This repository has been archived by the owner on Jul 26, 2021. It is now read-only.
Revamed ATO main page and background page #227
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Thanks so much @jezhumble. I'm afraid of how this week is going, this will get punted by 🔥s if we do it async. Please put 20 mins on my calendar and we'll knock out this PR and any other BYS PRs. |
JJediny
reviewed
Nov 2, 2016
|
|
||
| The information system's owner, working with the AO, decides which controls should be implemented. NIST's encyclopedic [Special Publication 800-53](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) (currently on revision 4) is the definitive guide to security and privacy controls for federal information systems. Which controls are selected is based on the following: | ||
|
|
||
| * *The impact level of the system* (low, moderate or high). SP 800-53 provides a "baseline" set of controls for each level. The higher the level, the more controls are in scope. For systems running on cloud infrastructure, you should consult [FedRAMP's security control documentation](https://www.fedramp.gov/resources/documents-2016/). |
There was a problem hiding this comment.
"The higher the level, the more controls are in scope"
to
"The higher the level, the more controls and/or control enhancements are within scope"
JJediny
reviewed
Nov 2, 2016
| The information system's owner, working with the AO, decides which controls should be implemented. NIST's encyclopedic [Special Publication 800-53](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) (currently on revision 4) is the definitive guide to security and privacy controls for federal information systems. Which controls are selected is based on the following: | ||
|
|
||
| * *The impact level of the system* (low, moderate or high). SP 800-53 provides a "baseline" set of controls for each level. The higher the level, the more controls are in scope. For systems running on cloud infrastructure, you should consult [FedRAMP's security control documentation](https://www.fedramp.gov/resources/documents-2016/). | ||
| * *Which controls are already taken care of by your infrastructure*. If you're running in the cloud, many controls are taken care of at the infrastructure or platform layer. If your provider has received a FedRAMP ATO, it will provide a document called a _customer responsibility matrix_ (CRM) listing the residual controls that are the responsibility of the applications running on the infrastructure or platform. |
There was a problem hiding this comment.
residual or hybrid controls.... that are the responsibility (or for hybrid controls partial responsibility)...
mogul
reviewed
Nov 2, 2016
| Before a system is made publicly accessible on the Internet, it must go through either the full ATO process or a 90-Day [Lightweight Authority to Operate (LATO)](types/). Systems can be made available for use in an extremely limited capacity if they meet the [pre-authorization criteria](types/#pre-authorization). | ||
|
|
||
| While the ATO is the final compliance step that's required before launching an application, you will want to **start the process as soon as possible** after your project gets off the ground. | ||
| Every federal information system must go through NIST's [Risk Management Process](background/) before it can be used to process federal information. This process culminates in a signed Authority to Operate (ATO) being issued. Because the Risk Management Process is a complex, multi-step process which will constrain the design and implementation of your system, you should start thinking about how it applies to your system _before_ you begin designing and implementing it. The steps of the Risk Management Process should be executed in parallel with other project activities. Please get in touch with the TTS Infrastructure Team as soon as your project gets funding so you can discuss which category of ATO will be required for your system, and understand what will be required to gain an ATO for it. |
There was a problem hiding this comment.
This should use "Risk Management Framework" terminology consistently, as NIST RMF is widely referenced, so that people don't think "Risk Management Process" is something else.
NoahKunin
reviewed
Nov 2, 2016
| navtitle: Background | ||
| --- | ||
|
|
||
| ***[This page is in need of a rewrite.](https://github.com/18F/before-you-ship/issues/89)*** | ||
| One of the goals of the Federal Information Security Management Act of 2002 (FISMA) is to "provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets." NIST was tasked with designing and implementing this framework: the result is NIST's Risk Management Framework (RMF). All federal information and information systems (except classified information and national security systems) are subject to NIST's RMF by law. |
There was a problem hiding this comment.
My general mode is regardless of context, each standalone document always spells out acronyms the first time within that document. Plz spell out NIST - thx!
There was a problem hiding this comment.
Remove "by law". The SPs are guidance - not even psuedo-regulatory.
NoahKunin
reviewed
Nov 2, 2016
|
|
||
| ### Step 6: Monitor Security Controls | ||
|
|
||
| Once a system receives an ATO, it must be assessed at regular intervals to ensure the effectiveness of the control implementation. Any changes to the system or its environment should also be assessed to determine their impact. |
There was a problem hiding this comment.
Swap "any changes" to "Changes to the system's security boundary".
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I am working on a rewrite of the ATO section of before you ship with two goals:
This PR updates the first page of the ATO and the background section.