·  Conduct sensitivity assessment (information, potential damage, laws and regulations, threats, environmental concerns, security characteristics, NIH policy and guidance).

·  Perform initial or preliminary Risk Assessment

Develop security requirements:

·  Technical features (e.g., access controls)

·  Assurances (e.g., background checks for developers)

·  Operational practices (e.g., awareness and training)

·  Test plans/script/scenarios.

For built systems:

·  Develop security features

·  Monitor development process for security problems

·  Respond to changes

For off-the-shelf systems:

·  Monitor to ensure security is part of market surveys

·  Contract solicitation documents

Develop operational practices:

·  System Security Plan (SSP)

·  Contingency plan (CP)

·  Awareness and training

·  Develop test data.

·  Test unit, subsystem, and entire system.

Review the following:

·  Security management (administrative controls, safeguards)

·  Physical facilities

·  Personnel, responsibilities, job functions, and interfaces

·  Procedures (e.g., backup, labeling)

·  Use of commercial or in-house services (e.g., networking)

·  Contingency planning

Operational and administrative activities:

·  Perform backups

·  Hold training classes

·  Manage cryptographic keys

·  Maintain user administration and access privileges

·  Ensure audit logs are available

·  Update security software

·  Review physical protection

·  Review off-site storage usage, services, and availability

·  Review output distribution process

Operation assurance activities:

·   Review action of people who operate system (e.g., change control procedures)

·   Review technical controls

·   Review interdependencies

Perform self-administered or independent security audits (risk assessments) periodically.  Types: using automated tools, internal control audit, security checklists, and penetration testing.