OVERVIEW The objective of program management is to ensure that security considerations are planned for early and handled consistently in the project lifecycle. The DoD has established an integrated enterprise-wide decision structure for cybersecurity risk management (the Risk Management Framework (RMF)) that includes cybersecurity requirements for DoD information technologies will be managed through the RMF consistent with the principals established in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37. This plan ensures that {ACRONYM} follows the established guidelines and requirements for program management. The formal System Security Plan is documented separately. The purpose of this document is to consolidate information and provide traceability to security control requirements. The following subject areas are considered Tier-1 requirements and are covered at the DoD level: PM-1 Information Security Program Plan PM-2 Senior Information Security Officer PM-7 Enterprise Architecture PM-8 Critical Infrastructure Plan PM-9 Risk Management Strategy PM-10 Security Authorization Process PM-13 Information Security Workforce This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in . CNTL NO. CONTROL NAME PRIORITY LOW MOD HIGH Information Security Not Not Selected Not Selected Not Selected Program Plan Selected Senior Information Security Not Not Selected Not Selected Not Selected Officer Selected Information Security Not PM-3 PM-3 PM-3 Resources Selected Plan of Action and Not PM-4 PM-4 PM-4 Milestones Process Selected Information System Not PM-5 PM-5 PM-5 Inventory Selected Information Security Not PM-6 PM-6 PM-6 Measures of Performance Selected Enterprise Architecture Not Not Selected Not Selected Not Selected Selected Critical Infrastructure Plan Not Not Selected Not Selected Not Selected Selected Risk Management Strategy Not Not Selected Not Selected Not Selected Selected Security Authorization Not Not Selected Not Selected Not Selected Process Selected Mission/Business Process Not PM-11 PM-11 PM-11 Definition Selected
OVERVIEW The objective of program management is to ensure that security considerations are planned for early and handled consistently in the project lifecycle. The DoD has established an integrated enterprise-wide decision structure for cybersecurity risk management (the Risk Management Framework (RMF)) that includes cybersecurity requirements for DoD information technologies will be managed through the RMF consistent with the principals established in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37. This plan ensures that {ACRONYM} follows the established guidelines and requirements for program management. The formal System Security Plan is documented separately. The purpose of this document is to consolidate information and provide traceability to security control requirements. The following subject areas are considered Tier-1 requirements and are covered at the DoD level: PM-1 Information Security Program Plan PM-2 Senior Information Security Officer PM-7 Enterprise Architecture PM-8 Critical Infrastructure Plan PM-9 Risk Management Strategy PM-10 Security Authorization Process PM-13 Information Security Workforce This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in . CNTL NO. CONTROL NAME PRIORITY LOW MOD HIGH Information Security Program Plan Not Selected Not Selected Not Selected Not Selected Senior Information Security Officer Not Selected Not Selected Not Selected Not Selected Information Security Resources Not Selected PM-3 PM-3 PM-3 Plan of Action and Milestones Process Not Selected PM-4 PM-4 PM-4 Information System Inventory Not Selected PM-5 PM-5 PM-5 Information Security Measures of Performance Not Selected PM-6 PM-6 PM-6 Enterprise Architecture Not Selected Not Selected Not Selected Not Selected Critical Infrastructure Plan Not Selected Not Selected Not Selected Not Selected Risk Management Strategy Not Selected Not Selected Not Selected Not Selected Security Authorization Process Not Selected Not Selected Not Selected Not Selected Mission/Business Process Definition Not Selected PM-11 PM-11 PM-11