Subject: [sacm] Fwd: [sw.assurance] ISCMA: An Information Security Continuous Monitoring Program Assessment -- Draft NISTIR 8212 Available for Comment

From: Ira McDonald <[email-masked]>
Date: Wed, 7 Oct 2020 13:59:18 -0400

---------- Forwarded message ---------
From: 'Pillitteri, Victoria Yan (Fed)' via sw.assurance <
[email-masked]>
Date: Wed, Oct 7, 2020 at 10:32 AM
Subject: [sw.assurance] ISCMA: An Information Security Continuous
Monitoring Program Assessment -- Draft NISTIR 8212 Available for Comment
To: sec-cert <[email-masked]>

Draft NIST Interagency Report (NISTIR) 8212, *ISCMA: An Information
Security Continuous Monitoring Program Assessment
<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDEuMjgwNjQxOTEiLCJ1cmwiOiJodHRwczovL2NzcmMubmlzdC5nb3YvcHVibGljYXRpb25zL2RldGFpbC9uaXN0aXIvODIxMi9kcmFmdCJ9.G2gw4qUn8Ju043R_tDcaYHld1VfOCcEs_Hqfy8X7owo/s/134140706/br/86276861934-l>*,
provides an operational approach to the assessment of an organization's
information security continuous monitoring (ISCM) program.  The ISCM
assessment (ISCMA) approach is consistent with the ISCM Program Assessment,
as described in NIST SP 800-137A, *Assessing ISCM Programs: Developing an
ISCM Program Assessment*.  The ISCMA process proceeds according to the
following five steps:

   1. Plan the approach
   2. Evaluate the elements
   3. Score the judgments
   4. Analyze the results
   5. Formulate actions

Included with the ISCMA approach in this report is ISCMAx, a free,
publicly-available working implementation of ISCMA that can be tailored to
fit the needs of the implementing organization. ISCMAx produces a detailed
scorecard with associated graphical output and identifies conditions that
may warrant further analysis. The ISCMAx tool is a Microsoft Excel
application and can be used in the Windows operating system; it does not
run on the Macintosh operating system. NISTIR 8212 provides complete
instructions for both using ISCMAx as provided, and for tailoring ISCMAx,
if desired. For instructions on using the ISCMAx tool, refer to Sec. 3, 4,
and 5 of Draft NISTIR 8212.

 *A public comment period for this document is open through November 13,
2020.*  See the publication details
<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDEuMjgwNjQxOTEiLCJ1cmwiOiJodHRwczovL2NzcmMubmlzdC5nb3YvcHVibGljYXRpb25zL2RldGFpbC9uaXN0aXIvODIxMi9kcmFmdCJ9.hlO6TaHJmyf3xdk4tsGGBax5axnS4tuIjol8Jc2ABbI/s/134140706/br/86276861934-l>
 for a copy of the draft publication, ISCMAx tool (Recommended Judgment and
Alternate Judgment, macro-enabled spreadsheet), and instructions for
submitting comments—preferably using the comment template provided.  For
any questions, please contact sec- <[email-masked]>[email-masked].

*NOTE: A call for patent claims is included on page vi of this draft. For
additional information, see the Information Technology Laboratory (ITL)
Patent Policy--Inclusion of Patents in ITL Publications
<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDEuMjgwNjQxOTEiLCJ1cmwiOiJodHRwczovL3d3dy5uaXN0Lmdvdi9pdGwvaW5mb3JtYXRpb24tdGVjaG5vbG9neS1sYWJvcmF0b3J5LWl0bC1wYXRlbnQtcG9saWN5LWluY2x1c2lvbi1wYXRlbnRzLWl0bC1wdWJsaWNhdGlvbnMifQ.M2JmaalJk2iJ_ryyvdqPXrsdjv9HEDrm0E7MOVBZdhM/s/134140706/br/86276861934-l>.*

Publication details:
https://csrc.nist.gov/publications/detail/nistir/8212/draft
<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDEuMjgwNjQxOTEiLCJ1cmwiOiJodHRwczovL2NzcmMubmlzdC5nb3YvcHVibGljYXRpb25zL2RldGFpbC9uaXN0aXIvODIxMi9kcmFmdCJ9.yM4-8QcLZHqTLsstelCVZutlEWVpuDPF_Gr7Jdheu3c/s/134140706/br/86276861934-l>

ITL Patent Policy:
https://www.nist.gov/itl/information-technology-laboratory-itl-patent-policy-inclusion-patents-itl-publications
<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDEuMjgwNjQxOTEiLCJ1cmwiOiJodHRwczovL3d3dy5uaXN0Lmdvdi9pdGwvaW5mb3JtYXRpb24tdGVjaG5vbG9neS1sYWJvcmF0b3J5LWl0bC1wYXRlbnQtcG9saWN5LWluY2x1c2lvbi1wYXRlbnRzLWl0bC1wdWJsaWNhdGlvbnMifQ.T5vFUg6Xa4qV7pLBq-KHZh0OZPYWr3YeUOYhbe_wM5c/s/134140706/br/86276861934-l>

-- 

Victoria Yan Pillitteri

National Institute of Standards and Technology

[email-masked]

-- 
To unsubscribe from this group, send email to
[email-masked]
View this message at https://list.nist.gov/sw.assurance
---
To unsubscribe from this group and stop receiving emails from it, send an
email to [email-masked].