Establish and Percentage (%) Implementation (Number of 100% 1. Have all Collection ISO Change maintain approved and approved and changes been Frequency: ISSO Requests baseline implemented implemented documented? Quarterly Scans configurations configuration changes configuration Reporting throughout the identified changes Frequency: system lifecycle. identified/total Quarterly number of configuration changes identified through automated scans) *100 CP-001 Establish, Percentage (%) of Effectiveness/Efficiency (Number of 100% 1. has the Collection ISO CP Test maintain, and information systems information systems Contingency Frequency: Yearly ISSO Artifact effectively that have conducted that have conducted Plan been Reporting Lessons implement plans annual contingency annual contingency exercise? Frequency: Yearly Learned for emergency plan testing plans response, backup testing/number of operations, and information systems post-disaster in the system recovery for inventory) *100 organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations IA-001 All system Percentage (%) of Effectiveness/Efficiency (Number of users 100% 1. Are all Collection ISO Scans are identified users with CAC access with CAC-based authenticated Frequency: ISSO Interview and accounts/total with CAC? Quarterly authenticated number of users) Reporting using PKI *100 Frequency: Quarterly IR-001 Track, document, Percentage (%) of Effectiveness/Efficiency For each incident 100% 1. all Collection ISO Actions and report incidents reported category (number of incidents Frequency: As ISSO Report incidents to within required time incidents reported reported? Needed Lessons appropriate per applicable on time/total Reporting Learned organizational incident category number of reported Frequency: Yearly officials and/or incidents) *100 authorities
Establish and maintain baseline configurations throughout the system lifecycle. Percentage (%) approved and implemented configuration changes identified Implementation (Number of approved and implemented configuration changes identified/total number of configuration changes identified through automated scans) *100 100% 1. Have all changes been documented? Collection Frequency: Quarterly Reporting Frequency: Quarterly ISO ISSO Change Requests Scans CP-001 Establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations Percentage (%) of information systems that have conducted annual contingency plan testing Effectiveness/Efficiency (Number of information systems that have conducted annual contingency plans testing/number of information systems in the system inventory) *100 100% 1. has the Contingency Plan been exercise? Collection Frequency: Yearly Reporting Frequency: Yearly ISO ISSO CP Test Artifact Lessons Learned IA-001 All system are identified and authenticated using PKI Percentage (%) of users with CAC access Effectiveness/Efficiency (Number of users with CAC-based accounts/total number of users) *100 100% 1. Are all authenticated with CAC? Collection Frequency: Quarterly Reporting Frequency: Quarterly ISO ISSO Scans Interview IR-001 Track, document, and report incidents to appropriate organizational officials and/or authorities Percentage (%) of incidents reported within required time per applicable incident category Effectiveness/Efficiency For each incident category (number of incidents reported on time/total number of reported incidents) *100 100% 1. all incidents reported? Collection Frequency: As Needed Reporting Frequency: Yearly ISO ISSO Actions Report Lessons Learned
RMF_Program-Management-Plan.docx