- Area
- Risk Management
- Framework
- NIST RMF (SP 800-37)
- Controls
- Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor
Documents
What I did
Developed a full SSP for a fictional patient portal at Lakeshore Health Partners. I categorized the system as Moderate under FIPS 199, selected and tailored the NIST 800-53 Rev 5 baseline, and wrote implementation statements for 40+ controls. I documented the authorization boundary, data flows and inherited controls, then produced a POA&M for the 9 controls that were not fully implemented.
What I learned
An SSP is only as strong as its evidence. Writing implementation statements that an assessor can actually test changed how I think about controls: as proof, not policy.