Catalog of Control Systems Security: Recommendations for Standards Developers

2.17 Monitoring and Reviewing Control System Security Policy .......................................... 140
2.17.1 Monitoring and Reviewing Control System Security Management
Policy and Procedures .................................................................................... 140
2.17.2 Continuous Improvement ............................................................................... 141
2.17.3 Monitoring of Security Policy ........................................................................ 141
2.17.4 Best Practices .................................................................................................. 142
2.17.5 Security Accreditation .................................................................................... 142
2.17.6 Security Certification ...................................................................................... 143
2.18 Risk Management and Assessment ................................................................................. 144
2.18.1 Risk Assessment Policy and Procedures ........................................................ 144
2.18.2 Risk Management Plan ................................................................................... 145
2.18.3 Certification, Accreditation, and Security Assessment Policies and
Procedures ...................................................................................................... 145
2.18.4 Security Assessments ..................................................................................... 146
2.18.5 Control System Connections .......................................................................... 147
2.18.6 Plan of Action and Milestones ........................................................................ 147
2.18.7 Continuous Monitoring................................................................................... 148
2.18.8 Security Categorization .................................................................................. 148
2.18.9 Risk Assessment ............................................................................................. 149
2.18.10 Risk Assessment Update ................................................................................ 150
2.18.11 Vulnerability Assessment and Awareness ...................................................... 150
2.18.12 Identify, Classify, Prioritize, and Analyze Potential Security Risks .............. 152
2.19 Security Program Management ....................................................................................... 152
2.19.1 Information Security Program Plan ................................................................ 152
2.19.2 Senior Information Security Officer ............................................................... 153
2.19.3 Information Security Resources ..................................................................... 154
2.19.4 Plan of Action and Milestones Process .......................................................... 154
2.19.5 Information System Inventory ........................................................................ 155
2.19.6 Information Security Measures of Performance ............................................. 155
2.19.7 Enterprise Architecture ................................................................................... 156
2.19.8 Critical Infrastructure Plan ............................................................................. 156
2.19.9 Risk Management Strategy ............................................................................. 156
2.19.10 Security Authorization Process ...................................................................... 157
2.19.11 Mission/Business Process Definition ............................................................. 157
3. CONCLUSIONS ......................................................................................................................... 159
4. GLOSSARY: DEFINITIONS OF TERMS ................................................................................. 160
5. DOCUMENTS REFERENCED .................................................................................................. 174
TABLES
Table 1. Catalog of Recommendations and NIST SP 800-53 comparison. .................................................. 3
xii