NIST SP800-70r4：IT产品国家安全清单程序指南

NIST

SP800

需积分: 9 168 浏览量更新于2024-07-16 收藏 612KB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源详情

资源推荐

NIST SP 800-70 REV. 4 NATIONAL CHECKLIST PROGRAM FOR IT PRODUCTS

vii

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-70r4

minimally acceptable system configuration requirements and to ensure compliance with them [2].

Accordingly, Federal agencies, as well as vendors of products for the Federal government, should acquire

or implement and share such checklists using the NIST repository. NIST encourages checklist developers

to assert mappings to the security controls delineated in NIST Special Publication (SP) 800-53 to

facilitate FISMA compliance checking for Federal agencies.

Organizations should consider the availability of security configuration checklists during their IT product

selection processes.

When selecting checklists, checklist users should carefully consider each checklist’s degree of

automation, source, use of standards, and other relevant characteristics.

NIST recognizes that some checklists are more automated and standards-based than others. For example,

non-automated checklists provide prose-based descriptions of how a person can manually alter a

product’s configuration. Automated checklists are machine-readable. Automated checklists that fully

adhere to the Security Content Automation Protocol (SCAP), which are also known as SCAP content,

have all security settings documented in standardized SCAP formats; have undergone syntactic testing

using the NIST SCAP Content Validation Tool (SCAPVal)

for compliance to the SCAP-related

specifications; and include mappings between low-level security settings and high-level security

requirements.

When multiple checklists are available for a particular product, organizations should take into

consideration the degree of automation and use of standards of each checklist. Generally, SCAP

checklists can be used more consistently and efficiently than others. There may be other significant

differences among checklists; for example, one checklist may include software bundled with an operating

system (e.g., web browser and email client) while another checklist addresses that operating system only.

Another example is the assumptions on which the checklists are based (e.g., operational environment). A

checklist user should identify such differences and determine which checklist(s) seem appropriate and

merit further analysis.

Checklist source is particularly important for users from Federal civilian agencies, who should first search

for government-authorized or mandated checklists (e.g., mandated by Part 39 of the FAR [1]). In general,

these users should search for NIST-produced checklists, which are tailored for civilian agency use. If no

NIST-produced checklist is available, then agency-produced checklists from the Defense Information

Systems Agency (DISA) or the National Security Agency (NSA) should be used if available. If formal

government-authorized checklists do not exist, organizations are encouraged to use vendor-produced

checklists. If vendor-produced checklists are not available, other checklists that are posted on the NCP

website may be used.

Checklist users should customize and test checklists before applying them to production systems.

A checklist that is not mandatory for an organization to adopt should be considered a starting point for an

organization to customize. Although the settings are based on sound knowledge of security threats and

vulnerabilities, they cannot take into account organization-specific security and operational requirements,

existing security controls, and other factors that may necessitate changes. Organizations should carefully

evaluate the checklist settings and give them considerable weight, then make any changes necessary to

adapt the settings to the organization’s environment, requirements, policies, and security objectives. This

Organizations are also encouraged to include information in their checklists that supports mapping to other sets of

requirements, such as HIPAA.

SCAPVal is available for download for each SCAP version on the SCAP specification website at

https://scap.nist.gov/revision/index.html

NIST SP 800-70 REV. 4 NATIONAL CHECKLIST PROGRAM FOR IT PRODUCTS

viii

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-70r4

is particularly true for checklists intended for an environment with significantly different security needs.

All deviations from the checklist settings should be documented for future reference, and include the

reason behind each deviation and the impact of deviating from the setting.

Before applying a checklist that will be used to alter product settings, users should first test it on non-

critical systems, preferably in a controlled non-operational environment. Each checklist in the NIST

repository has been tested by its developer, but there are often significant differences between a

developer’s testing environment and an organization’s operational environment, and some of these

differences may affect checklist deployment. In some cases, a security control modification can have a

negative impact on a product’s functionality and usability, or on other products or security controls.

