SlideShare una empresa de Scribd logo
1 de 23
Descargar para leer sin conexión
Security Assessment Plan
<Information System Name>, <Date>




             Security Assessment Plan (Template)




                                    Version 1.0
                                      May 2, 2012

                            Company Sensitive and Proprietary
                                For Authorized Use Only
Security Assessment Plan
<Information System Name>, <Date>




                                   Document Name

                                           Prepared by

             Identification of Third-Party Assessment Organization that Prepared this Document

                         Organization Name

                         Street Address
    <insert logo>
                         Suite/Room/Building

                         City, State Zip




                                           Prepared for

                                  Identification of Cloud Service Provider

                         Organization Name

                         Street Address
    <insert logo>
                         Suite/Room/Building

                         City, State Zip




                                   Company Sensitive and Proprietary
Page 2
Security Assessment Plan
<Information System Name>, <Date>


                             Executive Summary
The Federal Risk Authorization Management Program (FedRAMP) is a government-wide
program that provides a standardized approach to security assessment, authorization, and
continuous monitoring for Cloud Service Providers (CSP). Testing security controls is an
integral part of the FedRAMP security authorization requirements and enables Federal
Agencies to use the findings that result from the tests to make risk-based decisions.
Providing a plan for security control ensures that the process runs smoothly. This
document, released originally in Template format, has been designed for CSP Third-Party
Independent Assessors (3PAOs) to use for planning security testing of CSPs. Once filled
out, this document constitutes a plan for testing. Actual findings from the tests are to be
recorded in FedRAMP security test procedure workbooks and a Security Assessment
Report (SAR).




                               Company Sensitive and Proprietary
Page 3
Security Assessment Plan
<Information System Name>, <Date>


                       Document Revision History

         Date         Description              Version       Author
         05/02/2012   Document Publication     1.0                  FedRAMP Office

         05/03/2012   Renamed Section 5.3      1.0                  FedRAMP Office




                                Company Sensitive and Proprietary
Page 4
Security Assessment Plan
<Information System Name>, <Date>


                                                            Table of Contents
About this document .....................................................................................................................................................7
             Who should use this document? .....................................................................................................................7
             How this document is organized .....................................................................................................................7
             Conventions used in this document ................................................................................................................7
             How to contact us............................................................................................................................................8
1.          Overview...........................................................................................................................................................9
             1.2        Applicable Laws and Regulations.......................................................................................................10
             1.3        Applicable Standards and Guidance ..................................................................................................10
             1.4        FedRAMP Governance .......................................................................................................................10
2.          Scope ..............................................................................................................................................................10
             2.1        System Name/Title ............................................................................................................................10
             2.2        IP Addresses Slated for Testing ..........................................................................................................11
             2.3        Web Applications Slated for Testing ..................................................................................................12
             2.4        Databases Slated for Testing ..............................................................................................................12
             2.5        Roles Slated for Testing ......................................................................................................................13
3.          Assumptions ...................................................................................................................................................13
4.          Methodology ..................................................................................................................................................14
5.          Test Plan ..........................................................................................................................................................15
             5.1        Security Assessment Team ................................................................................................................15
             5.2        CSP Testing Points of Contact ............................................................................................................16
             5.3        Testing Performed Using Automated Tools .......................................................................................16
             5.4        Testing Performed Through Manual Methods...................................................................................17
             5.5        Schedule ............................................................................................................................................17
6.          Rules of Engagement ......................................................................................................................................18
             6.1        Disclosures .........................................................................................................................................18
                   6.1.1. Security Testing May Include .........................................................................................................19
                   6.1.2. Security Testing Will Not Include...................................................................................................19
             6.2        End of Testing ....................................................................................................................................20
             6.3        Communication of Test Results ........................................................................................................20
             6.4        Limitation of Liability .........................................................................................................................20
             6.5        Signatures ..........................................................................................................................................21
Acronyms .....................................................................................................................................................................22
Appendix A – Test Case Procedures .............................................................................................................................23




                                                      Company Sensitive and Proprietary                                                                        Page 5
Security Assessment Plan
<Information System Name>, <Date>




                                                                List of Tables
Table 2-1. Information System Name and Title............................................................................................................11
Table 2-2. Location of Components .............................................................................................................................11
Table 2-3. Components Slated for Testing ...................................................................................................................11
Table 2-4. Application URLs Slated for Testing ............................................................................................................12
Table 2-5. Databases Slated for Testing ......................................................................................................................12
Table 2-6. Role Based Testing .......................................................................................................................................13
Table 5-1. Security Testing Team ..................................................................................................................................15
Table 5-2. CSP Points of Contact ..................................................................................................................................16
Table 5-3. Tools Used for Security Testing ....................................................................................................................16
Table 5-4. Testing Performed Through Manual Methods ............................................................................................17
Table 5-5. Testing Schedule ..........................................................................................................................................17
Table 6-1. Individuals at CSP Receiving Test Results ....................................................................................................20




                                                   Company Sensitive and Proprietary                                                                  Page 6
Security Assessment Plan
<Information System Name>, <Date>



ABOUT THIS DOCUMENT
This document has been developed to provide guidance on how to participate in and understand
the FedRAMP program.

Who should use this document?
This document is intended to be used by FedRAMP Third-Party Independent Assessors (3PAOs)
when testing Cloud Service Provider (CSP) security controls.

How this document is organized
This document is divided into ten sections. Most sections include subsections.

Section 1 describes an overview of the testing process.

Section 2 describes the scope of the security testing.

Section 3 describes assumptions related to the security testing.

Section 4 describes the security testing methodology.

Section 5 describes the test plan and schedule.

Section 6 describes the Rules of Engagement and signatures for security testing.

Conventions used in this document
This document uses the following typographical conventions:

Italic
    Italics are used for email addresses, security control assignments parameters, and formal
document names.

Italic blue in a box
    Italic blue text in a blue box indicates instructions to the individual filling out the template.

     Instruction: This is an instruction to the individual filling out of the template.

Bold
  Bold text indicates a parameter or an additional requirement.

Constant width
   Constant width text is used for text that is representative of characters that would show up on
a computer screen.




                                Company Sensitive and Proprietary                            Page 7
Security Assessment Plan
<Information System Name>, <Date>

<Brackets>
Bold blue text in brackets indicates text that should be replaced with user-defined values. Once
the text has been replaced, the brackets should be removed.

Notes
    Notes are found between parallel lines and include additional information that may be helpful
to the users of this template.


       Note: This is a note.


Sans Serif
  Sans Serif text is used for tables, table captions, figure captions, and table of contents.

How to contact us
If you have questions about FedRAMP or something in this document, please write to:

       info@fedramp.gov

For more information about the FedRAMP project, please see the website at:

       http://www.fedramp.gov.




                               Company Sensitive and Proprietary                           Page 8
Security Assessment Plan
<Information System Name>, <Date>



1. OVERVIEW
Federal Risk and Authorization Management Program (FedRAMP) is a government-wide
program that provides a standardized approach to security assessment, authorization, and
continuous monitoring for Cloud Service Providers (CSP). Testing security controls is an integral
part of the FedRAMP security authorization requirements. Providing a plan for security control
ensures that the process runs smoothly.

The <Information System Name> will be assessed by a FedRAMP accredited Third-Party
Assessment Organization (3PAO). The use of an independent assessment team reduces the
potential for conflicts of interest that could occur in verifying the implementation status and
effectiveness of the security controls. NIST SP 800-39, Managing Information Security Risk
states:

           Assessor independence is an important factor in: (i) preserving the
           impartial and unbiased nature of the assessment process; (ii) determining
           the credibility of the security assessment results; and (iii) ensuring that the
           authorizing official receives the most objective information possible in
           order to make an informed, risk-based, authorization decision.

1.1    Purpose

Instruction: A goal of the kick-off meeting is to obtain the necessary information to populate this
plan. The 3PAO should obtain the requisite information on the CSP system at the kick-off
meeting so that this plan can be completed. After this plan has been completed, the 3PAO should
meet again with the CSP, present the Draft Security Assessment Plan, and make any necessary
changes before finalizing the plan. Both the Draft plan and Final plan should be submitted to
the FedRAMP ISSO for review.


This document consists of a test plan to test the security controls for the <Information System
Name>. It has been completed by <3PAO> for the benefit of <CSP>. NIST SP 800-39,
Managing Information Security Risk states:

           The information system owner and common control provider rely on the
           security expertise and the technical judgment of the assessor to: (i) assess
           the security controls employed within and inherited by the information
           system using assessment procedures specified in the security assessment
           plan; and (ii) provide specific recommendations on how to correct
           weaknesses or deficiencies in the controls and address identified
           vulnerabilities.




                               Company Sensitive and Proprietary                             Page 9
Security Assessment Plan
<Information System Name>, <Date>

1.2      Applicable Laws and Regulations

The following laws and regulations are applicable to the FedRAMP program:

      Computer Fraud and Abuse Act [PL 99-474, 18 USC 1030]
      Federal Information Security Management Act (FISMA) of 2002 [Title III, PL 107-347]
      Homeland Security Presidential Directive-7, Critical Infrastructure Identification,
      Prioritization, and Protection [HSPD-7]
      Management of Federal Information Resources [OMB Circular A-130]
      Privacy Act of 1974 as amended [5 USC 552a]
      Protection of Sensitive Agency Information [OMB M-06-16]
      Security of Federal Automated Information Systems [OMB Circular A-130, Appendix III]

1.3      Applicable Standards and Guidance

The following standards and guidance are applicable to security testing and risk assessment:

      Guide for Assessing the Security Controls in Federal Information Systems [NIST SP 800-
      53A]
      Risk Management Guide for Information Technology Systems [NIST SP 800-30]
      Technical Guide to Information Security Testing and Assessment [NIST SP 800-115]
      Managing Information Security Risk [NIST SP 800-39]

1.4      FedRAMP Governance

FedRAMP is governed by a Joint Authorization Board (JAB) that consists of representatives
from the Department of Homeland Security (DHS), the General Services Administration (GSA),
and the Department of Defense (DoD). The FedRAMP program is endorsed by the U.S.
government CIO Council including the Information Security and Identity Management
Committee (ISIMC). The ISIMC collaborates on identifying high-priority security and identity
management initiatives and developing recommendations for policies, procedures, and standards
to address those initiatives.

