96-S_Exhibit_S_-_ESP_SOW_Security_Requirements.pdf

Exhibit S

SSA External Service Provider Security Requirements

This resource identifies the basic information security requirements related to the procurement of Information Technology (IT) services hosted externally to SSA’s Network.

The following general security requirements apply to all External Service Providers (ESP).

a. The solution must be located in the United States1, its territories or possessions.

b. Upon request from the SSA Contracting Officer Technical Representative (COTR) the ESP shall provide access to the hosting facility to the US Government or authorized agents for inspection and facilitate an on-site security risk and vulnerability assessment.

c. The solution must meet Federal Information Processing Standards (FIPS) and guidance developed by the National Institute of Science and Technology (NIST) under its authority provided by the Federal Information Security Management Act (FISMA) to develop security standards for federal information processing systems, and Office of Management and Budget’s (OMB) Circular A-130 Appendix III.

d. ESPs classified as Cloud Service Providers (CSP) must adhere to additional FedRAMP security control requirements. Further information may be found at:

http://www.gsa.gov/portal/category/102371. As part of these requirements CSPs must have a security control assessment performed by a Third Party Assessment Organization (3PAO).

e. The ESP shall submit to the SSA COTR documentation describing how the solution implements security controls in accordance with the designated categorization (FIPS 199) and the Minimum Security Requirements for Federal Information and Information Systems (FIPS 200) which requires the use of NIST SP 800-53 Rev4 before SSA provides data.

f. All ESPs that process or store Personally Identifiable Information (PII) 2 are considered a Moderate impact categorization. If PII or sensitive data (defined by the COTR) is stored or processed by the ESP, then the ESP shall provide a Security Assessment Package (SAP) created by an independent assessor3. The SAP should include a System Security Plan (SSP), Security Assessment Report (SAR), Risk Assessment Report (RAR), and Plan of Action & Milestone Report (POA&M). The SAP must be reviewed by SSA before the SSA transfers data to the ESP. Refer to NIST SP 800-37 for more information on the Security Assessment Package.

g. SSA will consider a self-assessment of security controls for solutions that do not involve sensitive information or PII.

For additional security requirements and NIST 800-53, REV 4 organization defined parameters, refer to “ESP Additional Security Controls” attachment.

1 “United States” means the 50 States, the District of Columbia, Puerto Rico, the Northern Mariana Islands, American Samoa, Guam, the U.S. Virgin Islands, Johnston Island, Wake Island, and Outer Continental Shelf Lands as defined in the Outer Continental Shelf Lands Act (43 U.S.C. 1331, et seq.), but does not include any other place subject to U.S. jurisdiction or any U.S. base or possession within a foreign country (29 CFR 4.112).

2 PII is any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

3 Independent assessor is any individual or group capable of conducting an impartial assessment of security controls employed within or inherited by an information system.

http://www.gsa.gov/portal/category/102371

References – Refer to most up to date revision.

• Federal Information Security Management Act (FISMA) of 2002.

• Clinger‐Cohen Act of 1996 also known as the “Information Technology Management Reform Act of

1996.”

• Privacy Act of 1974 (5 U.S.C. § 552a).

• Homeland Security Presidential Directive (HSPD‐12), “Policy for a Common Identification Standard for Federal Employees and Contractors”, August 27, 2004.

• Office of Management and Budget (OMB) Circular A‐130, “Management of Federal Information

Resources”, and Appendix III, “Security of Federal Automated Information Systems”, as amended.

• OMB Memorandum M‐04‐04, “E‐Authentication Guidance for Federal Agencies.”

• FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information

Systems.”

• FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems.”

• FIPS PUB 140‐2, “Security Requirements for Cryptographic Modules.”

• NIST Special Publication 800-18, “Guide for Developing Security Plans for Federal Information

Systems.”

• NIST Special Publication 800-30, “Risk Management Guide for Information Technology Security Risk

Assessment Procedures for Information Technology Systems.”

• NIST Special Publication 800-34, “Contingency Planning Guide for Information Technology Systems.”

• NIST SP 800‐37 “Guide for the Security Certification and Accreditation of Federal Information

Systems.”

• NIST Special Publication 800-47, “Security Guide for Interconnecting Information Technology

Systems.”

• NIST Special Publication 800-53, “Recommended Security Controls for Federal Information

Systems.”

• NIST Special Publication 800-53A, “Guide for Assessing the Security Controls in

• Federal Information Systems, ”CIO Council’s Federal Identity, Credential, and Access Management

(FICAM) Roadmap and Implementation Guidance”

• NIST Special Publication 800-60

• OMB M-07-16, AIMS Chapter 15: Personally Identifiable Information (PII) Loss and Remediation