Information Systems Security Officer (ISSO) 101

Name: Information Systems Security Officer (ISSO) 101
Rating: 4.2 (17 reviews)

The Only 5 Skills You Need to Become A Cybersecurity Professional

Created bySerena Curry

Last updated 8/2023

English

English [Auto],

What you'll learn

Learn The Core Responsibilities Of An ISSO: The Only 5 Core Skills You'll Need
What You Need to Know About NIST frameworks - SP 800-37 (RMF) and SP 800-53 (REV 5)?
How Does FedRAMP (Cloud-based Systems) Relate To RMF (On-Prem Systems)?
Categorize An Information System - Low, Moderate or High | FIPS 199
Quickly How Orgs Establish baselines and How ISSOs tailor baseline controls
Assess Document : Review/Edit/Write Implementation Statements
Complete Continuous Monitoring Tasks - Review Audit Logs, Analyze Scans Reports, Create POAMs
BONUS: ISSO Workload: How To Manage All Your Tasks - Daily, Monthly, Quarterly, Annuallly - There are lots of them
BONUS: Assessments: How to Keep Them On Track Even Though You Aren't In Charge
BONUS: Collaborate: How to Successfully Work With Key Stakeholders - SO, ISSM, CISO, IA, SAOP

Course content

12 sections • 44 lectures • 1h 26m total length

Course Overview1:15
Course Overview: Outline0:30
CPE/CEU: Earn By Learning0:01
This course comprises ~ 90 minutes of lectures with ~ 1.5 hours of hands-on exercises and practice assignments, allowing you to earn 3 hours of continuing learning credits (CEU, CPE) when you complete all of the assignments and pass the exam.
Don't forget to ask if your organization will reimburse your for this training. CPE + FREE = best of both worlds.
Course Glossary of Terms And Acronyms List1:43

NIST SP 800-37 Rev 2: Risk Management Framework (RMF)3:38
NIST SP 800-53 Rev 5 Cybersecurity Framework (CSF)3:07
Explore the NIST SP 800-53 Rev 5 cybersecurity framework (CSF) within the ISSO context, outlining core controls, governance, and risk management for information systems.
FedRAMP1:53
This video highlights the key difference between the RMF and FedRAMP assessment and accreditation processes - where your system is hosted? On-prem (Corporate Network) - RMF; Cloud (CSP) - FedRAMP.
Rev 5 | Rev 2 (RMF) | FedRAMP Resources0:17

Categorization Intro1:21
Intro video on the purpose and requirement for assigning a security category to information (data) and information systems (applications, servers, networks, etc. )
Categorize Exercise: Complete FIPS-1998:29
Hands-on exercise demonstrating the security categorization of information and information system using a sample FIPS-199 Security Categorization form (isso101_securityCategorizationExercise.docx). Download the file and follow along or watch the demo and practice offline.
NOTE: As you will learn in this exercise, security categorization is based on the data (e.g. financial, medical, etc) AND the software (e.g. applications, websites) and hardware (e.g. servers, firewalls, cloud buckets) collecting, transmitting and storing the data.
Time-Saving Tip #10:21

Baseline Intro1:12
Select Baseline Security & Privacy Controls3:57
In this exercise, we take a step-by-step approach through the process of selecting the baseline controls for our sample information system. When concluded, you will understand why it differs from the NIST 800-53 Rev 5 baseline for a low-impact system.
Time-Saving Tip #20:22
Compare the organization's baseline control list, the Control Responsibility matrix, to the system SSP to ensure the controls listed are included and addressed.

Documentation: Implementation Statements Intro1:03
Study documentation and introduction to implementation statements for information systems security officer (ISSO) 101, outlining purpose, scope, and roles in security projects.
Implementation Statements: Exercise- Writing Hybrid Controls5:19
Implementation Statements Exercise: Writing Not Applicable Controls2:02
Time-Saving Tip #40:20
Apply time saving tip four by copying the controller description text from the 853 artifact to write the implementation statement, ensuring all security objectives are addressed.

Continuous Monitoring: Logs Intro2:03
Let's review why it's important to continuously monitor information system logs for unusual and/or suspicious behavior.
Copntinuous Monitoring: Log Review User Accounts2:05
Learn how continuous monitoring and log review of user accounts reinforce access controls, detect anomalies, and strengthen information systems security for ISSO professionals.
Continuous Monitoring: Log Review User Last Login1:06
Continuous Monitoring: Log Review User Separation of Duties0:59
Continuous Monitoring: Log Review Web (IIS)0:02
Continuous Monitoring: Log Exercise -DDOS1:21
Time-Saving Tip #70:22

Requirements

Required: Security Certification* - Security Plus, Network Plus, CISSP (*Obtained or studying for)
Helpful: Some hands-on experience in one of the following roles is helpful - web development, database management, network administration, Tier 1 technical support
Plus: Some working knowledge of federal/DoD terms and acronyms

Description

From categorizing information systems to establishing baseline controls and identify vulnerabilities by analyzing scan reports and reviewing audit log to tracking vulnerabilities with plan of actions and milestones.

This course ensures you will be able to use your knowledge as an ISSO to establish and maintain the security posture of information systems.

This course ensures you will be able to use your knowledge as an ISSO to establish and maintain the security posture of information systems. From categorizing information systems to establishing baseline controls and identify vulnerabilities by analyzing scan reports and reviewing audit log to tracking vulnerabilities with plan of actions and milestones.

This course ensures you will be able to use your knowledge as an ISSO to establish and maintain the security posture of information systems.

Who this course is for:

Beginner Intermediate Experienced Cybersecurity Professionals

Information Systems Security Officer (ISSO) 101

What you'll learn

Explore related topics

Course content

Introduction4 lectures • 3min

What is an ISSO?3 lectures • 4min

BACKGROUND: NIST, RMF and FedRAMP4 lectures • 9min

System Categorization: FIPS 199 (RA-2)3 lectures • 10min

Select Baseline Controls (PL-10)3 lectures • 6min

Tailor/Filter Security & Privacy Controls (PL-11)4 lectures • 11min

Write/Edit Implementation Statements (SA-5)4 lectures • 9min

Continuous Monitoring: POAMS (CA-5)4 lectures • 7min

Continuous Monitoring: Analyze Scans (RA-5)5 lectures • 8min

Continuous Monitoring: Review Logs (AU-6)7 lectures • 8min

Requirements

Description

Who this course is for: