Section A: Understanding Security Authorization
- FISMA, NIST/NSA, NIST Publications, and OMB A-130
- Certification & Accreditation (C&A) or Authorization
- Authorization Evolution
- Authorization 2010 and Beyond
- Risk Management Framework (RMF)
- DoD RMF and CNSSI-I253
- System Development Life Cycle (SDLC) and DoD System Acquisition Process
- System to Enterprise Evolution 2002-2010
- Hierarchical Risk Management
- DoD RMF Governance
- Roles and Responsibilities
- Information Systems, Defense Concepts, and Perfect Security
- Risk and Risk Assessments
- Security Objectives and Impact Levels
- Trust Relationships and Reciprocity
- DoD RMF Publication Flow
Section B: Categorization of Information and Information Systems
- Security Plan (SP) SP800-18 and SP 800-37
- DoD IT Products, Services and PIT DoDI 8510.01
- Knowledge Service (KS) rmfks.osd.mil
- Categorization CNSSI-1253, FIPS 199, and SP800-60 ICD-503
- Initiate SP and Authorization Boundaries SP800-18 and SP 800-37
- Registration SP800-53
- Assign Qualified Personnel DoDD 8570.01 and DoDDI 8140.01
Section C: Selection of Security Controls
- Specific, Common, and Hybrid Controls SP800-53
- Selecting Security Controls CNSSI-1253, FIPS-200, and SP800-53
- DoD RMF Control Baseline Tool
- Overlays CNSSI-1253 and SP800-53
- Tailoring Controls CNSSI-1253 and SP800-53
- Compensating Controls SP800-53
- Trustworthiness and Assurance SP800-53
- Monitoring Strategy SP800-137
- Approval and Registration DoDI 8510.01
- Knowledge Service and eMASS
Section D: Implementation of Security Controls
- Security Control Implementation SP800-53
- Control Documentation SP800-18 and SP800-37
- Approved Configurations, Tests and Checklists SP800-70
- Security Content Automation Protocol(SCAP) SP800-115 SP800-117
- Contingency Operations and Risk Author's Experience
Section E: Assessment of Security Controls
- Assessment and Testing Methods SP800-53A and SP800-115
- Vulnerability Tools and Techniques SP800-53A and SP800-115
- Develop Security Assessment Plan (SAP) and Report (SAR) SP800-37
- Expertise and Independence SP800-37
- Assess Security Control SP800-53A and SP800-115
- Security Assessment Report (SAR) SP800-37, SP800-53A, and SP800-115
- Conduct Remediation Actions SP800-37 and SP800-53
Section F: Authorization of Information Systems
- Special DoD Systems DoDI 8510.01
- Plan Of Actions and Milestones (POA&M) OMB M-02-01
- Security Authorization Package SP800-37 and DoDI 8510.01
- Determine Risk DoDI 8510.01
- Authorization SP800-37 and DoDI 8510.01
- Section G: Continuous Monitoring of Security Controls
- Continuous Monitoring SP800-53 and DoDI 8510.01
- Information Security Continuous Monitoring (ISCM) SP800-137 and HBSS
- Determine Impact of Change SP800-128 and SecCM
- Patch and Vulnerability Management SP800-40
- Security Content Automation Protocol (SCAP) SP800-115 and SP800-117
- Assessments SP800-53A and SP800-115
- Cloud Computing FedRAMP and SRG
- More Overlays FedRAMP, SP800-53, and NSI-1253
- DIACAP to DoD RMF Transition Schedule DoDI 8510.01