IT Security plan

Sections 1 – 8 present a thorough and complete identification of the system (Field Office General IT Support), the responsible individuals, and the system status. Key personnel (Section 5) roster contains three or more appropriate designated officials.

Sections 1 – 8 identify the system (Field Office General IT Support), the responsible individuals, and the system status. Information was adapted from the Case Study. Key personnel (Section 5) roster contains at least two appropriate designated officials.

Sections 1 – 8 were completed using information from the Case Study. Key personnel (Section 5) roster contains at least one appropriate designated official.

Entered information for 6 or more sections. Information was incomplete or incorrect.

Completed less than 50% of the required information for sections 1-8. (Or, inappropriate or excessive copying from other authors’ work.)

Insufficient, missing, or no work submitted.

Provided an excellent description of the Field Office General IT Support System. Integrated case study information to describe the business operations supported by the hardware, software, and networks which comprise the “General IT Support” system. Included information about the types and sensitivity of information processed by this system. Described the “smart home” and “Internet of Things” capabilities which are supported by the field office IT systems.

Provided an outstanding description of the Field Office General IT Support System. Integrated case study information to describe the business operations including mention of the types and sensitivity of information processed by this system. Mentioned the “smart home” and “Internet of Things” capabilities which are supported by the field office IT systems.

Provided an acceptable description of the Field Office General IT Support System. Integrated case study information to describe the business operations, mentioned the types of information processed, and the “smart home” / “Internet of Things” capabilities incorporated into the field offices.

Described the field office business operations supported by the Field Office General IT Support System. The description lacked details.

Attempted to describe a General IT Support System. Did not integrate information from the case study. (Or, inappropriate or excessive copying from other authors’ work.)

Insufficient, missing, or no work submitted.

Provided an excellent description of the enterprise architecture for the Field Office General IT Support System. Integrated case study information to clearly and accurately describe the hardware, software, and networks which comprise the “General IT Support” system. Included information about the devices and controllers used for the “smart home” and “Internet of Things” capabilities which are used by the field office.

Provided an outstanding description of the enterprise architecture for the Field Office General IT Support System. Integrated case study information to describe the hardware, software, and networks which comprise the “General IT Support” system. Included information about the devices and controllers used for the “smart home” and “Internet of Things” capabilities which are used by the field office.

Provided an acceptable description of the Field Office General IT Support System. Integrated case study information to describe the business operations, mentioned the types of information processed, and the “smart home” / “Internet of Things” capabilities incorporated into the field offices.

Described the field office business operations supported by the Field Office General IT Support System. The description lacked details.

Attempted to describe a General IT Support System. Did not integrate information from the case study. (Or, inappropriate or excessive copying from other authors’ work.)

Insufficient, missing, or no work submitted.

Used information from the case study to identify (name) 5 or more interconnected systems and networks (including the LAN/WAN network connections between the field office and the operations center). Provided an excellent description for each that included the types and sensitivity levels of information transmitted over the connection (e.g. company proprietary information, customer information, public Internet information). Named the “owning” organization and responsible ISSO.

Used information from the case study to identify (name) 4 or more interconnected systems and networks (including the LAN/WAN network connections between the field office and the operations center). Provided an outstanding description for each that included the types and sensitivity levels of information transmitted over the connection (e.g. company proprietary information, customer information, public Internet information). Named the “owning” organization and responsible ISSO.

Used information from the case study to identify (name) 3 or more interconnected systems and networks (including the LAN/WAN network connections between the field office and the operations center). Provided an acceptable description for each. Named the “owning” organization.

Section identified interconnected systems including the LAN / WAN network connections. Provided some information about the systems and networks.

Section named LAN / WAN network connections but provided no other information. (Or, inappropriate or excessive copying from other authors’ work.)

Insufficient, missing, or no work submitted.

Provided an excellent overview of laws, regulations, and policies which establish specific requirements for the confidentiality, integrity, and availability of the data collected, processed, and/or stored in the Field Office General IT Support System. Named and described the applicability of 5 or more federal or state laws and regulations. Identified and described at least one internal policy which applies to the use of this system.

Provided an outstanding overview of laws, regulations, and policies which establish specific requirements for the confidentiality, integrity, and availability of the data collected, processed, and/or stored in the Field Office General IT Support System. Named and described the applicability of 4 or more federal or state laws and regulations. Identified and described at least one internal policy which applies to the use of this system.

Provided an acceptable list of laws, regulations, and policies which establish specific requirements for the confidentiality, integrity, and availability of the data collected, processed, and/or stored in the Field Office General IT Support System. Named and described the applicability of 3 or more federal or state laws and regulations. Identified and described at least one internal policy which applies to the use of this system.

Named and described at least three legal (laws), regulatory (regulations or “rules”), and/or policy sources for security requirements which apply to the Field Office IT General Support System.

Named at least two laws, regulations, and/or policies as sources of security requirements for the Field Office IT General Support System. (Or, inappropriate or excessive copying from other authors’ work.)

Insufficient, missing, or no work submitted.

Provided an excellent introduction for Section 13: Minimum Security Controls. Discussed the differences between management, operational, and technical categories of security controls. Used information from the case study and NIST SP 800-53.

