030ADV24R0008 - Attachment J-5 - ITSG_SD_5-410-1.pdf

THE LIBRARY OF CONGRESS

WASHINGTON, D.C. 20540

Information Technology Security Directive

5-410.1

General Information Technology Security

TO: Library of Congress Executive Committee (EC)

Library of Congress Information Technology Steering Committee (ITSC)

FROM: Bernard A. Barton, Chief Information Officer (CIO), Office of the Chief Information Officer (OCIO)

SUBJECT: General Information Technology Security Directive

EFFECTIVE March 29, 2019

IT Security Directive 5-410.1

March 29, 2019 ii

Revision History Revision Date Revised By Notes

3.4 March 29, 2019 Karen Beirne Removed 5.3.3.d, 3.5.f, 5.3.3.l, 5.3.3.m

Revised 5.3.3.h

Removed references to ITSG. Updated to ITSEC and removed Compliance Office.

iii

Table of Contents

Introduction Information Technology Security Program Authorities

Scope 2 Policy Overview Definitions Waivers and Waiver Requests

Waivers

Waiver Requests Changes to Policy Roles and Responsibilities

IT Security Program Roles LC Chief Information Security Officer (CISO) / Senior Agency Information Security

Officer

Authorizing Official (AO) Information System Business Owner (ISBO) Information Systems Security Officer

Other Roles Library of Congress Chief Information Officer (CIO)

Heads of LC Service Units Information Owner/Steward

Common Control Provider LC Employees, Contractors, and Others Working on Behalf of LC

ITSEC

Management Policies Basic Requirements

Capital Planning and Investment Control Contractors and Outsourced Operations

Continuity Planning for Critical LC Assets

Continuity of Operations Planning

IT Contingency Planning and Testing System Development Life Cycle (SDLC) Requirements Definitions Design Development

Test Implementation Operations and Maintenance Configuration Management Risk Management

Risk Assessment Security Authorization and Security Control Assessments

Ongoing Authorization System Security Plan (SP) iv

Security Control Assessment and Security Acceptance Testing

Plan of Action and Milestones (POA&Ms) Information Security Policy Violation and Disciplinary Action Required Reporting Privacy and Data Security

Personally Identifiable Information (PII) and Sensitive PII

Protecting Privacy Sensitive Systems Privacy Incident Reporting

Social Media Operational Policies

Personnel Citizenship, Personnel Screening, and Position Categorization Rules of Behavior Access to Sensitive Information

Separation of Duties Information Security Awareness, Training, and Education Role –Based Training

Separation from Duty Physical Security

General Physical Access

Physical Access

Media Controls Media Protection Media Marking and Transport

Media Sanitization and Disposal Production, Input/Output Controls

Telecommunications Security Data Communications Facsimiles

Video Teleconferencing Voice Over Data Networks (VoIP)

Wireless Network Communications

Wireless Portable Electronic Devices

Equipment Servers Workstations Laptop Computers and Other Mobile Computing Devices Personally Owned Equipment and Software

Hardware and Software Wireless Settings for Peripheral Equipment

IT Security Incidents and Incident Response & Reporting Vulnerability Management

Law Enforcement Incident Response Documentation Converging Technologies

Technical Policies v

Identification and Authentication

Passwords Access Control Automatic Account Lockout Automatic Session Termination Warning Banner

Auditing Network and Communications Security

Remote Access and Dial-In Network Security Monitoring

Network Connectivity Management of Firewalls and Policy Enforcement Points Internet Security Email Security

Testing and Vulnerability Management Peer-to-Peer Technology

Cryptography

Encryption Public/Private Key Malware Protection

Product Assurance

Questions and Comments Appendix A – Revision History Appendix B – Acronyms

Appendix C – Glossary Appendix D – References

Appendix E – Allowable IT Security Role Combinations

Introduction

This document articulates the Library of Congress (LC) Information Technology (IT) Security

Program policies for information systems. This policy serves as a foundation for Library service units to develop and implement their information security programs. The baseline security requirements included in this policy must be addressed when developing and maintaining information security documents.

