RMF Procedures Overview, DoDI 8510.01

RMF Procedures Overview, DoDI 8510.01

RMF Procedures, DoDI 8510.01 applies to all DoD Information Technology (IT) that receives, processes, stores, displays, or transmits DoD information.

The Risk Management Framework (RMF) brings a risk-based approach to implementing cybersecurity, supports cybersecurity integration early and throughout the system lifecycle, promotes reciprocity to the maximum extent possible, and stresses continuous monitoring.

Risk management is a continuous process that is accomplished throughout the life cycle of a system and should begin at the earliest stages of program planning.

It is used as the foundation of the Risk Management Framework. The approach is an organized methodology for continuously:

• Risk Identification: identifying and measuring the unknowns;
• Risk Mitigation: developing mitigation options;
• Risk Mitigation Implementation: selecting, planning, and implementing appropriate risk mitigations; and
• Risk Tracking: tracking the implementation to ensure successful risk reduction.

The goals of the Risk Management Framework, as stated by the Defense Security Service (DSS), are:

• Improve information security
• Strengthen risk management processes
• Encourage reciprocity among federal agencies

The DoD RMF governance structure implements a three-tiered approach to cybersecurity risk management.

• Tier 1 Strategic Level: Addresses risk management at the DoD enterprise level.  At this tier, the DoD Chief Information Officer (CIO) directs and oversees the cybersecurity risk management of DoD IT.  The Risk Executive Function is performed by the DoD Information Security Risk Management Committee (ISRMC).
• Tier 2 Mission / Business Processes Level: At this level, the Component CIO is responsible for the administration of the RMF within the DoD Component cybersecurity program.
• Tier 3 IS and PIT Systems Level: The DoD Component Heads are responsible for the appointment of trained and qualified Authorization Officials for all DoD ISs and PIT systems within their Component.

An important objective of the DoDI RMF process is to incorporate cybersecurity early and robustly in the acquisition and system development life cycle.

An additional key objective is to provide a risk management methodology that gives organizations a true picture of vulnerabilities caused by noncompliant controls as it relates to other risk factors (e.g., likelihood, threat, and impact).

RMF Procedures Overview, DoDI 8510.01 Course byTonex

RMF Procedures Overview , DoDI 8510.01 Course Description

RMF Procedures Overview, DoDI 8510.01 training establishes the Risk Management Framework (RMF) for the Department of Defense (DoD) Information Technology (IT) for cybersecurity policies, responsibilities and risk management. RMF is a new replacement to DoD Information Assurance Certification and Accreditation Process (DIACAP) and manages the cybersecurity life cycle for DoD IT based on DoD, National Institute of Standards and Technology (NIST) and Committee on National Security Systems (CNSS) standards.

Tonex as a leader in security industry for more than 15 years is now announcing the RMF Procedures Overview, DoDI 8510.01 training which helps you to understand security controls in compliance with laws, regulations and policies and implement step by step risk management framework to federal agencies and DoD related IT.

Learn about cybersecurity requirements for DoD IT and RMF established in NIST Special Publications, NIST SP 800-37 and NIST 800-53 and apply these regulations to your DoD IT.

Transition from Certification and Accreditation (C&A) to RMF for DoD IT requires all DoD Information System (DoD IS) and PIT to be categorized in accordance with CNSS 1253 standards and NIST SP 800-53 as a part of defense planning, programming, budgeting and execution process.

DoDI 8510.01 can be implemented in all DoD related organizations, military departments, the office of the chairman of the joint chiefs of staff (CJCS), defense agencies, DoD field activities and all other organizational entities related to the DoD.

Tonex as a leader in industry and academia with high quality conferences, seminars, workshops, and exclusively designed courses in cybersecurity area is pleased to announce a complete training on RMF implementation for DoD to understand the steps for RMF implementation and be able to implement RMF for their DoD organization. .

RMF Procedures Overview, DoDI 8510.01 training will help you to implement a multi-tiered risk management framework for DoD Information level, through the DoD component level and down to the Information System (IS) level.

