ID Goal Measure Measure Type Formula Target Evidence Frequency Responsibility Data Source Ensure all Percentage (%) of high Effectiveness/Efficiency (# of high 100% 1. Number of Collection ISSO ACAS Scans vulnerabilities vulnerabilities vulnerabilities high Frequency: Monthly VRAM are identified mitigated within identified and vulnerabilities Reporting and mitigated organizationally mitigated within identified. Frequency: Monthly defined time periods targeted time after discovery during the time 2. Number of period /number of high high vulnerabilities vulnerabilities identified within the mitigated. time period) *100 AT-001 Ensure that Percentage (%) of Implementation (Number of 100% 1. Number of Collection ISO Training and organization information system information system personnel Frequency: Yearly ISSO awareness personnel are security personnel security personnel completing Reporting tracking adequately that have received that have completed required Frequency: Yearly records trained to carry security training. security training training out their within the past assigned year/total number of information information system security-related security personnel) duties and *100 responsibilities Create, protect, Average frequency of Effectiveness/Efficiency Average frequency 100% 1. Is logging Collection ISSO Audit log and retain audit records review during reporting set per STIG? Frequency: Daily reports information and analysis for period Reporting system inappropriate activity 2. Are audit Frequency: Monthly records to the logs reviewed extent needed to daily? enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate activity CA-001 Ensure all Percentage (%) of Effectiveness/Efficiency (Number of systems 100% 1. Is the Collection ISSO ATO Letter information systems that have with complete C&A system Frequency: Monthly systems have completed packages with accredited? Reporting been certified certification and Authorizing Official Frequency: Monthly and accredited accreditation [AO] approval/(total as required. number of new systems) *100
ID Goal Measure Measure Type Formula Target Evidence Frequency Responsibility Data Source Ensure all vulnerabilities are identified and mitigated Percentage (%) of high vulnerabilities mitigated within organizationally defined time periods after discovery Effectiveness/Efficiency (# of high vulnerabilities identified and mitigated within targeted time during the time period /number of high vulnerabilities identified within the time period) *100 100% 1. Number of high vulnerabilities identified. 2. Number of high vulnerabilities mitigated. Collection Frequency: Monthly Reporting Frequency: Monthly ISSO ACAS Scans VRAM AT-001 Ensure that organization personnel are adequately trained to carry out their assigned information security-related duties and responsibilities Percentage (%) of information system security personnel that have received security training. Implementation (Number of information system security personnel that have completed security training within the past year/total number of information system security personnel) *100 100% 1. Number of personnel completing required training Collection Frequency: Yearly Reporting Frequency: Yearly ISO ISSO Training and awareness tracking records Create, protect, and retain information system records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate activity Average frequency of audit records review and analysis for inappropriate activity Effectiveness/Efficiency Average frequency during reporting period 100% 1. Is logging set per STIG? 2. Are audit logs reviewed daily? Collection Frequency: Daily Reporting Frequency: Monthly ISSO Audit log reports CA-001 Ensure all information systems have been certified and accredited as required. Percentage (%) of systems that have completed certification and accreditation Effectiveness/Efficiency (Number of systems with complete C&A packages with Authorizing Official [AO] approval/(total number of new systems) *100 100% 1. Is the system accredited? Collection Frequency: Monthly Reporting Frequency: Monthly ISSO ATO Letter
RMF_Program-Management-Plan.docx