CAP (The American College Credentials) cheat sheet

NIST SP 800-37 Rev. 2 (December 2018) defines the RMF; its seven steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor.

Revision 2 added the Prepare step, emphasized organization-level risk management, introduced near real-time (ongoing) authorization, and strengthened supply chain risk considerations.

SP 800-39 defines three risk management tiers: Tier 1 organization, Tier 2 mission/business processes, Tier 3 information systems; the RMF operates primarily at Tier 3 using Tier 1 and Tier 2 inputs.

Each RMF step has defined tasks with specified inputs, outputs, and responsible roles; for example, the Categorize step produces a security categorization that the authorizing official reviews and approves.

Core roles: Authorizing Official (accepts risk), System Owner, Information System Security Officer, Security Control Assessor, Common Control Provider, CISO, and mission/business owner.

The RMF applies to federal information systems other than national security systems; national security systems follow CNSSI 1253 under the CNSS risk management process.

FISMA (44 U.S.C. § 3551 et seq.) and OMB Circular A-130 require federal agencies to use the RMF; for non-federal organizations it is voluntary guidance.

RMF outputs are captured in the authorization package: the system security plan, the security assessment report, and the plan of action and milestones.

The RMF is continuous and iterative, integrated with the SDLC and enterprise architecture rather than a one-time certification event.

FIPS 199 establishes security categories for federal information and information systems using three potential impact levels-low, moderate, high-applied separately to confidentiality, integrity, and availability.

Notation: SC information system = {(confidentiality, impact), (integrity, impact), (availability, impact)}; the overall system category is the high-water mark of the three.

FIPS 199 definitions: confidentiality = preserving authorized restrictions on access and disclosure; integrity = guarding against improper modification or destruction, including non-repudiation and authenticity; availability = ensuring timely and reliable access to and use of information.

Impact definitions: low = limited adverse effect; moderate = serious adverse effect; high = severe or catastrophic adverse effect on organizational operations, assets, or individuals.

NIST SP 800-60 Vol. 1 (guide) and Vol. 2 (appendices) map information types to provisional confidentiality, integrity, and availability impact values used as the categorization starting point.

Categorization weighs impacts on organizational operations and assets, individuals, other organizations, and the Nation, including privacy, civil liberties, and loss of public confidence.

Aggregation and other special factors can justify raising a provisional impact above the SP 800-60 value, provided the rationale is documented and approved.

The resulting security category sets the minimum SP 800-53B baseline (low, moderate, or high) and drives assessment rigor and monitoring frequency.

FIPS 200 specifies minimum security requirements across 17 security-related areas; agencies satisfy them by selecting controls from the NIST SP 800-53 catalog.

NIST SP 800-53 Rev. 5 organizes controls into 20 families, including the SR (supply chain risk management) and PT (PII processing and transparency) families added in Rev. 5.

NIST SP 800-53B contains the low, moderate, and high control baselines plus privacy baselines; selection starts with the baseline matching the FIPS 199 category.

Tailoring consists of scoping (removing inapplicable controls), parameterization (setting organization-defined values), applying compensating controls, and supplementation (adding controls).

Scoping considerations include technology, physical infrastructure, policy/regulatory constraints, operational requirements, security objectives, and ownership/allocation of controls.

Controls are allocated as common (inherited from a provider), system-specific, or hybrid; the allocation is documented so inheriting systems know what to rely on and what to assess.

An overlay is a tailored set of controls and supplemental guidance for a community of interest, such as cloud, industrial control systems, or space systems.

Identifiers use family abbreviations with numbers (AC-2) and enhancements in parentheses (AC-2(1)); baseline tables list which controls and enhancements apply at each impact level.

The selected controls, rationale for tailoring, and parameter values are documented in the system security plan.

The system security plan, developed per NIST SP 800-18, documents the authorization boundary, system environment, selected controls, implementation status, and control descriptions.

