Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Appendix D. Systems With Outdated Security Baseline Controls
In the evaluation, we assessed a sample of 30 systems (see Appendix I) to determine
whether the systems were in compliance with National Institute of Standards and Technology
(NIST) Special Publication (SP) 800-53 Revision 3, Recommended Security Controls for
Information Systems (August 2009) (last updated May 1, 2010). NIST SP 800-53 Revision 3
provides guidelines for selecting and specifying security controls (management, operational, and
technical) for information systems supporting the executive agencies of the Federal Government
to meet the requirements of FIPS 200, Minimum Security Requirements for Federal Information
and Information Systems.
Table 1 lists the systems for which security controls have not been updated to comply
with NIST SP 800-53 Revision 3. 1
Table 1. Systems With Outdated Security Baseline Controls
Sample # Bureau Name Package Type FIPS Compliance
Name No. Categorization (Y/N)
1 A ILMS 830 UNCL M N
2 CA IVAMS 97 UNCL M N
3 CA FEP 344 UNCL M N
4 CA PLOTS 346 UNCL M N
5 CA CLASS 558 UNCL H N
6 CA MIS 724 UNCL M N
7 CA OPSS 898 UNCL M N
8 CA PLMS 4547 UNCL M N
9 DS CMS 424 UNCL M N
10 DS SIMAS 798 UNCL M N
11 DS IDMS 1000 UNCL M N
12 EUR EXTRANE
T
1140 UNCL L N
1
OMB Memorandum M-11-33 FY 2011 FAQs states that agencies are expected to be in compliance with NIST
standards and guidelines within one year of the publication date unless otherwise directed by OMB.
48
UNCLASSIFIED