Security Controls Evaluation, Testing, and Assessment Handbook

Chapter 4

Federal RMF Requirements

Abstract

This chapter discusses the general guidance and testing techniques for testers, evaluators, auditors, and validators to ensure the systems they were reviewing meet the federal criteria for accreditation and security. The four methods for evaluation and testing of governmental systems, outside the Risk Management Framework, are explained.

Keywords

RMF

DIACAP

ICD 503

FedRAMP

Cybersecurity Framework

Over the past 10–15 years there have been multiple efforts to provide testers, evaluators, auditors, and validators the guidance and techniques to ensure the systems they were reviewing meet the federal criteria for accreditation and security. As described in Chapters 1 and 2, these activities have culminated ...