The DOC requires the OUs to employ automated mechanisms to support management of distributed security testing. Software and Information Integrity Software, Firmware, and Information Integrity The DOC requires the OUs to ensure the information SI-7 X X system detects and protects against unauthorized changes to software, firmware, and information. Integrity Checks The DOC requires the OUs to reassess the integrity of software, firmware, and information by SI-7.1 X X performing integrity of the system at least Centrally-Managed Integrity Tools The DOC requires the OUs to employ centrally SI-7.3 X managed integrity verification tools. Program Management (PM) Security Baselines Control Control Name/Requirement Number Low High Information Security Resources Information Security Resources The DOC requires OUs to follow OMB Budget PM-3 X X X Data Request requirements provided by DOC for reporting IT Security expenditures. Plan of Action and Milestones Process Plan of Action and Milestones Process IT Security Plans of Action and PM-4 Refer to CITR-018: X X X Milestones (POA&M) for control details. Information System Inventory Information System Inventory OUs must enter all FISMA-reportable systems into PM-5 X X X CSAM, review their inventory at least once a fiscal year, and make updates as necessary. Information Security Measures of Performance Information Security Measures of Performance OUs must provide FISMA and CyberCAP metrics PM-6 X X X per DOC OCS guidance, as well as their own performance measures, as appropriate. Critical Infrastructure Plan
The DOC requires the OUs to employ automated mechanisms to support management of distributed security testing. Software and Information Integrity SI-7 Software, Firmware, and Information Integrity The DOC requires the OUs to ensure the information system detects and protects against unauthorized changes to software, firmware, and information. X X SI-7.1 Integrity Checks The DOC requires the OUs to reassess the integrity of software, firmware, and information by performing integrity of the system at least X X SI-7.3 Centrally-Managed Integrity Tools The DOC requires the OUs to employ centrally managed integrity verification tools. X Program Management (PM) Control Number Control Name/Requirement Security Baselines Low High Information Security Resources PM-3 Information Security Resources The DOC requires OUs to follow OMB Budget Data Request requirements provided by DOC for reporting IT Security expenditures. X X X Plan of Action and Milestones Process PM-4 Plan of Action and Milestones Process Refer to CITR-018: IT Security Plans of Action and Milestones (POA&M) for control details. X X X Information System Inventory PM-5 Information System Inventory OUs must enter all FISMA-reportable systems into CSAM, review their inventory at least once a fiscal year, and make updates as necessary. X X X Information Security Measures of Performance PM-6 Information Security Measures of Performance OUs must provide FISMA and CyberCAP metrics per DOC OCS guidance, as well as their own performance measures, as appropriate. X X X Critical Infrastructure Plan
2014-doc-itspp.docx