PB 22164 - September 29, 2005 - USPS.com® - About

More documents

Recommendations

Info

98 POSTAL BULLETIN 22164 (9-29-05) 4-2.4.10 Develop Operational Security Training Appropriate materials are developed for training users, system administrators, managers, and other personnel on the correct use of the application and its security controls. 4-2.4.11 Register Application in eAccess The application is registered in eAccess, which is the Postal Service’s application for managing the authorization process for personnel needing to access an application and the associated information. Registration is also required for the use of managed accounts (i.e., machine accounts, etc.). 4-3 Phase 3 — Testing * * * * * [Delete section 4-3.4.5, Harden Platform.] * * * * * 4-4 Phase 4 — Evaluation * * * * * 4-4.3 Roles and Responsibilities [Change the Portfolio manager and Accreditor (manager, CISO) roles and responsibilities to read as follows:] Portfolio manager Analyzes ISA and business documentation, makes the decision to escalate security concerns or prepares a risk mitigation plan addressing high and medium risks and recommending whether the risks should be accepted, transferred, or further mitigated. If a documented vulnerability will not be mitigated, prepares and signs an acceptance of responsibility letter and forwards it (the risk mitigation plan and ISA documentation package) to the accreditor. Accreditor (manager, CISO) Analyzes ISA and business documentation, makes the decision to escalate security concerns, or prepares and signs an accreditation letter. Forwards the accreditation letter and ISA documentation package to the executive sponsor and portfolio manager. * * * * * 4-4.4 Activities * * * * * [Revise title and text of 4-4.4.5 to read as follows:] 4-4.4.5 Escalate Security Concerns or Prepare Risk Mitigation Plan and Acceptance of Responsibility Letter (if Required) The portfolio manager reviews the certification letter, the supporting ISA, and the business documentation, and escalates security concerns or prepares a risk mitigation plan for any residual risks rated as medium or high. The portfolio manager then recommends whether the risks should be accepted, transferred, or further mitigated. If a documented vulnerability will not be mitigated, the portfolio manager prepares and signs an acceptance of responsibility letter and then forwards it, the risk mitigation plan, and ISA documentation package to the accreditor. * * * * * Exhibit 4a ISA Templates [Add a row to Exhibit 4a after the Risk Mitigation Plan row to read as follows:] Template Name Applicability Purpose Acceptance of Responsibility for Documented Vulnerability Letter For a documented vulnerability that will not be mitigated. For the portfolio manager to accept responsibility for a documented vulnerability that will not be mitigated.
POSTAL BULLETIN 22164 (9-29-05) Exhibit 2 Relationship of ISA Roles [Revise Exhibit 2 as follows:] Vice Presidents of Functional Business Areas Business Area Executive Sponsor ISSR Chief Privacy Officer Accreditor (CISO Manager) Development Team Portfolio Manager Project Manager Postal Inspection Service Vice President, Chief Technology Officer Corporate Information Security Office Certifier (ISSO Manager) Information Systems Security Officer Organizational Structure Lines of Communication Organization and Communication 99
Page 2 and 3:
2 POSTAL BULLETIN 22164 (9-29-05) C
Page 4 and 5:
4 POSTAL BULLETIN 22164 (9-29-05) P
Page 6 and 7:
6 POSTAL BULLETIN 22164 (9-29-05) C
Page 8 and 9:
8 POSTAL BULLETIN 22164 (9-29-05) N
Page 10 and 11:
10 POSTAL BULLETIN 22164 (9-29-05)
Page 12 and 13:
Page 14 and 15:
Page 16 and 17:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49: 48 POSTAL BULLETIN 22164 (9-29-05)
Page 136: 475 L’ENFANT PLAZA SW WASHINGTON
show all

PB 22164 - September 29, 2005 - USPS.com® - About

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?