Writing a Cybersecurity Accreditation Package
Author: Mark a Russo Cissp-Issap
Publisher:
Published: 2020-02-18
Total Pages: 296
ISBN-13:
DOWNLOAD EBOOK →IF YOU ARE WRITING AN ACCREDITATION PACKAGE FOR NIST 800-171 OR CMMC, THIS BOOK IS DESIGNED FOR THE COMPANY LEADERSHIP AND ITS IT STAFF TO BE SUCCESSFUL...IT WILL SAVE YOU TIME AND HEADACHES...THIS IS A HOW-TO NOT A "50,000 FOOT VIEW" BOOK!Introducing the Security Authorization Development Package Model (SADP-M). I hope this helps all of you to create a fully auditable and complete package under the base NIST 800-171 and the Cybersecurity Maturity Model Certification (CMMC) process emerging from the Department of Defense (DOD). I have added CMMC control traceability for Levels 1 through 3 in this version. This model introduces the Global Cybersecurity Policy (G-CSP). It forms the starting-point for required accreditation documentation under NIST 800-171--with applicability to CMMC. This is a defined process to help create auditable packages for accreditation. The assigned IT professional or ISSO will subsequently populate and provide answers for the auditor in the G-CSP. After this work is completed, the ISSO will begin to "strip out" the other documents to include the SSP, CSP, POAM, etc. One of the most common requests I receive from my readers is help in creating an effective Cybersecurity Policy (CSP). I initially was focused on the two major technical parts of the NIST 800-171 accreditation package, the System Security Plan (SSP) and Plans of Action and Milestones (POAM). I consider the CSP more a Human Resources effort that focuses on the people side of the People-Process-Technology Triad, but no less critical. Fortunately, I have recently been able to dedicate the time to develop what I describe as an onion approach to create a CSP. I describe a GLOBAL CSP as a base document that the cybersecurity professional can strip-out the SSP, the final CSP, as well as several other vital cybersecurity documents needed to manage any IT system.