|
What are a Tabletop exercises and how to benefit from them?
Tabletop exercises are discussion-based events where personnel with roles and responsibilities in a particular IT plan meet in a classroom setting or in breakout groups to discuss their roles during an emergency and their responses to a particular emergency situation. Tabletop exercises are conducted in an informal environment, with a facilitator guiding participants through a discussion designed to meet pre-defined objectives. One or more scenarios may be discussed during a single tabletop exercise.
NIST SP 800-84 GUIDE TO TEST, TRAINING, AND EXERCISE PROGRAMS FOR IT PLANS AND CAPABILITIES, page 4-1
Tabletop exercise
The following tabletop exercise is based upon the following NIST 800-171 r2 requirement:
3.7.3 Ensure equipment removed for off-site maintenance is sanitized of any CUI and status of CUI information which is identified as Single State Information – NIST 800-171 r2, Chapter 2, page 6.
A key issue to consider when handling Controlled Unclassified Information (CUI) is that CUI is referred to as being Single State Information. In other words, as mentioned on page 6 of NISTY 800-171 r2 --
“Controlled Unclassified Information has the same value, whether such information is resident in a federal system that is part of a federal agency or a nonfederal system that is part of a nonfederal organization.”
A device such as a laptop or desktop computer will not boot. Staff IT have examined it and determined that it must be taken off-site for repairs.
To further complicate repair logistics, this device likely holds a variety of controlled sensitive information such as JCP, ITAR and/or especially Controlled Unclassified Information (CUI).
What actions are required to comply with DFARS requirements and NIST 800-171 r2 and other controlling program requirements? What NIST 800-171 r2 security requirements apply to this situation?
If the sensitive information can be fully removed from the machine how should the company proceed?
If the sensitive information cannot be fully removed from the machine what actions need to be taken, who should be involved, what training do all individuals require? If a third-party repair service is engaged, what vetting actions and documentation will be needed? Lastly, what company document and/or other documents should be the primary references?
What are general issues that this scenario creates? Does your System Security Plan (SSP) address these issues. Are there policies and procedures that address this issue.
If your SSP doesn’t address these issues, contact WPI and speak with Matt Frost for assistance in developing and/or updating your SSP, plans, policies and procedures to address these and other issues.
NIST SP 800-88 rev 1 - Guidelines for Media Sanitization provides guidance on this topic https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf
| 
