drawings, and drawings, and Lead: A/E specifications. specifications. Documents/Models/Tools: At 90% design create At 90% design create Construction Design initial SSP and baseline initial SSP and baseline Documents / Building security risk secuirty risk Information Model assessment. assessment. (BIM) / CAD CSET GrassMarlin Draft Baseline System Security Plan (SSP) IT Contingency Plan and CONOPS (ITCP) Conduct CS build and Validate and verify the Construction patch activities without upgrade/modernization/ Test and Development impacting the patch is ready to (T&D) and Patch support the additional organization’s Management production systems (test systems without Environments (Virtual or and development impacting the Physical) environment typically organization’s 4 6 weeks – Lead: provided by vendor). production systems (test Construction/System and development Integrator environment typically Documents/Models/Tools: provided by vendor). VM Kali Linux SamuraiSTFU Build and/or configure Build and/or configure Construction 1 2 weeks – servers to properly servers to properly Build/Configure Servers operate the CS solution. operate the CS solution. Install supporting Install supporting Construction software on CS servers. software on CS servers. Install Supporting Software 1 2 weeks – Lead: Construction/System Integrator Configure CS software Configure CS software Construction to meet unique needs. to meet unique needs. Configure Supporting After the operating After the operating Software system is loaded, apply system is loaded, apply Lead: hardening criteria hardening criteria 1 2 weeks – Construction/System (STIGs), run Security (STIGS), run Security Integrator Content Automated Content Automated Documents/Models/Tools: Protocol Protocol validated tool, perform tool, perform STIGS factory acceptance FAT on major system SCAP testing (FAT) on major components and
Lead: A/E Documents/Models/Tools: Construction Design Documents / Building Information Model (BIM) / CAD CSET GrassMarlin Draft Baseline System Security Plan (SSP) IT Contingency Plan and CONOPS (ITCP) drawings, and specifications. At 90% design create initial SSP and baseline security risk assessment. drawings, and specifications. At 90% design create initial SSP and baseline secuirty risk assessment. Construction Test and Development (T&D) and Patch Management Environments (Virtual or Physical) Lead: Construction/System Integrator Documents/Models/Tools: VM Kali Linux SamuraiSTFU Conduct CS build and patch activities without impacting the organization’s production systems (test and development environment typically provided by vendor). Validate and verify the upgrade/modernization/ patch is ready to support the additional systems without impacting the organization’s production systems (test and development environment typically provided by vendor). 4 – 6 weeks Construction Build/Configure Servers Build and/or configure servers to properly operate the CS solution. Build and/or configure servers to properly operate the CS solution. 1 – 2 weeks Construction Install Supporting Software Lead: Construction/System Integrator Install supporting software on CS servers. Install supporting software on CS servers. 1 – 2 weeks Construction Configure Supporting Software Lead: Construction/System Integrator Documents/Models/Tools: STIGS SCAP Configure CS software to meet unique needs. After the operating system is loaded, apply hardening criteria (STIGs), run Security Content Automated Protocol tool, perform factory acceptance testing (FAT) on major Configure CS software to meet unique needs. After the operating system is loaded, apply hardening criteria (STIGS), run Security Content Automated Protocol tool, perform FAT on major system components and 1 – 2 weeks validated
ESTCP_IA_GUIDELINE_10-31-2016.docx