Cloud Security Risk Management Methodologies

Categorize information system based on NIST RMF guidelines. This includes evaluating information system documentation, analyzing information system documentation to produce FIPS 199 Worksheet, and finalizing System Registration Form. Select security controls based on NIST RMF and FedRAMP guidelines. Analyze and validate Security Controls Traceability Matrix (SCTM) using appropriate resources. Write a system security control in alignment with NIST RMF and FedRAMP guidelines. This may include developing a System Security Plan (SSP) control based on email scenario, analyzing scenario for implementation parameters, and documenting the implementation of assigned security control following best practices. Develop a compliant System Security Plan (SSP) using NIST RMF and FedRAMP. Analyze and document inherited controls to ensure cloud security posture is maintained. Differentiate and document hybrid and system controls in alignment with NIST RMF and FedRAMP. This may include analyzing system owner email to update information system documentation and evaluating Common Control Provider (CCP) controls to ensure that they meet security requirements of the system. Develop Information System Continuous Monitoring (ISCM) strategy based on NIST RMF best practices. This may include analyzing enterprise level ISCM strategy, and synthesizing and documenting system level ISCM strategy supporting enterprise level ISCM strategy. Prepare system for assessment. Students will evaluate all system documentation, evaluate key system documentation (SSP, SCTM, ISCM), and evaluate documentation of security controls ensuring appropriate measures meet security requirements. In addition, students will develop communication notifying key stakeholders of systems pending assessment. Demonstrate highly developed critical thinking skills and a deepened understanding of risk management issues. Understands how to research issues of importance to the organization as well as possible recommendations to address risk management processes. Collect, interpret and analyze existing research and/or resources, and use in risk management processes.