Policies and Procedures Writing:

When it comes to federal compliance with the NIST Risk Management Framework (RMF), documentation in terms of policies, procedures, and programs is absolutely critical. Writing security policies is one of the most tedious and taxing exercises that organizations simply loathe, and understandably so. With Centris, our federal compliance experts have years writing security policies and procedures, along with developing comprehensive programs relating to incident response, disaster recovery/contingency planning, configuration management, and much more.

Additionally, our expertly developed templates serve as a starting baseline for rapid policy development.

I.T. Security Tools & Solutions Sourcing:

Many times, remediating controls also requires implementing security tools and solutions for audit logging, vulnerability scanning, file integrity monitoring, intrusion detection, and much more. Identifying the appropriate tools needed, along with implementation – can be a time-consuming and complex undertaking. With Centris, we can help in determining the best security tools & solutions needed for your environment, then help with critical implementation.

System Security Plan (SSP) Development:

Federal contractors seeking Authorization to Operate (ATO) designation will need to document their controls within a System Security Plan (SSP). The purpose of the System Security Plan (SSP) is to provide an overview of the security requirements of the system and describe the controls in place or planned, for meeting those requirements. The System Security Plan also delineates responsibilities and expected behavior of all individuals who access the system.

The System Security Plan should be viewed as documentation of the structured process of planning adequate, cost-effective security protection for a system. It should reflect input from various managers with responsibilities concerning the system, including information owners, the system operator, and the system security manager. Centris has years of experience authoring SSPs for federal contractors, which equates to efficiency and quality from us to you.

Security Assessment Reports (SAR):

Centris offers third-party independent Security Assessment Reports (SAR) for the NIST RMF. This is often applicable for FISMA reporting, where SARs have long been the standard for assessing and validating controls against the NIST SP 800-53 framework. Centris has long issued SARs for federal contractors all throughout North America.

Continuous Monitoring:

As defined by the National Institute of Standards and Technology (NIST), information security continuous monitoring (ISCM) is “maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.”

Maintaining an up-to-date view of information security risks across an organization is a complex, multifaceted undertaking. It requires the involvement of the entire organization, from senior leaders providing governance and strategic vision to individuals developing, implementing, and operating individual information systems in support of the organization’s core missions and business functions. Now more than ever, organizations need to engage in continuous monitoring activities, and Centris can assist. With years of federal compliance expertise, Centris can design, build and implement a continuous monitoring program for your organization.