Common control providers implement controls for multiple systems and supply implementation statements and evidence to the owners of inheriting systems.

Implementation status is recorded as implemented, partially implemented, planned, or not applicable, always with a description of how the control is satisfied.

Implementation spans technical, operational, and management controls and is aligned with the SDLC, acquisition, and enterprise architecture processes.

Configuration management (CM family) establishes and maintains baseline configurations; changes pass through change control and security impact analysis before implementation.

NIST SP 800-70 security configuration checklists and SCAP automate verification of configuration settings that implement controls.

Organization-defined parameters (e.g., audit record retention period, session lock delay) are assigned during implementation and recorded in the security plan.

Inheritance must be explicit: the inheriting system records the provider, the control inherited, and how the implementation is verified.

NIST SP 800-53A provides assessment procedures, with assessment objectives and methods, for each control and enhancement in SP 800-53.

Three assessment methods: examine (review documents, logs, configurations), interview (discuss with personnel), and test (exercise or scan the mechanism under specified conditions).

Determinations are 'satisfied' or 'other than satisfied'; deficiencies are documented in the security assessment report and carried into the POA&M.

The security assessment plan defines scope, controls, methods, schedule, and team; the security assessment report documents scope, methods, and control-by-control results.

Assessors must be independent of the system's development, operation, and management so the authorizing official receives objective results.

Depth and coverage scale with the system's categorization and risk; sampling is acceptable only when documented and justified.

NIST SP 800-115 covers technical testing, including vulnerability scanning, penetration testing, and post-testing analysis.

Common controls are assessed once by the provider; inheriting systems rely on the provider's assessment evidence instead of retesting the control.

Assessment findings feed risk assessment (SP 800-30) by identifying the likelihood and impact of exploited weaknesses.

The authorization package consists of the system security plan, the security assessment report, and the plan of action and milestones.

The Authorizing Official is a senior official who reviews the package, determines residual risk, and signs the authorization decision; the AO is accountable for that decision.

Possible decisions are Authorization to Operate (ATO), ATO with specific conditions, and Denial of Authorization to Operate (DATO).

SP 800-37 Rev. 2 also recognizes common control authorization and authorization to use for systems that rely on inherited controls.

The AO may delegate decision authority in writing to a Delegated Authorizing Official but retains accountability for the accepted risk.

Risk responses available to the AO follow SP 800-39: accept, avoid, mitigate, and transfer/share; denying authorization is effectively risk avoidance.

The authorization decision document records the system, controls assessed, accepted residual risk, terms and conditions, signature, and any expiration date.

An ATO remains valid only while continuous monitoring shows controls stay effective and risk stays within tolerance; significant changes may require reauthorization.

Separation of duties applies: the AO should not also be the system owner or the assessor, so the decision stays independent of system operation.

NIST SP 800-137 defines information security continuous monitoring (ISCM) as maintaining ongoing awareness of information security, vulnerabilities, and threats to support risk decisions.

ISCM process: define the strategy, establish the program, implement the program, analyze and report findings, respond to findings, and review/update the strategy and program.

Monitoring frequency and rigor are set by the system's FIPS 199 category and organizational risk tolerance; high-impact systems are monitored more frequently.

The Monitor step in SP 800-37 Rev. 2 includes control effectiveness monitoring, change management, security impact analysis, and ongoing authorization.

A significant change (e.g., new interface, altered architecture, changed categorization) triggers a security impact analysis and may require reassessment and reauthorization.

POA&Ms track remediation of identified weaknesses with milestones, resources, and responsible parties, and are updated as weaknesses are resolved.

Automation such as SCAP, continuous diagnostics and mitigation (CDM), and SIEM supports near real-time status reporting, dashboards, and metrics.

Monitoring data supports annual FISMA reporting and ongoing authorization decisions, replacing point-in-time certification and accreditation cycles.

Metrics should be tied to control effectiveness objectives and reviewed across Tier 1, Tier 2, and Tier 3 of the risk management hierarchy.