NIST Guidance

NIST 800-18 § 2 defines the methodology for identifying the boundaries of information systems. Before the system security plan can be developed, the information system and the information resident within that system must be categorized based on a FIPS 199 impact analysis. Then a determination can be made as to which systems in the inventory can be logically grouped into major applications or general support systems. The process of uniquely assigning information assets to an information system defines the security boundary for that system. While there is no set rule for a strict definition of which assets should be included, NIST 800-18 does give a few guidelines:

• Each asset should generally be under the same direct management control. Subsystems typically fall under the same management authority and are included within a single system.

• Each asset should the same function or mission objective and essentially the same operating characteristics and security needs.

• Each asset should reside in the same general operating environment (or in the case of a distributed information system, reside in various locations with similar operating environments).

The process of establishing boundaries for agency information systems and the associated security implications, is an agency-level activity that should include careful negotiation among all key participants—taking into account the mission/business requirements of the agency, the technical considerations with respect to information security, and the programmatic costs to the agency.

The categories that a system should be assigned to are major application, general support system, and minor application.

Certain applications, because of the information they contain, process, store, or transmit, or because of their criticality to the agency's mission, require special management oversight. These applications are major applications. Major applications are systems that perform clearly defined functions for which there are readily identifiable security considerations and needs (e.g., an electronic funds transfer system). A major application might comprise many individual programs and hardware, software, and telecommunications components. These components can be a single software application or a combination of hardware/software focused on supporting a specific, mission-related function. A major application may also consist of multiple individual applications if all are related to a single mission function (e.g., payroll or personnel).

A general support system is an interconnected set of information resources under the same direct management control that shares common functionality. A general support system normally includes hardware, software, information, data, applications, communications, facilities, and people and provides support for a variety of users and/or applications. Common general support systems include:

• The organizational backbone network (WAN/MAN)

• The facility LAN

• The facility VOIP system

• The data center and MDF/IDFs

• Shared storage or shared application systems

The backup or replication system

Minor applications are those applications that neither fall into the major application nor general support systems categories.

NIST 800-18, Appendix A, lists all of the key information that must be recorded for a system within the System Security Plan:

1. Information System Name/Title: Unique identifier and name given to the system.

2. Information System Categorization: Identify the appropriate FIPS 199 categorization.

3. Information System Owner: Name, title, agency, address, email address, and phone number of person who owns the system.

4. Authorizing Official: Name, title, agency, address, e-mail address, and phone number of the senior management official designated as the authorizing official.

5. Other Designated Contacts: List other key personnel, if applicable; include their title, address, e-mail address, and phone number.

6. Assignment of Security Responsibility: Name, title, address, e-mail address, and phone number of person who is responsible for the security of the system.

7. Information System Operational Status: Indicate the operational status of the system. If more than one status is selected, list which part of the system is covered under each status.

8. Information System Type: Indicate if the system is a major application or a general support system.

9. General System Description/Purpose: Describe the function or purpose of the system and the information processes.

10. System Environment: Provide a general description of the technical system. Include the primary hardware, software, and communications equipment.

11. System Interconnections/Information Sharing: List interconnected systems and system identifiers (if appropriate), provide the system, name, organization, system type (major application or general support system), indicate if there is an ISA/MOU/MOA on file, date of agreement to interconnect, FIPS 199 category, C&A status, and the name of the authorizing official.

12. Related Laws/Regulations/Policies: List any laws or regulations that establish specific requirements for the confidentiality, integrity, or availability of the data in the system.

13. Minimum Security Controls: Provide a thorough description of how the minimum controls in the applicable baseline are being implemented or planned to be implemented. The controls should be described by control family and indicate whether it is a system control, hybrid control, common control, if scoping guidance is applied, or a compensating control is being used.

14. Information System Security Plan Completion Date: Enter the completion date of the plan.

15. Information System Security Plan Approval Date: Enter the date the system security plan was approved and indicate if the approval documentation is attached or on file.

NIST 800-26, § 2.1 covers the same topic as does NIST 800-18, but not in as much detail.

As a part of system characterization, NIST 800-30, § 3.1 defines the methodology by which the inputs of hardware, software, system interfaces, data and information, staff and third party usage, and the system’s mission define the system’s boundary. Identifying risk for an IT system requires a keen understanding of the system’s processing environment. The person or persons who conduct the risk assessment must therefore first collect system-related information, which is usually classified as follows:

• Hardware

• Software

• System interfaces (e.g., internal and external connectivity)

• Data and information

• Persons who support and use the IT system

• System mission (e.g., the processes performed by the IT system)

• System and data criticality (e.g., the system’s value or importance to an organization)

• System and data sensitivity

• Additional information related to the operational environmental of the IT system and its data includes, but is not limited to, the following:

• The functional requirements of the IT system

• Users of the system (e.g., system users who provide technical support to the IT system; application users who use the IT system to perform business functions)

• System security policies governing the IT system (organizational policies, federal requirements, laws, industry practices)

• System security architecture

• Current network topology (e.g., network diagram)

• Information storage protection that safeguards system and data availability, integrity, and confidentiality

• Flow of information pertaining to the IT system (e.g., system interfaces, system input and output flowchart)

• Technical controls used for the IT system (e.g., built-in or add-on security product that supports identification and authentication, discretionary or mandatory access control, audit, residual information protection, encryption methods)

• Management controls used for the IT system (e.g., rules of behavior, security planning)

• Operational controls used for the IT system (e.g., personnel security, backup, contingency, and resumption and recovery operations; system maintenance; offsite storage; user account establishment and deletion procedures; controls for segregation of user functions, such as privileged user access versus standard user access)

• Physical security environment of the IT system (e.g., facility security, data center policies)

• Environmental security implemented for the IT system processing environment (e.g., controls for humidity, water, power, pollution, temperature, and chemicals).

NIST 800-53, SC-7 discusses the need system boundary controls, which imply that the system’s boundaries have to first be identified.