-: Now let's move on to step number three, 2 2
where we'll select the controls 3 3
that will protect your system and the information 4 4
that's contained with it. 5 5
And just a quick reminder, 6 6
controls are the things your organization implements 7 7
to meet your cybersecurity supply chain 8 8
and privacy requirements. 9 9
Controls can be technical, administrative, or even physical. 10 10
In addition, controls can be sorted into preventative, 11 11
detective, or corrective categories. 12 12
Let's get into the six tasks 13 13
that are inside of step number three. 14 14
At the end of Task S-1, 15 15
you'll have selected the controls you need 16 16
for your system and environment. 17 17
RMF says you can select controls in one of two ways. 18 18
The first approach is called baseline control selection 19 19
while the second approach is called 20 20
an organization generated control selection. 21 21
Now, the first approach, a baseline control selection 22 22
is when you choose a pre-written set of controls 23 23
that was made to help your organization 24 24
with their security and privacy needs. 25 25
In contrast, an organization generated selection approach 26 26
is more of a do it yourself way to go, 27 27
and you don't start with a predefined set of controls. 28 28
If you do it yourself, you'll create 29 29
and use your own selection process to choose controls. 30 30
This approach may be necessary 31 31
if your system is very specialized, 32 32
such as a weapon system or a medical device, 33 33
or you may need to take this approach 34 34
if your system has a limited purpose, 35 35
such as a smart meter. 36 36
The do it yourself approach is more of a bottom up method 37 37
but it could be more cost effective 38 38
than the baseline control selection approach 39 39
depending on your situation. 40 40
Let's look now at Task S-2. 41 41
When you finish it, you'll have a collection 42 42
of tailored controls that are selected for your system 43 43
and the environment that it operates in. 44 44
You can use your risk assessments 45 45
to guide this tailoring part of the process, 46 46
and then you can modify it further 47 47
based on your organization's budget and other requirements. 48 48
Once you have your list of tailored controls, 49 49
you'll use it to complete Task S-3, 50 50
which is called control allocation. 51 51
In this task, the controls will be designated 52 52
as either system specific, hybrid, or common controls. 53 53
Let me explain each one. 54 54
Common controls satisfy security and privacy requirements 55 55
at the organization level and are inherited 56 56
by one or more systems may be yours. 57 57
Hybrid controls are partially inherited 58 58
by one or more systems, 59 59
which means your system may or may not inherit controls 60 60
that other systems inherit. 61 61
And finally, system specific controls 62 62
provide a protective function for a single system. 63 63
Now, after you've designated the controls 64 64
then what you do next is you allocate them 65 65
to their respective parts of the system. 66 66
When you finish Task S-4, 67 67
you'll have good documentation of the controls 68 68
that you plan to implement. 69 69
The documentation of your controls should be included 70 70
in your security and privacy plans. 71 71
You should also decide if you want your security 72 72
and privacy plans to be separate 73 73
or to put them together into a single document. 74 74
In Task S-5 five, you'll develop and implement a plan 75 75
for how you'll continue to monitor the effectiveness 76 76
of the controls that you put into place. 77 77
And this plan will define things 78 78
like how changes to your system will be monitored 79 79
and how risk assessments are to be conducted in the future. 80 80
You'll also define reporting requirements. 81 81
Continuously monitoring your controls at a system level 82 82
is an important aspect of managing the ongoing risk 83 83
to your system. 84 84
You'll also need to decide how often 85 85
to review your controls based on your protection needs 86 86
as well as the criticality of each control. 87 87
So I want you to ask yourself, 88 88
how dire will the situation be if one of your controls 89 89
for a specific part of your system should fail? 90 90
Now, answering this question should help guide your decision 91 91
about assessment frequency. 92 92
By the end of tasks S-6, 93 93
you'll have a complete list of controls 94 94
inside your security and privacy plans 95 95
that have been reviewed and approved 96 96
by your authorizing official, 97 97
which is a major RMF milestone.