Submitted Cybersecurity Risk Acceptance Request Form Provide All Audit Scan (host based Scanning tool (i.e., Qualys) generated Risk scans & application based testing) Assessment Report plus Analyst notes Completed Security Controls Checklist Executed CCI and NIST checklists validated by scanning and manual Updated systems POAM 4 Risk Assessment review Validated Step Three Artifacts Develop and Execute Testing Plans Residual Risk Report (Artifacts not provided will be created by the Office of Cybersecurity) Step Three Deliverables Residual Risk Report Chief Information Security Officer signed 5 Authorize System Implement Step Four deliverables Risk Letter plus Risk Executive’s Endorsement/Approval to Operate Project Handoff to Operations Approved scanning tool Provide Monthly Risk Reports & POAM Mitigate and 6 Operate Control Validation Plan updates Monitor Step Five deliverables Security Control Validation Report
Submitted Cybersecurity Risk Acceptance Request Form 4 Risk Assessment Provide All Audit Scan (host based scans & application based testing) Completed Security Controls Checklist validated by scanning and manual review Develop and Execute Testing Plans (Artifacts not provided will be created by the Office of Cybersecurity) Step Three Deliverables Scanning tool (i.e., Qualys) generated Risk Assessment Report plus Analyst notes Executed CCI and NIST checklists Updated systems POAM Validated Step Three Artifacts Residual Risk Report 5 Authorize System Implement Residual Risk Report Step Four deliverables Chief Information Security Officer signed Risk Letter plus Risk Executive’s Endorsement/Approval to Operate Project Handoff to Operations 6 Mitigate and Monitor Operate Approved scanning tool Control Validation Plan Step Five deliverables Provide Monthly Risk Reports & POAM updates Security Control Validation Report
Cybersecurity-Risk-Management-Policy-2017-04-19_Final-for-ITC-and-ITSC-endorsement-to-UC.docx