NIST logo

Publication Citation: Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans

NIST Authors in Bold

Author(s): Ronald S. Ross; L A. Johnson;
Title: Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans
Published: June 29, 2010
Abstract: [Superseded by SP 800-53A Rev. 4 (December 2014): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=917644] Special Publication 800-53A, Revision 1 provides guidelines for developing security assessment plans and associated security control assessment procedures that are consistent with Special Publication 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations, August 2009 (including updates as of 05-01-2010). NIST has been working in partnership with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DOD), and the Committee on National Security Systems (CNSS) to develop a common information security framework for the federal government and its contractors. The updated security assessment guideline incorporates best practices in information security from the United States Department of Defense, Intelligence Community, and Civil agencies and includes security control assessment procedures for both national security and non national security systems. The guideline for developing security assessment plans is intended to support a wide variety of assessment activities in all phases of the system development life cycle including development, implementation, and operation. The important changes described in Special Publication 800-53A, Revision 1, are part of a larger strategic initiative to focus on enterprise-wide, near real-time risk management. The increased flexibility in the selection of assessment methods, assessment objects, and depth and coverage attribute values empowers organizations to place the appropriate emphasis on the assessment process at every stage in the system development life cycle. [Supersedes NIST SP 800-53A (July 2008): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=51209]
Citation: NIST SP - 800-53A Rev 1
Pages: 399 pp.
Keywords: assurance requirements; attributes; categorization; FISMA; NIST SP 800-53; risk management; security assessment plans; security controls
Research Areas: Computer Security, Cybersecurity, Information Processing Systems, Information Technology