This course covers variety of topics in RMF implementation for DoD such as: security authorization process, responsibilities in risk management framework, procedures for risk management framework, RMF step 1: categorizing information system, RMF step 2- selecting security control, RMF step 3: implementing security control, RMF step 4: assessing security control, RMF step 5: authorizing information system, RMF step 6: monitoring security controls, risk management framework governance, risk management of is and pit systems and risk management framework transition

RMF Procedures Overview, DoDI 8510.01 course by TONEX is interactive course with a lot of class discussions and exercises aiming to provide you a useful resource for RMF implementation to your information technology system.

If you are an IT professional of federal agency personnel and need to risk management framework for your IT system or validate your RMF skills, you will benefit the presentations, examples, case studies, discussions, and individual activities upon the completion of the RMF Procedures Overview, DoDI 8510.01 training and will prepare yourself for your career.

RMF Procedures Overview, DoDI 8510.01 training will introduce a set of labs, workshops and group activities of real world case studies in order to prepare you to tackle the entire related RMF challenges.

Audience

RMF Procedures Overview, DoDI 8510.01 training is a 2-day course designed for:

• IT professionals in the DoD organizations
• Airforce and Military Personnel in charge of cybersecurity
• DoD employees and contractors or service providers
• All DoD personnel in charge of information assurance
• Authorizing official representatives, chief information officers, senior information assurance officers, information system owners or certifying authorities
• Employees of federal agencies and the intelligence community
• Assessors, assessment team members, auditors, inspectors or program managers of information technology area
• Any individual looking for information assurance implementation for a company based on recent DoD and NIST policies
• Information system owners, information owners, business owners, and information system security managers

Training Objectives

Upon completion of the RMF Procedures Overview, DoDI 8510.01 training course, the attendees are able to:

• Understand the necessity of transition from DIACAP to RMF and differentiate C&A with RMF
• Learn about general standards used in RMF such as FISMA, NIST, and CNSS
• Explain key roles and responsibilities of RMF such as CIO, AO, and ISO
• Recognize different steps to risk management framework application
• Explain how to categorize the DoD information system based on NIST SP 800-37 and DoDI 8510-01
• Select security controls for DoD IT based on CNSSI 1253 and NIST SP 800-53
• Implement the security control to DoD IT based on NIST SP 800-53 and NIST SP 800-70
• Assess the security control based on security assessment method standards
• Explain security authorization package and plan of action and milestones (POA&M)
• Conduct continuous monitoring security plan based on NIST SP 800-137
• Understand three tiered of risk management framework governance
• Implement RMF for IS and PIT systems
• Understand transitions of risk management framework

Training Outline

RMF Procedures Overview, DoDI 8500.01 training course consists of the following lessons, which can be revised and tailored to the client’s need:

Security Authorization Process

• Security Authorization Standards
• NIST, FISMA, DIACAP and RMF
• DoD: DoDI 8500.01 and DoDI 8510.01
• CNSSP-42, CNSSI-1253, CNSS 4009
• NIST Special Publications, NIST SP 800-37, NIST SP 800-39, NIST SP 800-53A, NIST SP 800-137 and NIST SP 800-160
• Risk Management Framework Tools
• eMASS and Information Assurance Support Environment (IASE)
• Security Process and Concepts
• Adequate Security and Risk based OMB
• Security Objectives: Confidentiality, Integrity and Availability
• Types of Risks
• Privacy Rules: HIPAA and Personally Identifiable Information (PII)
• Trust Relationship: Reciprocity and Documents
• Risk Management
• Risk Assessment: Qualitative and Quantitative

Responsibilities in Risk Management Framework

• DoD IT
• DoD Chief Information Officer (DoD CIO)
• Director, Defense Information System Agency
• Secretary of Defense for Acquisition Technology
• DT&E
• DOT&E
• Chief Central Security Service
• DoD Component Heads
• Risk Executive
• DoD Information Security Officer (SISO)
• Authorizing Official (AO)
• AO Designated Representative
• Information Owner
• Security Control Assessor
• Information System Owner (ISO)
• Information System Security Engineer

Procedures for Risk Management Framework

• Categorizing the Information and Information Systems
• Selecting Security Control
• Implementing Security Control
• Assessing Security Control
• Authorizing the Information System
• Monitoring Security Controls

RMF Step 1: Categorizing Information System

• System Security Plan based on SP 800-18, SP 800-37
• DoD IT Products, Services and PIT based on DoDI 8510-01
• Categorization based on CNSSI-1253 and SP 800-53
• Accreditation Boundaries based on SP 800-18
• Interconnecting the Information System
• Registration based on SP 800-53
• Qualified Personned based on DoDD 8570-01 and DoDD 8140.01

