96- S Exhibit R - SSP TEMPLATE FY17 - Externally Hosted System.pdf

UNCLASSIFIED // FOR OFFICIAL USE ONLY

UNCLASSIFIED // FOR OFFICIAL USE ONLY

TEMPLATE VERSION (V2.2 FY17)

Exhibit R

Social Security Administration (SSA)

Security Categorization: <Enter Categorization>

NOTE: The Security Categorization for the system may not be available at the time of the development of this document if the system is a newly developed system or has undergone a major change which has augmented the data types processed by the system. Additional information on completing the security categorization of the information system can be found on the DSPP website at:

http://sharepoint.ba.ssa.gov/DCS/OIS/DSPP/Veris%20TO14%20IVV%20and%20OA/ Forms/AllItems.aspx?RootFolder=%2fDCS%2fOIS%2fDSPP%2fVeris%20TO14%20I VV%20and%20OA%2fIVV%2fTEMPLATES%2fOIS%20TEMPLATES%20FY16&Fol derCTID=0x0120003BC3DC1169B0CE47BB662BC248F5B5EE. REMOVE THIS

NOTE BEFORE PUBLISHING.

<Document Name>

FOR

<Externally Hosted Information System Name> <(Acronym)>

<DRAFT/FINAL> Version <X.X> <Month DD, YYYY>

Prepared by

[COMPANY LOGO]

[COMPANY STREET ADDRESS]

[COMPANY CITY, STATE ZIP]

Social Security Administration <System Name><System Acronym>

Version <X.X>

TMP V2.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY ii

Document Revision History

Revision Number

Revision Date

Page Number Revision Summary Name of

Reviewer

V[X.X] MM/DD/YYYY All/Page No. [E.g. Initial Draft, Annual Review, etc.]

[Company/Agency Name: Contact

Name]

<System Name><(System Acronym)>

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY iii

PREFACE

To carry out its wide-ranging responsibilities, the Social Security Administration (SSA), and its employees and managers have access to diverse and complex automated information systems, which includes, file servers, local and wide area networks (LANs/WANs) running on various platforms, and telecommunications systems. The components and offices within the SSA depend on the confidentiality, integrity, and availability (as defined by the Federal Information Processing Standard (FIPS) 199) of these systems and their data in order to accomplish day-to-day operations.

In accordance with Office of Management and Budget (OMB) Circular A-130, Appendix III, all federal systems have value and require some level of protection. The generic term “system” is used to mean either a general support system or a major application. (See NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information Systems for additional information).

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY iv

EXECUTIVE SUMMARY

The SSA relies on its information technology (IT) systems, including the [Enter SYSTEM NAME (Acronym)], to accomplish its undertaking of providing cost-effective and reliable services to the SSA, other Federal agencies, and the public at large. Since this externally hosted information system is part of an SSA security authorization boundary, it is subject to meet some or all of the SSA specific security requirements depending upon the information it processes and the services it provides for the SSA.

[Provide an EXECUTIVE SUMMARY and overview of the information system. This summary should describe what the information system is, what its importance is to SSA, who is in the user audience, and any additional subsystems that is encompassed in the system.]

The purpose of this system security plan is to provide an overview of the security requirements of the [ENTER SYSTEM NAME HERE] system and describe the controls in place or planned for meeting those requirements. The system security plan also delineates responsibilities and expected behavior of all individuals who access the system.

The SSP documents the structured process of planning adequate, cost-effective security protection for a system. It shall reflect input from various managers/stakeholders with responsibilities concerning the system from the hosting company and from the SSA component for which the system provides services.

[Note: This SSP template shall be used to document an external hosted Information Systems that “IS” associated with one of the existing SSA Security Authorization Boundaries.

As part of the development of this SSP document, the external system ISO or designee along with the SSA SAM and the Office of Information Security (OIS) will need to follow the instructions to determine which new application/system/sub-system should be included or associated with SSA. See section 1.1 below for more details related to this process.] DELETE THESE INSTRUCTIONS UPON COMPLETION

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY v

SYSTEM SECURITY PLAN AGREEMENT SUMMARY

This SSP documents a formal agreement among the organizational officials approving the security controls designed to meet the security requirements for the [SYSTEM NAME]. These officials are the SSA System Owner (SO), (External Contractor) Information System Security Officer (ISSO), SSA Security Authorization Manager (SAM) and the SSA Authorizing Official (AO).

Each organizational official has signed this agreement summary for the reasons identified below and has concurred with the security category of this Controlled Unclassified Information (CUI) system to be [LOW/MODERATE]. See Executive Order 13556 for more information on CUI.

[Check the box below that is applicable DELETE]

Initiation of the System Security Plan (including FIPS 199 security categorization)1 Annual Update of the System Security Plan (no significant changes)

Acceptance and Signature As the Designated Representative(s) for <System Name>, I hereby certify that the <System Acronym> System Security Plan described in this document provides an accurate representation of the <System Acronym> and its subsystems.

