system components and devices, perform initial Continuous devices, perform initial penetration testing. Monitoring penetration testing. Kali Linux SamuraiSTFU Penetration Testing Scope and ROE (if required) Jump-Kit Rescue CD Conduct RMF Steps 3 Conduct RMF Steps 3 Construction and 4 by applying and 4 by applying Implement and assess controls identified during controls identified during security controls the requirements and the requirements and Lead: construction/system design phase, by design phase, by integrator assessing the adequacy assessing the adequacy Documents/Models/Tools: and effectiveness of and effectiveness of security controls, and by CSET security controls, and by documenting findings in documenting findings in SSP 12 20 the security assessment – the security assessment Security Assessment weeks report. Create draft report. Create draft Report (SAR) approval package. approval package. Plan of Action & Milestones (POAM) ITCP Incident Response Procedures (IRP) Penetration Testing Scope and ROE (if required) Jump-Kit Rescue CD Test CS solution in a Conduct testing on initial Test CS solution in a test and development build test and development environment to ensure environment to ensure Lead: construction/system system errors are found, system errors are found, integrator 2 4 weeks – corrected before corrected before Documents/Models/Tools: solution is deployed on solution is deployed on Kali Linux network. network. SamuraiSTFU Conduct site Construction - conduct Pilot implementation of acceptance testing, and pilot implementation CS solution on a small if required final deployment subset of user base to Varies with penetration testing, and evaluate solution size of Lead: construction/system create final approval against real-world deployment integrator package. requirements. Conduct (number of Documents/Models/Tools: site acceptance testing, facilities and Kali Linux and if required final penetration testing, and SamuraiSTFU create final approval OIT IT Repository package.
Continuous Monitoring Kali Linux SamuraiSTFU Penetration Testing Scope and ROE (if required) Jump-Kit Rescue CD system components and devices, perform initial penetration testing. devices, perform initial penetration testing. Construction Implement and assess security controls Lead: construction/system integrator Documents/Models/Tools: CSET SSP Security Assessment Report (SAR) Plan of Action & Milestones (POAM) ITCP Incident Response Procedures (IRP) Penetration Testing Scope and ROE (if required) Jump-Kit Rescue CD Conduct RMF Steps 3 and 4 by applying controls identified during the requirements and design phase, by assessing the adequacy and effectiveness of security controls, and by documenting findings in the security assessment report. Create draft approval package. Conduct RMF Steps 3 and 4 by applying controls identified during the requirements and design phase, by assessing the adequacy and effectiveness of security controls, and by documenting findings in the security assessment report. Create draft approval package. 12 – 20 weeks Conduct testing on initial build Lead: construction/system integrator Documents/Models/Tools: Kali Linux SamuraiSTFU Test CS solution in a test and development environment to ensure system errors are found, corrected before solution is deployed on network. Test CS solution in a test and development environment to ensure system errors are found, corrected before solution is deployed on network. 2 – 4 weeks Construction - conduct pilot implementation deployment Lead: construction/system integrator Documents/Models/Tools: Kali Linux SamuraiSTFU OIT IT Repository Pilot implementation of CS solution on a small subset of user base to evaluate solution against real-world requirements. Conduct site acceptance testing, and if required final penetration testing, and create final approval package. Conduct site acceptance testing, and if required final penetration testing, and create final approval package. Varies with size of deployment (number of facilities and
ESTCP_IA_GUIDELINE_10-31-2016.docx