Đang chuẩn bị liên kết để tải về tài liệu:
fisma certification and accreditation handbook phần 4

To đầy đủ và chính xác phát triển việc kiểm kê, bạn sẽ cần phải làm việc với nhiều người phụ trách hoạt động ngày-to-ngày của người dân thông tin của một tổ chức systems.These không phải luôn luôn tập trung vào các vấn đề an ninh thông tin, | 126 Chapter 8 Performing and Preparing the Self-Assessment Table 8.4 continued Operational Assurance Control Questions No. Question L1 L2 L3 L4 Are procedures documented for using system maintenance and monitoring utilities Are processes in place to track version control of operating systems Are processes in place to track version control of hardware Are processes in place to track version control of applications Is licensed software labeled and stored securely Is licensed software inventoried either manually or automatically Does a policy exist to prohibit the use of nonlicensed software that is not freeware or shareware Does a policy exist to explain how freeware and shareware should or should not be used Does a process exist to allow for expedited emergency change procedures When new versions of software are installed are the versions tested prior to being put into production Do procedures exist to test and install new software patches Are operating systems hardened and are unnecessary services turned off Are systems scanned for known vulnerabilities on a regular basis Are vulnerabilities reviewed and mitigated Does all purchased software and hardware include vendor supplied documentation Continued www.syngress.com Performing and Preparing the Self-Assessment Chapter 8 127 Table 8.4 continued Operational Assurance Control Questions No. Question L1 L2 L3 L4 Does documentation exist for custom and in-house developed applications Do procedures for testing security configuration exist Are router and switch configurations documented Does an up-to-date topological map of the network exist Are the firewall rules documented Data Integrity Required by FISMA 3544 c 2 G OMB Circular A-130 III FISCAM SP-1 SS-2.2 Recommended by NIST SP 800-18 NIST SP 800-30 Has data integrity been characterized Have threats to data integrity been reviewed Have safeguards been implemented to preserve data integrity Is sensitive information encrypted as required .