Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

More documents

Recommendations

Info

7.8 FIELDING THE SYSTEM 7.8.1 PROGRAM MANAGEMENT RESPONSIBILITY TRANSFER 7.8.2 COMPLETION OF CERTIFICATION 7.8.3 THE FIELDED SYSTEM 7.9 REFERENCES APPENDIX A HISTORICAL BASIS A.1 INTRODUCTION A.2 DISCUSSED IN THE ORANGE BOOK A.3 SINCE THE ORANGE BOOK APPENDIX B PLAN AND DELIVERABLE DOCUMENT SUMMARIES B.1 DOCUMENTS RELATED TO FUNCTIONAL AREAS B.1.1 PLANNING AND FINANCIAL MANAGEMENT DOCUMENTS B.1.2 PROGRAM MANAGEMENT DOCUMENTS B.1.3 MISSION USER DOCUMENTS B.1.4 CONTRACTING DOCUMENTS B.2 SUPPORT PLANS RELATED TO CONCEPTS B.2.1 SUPPORT PLANS RELATED TO THE CONCEPT OF OPERATIONS B.2.2SUPPORT PLANS RELATED TO THE CONCEPT OF ENGINEERING B.2.3 SUPPORT PLANS RELATED TO THE CONCEPT OF MAINTENANCE B.3 LIFE-CYCLE PHASES AND DATA DELIVERABLES B.3.1 CONCEPT AND DEFINITION PHASE B.3.2 DESIGN, DEVELOPMENT, AND TEST PHASE B.3.3 OPERATION AND IMPLEMENTATION PHASE (USER DOCUMENTATION) B.4 DOCUMENT SUMMARY APPENDIX C BIBLIOGRAPHY C.1 WORKING BIBLIOGRAPHY C.2 AGENCY/PROTECTION-SPECIFIC BIBLIOGRAPHY Page 10
NCSC-TG-024 Volume 1/4 Library No. 5-239,669 Version 1 FOREWORD This guideline, volume 1 of 4 in the series, "A Guide to Procurement of Trusted Systems," is written to help facilitate the acquisition of trusted computer systems in accordance with DoD 5200.28-STD, "Department of Defense Trusted Computer System Evaluation Criteria." It is designed for new or experienced automated information system developers, purchasers, or program managers who must identify and satisfy requirements associated with securityrelevant acquisitions. Information contained within this series will facilitate subsequent development of procurement guidance for the Federal Criteria. This series also includes information being developed for certification and accreditation guidance. Finally, this introductory guideline addresses both the complex acquisition process and the many regulations, standards, and criteria to be satisfied in providing a secure system. There is a large body of national policy established in the form of regulations, directives, Presidential Executive Orders, and Office of Management and Budget (OMB) Circulars that forms the basis for procedures to handle and process Federal information, particularly classified information. These are presented and discussed in Appendix A, "Historical Basis." The business of computers, security, and acquisitions is complex and dynamic. As the Director, National Computer Security Center, l invite your recommendations for revision to this technical guideline. Our staff will work to keep it current. However, experience of users in the field is the most important source of timely information. Please send comments and suggestions to; National Security Agency 9800 Savage Road Fort George G. Meade, MD 20755-6000 ATTN: Standards, Criteria, and Guidelines Division December 1992 Patrick R. Gallagher Director National computer Security Center Page 11
Page 1 and 2: A Guide to the Procurement of Trust
Page 3 and 4: 2.5.1.6 OBLIGATION AUTHORITIES 2.5.
Page 5 and 6: SPECIFICATION) 3.3.3.2 PROGRAMMING
Page 7 and 8: 5.3.2 OPERATIONAL TEST AND EVALUATI
Page 9: 7.4.1.1 LOW COST 7.4.1.1.1 HARDWARE
Page 13 and 14: LIST OF FIGURES Figure 1-1 How to U
Page 15 and 16: 1 GENERAL INFORMATION 1.1 INTRODUCT
Page 17 and 18: person. In either case, the princip
Page 19 and 20: 1.8.3.1 SCI REQUIREMENTS The SSO ca
Page 21 and 22: y the National Security Agency - Co
Page 23 and 24: called the PPBS. The PPBS is the of
Page 25 and 26: The safest way to communicate with
Page 27 and 28: PMD. The PMP specifically describes
Page 29 and 30: This documentation describes a full
Page 31 and 32: B C D E F G H I J K L M Supplies or
Page 33 and 34: f. DoD Instruction 7110.1, "DoD Bud
Page 35 and 36: 5200.28-STD. 3.2.1 SECURITY POLICY
Page 37 and 38: sites. 3.2.2.2 THE REQUIREMENTS Eac
Page 39 and 40: architecture must also separate eac
Page 41 and 42: Software matters require structure
Page 43 and 44: Each TCB division/class requires a
Page 45 and 46: software must be protected at the h
Page 47 and 48: Dealing effectively with security-r
Page 49 and 50: Whenever possible, the hardware spe
Page 51 and 52: As soon as composition and interfac
Page 53 and 54: such as memory, tapes, disk(ette)s,
Page 55 and 56: The SSCONOPS is an architectural-le
Page 57 and 58: any stored information is to be tre
Page 59 and 60: maintain the system, and how the sy
Page 61 and 62:
4.6.2 PERFORMING A SUBJECTIVE ANALY
Page 63 and 64:
g. NCSC-TG-011, "Trusted Network In
Page 65 and 66:
5.2.4 THE EVALUATION PROCESS The NS
Page 67 and 68:
parent organization/agency. OT&E us
Page 69 and 70:
FOT&E is operational testing conduc
Page 71 and 72:
Procedures" - Part 8 of this instru
Page 73 and 74:
Risk Analysis Cost/Benefit Analysis
Page 75 and 76:
evaluation. Countermeasure(s) will
Page 77 and 78:
Other Pertinent Documents (e.g., co
Page 79 and 80:
important task in the basic evaluat
Page 81 and 82:
6.5.2.2 SUPPORTING DOCUMENTATION Th
Page 83 and 84:
Here, permission to Operate might b
Page 85 and 86:
(1) "Introduction to C&A Concepts"
Page 87 and 88:
Program management is a necessary i
Page 89 and 90:
The Program Manager is responsible
Page 91 and 92:
have a separate System Security Con
Page 93 and 94:
This is a major support plan for mo
Page 95 and 96:
that combined set which best fits t
Page 97 and 98:
automated information system securi
Page 99 and 100:
concepts for documents developed to
Page 101 and 102:
APPENDIX A HISTORICAL BASIS A.1 INT
Page 103 and 104:
. National Security Decision Direct
Page 105 and 106:
Provides detailed tasking, outlines
Page 107 and 108:
A. Cover Sheet and Contract FOrm Ge
Page 109 and 110:
Supply Support Plan Specifies how c
Page 111 and 112:
SSR-30 Formal Top-Level Specificati
Page 113 and 114:
Certification Plan Chapter: 6,7, 03
Page 115 and 116:
Chapter: 3, 03 Reference: DoD 5200.
Page 117 and 118:
List of Documents, Exhibits, and Ot
Page 119 and 120:
Reference: DoD 5000.2-M Proposal Ev
Page 121 and 122:
Reference: DoDI 5000.2 (Sect 6D), D
Page 123 and 124:
Reference: DoD-STD-21 67A, DoD-STD-
Page 125 and 126:
DoD 5010.12-L, "Acquisition Managem
Page 127 and 128:
Gasser, M., Buildinq a Secure Compu
Page 129 and 130:
Trusted Systems," September 1, 1991
Page 131 and 132:
DoD Directive 5100.36," Defense Sci
show all

Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?