96-S Exhibit O - SSA External Service Provider.pdf

Exhibit O

SSA EXTERNAL SERVICE PROVIDER SECURITY REQUIREMENTS continued:

Account Management Requirements: The purpose of the following is to address requirements for account and session management for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) AC-2 - ESPs must employ individual account types on external service provider systems. The use of group, anonymous, or temporary accounts is strictly prohibited.

(b) AC-2 - ESPs must demonstrate the implementation of an approval process that describes how system accounts are created, deleted, disabled, or modified. The process should account for roles in the system and the appropriate authorizations to grant access. Public-facing systems may use a registration process in place of the approval process.

(c) AC-2(3) - A deactivation process is required to manage inactive accounts. The process must describe how the system identifies and deactivates inactive accounts that have not been in use for 90 calendar days or more. ESPs must automatically disable inactive accounts after 90 calendar days and then remove these disabled accounts after one (1) calendar year.

(d) AC-2(4) - ESPs must provide the capability to produce a record of all account management activities that occur on the system and develop an automated method to submit these records in the form of a report to SSA.

(e) AC-6 - ESP administrator accounts and privileged user accounts must be customized to only allow access to specific roles and functions on the system. ESP must provide a list of these functions to the Contract Officer Technical Representative (COTR). (Moderate and High categorized systems only.)

(f) AC-7 - ESPs must enforce a limit of three (3) consecutive invalid login attempts by a user during a 20 minute timeframe and automatically lock the account/node for 30 minutes when the maximum number of unsuccessful attempts is exceeded. The account shall remain locked for 30 minutes. (Moderate and High categorized systems only.)

(g) AC-8 - ESPs providing services to SSA internal users must display the internally used and approved warning banner. The SSA internal banner is as follows:

Only authorized users can access the system.

The system is a U.S. Government computer system subject to Federal law.

Unauthorized attempts to access or modify any part of SSA’s systems are prohibited and subject to disciplinary civil action, or criminal prosecution.

If the system is serving the general public as its user base, the system must display a warning banner containing language that is appropriate to the application. The SSA COTR must approve the public warning banner language prior to implementation.

(h) AC-11 - ESPs must enforce termination of user sessions after 30 minutes of inactivity. Users must authenticate again after sessions are terminated in order to continue using the application. (Moderate and High categorized systems only.)

(i) AC-17(4) - ESPs must restrict remote access to approved administrative functions and accounts.

Auditing Requirements: The purpose of the following is to address requirements for auditing for ESPs.

SSA’s additional requirements for ESPs are as follows –

(a) AU-2 - ESPs must maintain an audit log of transactions to create, modify, or delete SSA information.

(b) AU-2 - ESPs must maintain an audit log of the following events: Logon/logoff events, account management, privilege or role changes, and administrator activity.

(c) AU-5 - ESPs must report any failure of audit processing that occurs to the SSA COTR within 24 hours.

(d) AU-6 - ESPs must review and analyze information system audit record for indications of inappropriate or unusual activity and report those findings to SSA COTR within 24 hours. ESPs must support monitoring and review of the system for unusual or inappropriate activity daily. This activity must be provided to the COTR immediately for review.

(e) AU-6 - ESPs must provide user and transaction log reports to SSA when requested.

(f) AU-7(1) - ESPs must allow for scoping of audit criteria for efficient reporting capability.

(g) AU-11 - ESPs must retain online audit logs for 90 calendar days.

(h) AU-11 - ESPs must retain audit records for seven (7) years.

Awareness and Training Requirements: The purpose of the following is to address requirements for awareness and training for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) AT-2 - ESP contractors and their employees or subcontractors must complete SSA provided security awareness training at least annually.

(b) AT-3 - ESPs must provide role based training to all employees who fulfill special roles or duties in regards to SSA data or systems.

(c) AT-4 - ESPs must retain and produce records of role based training completions for three (3) calendar years.

Configuration Management Requirements: The purpose of the following is to address requirements for configuration management for External Service Providers. SSA’s additional requirements for ESPs are as follows –

(a) CM-2(3) - ESPs must define and deploy an approved device configuration on each device used to provide services to SSA at least annually.

(b) CM-6 - ESPs must periodically scan the device configuration of each device used to provide services to SSA and identify deviations from the approved device configuration. Deviations shall be logged and corrected within 24 hours. The ESP shall submit device scan reports to SSA upon request.

(c) CM-8 - ESPs must maintain an inventory all IT assets that store, process, or transmit SSA data and provide to SSA upon request.

(d) CM-9 - The contractor shall maintain a configuration management plan that addresses the roles, responsibilities, processes, and procedures to manage inventory throughout the lifecycle.

Contingency Planning Requirements: The purpose of the following is to address requirements for contingency planning for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) CP-2 - ESP must submit a contingency plan that will support and meet the SSA supplied recovery objectives and must be maintained, reviewed, and, if necessary, updated at least annually.

(b) CP-9 - ESPs must encrypt all media used for backup and archiving purposes using Federal Information Processing Standard (FIPS) 140-2 compliant solutions. (Moderate and High categorized systems only.)

