I-Assure Forums / DIACAP Toolset / Suggestions and Feature Requests / FISMA, NIST, OMB and PII information listings / Latest Posts

RE: FISMA, NIST, OMB and PII information listings

ult — Wed, 28 Oct 2009 23:32:15 GMT

Agreed, we are curious as well. What is the status of the FISMA tool?

RE: FISMA, NIST, OMB and PII information listings

swentz — Fri, 16 Jan 2009 13:21:28 GMT

What is the status on the release of a FISMA tool?

RE: FISMA, NIST, OMB and PII information listings

Admin — Mon, 11 Aug 2008 18:59:28 GMT

Will need "Edwards" to answer..........didn't come from I-Assure

RE: FISMA, NIST, OMB and PII information listings

forum-newbie — Mon, 11 Aug 2008 15:28:49 GMT

Not sure I understand all the entries in these estimates. Especially the cost per 100,000 ... 100,000 what? Is that some sort of estimate of the size of the system being evaluated?

If the system is bigger or smaller, how do those numbers change?

RE: FISMA, NIST, OMB and PII information listings

edwards — Tue, 05 Feb 2008 09:09:01 GMT

Junior Member

Your reference to DCID 6/3, FISCAM sounds like the Computer Network Defence Service Provider (CNDSP) rating that was found in E3.3.1 in the Interim DIACAP July 2006. This process required an organization to certify their backbone utilizing the DISA Evaluators Scoring Matrix that consisted of 120 Section two parts (Provider, User) with over 640 bulleted questions that reference your four documents. The problem was that the bullets had no matrix pointing to which document the bullet was applied from.

RE: FISMA, NIST, OMB and PII information listings

edwards — Tue, 05 Feb 2008 09:04:42 GMT

yo, snowball inform your management of the following cost estimate to do a C&A based on the DITSCAP process.

		Manual	C&A			Step 5	Hourly Wage
						GS15	$56.45
	Regs	Man-Hour	Time	Cost		GS14	$47.99
		$41.57				GS13	$40.61
SSAA		$41.57	80	$3,325.76		GS12	$34.32
						GS11	$28.49
Acronyms	2	$41.57	0.15	$12.47		TOTAL Hourly Wage	$207.86
Definitions	2	$41.57	0.15	$12.47		Average Hourly Wage	$41.57
References	2	$41.57	0.5	$41.57
CONOPS	1	$41.57	80	$3,325.76		NSS (FISMA)	0
ISSP	1	$41.57	100	$4,157.20		NIST	0
SRTM	2	$41.57	120	$9,977.28		OMB	0
CT&E	2	$41.57	120	$9,977.28		other agencies	2
ST&E	2	$41.57	120	$9,977.28		Total	2
ASDA/SD	1	$41.57	187	$7,773.96		CMP, SFUG, TFM
SROB	1	$41.57	10	$415.72		NSS Documents
IRP	1	$41.57	100	$4,157.20		EO	8
COOP	1	$41.57	100	$4,157.20		PDD	2
PC/TSC	1	$41.57	200	$8,314.40		HSPD	3
MOA/MOU/ISA	1	$41.57	10	$415.72		PM	4
SETAP	1	$41.57	200	$8,314.40		NSPD	2
TER	1	$41.57	100	$4,157.20		PL	30
RRAR/POAM	1	$41.57	120	$4,988.64		Total	49
CAL	1	$41.57	1	$41.57


		Total	Cost	$83,543.09	per	100,000	$8,354,309,120.00

Note this does not include the classification levels of doing a C&A nor does include any meetings or ad hoc meetings to fix things.

	DIACAP	Manual	C&A			Step 5	Hourly Wage
						GS15	$56.45
	Regs	Man-Hour	Time	Cost		GS14	$47.99
		$41.57				GS13	$40.61
SIP		$41.57	80	$3,325.76		GS12	$34.32
Scorecard	1	$41.57	100	$4,157.20		GS11	$28.49
POAM	1	$41.57	120	$4,988.64		TOTAL Hourly Wage	$207.86
DIP	1	$41.57	120	$4,988.64		Average Hourly Wage	$41.57
CA Letter	1	$41.57	1	$41.57
ATO/IATO Letter	1	$41.57	1	$41.57		NSS (FISMA)	0
						NIST	0
CT&E	2	$41.57	120	$9,977.28		OMB	0
ST&E	2	$41.57	120	$9,977.28		other agencies	2
IRP	1	$41.57	100	$4,157.20		Total	2
CP	1	$41.57	100	$4,157.20		CMP, SFUG, TFM
CMP	1	$41.57	200	$8,314.40		NSS Documents
MOA/MOU/ISA	1	$41.57	10	$415.72		EO	8
SETAP	1	$41.57	200	$8,314.40		PDD	2
						HSPD	3
						PM	4
						NSPD	2
						PL	30
						Total	49


