“Well organized, good reviews, excellent examples.”
-Frank Russo, Information Assurance Manager, Blue Cross and Blue Shield of South Carolina

Totally updated to reflect the historic nature of the partnership among the civil, defense, and intelligence communities and the rapid convergence of information security standards and guidelines for the federal government, this seminar has been designed around the final revision to NIST SP 800-37; Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Lifecycle Approach. It explores the risk executive function that provides organizations with a comprehensive and holistic approach for addressing risk,  offers expanded coverage on selecting and assessing security controls, and provides guidance on how to apply continuous auditing to your organization's information system environment. 

In this practical three-day seminar you will be guided through the common security authorization process developed by the Joint Task Force Transformation Initiative Interagency Working Group. From defining the authorization boundary, selecting the control baseline, evaluating the adequacy of controls selected, to compiling the final authorization package and authorization recommendation for presentation to the Authorizing Official, you will gain a solid understanding of what many incorrectly perceive to be a very complex security authorization process.

Using a fictitious federal agency, Bureau of Water-Tower Security, and practical case studies, you will go through the logical step-by-step NIST/CNSS Security Authorization process. Using one of BOWS’ most critical information systems, the Bureau Authorization Reporting & Tracking System, you will learn how to define the authorization boundary of an information system and walk through the logical processes of performing a risk assessment, completing a system security plan, preparing for the assessment of the security controls, documenting the results of your assessment, and preparing the final authorization package.

All of the concepts and methodologies in this seminar are applicable to all federal agencies as well as to state agencies and commercial organizations requiring a formalized approach to the assessment of security policy implementation in information systems. What you learn here can be easily tailored to meet the security authorization needs of any organization.

Prerequisites: A basic understanding of the fundamentals of information security.

Advance Preparation: None         Learning Level: Intermediate

Delivery Method: Group-Live         Field: Specialized Knowledge and Application