Information Technology Security Program

The LC IT Security Program provides a baseline of policies, procedures, standards, and guidelines for Library service units. This document provides direction to managers and senior executives for managing and protecting information systems. It also outlines policies relating to management, operational, and technical controls necessary for ensuring confidentiality, integrity, and availability within the LC information system infrastructure and operations. Policy elements are designed to be broad in scope. Specific implementation information can often be found in

National Institute for Standards and Technology (NIST) publications, such as NIST Special

Publication (SP) 800-53, Rev.4, Security and Privacy Controls for Federal Information Systems and Organizations.

This directive applies to any outside organizations, or their representatives, who are granted access to the Library’s IT resources, such as other Federal agencies.

From the date of issuance, all new IT systems must comply with this directive and all existing systems must be brought into compliance as resources permit. Information Technology Security

Division (ITSEC) compliance tools will be updated to reflect with these Directives.

Authorities

The following list provides references for the LC information security program.

Library of Congress Regulation (LCR) 5-410 IT Security Policy

44 U.S.C. 3551, et seq., Federal Information Security Modernization Act of 2014

NIST Federal Information Processing Standards (FIPS) 200, Minimum Security

Requirements for Federal Information and Information Systems

NIST Federal Information Processing Standards (FIPS) 199, Standards for Security

Categorization of Federal Information and Information Systems

NIST SP 800-37, Revision 1, Guide for Applying the Risk Management Framework to

Federal Information Systems

NIST SP 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-60, Volume 1, Rev. 1, Guide for Mapping Types of Information and

Information Systems to Security Categories

NIST SP 800-60, Volume 2, Rev. 1, Guide for Mapping Types of Information and

Information Systems to Security Categories: Appendices http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf

Scope

This directive applies to all LC hardware, software (including operating systems, Commercial off the shelf (COTS) software, and custom-developed applications), media and facilities, as well as to all Library service units, personnel, and contractors.

This directive applies to any outside organizations, or their representatives, who are granted access to the Library’s IT resources, such as other Federal agencies.

From the date of issuance, all new IT systems must comply with this directive and all existing systems must be brought into compliance as resources permit.

Systems in place before the issuance of this directive will be assessed against this directive in all future assessments.

Directives marked Low (L) are required for IT systems with a Security Category of Low.

Directives marked Moderate (M) are required for IT systems with a Security Category of

Moderate.

Directives marked High (H) are required for IT systems with a Security Category of High.

Directives within the Management Policies are mandatory for the Library and may not directly apply to individual IT systems.

Policy Overview

The purpose of this directive is to protect valuable LC assets including information, hardware, and software and to support the overall mission while improving service to the nation. This directive is in conformance with the law and draws upon Federal guidance as well as industry best practices. The primary goal is to protect the confidentiality, integrity, and availability of business resources and digital assets.

This directive extends LCR 5-410, creating the framework for information security at LC. High-level policy is contained in LCR 5-410. General security directives are found in this document.

LC information security policies delineate the security management structure and foundation to measure progress and compliance. Policies in this document are organized under three areas:

LCR 5-410

IT Security Directive 5-410.1

Service Unit Policy and Procedures

Management Controls – Focus on managing both the system information security controls and system risk. These controls consist of risk mitigation techniques and concerns normally addressed by management.

Operational Controls – Focus on mechanisms primarily implemented and executed by people. These controls are designed to improve the security of a particular system, or group of systems, and often rely on management and technical controls.

Technical Controls – Focus on security controls executed by information systems. These controls provide automated protection from unauthorized access or misuse. They facilitate detection of security violations and support security requirements for applications and data.

This IT Security Directive is designed to provide a comprehensive listing of IT security controls that should be implemented within a system’s boundary to protect its information. Within the

Management, Operational, and Technical controls section, specific policies are grouped into security categories. Each category lists specific security controls to be implemented for that category. Each policy includes the following –

Policy ID – A unique ID used track the policy through multiple documents

LC Policy Statements – The specific IT Security policy to be implemented

Category – Lists the security categorization to which the policy is applied

Relevant Controls – Provides the related NIST SP 800-53 Rev 4 security control(s) the

LC IT Security policy satisfies.

