For this week’s discussion you are asked to create a 3-5 paragraph “talking points” paper in which you discuss the (CA) family of security controls. You should identify and discuss at least three specific controls from this family. Focus on how these controls provide for implementation of assessment, authorization, and monitoring functions to protect the organization’s information and information systems. CA-5, for example, calls for developing a specific plan of action and milestones to track security controls implementation. CA-2 requires that all security controls be assessed to determine if they are working as intended.
Your talking points will be incorporated into a budget presentation and, for that reason, should support (explain) the Office of Risk Management’s planned activities in this area for the next fiscal year. Full paragraphs are preferred for a talking points paper, but you may use a limited number of bullet points. Remember to use and cite authoritative sources in your work. Place your list of references at the end of your paper.
Remember to submit your discussion response to the Turn It In for Discussions assignment folder. See the forum instructions for more information.
For your critiques, focus on providing suggestions for strengthening the original poster’s analysis of the CA controls. Include at least 3 examples and/or content suggestions supported by your own readings (include citations and references for authoritative sources). For full credit, a total of two critiques and two additional responses or follow-up postings are required in addition to your main posting.
In the discussion for this week, you and your peers will be analyzing the CA family of security controls. These controls provide for implementation of assessment, authorization, and monitoring functions to protect information and information systems. CA-5, for example, calls for developing a specific plan of action and milestones to track security controls implementation. CA-2 requires that security controls be assessed to determine if they are working as intended.
Week 3 Readings:
Chapter 4 in the (ISC2) SSCP Systems Security Certified Practitioner Official Study Guide, 3rd Ed. Available from the UMGC online library (UMGC student login required). https://go.oreilly.com/umgc/https://learning.oreilly.com/library/view/isc-2-sscp-systems/9781119854982/
Review Section 3.4 Assessment, Authorization, and Monitoring in NIST SP 800-53 rev 5. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
