NIH | National Cancer Institute | NCI Wiki  

Versions Compared

Old Version 3

changes.mady.by.user Hayn, Craig (NIH/NCI) [E]

Saved on

compared with

New Version Current

changes.mady.by.user Unknown User (scotterr)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
NCI Customer Managed and Co-Location√√ Analysis√IS Contingency Plan√ (may embed with ISCPIS
  • Tabletop (Low (L) availability only)
  • Simulated (L/M/H)
  • Functional (L/M/H)
√ (Control) /SCAP√Configuration Management (CMP)Plan √
Artifact NameFAST ATO (LowContractor Hosted (Third Party)Cloud HostedCBIIT Fully ManagedLowModerate
FIPS-199 Security Categorization√√√
e-Authentication Risk Assessment√√√

Privacy Impact

Assessment (PIA)



√
Business Impact Analysis
√
√
System Security Plan (SSP)√√√√
Configuration Management Plan (CMP)√√√√Business Impact Analysis

Contingency Plan

(includes disaster recovery/incident response plans

)

√√√

Contingency Plan Exercise Report

  • the Tabletop option is available to any systems with a "Low" rating for availability

√

Tabletop

√

Tabletop

√

Simulated
or
Functional

√√√

Memorandum of Understanding (MoU) and/or Interconnection Security Agreement (ISA)As neededAs neededAs needed
Security Assessment Plan (SAP)√√√√
Security Assessment Report (SAR)√√√
Plan √√√√ of Action and Milestones (POA&M)√√√
Self Attestation√

Signed ATO Letter√√√

These requirements apply to all NCI federal systems regardless of hosting location:

Externally (Contractor/Third Party) Hosted
CBIIT Managed
Customer Managed
Co-Location
Cloud