Where can I get security control for inheritance?

Security controls most often offered up for inheritance by common control providers are in the Physical and Environmental (PE), Media Protection (MP) and Maintenance (MA) families. Depending on the specific common control provider, additional controls in other families may also be available for inheritance.

What does CNSSI 4009 security control inheritance mean?

CNSSI 4009 defines Security Control Inheritance as “a situation in which an information system or application receives protection from security controls (or portions of security controls) that are developed, implemented, and assessed, authorized, and monitored by entities other than those responsible for the system or application”.

Is the inherited control of a system automatically compliant?

It is important to understand that inherited controls are not considered “automatically compliant”. What “System A” will actually inherit is the compliance status (i.e., compliant or non-compliant) of each inherited control.

What’s the role of a hosted system owner in inheritance?

The hosted system owner’s role includes installation and configuration of backup agent software, etc. To accommodate this scenario, common control providers can offer up hybrid controls for inheritance, in which both the common control provider and the hosted system owner have a role.

Can a information system inherit a security control?

Each of the information systems owned by the subordinate entities can inherit compliance with specific security controls based on the existence of those organizational-level policies.