MSSEI Self Assessment Plan Step-by-Step Guide

Applications and systems that handle protected data are required to meet the campus Minimum Security Standard for Electronic Information policy (MSSEI).  The MSSEI Self Assessment Plan (SAP) is a tool for describing the controls in place to meet those requirements.  A completed MSSEI SAP for UC P4 classified systems (formerly UCB PL2 & PL3) is required before the Information Security Office (ISO) can assess compliance with campus security policies.

The following is a step-by-step guide for completing the MSSEI SAP, with instructions for what information needs to be provided in each section.  The self assessment plan is meant to be a snapshot in time of implemented security controls, and should be updated after any significant changes are made.

The self assessment plan is NOT meant to include information that can directly lead to the compromise of protected data, such as account credentials.  A completed SAP should be considered classified as UC P3 data and shared with collaborators on a need-to-know basis.

Refer to the campus Data Classification Standard and guideline for details about how to classify campus data, including examples for each data class.  If unsure about the correct classification, contact ISO at policy@berkeley.edu for additional guidance.

Especially important to the description of the system are Section 3 - Architecture Model and Section 4 - Data Flow Description.

In Section 5, Support & Development Staff:

• List any staff members who have elevated privileges* in the application or its underlying devices

• Include a description of their responsibilities and email contact information

* Elevated privileges may mean administrator permissions to make changes to the application configuration, or bulk access to protected data, etc.

6. Resources

Section 6, Resources, is intended for referencing system security documentation.*  The campus security policies are listed, but this section can also reference other documents or resources that impact security controls, such as departmental policies. 

* These references should not include any technical documentation that could be exploited by an attacker.

Step 2. Describe How MSSEI Requirements Are Being Met

Before attempting to complete this section, read the policy and guidelines for each requirement first.* The guidelines provide detailed recommendations about how to meet control requirements, including resources for campus services to help support MSSEI compliance efforts.

Instructions are provided for each MSSEI requirement.  Include as much detail as seems relevant, so that others reading the SAP will readily understand.

* There is a link to the guidelines for each MSSEI requirement in Section 7.

Covered Devices

The MSSEI policy defines three Device/Use Categories that are covered by the requirements:

• Institutional Devices

• Privileged Access Devices

• Individual Devices*

Each covered device has its own subset of MSSEI requirements based upon the protection level classification of the application or system.  To see which requirements apply for each device category, refer to the MSSEI Baseline Data Protection Profile Summary table.

Where applicable for each of the requirements in Section 7, space is provided to enter a description of the controls that apply for covered Institutional and Privileged Access Devices.