attack vectors, and attack patterns as well as compensating controls and design patterns needed to mitigate risk; and reducing risk to acceptable levels, thus enabling informed risk management decisions, Is {ACRONYM} a new development effort? No Yes If no, delete the following information. If yes, 1. Do system requirements documents apply information system security No Yes engineering principles in the specification of the information system? 2. Do design documents apply information system security engineering No Yes principles in the design of the information system? 3. Do system development procedures (e.g. configuration management No Yes plans, code review procedures, and coding style guides) apply information system security engineering principles in the development of the information system? 4. Are changes made in accordance with the configuration management No Yes plan? 5. Does an audit trail of changes exist? No Yes EXTERNAL INFORMATION SYSTEM SERVICES External information system services are services that are implemented outside of the authorization boundaries of organizational information systems. This includes services that are used by, but not a part of, organizational information systems. FISMA and OMB policy require that organizations using external service providers that are processing, storing, or transmitting federal information or operating information systems on behalf of the federal government ensure that such providers meet the same security requirements that federal agencies are required to meet. Does {ACRONYM} acquire or outsource information security services? No Yes If no, delete the following information. If yes, 1. Has an organizational assessment of risk prior to the acquisition or No Yes outsourcing of dedicated information security services been performed? 2. Has the acquisition or outsourcing of dedicated information security No Yes services been approved by the DoD Component CIO or their delegate(s)? 3. Have the functions, ports, protocols, and other services required for the No Yes use of such services been identified? 4. Do external information system services comply with No Yes information security requirements? 5. Do contracts/agreements require that providers of external information No Yes system services employ security controls defined in CNSSI 1253?
attack vectors, and attack patterns as well as compensating controls and design patterns needed to mitigate risk; and reducing risk to acceptable levels, thus enabling informed risk management decisions, Is {ACRONYM} a new development effort? No Yes If no, delete the following information. If yes, 1. Do system requirements documents apply information system security engineering principles in the specification of the information system? No Yes 2. Do design documents apply information system security engineering principles in the design of the information system? No Yes 3. Do system development procedures (e.g. configuration management plans, code review procedures, and coding style guides) apply information system security engineering principles in the development of the information system? No Yes 4. Are changes made in accordance with the configuration management plan? No Yes 5. Does an audit trail of changes exist? No Yes EXTERNAL INFORMATION SYSTEM SERVICES External information system services are services that are implemented outside of the authorization boundaries of organizational information systems. This includes services that are used by, but not a part of, organizational information systems. FISMA and OMB policy require that organizations using external service providers that are processing, storing, or transmitting federal information or operating information systems on behalf of the federal government ensure that such providers meet the same security requirements that federal agencies are required to meet. Does {ACRONYM} acquire or outsource information security services? No Yes If no, delete the following information. If yes, 1. Has an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services been performed? No Yes 2. Has the acquisition or outsourcing of dedicated information security services been approved by the DoD Component CIO or their delegate(s)? No Yes 3. Have the functions, ports, protocols, and other services required for the use of such services been identified? No Yes 4. Do external information system services comply with information security requirements? No Yes 5. Do contracts/agreements require that providers of external information system services employ security controls defined in CNSSI 1253? No Yes