Example NIST 800-53 rev4 Written Information Security ...

1 Written Information Security PROGRAM (WISP) ACME Business Consulting, Inc. Written Information Security Program (WISP) - Version Page 2 of 227 TABLE OF CONTENTS Written Information Security PROGRAM (WISP) OVERVIEW 9 INTRODUCTION 9 PURPOSE 9 SCOPE & APPLICABILITY 10 POLICY OVERVIEW 10 VIOLATIONS 10 EXCEPTIONS 10 UPDATES 10 KEY TERMINOLOGY 11 Information Security PROGRAM STRUCTURE 13 POLICIES, STANDARDS, PROCEDURES & GUIDELINES STRUCTURE 13 Information Security CONTROL OBJECTIVES 13 CONTROL OBJECTIVE PRECEDENCE 15 Information Security PROGRAM ACTIVITIES 15 Information Security CONSIDERATIONS FOR PROTECTING SYSTEMS 15 COMMON CONTROLS 16 PROGRAM MANAGEMENT (PM)

2 16 PM-01: Information Security PROGRAM PLAN 16 PM-02: ASSIGNED Information Security RESPONSIBILITIES 17 PM-03: Information Security RESOURCES 17 PM-04: VULNERABILITY REMEDIATION PROCESS 17 PM-05: Information SYSTEM INVENTORY 17 PM-06: Information Security MEASURES OF PERFORMANCE 18 PM-07: ENTERPRISE ARCHITECTURE 18 PM-08: STATUTORY, REGULATORY & CONTRACTUAL COMPLIANCE 19 PM-09: RISK MANAGEMENT STRATEGY 19 PM-10: Security AUTHORIZATION PROCESS 19 PM-11: BUSINESS PROCESS DEFINITION 20 PM-12: INSIDER THREAT PROGRAM 20 PM-13: Information Security WORKFORCE 20 PM-14: TESTING, TRAINING & MONITORING 21 PM-15: CONTACTS WITH Security GROUPS & ASSOCIATIONS 21 PM-16: THREAT AWARENESS PROGRAM 21 MANAGEMENT CONTROLS 23 AWARENESS & TRAINING (AT) 23 AT-01: Security AWARENESS & TRAINING POLICY & PROCEDURES 23 AT-02: Security AWARENESS 24 AT-03: Security TRAINING 24 AT-04: Security TRAINING RECORDS 25 AT-05: Security INDUSTRY ALERTS & NOTIFICATION PROCESS 26 PERSONNEL Security (PS) 27 PS-01: PERSONNEL Security POLICY & PROCEDURES 27 PS-02: POSITION RISK DESIGNATION (POSITION CATEGORIZATION) 27 PS-03: PERSONNEL SCREENING 28 PS-04: PERSONNEL TERMINATION 29 PS-05: PERSONNEL TRANSFER 30 PS-06: ACCESS AGREEMENTS 30 PS-07.

3 THIRD-PARTY PERSONNEL Security 30 PS-08: PERSONNEL SANCTIONS 31 PLANNING (PL) 32 PL-01: Security PLANNING POLICY & PROCEDURES 32 Written Information Security Program (WISP) - Version Page 3 of 227 PL-02: SYSTEM Security PLAN (SSP) 32 PL-03: SYSTEM Security PLAN UPDATE 34 PL-04: RULES OF BEHAVIOR 34 PL-05: PRIVACY IMPACT ASSESSMENT (PIA) 35 PL-06: Security -RELATED ACTIVITY PLANNING 35 PL-07: Security CONCEPT OF OPERATIONS 35 PL-08: Security ARCHITECTURE 36 PL-09: CENTRAL MANAGEMENT 36 RISK ASSESSMENT (RA) 36 RA-01: RISK ASSESSMENT POLICY & PROCEDURES 36 RA-02: Security CATEGORIZATION 37 RA-03: RISK ASSESSMENT 37 RA-04: RISK ASSESSMENT UPDATE 38 RA-05: VULNERABILITY SCANNING 38 RA-06: TECHNICAL SURVEILLANCE COUNTERMEASURES Security 41 SYSTEM & SERVICE ACQUISITION (SA) 41 SA-01: SYSTEM & SERVICES ACQUISITION POLICY & PROCEDURES 41 SA-02: ALLOCATION OF RESOURCES 41 SA-03: SYSTEM DEVELOPMENT LIFE CYCLE (SDLC) 42 SA-04: ACQUISITION PROCESS 42 SA-05: Information SYSTEM DOCUMENTATION 44 SA-06: SOFTWARE USAGE RESTRICTIONS 46 SA-07: USER-INSTALLED SOFTWARE 46 SA-08: Security ENGINEERING PRINCIPLES 46 SA-09: EXTERNAL Information SYSTEM SERVICES 46 SA-10: DEVELOPER CONFIGURATION MANAGEMENT 49 SA-11.