Privacy controls have been added to LCD 5-410.1 to comply with the publication of NIST SP

800-53, Rev. 4, Appendix J : Privacy Control Catalog. The privacy controls focus on information privacy as a value distinct from, but highly interrelated with, information security.

Privacy controls are administrative, technical, and physical safeguards employed within organization to protect and ensure the proper handling of Personally Identifiable Information

(PII).

Definitions

Definitions for all terms used throughout this LCD are documented within Appendix C -

Glossary.

Waivers and Waiver Requests

Waivers

Library service units may request waivers to any portion of this policy, for up to one (1) year, any time they are unable to fully comply with policy requirements. Requests are made through the Library service unit’s ISSO for the system to the Designated Signing Official (DSO). The

DSO is generally the Information System Business Owner (ISBO) for a system, but could also be the Contracting Officer’s Representative (COR) in regards to Virtual Private Network (VPN)

Waivers. After the DSO approves the waivers, it is sent to the LC Chief Information Security

Officer (CISO) for final review and approval. In all cases waivers shall be requested for an appropriate period of time, no longer than one year, based on a reasonable remediation strategy.

Waiver Requests

All waiver requests are documented within OCIO ITSEC’s Archer Governance, Risk, and

Compliance (GRC) tool. Refer to the waiver procedures on how to complete a waiver within

Archer.

Waiver requests shall include the operational justification (document mission impact), risk acceptance, risk mitigation measures, and, if applicable, a Plan of Action and Milestones

(POA&M) for bringing the system procedures or control weakness into compliance.

Policy

ID

LC Policy Statements

Category Relevant

Controls

1.6.2.a This Security Directive applies to all LC employees, contractors, detailees, others working on behalf of LC, and users of LC information systems that collect, generate, process, store, display, transmit, or receive LC data unless an approved waiver or exception has been granted. This includes prototypes, telecommunications systems, and all systems in all phases of the

System Development Life Cycle (SDLC).

L/M/H SA-3

1.6.2.b Systems without an Authorization to Operate (ATO) when this policy is issued shall comply with all of its policy statements or obtain appropriate waivers.

L/M/H PL-1

1.6.2.c Each system waiver request shall include the system name, the directive(s) being waived, the business requirement for the waiver, and an associated POA&M.

L/M/H CM-3

1.6.2.d Service unit system representatives (i.e., Information System

Business Owner, Contracting Officer Representatives) shall request a waiver whenever they are temporarily unable to comply fully with any portion of these directives.

L/M/H CA-2

1.6.2.e All system-level waiver requests shall identify the POA&M for bringing the system into compliance.

L/M/H CA-5, PM-4

1.6.2.f A waiver shall be issued for one (1) year or less. Waivers may be renewed once, by following the same process as in the initial request.

L/M/H CA-2

Changes to Policy

The policies outlined in this publication serve as a foundation for service units to use in developing and implementing their information security programs and IT systems.

For interpretation or clarification of LC information security policies, procedures, and guidance found in this directive, contact the LC CISO at itsec@loc.gov.

http://www.loc.gov/staff/security/docs/Archer%20Waiver%20Procedure_v2.0_08172018.pdf mailto:%20itsec@loc.gov

Policy

ID

LC Policy Statements

Category Relevant

Controls

1.7.a The LC CISO shall be the authority for interpretation, clarification, and modification of Directive 5-410.1 – General IT

Security Directive (inclusive of all appendices and attachments).

L/M/H PL-1

1.7.b The LC CISO shall review annually and update, as necessary, Directive 5-410.1.

L/M/H PL-1

Roles and Responsibilities

The LC regards certain IT security roles as inherently governmental. These roles include the LC

Chief Information Officer (CIO), LC CISO, Authorizing Officials, Information

Owners/Stewards, and Information System Business Owners. Contractors, who are working on behalf of LC, and other sources may assist in the performance of security functions, but an LC employee must always be designated as the responsible agent for all security requirements and functions other than that of the Information System Security Officer (ISSO). This section outlines the roles and responsibilities for implementing these requirements. See also NIST SP

800-37 Revision 1, Guide to Applying the Risk Management Framework (RMF) to Federal

Information Systems.

