WIXLIB

DOE Essential Body of Knowledge (EBK) 1.1.4 Implement media control procedures, and continuously monitor for complianceImplement and verify data security access controls, and assign privilegesAddress all suspected incidents in accordance with Departmental directives andapplicable PCSPsApply and maintain confidentiality controls and processes in accordance withstandards, procedures, directives, policies, regulations, and laws (statutes)Implement authenticator generation and verification requirements and processesin accordance with standards, procedures, directives, policies, regulations, andlaws (statutes)Execute media sanitization (clearing, purging, or destroying) and reuse proceduresExecute processes and procedures for protecting SUI, including PII.EvaluateAssess the effectiveness of Departmental/PCSP data security policies, processes,and procedures against established standards, guidelines, and requirements, andsuggest changes where appropriateEvaluate the effectiveness of the sensitivity determination processes by assessingunclassified non-SUI data at rest for OPSEC issuesEvaluate the effectiveness of solutions implemented to provide the requiredprotection of data, including appropriate authenticator management andencryption controlsAssess data transmissions (e.g., email, file transfers, etc.) to evaluate theprotection mechanisms being utilized (e.g., sensitivity determinations, sensitivitylabels, encryption, etc.)Review alleged violations of data security and privacy breachesIdentify improvement actions required to maintain the appropriate level of dataprotectionEvaluate the effectiveness of the media sanitization (clearing, purging, ordestroying) and reuse processesEvaluate the effectiveness of the processes and procedures for protecting SUI,including PII.1.2 Enter pr ise ContinuityRefers to application of the principles, policies, and procedures used to ensure that anorganization continues to perform essential business functions within a definedaccreditation boundary after the occurrence of a wide range of potential catastrophicevents.1.2.1 Manage Coordinate with stakeholders to establish the organizational continuity ofoperations program Acquire necessary resources, including financial resources, to conduct aneffective continuity of operations program Define the continuity of operations organizational structure and staffing model Define emergency delegations of authority and orders of succession for keypositionsJune 20107

DOE Essential Body of Knowledge (EBK) 1.2.2 1.2.3 1.2.4 June 2010Direct contingency planning, operations, and programs to manage riskDefine the scope of the continuity of operations program to address businesscontinuity, business recovery, contingency planning, and disaster recovery/relatedactivitiesEnsure that each system is covered by a contingency planIntegrate organizational concept of operations activities with related contingencyplanning activitiesDefine overall contingency objectives and criteria required for activatingcontingency plansEstablish a continuity of operations performance measurement programIdentify and prioritize critical business functions to include Critical Infrastructureand Key ResourcesEnsure that appropriate changes and improvement actions are implemented asrequiredApply lessons learned from test, training and exercise, and crisis events.DesignDevelop a continuity of operations plan and related procedures in accordance withDepartmental directives and applicable PCSPsDevelop and maintain information system continuity of operations documentationsuch as contingency, business continuity, disaster recovery, and incidentmanagement plans and disaster recovery strategiesDevelop a process for conducting Business Impact Analyses (BIAs) to identifysystems providing critical services and facilitate the creation of disaster recoverystrategiesDevelop a comprehensive test, training, and exercise program to evaluate andvalidate the readiness of continuity of operations plans and contingency plans forinformation systemsPrepare internal and external continuity of operations communications proceduresand guidelines.ImplementExecute organization and information system continuity of operations and relatedcontingency plans and proceduresConduct testing of contingency plans for all organizational information systemsProvide contingency plan test reports on Critical Infrastructure and KeyResources to Senior DOE ManagementControl access to information assets during an incident in accordance withorganizational policy.EvaluateReview test, training, and exercise results to determine if information systems areavailable within organization or Senior DOE Management mission-requirementtime frames , and recommend changes as appropriateAssess the effectiveness of the continuity program, processes, and procedures, andmake recommendations for improvement8

DOE Essential Body of Knowledge (EBK) Continuously validate the organization against additional mandates, as developed,to ensure full complianceCollect and report performance measures and identify improvement actions.1.3 Incident ManagementRefers to knowledge and understanding of the process to prepare cyber security incidentreports and to prevent, detect, investigate, contain, eradicate, and recover from incidentsthat impact the organizational mission as directed by the DOE Cyber Incident ResponseCapability (CIRC). This competency includes the knowledge of digital investigation andanalysis techniques.1.3.1 Manage Coordinate with stakeholders to establish the incident management program Establish and coordinate activities of a Cyber Security Incident Response Team(CIRT) to perform digital and network incident management activities Establish relationships between the CIRT and internal individuals/groups (e.g.,DAA, classification/technical officer, Facility Security Officer, legal department,etc.) and external individuals/groups (e.g., CIRC, law enforcement agencies,vendors, and public relations professionals) Acquire and manage resources, including financial resources, for incidentmanagement functions Ensure users and incident management personnel are trained in incident reportingand handling procedures Ensure coordination between the CIRT and the security administration andtechnical support teams Provide adequate work space for the CIRT that at a minimum takes into accountthe electrical, thermal, acoustic, and privacy concerns (i.e., intellectual properties,classification, contraband) and security requirements (including access controland accountability) of equipment and personnel, and provide adequate reportwriting/administrative areas Apply lessons learned from information security incidents to improve incidentmanagement processes and procedures Ensure that appropriate changes and improvement actions are implemented asrequired Maintain current knowledge on network forensic tools and processes Establish an incident management measurement program.1.3.2 June 2010DesignDevelop the incident management policy, based on standards and procedures forthe organization to include impact assessments and incident categorizationrequirementsDevelop procedures for reporting INFOCON changes and security incidentsincluding incidents and potential incidents involving Personally IdentifiableInformation (PII) to CIRCIdentify services that the incident response team should provide9