Identification and Authentication Requirements: The purpose of the following is to address requirements for identification and authentication for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) IA-2(12) (Identity, Authorization and Access Management (IdAAM)) - ESPs must seamlessly integrate with the SSA’s Federation Service. This service is based on oAuth and SAML (Security Assertion Markup Language) 2.0 standards and enables SSA to meet its 2-factor authentication requirements as specified in Homeland Security Presidential Directive (HSPD)-12, dated August 12, 2004. This service enables SSA to leverage an internal Microsoft’s Active Directory to create a single SSA-wide directory of all users. Currently, SSA users are required to authenticate using their SSA HSPD- 12 PIV Smart Card at the workstation. In certain acceptable instances, users can revert to user name and password, while SSA is transitioning to HSPD-12 PIV Smart Card Authentication. The ESPs must support both authentications methods.

(b) IA-6 - ESPs must mask all fields on a system that has a logon screen that requires credentials to prevent unauthorized exposure.

(c) IA-7 -The ESP must encrypt credentials used for e-authentication. The encryption solution must be compliant with FIPS 140-2. (Moderate and High categorized systems only.)

Incident Response Requirements: The purpose of the following is to address requirements for incident response for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) IR-6 - ESPs will receive the incident response capability timeframe and reporting requirements from the SSA COTR.

(b) IR-6 - ESPs Incident Response plan must require all security incidents of US CERT categories 1, 2, 3, 4, and 6 must be reported to SSA COTR.

(c) IR-7 - ESPs are responsible for notifying the appropriate SSA COTR when there is a security incident that has been categorized 1, 2, 3, 4, or 6 per US CERT regulations. The COTR is authorized to issue orders to take down external systems or components to perform IR, forensics, further loss of data, etc.

Maintenance Requirements: The purpose of the following is to address requirements for maintenance for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) MA-2 - ESP must retain records of maintenance activities performed on IT devices used to provide services to SSA. Maintenance activity logs must be made available upon request.

(b) MA-2 - IT equipment and media used to provide services to SSA must be sanitized prior to removal from the ESP’s facility for maintenance or disposal purposes. The ESP must maintain a log as evidence that the IT equipment or media was sanitized prior to removal. Logs must be made available upon request. Refer to NIST SP 800-88 for more information on media sanitization.

Media Protection Requirements: The purpose of the following is to address requirements for media protection for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) MP-2 - Removable media used to store SSA data must be encrypted using a FIPS 140-2 compliant encryption solution.

(b) MP-3 - ESP must label or mark (human readable) all media containing PII or other sensitive SSA data as “SSA Confidential Unclassified Information.” (Moderate and High categorized systems only.)

(c) MP-4 - ESP must have a documented process describing how IT equipment and media are controlled to ensure the security and confidentiality of SSA data.

(d) MP-5 - ESP must maintain chain of custody for IT equipment and media during transport outside of controlled-access facilities. Transport of media outside of controlled areas must be performed by authorized personnel.

Planning Requirements: The purpose of the following is to address requirements for the planning for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) PL-2 - ESP must develop a System Security Plan (SSP) compliant with SP 800-18. The SSP shall be submitted to the SSA COTR.

(b) PL-2 - ESP must conduct an annual security review of the solution used to provide services to SSA.

The SSP must be updated to reflect changes affecting the security of SSA data.

(c) PL-4 - The SSA COTR will provide the SSA Rules of Behavior (within the SSA Information System Security Handbook) for ESP systems that support internal users providing services to SSA. The rules of behavior ensure users are familiar with information security, privacy, and confidentiality practices.

Risk Assessment Requirements: The purpose of the following is to address requirements for risk assessment for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) RA-3 - ESPs shall conduct a risk assessment to assess the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of sensitive SSA information. The risk assessment should be reviewed annually and updated every three (3) calendar years or when a significant change occurs.

(b) RA-5 - ESP must scan IT equipment used to provide services to SSA for security vulnerabilities at least monthly. The contractor must use a commercially available scanning tool. The scanning must include vulnerabilities identified in DHS national vulnerability database. Vulnerability scan reports must be retained for 12 months and submitted to the SSA COTR upon request.

Security Assessments and Authorization Requirements: The purpose of the following is to address requirements for security assessments and authorization for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) CA-2 - ESPs must develop an assessment plan that includes:

Annual assessment of a subset of controls Triennial comprehensive assessment (full scope) Assessments as needed when a significant change occurs on the system.

(b) CA-2 - ESP and COTR must define what a significant change is and require a new assessment whenever a significant change occurs. Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.

(c) CA-3 - The contractor shall document in the SSA security plan, all connections to contractor resources made to external information systems, and applications. Examples of connections would include:

connections to subcontractor sites, connections used for remote administration, connections made to contractor’s company/corporate networks, etc. These connections shall be reviewed and monitored on an ongoing basis, at least annually to determine the need for ongoing use by the contractor management.