IT Security Program Roles

Designated personnel play a major role in the planning and implementation of information security requirements. Roles directly responsible for information system security are described in the following subsections. Certain IT security roles may be combined into a single individual pursuant to the limitations shown in Appendix D – Allowable IT Security Role Combinations.

LC Chief Information Security Officer (CISO) / Senior Agency Information

Security Officer

The LC Chief Information Security Officer (CISO) shall implement and manage the LC

IT Security Program, ensuring compliance with applicable Federal laws, directives, policies, and regulations. The LC CISO reports directly to the Deputy, Chief Information

Officer (CIO) within the Office of the Chief Information Officer. The LC CISO is the principal advisor for all IT security matters. The LC CISO also serves as the Group

Leader of ITSEC.

The CISO, or designate, serves as the Security Control Assessor (SCA). The Security

Control Assessor (SCA) certifies the results of the security control assessment. The SCA and the team conducting the security assessment must be impartial, that is, free from any perceived or actual conflicts of interest with respect to the developmental, operational, and/or management chain of command associated with the information system or to the determination of security control effectiveness.

LC Policy Statements

Category Relevant

Controls

2.1.1.a The LC CISO shall perform the duties and responsibilities of the

LC Senior Agency Information Security Officer.

L/M/H

PL-1, PM-

2.1.1.b The LC CISO shall implement and manage the LC IT Security

Program.

L/M/H PL-1, PM-

2.1.1.c The LC CISO shall be a dedicated duty, without non-IT security-related collateral duties.

L/M/H PM-2

LC Policy Statements

Category Relevant

Controls

2.1.1.d The LC CISO shall not serve as the AO, ISSO, Information

System Business Owner (ISBO), Information Owner/Steward

(IO), or System Administrator (SA) for any IT system.

L/M/H PM-2

2.1.1.e The LC CISO shall develop an LC IT Security Program Plan for the approval of the CIO.

L/M/H PM-2

2.1.1.f The LC CISO shall assist the CIO, in implementing an LC IT

Security Program Plan.

L/M/H PM-2

2.1.1.g The LC CISO shall conduct security compliance reviews to assess the overall effectiveness of security program implementation across LC.

L/M/H PM-2

2.1.1.h The LC CISO shall assess service unit compliance with the LC IT

Security Plan.

L/M/H PM-2

2.1.4.a An SCA may be responsible for more than one system. L/M/H CA-2

2.1.4.b The SCA provides an assessment of the severity of weaknesses or deficiencies in the information systems, and prepares the final security control assessment report containing the results and findings from the assessment but not making a risk determination.

L/M/H CA-7

2.2.3.b The CISO shall ensure that an ISSO is designated in writing for each information system.

L/M/H PL-1

The LC CISO:

Implements and manages the Library of Congress Information Security Program.

Issues Library-wide information security policy, guidance, and security architecture requirements for all LC systems and networks. These policies shall incorporate NIST guidance.

Facilitates development of subordinate plans for providing adequate IT security for networks, facilities, and systems or groups of information systems.

Serves as the principal Library liaison with organizations outside the LC for matters relating to IT security.

Reviews and approves the tools, techniques, and methodologies planned for use in assessing and authorizing LC systems. This includes, but is not limited to, Security

Control Assessment plans and security risk assessments.

Consults with the director of security, Office of Security & Emergency Preparedness

(OSEP), on matters pertaining to physical security, personnel security, and investigations, as they relate to information security and infrastructure.

Develops and implements procedures for detecting, reporting, and responding to information security incidents.

Ensures preparation and maintenance of plans and procedures to provide continuity of operations for information systems.

Set standards for Library personnel, contractors, and others working on behalf of LC to ensure they receive appropriate information security awareness training.

Maintains a comprehensive IT system’s inventory of all GSS, MA, Minor

Applications, Subsystems, and Low Impact Externally Hosted system maintained by

Library.

Maintains a repository for all security assessment and authorization process documentation and modifications.

Provides oversight of all IT Security operations functions within the Library.

Performs periodic compliance reviews for selected systems and applications.

