ISCP Review of Activation and Notification

[gary-fallon]

Description

The Activation and Notification in Section 3 need to be reviewed and updated.

The type of outage indicates the VFSP-Va.gov will be down for more than 6 hours.

PSEC recommends holding a threat modeling session to capture possible outage scenarios and the LOE required to recover should the ISCP be invoked.

Tasks

The following tasks must be reviewed and completed as necessary.

• [ ] In Section 3.1, referenced RTO of 6 hours needs to be updated, assuming the BIA is updated.
• [ ] In Section 3.2, the method and procedure used for notification appears to be taken from the IRP.
  • [ ] Ensure that this is accurate and up-to-date.
  • [ ] Ensure that additional details are provided -- states that "Tickets are created." Where are those tickets created? Is the issue raised with CSOC?
• [ ] Slack and PagerDuty are both referenced SaaS applications; however, it is known that PD is not FedRAMP compliant and Slack has constraints.
  • [ ] Are both Slack and PagerDuty on the same cloud? Could an outage impact both services?
• [ ] In Section 3.3, Outage Assessment Procedures may benefit from being added to the IR Playbook.

Acceptance

The following tasks must be completed before this issue can be considered done.

• [ ] Review for accuracy and completeness.

[alyssagallion]

Looping in @ph-One @jhouse-solvd

[gary-fallon]

I will be drafting the BIA and ISCP based on a new definition of the FISMA authorization boundary that includes all VFS applications.

[alyssagallion]

During our Gap Analysis, we realized that the System Security Plan (SSP) was incorrect. We have since updated it, presented it to the ISSO and Ray Wang is now reviewing the associated tickets he needs to approve. Once those are reviewed and approved, @ScottCutlip will continue the work on SSP.

SSP is blocking BIA work and BIA work must be completed prior to ISCP work being done. Blocked.

[jhouse-solvd]

Please see the parent epic for a recent update.

Moving to review.

[jhouse-solvd]

The ISCP has been updated w/ the most recent info.

Please see the parent epic (#53216) for future updates and follow-up issues.

Closing.