SI-7 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

3.3 creating overlays

To address the need for developing community-wide and specialized sets of security controls for information systems and organizations, the concept of overlay is introduced. An overlay is a fully specified set of security controls, control enhancements, and supplemental guidance derived from the application of tailoring guidance in Section 3.2 to security control baselines in Appendix D.⁸⁷ Overlays complement the initial security control baselines by: (i) providing the opportunity to add or eliminate controls; (ii) providing security control applicability and interpretations for specific information technologies, computing paradigms, environments of operation, types of information systems, types of missions/operations, operating modes, industry sectors, and statutory/regulatory requirements; (iii) establishing community-wide parameter values for assignment and/or selection statements in security controls and control enhancements; and (iv) extending the supplemental guidance for security controls, where necessary. Organizations typically use the overlay concept when there is divergence from the basic assumptions used to create the initial security control baselines (see Section 3.1). If organizations are not divergent from the basic assumptions for the initial baselines, there is likely no need to create an overlay. Alternatively, the baselines may be missing key assumptions which would justify creating an overlay with additional assumptions.

The full range of tailoring activities can be employed by organizations to provide a disciplined and structured approach for developing tailored baselines supporting the areas described above. Overlays provide an opportunity to build consensus across communities of interest and develop security plans for organizational information systems that have broad-based support for very specific circumstances, situations, and/or conditions. Categories of overlays that may be useful include, for example:

• 
  Communities of interest, industry sectors, or coalitions/partnerships (e.g., healthcare, law enforcement, intelligence, financial, transportation, energy, allied collaboration/sharing);
  
• 
  Information technologies/computing paradigms (e.g., cloud/mobile, PKI, Smart Grid, cross-domain solutions);
  
• 
  Environments of operation (e.g., space, tactical);
  
• 
  Types of information systems and operating modes (e.g., industrial/process control systems, weapons systems, single-user systems, standalone systems);
  
• 
  Types of missions/operations (e.g., counterterrorism, first responders, research, development, test, and evaluation); and
  
• 
  Statutory/regulatory requirements (e.g., Foreign Intelligence Surveillance Act, Health Insurance Portability and Accountability Act, Privacy Act).
  

Multiple overlays can be applied to a single security control baseline. The tailored baselines that result from the overlay development process may be more or less stringent than the original security control baselines. Risk assessments provide information necessary to determine if the risk from implementing the tailored baselines falls within the risk tolerance of the organizations or communities of interest developing the overlays. If multiple overlays are employed, it is possible that there could be a conflict between the overlays. If the use of multiple overlays results in conflicts between the application or removal of security controls, the authorizing official (or designee), in coordination with the mission/business owner and/or information owner/steward, can resolve the conflict. In general, overlays are intended to reduce the need for ad hoc tailoring of baselines by organizations through the selection of a set of controls and control enhancements that more closely correspond to common circumstances, situations, and/or conditions. However, the use of overlays does not preclude organizations from performing further tailoring to reflect organization-specific needs, assumptions, or constraints. Tailoring of overlays is accomplished within the constraints defined within the overlay and may require the concurrence/approval of the authorizing official or other organization-designated individuals. For example, an overlay created for an industrial control system (ICS) may require tailoring for applicability to a specific type of ICS and its environment of operation. But it is anticipated that the use of overlays would greatly reduce the number and extent of organization-specific ad hoc tailoring.