Reports annually to the Librarian of Congress on the effectiveness of the LC IT

Security Program, including progress of remedial actions.

Heads an office with the mission and resources to assist in ensuring Library compliance with information security requirements.

Provides operational direction to the Library of Congress Security Operations Center

(LC-SOC).

Authorizing Official (AO)

The Authorizing Official (AO) formally assumes responsibility for operating an information system at an acceptable level of risk. The D/CIO shall serve as the

Authorizing Official for all LC systems. In the event that a conflict of interest is perceived or apparent, the CIO will assign an alternate AO for a single system.

Policy

ID

LC Policy Statements

Category Relevant

Controls

2.1.3.a The CIO shall assign one AO for each LC IT system and must be appointed in writing.

L/M/H CA-6

2.1.3.b The AO must be a Library employee with sufficient authority to accept risk on behalf of the organization and direct resources to mitigate vulnerabilities posing excessive risk.

L/M/H CA-6

LC Policy Statements

Category Relevant

Controls

2.1.3.c Every system shall have a designated AO. An AO may be responsible for more than one system.

L/M/H CA-6

2.1.3.d The AO shall be responsible for acceptance of resulting risk to organizational operations and assets, individuals, other organizations, and the Library.

L/M/H CA-6

2.1.3.e The AO shall periodically review security status to determine if risk remains acceptable.

L/M/H CA-6

2.1.3.f AOs must evaluate security authorization findings and assess vulnerabilities and residual risks.

L/M/H CA-6

2.1.3.g AOs must not also serve as the ISBO, SCA, CISO, ISSO, or SA for any IT system.

Information System Business Owner (ISBO)

Information System Business Owners (ISBO) are responsible for the successful operation of the information systems and programs within their purview and are ultimately accountable for their security. All systems require an ISBO designated in writing for proper administration of security.

Policy ID LC Policy Statements Category Relevant

Controls

2.2.3.a ISBOs shall ensure that each of their systems is deployed and operated in accordance with this policy document.

L/M/H PL-1

2.2.3.c There shall be only one ISBO designated for each LC system. L/M/H PL-1

2.2.3.d All IT systems must have an ISBO responsible for overall management of the IT system appointed in writing by the AO.

L/M/H PL-1

2.2.3.e The ISBO or designate must formally approve all changes to the IT system.

L/M/H CM-3

2.2.3.f The ISBO must ensure that all changes to the IT system, including software and hardware changes, follow a formal change management process.

L/M/H CM-3

Policy ID LC Policy Statements Category Relevant

Controls

2.2.3.g The ISBO must ensure that an analysis is performed to determine all necessary training, for both technical and user communities, whenever there is a change in the IT system.

L/M/H CM-3

2.2.3.i The ISBO must be a supervisor within the Library of

Congress, with sufficient authority to ensure that the IT system is operated in compliance with LCR 5-410 and the IT

Security directives.

L/M/H PS-2

2.2.3.k The ISBO must not serve as the AO, CISO, SCA, ISSO or SA for any IT system.

L/M/H PS-2

2.2.3.l ISBOs must have regular communication with their ISSOs regarding staff separations because ISSOs receive email notifications of this event.

L/M/H PS-5

2.2.3.n The ISBO must ensure that all access agreements, including records of account management and access authorization, non-disclosure agreements, and Rules of Behavior for Privileged

Use agreements are completed as necessary and records are maintained.

L/M/H PS-5

2.2.3.o The ISBO shall document the Security Categorization for the information system, with assistance as needed from the

Information Owner/Steward, as applicable. Guidance and direction for conducting a Security Categorization is provided in the NIST SP 800-60, Rev 1, Vol. 1 & 2. Specific information types are listed in Volume 2.

L/M/H RA-2

2.1.2.j ISBOs shall prioritize security weaknesses for mitigation. L/M/H CA-5

Information Systems Security Officer

An Information Systems Security Officer (ISSO) performs designated security actions for an information system. While the ISSO performs security functions, the Information

System Business Owner is always responsible for information system security.

Policy

ID

LC Policy Statements

Category Relevant

Controls

2.1.5.a An ISSO shall be designated for every information system and serve as the point of contact for all security matters related to that system.