SSA Security Authorization Manager

[ENTER NAME OF SAM DELETE

<Insert digital signature>

SSA DSP Director

[ENTER NAME OF DSP DIRECTOR]

DELETE

<Insert digital signature>

1 When there are no significant changes, the System Owner, Information System Security Officer and SSA Security Authorization Manager must sign the agreement summary for an annual update. The Authorizing Official is not required to sign if there are no significant changes affecting the security posture of the system requiring reauthorization. Reauthorization is addressed via a formal memorandum approving the security plan and authorizing the system to operate for a specified period of time.

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY vi

Table of Contents

1 INFORMATION SYSTEM IDENTIFICATION

1.1 DETERMINATION OF SYSTEM

1.2 RESPONSIBLE ORGANIZATION

1.3 INFORMATION SYSTEM CATEGORIZATION

1.4 GENERAL DESCRIPTION OF INFORMATION SENSITIVITY

1.5 IMPACT LEVEL FOR INFORMATION TYPES

1.6 SYSTEM POINTS OF CONTACT

1.7 ASSIGNMENT OF SECURITY RESPONSIBILITY

1.8 SYSTEM OPERATIONAL STATUS

1.9 INFORMATION SYSTEM TYPE

1.10 SECURITY STATUS

1.11 GENERAL DESCRIPTION AND PURPOSE

1.12 DATA TYPES

1.13 INFORMATION SYSTEM BOUNDARY

1.14 SYSTEM ARCHITECTURE/ENVIRONMENT

1.15 SECURITY AUTHORIZATION BOUNDARY

1.16 SYSTEM INVENTORY

1.17 SYSTEM INTERCONNECTIONS

2 [SYSTEM ACRONYM] NIST SP 800-53 - REV 4 MINIMUM SECURITY CONTROLS

2.1 SECURITY CONTROLS

2.1.1 Access Control (AC)

2.1.1.1 AC-1 Access Control Policy and Procedures

2.1.1.2 AC-2 Account Management

2.1.1.3 AC-3 Access Enforcement

2.1.1.4 AC-4 Information Flow Enforcement

2.1.1.5 AC-5 Separation of Duties

2.1.1.6 AC-6 Least Privilege

2.1.1.7 AC-7 Unsuccessful Logon Attempts

2.1.1.8 AC-8 System Use Notification

2.1.1.9 AC-11 Session Lock

2.1.1.10 AC-12 Session Termination

2.1.1.11 AC-14 Permitted Actions without Identification or Authentication

2.1.1.12 AC-17 Remote Access

2.1.1.13 AC-18 Wireless Access

2.1.1.14 AC-19 Access Control for Mobile Devices

2.1.1.15 AC-20 Use of External Information Systems

2.1.1.16 AC-21 Information Sharing

2.1.1.17 AC-22 Publicly Accessible Content

2.1.2 Awareness and Training (AT)

2.1.2.1 AT-1 Security Awareness and Training Policy and Procedures

2.1.2.2 AT-2 Security Awareness Training

2.1.2.3 AT-3 Role-Based Security Training

2.1.2.4 AT-4 Security Training Records

2.1.3 Audit and Accountability (AU)

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY vii

2.1.3.1 AU-1 Audit and Accountability Policy and Procedures

2.1.3.2 AU-2 Audit Events

2.1.3.3 AU-3 Content of Audit Records

2.1.3.4 AU-4 Audit Storage

2.1.3.5 AU-5 Response to Audit Processing Failures

2.1.3.6 AU-6 Audit Review, Analysis, and Reporting

2.1.3.7 AU-7 Audit Reduction and Report Generation

2.1.3.8 AU-8 Time Stamps

2.1.3.9 AU-9 Protection of Audit Information

2.1.3.10 AU-11 Audit Record Retention

2.1.3.11 AU-12 Audit Generation

2.1.4 Security Assessment and Authorization (CA)

2.1.4.1 CA-1 Security Assessment and Authorization Policies and Procedures

2.1.4.2 CA-2 Security Assessments

2.1.4.3 CA-3 System Interconnections

2.1.4.4 CA-5 Plan of Action and Milestones

2.1.4.5 CA-6 Security Authorization

2.1.4.6 CA-7 Continuous Monitoring

2.1.4.7 CA-9 Internal System Connections

2.1.5 Configuration Management (CM)

2.1.5.1 CM-1 Configuration Management Policy and Procedures

2.1.5.2 CM-2 Baseline Configuration

2.1.5.3 CM-3 Configuration Change Control

2.1.5.4 CM-4 Security Impact Analysis

2.1.5.5 CM-5 Access Restrictions for Change

2.1.5.6 CM-6 Configuration Settings

2.1.5.7 CM-7 Least Functionality

2.1.5.8 CM-8 Information System Component Inventory

2.1.5.9 CM-9 Configuration Management Plan

2.1.5.10 CM-10 Software Usage Restrictions

2.1.5.11 CM-11 User-Installed Software

2.1.6 Contingency Planning (CP)

2.1.6.1 CP-1 Contingency Planning Policy and Procedures

2.1.6.2 CP-2 Contingency Plan

2.1.6.3 CP-3 Contingency Training

2.1.6.4 CP-4 Contingency Plan Testing

2.1.6.5 CP-6 Alternate Storage Site

2.1.6.6 CP-7 Alternate Processing Site

2.1.6.7 CP-8 Telecommunications Services

2.1.6.8 CP-9 Information System Backup

2.1.6.9 CP-10 Information System Recovery and Reconstitution

2.1.7 Identification and Authentication (IA)

2.1.7.1 IA-1 Identification and Authentication Policy and Procedures

2.1.7.2 IA-2 Identification and Authentication

2.1.7.3 IA-3 Device Identification and Authentication

2.1.7.4 IA-4 Identifier Management

2.1.7.5 IA-5 Authenticator Management

2.1.7.6 IA-6 Authenticator Feedback

2.1.7.7 IA-7 Cryptographic Module Authentication

2.1.7.8 IA-8 Identification and Authentication (Non-Organizational Users)

2.1.8 Incident Response (IR)

2.1.8.1 IR-1 Incident Response Policy and Procedures

2.1.8.2 IR-2 Incident Response Training

2.1.8.3 IR-3 Incident Response Testing

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY viii

2.1.8.4 IR-4 Incident Handling

2.1.8.5 IR-5 Incident Monitoring

2.1.8.6 IR-6 Incident Reporting

2.1.8.7 IR-7 Incident Response Assistance

2.1.8.8 IR-8 Incident Response Plan

2.1.9 Maintenance (MA)

2.1.9.1 MA-1 System Maintenance Policy and Procedures

2.1.9.2 MA-2 Controlled Maintenance

2.1.9.3 MA-3 Maintenance Tools

2.1.9.4 MA-4 Nonlocal Maintenance

2.1.9.5 MA-5 Maintenance Personnel

2.1.9.6 MA-6 Timely Maintenance

2.1.10 Media Protection (MP)

2.1.10.1 MP-1 Media Protection Policy and Procedures

2.1.10.2 MP-2 Media Access

2.1.10.3 MP-3 Media Marking

2.1.10.4 MP-4 Media Storage

2.1.10.5 MP-5 Media Transport

2.1.10.6 MP-6 Media Sanitization

2.1.10.7 MP-7 Media Use

2.1.11 Physical and Environmental Protection (PE)

2.1.11.1 PE-1 Physical and Environmental Protection Policy and Procedures

2.1.11.2 PE-2 Physical Access Authorizations

2.1.11.3 PE-3 Physical Access Control

2.1.11.4 PE-4 Access Control for Transmission Medium

2.1.11.5 PE-5 Access Control for Output Devices

2.1.11.6 PE-6 Monitoring Physical Access

2.1.11.7 PE-8 Visitor Access Records

2.1.11.8 PE-9 Power Equipment and Cabling

2.1.11.9 PE-10 Emergency Shutoff

2.1.11.10 PE-11 Emergency Power

2.1.11.11 PE-12 Emergency Lighting

2.1.11.12 PE-13 Fire Protection

2.1.11.13 PE-14 Temperature and Humidity Controls

2.1.11.14 PE-15 Water Damage Protection

2.1.11.15 PE-16 Delivery and Removal

2.1.11.16 PE-17 Alternate Work Site

2.1.12 Planning (PL)

2.1.12.1 PL-1 Security Planning Policy and Procedures

2.1.12.2 PL-2 System Security Plan

2.1.12.3 PL-4 Rules of Behavior

2.1.12.4 PL-8 Information Security Architecture

2.1.13 Personnel Security (PS)

2.1.13.1 PS-1 Personnel Security Policy and Procedures

2.1.13.2 PS-2 Position Risk Designation

2.1.13.3 PS-3 Personnel Screening

2.1.13.4 PS-4 Personnel Termination

2.1.13.5 PS-5 Personnel Transfer

2.1.13.6 PS-6 Access Agreements

2.1.13.7 PS-7 Third-Party Personnel Security

2.1.13.8 PS-8 Personnel Sanctions

2.1.14 Risk Assessment (RA)

2.1.14.1 RA-1 Risk Assessment Policy and Procedures

2.1.14.2 RA-2 Security Categorization

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY ix

2.1.14.3 RA-3 Risk Assessment

2.1.14.4 RA-5 Vulnerability Scanning

2.1.15 System and Services Acquisition

2.1.15.1 SA-1 System and Services Acquisition Policy and Procedures

2.1.15.2 SA-2 Allocation of Resources

2.1.15.3 SA-3 System Development Life Cycle

2.1.15.4 SA-4 Acquisition Process

2.1.15.5 SA-5 Information System Documentation

2.1.15.6 SA-8 Security Engineering Principles

2.1.15.7 SA-9 External Information System Services

2.1.15.8 SA-10 Developer Configuration Management

2.1.15.9 SA-11 Developer Security Testing and Evaluation

2.1.16 System and Communications Protection

2.1.16.1 SC-1 System and Communications Protection Policy and Procedures

2.1.16.2 SC-2 Application Partitioning

2.1.16.3 SC-4 Information in Shared Resources

2.1.16.4 SC-5 Denial of Service Protection

2.1.16.5 SC-7 Boundary Protection

2.1.16.6 SC-8 Transmission Confidentiality and Integrity

2.1.16.7 SC-10 Network Disconnect

2.1.16.8 SC-12 Cryptographic Key Establishment and Management

