3 Bo Berlas New implementation guidance for NIST To facilitate implementation of 25 800-53 controls. required controls 4 Bo Berlas New NIST 800-53 assessment test Required to facilitate assessment of Appendix C cases NIST 800-53 controls 5 Bo Berlas New OCISO A&A Review SOP Documents the process for Appendix E submission of A&A packages to the OCISO and the detailed procedural steps performed by the OCISO to verify A&A compliance. 6 Bo Berlas New guidance for A&A of Minor To facilitate assessment of minor 22 Systems systems. Revision 6 Changes – December 16, 2010 1 Bo Berlas Updated references for Certification, To be consistent with the current Throughout Accreditation, and Certification and terminology in NIST 800-37. Accreditation (C&A) to Assessment, Authorization, and Assessment and Authorization (A&A), respectively. 2 Bo Berlas Inserted guidance for forming sections To address cloud specific security 12 1-10 of the SSP for cloud computing challenges. system SSPs. Revision 7 Changes – May 31, 2011 1 Bo Berlas Updated references to A&A to security To be consistent with the current Throughout authorization process and terminology in NIST 800-37. authorization package or A&A package to security authorization package. 2 Bo Berlas Inserted guidance for review of To document required review 25 minimal impact SaaS solutions. activities for such systems. 3 Bo Berlas Updated Appendix E to include a To reflect current version of the 48 revised OCISO Security Authorization SOP. Package Review SOP. Revision 8 Changes – November 25, 2015 1 Lewis/ Changes made throughout the Updated to reflect and implement Various Sitcharing document to reflect NIST and GSA the most current NIST 800-53-Rev4 requirements and GSA requirements Revision 9 Changes – May 19, 2016 1 Wilson/ Restructuring of the document, Updated to reflect current Various Klemens modifications to specific process acceptance of risk process and descriptions. rename Minor Application process to Subsystem process and revise its description. Restructuring and editing throughout. Revision 10 Changes – April 10, 2017 1 Desai/ Clarifying system definitions and Included definitions of Federal and Sections Klemens penetration testing requirements. Contractor systems. Clarified when 1.2, 4.1.7 systems are required to have penetration tests as part of their assessment.
3 Bo Berlas New implementation guidance for NIST 800-53 controls. To facilitate implementation of required controls 25 4 Bo Berlas New NIST 800-53 assessment test cases Required to facilitate assessment of NIST 800-53 controls Appendix C 5 Bo Berlas New OCISO A&A Review SOP Documents the process for submission of A&A packages to the OCISO and the detailed procedural steps performed by the OCISO to verify A&A compliance. Appendix E 6 Bo Berlas New guidance for A&A of Minor Systems To facilitate assessment of minor systems. 22 Revision 6 Changes – December 16, 2010 1 Bo Berlas Updated references for Certification, Accreditation, and Certification and Accreditation (C&A) to Assessment, Authorization, and Assessment and Authorization (A&A), respectively. To be consistent with the current terminology in NIST 800-37. Throughout 2 Bo Berlas Inserted guidance for forming sections 1-10 of the SSP for cloud computing system SSPs. To address cloud specific security challenges. 12 Revision 7 Changes – May 31, 2011 1 Bo Berlas Updated references to A&A to security authorization process and authorization package or A&A package to security authorization package. To be consistent with the current terminology in NIST 800-37. Throughout 2 Bo Berlas Inserted guidance for review of minimal impact SaaS solutions. To document required review activities for such systems. 25 3 Bo Berlas Updated Appendix E to include a revised OCISO Security Authorization Package Review SOP. To reflect current version of the SOP. 48 Revision 8 Changes – November 25, 2015 1 Lewis/ Sitcharing Changes made throughout the document to reflect NIST and GSA requirements Updated to reflect and implement the most current NIST 800-53-Rev4 and GSA requirements Various Revision 9 Changes – May 19, 2016 1 Wilson/ Klemens Restructuring of the document, modifications to specific process descriptions. Updated to reflect current acceptance of risk process and rename Minor Application process to Subsystem process and revise its description. Restructuring and editing throughout. Various Revision 10 Changes – April 10, 2017 1 Desai/ Klemens Clarifying system definitions and penetration testing requirements. Included definitions of Federal and Contractor systems. Clarified when systems are required to have penetration tests as part of their assessment. Sections 1.2, 4.1.7