applying assessment authorization a a in the

Before starting the A&A process, you should review your sponsorship documentation and security classification guidance, review the materials on the DCSA Risk Management Framework (RMF) website, and contact your local Information System Security Professional (ISSP) with any questions or concerns.

The RAR documents the results of the risk and threat assessment and influences the selection of security controls used to mitigate the risk associated with the Information System.

The three main outputs of the Categorize Step are a System Description, an updated NISP eMASS System Record, and the System Categorization.

The IO is the authority for determining categorization and must be involved in the process of categorizing the data and system.

The types of security controls defined in the Select Step are system-specific, common, and hybrid controls.

Continuous monitoring is used to determine whether the planned security control implementation is acceptable and includes configuration management and control, security impact analyses on proposed changes, assessment of selected security controls, and security status reporting.

The final task is registering the system in the NISP eMASS instance.

The DCSA baseline categorization is a Moderate impact due to loss of confidentiality and a Low impact due to loss of integrity or availability.

The ISSM implements the security controls identified in the Security Control Selection and documents the implementation while looking for any weaknesses.

Tailoring security controls allows the ISSM to supplement the baseline with additional controls or to remove controls that do not apply or are satisfied by mitigating factors, providing justification in the security plan.

NISP eMASS is the government-owned, web-based application that manages the A&A process and is used to populate information and upload artifacts, including generating a Security Plan.