2.1.16.9 SC-13 Cryptographic Protection

2.1.16.10 SC-15 Collaborative Computing Devices

2.1.16.11 SC-17 Public Key Infrastructure Certificates

2.1.16.12 SC-18 Mobile Code

2.1.16.13 SC-19 Voice Over Internet Protocol

2.1.16.14 SC-20 Secure Name / Address Resolution Service (Authoritative Source)

2.1.16.15 SC-21 Secure Name / Address Resolution Service (Recursive or Caching Resolver)

2.1.16.16 SC-22 Architecture and Provisioning for Name / Address Resolution Service

2.1.16.17 SC-23 Session Authenticity

2.1.16.18 SC-28 Protection of Information at Rest

2.1.16.19 SC-39 Process Isolation

2.1.17 System and Information Integrity

2.1.17.1 SI-1 System and Information Integrity Policy and Procedures

2.1.17.2 SI-2 Flaw Remediation

2.1.17.3 SI-3 Malicious Code Protection

2.1.17.4 SI-4 Information System Monitoring

2.1.17.5 SI-5 Security Alerts, Advisories, and Directives

2.1.17.6 SI-7 Software, Firmware, and Information Integrity

2.1.17.7 SI-8 Spam Protection

2.1.17.8 SI-10 Information Input Validation

2.1.17.9 SI-11 Error Handling

2.1.17.10 SI-12 Information Handling and Retention

2.1.17.11 SI-16 Memory Protection

3 APPENDIX LISTING

3.1 REQUIRED APPENDICES

3.2 SYSTEM SPECIFIC APPENDICES

3.3 ACRONYM LIST

3.4 DEFINITIONS/GLOSSARY

3.5 APPLICABLE LAWS AND REFERENCES

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY x

LIST OF FIGURES

Figure 1: [System Acronym] Architecture Diagram Figure 2: [System Acronym] Accreditation Boundary

LIST OF TABLES

Table 1: System Name/Identifier Table 2: Responsible Organization Table 3: Security Categorization Table 4: Impact Level for Information Types Table 5: <System Name> Points of Contact Table 6: [System Acronym] (Contractor) Information System Security Officer (ISSO) Table 7: SSA Security Authorization Manager (SAM) Table 8: Information System Operational Status Table 9: Information System Type Table 10: NIST SP 800-60 Vol 2. Information Data Types Table 11: Inventory: List of Technologies Table 12: [System Acronym] System Interconnections

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 1

1 Information System Identification

1.1 Determination of System

Table 1: System Name/Identifier

System Name/Title: System ID No:

<System name: external information system name> ( short name-subsystem short name)

1.2 Responsible Organization

Table 2: Responsible Organization

Organization Address

1.3 Information System Categorization

Security categorizations are to be performed as the first step in the security authorization process as required by Federal Information Processing Standard (FIPS) 199 in order to select appropriate system security controls to be addressed throughout the rest of the security authorization. FIPS 199 categories are derived according to the potential impact on the agency that would occur if its Confidentiality, Integrity, or Availability were compromised. FIPS 199 category definitions are as follows:

• High Impact: The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

• Moderate Impact: The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. (At SSA, the highest security categorization is currently Moderate)

• Low Impact: The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

Based on the system categorization of this externally hosted system the [SYSTEM ACRONYM] system has been categorized as a [LOW/MODERATE] system according to FIPS 199.

[Enter an “X” in the applicable section] DELETE

Table 3: Security Categorization

Low

Moderate

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 2

1.4 General Description of Information Sensitivity

Sensitive information is defined by the Computer Security Act (section 552a of Title 5, United States Code) as any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled.

The National Institute of Standards and Technology (NIST) Special Publication 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) further defines the requirements for Personal Identity Information (PII) which SSA follows with regard to protecting its sensitive PII.