		Total	Cost	$62,856.86	per	100,000	$6,285,686,400.00

RE: FISMA, NIST, OMB and PII information listings

Admin — Fri, 18 May 2007 08:30:29 GMT

We are shooting for 1 June. Been hard at work on a new DIACAP Toolset release. The new DIACAP Toolset release will incorporate the ability to add the ~27 FISMA IA controls that do not map directly to the 8500.2 IA controls as Supplemental IA Controls to new or existing projects.

RE: FISMA, NIST, OMB and PII information listings

Forumnewbie3 — Wed, 16 May 2007 16:59:27 GMT

Any update as to when the FISMA Toolset will be available.

For all you do, Thanks!

RE: FISMA, NIST, OMB and PII information listings

Newbie2 — Tue, 10 Apr 2007 12:48:28 GMT

The chances of persuading my organization to pay $1200.00 for a tool for me are somewhere between a snowball's chance in Bermuda and none. Even though I absolutely see the value, I don't think my chain-of-command would cough up the bucks for me. I would just have to keep "cyber-schlepping" back and forth between Federal, DoD, and AF Level, wading through the adminisphere and documenutia (I think these are "Dilbertisms") - doing things the hard way. Anything you guys do to make that less painful is most welcome and appreciated. My sincere thanks to I-Assure for the tool and this venue; and thanks to other members, too, I learn something every time I visit.

RE: FISMA, NIST, OMB and PII information listings

Admin — Tue, 10 Apr 2007 11:31:46 GMT

Thanks. We are using that table as a basis for combining NIST and DoDI 8500.2 IA controls in the future. Also, we decided to give the FISMA Toolset away for free, so look for it by end of april.

Thanks

RE: FISMA, NIST, OMB and PII information listings

Newbie2 — Tue, 10 Apr 2007 10:33:58 GMT

There is a table in NIST SP 800-53 that I find helpful in this area. Appendix G of this pub consists of IA Controls with references to ISO, NIST, GAO FISCAM, DoD 8500.2 and DCID 6/3. Now, to be honest, I don't even know what one or two of those are, but it is very helpful to me as a "translator" between NIST, ISO and DoD/DCID references. It gives you the Control name and the numbers each of those entities associates with that particular control. It's one of the references I consider "hardcopy worthy". I hope it helps you too.

RE: FISMA, NIST, OMB and PII information listings

Admin — Tue, 13 Mar 2007 10:58:36 GMT

We will be releasing the I-Assure FISMA Toolset in the coming weeks. It will have the same look, feel and fucntionality as the DIACAP Toolset, with one major difference--it will be a pay-for tool. Licensing is expected to be $1200.00/seat with site and enterprise licensing options. The FISMA Toolset will support the SP800-53 IA Controls, Supplemental Guidance, IA Control Enhancements and Validation procedures.

RE: FISMA, NIST, OMB and PII information listings

Tue, 13 Mar 2007 10:01:16 GMT

DIACAP is based on DODI 8500.2 controls not the NIST SP 800-53 controls. For DOD the I-Assure software is ok. For Federal systems other than DOD a different set of controls is needed.

Cheers
Vern

FISMA, NIST, OMB and PII information listings

jaylangham — Mon, 12 Mar 2007 15:02:56 GMT

I just downloaded and played with the tool today. I have a few recommendations/questions.

DIACAP requires using the NIST 800-53 yet I don't see a recognizable 53 mapping (looking for the 21 families) for requirements. Did I miss it?

OMB requirements are also not truly defined for Personal Information in Identifiable Form (PII or IFF data) HSPD-12 should be the source. (NIST has promised a PII authoritative reference but has not delivered)

FISMA / NIST applications could be an easy inclusion for the tool. (I'm looking at contractors that are trying to meet DoD and Federal standards)

Also, the standardized testing for the requirements could be included.