1.      Select and incorporate appropriate management, technical, and operational security controls into a system security plan.

2.      Integrate and evaluate management, technical, and operational controls in the context of an information security program.

3.      Develop a sample System Security Plan for an information system.

Selected organization is the State of Maryland. 

 Project 3: Sample Cybersecurity Profile (System Security Plan)

Overview

Every organization must create a cybersecurity profile (system security plan (SSP)) for all of its major and minor information systems. The cybersecurity profile documents the current and planned controls for the system and addresses security concerns that may affect the system’s operating environment. The cybersecurity profile includes security categorizations and security controls, and is included in the certification and accreditation package. For this project, you will create a sample cybersecurity profile describing the security posture of your selected organization.

Learning Objectives

After completing this project, students will be able to

1.      Select and incorporate appropriate management, technical, and operational security controls into a system security plan.

2.      Integrate and evaluate management, technical, and operational controls in the context of an information security program.

3.      Develop a sample System Security Plan for an information system.

Deliverable

Your sample cybersecurity profile should be at least 5 full pages, double spaced, 1-inch margins, in New Times Roman 12-pitch font, with a cover page (name, course number, date, title of paper) and a reference page. The cover page and reference page are not included in the five-page minimum. Papers not meeting the five full-page minimum will lose points. You must have at least three sources, correctly formatted per APA guidelines. Submit your research paper to the appropriate TurnItIn assignment area by the due date.

Detailed Description of Learning Activity

1.      Review NIST SP 800-53A, Rev 4 Assessing Security and Privacy Controls in Federal Information Systems and Organizations

2.      Select three (3) security controls that apply* to your selected organization. Each primary security control is designated as a Familycontrol. Examples of Family controls include Access Control or Awareness and Training.

3.      Describe each Family control. Include why these controls are required.

4.      For each Family Control (i.e., Access Control) select two Control Enhancements (i.e., Account Management (AC-2).

5.      Describe each Control Enhancement, state the implementation status as it relates to your selected organization’s security program, and describe how your selected organization implements the control.

6.      Write your sample cybersecurity profile. At a minimum, the profile should include

Ø  an Introduction that includes the purpose of your paper and introduces security profiles as they relate to your selected organization

Ø  an Analysis section that includes Items 2 – 5

Ø  a Conclusion that summarizes your assessment findings (you will use the findings for Project 4).

7.      Use spell and grammar check before submitting. It is also a good idea to have someone else read your paper. You should also review the grading rubric to ensure that you have all the graded components.

8.      Submit the project to TurnItIn and the classroom by the due date.

* Do not select a control if you cannot find any information about the control in the organization’s security documentation.