2. SCOPE
The scope of the security tests that will be performed for the CSP service offering is limited and
well defined. Tests on systems and interfaces that are outside the boundary of the CSP service
offering (for FedRAMP) are not included in this plan.

2.1      System Name/Title
Instruction: Name the system that that is slated for testing and include the geographic location
of all components that will be tested. Put in a brief description of the system components that is
a direct copy/paste from the description in the System Security Plan.



                               Company Sensitive and Proprietary                         Page 10
Security Assessment Plan
<Information System Name>, <Date>

This <Information System Name> that is undergoing testing as described in this Security
Assessment Plan is named in Table 2-1.
                                  Table 2-1. Information System Name and Title

        Unique Identifier                  Information System Name             Information System Abbreviation




The physical locations of all the different components that will be tested are described in
Table 2-2.
                                         Table 2-2. Location of Components

      Data Center Site Name                        Address                       Description of Components




2.2      IP Addresses Slated for Testing
Instruction: List the IP address of all systems that will be tested. You will need to obtain this
information from the System Security Plan and the CSP. Note that the IP addresses found in the
System Security Plan should be consistent with the boundary. If additional IP addresses are
discovered that were not included in the System Security Plan, advise the CSP to update the
inventory and boundary information in the SSP and obtain new approval on the SSP from the
ISSO before moving forward. IP addresses can be listed by network ranges and CIDR blocks. If
you are scanning a large network (Class B or larger), you should plan on testing a subset of the
IP addresses. All scans should be fully authenticated. Add additional rows to the table as
necessary.

IP addresses, and network ranges, of the system that will be tested are noted inTable 2-3.
                                    Table 2-3. Components Slated for Testing

 IP Address(s) or
                              Hostname                Software & Version                     Function
     Ranges




                                   Company Sensitive and Proprietary                                 Page 11
Security Assessment Plan
<Information System Name>, <Date>




2.3     Web Applications Slated for Testing
 Instruction: Insert any URLs and the associated login IDs that will be used for testing. Only list
 the login URL. Do not list every URL that is inside the login in the below table. In the Function
 column, indicate the purpose that the web-facing application plays for the system (e.g. control
 panel to build virtual machines).

Activities employed to perform role testing on web applications may include capturing POST
and GET requests for each function. The various web based applications that make up the
system, and the logins and their associated roles that will be used for testing are noted by URL in
Table 2-4.
                              Table 2-4. Application URLs Slated for Testing

                Login URL                            IP Address of Login Host       Function




2.4     Databases Slated for Testing
 Instruction: Insert the hostnames, IP address, and any relevant additional information on the
 databases that will be tested. All scans should be fully authenticated. Add additional rows as
 necessary.

Databases that are slated for testing include those listed in Table 2-5.
                                    Table 2-5. Databases Slated for Testing

      Database Name                 Hostname                    IP Address       Additional Info




                               Company Sensitive and Proprietary                          Page 12
Security Assessment Plan
<Information System Name>, <Date>

2.5    Roles Slated for Testing

Role testing will be performed to test the authorizations restrictions for each role. <3PAO> will
access the system while logged in as different user types and attempt to perform restricted
functions as unprivileged users. Functions and roles that will be tested are noted in Table 2-6.
Roles slated for testing correspond to those roles listed in Table 9-1 of the <Information System
Name> System Security Plan.
                                    Table 2-6. Role Based Testing

            Role Name                          Test User ID                 Associated Functions




3. ASSUMPTIONS
 Instruction: The assumptions listed are default assumptions. 3PAO should edit these
 assumptions as necessary for each unique engagement.

The following assumptions were used when developing this Security Assessment Plan:

       <CSP> resources, including documentation and individuals with knowledge of the
       <CSP> systems and infrastructure and their contact information, will be available to
       <3PAO> staff during the time necessary to complete assessments.

       The <CSP> will provide login account information / credentials necessary for <3PAO>
       to use its testing devices to perform authenticated scans of devices and applications.

       The <CSP> will permit <3PAO> to connect its testing laptops to the <CSP> networks
       defined within the scope of this assessment.

       The <CSP > will permit communication from <3PAO> testing appliances to an internet
       hosted vulnerability management service to permit the analysis of vulnerability data.

       Security controls that have been identified as “Not Applicable” (e.g. AC-18 wireless
       access) in the System Security Plan will be verified as such and further testing will not be
       performed on these security controls

       Significant upgrades or changes to the infrastructure and components of the system
       undergoing testing will not be performed during the security assessment period.




                               Company Sensitive and Proprietary                         Page 13
Security Assessment Plan
<Information System Name>, <Date>

       For onsite control assessment, <CSP> personnel will be available should the <3PAO>
       staff determine that either after hours work, or weekend work, is necessary to support the
       security assessment.

4. METHODOLOGY
 Instruction: FedRAMP provides a documented methodology to describe the process for testing
 the security controls. 3PAOs may edit this section to add additional information.

<3PAO> will perform an assessment of the <Information System Name> security controls
using the methodology described in NIST SP 800-53A. <3PAO> will use FedRAMP supplied
test procedures to evaluate the security controls. Contained in Excel worksheets, these test
procedures contain the test objectives and associated test cases to determine if a control is
effectively implemented and operating as intended. The results of the testing shall be recorded in
the worksheets (provided in Appendix A) along with information that notes whether the control
(or control enhancement) is satisfied or not.

<3PAO> data gathering activities will consist of the following:

       Request <CSP> to provide FedRAMP required documentation

       Request any follow-up documentation, files, or information needed that is not provided in
       FedRAMP required documentation

       Travel to the CSP sites as necessary to inspect systems and meet with CSP staff

       Obtain information through the use of security testing tools

Security controls will be verified using one or more of the following assessment methods:

       Examine: the 3PAO will review, analyze, inspect, or observe one or more assessment
       artifacts as specified in the attached test cases;

       Interview: the 3PAO will conduct discussions with individuals within the organization to
       facilitate assessor understanding, achieve clarification, or obtain evidence;

       Technical Tests: the 3PAO will perform technical tests, including penetration testing, on
       system components using automated and manual methods.

NIST SP 800-39, Managing Information Security Risk states:

           Prior to initiating the security control assessment, an assessor conducts an
           assessment of the security plan to help ensure that the plan provides a set
           of security controls for the information system that meet the stated security


                               Company Sensitive and Proprietary                           Page 14
Security Assessment Plan
<Information System Name>, <Date>

           requirements.




 Instruction: All documentation provided to the 3PAO by the CSP should be reviewed for
 accuracy and completeness. Any issues with CSP documentation should be recorded in both the
 security testing procedures workbooks and in the SAR. If CSP documentation makes reference to
5. TEST PLAN
 additional documentation that has not been provided to the 3PAO, the 3PAO may request copies
 of that documentation from the CSP. 3PAOs should keep a list of all documentation that was
The schedule for testing, CSP, and which documents were provided as aused are described in the
 provided to them by the testing roles, and the testing tools that will be subsequent additional
 request. The SAR template will require that all documents reviewed be listed.
sections that follow.

5.1    Security Assessment Team

Instruction: List the members of the risk assessment team and the role each member will play.
Include team members contact information.

The security assessment team consists of individuals from <3PAO Name> which are located at
<Address of 3PAO>. Information about <3PAO Name> can be found at the following URL:
<insert URL>.

Security control assessors play a unique role in testing system security controls. NIST 800-39,
Managing Information Security Risk states:

           The security control assessor is an individual, group, or organization
           responsible for conducting a comprehensive assessment of the
           management, operational, and technical security controls employed within
           or inherited by an information system to determine the overall
           effectiveness of the controls (i.e., the extent to which the controls are
           implemented correctly, operating as intended, and producing the desired
           outcome with respect to meeting the security requirements for the system).

The members of the 3PAO security testing team are found in Table 5-1.
                                    Table 5-1. Security Testing Team

             Name                                Role                     Contact Information




                               Company Sensitive and Proprietary                         Page 15
Security Assessment Plan
<Information System Name>, <Date>

5.2     CSP Testing Points of Contact
Instruction: The 3PAO should obtain at least three points of contact from the CSP to use for
testing communications. One of the contacts should be available 24 x 7 and should include an
operations center (e.g. NOC, SOC).

The CSP points of contact that the testing team will use are found in Table 5-2.
                                     Table 5-2. CSP Points of Contact

Name                                Role                                 Contact Information




5.3     Testing Performed Using Automated Tools
Instruction: Describe what tools will be used for testing security controls. Include all product
names and names of open source tools and include version numbers. If open source tools are
used, name the organization (or individuals) who developed the tools. Additionally, describe the
function and purpose of the tool (e.g. file integrity checking, web application scanning). If you
are using a scanner, indicate what the scanner’s capability is, e.g. database scanning, web
application scanning, infrastructure scanning, code scanning/analysis). For more information
on please see the Guide to Understanding FedRAMP.