DOE Essential Body of Knowledge (EBK) 1.3.3 June 2010Create an Incident Response Management Plan in accordance with DOE policiesand the applicable PCSPDevelop procedures for performing incident and INFOCON responses andmaintaining recordsDevelop procedures for handing information and cyber alerts disseminated by theDOE CIRCCreate incident response exercises and penetration testing activitiesSpecify incident response staffing and training requirements to include generalusers, system administrators, and other affected personnelEstablish an incident management measurement programDevelop policies for preservation of electronic evidence, data recovery andanalysis, and the reporting and archival requirements of examined material inaccordance with procedures set forth by the DOE CIRCAdopt or create chain of custody procedures that include disposal procedures and,when required, the return of media to its original owner in accordance withprocedures set forth by the DOE CIRC.ImplementApply response actions in reaction to security incidents, in accordance withestablished policies, plans, and procedures to include appropriate incidentcharacterization (i.e., Type 1 or Type 2) and categorization (i.e., low, media, high,or very high)Respond to and report incidents within mandated timeframes as required by theDOE CIRC and other federal agencies (e.g., Office of Health, Safety, andSecurity) as appropriatePerform assessments to determine the impact of the loss of confidentiality,integrity, and/or availabilityRespond proactively to information and alerts disseminated by the DOE CIRC toinclude performing consequence analyses and corrective actionsRespond proactively to changes in INFOCON levels as disseminated by SeniorDOE Management/DOE CIOAssist in collecting, processing, and preserving evidence according toDepartmental/PCSP standards, procedures, directives, policies, and regulationsand laws (statutes)Perform forensic analysis on networks and computer systems, and makerecommendations for remediationApply and maintain intrusion detection systems; intrusion prevention systems;network mapping software; and monitoring and logging systems; and analyzeresults to protect, detect, and correct information security-related vulnerabilitiesand eventsFollow proper chain-of-custody best practices in accordance with procedures setforth by the DOE CIRCCollect and retain audit data to support technical analysis relating to misuse,penetration, reconstruction, or other investigationsProvide audit data to appropriate law enforcement or other investigating agencies,to include Departmental security elements10

DOE Essential Body of Knowledge (EBK) 1.3.4 Report complete and accurate findings, and result of the analysis of digitalevidence, to appropriate resourcesExecute incident response plansExecute penetration testing activities and incidence response exercisesEnsure lessons learned from incidents are collected in a timely manner, and areincorporated into plan reviewsCollect, analyze, and report incident management measuresCoordinate, integrate, and lead team responses with internal and external groupsaccording to applicable policies and proceduresCoordinate, interface, and work under the direction of appropriate legal authority(e.g., Inspector General, FBI) regarding investigations or other legal requirementsincluding investigations that involve external governmental entities (e.g.,international, national, state, local).EvaluateAssess the efficiency and effectiveness of incident response program activities toinclude digital forensic investigations, and make improvement recommendationsExamine the effectiveness of penetration testing, incident response tests,INFOCON processes, training, and exercisesExamine penetration testing and vulnerability analysis results to identify risks andimplement patch managementAssess the effectiveness of communications between the CIRT and relatedinternal and external organizations, and implement changes where appropriateIdentify incident management and INFOCON improvement actions based onassessments of the effectiveness of incident management and INFOCONprocedures.1.4 Cyber Secur ity Tr aining and Awar enessRefers to the principles, practices, and methods required to raise employee awarenessabout basic information security and train individuals with information security roles toincrease their knowledge, skills, and abilities. Training activities are designed to instructworkers about their security responsibilities and teach them about information securityprocesses and procedures to enable duties to be performed optimally and securely withinrelated environments. Awareness activities present essential information securityconcepts to the workforce to influence user behavior.1.4.1 Manage Identify business requirements and establish PCSP and organizational policy forthe cyber security awareness and training program Acquire and manage necessary resources, including financial resources, tosupport the cyber security awareness and training program Set operational performance measures for training and delivery, and ensure thatthey are met Ensure the organization complies with cyber security awareness and trainingstandards and requirementsJune 201011

DOE Essential Body of Knowledge (EBK) 1.4.2 1.4.3 1.4.4 Ensure that appropriate changes and improvement actions are implemented asrequired.DesignDevelop the policy for the cyber security training and awareness programIncorporate requirements from the department cyber security training andawareness programDefine the goals and objectives of the cyber security awareness and trainingprogramWork with appropriate security SMEs to ensure completeness and accuracy of thesecurity training and awareness programEstablish a tracking and reporting strategy for cyber security training andawareness programEnsure currency

DOE Essential Body of Knowledge (EBK) June 2010 8 Direct contingency planning, operations, and programs to manage risk Define the scope of the continuity of operations program to address business cont