Storage.googleapis.com



Building and Operating a Secure and Reliable NetworkProcess ActivityLead & GovernFunction (purpose)OrganizePolicy or proceduresCorporate QA PolicyCorporate Acquisition PolicyCorporate Policy on Safeguarding Classified DataCorporate Policy on Network Design & OperationBoard Risk & Cyber Policy or GuidanceBoard Governance PolicyInsurance Co. Cyber GuidanceProcess ActivityDesign Secure & Reliable NetworkTrain & ImplementSecure Data During UseAnticipatePrepareSustainAuthoritiesFunction (purpose)Design & ImplementEnableAnticipate ThreatsPrepare for BattleSustain Design Basis & Secure NetworkUnderstand Scope of AuthorizationSub-Process Activity (if any)Train WorkforceSecure Data in TransitUnderstanding the BattlespaceDevelop & Maintain Stakeholder TrustComputer Fraud Abuse Act, 18?U.S.C. §?1030Stored Coms Act 18?U.S.C. §?2701 et seqForeign Intel Surveillance Act, 18?U.S.C. §?1801 et seqFederal Wiretap Act, 18?U.S.C. §?2510 et seqPen Registers and Trap & Trace Devices, 18?U.S.C. §3121 et seqFed. Regs. such as FAR & SECE.O. 13,231, amend by E.O.13,296 Critical Infra. Protection in Info AgeE.O. 13,691 Promoting Private Sector Cybersecurity Info SharingE.O. 13,800 Strengthening Cybersecurity of Fed Networks & Critical InfraE.O. 13,873 Securing Information & Communications Technology & Services Supply ChainE.O. 16,636 Improving Critical Infra CybersecurityPresidential Policy Directive 21: Critical Infra Security and ResiliencePresidential Policy Directive 41: United States Cyber Incident CoordinationNational Cyber Strategy of the United States (Sept.?2018)International Strategy for Cyberspace (May 2011)State regulatory guidanceConsensus StandardsNIST, Special Pubs 800 SeriesPolicy or proceduresNIST SP 800-119Guidelines for Secure Deployment of IPv6Training Standard for Senior Systems Managers (e.g., CNSSI 4012)NIST SP 800-153 Guidelines for Securing Wireless Local Area NetworksNIST, Framework for Improving Critical Infrastructure Cybersecurity (Ver.?1.1)DoD 5220.22-M, National Industrial Security Program Operating Manual (Chg. 2) (NISPOM)Self-Inspections & EvaluationsPolicy or proceduresCommon Criteria Evaluation and Validation SchemeTraining Standard For System Administrators (e.g., CNSSI 4013)Corporate Biometrics Policy & ProcedureNIST SP 800-101 Guidelines on Mobile Device Forensics (Rev.?1)Corporate Cyber Policies & ProceduresIndependent, External AuditsPolicy or proceduresNIST SP 800-144 Guidelines on Security and Privacy in Public Cloud ComputingTraining Standard for Information Systems Security Officers (e.g., CNSSI 4014)NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and OrganizationsNIST IR 7693 Specification for Asset Identification 1.1Prompt & Transparent Reporting of Accurate Facts when Known AccuratelyEvents lead to Extent of Condition Analysis, Corrections Action & Effectiveness ReviewsSub-Process Activity (if any)Implementation of SSCsManage AccessPreventing and Delaying Attackers Access and StayingStrengthen Cyber ReadinessPolicy or proceduresNIST SP 800-171 (Rev 1) Protect Controlled Unclassified Information in Nonfederal Systems and OrganizationsOperational Readiness Review (ORR)NIST SP 800-111 Guide to Storage Encryption Technologies for End User DevicesNIST SP 800-37 Risk Management Framework for Information Systems and OrganizationsNIST SP 800-137 Information Security Continuous MonitoringEvents Analyzed for Lessons Learned & opportunities for ImprovementPolicy or proceduresCNSSI 1253F, Attachment 6 Privacy Overlay (protect PII)Conduct of Operations—Change ManagementCorporate Policies & Procedures Governing Facility Access ControlsNIST SP 800-163 Vetting the Security of Mobile ApplicationsNIST SP 800-115 Technical Guide to Information Security Testing & AssessmentCorporate Continuity of Operations Policies & ProceduresSub-Process Activity (if any)Assure Information SharingResponsivenessPolicy or proceduresInspections, Tests, Analyses, and Acceptance Criteria (ITAAC)Conduct of Operations—Configuration ControlConduct of Operations—Operating Experience ProgramNIST SP 800-128 Guide for Security-Focused Configuration Management of Information SystemsNIST SP 800-61 Computer Security Incident Handling Guide (Rev.?2)Lessons Learned Integrated in Procurements, SSC and Policy & Procedure ModificationsPolicy or proceduresSoftware Bill of Materials (sBOM) (under review at NIST)Conduct of Operations—Equipment & System StatusInstitute of Nuclear Power Operators (INPO) “Prevent Events” ModelNIST SO 800-92 Guide to Computer Security Log ManagementCorporate Incident or Event Response PlanEmployee Expectations Plainly Reflected in Annual Performance PlansPolicy or proceduresRecover design basis of existing SSCs; NIST Framework for Improving Critical Infrastructure Cybersecurity (Ver.?1.1)Conduct of Operations—Shift TurnoverCenter for Chemical Process Safety (CCPS) Beacon sections on “Did You Know?,” “What Can You Do?”NIST SP 800-124 Guidelines for Managing the Security of Mobile Devices in the Enterprise (Rev.?1)Self-Reporting to Regulators and CustomersOrganizational Learning & High Performance EmbracedColor Key:ProcessProcessSub-ProcessStakeholder GuidanceINPOProcessProcessFunction (purpose)NISTCCPSProcessProcessCorp. PolicyDoDLaw, Reg., EO, Strategy, Consensus Stds, ProcessProcessBoard PolicyCNNISource: C. Russell H. Shearer, ISL ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download