NIH | National Cancer Institute | NCI Wiki  

Versions Compared

Old Version 7

changes.mady.by.user Hayn, Craig (NIH/NCI) [E]

Saved on

compared with

New Version 8

changes.mady.by.user Unknown User (scotterr)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
√

Contractor Hosted ATOaaS (Third PartyLow)*Cloud Hosted*CBIIT Fully ManagedLowModerateNCI Customer Managed and Co-LocationHigh
FIPS-199 Security Categorization√√√√
e-Authentication Risk Assessment√√√√

Privacy Impact

Analysis

Assessment (PIA)



√√√
System Security Plan (SSP)√√√√
IS

Contingency Plan

(includes disaster recovery/incident response plans)

√√√√
Business Impact Analysis √ (may embed with ISCP)√ (may embed with ISCP)
√ (may embed with ISCP)
√ (may embed with ISCP)

IS Contingency Plan Exercise Report

  • Tabletop (Low (L) availability only)
  • Simulated (L/M/H)
  • Functional (L/M/H)
√√√
  • the Tabletop option is available to any systems with a "Low" rating for availability

√

Tabletop

√

Tabletop

√

Simulated
or
Functional

√

Simulated
or
Functional

√

Memorandum of Understanding (MoU) and/or Interconnection Security Agreement (ISA)As neededAs neededAs neededAs needed
Security (Control) Assessment Plan (SAP/SCAP)√√√√
Security Assessment Report (SAR)√√√√
Configuration Management Plan (CMP)√√√√
Plan of Action and Milestones (POA&M)√√√√
Signed ATO or Endorsement Letter √√√√

These requirements apply to all NCI federal systems regardless of hosting location:

Contractor/Third Party Hosted
CBIIT Managed
Customer Managed
Co-Location
Cloud

* All security packages including the ATO letter for externally hosted systems (i.e., 3rd party and Cloud) should be electronically copied to the NCI ISSO as evidence that the SA&A was completed in accordance with NIST 800-37 Risk Management Framework.