FIPS 199 defines security categories for information systems based on potential impact on organizations, assets, or individuals should there be a breach of security—that is, a loss of confidentiality, integrity, or availability. FIPS 199 security categories play an important part in defining information system security boundaries by partitioning the agency's information systems according to the criticality or sensitivity of the information and information systems and the importance of those systems in accomplishing the agency's mission. This is particularly important when there are various FIPS 199 impact levels contained in one information system. The FIPS 199 requirement to secure an information system to the high watermark or highest impact level must be applied when grouping minor applications/subsystems with varying FIPS 199 impact levels into a single general support system or major application unless there is adequate boundary protection, e.g., firewalls and encryption, around those subsystems or applications with the highest impact level. Additionally, there must be assurance that the shared resources, i.e., networks, communications, and physical access within the whole general support system or major application, are protected adequately for the highest impact level. Having the ability to isolate the high impact systems will not only result in more secure systems, but will also reduce the amount of resources required to secure many applications/systems that do not require that level of security. NIST SP 800-53 provides three security control baselines, i.e., low, moderate, and high (high is not addressed by this SSP), that are associated with the three FIPS 199 impact levels; as the impact level increases, so do the minimum assurance requirements. For reporting purposes, i.e., FISMA annual report, when an information system has varying FIPS 199 impact levels, that system is categorized at the highest impact level on that information system.

1.5 Impact Level for Information Types

The following tables identify the information types that are input, stored, processed, and/or output from [System Acronym]. The selection of the information types is based on guidance provided by OMB Federal Enterprise Architecture Program Management Office Business Reference Model 2.0 (http://www.whitehouse.gov/omb/e-gov/fea), and the FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, and NIST Special Publication (SP) 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories. SP 800-60 includes two volumes: Volume I is a basic guideline and Volume II contains appendices. Users should review the guidelines provided in Volume I, then refer to only the material from the appendices that is applicable. NIST SP 800-60 is available for download at http://csrc.nist.gov/publications/.

The potential impact is LOW if—

The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced;

(ii) result in minor damage to organizational assets; (iii) result in minor financial loss; or (iv) result in minor harm to individuals.

The potential impact is MODERATE if— http://csrc.nist.gov/publications/

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 3

The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

A serious adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced; (ii) result in significant damage to organizational assets; (iii) result in significant financial loss; or (iv) result in significant harm to individuals that does not involve loss of life or serious life threatening injuries.

The potential impact is HIGH if—

The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

A severe or catastrophic adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions; (ii) result in major damage to organizational assets; (iii) result in major financial loss; or (iv) result in severe or catastrophic harm to individuals involving loss of life or serious life threatening injuries.

[List the different information types per NIST SP 800-60 and indicate provisional impact level. Add or modify information types if necessary]. This information can be copy/pasted from the SSA Parent System FIPS199 Security Categorization Review documentation, Section 4. DELETE THESE

INSTRUCTIONS UPON COMPLETION

Table 4: Impact Level for Information Types

NIST

Information

Type

NIST

SP 800-60,

Volume II Reference

NIST Recommended Provisional Impact Levels System Owner

Selected Impact Levels Comments

Confidentiality Integrity Availability Confidentialit y Integrity Availability

EXAMPLE:

Personal Identity and Authentication Information Type

C.2.8.9 M M M M M M None

1.6 System Points of Contact

<Complete the attached spreadsheet with system specific information.>

Table 5: <System Name> Points of Contact

SSP-Point of Contacts.xlsx

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 4

1.7 Assignment of Security Responsibility

Table 6: [System Acronym] (Contractor) Information System Security Officer (ISSO)

Name:

Title:

Agency:

Address:

Telephone:

Email:

Responsibility: Individual with assigned responsibility for maintaining the appropriate operational security posture for an information system or program. Information System Security Officer (ISSO).

Table 7: SSA Security Authorization Manager (SAM)

Name:

Title:

Agency:

Address:

Telephone:

Email:

Responsibility: SSA Security Authorization Manager

1.8 System Operational Status

The [SYSTEM ACRONYM] and its component systems are in the [INITIATION, ACQUISITION/DEVELOPMENT, IMPLEMENATION, OPERATIONAL/MAINTENANCE] phase of their System Development Life Cycles (SDLC).

[Enter an “X” in the applicable section] DELETE

Table 8: Information System Operational Status

Initiation Development Implementation Operational

1.9 Information system Type

[Enter an “X” in the applicable section below] DELETE

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 5

Table 9: Information System Type

Subsystem/Application Major Application General Support System

1.10 Security Status

[SECURTIY AUTHORIZATION ACRONYM/ EXTERNAL INFORMATION SYSTEM ACRONYM] received a full Authority to Operate (ATO) on [Enter DATE of ATO].

1.11 General Description and Purpose

[This section should contain a detailed general description and overall purpose for the information system. It should identify the system's purpose, capabilities, users, arrangements for hosting, connection and/or interface to SSA, and information data flow; discuss the hardware, software and firmware implemented in support of the information system] DELETE

1.12 Data Types

Table 10: NIST SP 800-60 Vol 2. Information Data Types

NIST

Information

Type NIST SP 800-60, Volume II

Reference Data Type Description

EXAMPLE:

Personal Identity Information Type

C.2.8.9 Personal identity and authentication information includes that information necessary to ensure that all persons who are potentially entitled to receive any federal benefit are enumerated and identified so that Federal agencies can have reasonable assurance that they are paying or communicating with the right individuals. This information include individual citizen’s Social Security Numbers, names, dates of birth, places of birth, parents’ names, etc.