L/M/H PL-1

LC Policy Statements

Category Relevant

Controls

2.1.5.b An ISSO shall ensure the implementation and maintenance of security controls in accordance with the system’s Security Plan

(SP) and LC policies.

L/M/H PL-1

2.1.5.c An ISSO may be a LC employee or a contractor. L/M/H PL-1

2.1.5.d An ISSO may be assigned to more than one system. L/M/H PL-1

2.1.5.e ISSOs must be appointed in writing by the CISO. L/M/H PL-1

2.1.5.f ISSOs must respond to IT security-related requests from the ITSEC on information regarding their assigned systems.

L/M/H PL-1

2.1.5.g Each IT system must have at least one primary and one backup

ISSO designated.

L/M/H PL-1

2.1.5.h The ISSO must review the audit logs of all remote maintenance sessions.

L/M/H MA-4

2.1.5.i ISSOs may not serve as the AO, CISO, ISBO, IO, SCA, or SA for any IT system.

L/M/H PS-2

2.1.5.j ISSOs must maintain effective communications with the AO, ISBO, IO and SAs.

L/M/H SA-3

2.1.5.k ISSOs receive notice of separations of Library staff via the

Terminators email list. This information must be used to validate that accounts and access are removed from their systems within the timeframe prescribed in Separation from Duty and also communicated to their ISBOs.

L/M/H PS-4

2.1.2.k ISSOs shall provide copies of POA&Ms to affected Information

System Business Owners.

L/M/H CA-5,

PM-4

2.1.2.l ISSOs shall ensure that POA&Ms address the following:

The specific weaknesses or deficiencies in the information system security controls

Appropriate milestones to track mitigation of the weakness

Timeframe for mitigating the weakness are in line with the

POA&M remediation policy.

L/M/H CA-5,

PM-4

2.1.2.m ISSOs shall periodically test the security controls of implemented systems in line with the LC’s Continuous Monitoring guidance.

Information System Security Officers (ISSO) also –

Acknowledge receipt of Security Advisory messages, report compliance with requirements, or notify ITSEC to grant a waiver.

Ensure system adheres to the LC Secure Baseline Configuration Guides. These can be found at http://www.loc.gov/staff/security/hardening-guides.html

Implement Library information security policies, procedures, and control techniques to address all applicable requirements.

Ensure training and oversight for personnel with significant responsibilities for information security.

Other Roles

Roles related to, but not directly responsible for, information system security is described in the following subsections.

Library of Congress Chief Information Officer (CIO)

The person filling this role is responsible for ensuring that the Library’s IT Security

Program is established and managed in accordance with LC policy and directives.

The LC CIO serves as the LC Risk Executive ensuring that risks are managed consistently across the organization. The Risk Executive provides a holistic view of risk beyond that associated with the operation and use of individual information systems.

Risk Executive inputs are documented and become part of the security Assessment and

Authorization decision. The LC Risk Executive:

Ensures that managing information system-related security risks is consistent across the organization, reflects organizational risk tolerance, and is performed as part of an organization-wide process that considers other organizational risks affecting mission/business success.

Ensures that information security considerations for individual information systems, including the specific authorization decisions for those systems, are viewed from an organization-wide perspective with regard to the overall strategic goals and objectives of the organization.

Provides visibility into the decisions of the AO and a holistic view of risk to the organization beyond the risk associated with the operation and use of individual information systems.

Facilitates the sharing of security-related and risk-related information among the AO and other senior leaders within the organization in order to help these officials consider all types of risks that may affect mission and business success and the overall interests of the organization at large.

Policy ID LC Policy Statements

Category Relevant

Controls

2.1.1.j The LC CIO shall act as the LC Risk Executive. L/M/H PL-1, PM-

Heads of LC Service Units

The heads of LC service units are responsible for oversight of the service unit information security program. Persons filling this role allocate adequate resources to information systems for information system security.

Controls

2.2.2.a The Heads of service units shall ensure that information systems and their data are sufficiently protected.

PL-1

2.2.2.b Ensure that adequate funding for information security is provided for service unit information systems and that adequate funding requirements are included for all information systems budgets.