4 DEVELOPER Security TESTING 50 SA-12: SUPPLY CHAIN PROTECTION 52 SA-13: TRUSTWORTHINESS 53 SA-14: CRITICALITY ANALYSIS 54 SA-15: DEVELOPMENT PROCESS, STANDARDS & TOOLS 54 SA-16: DEVELOPER-PROVIDED TRAINING 55 SA-17: DEVELOPER Security ARCHITECTURE & DESIGN 55 SA-18: TAMPER RESISTANCE & DETECTION 56 SA-19: COMPONENT AUTHENTICITY 56 SA-20: CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTS 57 SA-21: DEVELOPER SCREENING 57 SA-22: UNSUPPORTED SYSTEM COMPONENTS 57 OPERATIONAL CONTROLS 59 CERTIFICATION, ACCREDITATION & Security ASSESSMENTS (CA) 59 CA-01: Security ASSESSMENT POLICY & PROCEDURES 59 CA-02: Security ASSESSMENTS 59 CA-03: Information SYSTEM CONNECTIONS 61 CA-04: Security VERIFICATION 62 CA-05: PLAN OF ACTION & MILESTONES (POA&M) 62 CA-06: Security AUTHORIZATION 62 CA-07: CONTINUOUS MONITORING 63 CA-08: PENETRATION TESTING 64 CA-09: INTERNAL SYSTEM CONNECTIONS 65 CONTINGENCY PLANNING (CP) 65 CP-01: CONTINGENCY PLANNING POLICY & PROCEDURES 65 CP-02: CONTINGENCY PLAN 65 CP-03: CONTINGENCY TRAINING 67 CP-04: CONTINGENCY PLAN TESTING 67 CP-05: CONTINGENCY PLAN UPDATE 68 CP-06: ALTERNATE STORAGE SITE 68 CP-07.

5 ALTERNATE PROCESSING SITE 69 Written Information Security Program (WISP) - Version Page 4 of 227 CP-08: TELECOMMUNICATIONS SERVICES 70 CP-09: Information SYSTEM BACKUP 71 CP-10: Information SYSTEM RECOVERY & RECONSTITUTION 73 CP-11: ALTERNATE COMMUNICATIONS PROTOCOLS 74 CP-12: SAFE MODE 74 CP-13: ALTERNATIVE Security MEASURES 75 INCIDENT RESPONSE (IR) 75 IR-01: INCIDENT RESPONSE POLICY & PROCEDURES 75 IR-02: INCIDENT RESPONSE TRAINING 75 IR-03: INCIDENT RESPONSE TESTING 76 IR-04: INCIDENT HANDLING 76 IR-05: INCIDENT MONITORING 78 IR-06: INCIDENT REPORTING 78 IR-07: INCIDENT REPORTING ASSISTANCE 79 IR-08: INCIDENT RESPONSE PLAN (IRP) 80 IR-09: Information SPILLAGE RESPONSE 80 IR-10: INTEGRATED Information Security ANALYSIS TEAM 82 MAINTENANCE (MA) 82 MA-01: MAINTENANCE POLICY & PROCEDURES 82 MA-02: CONTROLLED MAINTENANCE 82 MA-03: MAINTENANCE TOOLS 83 MA-04: NON-LOCAL MAINTENANCE 84 MA-05: MAINTENANCE PERSONNEL 86 MA-06: TIMELY MAINTENANCE 87 MEDIA PROTECTION (MP) 87 MP-01: MEDIA PROTECTION POLICY & PROCEDURES 87 MP-02: MEDIA ACCESS 87 MP-03: MEDIA MARKING 88 MP-04: MEDIA STORAGE 89 MP-05: MEDIA TRANSPORTATION 89 MP-06: MEDIA SANITIZATION 90 MP-07.

6 MEDIA USE 91 MP-08: MEDIA DOWNGRADING 92 PHYSICAL & ENVIRONMENTAL PROTECTION (PE) 92 PE-01: PHYSICAL & ENVIRONMENTAL PROTECTION POLICY & PROCEDURES 93 PE-02: PHYSICAL ACCESS AUTHORIZATIONS 93 PE-03: PHYSICAL ACCESS CONTROL 94 PE-04: ACCESS CONTROL FOR TRANSMISSION MEDIUM 96 PE-05: ACCESS CONTROL FOR OUTPUT DEVICES 96 PE-06: MONITORING PHYSICAL ACCESS 96 PE-07: VISITOR CONTROL 97 PE-08: ACCESS RECORDS 97 PE-09: POWER EQUIPMENT & POWER CABLING 97 PE-10: EMERGENCY SHUTOFF 98 PE-11: EMERGENCY POWER 98 PE-12: EMERGENCY LIGHTING 98 PE-13: FIRE PROTECTION 99 PE-14: TEMPERATURE & HUMIDITY CONTROLS 99 PE-15: WATER DAMAGE PROTECTION 100 PE-16: DELIVERY & REMOVAL 100 PE-17: ALTERNATE WORK SITE 100 PE-18: LOCATION OF Information SYSTEM COMPONENTS 101 PE-19: Information LEAKAGE 101 PE-20: ASSET MONITORING & TRACKING 101 TECHNICAL CONTROLS 103 ACCESS CONTROL (AC) 103 AC-01: ACCESS CONTROL POLICY & PROCEDURES 103 Written Information Security Program (WISP) - Version Page 5 of 227 AC-02: ACCOUNT MANAGEMENT 103 AC-03: ACCESS ENFORCEMENT 106 AC-04: Information FLOW ENFORCEMENT ACCESS CONTROL LISTS (ACLS) 106 AC-05: SEPARATION OF DUTIES 108 AC-06: LEAST PRIVILEGE 108 AC-07.

