NIST guide: The imperative of real-time risk management
Connecting state and local government leaders
NIST is revising its guidance for assessing the IT security controls required under FISMA as part of an effort to emphasize real-time risk management and to harmonize security requirements across government.
Revised guidelines for assessing security controls for government IT systems reflect a shifting emphasis toward continuously monitoring systems and making real-time risk assessments.
The changes are laid out in a final draft of Special Publication 800-53A Rev. 1, "Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans," released for public comment Thursday by the National Institute of Standards and Technology.
The guidelines were developed by an inter-agency working group that is part of an initiative to harmonize information security requirements across government, including national security systems in the military and in the intelligence community. It is the third publication developed by the Joint Task Force Transformation Initiative Working Group and is a companion document to SP 800-53 Rev. 3, "Recommended Security Controls for Federal Information Systems and Organizations," also recently updated.
SP 800-53A gives guidelines for developing security assessment plans required for government IT systems.
“The updated security assessment guideline incorporates best practices in information security from the United States Department of Defense, Intelligence Community, and Civil agencies and includes security control assessment procedures for both national security and non national security systems,” NIST wrote in introducing the publication. “The guideline for developing security assessment plans is intended to support a wide variety of assessment activities in all phases of the system development life cycle including development, implementation, and operation.”
Significant changes in the new publication include:
- Updated assessment procedures for security controls and control enhancements specified in SP 800-53, Rev. 3.
- Elimination of the Extended Assessment Procedure.
- Establishing a simpler common nomenclature for some attributes.
- Elimination of some designators in the assessment procedures catalog to give greater flexibility in selecting appropriate assessment methods.
- The important changes described in Special Publication 800-53A, Revision 1, are part of a larger strategic initiative to focus on enterprisewide, near real-time risk management; that is, managing risks from information systems in dynamic environments of operation that can adversely affect organizational operations and assets, individuals, other organizations, and the nation, the document says.
The changes allow increased flexibility in selecting methods and objects of assessment, which in turn should allow organizations to apply the appropriate emphasis at every step of the system life cycle, from early in the development process to monitoring during full operation. “As always, communities of interest may establish certain floors or ceilings on the level of assessment activities based on mission/business needs,” the document says.
Comments on the draft of SP 8000-53A Rev. 1 should be submitted by June 4 to sec-cert@nist.gov. Upon final publication, NIST and the task force plan to update Web-based assessment cases described in Appendix H of the document, which help to provide a predefined set of actions needed for an assessment. Use of these predefined actions is not required, and agencies also have the flexibility of using more generalized procedures laid out elsewhere in the publication.
In addition to this draft publication, NIST also has updated Revision 3 of SP 800-53, which contains an errata page showing significant changes that have been made through May 1. SP 800-53 spells out the security controls necessary for compliance with Federal Information Processing Standard 200, Minimum Security Requirements for Federal Information and Information Systems. While not a complete revision of SP 800-53, the updates are part of an effort by NIST to keep its guidance up to date.
NEXT STORY: Terrorism goes low-tech