| Agenda
and Speaking Faculty |
| Day
One: December 16, 2004 |
| 8:30 |
Updates
on FISMA and NIST Directives and Developments
•
Hear the latest news and guidance on government security and C&A,
including FISMA requirements and NIST publications
• Discuss “what's next” in security reform from
inside the top computer security agencies
• Voice concerns and ask questions during a participant feedback
session
Marianne Swanson, National Institute for Standards
and Technology |
| 9:45 |
Step
One: Mapping Information Systems |
|
Generating
Cost Efficiencies: Using IS Categorization and Grouping to Streamline
Accreditation Boundaries
• Utilize NIST guidance to categorize and group multiple information
systems
• Certify and accredit grouped systems to reduce costs
• Determine the total cost to certify and accredit information
systems
Scott Charbo, CIO, US Department of Agriculture |
| 10:45 |
Break
& Refreshments |
| 11:00 |
Step
Two: Initiation Phase* |
|
Identifying
Roles and Resources and Garnering Support from Stakeholders
• Identify key participants in the C&A process
• Acquire agreement and support from senior agency security
staff, stakeholders and constituents
• Align C&A process and security controls with agency
security requirements
Jim Litchko, Litchko & Associates
Al Payne, Theta Solutions
|
| 12:00 |
Luncheon
and Case Study: Certification and Accreditation at the Department
of Transportation ·
Explore a step-by-step walkthrough of the C&A process at the
Department of Transportation
· Learn techniques to reduce time and generate cost efficiencies
· Develop a verifiable C&A process in accordance with
FISMA requirements
Lisa Schlosser, Department of Transportation
Pat Howard, Department of Transportation
|
| 1:00 |
Step
Three: Certification Phase* |
|
Assessing
Security Controls and Documenting Certification
• Develop a verifiable and transparent documentation system
to withstand demanding security reviews and audits
• Implement effective and cost efficient security controls
that align with mission needs and reduce risks
• Execute a cost-benefit analysis to determine the best security
controls in terms of costs, system usability and risk
Jim Litchko, Litchko & Associates
Al Payne, Theta Solutions |
| 2:15 |
Break
& Refreshments |
| 2:30 |
Step
Four: Accreditation Phase* |
|
Conducting
Risk Assessment and Authorizing Information Systems
• Conduct a thorough risk assessment to ensure compliance
with agency and FISMA security requirements
• Identify remaining vulnerabilities and propose corrective
actions taken to minimize risk
• Communicate accreditation decisions to stakeholders and
auditors
Jim Litchko, Litchko & Associates
Al Payne, Theta Solutions |
| 4:00 |
Adjourn
|
|
Day Two: December 17, 2004 |
| 8:30 |
Step Five: Continuous Monitoring Phase* |
|
Managing
Information Systems for Continued Assurance
• Establish potential security gaps not pinpointed in the
accreditation phase
• Assess the impact of future changes and upgrades to
information systems
• Communicate security vulnerabilities to agency staff and
end-user to diminish future incidents
Jim Litchko, Litchko & Associates
Al Payne, Theta Solutions |
| 9:45 |
Step Five: Continuous Monitoring Phase |
|
Information
Security within a Performance Framework
• Develop mission-aligned performance measures to gauge effectiveness
security controls for system security plans
• Establish a clear strategy for overcoming security incidents
and vulnerabilities
• Develop common security performance measures that communicate
priorities in the C&A process to stakeholders and auditors
Bob Tettelbach, The Performance Institute |
| 10:45 |
Break
& Refreshments |
| 11:00 |
Automating
the C&A Process to Streamline Operations
• Learn how EPA developed the new ASSERT system to reduce
time and costs needed to complete C&A
• Fully integrate an automated C&A process with business
operations and IT management
• Lessen burden while increasing transparency and verifiability
with a paperless system
Mari0n Cody, Environmental Protection Agency |
| 12:00 |
Networking
Luncheon |
| 12:45 |
Implementing
the Federal Enterprise Architecture: Aligning Information Security
with Agency-Related Mission Needs
• Comply with OMB mandates to integrate security and privacy
across all lines of business
• Align business and management level security requirements
with technical controls needed at the system level
• Balance the need for information sharing with the application
of security and privacy policies
John Keane, The Performance Institute
|
| 2:00 |
Workshop:
Hands-On Application of the C&A Process
• Submit you agencies security requirements for a customized
run through
• Conduct a hands-on walkthrough of the C&A Process
• Address agency specific concerns in completing C&A
Jim Litchko, Litchko & Associates
Al Payne, Theta Solutions
|
| 4:30 |
Conference
Adjourns |
