Chapter 35 of Title 44, U.S.C. disruption, modification, denial of service, or OMB Circular A-130, Appendix destruction of agency information and information III systems. NIST SP 800-30 NIST SP 800-37 NIST SP 800-39 NIST SP 800-53 NIST SP 800-59 CNSSI 4012 ISO/IEC 27005 NIST SP 800-37 10.6 LO 2: Specify responsibilities and criteria for NIST SP 800-53 granting approvals. NIST SP 800-37 10.6 LO 3: Develop implementing procedures for NIST SP 800-53 granting authority to operate (i.e., certification and accreditation). 10.6 LO 4: Formulate risk management plans to NIST SP 800-37 NIST SP 800-53 mitigate identified cybersecurity/IA weaknesses. Competency 10.7 - Enterprise-wide 10.7 LO 1: Evaluate an agency-wide cybersecurity/IA program cybersecurity/IA program and modify the program to comply with changes in policies, laws, management regulations, standards, threats, and vulnerabilities. Chapter 35 of Title 44, U.S.C. OMB Circular A-130, Appendix III NIST SP 800-100 10.7 LO 2: Model how to document remedial action to address deficiencies in the cybersecurity/IA policies, procedures, and practices of an organization. Chapter 35 of 44, U.S.C. 10.7 LO 3: Develop a plan and implementing NIST SP 800-16 procedures for a comprehensive cybersecurity/IA NIST SP 800-50 education and training program that includes tiered 4012 levels of training (e.g., general managers, ISO/IEC 27002 personnel with significant responsibilities for information security, and general agency awareness training), as well as continuous learning requirements. Competency 10.8 - Information 10.8 LO 1: Discuss OMB IT security reporting requirements and develop an example of such a security reporting compliance report. Chapter 35 of 44, U.S.C. OMB M-12-20 (or latest FY guidance) OMB Guidance on Exhibit 300
Chapter 35 of Title 44, U.S.C. OMB Circular A-130, Appendix III NIST SP 800-30 NIST SP 800-37 NIST SP 800-39 NIST SP 800-53 NIST SP 800-59 CNSSI 4012 ISO/IEC 27005 disruption, modification, denial of service, or destruction of agency information and information systems. NIST SP 800-37 NIST SP 800-53 10.6 LO 2: Specify responsibilities and criteria for granting approvals. NIST SP 800-37 NIST SP 800-53 10.6 LO 3: Develop implementing procedures for granting authority to operate (i.e., certification and accreditation). NIST SP 800-37 NIST SP 800-53 10.6 LO 4: Formulate risk management plans to mitigate identified cybersecurity/IA weaknesses. Competency 10.7 - Enterprise-wide cybersecurity/IA program management Chapter 35 of Title 44, U.S.C. OMB Circular A-130, Appendix III NIST SP 800-100 10.7 LO 1: Evaluate an agency-wide cybersecurity/IA program and modify the program to comply with changes in policies, laws, regulations, standards, threats, and vulnerabilities. 10.7 LO 2: Model how to document remedial action to address deficiencies in the cybersecurity/IA policies, procedures, and practices of an organization. Chapter 35 of 44, U.S.C. NIST SP 800-16 NIST SP 800-50 4012 ISO/IEC 27002 10.7 LO 3: Develop a plan and implementing procedures for a comprehensive cybersecurity/IA education and training program that includes tiered levels of training (e.g., general managers, personnel with significant responsibilities for information security, and general agency awareness training), as well as continuous learning requirements. Competency 10.8 - Information security reporting compliance Chapter 35 of 44, U.S.C. OMB M-12-20 (or latest FY guidance) OMB Guidance on Exhibit 300 10.8 LO 1: Discuss OMB IT security reporting requirements and develop an example of such a report.