RMF Step 2- Selecting Security Control

• Types of Security Controls
• CNSSI-1253, SP 800-53
• Selecting Security Control based on CNSSI-1253 and FIPS-200
• Compensating Controls-SP800-53
• Trustworthiness and Assurance- SP 800-53
• Monitoring Control Selection-SP 800-53
• Monitored Control Selection-SP 800-37
• Registration- DoDI 8510.01
• Knowledge Services and eMASS

RMF Step 3: Implementing Security Control

• Implementation of Security Control based on NIST SP 800-53
• Documentation of Security Control based on SP800-18 and SP800-37
• Security Control Tests and Checklist based on NIST SP 800-70 and eMASS
• Security Content Automation Protocol (SCAP) based on SP800-115 and SP800-117

RMF Step 4: Assessing Security Control

• Security Control Assessment Method based on SP-800-53 and SP 800-115
• Vulnerability Assessing Tools, SP 800-53A and SP 800-115
• Security Assessment Plan based on SP 700-37
• Security Assessor Expertise based on DoDI 8510.01
• Assessing Security Control, SP800-53A
• Security Control Assessment, SP800-37

RMF Step 5: Authorizing Information System

• Special DoD Systems, DoDI 8510.01
• Plan of Action and Milestones (POA&M)
• Security Authorization Package based on SP 800-37 and DoDI 8510.01
• Authority to Operate (ATO)
• Interim Authorization to Test (IATT)
• Denial of Approval to Operate (DATO)
• Special Authorizations: DoDI 8510.01
• Platform Information Technology (PIT) Authorization

RMF Step 6: Monitoring Security Controls

• Information Security Continuous Monitoring based on SP 800-137
• Patch and Vulnerability Management
• Cloud Computing, FedRAMP
• DoD RMF Schedule, Status and Issues for DoDI 8510.01

Risk Management Framework Governance

• Three Tiered Approach
• Cybersecurity Risk Management based on NIST SP 800-39
• Tier1: Organizations, DoD CIO/SISO, RM TAG&KS, DoD ISRMC
• Tier 2: Mission/Business Processes, WMA, BMA, EIEMA, DIMA PAOs, DoD Component CIO/SISO
• Tier 3: IS/PIT Systems, Authorization Official, System Cybersecurity Program
• Traceability and Transparency of Risk-Based Decisions
• Organization-Wide Risk Awareness
• Strategic Risks
• Tactical Risks
• Feedback Loop for Continuous Improvements
• Inter-Tier and Intra-Tier Communications
• Risk Executive Function
• DoD Cybersecurity Architecture
• Knowledge Service (KS)

Risk Management of IS and PIT Systems

• Applicability to IS and PIT Systems
• Considerations for Special System Configurations
• Cross Domain Solutions (CDS) for IS and PIT
• Unified Capabilities (UC) for PIT and IS
• Type Authorization
• Stand-Alone IS and PIT Systems
• Having another Entity Operating IS and PIT Systems
• DoD Partnered System
• OSD Systems
• Authorization with a Single/Multiple AO
• Authorization Approaches

Risk Management Framework Transition

• RMF Initial Transition Timeline and Instructions
• Transition from DIACAP to CNSSI 1253
• Transition to NIST SP 800-53 and RMF

Hands On, Workshops, and Group Activities

• Labs
• Workshops
• Group Activities

Sample Workshops and Labs for Cybersecurity Procedures Overview, DoDI 8500.01 Training

• Categorizing the Information system Based on the Information Type using NIST SP 800-60
• Determining the Security Category for Confidentiality, Availability, and Integrity of the System
• Identifying Controls Case, Second Phase of RMF Case Study Using NIST SP 800-53
• RMF Phase 3 Case Study, Resolving the Control Planning Issues
• Developing Test Procedures and Plans for Assessing Security Controls and Security Assessment Reports (SAR) using NIST SP 800-53A
• Developing Plan of Action and Milestones (POA&M)
• RMF Monitoring Phase; Assessing the Controls based on Schedule

RMF Procedures Overview , DoDI 8510.01