The links for security and privacy forms and templates listed below have been divided by functional areas to better assist you in locating specific forms associated with security and/or privacy related activities that are described elsewhere in the NCI IT Security Website.

Prepare (RMF Step "0")

• ATO Schedule

Categorize System and Select Controls (FISMA Starter Kit) (RMF Steps 1 & 2)

• FIPS-199 System Categorization (FIPS-199) 
  • NIST SP 800-60 Volume 1 (Mapping Guidelines)
  • NIST SP 800-60 Volume 2 (Information Types w/ provisional security impact level assignments)
• E-Authentication Risk Assessment (E-Auth)
• Privacy Impact Assessment (PIA) (right click and save to open)
• NCI Business Impact Analysis (BIA)

Implement Controls (RMF Step 3)

System Security Plans (SSPs)

• • FISMA Moderate SSP (for non-cloud systems categorized as Moderate only)

• FISMA Low SSP (for non-cloud systems categorized as Low only)
  
  
  • NIH Information Security Policy Handbook (Security Policies and Security Control Implementation Requirements)
    (FOUO - Request from NCI ISSO Office)

System Standard Operating Procedure (SOP) templates

• • NCI Identity and Access Management (IdAM)
  • NCI Audit Management
  • NCI System Physical and Environmental Control
  • NIH IT General Rules of Behavior (RoB)

Configuration management

• • • Configuration Management Plan (CMP)
    • NIH Memorandum of Understanding (MOU)
    • Interconnection Security Agreement (ISA)
    • HHS/NIH Department Standard Warning Banner

Contingency planning and disaster recovery templates

• • • NIH Contingency Plan (CP)
    • NIH Contingency Test Plan and After-Action Report

Incident response planning templates 

• • • NIH Incident Response Plan (IRP)
    • NIH Incident Response Plan Test

 Assess Controls (RMF Step 4)

• Security Assessment Plan (SAP)
• Security Assessment Report (SAR)
• Plan of action and milestones (POA&M)

Authorize System (RMF Step 5)

• Authority To Operate Letter (ATO)

Monitor System (RMF Step 6)

• Security Impact Analysis (SIA)
• Annual Assessment (AA) Guidance
  • AA Security Control Matrix by Fiscal Year (list of security controls to be assessed during AA)
    • AA Supplemental Testing Guidance (guidance on testing and evidence to be requested during AA)