<3PAO Name> plans to use the following tools noted in Table 5-3 to perform testing of the
<Information System Name>.
                                Table 5-3. Tools Used for Security Testing

       Tool Name         Vendor/Organization Name & Version                    Purpose of Tool




                               Company Sensitive and Proprietary                                 Page 16
Security Assessment Plan
<Information System Name>, <Date>




5.4       Testing Performed Through Manual Methods

Instruction: Describe what technical tests will be performed through manual methods without
the use of automated tools. The results of all manual tests must be recorded in the SAR.
Examples are listed in the first four rows. Delete the examples, and put in the real tests. Add
additional rows as necessary. Identifiers should be in the format MT-1, MT-2 which would
indicate “Manual Test 1” and “Manual Test 2” etc..


                             Table 5-4. Testing Performed Through Manual Methods

  Test ID             Test Name                                           Description

   MT-1            Forceful Browsing      We will login as a customer and try to see if we can gain access to the
                                          Network Administrator and Database Administrator privileges and
                                          authorizations by navigating to different views and manually forcing the
                                          browser to various URLs.

   MT-2              SQL Injection        We will perform some manual SQL injection attacks using fake names
                                          and 0 OR '1'='1' statements.

   MT-3                CAPTCHA            We will test the CAPTCHA function on the web form manually.

   MT-4                 OCSP              We will manually test to see if OCSP is validating certificates.




5.5       Schedule

Instruction: Insert the security assessment testing schedule. This schedule should be presented
to the CSP by the 3PAO at the kick-off meeting. The ISSO should be invited to the meeting that
presents the schedule to the CSP. After being presented to the CSP at the kick-off meeting, the
3PAO should make any necessary updates to the schedule and this document and send an
updated version of the CSP (Ccing the ISSO).


The security assessment testing schedule can be found in Table 5-5.
                                           Table 5-5. Testing Schedule

Task Name                                                   Start Date                     Finish Date

Kick-off Meeting




                                     Company Sensitive and Proprietary                                       Page 17
Security Assessment Plan
<Information System Name>, <Date>


Task Name                                         Start Date               Finish Date

Prepare Test Plan

Meeting to Review Test Plan

Test Plan Update

Review CSP Documentation

Conduct Interviews of CSP Staff

Perform Testing

Vulnerability Analysis and Threat Assessment

Risk Exposure Table Development

Complete Draft SAR

Draft SAR Delivered to SAP

Issue Resolution Meeting

Complete Final Version of SAR

Send Final Version of SAR to CSP and ISSO


6. RULES OF ENGAGEMENT
A Rules of Engagement (ROE) is a document designed to describe proper notifications and
disclosures between the owner of a tested systems and an independent assessor. In particular, a
ROE includes information about targets of automated scans and IP address origination
information of automated scans (and other testing tools). Together with the information provided
in preceding sections of this document, this document shall serve as a Rules of Engagement once
signed.

Instruction: FedRAMP provides and recommends the Rules of Engagement as listed in the
section that follows. 3POAs should edit this ROE as necessary. The final version of the ROE
should be signed by both the 3PAO and CSP.


6.1     Disclosures
Instruction: Edit and modify the disclosures as necessary. If testing is to be conducted from an
internal location, identify at least one network port with access to all subnets/segments to be
tested. The purpose of identifying the IP addresses from where the security testing will be
performed is so that when 3PAOs are performing scans, the CSP will understand that the rapid
and high volume network traffic is not an attack and is part of the testing.
                                Company Sensitive and Proprietary                        Page 18
Security Assessment Plan
<Information System Name>, <Date>




Any testing will be performed according to terms and conditions designed to minimize risk
exposure that could occur during security testing. All scans will originate from the following IP
address(es): <IP addresses>.

 6.1.1.        Security Testing May Include

 Instruction: 3PAO should edit the bullets in this default list to make it consistent with each
 unique system tested.

Security testing may include the following activities:
       Port scans and other network service interaction and queries
       Network sniffing, traffic monitoring, traffic analysis, and host discovery
       Attempted logins or other use of systems, with any account name/password
       Attempted SQL injection and other forms of input parameter testing
       Use of exploit code for leveraging discovered vulnerabilities
       Password cracking via capture and scanning of authentication databases
       Spoofing or deceiving servers regarding network traffic
       Altering running system configuration except where denial of service would result
       Adding user accounts

 6.1.2.        Security Testing Will Not Include
 Instruction: 3PAO should edit the bullets in this default list to make it consistent with each
 unique system tested.

Security testing will not include any of the following activities:
       Changes to assigned user passwords
       Modification of user files or system files
       Telephone modem probes and scans (active and passive)
       Intentional viewing of <CSP> staff email, Internet caches, and/or personnel cookie files
       Denial of Service attacks (smurf, land, SYN flood, etc.)
       Exploits that will introduce new weaknesses to the system
       Intentional introduction of malicious code (viruses, Trojans, worms, etc.)



                               Company Sensitive and Proprietary                          Page 19
Security Assessment Plan
<Information System Name>, <Date>

6.2    End of Testing

<3PAO> will notify <Name of Person> at <CSP> when security testing has been completed.

6.3    Communication of Test Results

Email and reports on all security testing will be encrypted according to <CSP> requirements.
Security testing results will be sent and disclosed to the individuals at <CSP> noted in Table 6-1
within <number> days after security testing has been completed.
                            Table 6-1. Individuals at CSP Receiving Test Results

             Name                                  Role                            Contact Information




6.4    Limitation of Liability
Instruction: Insert any Limitations of Liability associated with the security testing below. Edit
the provided default Limitation of Liability as needed.

<3PAO>, and its stated partners, shall not be held liable to <CSP> for any and all liabilities,
claims, or damages arising out of or relating to the security vulnerability testing portion of this
Agreement, howsoever caused and regardless of the legal theory asserted, including breach of
contract or warranty, tort, strict liability, statutory liability, or otherwise.

<CSP> acknowledges that there are limitations inherent in the methodologies implemented, and
the assessment of security and vulnerability relating to information technology is an uncertain
process based on past experiences, currently available information, and the anticipation of
reasonable threats at the time of the analysis. There is no assurance that an analysis of this nature
will identify all vulnerabilities or propose exhaustive and operationally viable recommendations
to mitigate all exposure.




                               Company Sensitive and Proprietary                                  Page 20
Security Assessment Plan
<Information System Name>, <Date>

6.5    Signatures

The following individuals at the 3PAO and CSP have been identified as having the authority to
agree to security testing of <Information System Name>.




  ACCEPTANCE AND SIGNATURE

         I have read the above Security Assessment Plan and Rules of Engagement and I
         acknowledge and agree to the tests and terms set forth in the plan.

  3PAO Representative: _________________________________ (printed)

  3PAO Representative: _________________________________ (signature)        ______ (date)


  CSP Representative: _________________________________ (printed)

  CSP Representative: _________________________________ (signature)       ______ (date)




                               Company Sensitive and Proprietary                            Page 21
Security Assessment Plan
<Information System Name>, <Date>

ACRONYMS
Acronyms used in this document can be found in the below table.

Acronym                     Description

FedRAMP                     Federal Risk Authorization Management Program

NIST                        National Institute of Standards and Technology

SAP                         Security Assessment Plan

SAR                         Security Assessment Report




                               Company Sensitive and Proprietary             Page 22
Security Assessment Plan
<Information System Name>, <Date>

APPENDIX A – TEST CASE PROCEDURES
Results of the attached security test case procedures shall be recorded directly in each respective
workbook.



A_01_AC_20111102.   A_02_AT_20111028.   A_03_AU_20111102.   A_04_CA_20111102.   A.3.1.2.05_CM_2011
       xlsx                xlsx                xlsx                xlsx               1102.xlsx




A_06_CP_20111108.   A_07_IA_20111109.   A_08_IR_20111114.   A_09_MA_20111115    A_10_MP_20111116.
       xlsx                xlsx                xlsx               .xlsx               xlsx




A_11_PE_20111118.   A_12_PL_20111118.   A_13_PS_20111121.   A_14_RA_20111122.   A_15_SA_20111125.
       xlsx                xlsx                xlsx                xlsx                xlsx




A_16_SC_20111130.   A_17_SI_20111201.
       xlsx                xlsx




                                 Company Sensitive and Proprietary                                   Page 23

Más contenido relacionado

La actualidad más candente

7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited ResourcesLogRhythm
 
ISO_ 27001:2022 Controls & Clauses.pptx
ISO_ 27001:2022 Controls & Clauses.pptxISO_ 27001:2022 Controls & Clauses.pptx
ISO_ 27001:2022 Controls & Clauses.pptxforam74
 
Risk Assessment Process NIST 800-30
Risk Assessment Process NIST 800-30Risk Assessment Process NIST 800-30
Risk Assessment Process NIST 800-30timmcguinness
 
Cloud Security using NIST guidelines
Cloud Security using NIST guidelinesCloud Security using NIST guidelines
Cloud Security using NIST guidelinesSrishti Ahuja
 
HITRUST 101: All the basics you need to know
HITRUST 101: All the basics you need to knowHITRUST 101: All the basics you need to know
HITRUST 101: All the basics you need to know➲ Stella Bridges
 
Information security management system (isms) overview
Information security management system (isms) overviewInformation security management system (isms) overview
Information security management system (isms) overviewJulia Urbina-Pineda
 
Audit of it infrastructure
Audit of it infrastructureAudit of it infrastructure
Audit of it infrastructurepramod_kmr73
 
Business case for information security program
Business case for information security programBusiness case for information security program
Business case for information security programWilliam Godwin
 
Test strategy Vs. Test Plan
Test strategy Vs. Test PlanTest strategy Vs. Test Plan
Test strategy Vs. Test PlanProfessional QA
 
Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)MetroStar
 
Project plan for ISO 27001
Project plan for ISO 27001Project plan for ISO 27001
Project plan for ISO 27001technakama
 
