Information Security Assurance Training and Rating Program

Please keep your contact information current.
Please contact isatrp@isatrp.org if you feel your information needs updating.

Before you conduct an assessment, be aware of current regulations, manuals, certificates, rules for that particular company that you are assessing. Some of the many Rules/Regulations/Guides can be found at the following sites: (Note that this is not an all-inclusive list.) Some links may be out of date, please let us know if you find links that are out of date or great resources that should be added.

Government/DoD

C4I http://www.cygnacom.com/certification/dod_acq.htm
DoD http://www.defenselink.mil/execsec/adr1999/apdx_k.html .mil site
DoD 8500.2

• http://niap.nist.gov/cc-scheme/policy/dod/d85002p.pdf
• http://www.dtic.mil/whs/directives/corres/html/85002.htm .mil site
• http://iase.disa.mil/policy.html .mil site

• http://www.dla.mil/j-6/dlmso/eLibrary/Manuals/regulations.asp .mil site
• http://www.dla.mil/j-6/dlmso/eLibrary/Manuals/publications.asp .mil site

• Information Assurance Training, Certification and Workforce Management .mil site
• DoD8570_1M.pdf

DCID 6/3 http://www.watchfire.com/securityzone/dcid.aspx
DITSCAP, Appendix Q http://www.i-assure.com/services/ditscap.htm
DSS Security Awareness http://www.dss.mil/training/salinks.htm#iss .mil site

FAR/DFAR http://www.acqnet.gov/far/

Section 508 Compliance Policy: http://www.section508.gov/index.cfm?FuesAction=Content&ID=3
Office of Acquisition Management: http://oamweb.osec.doc.gov
GAO - General Accounting Office: http://www.gao.gov/sitemap.html
Global CERTS http://www.globalcerts.net/government.php
Information Assurance (IA) Controls DIACAP http://www.cygnacom.com/certification/ia_controls.htm
NIACAP http://www.cygnacom.com/certification/niacap.htm
Non-DoD http://www.dla.mil/j-6/dlmso/eLibrary/Manuals/nondod.asp .mil site
Procurement Regulations: http://www.procurement-lawyer.com/regulations.htm
Regulations galore: http://www.regulations.gov/ and click on "Regulations by topic"
Security Assistance Act of 2002: http://www.disam.dsca.mil/pubs/USG/images/PDF/SAA%20OF%202002.htm .mil site

FEDERAL

FIPS Regulation- Electronic Data Interchange (EDI): http://www.itl.nist.gov/fipspubs/fip161-2.htm
FIPS Publications: Federal Information Processing Standard (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems 199:
http://industries.bnet.com/whitepaper.aspx?scname=Enterprise+Architecture&scname=Enterprise+Architecture&x=40&docid=116702
FIPS 81 http://www.itl.nist.gov/fipspubs/fip81.htm
FIPS 140-1 http://www.entrust.com/resources/fips1401.htm
FIPS 140-2 Regulations http://www.corsec.com/index.php?option=com_content&task=blogcategory&id=41&Itemid=100
Office of the Federal Registery - GPO http://www.gpoaccess.gov/nara/index.html
OPM - Office of Personnel Management http://www.Opm.gov

Federal and Private Industry Publications

FIPS Pub 200 Minimum Security Requirements for Federal Information and Information Systems Dated Mar 2006
http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

FINANCE compliance (Sarbanes/Oxley Act of 2002):

http://www.concur.com/solutions/value/compliance/default.asp?c1=sox1&source=google&kw=sarbanes_oxley_act
http://www.aicpa.org/info/sarbanes_oxley_summary.htm
Office of Management and Budget (OMB) (OMB A-130 Circular) http://www.whitehouse.gov/omb/circulars/a130/a130trans4.html
OMB Regulations: http://www.whitehouse.gov/omb/inforeg/regpol.html

HEALTH:

Health Service Policies and Regulations: http://www.hhs.gov/
HIPAA Advisory: http://www.hipaamanager.com/hm/what.cfm

HIPAA.Org

• http://www.rlyeh.com/hipaa-GPPC.htm
• http://www.hipaa.org/
• http://aspe.hhs.gov/admnsimp/index.shtml
• http://www.seoul.amedd.army.mil/webshare/files/85/resource/HIPAA%20Security/FISMA_DITSCAP-Crosswalk.pdf .mil site
• http://www.rlyeh.com/hipaa-GPPC.ht
• http://www.globalcerts.net/whitepapers4.php
• http://www.globalcerts.net/healthcare.php

INDUSTRY STANDARDS:

Cabinet Office:

• http://www.e-tronics.com/authorities.htm

INTERNET SECURITY:

• Computer Security Division Computer Security Resouce Center(CSRC) and NIST: http://csrc.nist.gov/events/index.html#April06
• NIST Interagency Publications (IR's): http://csrc.nist.gov/publications/nistir/index.html
• National Vulnerability Database: http://nvd.nist.gov

NATIONAL:

NIST 800 Series:

• http://csrc.nist.gov/publications/nistpubs/

• http://csrc.nist.gov/publications/nistpubs/ and FIPS pubs
• http://csrc.nist.gov/ for their Special Pubs
• http://csrc.nist.gov/publications/fips/index.html (for 199 and the forthcoming 200)

NSA

• http://www.nsa.gov/ia
• http://www.nsa.gov/snac/
• http://www.nsa.gov/snac/index.cfm?MenuID=scg10.3.1 for Security Configuration Guides/Regulations

Operational Security (OPSEC)

NSA:

• http://www.ioss.gov
• http://www.ioss.gov/related_publications.html

DSS:

• http://www.dss.mil/training/salinks.htm .mil site
  

Acronyms: http://www.nsa.gov/ia/acronyms.cfm?MenuID=10
Acronyms: http://www.acronymfinder.com/

Note: We realize that ".mil" sites are not accessible to everyone, so we have tried to give you a variety of links to assist you.
Comments and suggestions are always welcome.