|
|
|
Junior Member
 
Group: Forum Members
Last Login: 8/10/2009 4:18:52 PM
Posts: 17,
Visits: 78
|
|
Admin (12/15/2006)
Also, we have been discussing internally why there is even an "Implementation Plan" in the DIACAP. We feel most people will start with the ScoreCard and use the POA&M to capture the info in the "Implementation Plan". Thoughts?
As I understand it the implementation plan provides the 'as is' view and the POA&M provides the 'will be' view of the package.
|
|
|
|
|
Supreme Being
Group: Administrators
Last Login: 8/24/2010 8:37:01 PM
Posts: 292,
Visits: 690
|
|
| Fully agree, but the two Implementation Plan (IP) and ScoreCard are fairly duplicative. In a perfect world, I can definately see the need for the IP for new development, but for systems already in production and transitioning, they should go straight to the ScoreCard and POA&M. Also, the POA&M captures the info that is in the IP, so starting at the ScoreCard/POA&M builds a nice historical record for bringing a control into compliance. 6 on hand, half dozen the other--personally prefer not to duplicate info
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 4/4/2008 10:56:03 AM
Posts: 7,
Visits: 10
|
|
| I think the implementation plan should feed the scorecard and the POA&M should pull from the implementation plan (especially responsible entity to POC and resource to resource required). Also I think the IA conrtol validation procedures should be a full tab, not a sub tab in the scorecard. The validation procedures should pull from the implementation plan as well, that way you have validation steps and can score based on results. The report header should be somewhat customizable, maybe pull the header from a config file (xml or http), place to put logo, and place to put classification marking (confidentiality statement, which can be modified for government classification markings).
If not you, then who!
|
|
|
|
|
Supreme Being
Group: Administrators
Last Login: 8/24/2010 8:37:01 PM
Posts: 292,
Visits: 690
|
|
| Like the idea on pulling POA&M values from SIP--will implement shortly v3.1 BETA has the SIP to ScoreCard feed Will look into Control procedures having their own window Report Header--will look into .XML pull for values. v3.1 BETA alows classification marking--will look into logo. Thanks
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 8/16/2007 7:47:21 AM
Posts: 1,
Visits: 4
|
|
| Great tool for those folks in DoD to use in getting a handle on the 'documentation' side of the house. Question/Comment - We're testing the Toolset v3.0 and noticed that the default on the DIACAP Scorecard is set to 'C' for Compliant. Wouldn't it be more appropriate, from a IA security standpoint, to have everything 'NC' to ensure that all the IA controls were individually verified/validated? Sort of a 'fail safe' so as not to overlook a specific IA control. Thanks for the opportunity to comment.
|
|
|
|
|
Supreme Being
Group: Administrators
Last Login: 8/24/2010 8:37:01 PM
Posts: 292,
Visits: 690
|
|
| sounds good. Will change for next version
|
|
|
|
|
Junior Member
Group: Forum Members
Last Login: 2/5/2008 10:09:22 AM
Posts: 10,
Visits: 7
|
|
| v3.1 has a column in the SCORECARD labeled as POAM Required. Where did this come from, the DODI 8510.1 shows a column labeled as Inherited, but this column is absent from v3.1.
|
|
|
|
|
Junior Member
Group: Forum Members
Last Login: 2/5/2008 10:09:22 AM
Posts: 10,
Visits: 7
|
|
| DIACAP Toolset v3.1 SIP Report - any chance of adding a Document Change History page, with a Signature Page and a Table of Contents. The format of the SIP does not follow the format listed in the DODI 8510.1, instead of excel format can we see word as a project that I am working on has a 7 page system description with diagrams that do not fit well in a box. Lifecycle Phase - does not list the viable selection from 8510.1 System Operations lists two selection and an other, 8510.1 lists 4 selections. Accreditation Vehicle should be pre-filled to DODI 8500.2 User Representative (UR) PIA, CP and E-Authentication should have and explanation to justify a Yes or No answer. Classified should be a default to "DRAFT", users should change prior to signatures. Tiles and Roles should point to the CP Point of Contacts List for IA Personnel for the entire system support group as everyone has a hand in the process not a select few.
|
|
|
|
|
Supreme Being
Group: Administrators
Last Login: 8/24/2010 8:37:01 PM
Posts: 292,
Visits: 690
|
|
| In version 3.2 (coming soon) the SIP follows the latest guidance. All drop-down choices are lookup fields, which will allow end-user to add content. Reporting subsystem will allow end-user design options so the report can be formatted as required
|
|
|
|
|
Supreme Being
Group: Administrators
Last Login: 8/24/2010 8:37:01 PM
Posts: 292,
Visits: 690
|
|
| We use the POA&M required field to trigger the application to move focus to the POA&M for user editing. Version 3.2 will have the "Inherited" field
|
|