(d) CA-5 - For any security reports issued to the contractor, including internal independent reviews, the contractor is responsible for developing a Plan of Action and Milestone (POA&M) that identifies corrective actions and/or mitigating controls for any identified vulnerabilities. Contractors shall report to the COTR POA&M progress at least monthly. In addition, the contractor must provide artifacts to update POA&M items at least seven (7) calendar days prior to milestone completion date to ensure SSA has sufficient time to review.

(e) CA-7 - ESP must monitoring the effectiveness of its security controls on a continual basis and take appropriate corrective actions as necessary to ensure SSA data is protected from unauthorized access, modification or disclosure.

System and Communication Requirements: The purpose of the following is to address requirements for system and communications for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) SC-4 - ESP must logically or physically segregate SSA data from that of other customer if a multi-tenant environment is used to provide services to SSA. (Moderate and High categorized systems only.)

(b) SC-7(1) - ESPs shall physically allocate publicly accessible information system components to separate subnetworks with separate physical network interfaces.

(c) SC-7(4) - ESPs must provide traffic flow policy for each managed interface to SSA COTR for review and approval prior to implementation.

(d) SC-8 - ESP must encrypt PII and other sensitive SSA data when stored on persistent storage devices or when transmitted over approved system interconnections using a FIPS 140-2 compliant encryption solution (Moderate and High categorized systems only.)

(e) SC-10 - ESPs must terminate user sessions automatically after 15 minutes of inactivity. (Moderate and High categorized systems only.)

(f) SC-15 - ESPs use of collaborative computing devices (e.g., networked whiteboards, cameras, and microphones) on systems hosting/processing shall have their remote activation capability removed/disabled.

(g) SC-17 - For all ESPs who manage information systems, the information system shall utilize automated mechanisms with supporting procedures in place for digital certificate generation, installation, and distribution. Subscriber key pairs are generated and stored using FIPS 140-2 Security Level 2 or higher cryptographic modules. The same public/private key pair is not to be used for both encryption and digital signature. Private keys are protected using, at a minimum, a strong password. A certificate is revoked if the associated private key is compromised; management requests revocation; or, the certificate is no longer needed. (Moderate and High categorized systems only.)

(h) SC-18 - Mobile code is software that is executed from a host machine to run scripts on a client machine, including animation scripts, movies, etc. Mobile code is a powerful computing tool that can introduce risks to the user’s information system. Whenever an ESP is developing or deploying the mobile code technology, this shall be identified in the ESP’s security plan to SSA. Contractors who use mobile code shall be subject to a source code review by SSA personnel to ensure that there is no potential risk in introducing malicious code into the contractor/user’s environment. (Moderate and High categorized systems only.)

Personnel Security Requirements: The purpose of the following is to address requirements for personnel security for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) PS-4 - ESP must terminate employee and subcontractor access to the solution used to provide services to SSA immediately upon reassignment or separation.

(b) PS-6 - ESP personnel who are granted access to IT equipment, media, or data used to provide services to SSA must agree and sign a non-disclosure agreement prohibiting unauthorized disclosure of SSA data encountered in the performance of their duties.

(c) PS-7 - ESP subcontractors are bound to the same security requirements as employees.

(d) PS-8 - ESP must inform the SSA COTR of any violation of security requirements within 24 hours.

System and Information Integrity Requirements: The purpose of the following is to address requirements for system and information integrity for ESPs. SSA’s additional requirements for ESPs are as follows –

(a) S1-2 - ESPs will remediate discovered flaws in the information system according to a process that is approved by the COTR.

(b) SI-3 - ESP must submit alerts on malicious code detection and actions performed on malicious code to the SSA COTR for review.

(c) SI-4 - The ESP shall employ tools and techniques to monitor events on the information system to detect attacks and vulnerabilities, and detect, deter, and report on unauthorized use of the information system. Whenever there is an elevated security level, the monitoring efforts shall be increased as necessary to enable detection, deterrence, and reporting to take place so that corrective actions shall be made to the networked environment.

(d) SI-5 - ESPs must receive advisories (from US CERT) on a regular basis and take appropriate actions as necessary.

(e) SI-11 - The information system shall identify security relevant error conditions and handle error conditions in an expeditious manner. (Moderately and High categorized systems only.)

Government Access Requirements (FedRAMP): To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, availability, and reliability of any non-public Government data collected and stored by the contractor, the contractor shall afford the Government access to the contractor’s facilities, installations, technical capabilities, operations, documentation, records and databases. The contractor shall also identify how the following compliance, oversight, and law enforcement objectives can be effectively and efficiently conducted by SSA in the event such activity is deemed by SSA to be appropriate and necessary relative to the facilities, installations, operations, documentation, databases, IT systems, devices, and personnel used in performance of the contract, regardless of the location:

Audits;

Inspections;

Evaluations;

Investigations;

Continuous monitoring of the security posture and continued effectiveness of management, operational and technical controls (including IT asset and device discovery, inventory, and security configurations);

Penetration testing; and Vulnerability testing