Security Assessment and Authorization Policy
Security Assessment and Authorization Policy
PURPOSE
_______________________________________________________________
Information Technology (IT) and the various business units (information owners) will
ensure security controls in information systems, and the environments in which those
systems operate, as part of initial and ongoing security authorizations, annual
assessments, continuous monitoring and system development life cycle activities.
REFERENCE
_______________________________________________________________
National Institute of Standards and Technology (NIST) Special Publications (SP): NIST
SP 800-53a – Security Assessment and Authorization (CA), NIST SP 800-12, NIST SP
800-37, NIST SP 800-39, NIST SP 800-47, NIST SP 800-100, NIST SP 800-115, NIST
SP 800-137; NIST Federal Information Processing Standards (FIPS) 199
POLICY
_______________________________________________________________
This policy is applicable to all departments and users of IT resources and assets. Every
department that maintains or collects informational assets must be compliant with this
policy.
b. Review and update the current security assessment and authorization policy
and procedures [entity defined frequency].
2. SECURITY ASSESSMENTS
The [entity] shall:
b. Assess the security controls in the information system and its environment of
operation [entity defined frequency] to determine the extent to which the
controls are implemented correctly, operating as intended, and producing the
desired outcome with respect to meeting established security requirements.
3. SYSTEM INTERCONNECTIONS
IT Department shall:
b. Ensure that the authorizing official authorizes the information system for
processing before commencing operations.
6. CONTINUOUS MONITORING
IT Department shall:
vii. Reporting the security status of organization and the information system
to [entity defined personnel or roles] [entity defined frequency].
POLICY EXCEPTIONS
_______________________________________________________________
Requests for exceptions to this policy shall be reviewed by the Chief Information
Security Officer (CISO) and the Chief Information Officer (CIO). Departments requesting
exceptions shall provide such requests to the CIO. The request should specifically state
the scope of the exception along with justification for granting the exception, the
potential impact or risk attendant upon granting the exception, risk mitigation measures
to be undertaken by the IT Department, initiatives, actions and a time-frame for
achieving the minimum compliance level with the policies set forth herein. The CIO shall
review such requests. confer with the requesting department.
RESPONSIBLE DEPARTMENT
_______________________________________________________________
Chief Information Office