Carnegie Mellon University – System Security Plan Template
3.12 3.12.4 Security Assessment
https://www.cmu.edu/iso/compliance/800-171/CMU%20SSP%20Template.docx
This document is intended as a starting point for the IT System Security Plan required by NIST SP 800-171 (3.12.4).
Centers for Medicare & Medicaid Services – Plan of Action and Milestones Handbook
3.12 3.12.2 Security Assessment
https://security.cms.gov/policy-guidance/cms-plan-action-and-milestones-poam-handbook
A complete guide to creating, managing, and closing your system’s POA&M
Department of Energy – Plan of Action and Milestones (POA&M) Training Session
3.12 3.12.2 Security Assessment
https://www.energy.gov/sites/prod/files/cioprod/documents/Mon_1300_SalonIII_POAMv11_DataSphere01_jmn.pdf
This training is intended to provide guidance for developing effective POA&Ms.
Department of Homeland Security – Process Guide for Plan of Action and Milestones (POA&M)
3.12 3.12.2 Security Assessment
https://www.dhs.gov/sites/default/files/publications/4300A-Handbook-Attachment-H-POAM-Guide.pdf
The guidance in this Attachment is written to assist DHS and its Components in implementing the POA&M process.
https://www.fedramp.gov/assets/resources/documents/CSP_Penetration_Test_Guidance.pdf
The document provides guidelines regarding planning and conducting penetration testing and analyzing and reporting on the findings.
FedRAMP – Plan of Action and Milestones (POA&M) Template
3.12 3.12.2 Security Assessment
https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/03/POAM-Template-User-Guide_02182015.docx
This link provides a FedRAMP POA&M template.
GIAC – The Value of Documentation: A Useful System Security Plan Template
3.12 3.12.4 Security Assessment
https://www.giac.org/paper/gsec/675/documentation-system-security-plan-template/101553
This paper is intended for those who may be new to the information security arena and have been tasked with assembling a system security plan.
Illinois Department of Human Services – Cornerstone System Security Plan
3.12 3.12.4 Security Assessment
http://www.dhs.state.il.us/OneNetLibrary/27896/documents/Cornerstone/CornerstoneSystemSecurityPlanfinal1112.pdf
This document summarizes the security requirements for the agency business application, Cornerstone, and the CMS/BCCS hosted environment for Cornerstone.
Institute for Security and Open Methodologies – The Open Source Security Testing Methodology Manual
3.12 3.12.1 3.12.3 Security Assessment
https://www.isecom.org/OSSTMM.3.pdf
This is a methodology to test the operational security of physical locations, human interactions, and all forms of communications such as wireless, wired, analog, and digital.
ISACA Journal – Planning for Information Security Testing – A Practical Approach
3.12 3.12.1 3.12.3 Security Assessment
https://www.isaca.org/resources/isaca-journal/issues/2016/volume-5/planning-for-information-security-testinga-practical-approach
This article describes the steps involved with planning a security test of your network.