out before, during, and after the assessment.

FIGURE 8: SECURITY AND PRIVACY CONTROL ASSESSMENT PROCESS OVERVIEW

OBJECTIVES, METHODS, AND OBJECTS FOR ASSESSING SECURITY AND PRIVACY CONTROLS

This chapter provides a catalog of procedures to assess the security and privacy controls and control enhancements in [SP 800-53].⁴⁹ Assessors select assessment procedures from the catalog in accordance with the guidance provided in Section 3.2. Since the contents of the security and privacy plan are the basis for the development of the security and privacy assessment plans and the assessments, there will likely be assessment procedures in the catalog not used by assessors because the associated security and privacy controls or control enhancements are not contained in the security and privacy plan for the system,⁵⁰ or the security and privacy controls or control enhancements are not being assessed at this time.

Section 2.4 provides an overview of the assessment procedures, including the naming and numbering convention, assessment objectives, determination statements, potential assessment methods, and objects.

Appendix C provides definitions of the assessment methods, applicable objects, and additional information on assessment attributes of depth and coverage.

The same assessment object may appear in multiple assessment object lists in a variety of assessment procedures. The same object may be used in multiple contexts to obtain needed information or evidence for a particular aspect of an assessment. Assessors use the general references as appropriate to obtain the necessary information to make the specified determinations required by the assessment objective. For example, a reference to access control policy appears in the assessment procedures for AC-02 and AC-07. For assessment procedure AC-02, assessors use the access control policy to find information about that portion of the policy that addresses account management for the system. For assessment procedure AC-07, assessors use the access control policy to find information about that portion of the policy that addresses unsuccessful login attempts for the system.

Assessors are responsible for combining and consolidating the assessment procedures whenever possible or practical. Optimizing assessment procedures can save time, reduce assessment costs, and maximize the usefulness of assessment results. Assessors optimize assessment procedures by determining the best sequencing of the procedures. The assessment

of some security and privacy controls before others may provide information that facilitates understanding and assessment of other controls.⁵¹

The assessment procedures are published in multiple data formats, including comma-separated values (CSV), plain text, and Open Security Controls Assessment (OSCAL). The available data formats are accessible from on the NIST SP 800-53A Revision 5, publication details page at https://csrc.nist.gov/publications/detail/sp/800-53A/rev-5. The OSCAL Content Git Repository is available at https://github.com/usnistgov/oscal-content.

Whereas a set of potential assessment methods are included in the following catalog of assessment procedures, the potential assessment methods are not intended to be mandatory or exclusive. Depending on the particular circumstances of the system or organization to be assessed, not all methods may be required, or other assessment methods may also be used. In addition, the set of potential assessment objects listed in the catalog are not intended to be mandatory but rather a set from which the necessary and sufficient set of objects for a given assessment can be selected to make the appropriate determinations. Organizational assurance requirements and other risk management-related factors (e.g., system categorization, organizational risk tolerance) are primary drivers for determining the appropriate assessment methods and objects for a given assessment.

TIP #1: Select only those assessment procedures from Chapter 4 that correspond to the controls and control enhancements in the approved system security plan and privacy plan to be included in the assessment.

TIP #2: The assessment procedures selected from Chapter 4 are example procedures that serve as a starting point for organizations preparing for assessments. These assessment procedures are tailored as necessary by the assessors in accordance with the guidance in Section 3.2.3 to adapt to specific organizational requirements and operating environments.

TIP #3: With respect to the assessment procedures in Chapter 4, assessors need only apply those procedures, methods, and objects necessary for making a final determination that a particular security control requirement is “satisfied” or “not satisfied” (see Section 3.3).

TIP #4: To each assessment method, assessors apply values for depth and coverage (described in Appendix C) that are commensurate with the characteristics of the system (including assurance requirements) and the specific assessment activity that supports making a determination of the effectiveness of the security controls under review. The values selected for the depth and coverage attributes indicate the relative effort required in applying an assessment method to an assessment object (i.e., the rigor and scope of the activities associated with the assessment). The depth and coverage attributes, while not repeated in every assessment procedure in this appendix, can be represented as follows:

Interview: [assign attribute values: <depth>, <coverage>]. [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities].

TIP #5: Assessors may find useful assessment-related information in the Discussion and Related Controls section of each control described in [SP 800-53]. Information from the discussion about related controls can be used to carry out more effective assessments with regard to the application of assessment procedures and the reuse of assessment artifacts.

TIP #6: For controls with ODPs, the ODP values are defined during the RMF Select step and updated as necessary during the RMF Implement and Monitor steps. If ODP values are not defined and implemented, control effectiveness cannot be verified, resulting in an “other than satisfied” finding.

TIP #7: Organizations may refer to this publication or the derivative data formats to easily identify all of the control parameters whose values to define. The ODP definitions are highlighted within the assessment procedure listing and can be filtered using keyword “_ODP” or “XX-nn_ODP” (where XX is the two-character control family abbreviation, and nn is the control number).

Note: When assessing agency compliance with NIST guidance, auditors, Inspectors General, evaluators, and/or assessors consider the intent of the security and privacy concepts and principles articulated within the particular guidance document and how the agency applied the guidance in the context of its specific mission responsibilities, operational environments, and unique organizational conditions.