-: In this lesson, 2 2
we'll continue onto the next steps 3 3
of getting ready for the Risk Management Framework. 4 4
This section of the framework 5 5
is all about preparing at the system level. 6 6
There are 11 tasks in this second part of step number 1. 7 7
Let's look at each task in turn. 8 8
When you finish Task P-8, 9 9
you'll be able to identify your organization's missions, 10 10
business functions, 11 11
and the processes that your technology is meant to support. 12 12
To do this, 13 13
gather together your organization's mission statements, 14 14
technology policies, cybersecurity policies, 15 15
and any other similar documents that you might need, 16 16
then review them and assemble the big picture 17 17
of your organization's top goals 18 18
and how your technology has been helping you 19 19
to achieve them. 20 20
Task P-9 turns your attention to your stakeholders. 21 21
During Task P-9, 22 22
you'll identify who your top stakeholders are 23 23
and which ones would be most interested 24 24
in this system that you're trying to obtain 25 25
approval to operate, also known as ATO. 26 26
These stakeholders could be members of your organization, 27 27
or they could be on the outside. 28 28
But no matter where they are, 29 29
you need to make sure you're communicating with them 30 30
throughout the RMF process. 31 31
The next task in step 1, prepare your system, is P-10, 32 32
which will allow you to know 33 33
and then prioritize your system's assets 34 34
so you can protect them. 35 35
Some examples of assets are software, hardware, 36 36
computer networks, business processes, 37 37
business services, buildings, and of course data. 38 38
Next, when you complete Task P-11, 39 39
you'll know the security boundaries of your system, 40 40
and knowing the security boundaries 41 41
will let you answer important questions 42 42
like who should have access to what parts of the system 43 43
and what parts should be accessible by the internet. 44 44
To do Task P-11, 45 45
gather all the documentation about your systems, 46 46
like network diagrams, organizational charts, 47 47
and system design documents. 48 48
Then I want you to write down your thoughts 49 49
and note where the boundaries are now 50 50
or where you'll need to put them. 51 51
Task P-12 focuses on the data portion of your system. 52 52
When you complete Task P-12, 53 53
you'll know what kinds of information 54 54
your system processes, stores, and transmits, 55 55
knowing this will help you to figure out how to protect it. 56 56
And when this task is completed, 57 57
you should end up with a list 58 58
of the information types in your system. 59 59
Some important information types 60 60
include financial information, 61 61
personal information like health records, 62 62
product specifications, 63 63
and government and trade secrets. 64 64
Let's move on to Task P-13. 65 65
When you complete it, 66 66
you'll have a better understanding 67 67
of your organization's information life cycle, 68 68
and information life cycle describes the stages 69 69
that information goes through in an organization. 70 70
Usually, it goes something like this. 71 71
There's an initial creation or collection of data, 72 72
then it's processed, then it's shared, 73 73
somebody may use it, it's stored, 74 74
and finally, when it's not needed any longer, 75 75
it's destroyed or deleted. 76 76
Some questions you need to answer in this task 77 77
include how long are you required to safely store 78 78
different types of information, 79 79
how is this data processed in your environment, 80 80
and what types of data do you have to delete and when. 81 81
Looking now at Task P-14, I want you to know 82 82
that it'll be a bit more costly to complete 83 83
than the previous tasks that we've covered here in step 1. 84 84
Task P-14 is all about conducting system level security 85 85
and privacy risk assessments. 86 86
This task should be taken up 87 87
by your organization's security officer and technology team. 88 88
Now, if you don't have those people in house, 89 89
it's okay to contract 90 90
with qualified outside service providers. 91 91
Moving on to Task P-15. 92 92
When you complete it, 93 93
you'll end up with your documented security 94 94
and privacy requirements, 95 95
all of which will be based on 96 96
what assets need to be protected 97 97
against the specific risks that you've identified. 98 98
These requirements will help you 99 99
to select controls for your system, 100 100
which you'll do in future tasks of RMF. 101 101
When you complete Task P-16, 102 102
you'll have a thoroughly documented architecture 103 103
of your enterprise, 104 104
including an updated security and privacy architecture. 105 105
Enterprise architecture is a management practice 106 106
that maximizes the effectiveness of your business processes. 107 107
Additionally, a published system architecture 108 108
makes systems more transparent, 109 109
and therefore easier to understand and to protect. 110 110
By the end of Task P-17, 111 111
you'll have allocated security and privacy requirements 112 112
to your system and physical environment. 113 113
Allocation is deciding exactly 114 114
where your requirements are going to be satisfied 115 115
in the big picture. 116 116
When doing this task, 117 117
you can decide the most cost-effective ways 118 118
to allocate who will satisfy each requirement 119 119
throughout your organization, 120 120
with the goal of satisfying them all. 121 121
Finally, when your system has gone through all these tasks, 122 122
P-1 through P-17, 123 123
your last task in this step 124 124
is to inform your organization that your system exists. 125 125
RMF calls this system registration. 126 126
Make sure that the key decision makers of your organization 127 127
know about the system's creation and its role 128 128
in your overall mission. 129 129
Okay, that concludes our tour of step 1 130 130
of the Risk Management Framework.