Check Check Assessment & Authorization (A&A) & Governance, Risk & Compliance System Security Plans Plans of Action & Milestones (POA&Ms) System Categorization A&A Package Prep & Submission Risk Assessment Policies & Procedures Risk Identification/Assessment Regulatory Compliance (e.g., FISMA, HIPAA)
Cog Cog Operations & Monitoring Vulnerability management Secure network monitoring Patch and configuration management RMF control implementation support Red team support for penetration testing
Data Protection & Privacy Privacy Impact Assessments (PIAs) Data mapping and flow analysis Data classification & handling policies and procedures
Incident Response & Recovery Identification: Detection; Incident response; Tabletop exercises Containment: Isolation; Configuration changes; Strategic planning Eradication: Root Cause Analyses (RCAs); Malware removal; Patching & hardening Recovery: System restoration; Validation and testing; User communications
Network & Security Engineering & Architecture Network design and planning; IP address management Firewall and perimeter security design Remote access architecture (VPNs, secure connectivity) Load balancing and redundancy Cloud network architecture and premises integration Identity and Access Management (IAM); MFA; Zero Trust Architecture SIEM and log architecture IDS/IPS