Security Program Reviews

GTA has adopted the security requirements created by the Federal Information Security Management Act (FISMA) of 2002 and the FISMA Implementation Project conducted by NIST. GTA's policies and standards were developed in accordance with FISMA, and OIS conducts program reviews to help agencies identify and remediate deficiencies. These reviews are based on federal guidance from Program Review for Information Security Management Assistance (PRISMA). The reviews are focused on the agency's security management and operational processes based on requirements established by statewide security policies, the Federal Information Security Management Act (FISMA), and the National Institute of Standards and Technology (NIST) Computer Security Division.

The ultimate goal of these reviews is to assist agencies in:

  • Building robust information security and risk management programs
  • Preparing for future reporting and audit requirements
  • Responding to audit or assessment findings

Templates

  • Georgia System Security Plan Template (DOC, 389.91 KB)

    Georgia agencies are required to identify each information system that contains, processes, and transmits state data and information and prepare and implement a plan for the security and privacy of these systems.

  • NIST SP 800-53 Rev. 5

    Security and privacy controls for information systems and organizations.

  • NIST SP 800-53B (XLS, 88.67 KB)

    Control baselines for information systems and organizations.