The issue resolution provides an audit trail, accelerates the C&A, and documents management accountability. 4.3.3 Continuous NIST SP , NIST The continuous monitoring report, provides the results Task TBD by Monitoring Report SP of continuous monitoring of the security controls in the Reference Order Task information system to determine the extent to which the NIST site COR Order controls are implemented correctly, continue to operate for best as intended, and continue to produce the desired practices. outcome with respect to meeting the system security requirements. 4.3.3 Plan of Action & NIST SP The plan of action and milestones, which is prepared by Task TBD by Milestones OMB M-02-01 the information system owner, describes the measures Order Task that have been implemented or planned: (i) to correct COR any deficiencies noted during the assessment of the security controls; and (ii) to reduce or eliminate known vulnerabilities in the information system. 4.3.3 Updated System The updated system security plan is a formal document Task TBD by Security Plan that provides updates to the overview of the security Reference Order Task requirements for the information system and describes NIST site COR the updated security controls in place or planned for for best meeting those requirements. practices. 4.4.3 Privacy Threshold A Privacy Threshold Analysis (PTA) can be used to Task TBD by Analysis determine whether a PIA is needed. The PTA should Order Task include whether or not the system exists or is new, if COR Order the system collects, maintains, or shares information in the identifiable form, if that the information is about the public, and specific attributes about that information. Once complete, the Privacy Act Officer will review the PTA and determine if a PIA is required.
The issue resolution provides an audit trail, accelerates the C&A, and documents management accountability. 4.3.3 Continuous Monitoring Report NIST SP , NIST SP The continuous monitoring report, provides the results of continuous monitoring of the security controls in the information system to determine the extent to which the controls are implemented correctly, continue to operate as intended, and continue to produce the desired outcome with respect to meeting the system security requirements. Reference NIST site for best practices. Task Order COR TBD by Task Order 4.3.3 Plan of Action & Milestones NIST SP OMB M-02-01 The plan of action and milestones, which is prepared by the information system owner, describes the measures that have been implemented or planned: (i) to correct any deficiencies noted during the assessment of the security controls; and (ii) to reduce or eliminate known vulnerabilities in the information system. Task Order COR TBD by Task 4.3.3 Updated System Security Plan The updated system security plan is a formal document that provides updates to the overview of the security requirements for the information system and describes the updated security controls in place or planned for meeting those requirements. Reference NIST site for best practices. Task Order COR TBD by Task 4.4.3 Privacy Threshold Analysis A Privacy Threshold Analysis (PTA) can be used to determine whether a PIA is needed. The PTA should include whether or not the system exists or is new, if the system collects, maintains, or shares information in the identifiable form, if that the information is about the public, and specific attributes about that information. Once complete, the Privacy Act Officer will review the PTA and determine if a PIA is required. Task Order COR TBD by Task Order
Appendix_C_-_Table_of_Deliverables_and_References.docx