Program Review for Information Security Assistance PRISMA
PRISMA Review Option 2
The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing information systems. NIST will review and determine next steps to best support and potentially update the PRISMA content in 2022. For any questions or comments, please contact sec-cert@nist.gov.
Option two of a PRISMA review focuses on the strategic aspects and the technical aspects of the overall information security program. This option identifies the level of maturity of the information security program and the agency's ability to comply with existing requirements in nine areas. This review includes all the criteria in option one and one additional area of security controls:
Information Security Management And Culture
- IT Roles and Responsibilities
- Security Control Review
- Rules of Behavior and Documentation
- Personnel Security
- Risk Management
Information Security Planning
Security Awareness, Training, And Education
- End Users' Security Awareness and Training
- Security and IT Professionals' with Trusted Functions Security Awareness and Training
- Executive and Management Security Awareness and Training
- Security Awareness and Training Infrastructure
- IT Security Part of Capital Planning Process
- Adequate Resources Applied to IT Security
- IT Security Funding Distributed Based Upon a Risk Model
- Cost-effective IT Security Solutions
- Procurement Controls
- Governance Process
- Systems and Projects Inventory
- System Development Life Cycle (SDLC) Methodology
- Changes Controlled and Tested Through SDLC
- Security Requirements Definition
Certification And Accreditation
Critical Infrastructure Protection
- Contingency Planning and Disaster Response
- Incident Identification, Reporting, and Response
- Physical and Environmental Program
- Hardware and Software Maintenance
- System and Information Integrity
- Media Protection
- Identification and Authentication
- Logical Access Control
- Accountability (including Audit Trails)
- System and Communications Protection
Project Links
Additional Pages
Created December 07, 2016, Updated November 05, 2021
) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)
