Archive for authorization

You are browsing the archives of authorization.

Continuous Monitoring

Continuous monitoring is about keeping an ongoing watch on how well your security controls are doing their job. NIST introduced this idea back in 2004 when they were also evangelizing about the Authorization process, then known as Certification and Accreditation (or C&A). By law (FISMA), NIST supplies federal organizations with security guidance, which can be […]

Federal Cyber-Security

NIST (National Institute of Standards and Technology) has provided Federal Agencies with all the tools they need to get cyber-security done right. But obviously, it’s not being done right yet at most agencies. Why not? Failure to understand the threat level – this was certainly once the top problem… maybe not so much anymore with […]

POAMs

Plan of Action and Milestones A POAM is a plan that describes specific measures to be taken to correct deficiences found during a security control assessment. The POAM should identify: The tasks needed to correct the deficiency The resources required to make the plan work Milestones in completing the tasks Scheduled completion dates for the […]

Implementation and Assessment Phase

Implementation and Assessment Phase

Integration of security controls, Certification & Accreditation and documentation updates.
(…more)

800-53 Control Families

800-53 controls are divided into 17 families.
(…more)