Provided an outstanding introduction for Section 13: Minimum security controls. Discussed the use of management, operational, and technical categories of security controls. Used information from the case study and NIST SP 800-53.

Provided an acceptable introduction for Section 13: Minimum Security Controls. Mentioned the three categories (management, operational, technical). Used information from the case study and NIST SP 800-53.

Provided an introduction for Section 13: Minimum Security Controls. Introduction used information from the case study but lacked important details.

Provided an introduction for section 13. Did not customize the introduction for the case study. (Or, inappropriate or excessive copying from other authors’ work.)

Insufficient, missing, or no work submitted.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. CA) listed under the “management controls” category (in the baseline) using information from NIST SP 800-53. For each “family” listed in the baseline under this category, identified (listed) the specific controls (e.g. CA-1) and provided a excellent description of how the controls in each family work together to mitigate threats and vulnerabilities.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. CA) listed under the “management controls” category (in the baseline) using information from NIST SP 800-53. For each “family” listed in the baseline under this category, identified (listed) the specific controls (e.g. CA-1) and provided an outstanding description of how the controls in each family work together to mitigate threats and vulnerabilities.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. CA) listed under the “management controls” category (in the baseline) using information from NIST SP 800-53. Provided a brief description of how the controls in each family work together to mitigate threats and vulnerabilities.

Listed and described three or more management controls (from NIST SP 800-53) which should be implemented for the Field Office IT General Support System.

Listed and described one or more management controls (from NIST SP 800-53) which should be implemented for the Field Office IT General Support System.

Insufficient, missing, or no work submitted.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. AT) listed under the “operational controls” category (in the baseline) using information from NIST SP 800-53. For each “family” listed in the baseline under this category, identified (listed) the specific controls (e.g. AT-1) and provided a excellent description of how the controls in each family work together to mitigate threats and vulnerabilities.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. AT) listed under the “operational controls” category (in the baseline) using information from NIST SP 800-53. For each “family” listed in the baseline under this category, identified (listed) the specific controls (e.g. AT-1) and provided an outstanding description of how the controls in each family work together to mitigate threats and vulnerabilities.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. AT) listed under the “operational controls” category (in the baseline) using information from NIST SP 800-53. Provided a brief description of how the controls in each family work together to mitigate threats and vulnerabilities.

Listed and described three or more operational controls (from NIST SP 800-53) which should be implemented for the Field Office IT General Support System.

Listed and described one or more operational controls (from NIST SP 800-53) which should be implemented for the Field Office IT General Support System. (Or, inappropriate or excessive copying from other authors’ work.)

Insufficient, missing, or no work submitted.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. AC) listed under the “technical controls” category (in the baseline) using information from NIST SP 800-53. For each “family” listed in the baseline under this category, identified (listed) the specific controls (e.g. AC-1) and provided a excellent description of how the controls in each family work together to mitigate threats and vulnerabilities.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. AC) listed under the “technical controls” category (in the baseline) using information from NIST SP 800-53. For each “family” listed in the baseline under this category, identified (listed) the specific controls (e.g. AC-1) and provided an outstanding description of how the controls in each family work together to mitigate threats and vulnerabilities.

Used the provided security controls baseline for the case study company. Named and described each of the required control families (e.g. AC) listed under the “technical controls” category (in the baseline) using information from NIST SP 800-53. Provided a brief description of how the controls in each family work together to mitigate threats and vulnerabilities.

Listed and described three or more technical controls (from NIST SP 800-53) which should be implemented for the Field Office IT General Support System.

Listed and described one or more technical controls (from NIST SP 800-53) which should be implemented for the Field Office IT General Support System. (Or, inappropriate or excessive copying from other authors’ work.)

Insufficient, missing, or no work submitted.

Included both sections from the template file (14 & 15) and entered the completion date for the plan.

Included section 14 from the template file and entered a completion date for the plan.

N/A

N/A

N/A

Insufficient, missing, or no work submitted.

Work is professional in appearance and organization (appropriate and consistent use of fonts, headings, color).

No word usage, grammar, spelling, or punctuation errors. All quotations (copied text) are properly marked and cited using a professional format (APA format recommended but not required.)

Work is professional in appearance and organization (appropriate and consistent use of fonts, headings, color).

Work contains minor errors in word usage,grammar, spelling or punctuation which do not significantly impact professional appearance. All quotations (copied text) are properly marked and cited using a professional format (APA format recommended but not required.)

Work is professional in appearance and organization (minor issues allowable but overall the work contains appropriate and consistent use of fonts, headings, color).

Errors in word usage, spelling, grammar, or punctuation which detract from professional appearance of the submitted work. All quotations (copied text) are properly marked and cited using a professional format (APA format recommended but not required.)

Submitted work has numerous errors in formatting, organization, word usage, spelling, grammar, or punctuation which detract from readability and professional appearance. Punctuation errors may include failure to properly mark quoted or copied material (an attempt to name original source is required).

Submitted work is difficult to read / understand and has significant errors in formatting, appearance / organization, spelling, grammar, punctuation, or word usage. Significant errors in presentation of copied text (lacks proper punctuation and failed to attribute material to original source).

No work submitted. OR, work contains significant instances of cut-and-paste without proper citing / attribution to the original work or author.