NIST, Computer Security Division, Computer Security Resource Center
FASP Areas
Some security practices in the listing below may not reference an organization's affiliation. These practices are provided in a generic format. Document icons specify the type of file format (Ex. MS Word, pdf, Text file, etc.). The right column contains the document title. The left column contains the date when the file was posted to this page.
NOTE: After clicking link to document, the document will open in a blank browser window and this page will be in the background.
Audit Trails
Maintains a record of system activity by system or application processes and by user activity.
| Document | Posted |
Back to Top
Authorize Processing (C&A)
Provides a form of assurance of the security of the system.
Back to Top
Contingency Planning
How to keep an organization's critical functions operating in the event of disruption, large and small.
| Document | Posted |
| Contingency Plan Procedure - (CMS) | 07/01/09 |
| Contingency Plan Template - (CMS) | 07/01/09 |
| Contingency Plan Tabletop Test Template - (CMS) | 07/01/09 |
| Contingency Plan Template | 04/16/08 |
| System and Data Backups - (FCC) | 12/29/04 |
| Contingency Planning Template - (DOJ) | 7/03/03 |
Back to Top
Continuous Monitoring
Activities include configuration management and control of information system components, security impact analysis of changes to the system, ongoing assessment of security controls, and status reporting.
| Document | Posted |
| Continuous Monitoring Training | 04/16/08 |
Back to Top
Data Integrity
Controls used to protect data from accidental or malicious alteration or destruction and to provide assurance to the user that the information meets expectations about its quality and integrity.
| Document | Posted |
| Viruses 101 - (FCC) | 07/03/03 |
Back to Top
Hardware and System Software Maintenance
Controls used to monitor the installation of, and updates to, hardware and software to ensure that the system functions as expected and that a historical record is maintained of changes.
| Document | Posted |
Back to Top
Identification and Authentication
Technical measures that prevent unauthorized people (or unauthorized processes) from entering an IT system.
| Document | Posted |
| Password Protection - (FCC) | 07/03/03 |
| Creating Strong Passwords - (FCC) | 07/03/03 |
Back to Top
Incident Response Capability
Capability to provide help to users when a security incident occurs in a system.
Back to Top
Life Cycle
IT system life cycles contain five basic phases: initiation, development and/or acquisition, implementation, operation, and disposal.
| Document | Posted |
| The Project Manager's View of Security Processes Over the System Development Life Cycle - (Dept. of VA) | 11/18/04 |
Back to Top
Logical Access Controls
System-based mechanisms used to designate who or what is to have access to a specific system resource and the type of transactions and functions that are permitted.
| Document | Posted |
Back to Top
Network Security
Secure communication capability that allows one user or system to connect to another user or system.
Back to Top
Personnel Security
Involves human users, designers, implementers and managers and how they interact with computers and the access and authorities they need to do their jobs.
Back to Top
Physical and Environmental Protection
Measures taken to protect systems, buildings, and related supporting infrastructures against threats associated with their physical environment.
| Document | Posted |
| Site Survey of Data Center - (CFTC) | 06/15/04 |
| Securing Portable Electronic Media - (FCC) | 07/03/03 |
Back to Top
Policy and Procedures
Formally documented security policies and procedures.
| Document | Posted |
| Policy for the Acceptable Use of Desktop/Laptop and Other IT Resources - (CMS) | 07/01/09 |
| Rules of Behavior for Connection to Networks - (CMS) | 07/01/09 |
| Information Security Terms, Definitions and Acronyms - (CMS) | 06/30/09 |
| CDC Wireless Security Policy - Centers for Disease Control and Prevention (CDC) | TBA |
| Use of CDC Information Technology Resources - Centers for Disease Control and Prevention - (CDC) | 06/26/09 |
| Information Technology Security Policy Handbook Version 3.1 - (DOI) | 09/25/08 |
| Handbook for General Support Systems and Major Applications Inventory Procedures - (Department of Education) | 04/07/06 |
| U.S. Customs AIS Security Policy Manual CIS HB 1400-05 - (U.S. Customs) | 11/13/03 |
| Administrative Policies and Procedures Manual - (National Labor Relations Board) | 07/03/03 |
| Rules of Behavior - (FCC) | 07/03/03 |
Back to Top
Production, Input/Output Controls
Covers topics ranging from a user help desk to procedures for storing, handling and destroying media.
| Document | Posted |
| USB Flash Drive Security - (Office of Government Ethics) | 05/04/06 |
| Media Sanitization Procedures - (NIST) | 12/08/03 |
Back to Top
Program Management
Overall scope of the program (i.e., PD's, policies and security program plans and guidance).
Back to Top
Review of Security Controls
Routine evaluations and response to identified vulnerabilities.
| Document | Posted |
| Security Assessment Summary Template | 04/16/08 |
| Security Test & Evaluation Template | 04/16/08 |
| PII Security Controls Assessment Plan Template - (Department of Commerce) | 07/28/06 |
| Spreadsheet of SP 800-53 Controls - (Commodity Futures Trading Commission) | 06/21/06 |
Back to Top
Risk Management
The process of assessing risk, taking steps to reduce risk to an acceptable level, and maintaining that level of risk.
| Document | Posted |
| Risk Mitigation Worksheet - (Centers for Disease Control and Prevention (CDC)) | 06/26/09 |
| Risk Calculation Worksheet - (CDC) | 06/26/09 |
| Risk Assessment Report - (CDC) | 06/26/09 |
Back to Top
Security Awareness, Training and Education
Improves awareness of the need to protection system resources as well as develops skills and knowledge so computer users can perform their jobs more securely and build in-depth knowledge.
Back to Top
System Security Plan
Provide an overview of the security requirements of the system and describe the controls in place or planned for meeting those requirements.
* These submissions were first collected by the Federal CIO Council for their Best Security Practices initiative. That material was later passed to NIST's Computer Security Division.