Consequently, it is important to perform testing to determine the impact on system security, functionality,

and usability; to document the results of testing; and to take appropriate steps to address any significant

issues.

Checklist users should take their operational environments into account when selecting checklists,

and checklist developers should target their checklists to one or more operational environments.

Checklists are significantly more useful when they can run in common operational environments. The

NCP has identified several broad and specialized operational environments, such as Standalone and

Managed, and at least one of the environments should be common to most of the audiences. Thoroughly

identifying and describing these environments will make it easier for users to select the security checklists

that are most appropriate for their particular operating environments, and will allow developers to better

target their checklists to the general security characteristics associated with their operating environments.

NIST strongly encourages IT product vendors to develop security configuration checklists for their

products and contribute them to the NIST National Checklist Repository.

NIST encourages IT product vendors to develop security configuration checklists for their products, since

the vendors have the most expertise on the possible security configuration settings and the best

understanding of how the settings relate to and affect each other.

Vendors that create security configuration checklists should submit them for inclusion in the National

Checklist Repository through the NCP. The NCP provides a process and guidance for developing

checklists in a consistent fashion. For checklist developers, steps include initial development of the

checklist, checklist testing, documenting the checklist according to the guidelines of the NCP, and

submitting a checklist package to NIST. NIST screens the checklist according to program requirements

and then releases the checklist for public review, which lasts 30 days. After the public review period and

subsequent resolution of issues, the checklist is listed on the NIST checklist repository with its

information. Checklist maintenance may potentially be performed by the vendor, resulting in the release

of updated checklists. NIST retires or archives checklists as they become outdated or incorrect.

NIST SP 800-70 REV. 4 NATIONAL CHECKLIST PROGRAM FOR IT PRODUCTS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-70r4

1. Introduction

1.1 Purpose and Scope

This document describes the use, benefits, and management of checklists, and explains how to use the

NIST National Checklist Program (NCP) to find and retrieve checklists. The document also describes the

policies, procedures, and general requirements for participation in the NCP.

1.2 Document Organization

Section 2 contains an overview of checklists and describes the advantages of the NIST NCP and how it

works.

Section 3 provides additional details on pre-defined checklist operational environments that are used in

the NCP to help developers create checklists that are consistent with security practices. The material

presented in Section 3 can also help checklist users select the checklists that best match their own

operational environments.

Section 4 contains information for potential checklist users. It describes how to use the NCP to find and

retrieve checklists that best match the identified needs. It also contains guidance on how to implement

checklists, including how to analyze the specific operating environment and then tailor checklists as

applicable.

Section 5 provides guidance for current and prospective checklist developers. This guidance contains

information on the procedures for preparing and submitting a checklist to NIST for inclusion in the

checklist repository.

Appendix A lists references for this document.

Appendix B contains the programmatic and legal requirements that must be satisfied to participate in the

NCP.

Appendix C contains the NCP participation and logo usage agreement form.

Appendix D details additional requirements that United States Government Configuration Baseline

(USGCB) checklists must meet.

Appendix E contains a list of acronyms used in this document.

Appendix F presents a glossary of the terms used in this document.

Appendix G provides the change log for the most recent release of the document.

剩余51页未读，继续阅读

艾米的爸爸

粉丝: 760
资源: 314

NIST SP800-70r4：IT产品国家安全清单程序指南

NIST SP 800-53A: 联邦信息系统中安全控制评价指南

NIST SP800-70-rev2.pdf

NIST SP800-177r1.pdf

nist sp800-161下载

NIST SP800-90A

nist sp800-181

nist sp800-108

NIST SP800-131A

nist sp800-60

2017 nist sp800-181

NIST SP800-22r1a

sp800-53 工控

SP800-22标准 MATLA

什么是SP800-121

[nist 800-38b]

nist800-207

windows时间服务器地址

ASPEN物性库中NIST-RK、NIST-IG、NIST-HOC的区别

nist sp-800-90b随机数测试测试标准

温度的开源火灾检测数据集下载地址

最新资源