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 6

1.13 Information System Boundary

The [SYSTEM ACRONYM] system architecture, environment and agreement boundary is described below.

1.14 System Architecture/Environment

[Provide a description of the information system architecture/environment, explaining where and by whom it is hosted, whether it is a web-based (or cloud, etc.) application, what Software (SW) it is utilizing, what SW sits on the front end, back end, OS, how many users access the system, describe user interfaces, and designate whether connectivity to SSA and/or the outside is through VPN or WAN, etc.] DELETE

[INSERT a diagram of the information system architecture, including its connections/interfaces/other relationships to SSA]. DELETE

Figure 1: [System Acronym] Architecture Diagram

1.15 Security Authorization Boundary

[Provide information of where the information system is located; where backups and restores are conducted, and specifically where databases are housed. Provide an explanation of where the servers are located (company facility, datacenter, etc.), personnel, public access or not, how the systems are connected, how remote users can connect and how in and outbound internet connections are secured and maintained]. DELETE

[INSERT a diagram of the information security authorization boundary showing its connections/interfaces/other relationships to SSA.] DELETE

Figure 2: [System Acronym] Accreditation Boundary

1.16 System Inventory

The hardware (HW) and software (SW) components included in the externally hosted, non-SSA [System Acronym] boundary are listed in the tables below. <System acronym> consists of multiple technologies.

Table 6 contains a listing of technologies (hardware, software, technologies and platforms) that reside within the <system acronym> authorization boundary. Technology is listed per system and subsystem:

<Complete the embedded spreadsheet with system specific information.>

Table 11: Inventory: List of Technologies

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 7

Table 6_Inventory - List of Technologies -

NOTE: Any changes to the scope of the Authorization Boundary after the Boundary Scope Meeting and finalization of the BSM may impact the overall IV&V schedule.

1.17 System Interconnections

The externally hosted [SYSTEM ACRONYM] requires that written agreements (e.g., Memorandums of Understanding (MOUs), Memorandums of Agreement (MOAs), Interconnection Security Agreements (ISAs), etc., on the security controls to be enforced on interconnecting systems and must be obtained prior to connecting and/or sharing sensitive data/information. Table 18 shows the status of these agreements between [SYSTEM ACRONYM] and the external systems that share its information. [SYSTEM ACRONYM] [Has /does not have] external communications requiring MOUs or ISAs.

Table 12: [System Acronym] System Interconnections Information

System Organization Type

(GSS/MA)

Agreement

(ISA/MOU/MOA)

Date FIPS 199

Category C&A

Status

DAA

N/A N/A N/A N/A N/A N/A N/A N/A

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 8

2 [System Acronym] NIST SP 800-53 - Rev 4

MINIMUM SECURITY CONTROLS

The minimum security control baseline for [LOW/MODERATE]-impact systems from NIST SP 800-53 Revision 4 is documented below. Specifically, this section provides a description of how all the minimum-security controls in the baseline are being implemented, planned, and compensated or how they will be implemented in the future. The table contains: (1) the NIST SP Publication and revision number (2) the security control family and specific control with applicable enhancements; (3) if the security control is a common control, hybrid or system specific (4) the implementation statement; how the security control is being implemented or how it will be implemented (5) the implementation status to determine whether the control is in place, not in place, compensated or not applicable and (6) comments to capture specific notes about the control’s implementation. (Note: if not in place, an explanation will need to be provided under this section). Implementation statements of controls identified as common will reference the system and/or SSP that the control is inherited from.

2.1 Security Controls

Organizations employ security controls in federal information systems and the environments in which those systems operate in accordance with FIPS Publication 199, FIPS Publication 200, and NIST Special Publications 800-37 and 800-39. Security categorization of federal information and information systems, as required by FIPS Publication 199, is the first step in the risk management process. Next, organizations select an appropriate set of security controls for their information systems by satisfying the minimum-security requirements set forth in FIPS Publication 200. Appendix D includes three security control baselines that are associated with the designated impact levels of information systems as determined during the security categorization process. After baseline selection, organizations tailor the baselines by:

(i) identifying/designating common controls; (ii) applying scoping considerations; (iii) selecting compensating controls, if needed; (iv) assigning control parameter values in selection and assignment statements; (v) supplementing the baseline controls with additional controls and control enhancements from the security control catalog; and (vi) providing additional information for control implementation.

2.1.1 Access Control (AC)

2.1.1.1 AC-1 Access Control Policy and Procedures

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

c. Procedures to facilitate the implementation of the access control policy and associated access controls; and

d. Reviews and updates the current:

e. Access control policy [Assignment: organization-defined frequency]; and

f. Access control procedures [Assignment: organization-defined frequency].

