Information Systems Security Manager (ISSM) - Marine Corps ...

NAVSO P-5239-04SEPTEMBER 1995TABLE OF CONTENTSSecurity Awareness........................................................................................................................... 263.6 Physical Security............................................................................................................ 28Responsibility ....................................................................................................................................... 28Implementation ..................................................................................................................................... 28Facility Access.................................................................................................................................. 28User Identification and Authentication ............................................................................................. 29Data Access ...................................................................................................................................... 29Environmental Hazards Protection ................................................................................................... 29TEMPEST ........................................................................................................................................ 303.7 Auditing ......................................................................................................................... 32Responsibility ....................................................................................................................................... 32Implementation ..................................................................................................................................... 32Audit Procedures .............................................................................................................................. 32Audit Trail ........................................................................................................................................ 323.8 Incident and Violations Reporting ................................................................................. 34Responsibility ....................................................................................................................................... 34Implementation ..................................................................................................................................... 34Incident Reporting Mechanism ......................................................................................................... 34Incident Analysis .............................................................................................................................. 35Security Vulnerabilities and Problems .............................................................................................. 353.9 Security Configuration Management ............................................................................. 36Responsibility ....................................................................................................................................... 36Implementation ..................................................................................................................................... 363.10 Contingency Planning ..................................................................................................38Responsibility ....................................................................................................................................... 38Implementation ..................................................................................................................................... 383.11 Security Documentation............................................................................................... 40Activity INFOSEC Plan (ISSP) ............................................................................................................. 40System Security Plan............................................................................................................................. 40Risk Assessment ................................................................................................................................... 41ST&E Documentation ........................................................................................................................... 41Activity Accreditation Schedule (AAS) ................................................................................................ 43IS Incident Report ................................................................................................................................. 43Authorized User List ............................................................................................................................. 43Security Operating Procedures .............................................................................................................. 43Training and Awareness Documentation ............................................................................................... 43Contingency Plan .................................................................................................................................. 44APPENDIX -- Security Policy, Procedure, and Guidance DocumentationA-1iv