7 UNSUCCESSFUL LOGIN ATTEMPTS 110 AC-08: SYSTEM USE NOTIFICATION (LOGON BANNER) 110 AC-09: PREVIOUS LOGON NOTIFICATION 111 AC-10: CONCURRENT SESSION CONTROL 111 AC-11: SESSION LOCK 111 AC-12: SESSION TERMINATION 112 AC-13: SUPERVISION & REVIEW 112 AC-14: PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHORIZATION 113 AC-15: AUTOMATED MARKING 113 AC-16: Security ATTRIBUTES 113 AC-17: REMOTE ACCESS 113 AC-18: WIRELESS ACCESS 115 AC-19: ACCESS CONTROL FOR MOBILE DEVICES 116 AC-20: USE OF EXTERNAL Information SYSTEMS 119 AC-21: Information SHARING 120 AC-22: PUBLICLY ACCESSIBLE CONTENT 120 AC-23: DATA MINING PROTECTION 121 AC-24: ACCESS CONTROL DECISIONS 121 AC-25: REFERENCE MONITOR 121 AUDIT & ACCOUNTABILITY (AU) 122 AU-01: AUDIT & ACCOUNTABILITY POLICY & PROCEDURES 122 AU-02: AUDITABLE EVENTS 122 AU-03: CONTENT OF AUDIT RECORDS 123 AU-04: AUDIT STORAGE CAPACITY 124 AU-05: RESPONSE TO AUDIT PROCESSING FAILURES 124 AU-06: AUDIT REVIEW, ANALYSIS & REPORTING 125 AU-07: AUDIT REDUCTION & REPORT GENERATION 126 AU-08: TIME STAMPS 126 AU-09: PROTECTION OF AUDIT Information 127 AU-10: NON-REPUDIATION 128 AU-11: AUDIT RECORD RETENTION 128 AU-12: AUDIT GENERATION 129 AU-13.

8 MONITORING FOR Information DISCLOSURE 129 AU-14: SESSION AUDIT 129 AU-15: ALTERNATE AUDIT CAPABILITY 130 AU-16: CROSS-ORGANIZATIONAL AUDITING 130 CONFIGURATION MANAGEMENT (CM) 130 CM-01: CONFIGURATION MANAGEMENT POLICY & PROCEDURES 130 CM-02: BASELINE CONFIGURATIONS 131 CM-03: CONFIGURATION CHANGE CONTROL 133 CM-04: Security IMPACT ANALYSIS 134 CM-05: ACCESS RESTRICTION FOR CHANGE 134 CM-06: CONFIGURATION SETTINGS 136 CM-07: LEAST FUNCTIONALITY 136 CM-08: Information SYSTEM COMPONENT INVENTORY 138 CM-09: CONFIGURATION MANAGEMENT PLAN 139 CM-10: SOFTWARE USAGE RESTRICTIONS 140 CM-11: USER-INSTALLED SOFTWARE 140 IDENTIFICATION & AUTHENTICATION (IA) 141 IA-01: IDENTIFICATION & AUTHENTICATION POLICY & PROCEDURES 141 IA-02: USER IDENTIFICATION & AUTHENTICATION (ORGANIZATIONAL USERS) 141 IA-03: DEVICE-TO-DEVICE IDENTIFICATION & AUTHENTICATION 143 IA-04: IDENTIFIER MANAGEMENT (USER NAMES) 144 Written Information Security Program (WISP) - Version Page 6 of 227 IA-05: AUTHENTICATOR MANAGEMENT (PASSWORDS) 145 IA-06: AUTHENTICATOR FEEDBACK 148 IA-07: CRYPTOGRAPHIC MODULE AUTHENTICATION 148 IA-08: IDENTIFICATION & AUTHENTICATION (NON-ORGANIZATIONAL USERS) 148 IA-09.

9 SERVICE PROVIDER IDENTIFICATION & AUTHENTICATION (VENDORS) 149 IA-10: ADAPTIVE IDENTIFICATION & AUTHENTICATION 150 IA-11: RE-AUTHENTICATION 150 SYSTEM & COMMUNICATION PROTECTION (SC) 150 S