Michael Kwarteng Email & Phone Number

Washington, Dc, Us

Washington, Dc, Us

*Directed assessment remediation, validation, and collation of security artifacts to ensure successful implementation of security and privacy controls.*Served as a subject matter expert (SME) for HIPAA and NIST control requirements.*Provided an assessment as a subject matter expert (SME) to determine the company's compliance with NIST 800-53 and detailed knowledge of NIST Special Publication (SP) 800-18, 800-30, 800-37, 800-39, 800-53, 800-53A, 800-60, Etc.*Developed and documented FISMA testing template and provided information assurance directives and guidance to programs in various system development life cycle (SDLC) phases to meet Federal security requirement (NIST, DoDI 8500.2, DCID6/3) as required by OMB Circular A-130 and FISMA certification process.*Created, Compile and Complete Authorization Packages to include the System Security Plans, CAAT Files, SAR's, and SOP's. *Created (RTM) Risk Traceable Matrixes in which Pass/fail assessment results were documented.*Worked with Security assessment team Conducted assessment on Management, operational and technical Controls.*Determined security categorization using NIST 800-60 as an information guide.*Selected security controls using NIST 800-53 as guidance based on system security categorization.*Prepared Security Assessment Reports (SAR) in which all the weaknesses are reported.*Accessed Security Controls selected.

Bowie, Maryland, Us

Ø Reviewed Privacy Impact Assessment (PIA) documents.Ø Provided audit briefings to agency and Information Systems Security Officer, documented all findings in the POA&M.Ø Applied Risk Assessment to system security and the likelihood of risk occurrence using NIST 800-30 to determine.Ø Managed Security Control Assessment schedules for the client's systems to ensure the system remained compliant with Continuous Monitoring requirements.Ø Performed Confidential Government-wide program that provides Confidential standardized approach for security assessment, authorization, and continuous monitoring for cloud products/ computing services on multi-agency systems according to NIST security control baselines.Ø Conducted Security Assessments to determine if controls were implemented correctly, operating as intended, and meeting desired objectives/results.Ø Examined policies and procedures, interviewed personnel on tested controls, and conducted screenshot testing of the system configuration of technical controls.Ø Monitored controls post-authorization to ensure continuous compliance in accordance with NIST guidelines in NIST 800-137 for security control continuous monitory.

Greater New York City, Ny, Us

Ø Operated Risk Management Framework using NIST 800 - 37 as Confidential guide and FIPS 199 as Confidential guide to categorize information systems.Ø Classified information Systems using the RMF processes to ensure system Confidentiality, Integrity, and Availability.Ø Selected security controls using NIST 800-53 as guidance based on system security categorization.Ø Most of my current projects are focused on RMF phase 4 (Assessing security controls)Ø Effectively engaged in the assessment processing & preparing for assessment, conducting the assessment, communicating assessment results, and maintaining the assessment findings for remediationØ Coordinated, participated and attended weekly Confidential forums for security advice and updates.Ø Utilized the (SSP) System Security Plan's implementation section to address how each control is implemented (frequency of performing the controls, control types, and status).Ø Created SAP (to document assessment schedules, control families to be assessed, control tools and personnel, client's approval for assessment, assessment approach and scope, ROE if vulnerability scanning is involved).Ø Determined assessment method (examining policies and procedures, interviewing personnel, and testing technical controls), using NIST 800-53A as a guide.Ø Prepared Security Assessment Reports (SAR) in which all the weaknesses are reported.Ø Created Plans of Actions and Milestones to trace corrective action and resolve weaknesses and findings.Ø Reviewed Confidential & Confidential package items .Ø Set- up and participated in the Assessment Kick-up meetings per NIST SP 800-53A.Ø Prepared Confidential package documents (SSP, SAR, POAM reports, and Confidential package) to enable the Authorizing officer to make risk-based decisions to sign the Authorization to Operate.Ø Ensured that controls are implemented correctly, functioning as intended, and producing the right results.

Master'S Degree, Cybersecurity Teschnology

Bachelor'S Degree, Computer Science