L/M/H SA-2

Heads of LC service units:

Ensure that the security of information systems is an integral part of the life cycle management process for all information systems developed and maintained within their service units

Ensure that adequate funding for information security is provided for service unit information systems and that adequate funding requirements are included for all information systems budgets

Ensure that information system data is entered into the appropriate LC Security

Management Tools to support LC information security oversight

Ensure that the requirements for an information security performance metrics program are implemented and the resulting data maintained and reported.

Information Owner/Steward

The information owner/steward is an organizational official with statutory, management, or operational authority for specified information and the responsibility for establishing the policies and procedures governing its generation, collection, processing, dissemination, and disposal.

The owner/steward of the information processed, stored, or transmitted by an information system may or may not be the same as the system owner.

Policy ID LC Policy Statements Category Relevant

Controls

2.2.4.a The IO of information owned by the Library of Congress must be a Library of Congress employee with sufficient authority to determine the impact on the Library's mission due to compromise of the information.

L/M/H PS-2

2.2.4.b The IO must not serve as the CISO, SCA, ISSO or SA for any

IT System.

L/M/H PS-2

Common Control Provider

The Common Control Provider is an organizational official responsible for planning, development, implementation, assessment, authorization, and maintenance of organization common controls.

Policy ID LC Policy Statements Category Relevant

Controls

2.2.5.a The Common Control Provider shall document all LC common controls and submit them to the AO.

PM-1

2.2.5.b The LC CISO, on behalf of the Common Control Provider ensures that required assessments of common controls are carried out by qualified assessors with the appropriate level of independence.

2.2.5.c The Common Control Provider documents assessment findings in a security assessment report (SAR).

2.2.5.d The Common Control Provider ensures that POA&Ms are developed for all controls having weaknesses or deficiencies.

2.2.5.e The Common Control Provider shall make available security plans, SARs, and POA&Ms for common controls to

Information System Business Owners inheriting those controls after the information is reviewed and approved by a senior official.

PM-1,

PM-4

LC Employees, Contractors, and Others Working on Behalf of LC

LC employees, contractors, and others working on behalf of the LC or its service units shall follow the appropriate set(s) of rules of behavior.

Policy ID LC Policy Statements Category Relevant

Controls

2.2.6.a LC users shall follow prescribed rules of behavior and be held responsible for their actions on IT systems.

PL-4, PS-

6, PS-8

ITSEC

ITSEC ensures that IT systems and IT systems security staff are complying with established IT security policy and guidance. Staff within this group will ensure that the service unit head and LC CISO are kept apprised of all pertinent matters involving the security of information systems. They will also ensure that IT security-related decisions and information, including updates to this directive, are distributed to the ISSOs and other appropriate persons. ITSEC is responsible for implementing and managing the

POA&M process for the LC and review remediated POA&M for closure.

Policy ID LC Policy Statements Category Relevant

Controls

2.1.2.i ITSEC shall ensure that program POA&Ms are prepared and maintained.

L/M/H CA-5, PM-

2.1.6.a ITSEC shall serve as the point of contact for all ongoing risk management activities for systems enrolled into the OA

Program.

L/M/H PL-1

2.1.6.c ITSEC shall ensure that timely analysis of identified security events are provided to the AO to determine security risk.

L/M/H ---

2.1.6.e ITSEC shall be responsible for tracking security events, recording recommendations, and ensuring at least quarterly communication with the AO on system risks.

L/M/H ---

3.15.a-1 ITSEC must ensure that an approval process exists for all accreditation packages.

Management Policies

Basic Requirements

Basic security management principles must be followed in order to ensure the security of LC information resources. These principles are applicable throughout the Library and form the cornerstone of the LC IT Security Program.

Policy ID LC Policy Statements Category Relevant

Controls

3.1.a Every LC computing resource is identified as an information system or as a part of an information system (Major

Application or General Support System). This identification must include a defined system inventory of all IT system components within the authorization boundary, appropriate to the granularity deemed necessary for tracking and reporting.

L/M/H CM-8

3.1.c The IT system must employ automated mechanisms to highlight proposed changes to the information system that have not been approved or disapproved by 48 hours.

