VERSION HISTORY/CHANGE RECORD Person Page Change Posting Change Reason for Change Number of Number Change Change Revision 1 Changes – March 22, 2006 1 Bo Berlas Included the OWASP Web Application To provide a usable checklist for 14 Penetration Checklist and the OWASP testing the OWASP Top Ten Testing Project documents as Vulnerabilities. embedded objects into Appendix C – GSA Risk Assessment Security Requirements. Revision 2 Changes – February 13, 2007 1 Bo Berlas Various updates to reflect changes in FINAL publishing of NIST 800-53 on 4-10 A&A process 12/2006 2 Bo Berlas Updated Appendix A: Risk Assessment RA and SA are now combined into a 11 Report Format single RA/SA report. 3 Bo Berlas Updated Appendix B: GSA Security Updated Assessment test 15 Assessment Test Procedures procedures based on FINAL publishing of NIST 800-53 on 12/2006 4 Bo Berlas Updated Appendix C: Plan of Action Attached new POA&M template for 16 and Milestone (POA&M) Template FY 2007. 5 Bo Berlas Updated Appendix D: Risk Assessment Updated assessment plan template 17 / Security Assessment Plan Template to reflect combining of RA and SA reports. Revision 3 Changes – March 20, 2007 1 Bo Berlas Changed reference to OWASP Top Ten OWASP Top Ten, 2007 RC1 has not 6 from 2007 Release Candidate 1 back to been finalized. GSA will adopt the the 2004 Update. OWASP Top Ten, 2007 Update upon final publication. 2 Bo Berlas New database scanning requirement. App Detective or similar tool should 7 be used to test database security configurations. Revision 4 Changes – October 16, 2007 1 Bo Berlas Updated policy reference. GSA IT Security Policy was updated 6 June 2007. 2 Bo Berlas Changed reference to OWASP Top Ten The 2007 Top Ten lists current web 7 from the 2004 Update to the current application vulnerabilities. 2007 Update. 3 Bo Berlas Replaced the FY 2007 POA&M New OMB Quarterly POA&M 17 Reporting Template with the FY 2008 Reporting Requirements template. Revision 5 Changes – July 15, 2010 1 Bo Berlas Update the A&A process to be Updates required to ensure agency Various consistent with NIST 300-37 and the compliance. Risk Management Framework 2 Bo Berlas Inserted Roles and Responsibilities Identify A&A Roles and 3 relating to A&A from the GSA IT Responsibilities Security Policy
VERSION HISTORY/CHANGE RECORD Change Number Person Posting Change Change Reason for Change Page Number of Change Revision 1 Changes – March 22, 2006 1 Bo Berlas Included the OWASP Web Application Penetration Checklist and the OWASP Testing Project documents as embedded objects into Appendix C – GSA Risk Assessment Security Requirements. To provide a usable checklist for testing the OWASP Top Ten Vulnerabilities. 14 Revision 2 Changes – February 13, 2007 1 Bo Berlas Various updates to reflect changes in A&A process FINAL publishing of NIST 800-53 on 12/2006 4-10 2 Bo Berlas Updated Appendix A: Risk Assessment Report Format RA and SA are now combined into a single RA/SA report. 11 3 Bo Berlas Updated Appendix B: GSA Security Assessment Test Procedures Updated Assessment test procedures based on FINAL publishing of NIST 800-53 on 12/2006 15 4 Bo Berlas Updated Appendix C: Plan of Action and Milestone (POA&M) Template Attached new POA&M template for FY 2007. 16 5 Bo Berlas Updated Appendix D: Risk Assessment / Security Assessment Plan Template Updated assessment plan template to reflect combining of RA and SA reports. 17 Revision 3 Changes – March 20, 2007 1 Bo Berlas Changed reference to OWASP Top Ten from 2007 Release Candidate 1 back to the 2004 Update. OWASP Top Ten, 2007 RC1 has not been finalized. GSA will adopt the OWASP Top Ten, 2007 Update upon final publication. 6 2 Bo Berlas New database scanning requirement. App Detective or similar tool should be used to test database security configurations. 7 Revision 4 Changes – October 16, 2007 1 Bo Berlas Updated policy reference. GSA IT Security Policy was updated June 2007. 6 2 Bo Berlas Changed reference to OWASP Top Ten from the 2004 Update to the current 2007 Update. The 2007 Top Ten lists current web application vulnerabilities. 7 3 Bo Berlas Replaced the FY 2007 POA&M Reporting Template with the FY 2008 template. New OMB Quarterly POA&M Reporting Requirements 17 Revision 5 Changes – July 15, 2010 1 Bo Berlas Update the A&A process to be consistent with NIST 300-37 and the Risk Management Framework Updates required to ensure agency compliance. Various 2 Bo Berlas Inserted Roles and Responsibilities relating to A&A from the GSA IT Security Policy Identify A&A Roles and Responsibilities 3