Information System Security Manager Toolkit

Information System Security Manager (ISSM) Toolkit

This toolkit will quickly point you to the resources you need to help you perform your role as an Information System Security Manager (ISSM). Do you have a question about how to do something or need more information about a topic? Select a category to start accessing resources.

ISSM Overview
Facility Security Program
Threats to Cleared Facilities
Safeguarding
System and Network Security
A&A Process
Security Incidents
Authorization

ISSM Training

ISSM Required Online Training (DAAPM - 2.6)
- eLearning: Risk Management Framework (RMF) Prepare Step CS101.16
- eLearning: Risk Management Framework (RMF) Categorize Step CS102.16
- eLearning: Risk Management Framework (RMF) Select Step CS103.16
- eLearning: Risk Management Framework (RMF) Implement Step CS104.16
- eLearning: Risk Management Framework (RMF) Assess Step CS105.16
- eLearning: Risk Management Framework (RMF) Authorize Step CS106.16
- eLearning: Risk Management Framework (RMF) Monitor Step CS107.16
- eLearning: Continuous Monitoring CS200.16
- eLearning: Introduction to the Risk Management Framework CS124.16
- eLearning: Introduction to Industrial Security IS011.16
- eLearning: Introduction to Information Security IF011.16
- eLearning: Introduction to Personnel Security PS113.16
- eLearning: Introduction to Physical Security PY011.16
- Webinar: Assessment and Remediation using the SCAP Tool and POA&M Template
- Webinar: Information Security Continuous Monitoring
- Program: Risk Management Framework CS100.CU
STEPP: CDSE's learning management system
DOD Cyber Exchange

Key Resources for ISSMs

Policy Documents
Templates and Job Aids
Other Resources
- DCSA NISP Authorization Office (NAO)
- Cybersecurity Toolkit

Working in the NISP

Short: You're a New FSO: Now What?
Program: FSO Orientation for Non-Possessing Facilities IS020.CU
Program: FSO Program Management for Possessing Facilities IS030.CU
Toolkit: FSO Toolkit
DD 254: Department of Defense Contract Security Classification Specification

Facility Security Clearances

Training
- eLearning: Facility Clearances in the NISP IS140.16
- eLearning: Understanding Foreign Ownership, Control or Influence (FOCI) IS065.16
- eLearning: NISP Self Inspections IS130.16
- eLearning: Clearances in Industrial Security: Putting it All Together IS125.16
Other Resources
- Facility Clearance Branch

Personnel Security

eLearning: Personnel Clearances in the NISP IS142.16
eLearning: Introduction to Personnel Security PS113.16
Job Aid: Receive and Maintain Your National Security Eligibility

Facility Reporting Requirements

Training
- eLearning: NISP Reporting Requirements IS150.16
- Short: Adverse Information Reporting
Other Resources

Building a Security Program

Training
- eLearning: Risk Management for DOD Security Programs GS102.16
- eLearning: Introduction to Industrial Security IS011.16
- eLearning: Developing a Security Education and Training Program GS104.16
- eLearning: Establishing an Insider Threat Program for Your Organization INT122.06
- Program: FSO Orientation for Non-Possessing Facilities IS020.CU
- Program: FSO Program Management for Possessing Facilities IS030.CU
Other Resources
- Toolkit: FSO Toolkit

Threats Overview

eLearning: Thwarting the Enemy: Providing Counterintelligence & Threat Awareness to the Defense Industrial Base CI111.16
Webinar: Critical Elements of a Suspicious Contact Report
Webinar: Economic Espionage with Acting Unit Chief John Hartnett, Federal Bureau of Investigation

Insider Threats

Training
- eLearning: Insider Threat Awareness INT101.16
- Webinar: Cyber Insider Threat
- Short: Adverse Information Reporting
- Toolkit: Insider Threat
Other Resources
- Insider Threat Program for Industry

The Cyber Threat

Training
- eLearning: Cybersecurity Awareness CS130.16
- Webinar: Developing an Incident Response Capability
- Webinar: Cyber Insider Threat
- Short: Suspicious Emails
Other Resources
- NIST Computer Security Resource Center

Protecting Classified Information

Training
- eLearning: Introduction to Information Security IF011.16
- eLearning: Marking Special Categories of Classified Information IF105.16
- Short: Marking in the Electronic Environment

Physical Security of Information Systems

Training
- eLearning: Physical Security Measures PY103.16
- eLearning: Storage Containers and Facilities PY105.16
Policy Guidance
- DCSA Assessment and Authorization Process Manual (DAAPM)
- Protective Distribution Systems (CNSS No. 7003)

Safeguarding and Handling Procedures

Training
- eLearning: Introduction to Physical Security PY011.16
- eLearning: Marking Special Categories of Classified Information IF105.16
- eLearning: Storage Containers & Facilities PY105.16
- eLearning: Safeguarding Classified Information in the NISP IS109.16
- eLearning: Transmission and Transportation of Classified for Industry IS107.16
- eLearning: Visits and Meetings in the NISP IS105.16
- Short: Classified Storage Requirements
Templates and Job Aids

Disposal and Destruction

Training
- Short: Disposal and Destruction
Policy Guidance
Other Resources
- Contractors Approval Form for the Destruction of Classified Material at NSA/CMC Facility
- DOD Lock Program Technical Support

System Security Guidance

Policy Guidance
Templates and Job Aids
- DISA STIG Viewer
- SCAP Compliance Checker
Other Resources
- DOD Cyber Exchange
- National Industrial Security Program Authorization Office (NAO) Homepage

Network Security

Policy Guidance

Physical Security

A&A Process

eLearning: Risk Management Framework (RMF) Prepare Step CS101.16
eLearning: Risk Management Framework (RMF) Categorize Step CS102.16
eLearning: Risk Management Framework (RMF) Select Step CS103.16
eLearning: Risk Management Framework (RMF) Implement Step CS104.16
eLearning: Risk Management Framework (RMF) Assess Step CS105.16
eLearning: Risk Management Framework (RMF) Authorize Step CS106.16
eLearning: Risk Management Framework (RMF) Monitor Step CS107.16
eLearning: Continuous Monitoring CS200.16
Webinar: Assessment and Remediation using the SCAP Tool and POA&M Template
Webinar: Information Security Continuous Monitoring

A&A Process In the NISP

eLearning: Introduction to the NISP RMF A&A Process CS150.16
eLearning: Applying Assessment and Authorization in the NISP CS250.16
eLearning: Technical Implementation of A&A in the NISP CS300.06

Tools and Templates

Key Resources

Security Incident Response Overview

Training
- eLearning: CI Awareness and Reporting Course for DOD Employees CI116.16
- eLearning: Insider Threat Awareness Course INT101.16
- eLearning: NISP Security Violations and Administrative Inquiries IS126.16
- eLearning: NISP Reporting Requirements IS150.16
- Short: Security Incidents Reporting Requirements
- Short: Adverse Information Reporting
- Short: Suspicious Emails
Templates and Job Aids
- Security Incident
Other Resources
- OnGuardOnline

Information System Security Incidents

Training
- Short: Data Spills
Other Resources
- DCSA Assessment and Authorization Process Manual (DAAPM)

Authorization

Policy Guidance
- DCSA Assessment and Authorization Process Manual (DAAPM)
- DAAPM Appendix A Security Controls Version 2.2
Other Resources
- Cybersecurity Toolkit

Toolkit feedback/suggestions? Email dcsa.cdsetraining@mail.mil.