NIST Cybersecurity Framework - Mindmap
NIST Cybersecurity Framework - MindmapNIST Cybersecurity Framework - Mindmap
NIST Cybersecurity Framework - MindmapWAJAHAT IQBAL
 

La actualidad más candente (20)

7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
 
Incident response
Incident responseIncident response
Incident response
 
ISO_ 27001:2022 Controls & Clauses.pptx
ISO_ 27001:2022 Controls & Clauses.pptxISO_ 27001:2022 Controls & Clauses.pptx
ISO_ 27001:2022 Controls & Clauses.pptx
 
ISO 27001
ISO 27001ISO 27001
ISO 27001
 
Risk Assessment Process NIST 800-30
Risk Assessment Process NIST 800-30Risk Assessment Process NIST 800-30
Risk Assessment Process NIST 800-30
 
Vulnerability and Patch Management
Vulnerability and Patch ManagementVulnerability and Patch Management
Vulnerability and Patch Management
 
Cloud Security using NIST guidelines
Cloud Security using NIST guidelinesCloud Security using NIST guidelines
Cloud Security using NIST guidelines
 
HITRUST 101: All the basics you need to know
HITRUST 101: All the basics you need to knowHITRUST 101: All the basics you need to know
HITRUST 101: All the basics you need to know
 
Cyber Security Threat Modeling
Cyber Security Threat ModelingCyber Security Threat Modeling
Cyber Security Threat Modeling
 
Information security management system (isms) overview
Information security management system (isms) overviewInformation security management system (isms) overview
Information security management system (isms) overview
 
Audit of it infrastructure
Audit of it infrastructureAudit of it infrastructure
Audit of it infrastructure
 
Business case for information security program
Business case for information security programBusiness case for information security program
Business case for information security program
 
Test strategy Vs. Test Plan
Test strategy Vs. Test PlanTest strategy Vs. Test Plan
Test strategy Vs. Test Plan
 
Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)
 
Project plan for ISO 27001
Project plan for ISO 27001Project plan for ISO 27001
Project plan for ISO 27001
 
NIST SP 800 30 Flow Chart
NIST SP 800 30 Flow ChartNIST SP 800 30 Flow Chart
NIST SP 800 30 Flow Chart
 
Adarsh Resume ISO27001
Adarsh Resume ISO27001Adarsh Resume ISO27001
Adarsh Resume ISO27001
 
Sap template 050312
Sap template 050312Sap template 050312
Sap template 050312
 
NIST Cybersecurity Framework - Mindmap
NIST Cybersecurity Framework - MindmapNIST Cybersecurity Framework - Mindmap
NIST Cybersecurity Framework - Mindmap
 
Iso 27001 Checklist
Iso 27001 ChecklistIso 27001 Checklist
Iso 27001 Checklist
 

Destacado

Management in healthcare
Management in healthcareManagement in healthcare
Management in healthcareOther Mother
 
Start With A Great Information Security Plan!
Start With A Great Information Security Plan!Start With A Great Information Security Plan!
Start With A Great Information Security Plan!Tammy Clark
 
Sample Incident Response Plan
Sample Incident Response PlanSample Incident Response Plan
Sample Incident Response PlanMatthew J McMahon
 
What's New In CompTIA Security+ - Course Technology Computing Conference
What's New In CompTIA Security+ - Course Technology Computing ConferenceWhat's New In CompTIA Security+ - Course Technology Computing Conference
What's New In CompTIA Security+ - Course Technology Computing ConferenceCengage Learning
 
5 Step Data Security Plan for Small Businesses
5 Step Data Security Plan for Small Businesses5 Step Data Security Plan for Small Businesses
5 Step Data Security Plan for Small BusinessesWilkins Consulting, LLC
 
Enterprise Architecture and Information Security
Enterprise Architecture and Information SecurityEnterprise Architecture and Information Security
Enterprise Architecture and Information SecurityJohn Macasio
 
Cloud application architecture with sql azure and windows azure
Cloud application architecture with sql azure and windows azureCloud application architecture with sql azure and windows azure
Cloud application architecture with sql azure and windows azureEduardo Castro
 
Total Quality Management in Healthcare
Total Quality Management in HealthcareTotal Quality Management in Healthcare
Total Quality Management in HealthcareGunjan Patel
 
How to dimension user traffic in LTE
How to dimension user traffic in LTEHow to dimension user traffic in LTE
How to dimension user traffic in LTEAlthaf Hussain
 
Study notes for CompTIA Certified Advanced Security Practitioner
Study notes for CompTIA Certified Advanced Security PractitionerStudy notes for CompTIA Certified Advanced Security Practitioner
Study notes for CompTIA Certified Advanced Security PractitionerDavid Sweigert
 

Destacado (15)

Management in healthcare
Management in healthcareManagement in healthcare
Management in healthcare
 
Creating a Security Plan for Your Agency - Laird Rixford
Creating a Security Plan for Your Agency - Laird RixfordCreating a Security Plan for Your Agency - Laird Rixford
Creating a Security Plan for Your Agency - Laird Rixford
 
Start With A Great Information Security Plan!
Start With A Great Information Security Plan!Start With A Great Information Security Plan!
Start With A Great Information Security Plan!
 
Sample Incident Response Plan
Sample Incident Response PlanSample Incident Response Plan
Sample Incident Response Plan
 
What's New In CompTIA Security+ - Course Technology Computing Conference
What's New In CompTIA Security+ - Course Technology Computing ConferenceWhat's New In CompTIA Security+ - Course Technology Computing Conference
What's New In CompTIA Security+ - Course Technology Computing Conference
 
Plan your security
Plan your securityPlan your security
Plan your security
 
5 Step Data Security Plan for Small Businesses
5 Step Data Security Plan for Small Businesses5 Step Data Security Plan for Small Businesses
5 Step Data Security Plan for Small Businesses
 
Enterprise Architecture and Information Security
Enterprise Architecture and Information SecurityEnterprise Architecture and Information Security
Enterprise Architecture and Information Security
 
The Benefits of a Network Security Plan
The Benefits of a Network Security PlanThe Benefits of a Network Security Plan
The Benefits of a Network Security Plan
 
Cloud application architecture with sql azure and windows azure
Cloud application architecture with sql azure and windows azureCloud application architecture with sql azure and windows azure
Cloud application architecture with sql azure and windows azure
 
Rules of Behavior
Rules of BehaviorRules of Behavior
Rules of Behavior
 
Total Quality Management in Healthcare
Total Quality Management in HealthcareTotal Quality Management in Healthcare
Total Quality Management in Healthcare
 
SAP for Beginners
SAP for BeginnersSAP for Beginners
SAP for Beginners
 
How to dimension user traffic in LTE
How to dimension user traffic in LTEHow to dimension user traffic in LTE
How to dimension user traffic in LTE
 
Study notes for CompTIA Certified Advanced Security Practitioner
Study notes for CompTIA Certified Advanced Security PractitionerStudy notes for CompTIA Certified Advanced Security Practitioner
Study notes for CompTIA Certified Advanced Security Practitioner
 

Similar a Security Assessment Plan (Template)

Information Technology Contingency Plan (Template)
Information Technology Contingency Plan (Template)Information Technology Contingency Plan (Template)
Information Technology Contingency Plan (Template)GovCloud Network
 
Continuous monitoring strategy_guide_072712
Continuous monitoring strategy_guide_072712Continuous monitoring strategy_guide_072712
Continuous monitoring strategy_guide_072712Tuan Phan
 
Privacy Threshold Analysis
Privacy Threshold AnalysisPrivacy Threshold Analysis
Privacy Threshold AnalysisGovCloud Network
 
Oracle Web Conferencing - Release 2.0.4
Oracle Web Conferencing - Release 2.0.4Oracle Web Conferencing - Release 2.0.4
Oracle Web Conferencing - Release 2.0.4Mehul Sanghavi
 
U.S. Government Protection Profile Web Server For Basic ...
U.S. Government Protection Profile Web Server For Basic ...U.S. Government Protection Profile Web Server For Basic ...
U.S. Government Protection Profile Web Server For Basic ...webhostingguy
 
Trackment
TrackmentTrackment
Trackmentmeaannn
 
oracle10g datagurad
oracle10g dataguradoracle10g datagurad
oracle10g dataguradNst Tnagar
 
E authentication template 050212
E authentication template 050212E authentication template 050212
E authentication template 050212GovCloud Network
 
APM81SP1_RevA_Installation_Book
APM81SP1_RevA_Installation_BookAPM81SP1_RevA_Installation_Book
APM81SP1_RevA_Installation_BookDavid_Tickner
 
Srs template
Srs templateSrs template
Srs templateambitlick
 
Group 4 STS final version
Group 4 STS final versionGroup 4 STS final version
Group 4 STS final versionzenchi0
 
GenRays Project Scope Document
GenRays Project Scope DocumentGenRays Project Scope Document
GenRays Project Scope DocumentApril Drake
 
software requirements specification template
software requirements specification templatesoftware requirements specification template
software requirements specification templateAzimiddin Rakhmatov
 
B28654oas10g best pracitice
B28654oas10g best praciticeB28654oas10g best pracitice
B28654oas10g best praciticeCaipei Chen
 
Getting started with odi
Getting started with odiGetting started with odi
Getting started with odichecksekhar
 

Similar a Security Assessment Plan (Template) (20)

Information Technology Contingency Plan (Template)
Information Technology Contingency Plan (Template)Information Technology Contingency Plan (Template)
Information Technology Contingency Plan (Template)
 
Continuous monitoring strategy_guide_072712
Continuous monitoring strategy_guide_072712Continuous monitoring strategy_guide_072712
Continuous monitoring strategy_guide_072712
 
Privacy Threshold Analysis
Privacy Threshold AnalysisPrivacy Threshold Analysis
Privacy Threshold Analysis
 
Oracle Web Conferencing - Release 2.0.4
Oracle Web Conferencing - Release 2.0.4Oracle Web Conferencing - Release 2.0.4
Oracle Web Conferencing - Release 2.0.4
 
Test plansample
Test plansampleTest plansample
Test plansample
 
U.S. Government Protection Profile Web Server For Basic ...
U.S. Government Protection Profile Web Server For Basic ...U.S. Government Protection Profile Web Server For Basic ...
U.S. Government Protection Profile Web Server For Basic ...
 
