(Start: OMB Exhibit 300 Attachment 2 for the Initial Investment Decision (IID))

Review

• FAA FAST AMS Lifecycle Phases and Decisions guidance website
  • Investment Analysis (IA)
  • Investment Decision (ID)
• FAA FAST ISS Flow Chart of the IIA section
• Security engineering activities
  • FAA Information Systems Security (ISS) Engineering Process

Update

• CONOPS of system.
• ISS section of the Preliminary Requirements. (pPR document).
  • Apply 800-53.
    • Tailor 800-53 security requirements to your acquisitions.

Generate

• Basis of Estimates (BOE) on security cost estimates for alternatives.
• SCAP with your Service Unit/Service Area Certification Team Lead.
• The preliminary Information System Security Plan, (ISSP).
  • "Develop the Preliminary ISSP (Including Basic Security Policy)" (c)
    • NIST SP 800-18, "Guide for Developing Security plans for Federal Information Systems" (February 2006)
• Preliminary System Characterization/Categorization.
  • Develop Systems Characterization/Categorization (d)
  • FIPS-199
  • 800-53 controls.
• Preliminary vulnerability and risk assessment.
  • Developing Preliminary Vulnerability and Risk Assessment (e)
    • NIST SP 800-30, "Risk Management Guide for Information Technology Systems"

Deliverable(s)

1. BOE on security cost estimates for alternatives.
2. OMB Exhibit 300, Attachment 2: Business Case Analysis Report (BCAR)
3. Updated OMB Exhibit 300, Attachment 1: (pPR)
   • Requirements for the ISS section of the (pPR) to include the 800-53 controls.
4. Preliminary vulnerability and risk assessment.
5. Preliminary SCAPs document
   • Preliminary ISSP with security policy statement.
   • Preliminary System Characterization/Categorization.

End IIA for AMS decision point: #3