9.1 Project Planning
All changes in this version
Title changed
Before · SP 800-116
Project Planning
After · SP 800-116 Rev. 1
Project Planning
Control changed
Before · SP 800-116
Planning for a migration to PIV-enabled PACS should be viewed as an opportunity to modernize deployed PACS. Given the threat environment, as described in Section 4, migrating to PIV- enabled PACS enhances security, fosters trust among agencies, and creates cost efficiencies. This section provides a strategy for developing migration plans, as shown in Figure 9-1.
Inputs Process Outputs
Assess Current Environment: •Facility Security Level •Application Impact •Threat Vector •PACS Infrastructure Assess Current Environment: •Facility Security Level •Application Impact •Threat Vector •PACS Infrastructure Select Authentication Mechanism(s) Select Authentication Mechanism(s)
Identify Technology Gaps Identify Technology Gaps
Select Appropriate Solution Select Appropriate Solution •Risk Assessment •Business and Functional Requirements •Current Architecture •Migration Plan Depicting ‘To Be’ Environment •Target Architecture Inputs Process Outputs
Assess Current Environment: •Facility Security Level •Application Impact •Threat Vector •PACS Infrastructure Assess Current Environment: •Facility Security Level •Application Impact •Threat Vector •PACS Infrastructure Select Authentication Mechanism(s) Select Authentication Mechanism(s)
Identify Technology Gaps Identify Technology Gaps
Select Appropriate Solution Select Appropriate Solution •Risk Assessment •Business and Functional Requirements •Current Architecture •Migration Plan Depicting ‘To Be’ Environment •Target Architecture
Figure 9-1: Migration Strategy Planning should be risk-based. Not all access points will require the same level of authentication assurance. Therefore, it is important to start with the risk assessment, which distills into PACS requirements. A migration plan can then be developed to help the agency transition to the desired PIV-enabled PACS environment.
After · SP 800-116 Rev. 1
Planning for a migration to PIV-enabled PACS should be viewed as an opportunity to modernize deployed PACS. Given the threat environment, as described in Section 4, migrating to PIV- enabled PACS enhances security, fosters trust among agencies, and creates cost efficiencies. This section provides a strategy for developing migration plans, as shown in Figure 9-1.
Inputs Process Outputs
Assess Current Environment: •Facility Security Level •Application Impact •Threat Vector •PACS Infrastructure Assess Current Environment: •Facility Security Level •Application Impact •Threat Vector •PACS Infrastructure Select Authentication Mechanism(s) Select Authentication Mechanism(s)
Identify Technology Gaps Identify Technology Gaps
Select Appropriate Solution Select Appropriate Solution •Risk Assessment •Business and Functional Requirements •Current Architecture •Migration Plan Depicting ‘To Be’ Environment •Target Architecture Inputs Process Outputs
Assess Current Environment: •Facility Security Level •Application Impact •Threat Vector •PACS Infrastructure Assess Current Environment: •Facility Security Level •Application Impact •Threat Vector •PACS Infrastructure Select Authentication Mechanism(s) Select Authentication Mechanism(s)
Identify Technology Gaps Identify Technology Gaps
Select Appropriate Solution Select Appropriate Solution •Risk Assessment •Business and Functional Requirements •Current Architecture •Migration Plan Depicting ‘To Be’ Environment •Target Architecture
Figure 9-1: Migration Strategy Planning should be risk-based. Not all access points will require the same level of authentication assurance. Therefore, it is important to start with the risk assessment, which distills into PACS requirements. A migration plan can then be developed to help the agency transition to the desired PIV-enabled PACS environment.