Trackment
TrackmentTrackment
Trackment
 
Data guard
Data guardData guard
Data guard
 
oracle10g datagurad
oracle10g dataguradoracle10g datagurad
oracle10g datagurad
 
MIL-STD-498:1994
MIL-STD-498:1994MIL-STD-498:1994
MIL-STD-498:1994
 
E authentication template 050212
E authentication template 050212E authentication template 050212
E authentication template 050212
 
Al-Borj_QA_FDD_v0.02
Al-Borj_QA_FDD_v0.02Al-Borj_QA_FDD_v0.02
Al-Borj_QA_FDD_v0.02
 
APM81SP1_RevA_Installation_Book
APM81SP1_RevA_Installation_BookAPM81SP1_RevA_Installation_Book
APM81SP1_RevA_Installation_Book
 
Srs template
Srs templateSrs template
Srs template
 
Group 4 STS final version
Group 4 STS final versionGroup 4 STS final version
Group 4 STS final version
 
ESM_InstallGuide_5.6.pdf
ESM_InstallGuide_5.6.pdfESM_InstallGuide_5.6.pdf
ESM_InstallGuide_5.6.pdf
 
GenRays Project Scope Document
GenRays Project Scope DocumentGenRays Project Scope Document
GenRays Project Scope Document
 
software requirements specification template
software requirements specification templatesoftware requirements specification template
software requirements specification template
 
B28654oas10g best pracitice
B28654oas10g best praciticeB28654oas10g best pracitice
B28654oas10g best pracitice
 
Getting started with odi
Getting started with odiGetting started with odi
Getting started with odi
 

Más de GovCloud Network

IaaS Price performance-benchmark
IaaS Price performance-benchmarkIaaS Price performance-benchmark
IaaS Price performance-benchmarkGovCloud Network
 
Cloud computing training what's right for me
Cloud computing training what's right for meCloud computing training what's right for me
Cloud computing training what's right for meGovCloud Network
 
ViON Corporation: Surviving IT Change
ViON Corporation: Surviving IT ChangeViON Corporation: Surviving IT Change
ViON Corporation: Surviving IT ChangeGovCloud Network
 
Staying Safe in Cyberspace
Staying Safe in CyberspaceStaying Safe in Cyberspace
Staying Safe in CyberspaceGovCloud Network
 
Vets 360 Services - Military Dedication - Corporate Success
Vets 360 Services - Military Dedication - Corporate SuccessVets 360 Services - Military Dedication - Corporate Success
Vets 360 Services - Military Dedication - Corporate SuccessGovCloud Network
 
GovCloud Network LLC Overview - June 25, 2014
GovCloud Network LLC Overview - June 25, 2014GovCloud Network LLC Overview - June 25, 2014
GovCloud Network LLC Overview - June 25, 2014GovCloud Network
 
Army PEO EIS Cloud Architecture
Army PEO EIS Cloud Architecture   Army PEO EIS Cloud Architecture
Army PEO EIS Cloud Architecture GovCloud Network
 
ICH Agile Cloud Session 1-Highlights /Prospective Svc Offerings Kevin Jackson
ICH Agile Cloud Session 1-Highlights /Prospective Svc Offerings   Kevin JacksonICH Agile Cloud Session 1-Highlights /Prospective Svc Offerings   Kevin Jackson
ICH Agile Cloud Session 1-Highlights /Prospective Svc Offerings Kevin JacksonGovCloud Network
 
Improving Cybersecurity and Resilience Through Acquisition Emile Monette GSA
Improving Cybersecurity and Resilience Through Acquisition   Emile Monette GSAImproving Cybersecurity and Resilience Through Acquisition   Emile Monette GSA
Improving Cybersecurity and Resilience Through Acquisition Emile Monette GSAGovCloud Network
 
@AgileCLoud_ICH Presentation - 20140521 US Navy OPNAV - Capt Christopher Page
@AgileCLoud_ICH Presentation - 20140521 US Navy OPNAV - Capt Christopher Page@AgileCLoud_ICH Presentation - 20140521 US Navy OPNAV - Capt Christopher Page
@AgileCLoud_ICH Presentation - 20140521 US Navy OPNAV - Capt Christopher PageGovCloud Network
 
Agile Cloud Conference 2 Introduction - John Brennan
Agile Cloud Conference 2 Introduction - John BrennanAgile Cloud Conference 2 Introduction - John Brennan
Agile Cloud Conference 2 Introduction - John BrennanGovCloud Network
 
DoD Business Capability Lifecycle (BCL) Guide (Draft)
DoD Business Capability Lifecycle  (BCL)  Guide (Draft)DoD Business Capability Lifecycle  (BCL)  Guide (Draft)
DoD Business Capability Lifecycle (BCL) Guide (Draft)GovCloud Network
 
GovCloud Network Overview Presentation
GovCloud Network Overview PresentationGovCloud Network Overview Presentation
GovCloud Network Overview PresentationGovCloud Network
 
PM ISE Information Interoperability Presentation -agile sourcing brief
PM ISE Information Interoperability Presentation -agile sourcing briefPM ISE Information Interoperability Presentation -agile sourcing brief
PM ISE Information Interoperability Presentation -agile sourcing briefGovCloud Network
 
Intrusion Detection on Public IaaS - Kevin L. Jackson
Intrusion Detection on Public IaaS  - Kevin L. JacksonIntrusion Detection on Public IaaS  - Kevin L. Jackson
Intrusion Detection on Public IaaS - Kevin L. JacksonGovCloud Network
 
A Framework for Cloud Computing Adoption in South African Government
A Framework for Cloud Computing Adoption in South African GovernmentA Framework for Cloud Computing Adoption in South African Government
A Framework for Cloud Computing Adoption in South African GovernmentGovCloud Network
 
NCOIC GCC OWS-10 presentation 10 7 2013
NCOIC GCC OWS-10 presentation 10 7 2013NCOIC GCC OWS-10 presentation 10 7 2013
NCOIC GCC OWS-10 presentation 10 7 2013GovCloud Network
 
Tech gate kevin l jackson - 09-21-2013
Tech gate   kevin l jackson - 09-21-2013Tech gate   kevin l jackson - 09-21-2013
Tech gate kevin l jackson - 09-21-2013GovCloud Network
 
Paving the Way to the Cloud: Cloud Services Brokerage for Highly Secure, Dem...
Paving the Way to the Cloud:  Cloud Services Brokerage for Highly Secure, Dem...Paving the Way to the Cloud:  Cloud Services Brokerage for Highly Secure, Dem...
Paving the Way to the Cloud: Cloud Services Brokerage for Highly Secure, Dem...GovCloud Network
 
Government cloud deployment lessons learned final (4 4 2013)
Government cloud deployment lessons learned final (4 4 2013)Government cloud deployment lessons learned final (4 4 2013)
Government cloud deployment lessons learned final (4 4 2013)GovCloud Network
 

Más de GovCloud Network (20)

IaaS Price performance-benchmark
IaaS Price performance-benchmarkIaaS Price performance-benchmark
IaaS Price performance-benchmark
 
Cloud computing training what's right for me
Cloud computing training what's right for meCloud computing training what's right for me
Cloud computing training what's right for me
 
ViON Corporation: Surviving IT Change
ViON Corporation: Surviving IT ChangeViON Corporation: Surviving IT Change
ViON Corporation: Surviving IT Change
 
Staying Safe in Cyberspace
Staying Safe in CyberspaceStaying Safe in Cyberspace
Staying Safe in Cyberspace
 
Vets 360 Services - Military Dedication - Corporate Success
Vets 360 Services - Military Dedication - Corporate SuccessVets 360 Services - Military Dedication - Corporate Success
Vets 360 Services - Military Dedication - Corporate Success
 
GovCloud Network LLC Overview - June 25, 2014
GovCloud Network LLC Overview - June 25, 2014GovCloud Network LLC Overview - June 25, 2014
GovCloud Network LLC Overview - June 25, 2014
 
Army PEO EIS Cloud Architecture
Army PEO EIS Cloud Architecture   Army PEO EIS Cloud Architecture
Army PEO EIS Cloud Architecture
 
ICH Agile Cloud Session 1-Highlights /Prospective Svc Offerings Kevin Jackson
ICH Agile Cloud Session 1-Highlights /Prospective Svc Offerings   Kevin JacksonICH Agile Cloud Session 1-Highlights /Prospective Svc Offerings   Kevin Jackson
ICH Agile Cloud Session 1-Highlights /Prospective Svc Offerings Kevin Jackson
 
Improving Cybersecurity and Resilience Through Acquisition Emile Monette GSA
Improving Cybersecurity and Resilience Through Acquisition   Emile Monette GSAImproving Cybersecurity and Resilience Through Acquisition   Emile Monette GSA
Improving Cybersecurity and Resilience Through Acquisition Emile Monette GSA
 
@AgileCLoud_ICH Presentation - 20140521 US Navy OPNAV - Capt Christopher Page
@AgileCLoud_ICH Presentation - 20140521 US Navy OPNAV - Capt Christopher Page@AgileCLoud_ICH Presentation - 20140521 US Navy OPNAV - Capt Christopher Page
@AgileCLoud_ICH Presentation - 20140521 US Navy OPNAV - Capt Christopher Page
 
