RMF Step 4 - Security Control Assessment
Assurance Case
A structured set of arguments and a body of evidence showing that an information system satisfies specific claims with respect to a given quality attribute.
Penetration Testing
A test methodology in which assessors, using all available documentation (e.g., system design, source code, manuals) and working under specific constraints, attempt to circumvent the security features of an information system.
Coverage
An attribute associated with an assessment method that addresses the scope of the assessment objects included in the assessment (e.g., types of objects to be assessed and the number of objects to be assessed by type). The values hierarchically from less to more are: basic, focused, and comprehensive.
Continuous Monitoring
Maintaining ongoing awareness to support organizational risk decisions.
Assessment Object
The item (i.e., specifications, mechanisms, activities, individuals) upon which an assessment method is applied during an assessment.
Environment of Operation
The physical surroundings in which an information system processes, stores, and transmits information.
Tailoring (Assessment Procedures)
The process by which assessment procedures defined in Special Publication 800-53A are adjusted, or scoped, to match the characteristics of the information system under assessment, providing organizations with the flexibility needed to meet specific organizational requirements and to avoid overly-constrained assessment approaches.
Security Control Assessment
The testing and/or evaluation of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing desired outcome with respect to meeting the security requirements for the system.
Network Sniffing
A passive technique that monitors network communication, decodes protocols, and examines headers and payloads for information of interest. It is both a review technique and a target identification and analysis technique.
Assessment Procedure
A set of assessment objectives and an associated set of assessment methods and assessment objects.
Internal Security Testing
Security testing conducted from inside the organization's security perimeter.
External Security Testing
Security testing conducted from outside the organization's security perimeter.
Passive Security Testing
Security testing that does not involve any direct interaction with the targets, such as sending packets to a target.
Active Security Testing
Security testing that involves direct interaction with a target, such as sending packets to a target.
Security Control Effectiveness
The measure of correctness of implementation (i.e., how consistently the control implementation complies with the security plan) and how well the security plan meets organizational needs in accordance with current risk tolerance.
Security Assessment Plan
The objectives for the security control assessment and a detailed roadmap of how to conduct such an assessment.
Root Cause Analysis
A principle-based, systems approach for the identification of underlying causes associated with a particular set of risks.
Assessment Objective
A set of determination statements that expressed the desired outcome for the assessment of a security control or control enhancement.
Comprehensive Testing
A test methodology that assumes explicit and substantial knowledge of the internal structure and implementation detail of the assessment object. Also known as white box testing.
Basic Testing
A test methodology that assumes no knowledge of the internal structure and implementation detail of the assessment object. Also known as black box testing.
Focused Testing
A test methodology that assumes some knowledge of the internal structure and implementation detail of the assessment object. Also known as gray box testing.
Examine
A type of assessment method characterized by checking, inspecting, reviewing, observing, studying, or analyzing assessment objects to facilitate understanding and achieve clarification (or obtain evidence) to support the determination of security control effectiveness over time.
Interview
A type of assessment method that is characterized by the process of conducting discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or lead to the location of evidence, the results are used to support the determine of security control effectiveness over time.
Specification
An assessment object that includes document-based artifacts (e.g., policies, procedures, plans, system security requirements, functional specifications, and architectural designs) associated with an information system.
Activities
An assessment object that includes specific protection related actions supporting an information system that involves people (e.g., conducting system back up operations, monitoring network traffic).
Depth
An attribute associated with an assessment method that addresses the rigor and level of detail associated with the application of the method. The values hierarchically from less to more are: basic, focused, and comprehensive.
Executive Agency
An executive department specified in 5 U.S.C., Section 101; a military department specified in 5 U.S.C., Section 102; an independent establishment as defined in 5 U.S.C., Section 104(1); and a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., Chapter 91
Assessment Findings
Assessment results produced by the application of an assessment procedure to a security control or control enhancement to achieve an assessment objective; the execution of a determination statement within an assessment procedure by an assessor that results in either a satisfied or other than satisfied condition.
Rules of Engagement (ROE)
Detailed guidelines and constraints regarding the execution of information security testing. The BLANK is established before the start of security test, and gives the test team authority to conduct defined activities without the need for additional permissions.
Assessment Method
One of the three types of actions (i.e., examine, interview, test) taken by assessors in obtaining evidence during an assessment.
Vulnerability Assessment
Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation.
Supplementation (Assessment Procedures)
The process of adding procedures or details to assessment procedures in order to adequately meet the organization's risk management needs.