Joint task force transformation initiative

overlay template

• 
  Identification;
  
• 
  Overlay Characteristics;
  
• 
  Applicability;
  
• 
  Overlay Summary;
  
• 
  Detailed Overlay Control Specifications;
  
• 
  Tailoring Considerations;
  
• 
  Definitions; and
  
• 
  Additional Information or Instructions.
  

Within the Risk Management Framework (RMF), overlays are implemented as part of the tailoring process after the completion of an initial security categorization process described in Section 3.1 and any organization-specific guidance. The security categorization process results in the determination of an impact level of the information system, and is subsequently used to select an initial set of security controls from one of the security control baselines in Appendix D.¹¹⁸ After the initial set of security controls is identified, organizations initiate the tailoring process to modify and align the controls more closely with the specific conditions within the organizations. Overlays provide tailoring guidance from a community-wide perspective to address specialized requirements, missions/business functions, technologies, or environments of operation. Overlays provide uniformity and efficiency of security control selection by presenting tailoring options developed by security experts and other subject matter experts to information system owners responsible for implementing and maintaining such systems.

There is a considerable range of options that can be used to construct overlays, depending on the specificity desired by the overlay developers. Some overlays may be very specific with respect to the hardware, firmware, and software that form the key components the information system and the environment in which the system operates. Other overlays may be more abstract in order to be applicable to a large class of information systems that may be deployed in different environments. The example template described below can be used for any level of specificity on this continuum of potential options for overlays.

Overlays that provide greater specificity are typically developed by organizations with authority over the information system owners and environments of operation. Organizations decide on the appropriate tailoring actions for the selected baseline security controls as described in Section 3.2. Many of the variables and conditions that qualify the overlay for use on a specific information system are made explicit to ensure consistency when applying the overlay. Overlays that provide less specificity can also be developed by security and subject matter experts for application to large classes of information systems or in situations where there is less than full knowledge about the specific implementation details related to the system. Less specific overlays may require additional tailoring to customize the set of security controls for the specific information system. These overlays leave many of the assignment and selection statements in the security controls (i.e., the variable portion of the controls) to be completed by the organization that owns and operates the information system. The eight sections comprising the overlay are described below.

Organizations identify the overlay by providing: (i) a unique name for the overlay; (ii) a version number and date; (iii) the version of NIST Special Publication 800-53 used to create the overlay; (iv) other documentation used to create the overlay; (v) author or authoring group and point of contact; and (vi) type of organizational approval received. Organizations define how long the overlay is to be in effect and any events that may trigger an update to the overlay other than changes to NIST Special Publication 800-53 or organization-specific security guidance. If there are no unique events that can trigger an update for the overlay, this section provides that notation.

Organizations describe the characteristics that define the intended use of the overlay in order to help potential users select the most appropriate overlay for their missions/business functions. This may include, for example, a description of: (i) the environment in which the information system will be used (e.g., inside a guarded building within the continental United States, in an unmanned space vehicle, while traveling for business to a foreign country that is known for attempting to gain access to sensitive or classified information, or in a mobile vehicle that is in close proximity to hostile entities); (ii) the type of information that will be processed, stored, or transmitted (e.g., personal identity and authentication information, financial management information, facilities, fleet, and equipment management information, defense and national security information, system development information); (iii) the functionality within the information system or the type of system (e.g., standalone system, industrial/process control system, or cross-domain system); and (iv) other characteristics related to the overlay that help protect organizational missions/business functions, information systems, information, or individuals from a specific set of threats that may not be addressed by the assumptions described in Chapter Three.

Organizations provide criteria to assist potential users of the overlay in determining whether or not the overlay applies to a particular information system or environment of operation. Typical formats include, for example, a list of questions or a decision tree based on the description of the characteristics of the information system (including associated applications) and its environment of operation at the level of specificity appropriate to the overlay.

Organizations provide a brief summary of the salient characteristics of the overlay. This summary may include, for example: (i) the security controls and control enhancements that are affected by the overlay; (ii) an indication of which controls/enhancements are selected or not selected based on the characteristics and assumptions in the overlay, the tailoring guidance provided in Section 3.2, or any organization-specific guidance; (iii) the selected controls/enhancements including an overview of new supplemental guidance and parameter values; and (iv) references to applicable laws, Executive Orders, directives, instructions, regulations, policies, or standards.

Organizations provide a comprehensive expression of the security controls/control enhancements in the overlay as part of the tailoring process. This may include, for example: (i) justification for selecting or not selecting a specific security control/control enhancement; (ii) modifications to the supplemental guidance or the addition of new supplemental guidance for the security controls and control enhancements to address the characteristics of the overlay and the environments in which the overlay is intended to operate; (iii) unique parameter values for security control selection or assignment statements; (iv) specific statutory and/or regulatory requirements (above and beyond FISMA) that are met by a security control or control enhancement; (v) recommendations for compensating controls, as appropriate; and (vi) guidance that extends the basic capability of the control/enhancement by specifying additional functionality, altering the strength of mechanism, or adding or limiting implementation options.

Organizations provide information to information system owners and authorizing officials to consider during the tailoring process when determining the set of security controls applicable to their specific information systems. This is especially important for overlays that are used in an environment of operation different from the one assumed by the security control baselines (as defined in Section 3.1). In addition, organizations can provide guidance on the use of multiple overlays applied to a security control baseline and address any potential conflicts that may arise between overlay specifications and baseline controls.

Organizations provide any terms and associated definitions that are unique and relevant to the overlay. The terms and definitions are listed in alphabetical order. If there are no unique terms or definitions for the overlay, this is stated in this section.

Organizations provide any additional information or instructions relevant to the overlay not covered in the previous sections.