Agile Cloud Conference 2 Introduction - John Brennan
Agile Cloud Conference 2 Introduction - John BrennanAgile Cloud Conference 2 Introduction - John Brennan
Agile Cloud Conference 2 Introduction - John Brennan
 
DoD Business Capability Lifecycle (BCL) Guide (Draft)
DoD Business Capability Lifecycle  (BCL)  Guide (Draft)DoD Business Capability Lifecycle  (BCL)  Guide (Draft)
DoD Business Capability Lifecycle (BCL) Guide (Draft)
 
GovCloud Network Overview Presentation
GovCloud Network Overview PresentationGovCloud Network Overview Presentation
GovCloud Network Overview Presentation
 
PM ISE Information Interoperability Presentation -agile sourcing brief
PM ISE Information Interoperability Presentation -agile sourcing briefPM ISE Information Interoperability Presentation -agile sourcing brief
PM ISE Information Interoperability Presentation -agile sourcing brief
 
Intrusion Detection on Public IaaS - Kevin L. Jackson
Intrusion Detection on Public IaaS  - Kevin L. JacksonIntrusion Detection on Public IaaS  - Kevin L. Jackson
Intrusion Detection on Public IaaS - Kevin L. Jackson
 
A Framework for Cloud Computing Adoption in South African Government
A Framework for Cloud Computing Adoption in South African GovernmentA Framework for Cloud Computing Adoption in South African Government
A Framework for Cloud Computing Adoption in South African Government
 
NCOIC GCC OWS-10 presentation 10 7 2013
NCOIC GCC OWS-10 presentation 10 7 2013NCOIC GCC OWS-10 presentation 10 7 2013
NCOIC GCC OWS-10 presentation 10 7 2013
 
Tech gate kevin l jackson - 09-21-2013
Tech gate   kevin l jackson - 09-21-2013Tech gate   kevin l jackson - 09-21-2013
Tech gate kevin l jackson - 09-21-2013
 
Paving the Way to the Cloud: Cloud Services Brokerage for Highly Secure, Dem...
Paving the Way to the Cloud:  Cloud Services Brokerage for Highly Secure, Dem...Paving the Way to the Cloud:  Cloud Services Brokerage for Highly Secure, Dem...
Paving the Way to the Cloud: Cloud Services Brokerage for Highly Secure, Dem...
 
Government cloud deployment lessons learned final (4 4 2013)
Government cloud deployment lessons learned final (4 4 2013)Government cloud deployment lessons learned final (4 4 2013)
Government cloud deployment lessons learned final (4 4 2013)
 

Último

Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfAijun Zhang
 
UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7DianaGray10
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding TeamAdam Moalla
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.YounusS2
 
Comparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioComparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioChristian Posta
 
20230202 - Introduction to tis-py
20230202 - Introduction to tis-py20230202 - Introduction to tis-py
20230202 - Introduction to tis-pyJamie (Taka) Wang
 
UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6DianaGray10
 
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostKubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostMatt Ray
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Adtran
 
Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024SkyPlanner
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureEric D. Schabell
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopBachir Benyammi
 
AI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarAI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarPrecisely
 
Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfinfogdgmi
 
UiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPathCommunity
 
VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXTarek Kalaji
 
Nanopower In Semiconductor Industry.pdf
Nanopower  In Semiconductor Industry.pdfNanopower  In Semiconductor Industry.pdf
Nanopower In Semiconductor Industry.pdfPedro Manuel
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Will Schroeder
 

Último (20)

Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdf
 
UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.
 
Comparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioComparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and Istio
 
20230202 - Introduction to tis-py
20230202 - Introduction to tis-py20230202 - Introduction to tis-py
20230202 - Introduction to tis-py
 
UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6
 
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostKubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™
 
20150722 - AGV
20150722 - AGV20150722 - AGV
20150722 - AGV
 
Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability Adventure
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 Workshop
 
AI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarAI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity Webinar
 
Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdf
 
UiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation Developers
 
VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBX
 
Nanopower In Semiconductor Industry.pdf
Nanopower  In Semiconductor Industry.pdfNanopower  In Semiconductor Industry.pdf
Nanopower In Semiconductor Industry.pdf
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
 

Security Assessment Plan (Template)

