Supplemental Guidance on Ongoing Authorization: Transitioning to Near Real-Time Risk Management (Withdrawn)

Dempsey, Kelley; Ross, Ron; Stine, Kevin

doi:https://doi.org/10.6028/NIST.CSWP.3

NIST CSWP 3

Withdrawn on April 19, 2019. Superseded by SP 800-37 Rev. 2

Supplemental Guidance on Ongoing Authorization: Transitioning to Near Real-Time Risk Management

Documentation Topics

Date Published: 6/3/2014

Planning Note (04/19/2019): The information in this white paper has been rolled into SP 800-37 Revision 2. Please refer to that document for current guidance.

Author(s)

Kelley Dempsey (NIST), Ron Ross (NIST), Kevin Stine (NIST)

Abstract

Office of Management and Budget (OMB) Memorandum M-14-03, Enhancing the Security of Federal Information and Information Systems, reminds Federal agencies that, "Our nation's security and economic prosperity depend on ensuring the confidentiality, integrity and availability of Federal information and information systems," and directs NIST to "publish guidance establishing a process and criteria for agencies to conduct ongoing assessments and authorization." The following guidance clarifies and amplifies current NIST guidance on security authorization contained in Special Publications 800-37, 800-39, 800-53, 800-53A, and 800-137.

Keywords

information security; Office of Management and Budget; ongoing assessment; ongoing authorization; Risk Management Framework; Federal Information Security Management Act; continuous monitoring

Control Families

Assessment, Authorization and Monitoring; Risk Assessment

Documentation

Publication:
https://doi.org/10.6028/NIST.CSWP.3

Supplemental Material:
None available

Related NIST Publications:
SP 800-137
SP 800-37 Rev. 1
SP 800-39

Document History:
06/03/14: CSWP 3 (Final)

Topics

Security and Privacy

audit & accountability, categorization, continuous monitoring, risk assessment, system authorization

Laws and Regulations

Federal Information Security Modernization Act