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 9

NIST SP 800-53 Access Control Common (Fully Inherited Control)

Hybrid (Partially Inherited Control)

System Specific Control Revision 4 [AC-1]

Implementation Statement:

AC-1

Implementation Status: Status (check all that apply):

Implemented (In Place) Planned (Not in Place) Compensated Not Applicable Scoped

Comments:

2.1.1.2 AC-2 Account Management

a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

g. Monitors the use of, information system accounts;

h. Notifies account managers:

1. When accounts are no longer required;

2. When users are terminated or transferred; and

3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements [Assignment:

organization-defined frequency]; and

k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

(1) ACCOUNT MANAGEMENT | AUTOMATED SYSTEM ACCOUNT MANAGEMENT

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 10

The organization employs automated mechanisms to support the management of information system accounts.

(2) ACCOUNT MANAGEMENT | REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS

The information system automatically [Selection: removes; disables] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].

(3) ACCOUNT MANAGEMENT | DISABLE INACTIVE ACCOUNTS

The information system automatically disables inactive accounts after [Assignment:

organization-defined time period].

(4) ACCOUNT MANAGEMENT | AUTOMATED AUDIT ACTIONS

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].

NIST SP 800-53 Access Controls Common (Fully Inherited Control)

Hybrid (Partially Inherited Control)

System Specific Control Revision 4 [AC-2]

AC-2

Control Enhancement AC-2(1)

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 11

Control Enhancement AC-2(2)

Control Enhancement AC-2(3)

Control Enhancement AC-2(4)

2.1.1.3 AC-3 Access Enforcement

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 12

Hybrid (Partially Inherited Control)

System Specific Control Revision 4 [AC-3]

AC-3

2.1.1.4 AC-4 Information Flow Enforcement

The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].

System Specific Control Revision 4 [AC-4]

AC-4

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 13

2.1.1.5 AC-5 Separation of Duties

The organization:

a. Separates [Assignment: organization-defined duties of individuals];

b. Documents separation of duties of individuals; and

c. Defines information system access authorizations to support separation of duties.

System Specific Control Revision 4 [AC-5]

AC-5

2.1.1.6 AC-6 Least Privilege

The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Control Enhancements:

(1) LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY FUNCTIONS

The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].

(2) LEAST PRIVILEGE | NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS

The organization requires that users of information system accounts, or roles, with access to [Assignment:

organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions.

(5) LEAST PRIVILEGE | PRIVILEGED ACCOUNTS

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 14

The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].

(9) LEAST PRIVILEGE | AUDITING USE OF PRIVILEGED FUNCTIONS

The information system audits the execution of privileged functions.

(10) LEAST PRIVILEGE | PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED

FUNCTIONS

The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

NIST SP 800-53 Access Controls Common (Fully Inherited Control)

System Specific Control Revision 4 [AC-6]

AC-6

Control Enhancement AC-6(1)

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 15

Control Enhancement AC-6(2)

Control Enhancement AC-6(5)

Control Enhancement AC-6(9)

Control Enhancement AC-6(10)

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 16

2.1.1.7 AC-7 Unsuccessful Logon Attempts

The information system:

a. Enforces a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]; and

b. Automatically [Selection: locks the account/node for an [Assignment: organization-defined time period]; locks the account/node until released by an administrator; delays next logon prompt according to [Assignment: organization-defined delay algorithm]] when the maximum number of unsuccessful attempts is exceeded.

System Specific Control Revision 4 [AC-7]

AC-7

2.1.1.8 AC-8 System Use Notification

a. Displays to users [Assignment: organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:

1. Users are accessing a U.S. Government information system;

2. Information system usage may be monitored, recorded, and subject to audit;

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 17

3. Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and

4. Use of the information system indicates consent to monitoring and recording;

b. Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

c. For publicly accessible systems:

1. Displays system use information [Assignment: organization-defined conditions], before granting further access;

2. Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

3. Includes a description of the authorized uses of the system.

System Specific Control Revision 4 [AC-8]

AC-8

2.1.1.9 AC-11 Session Lock

a. Prevents further access to the system by initiating a session lock after [Assignment:

organization-defined time period] of inactivity or upon receiving a request from a user; and

b. Retains the session lock until the user reestablishes access using established identification and authentication procedures.

(1) SESSION LOCK | PATTERN-HIDING DISPLAYS

The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 18

Hybrid (Partially Inherited Control)

System Specific Control Revision 4 [AC-11]

AC-11

AC-11(1)

2.1.1.10 AC-12 Session Termination

The information system automatically terminates a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect].

System Specific Control Revision 4 [AC-12]

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 19

AC-12

2.1.1.11 AC-14 Permitted Actions without Identification or Authentication

a. Identifies [Assignment: organization-defined user actions] that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and

b. Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.

System Specific Control Revision 4 [AC-14]

AC-14

2.1.1.12 AC-17 Remote Access

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 20

a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

b. Authorizes remote access to the information system prior to allowing such connections.