  • 1. Security Assessment Plan <Information System Name>, <Date> Security Assessment Plan (Template) Version 1.0 May 2, 2012 Company Sensitive and Proprietary For Authorized Use Only
  • 2. Security Assessment Plan <Information System Name>, <Date> Document Name Prepared by Identification of Third-Party Assessment Organization that Prepared this Document Organization Name Street Address <insert logo> Suite/Room/Building City, State Zip Prepared for Identification of Cloud Service Provider Organization Name Street Address <insert logo> Suite/Room/Building City, State Zip Company Sensitive and Proprietary Page 2
  • 3. Security Assessment Plan <Information System Name>, <Date> Executive Summary The Federal Risk Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for Cloud Service Providers (CSP). Testing security controls is an integral part of the FedRAMP security authorization requirements and enables Federal Agencies to use the findings that result from the tests to make risk-based decisions. Providing a plan for security control ensures that the process runs smoothly. This document, released originally in Template format, has been designed for CSP Third-Party Independent Assessors (3PAOs) to use for planning security testing of CSPs. Once filled out, this document constitutes a plan for testing. Actual findings from the tests are to be recorded in FedRAMP security test procedure workbooks and a Security Assessment Report (SAR). Company Sensitive and Proprietary Page 3
  • 4. Security Assessment Plan <Information System Name>, <Date> Document Revision History Date Description Version Author 05/02/2012 Document Publication 1.0 FedRAMP Office 05/03/2012 Renamed Section 5.3 1.0 FedRAMP Office Company Sensitive and Proprietary Page 4
  • 5. Security Assessment Plan <Information System Name>, <Date> Table of Contents About this document .....................................................................................................................................................7 Who should use this document? .....................................................................................................................7 How this document is organized .....................................................................................................................7 Conventions used in this document ................................................................................................................7 How to contact us............................................................................................................................................8 1. Overview...........................................................................................................................................................9 1.2 Applicable Laws and Regulations.......................................................................................................10 1.3 Applicable Standards and Guidance ..................................................................................................10 1.4 FedRAMP Governance .......................................................................................................................10 2. Scope ..............................................................................................................................................................10 2.1 System Name/Title ............................................................................................................................10 2.2 IP Addresses Slated for Testing ..........................................................................................................11 2.3 Web Applications Slated for Testing ..................................................................................................12 2.4 Databases Slated for Testing ..............................................................................................................12 2.5 Roles Slated for Testing ......................................................................................................................13 3. Assumptions ...................................................................................................................................................13 4. Methodology ..................................................................................................................................................14 5. Test Plan ..........................................................................................................................................................15 5.1 Security Assessment Team ................................................................................................................15 5.2 CSP Testing Points of Contact ............................................................................................................16 5.3 Testing Performed Using Automated Tools .......................................................................................16 5.4 Testing Performed Through Manual Methods...................................................................................17 5.5 Schedule ............................................................................................................................................17 6. Rules of Engagement ......................................................................................................................................18 6.1 Disclosures .........................................................................................................................................18 6.1.1. Security Testing May Include .........................................................................................................19 6.1.2. Security Testing Will Not Include...................................................................................................19 6.2 End of Testing ....................................................................................................................................20 6.3 Communication of Test Results ........................................................................................................20 6.4 Limitation of Liability .........................................................................................................................20 6.5 Signatures ..........................................................................................................................................21 Acronyms .....................................................................................................................................................................22 Appendix A – Test Case Procedures .............................................................................................................................23 Company Sensitive and Proprietary Page 5
  • 6. Security Assessment Plan <Information System Name>, <Date> List of Tables Table 2-1. Information System Name and Title............................................................................................................11 Table 2-2. Location of Components .............................................................................................................................11 Table 2-3. Components Slated for Testing ...................................................................................................................11 Table 2-4. Application URLs Slated for Testing ............................................................................................................12 Table 2-5. Databases Slated for Testing ......................................................................................................................12 Table 2-6. Role Based Testing .......................................................................................................................................13 Table 5-1. Security Testing Team ..................................................................................................................................15 Table 5-2. CSP Points of Contact ..................................................................................................................................16 Table 5-3. Tools Used for Security Testing ....................................................................................................................16 Table 5-4. Testing Performed Through Manual Methods ............................................................................................17 Table 5-5. Testing Schedule ..........................................................................................................................................17 Table 6-1. Individuals at CSP Receiving Test Results ....................................................................................................20 Company Sensitive and Proprietary Page 6
  • 7. Security Assessment Plan <Information System Name>, <Date> ABOUT THIS DOCUMENT This document has been developed to provide guidance on how to participate in and understand the FedRAMP program. Who should use this document? This document is intended to be used by FedRAMP Third-Party Independent Assessors (3PAOs) when testing Cloud Service Provider (CSP) security controls. How this document is organized This document is divided into ten sections. Most sections include subsections. Section 1 describes an overview of the testing process. Section 2 describes the scope of the security testing. Section 3 describes assumptions related to the security testing. Section 4 describes the security testing methodology. Section 5 describes the test plan and schedule. Section 6 describes the Rules of Engagement and signatures for security testing. Conventions used in this document This document uses the following typographical conventions: Italic Italics are used for email addresses, security control assignments parameters, and formal document names. Italic blue in a box Italic blue text in a blue box indicates instructions to the individual filling out the template. Instruction: This is an instruction to the individual filling out of the template. Bold Bold text indicates a parameter or an additional requirement. Constant width Constant width text is used for text that is representative of characters that would show up on a computer screen. Company Sensitive and Proprietary Page 7
  • 8. Security Assessment Plan <Information System Name>, <Date> <Brackets> Bold blue text in brackets indicates text that should be replaced with user-defined values. Once the text has been replaced, the brackets should be removed. Notes Notes are found between parallel lines and include additional information that may be helpful to the users of this template. Note: This is a note. Sans Serif Sans Serif text is used for tables, table captions, figure captions, and table of contents. How to contact us If you have questions about FedRAMP or something in this document, please write to: info@fedramp.gov For more information about the FedRAMP project, please see the website at: http://www.fedramp.gov. Company Sensitive and Proprietary Page 8
  • 9. Security Assessment Plan <Information System Name>, <Date> 1. OVERVIEW Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for Cloud Service Providers (CSP). Testing security controls is an integral part of the FedRAMP security authorization requirements. Providing a plan for security control ensures that the process runs smoothly. The <Information System Name> will be assessed by a FedRAMP accredited Third-Party Assessment Organization (3PAO). The use of an independent assessment team reduces the potential for conflicts of interest that could occur in verifying the implementation status and effectiveness of the security controls. NIST SP 800-39, Managing Information Security Risk states: Assessor independence is an important factor in: (i) preserving the impartial and unbiased nature of the assessment process; (ii) determining the credibility of the security assessment results; and (iii) ensuring that the authorizing official receives the most objective information possible in order to make an informed, risk-based, authorization decision. 1.1 Purpose Instruction: A goal of the kick-off meeting is to obtain the necessary information to populate this plan. The 3PAO should obtain the requisite information on the CSP system at the kick-off meeting so that this plan can be completed. After this plan has been completed, the 3PAO should meet again with the CSP, present the Draft Security Assessment Plan, and make any necessary changes before finalizing the plan. Both the Draft plan and Final plan should be submitted to the FedRAMP ISSO for review. This document consists of a test plan to test the security controls for the <Information System Name>. It has been completed by <3PAO> for the benefit of <CSP>. NIST SP 800-39, Managing Information Security Risk states: The information system owner and common control provider rely on the security expertise and the technical judgment of the assessor to: (i) assess the security controls employed within and inherited by the information system using assessment procedures specified in the security assessment plan; and (ii) provide specific recommendations on how to correct weaknesses or deficiencies in the controls and address identified vulnerabilities. Company Sensitive and Proprietary Page 9
  • 10. Security Assessment Plan <Information System Name>, <Date> 1.2 Applicable Laws and Regulations The following laws and regulations are applicable to the FedRAMP program: Computer Fraud and Abuse Act [PL 99-474, 18 USC 1030] Federal Information Security Management Act (FISMA) of 2002 [Title III, PL 107-347] Homeland Security Presidential Directive-7, Critical Infrastructure Identification, Prioritization, and Protection [HSPD-7] Management of Federal Information Resources [OMB Circular A-130] Privacy Act of 1974 as amended [5 USC 552a] Protection of Sensitive Agency Information [OMB M-06-16] Security of Federal Automated Information Systems [OMB Circular A-130, Appendix III] 1.3 Applicable Standards and Guidance The following standards and guidance are applicable to security testing and risk assessment: Guide for Assessing the Security Controls in Federal Information Systems [NIST SP 800- 53A] Risk Management Guide for Information Technology Systems [NIST SP 800-30] Technical Guide to Information Security Testing and Assessment [NIST SP 800-115] Managing Information Security Risk [NIST SP 800-39] 1.4 FedRAMP Governance FedRAMP is governed by a Joint Authorization Board (JAB) that consists of representatives from the Department of Homeland Security (DHS), the General Services Administration (GSA), and the Department of Defense (DoD). The FedRAMP program is endorsed by the U.S. government CIO Council including the Information Security and Identity Management Committee (ISIMC). The ISIMC collaborates on identifying high-priority security and identity management initiatives and developing recommendations for policies, procedures, and standards to address those initiatives. 2. SCOPE The scope of the security tests that will be performed for the CSP service offering is limited and well defined. Tests on systems and interfaces that are outside the boundary of the CSP service offering (for FedRAMP) are not included in this plan. 2.1 System Name/Title Instruction: Name the system that that is slated for testing and include the geographic location of all components that will be tested. Put in a brief description of the system components that is a direct copy/paste from the description in the System Security Plan. Company Sensitive and Proprietary Page 10
  • 11. Security Assessment Plan <Information System Name>, <Date> This <Information System Name> that is undergoing testing as described in this Security Assessment Plan is named in Table 2-1. Table 2-1. Information System Name and Title Unique Identifier Information System Name Information System Abbreviation The physical locations of all the different components that will be tested are described in Table 2-2. Table 2-2. Location of Components Data Center Site Name Address Description of Components 2.2 IP Addresses Slated for Testing Instruction: List the IP address of all systems that will be tested. You will need to obtain this information from the System Security Plan and the CSP. Note that the IP addresses found in the System Security Plan should be consistent with the boundary. If additional IP addresses are discovered that were not included in the System Security Plan, advise the CSP to update the inventory and boundary information in the SSP and obtain new approval on the SSP from the ISSO before moving forward. IP addresses can be listed by network ranges and CIDR blocks. If you are scanning a large network (Class B or larger), you should plan on testing a subset of the IP addresses. All scans should be fully authenticated. Add additional rows to the table as necessary. IP addresses, and network ranges, of the system that will be tested are noted inTable 2-3. Table 2-3. Components Slated for Testing IP Address(s) or Hostname Software & Version Function Ranges Company Sensitive and Proprietary Page 11
