The NIST Framework

NIST CSF 1.1 focuses on using business drivers to guide cybersecurity activities and cybersecurity risk considerations as part of the organization’s risk management processes. The framework enables organizations to apply the principles and best practices of risk management to improving security and resilience. By assembling standards, guidelines, and practices that are currently working, the Framework creates a common organizing structure for multiple approaches to cybersecurity.

The assessment was carried out in three phases shown below.

Phase 1

Discover and Document

Identify people, processes, and technology involved with relevant assets, business environment, governance, strategy including vendors. These are all outlined in the Identify Function of NIST CSF 1.1.

• Questionnaire: To collect relevant information, Sedara developed a questionnaire concerning the management and operational controls. Questionnaires were also used during interviews.
  
• Interviews: Interviews with IT support and management personnel enabled Sedara to collect useful information about how systems are managed, and who is in charge of managing them.

Phase 2

Audit and Review Data

This phase begins to detect what is important and what is not. Interpret and validate data to assign meaning and context, and arrive at a relevant conclusion. This is our final sweep for any missing data, and to produce supporting artifacts.

• Quantify GAPs in people, process and technology.
  
• Document Review. Sedara reviews policy documentation, directives, system documentation, IT documentation that currently exists within the organization.

Phase 3

Summarize and Deliver Results

Upon completing the assessment, we provided a detailed Plan of Action and Milestones (POAM) document to provide actionable next-steps. This is a document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones for meeting the tasks, and recommended completion dates for the milestones.

• Prioritized roadmap to close gaps
  
• Long-term strategy to maintain closed gaps

Click to enlarge images.

References

Sedara uses NIST CSF 1.1 crosswalked to the following industry standards and best practices.

• National Crime Information Center (NCIC)
  
• National Emergency Number Association (NENA)
  
• Association of Public Safety Communications Officials (APCO)
  
• The National Fire Protection Association (NFPA)
  
• Commission on Accreditation for Law Enforcement Agencies (CALEA)
  
• The Federal Communications Commission (FCC)
  
• Task Force on Optimal Public Safety Answering Point Architecture (TFOPA)
  
• State 9-1-1 Standards
  
• State Division of Homeland Security and Emergency Services
  
• Federal Emergency Management Association (FEMA)

NCPA

Sedara Purchasing Contract Information

Sedara utilizes NCPA (National Cooperative Purchasing Alliance) 01-97 Advanced Technology Solutions Aggregator contract.
NCPA (National Cooperative Purchasing Alliance) is a leading national government purchasing cooperative working to reduce the cost of goods and services by leveraging the purchasing power of public agencies in all 50 states.