will help improve agency plans and procedures to ensure that relevant authorities are
documented and understood; and will enhance inter-agency communication and
coordination procedures to ensure incidents are mitigated appropriately and in a timely
manner.
b. In the FY 2016 FISMA Guidance, OMB will require that all departments and agencies
(not bureaus or components) designate one principal Security Operations Center (SOC),
or equivalent organization to be accountable to agency leadership, DHS, and OMB for all
incident response activities. Agencies will provide this information to US-CERT by
November 13, 2015.
c. Separately, within 3 months, OMB, in coordination with DHS, will provide agencies
with best practices and use cases for Federal SOCs to ensure consistent roles,
responsibilities, policies, and procedures are employed by SOCs across the Federal
Government.
d. In the FY 2016 FISMA Guidance, OMB will require agencies to have a standing Federal
Network Authorization with DHS to ensure DHS can rapidly deploy on-site resources to
conduct incident response activities, when necessary. The authorization should be
reviewed on a semi-annual basis and remain on file with DHS.
e. The CSIP directs GSA, in coordination with OMB, to research contract vehicle options
and develop a capability to deploy incident response services that can quickly be
leveraged by Federal agencies, on a reimbursable basis. The incident response service
will be managed by the contracting agency, in coordination with DHS and OMB. GSA
will develop requirements and deliver a detailed implementation plan for this task to
OMB within 3 months; then complete the acquisition process and deliver the final
capability within 6 months.
Page 16 of 21