Fluent Essays

Strategy for the Implementation The strategy for implementation is to follow the steps outlined in NIST SP800-37. These steps are tested and approved as a process to successfully implement RMF. Additionally, it was decided that the implementation would take place on a model information system. It would not have been feasible to implement an entire RMF on an actual organization due to the possible impact to business productivity. Using a mock network was decided to be the least disruptive as no schedule downtime would be required to implement controls, and no adverse effects would prevent the organization from functioning correctly. Finally, this was the best strategy as using an actual federal information system could have been restrictive with as far as how much information would be publically releasable. Since there are no detailed configuration items outside of industry best practice, it is possible to present this project to the public. Phases of the Rollout Phases of the rollout are defined in the NIST documentation as the 6 steps of a risk management framework. The first three stages are the categorization of the information system, selection of the security controls, and implementation of the said controls. These first three phases are the actual implementation and are considered to be the hands on aspect. Next, step four is the testing stage which is defined as the assessment of the security controls. This will allow the validation of the implementation and effectiveness of the controls applied. Afterward, the acceptance stage is step 5 which is the authorization of the information system. After the controls have been validated, the authorization authority with approve the operation of the system. Finally, the last stage of RMF is monitoring of the security controls. As the system Implementation of Risk Management Framework under Federally Compliant Standards 26 performs under normal operation, system changes will be imminent. New features will be added or modified and new threats may be uncovered. The monitoring stage will ensure the long term security of the system. Details of the Go-Live The project is considered to be fully implemented after the authorization to operate has been received. This is detailed in step 5 of the NIST SP800-37 document. All 4 prior steps detail the selection, implementation, and validation of the risk management controls. The 5th step is where he authorization official verifies the accuracy and completion of the controls implementation, and validates that the system is compliant. Using their authority, the system is then granted its accreditation which must be maintained by following the continuous monitoring of step 6. Dependencies The dependencies of the implementation of RMF are each of the prior steps. Before the first step can be completed, the system must be designed with the configuration details finalized in the to-be running state. Once the system is spec’d and designed, the system may be categorized and step two of selecting the controls may commence. Once complete, steps 3 and 4 may begin which are the implementation and assessment of the controls. Finally, steps 5 and 6 will begin which is the authorization approval and the continuous monitoring. The system will have to receive its approval before the continuous validation of controls begins, and then any changes will be processed through the 6 steps.