  • 12. Security Assessment Plan <Information System Name>, <Date> 2.3 Web Applications Slated for Testing Instruction: Insert any URLs and the associated login IDs that will be used for testing. Only list the login URL. Do not list every URL that is inside the login in the below table. In the Function column, indicate the purpose that the web-facing application plays for the system (e.g. control panel to build virtual machines). Activities employed to perform role testing on web applications may include capturing POST and GET requests for each function. The various web based applications that make up the system, and the logins and their associated roles that will be used for testing are noted by URL in Table 2-4. Table 2-4. Application URLs Slated for Testing Login URL IP Address of Login Host Function 2.4 Databases Slated for Testing Instruction: Insert the hostnames, IP address, and any relevant additional information on the databases that will be tested. All scans should be fully authenticated. Add additional rows as necessary. Databases that are slated for testing include those listed in Table 2-5. Table 2-5. Databases Slated for Testing Database Name Hostname IP Address Additional Info Company Sensitive and Proprietary Page 12
  • 13. Security Assessment Plan <Information System Name>, <Date> 2.5 Roles Slated for Testing Role testing will be performed to test the authorizations restrictions for each role. <3PAO> will access the system while logged in as different user types and attempt to perform restricted functions as unprivileged users. Functions and roles that will be tested are noted in Table 2-6. Roles slated for testing correspond to those roles listed in Table 9-1 of the <Information System Name> System Security Plan. Table 2-6. Role Based Testing Role Name Test User ID Associated Functions 3. ASSUMPTIONS Instruction: The assumptions listed are default assumptions. 3PAO should edit these assumptions as necessary for each unique engagement. The following assumptions were used when developing this Security Assessment Plan: <CSP> resources, including documentation and individuals with knowledge of the <CSP> systems and infrastructure and their contact information, will be available to <3PAO> staff during the time necessary to complete assessments. The <CSP> will provide login account information / credentials necessary for <3PAO> to use its testing devices to perform authenticated scans of devices and applications. The <CSP> will permit <3PAO> to connect its testing laptops to the <CSP> networks defined within the scope of this assessment. The <CSP > will permit communication from <3PAO> testing appliances to an internet hosted vulnerability management service to permit the analysis of vulnerability data. Security controls that have been identified as “Not Applicable” (e.g. AC-18 wireless access) in the System Security Plan will be verified as such and further testing will not be performed on these security controls Significant upgrades or changes to the infrastructure and components of the system undergoing testing will not be performed during the security assessment period. Company Sensitive and Proprietary Page 13
  • 14. Security Assessment Plan <Information System Name>, <Date> For onsite control assessment, <CSP> personnel will be available should the <3PAO> staff determine that either after hours work, or weekend work, is necessary to support the security assessment. 4. METHODOLOGY Instruction: FedRAMP provides a documented methodology to describe the process for testing the security controls. 3PAOs may edit this section to add additional information. <3PAO> will perform an assessment of the <Information System Name> security controls using the methodology described in NIST SP 800-53A. <3PAO> will use FedRAMP supplied test procedures to evaluate the security controls. Contained in Excel worksheets, these test procedures contain the test objectives and associated test cases to determine if a control is effectively implemented and operating as intended. The results of the testing shall be recorded in the worksheets (provided in Appendix A) along with information that notes whether the control (or control enhancement) is satisfied or not. <3PAO> data gathering activities will consist of the following: Request <CSP> to provide FedRAMP required documentation Request any follow-up documentation, files, or information needed that is not provided in FedRAMP required documentation Travel to the CSP sites as necessary to inspect systems and meet with CSP staff Obtain information through the use of security testing tools Security controls will be verified using one or more of the following assessment methods: Examine: the 3PAO will review, analyze, inspect, or observe one or more assessment artifacts as specified in the attached test cases; Interview: the 3PAO will conduct discussions with individuals within the organization to facilitate assessor understanding, achieve clarification, or obtain evidence; Technical Tests: the 3PAO will perform technical tests, including penetration testing, on system components using automated and manual methods. NIST SP 800-39, Managing Information Security Risk states: Prior to initiating the security control assessment, an assessor conducts an assessment of the security plan to help ensure that the plan provides a set of security controls for the information system that meet the stated security Company Sensitive and Proprietary Page 14
  • 15. Security Assessment Plan <Information System Name>, <Date> requirements. Instruction: All documentation provided to the 3PAO by the CSP should be reviewed for accuracy and completeness. Any issues with CSP documentation should be recorded in both the security testing procedures workbooks and in the SAR. If CSP documentation makes reference to 5. TEST PLAN additional documentation that has not been provided to the 3PAO, the 3PAO may request copies of that documentation from the CSP. 3PAOs should keep a list of all documentation that was The schedule for testing, CSP, and which documents were provided as aused are described in the provided to them by the testing roles, and the testing tools that will be subsequent additional request. The SAR template will require that all documents reviewed be listed. sections that follow. 5.1 Security Assessment Team Instruction: List the members of the risk assessment team and the role each member will play. Include team members contact information. The security assessment team consists of individuals from <3PAO Name> which are located at <Address of 3PAO>. Information about <3PAO Name> can be found at the following URL: <insert URL>. Security control assessors play a unique role in testing system security controls. NIST 800-39, Managing Information Security Risk states: The security control assessor is an individual, group, or organization responsible for conducting a comprehensive assessment of the management, operational, and technical security controls employed within or inherited by an information system to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). The members of the 3PAO security testing team are found in Table 5-1. Table 5-1. Security Testing Team Name Role Contact Information Company Sensitive and Proprietary Page 15
  • 16. Security Assessment Plan <Information System Name>, <Date> 5.2 CSP Testing Points of Contact Instruction: The 3PAO should obtain at least three points of contact from the CSP to use for testing communications. One of the contacts should be available 24 x 7 and should include an operations center (e.g. NOC, SOC). The CSP points of contact that the testing team will use are found in Table 5-2. Table 5-2. CSP Points of Contact Name Role Contact Information 5.3 Testing Performed Using Automated Tools Instruction: Describe what tools will be used for testing security controls. Include all product names and names of open source tools and include version numbers. If open source tools are used, name the organization (or individuals) who developed the tools. Additionally, describe the function and purpose of the tool (e.g. file integrity checking, web application scanning). If you are using a scanner, indicate what the scanner’s capability is, e.g. database scanning, web application scanning, infrastructure scanning, code scanning/analysis). For more information on please see the Guide to Understanding FedRAMP. <3PAO Name> plans to use the following tools noted in Table 5-3 to perform testing of the <Information System Name>. Table 5-3. Tools Used for Security Testing Tool Name Vendor/Organization Name & Version Purpose of Tool Company Sensitive and Proprietary Page 16
  • 17. Security Assessment Plan <Information System Name>, <Date> 5.4 Testing Performed Through Manual Methods Instruction: Describe what technical tests will be performed through manual methods without the use of automated tools. The results of all manual tests must be recorded in the SAR. Examples are listed in the first four rows. Delete the examples, and put in the real tests. Add additional rows as necessary. Identifiers should be in the format MT-1, MT-2 which would indicate “Manual Test 1” and “Manual Test 2” etc.. Table 5-4. Testing Performed Through Manual Methods Test ID Test Name Description MT-1 Forceful Browsing We will login as a customer and try to see if we can gain access to the Network Administrator and Database Administrator privileges and authorizations by navigating to different views and manually forcing the browser to various URLs. MT-2 SQL Injection We will perform some manual SQL injection attacks using fake names and 0 OR '1'='1' statements. MT-3 CAPTCHA We will test the CAPTCHA function on the web form manually. MT-4 OCSP We will manually test to see if OCSP is validating certificates. 5.5 Schedule Instruction: Insert the security assessment testing schedule. This schedule should be presented to the CSP by the 3PAO at the kick-off meeting. The ISSO should be invited to the meeting that presents the schedule to the CSP. After being presented to the CSP at the kick-off meeting, the 3PAO should make any necessary updates to the schedule and this document and send an updated version of the CSP (Ccing the ISSO). The security assessment testing schedule can be found in Table 5-5. Table 5-5. Testing Schedule Task Name Start Date Finish Date Kick-off Meeting Company Sensitive and Proprietary Page 17
  • 18. Security Assessment Plan <Information System Name>, <Date> Task Name Start Date Finish Date Prepare Test Plan Meeting to Review Test Plan Test Plan Update Review CSP Documentation Conduct Interviews of CSP Staff Perform Testing Vulnerability Analysis and Threat Assessment Risk Exposure Table Development Complete Draft SAR Draft SAR Delivered to SAP Issue Resolution Meeting Complete Final Version of SAR Send Final Version of SAR to CSP and ISSO 6. RULES OF ENGAGEMENT A Rules of Engagement (ROE) is a document designed to describe proper notifications and disclosures between the owner of a tested systems and an independent assessor. In particular, a ROE includes information about targets of automated scans and IP address origination information of automated scans (and other testing tools). Together with the information provided in preceding sections of this document, this document shall serve as a Rules of Engagement once signed. Instruction: FedRAMP provides and recommends the Rules of Engagement as listed in the section that follows. 3POAs should edit this ROE as necessary. The final version of the ROE should be signed by both the 3PAO and CSP. 6.1 Disclosures Instruction: Edit and modify the disclosures as necessary. If testing is to be conducted from an internal location, identify at least one network port with access to all subnets/segments to be tested. The purpose of identifying the IP addresses from where the security testing will be performed is so that when 3PAOs are performing scans, the CSP will understand that the rapid and high volume network traffic is not an attack and is part of the testing. Company Sensitive and Proprietary Page 18
  • 19. Security Assessment Plan <Information System Name>, <Date> Any testing will be performed according to terms and conditions designed to minimize risk exposure that could occur during security testing. All scans will originate from the following IP address(es): <IP addresses>. 6.1.1. Security Testing May Include Instruction: 3PAO should edit the bullets in this default list to make it consistent with each unique system tested. Security testing may include the following activities: Port scans and other network service interaction and queries Network sniffing, traffic monitoring, traffic analysis, and host discovery Attempted logins or other use of systems, with any account name/password Attempted SQL injection and other forms of input parameter testing Use of exploit code for leveraging discovered vulnerabilities Password cracking via capture and scanning of authentication databases Spoofing or deceiving servers regarding network traffic Altering running system configuration except where denial of service would result Adding user accounts 6.1.2. Security Testing Will Not Include Instruction: 3PAO should edit the bullets in this default list to make it consistent with each unique system tested. Security testing will not include any of the following activities: Changes to assigned user passwords Modification of user files or system files Telephone modem probes and scans (active and passive) Intentional viewing of <CSP> staff email, Internet caches, and/or personnel cookie files Denial of Service attacks (smurf, land, SYN flood, etc.) Exploits that will introduce new weaknesses to the system Intentional introduction of malicious code (viruses, Trojans, worms, etc.) Company Sensitive and Proprietary Page 19
  • 20. Security Assessment Plan <Information System Name>, <Date> 6.2 End of Testing <3PAO> will notify <Name of Person> at <CSP> when security testing has been completed. 6.3 Communication of Test Results Email and reports on all security testing will be encrypted according to <CSP> requirements. Security testing results will be sent and disclosed to the individuals at <CSP> noted in Table 6-1 within <number> days after security testing has been completed. Table 6-1. Individuals at CSP Receiving Test Results Name Role Contact Information 6.4 Limitation of Liability Instruction: Insert any Limitations of Liability associated with the security testing below. Edit the provided default Limitation of Liability as needed. <3PAO>, and its stated partners, shall not be held liable to <CSP> for any and all liabilities, claims, or damages arising out of or relating to the security vulnerability testing portion of this Agreement, howsoever caused and regardless of the legal theory asserted, including breach of contract or warranty, tort, strict liability, statutory liability, or otherwise. <CSP> acknowledges that there are limitations inherent in the methodologies implemented, and the assessment of security and vulnerability relating to information technology is an uncertain process based on past experiences, currently available information, and the anticipation of reasonable threats at the time of the analysis. There is no assurance that an analysis of this nature will identify all vulnerabilities or propose exhaustive and operationally viable recommendations to mitigate all exposure. Company Sensitive and Proprietary Page 20
  • 21. Security Assessment Plan <Information System Name>, <Date> 6.5 Signatures The following individuals at the 3PAO and CSP have been identified as having the authority to agree to security testing of <Information System Name>. ACCEPTANCE AND SIGNATURE I have read the above Security Assessment Plan and Rules of Engagement and I acknowledge and agree to the tests and terms set forth in the plan. 3PAO Representative: _________________________________ (printed) 3PAO Representative: _________________________________ (signature) ______ (date) CSP Representative: _________________________________ (printed) CSP Representative: _________________________________ (signature) ______ (date) Company Sensitive and Proprietary Page 21
  • 22. Security Assessment Plan <Information System Name>, <Date> ACRONYMS Acronyms used in this document can be found in the below table. Acronym Description FedRAMP Federal Risk Authorization Management Program NIST National Institute of Standards and Technology SAP Security Assessment Plan SAR Security Assessment Report Company Sensitive and Proprietary Page 22
  • 23. Security Assessment Plan <Information System Name>, <Date> APPENDIX A – TEST CASE PROCEDURES Results of the attached security test case procedures shall be recorded directly in each respective workbook. A_01_AC_20111102. A_02_AT_20111028. A_03_AU_20111102. A_04_CA_20111102. A.3.1.2.05_CM_2011 xlsx xlsx xlsx xlsx 1102.xlsx A_06_CP_20111108. A_07_IA_20111109. A_08_IR_20111114. A_09_MA_20111115 A_10_MP_20111116. xlsx xlsx xlsx .xlsx xlsx A_11_PE_20111118. A_12_PL_20111118. A_13_PS_20111121. A_14_RA_20111122. A_15_SA_20111125. xlsx xlsx xlsx xlsx xlsx A_16_SC_20111130. A_17_SI_20111201. xlsx xlsx Company Sensitive and Proprietary Page 23