(1) REMOTE ACCESS | AUTOMATED MONITORING / CONTROL

The information system monitors and controls remote access methods.

(2) REMOTE ACCESS | PROTECTION OF CONFIDENTIALITY / INTEGRITY USING ENCRYPTION

The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

(3) REMOTE ACCESS | MANAGED ACCESS CONTROL POINTS

The information system routes all remote accesses through [Assignment: organization-defined number] managed network access control points.

(4) REMOTE ACCESS | PRIVILEGED COMMANDS / ACCESS

(a) Authorizes the execution of privileged commands and access to security-relevant information via remote access only for [Assignment: organization-defined needs]; and

(b) Documents the rationale for such access in the security plan for the information system.

System Specific Control Revision 4 [AC-17]

AC-17

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 21

Control Enhancement AC-17(1)

Control Enhancement AC-17(2)

Control Enhancement AC-17(3)

Control Enhancement AC-17(4)

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 22

2.1.1.13 AC-18 Wireless Access

a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

b. Authorizes wireless access to the information system prior to allowing such connections.

(1) WIRELESS ACCESS | AUTHENTICATION AND ENCRYPTION

The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.

System Specific Control Revision 4 [AC-18]

AC-18

Control Enhancement AC-18(1)

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 23

2.1.1.14 AC-19 Access Control for Mobile Devices

a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

b. Authorizes the connection of mobile devices to organizational information systems.

(5) ACCESS CONTROL FOR MOBILE DEVICES | FULL DEVICE / CONTAINER-BASED

ENCRYPTION

The organization employs [Selection: full-device encryption; container encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].

System Specific Control Revision 4 [AC-19]

AC-19

Control Enhancement AC-19(5)

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 24

2.1.1.15 AC-20 Use of External Information Systems

The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:

a. Access the information system from external information systems; and

b. Process, store, or transmit organization-controlled information using external information systems.

(1) USE OF EXTERNAL INFORMATION SYSTEMS | LIMITS ON AUTHORIZED USE

The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:

(a) Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or

(b) Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.

(2) USE OF EXTERNAL INFORMATION SYSTEMS | PORTABLE STORAGE DEVICES

The organization [Selection: restricts; prohibits] the use of organization-controlled portable storage devices by authorized individuals on external information systems.

System Specific Control Revision 4 [AC-20]

AC-20

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 25

Control Enhancement AC-20(1)

Control Enhancement AC-20(2)

2.1.1.16 AC-21 Information Sharing

a. Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [Assignment: organization-defined information sharing circumstances where user discretion is required]; and

b. Employs [Assignment: organization-defined automated mechanisms or manual processes] to assist users in making information sharing/collaboration decisions.

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 26

System Specific Control Revision 4 [AC-21]

AC-21

2.1.1.17 AC-22 Publicly Accessible Content

a. Designates individuals authorized to post information onto a publicly accessible information system;

b. Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

c. Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and

d. Reviews the content on the publicly accessible information system for nonpublic information [Assignment: organization-defined frequency] and removes such information, if discovered.

System Specific Control Revision 4 [AC-22]

AC-22

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 27

2.1.2 Awareness and Training (AT)

2.1.2.1 AT-1 Security Awareness and Training Policy and Procedures

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

1. A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

2. Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and

b. Reviews and updates the current:

1. Security awareness and training policy [Assignment: organization-defined frequency]; and

2. Security awareness and training procedures [Assignment: organization-defined frequency].

NIST SP 800-53 Awareness and Training

Common (Fully Inherited Control)

Hybrid (Partially Inherited Control)

System Specific Control Revision 4 [AT-1]

AT-1

2.1.2.2 AT-2 Security Awareness Training

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 28

The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):

a. As part of initial training for new users;

b. When required by information system changes; and

c. [Assignment: organization-defined frequency] thereafter.

(2) SECURITY AWARENESS | INSIDER THREAT

The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.

Common (Fully Inherited Control)

Hybrid (Partially Inherited Control)

System Specific Control Revision 4 [AT-2]

AT-2

Control Enhancement AT-2(2)

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 29

2.1.2.3 AT-3 Role-Based Security Training

The organization provides role-based security training to personnel with assigned security roles and responsibilities:

a. Before authorizing access to the information system or performing assigned duties;

b. When required by information system changes; and

c. [Assignment: organization-defined frequency] thereafter.

Common (Fully Inherited Control)

Hybrid (Partially Inherited Control)

System Specific Control Revision 4 [AT-3]

AT-3

2.1.2.4 AT-4 Security Training Records

a. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

b. Retains individual training records for [Assignment: organization-defined time period].

Common (Fully Inherited Control)

Hybrid (Partially Inherited Control)

System Specific Control Revision 4 [AT-4]

AT-4

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 30

2.1.3 Audit and Accountability (AU)

2.1.3.1 AU-1 Audit and Accountability Policy and Procedures

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

1. An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance;

and

2. Procedures to facilitate the implementation of the audit and accountability policy and associated…