H CM-3

3.1.d The IT system must employ automated mechanisms to prohibit the change until necessary approvals are received.

H CM-3

3.1.e The IT system must employ automated mechanisms to document completed changes to the information system.

H CM-3

3.1.f Internet Service Provider (ISP) costs related to mobile computing used for activities, such as telework and Bring-

Your-Own-Device (BYOD), must be paid for by the staff member and are not reimbursable by the Library

M/H ---

3.1.g OCIO is the sole manager of IP addresses on the LCDN, including managing Dynamic Host Configuration Protocol

(DHCP) servers and allocating static IP addresses to servers.

L/M/H CM-3

3.1.h Devices attached to the LCDN with multiple interfaces must not transmit packets between their interfaces with the exception of routers, switches, firewalls, and boundary devices specified by OCIO.

L/M/H AC-4, CA-

3.1.i Each position of system responsibility must be reviewed and classified in terms of its sensitivity in accordance with LCR

9-220.

L/M/H PS-2

3.1.j OCIO, with the Office of the General Counsel (OGC) and the Office of Contracts and Grants Management (OCGM), L/M/H SA-1

Controls will annually review and update if necessary, the services acquisition policy with regard to IT security, and disseminate to Library of Congress staff.

3.1.k All boundary devices separating LC resources from non-LC resources shall be managed by OCIO.

L/M/H SC-7

3.1.l On an annual basis, OCIO shall review the system and information integrity policy and procedures, updating as necessary, and disseminate to Library of Congress staff.

L/M/H SI-1

3.1.m Periodic job/shift rotations must occur for employees in positions of significant security sensitivity (e.g., Systems

Administrators, database administrators, account management). Note that this is not a requirement for regular end users of IT systems.

M/H ---

3.1.n Regularly scheduled vacations must occur for employees in positions of significant security sensitivity (e.g., Systems

Administrators, database administrators, account management), during which another individual must perform the vacationing employee’s job responsibilities.

Note that this is not a requirement for regular end users of IT systems.

M/H ---

3.1.o Documented IT system-related job descriptions must accurately reflect assigned duties and responsibilities that segregate duties.

M/H ---

3.1.p IT responsibilities must be assigned to staff using the principle of least privilege.

M/H ---

3.1.q OCIO and OCGM will jointly issue the services acquisition policy with regard to IT security.

L/M/H ---

3.1.r OCGM will include the IT security requirements as documented in the services acquisition policy with regard to

IT security in all solicitations.

L/M/H ---

3.1.s OCIO will approve changes to solicitations with regard to IT security on a case by case basis.

L/M/H ---

3.1.t OCIO will notify service units when significant modifications to boundary protection devices that have the potential of significantly altering the security level or hindering the mission of the service units.

L/M/H ---

Controls

3.1.u All data centers must be approved by OCIO. L/M/H ---

3.1.v All security controls must be consistent with and an integral part of the IT Enterprise Architecture (EA) of the Library.

L/M/H ---

3.1.w Security controls must be commensurate with NIST SP 800-

53 Rev.4, Security and Privacy Controls for Federal

Information Systems and Organizations per the information

Security Categorization of the system.

L/M/H PL-2

3.1.x The LC IT Security Program must conduct an annual review of the Library’s IT system inventory in line with the LC’s

Inventory Management Program.

L/M/H PM-5

Capital Planning and Investment Control

Information security is a business driver and any risks found through security testing are ultimately business risks. Information security personnel should be involved, to the maximum extent possible, in all aspects of the acquisition process.

Policy ID LC Policy Statements Category Relevant

Controls

3.2.a The ISBO shall plan for and provide IT Security protection by budgeting adequate resources to fulfill all LC security requirements throughout the entire lifetime of the system.

L/M/H SA-2

3.2.b Information System Business Owners, and AOs, shall ensure that information security requirements and POA&Ms are adequately funded, resourced, and documented.

L/M/H PM-3,

PM-4,

SA-2

3.2.c Service units shall ensure that information security requirements, as described within this directive, are included in the acquisition of all LC systems used to input, process, store, display, or transmit LC information.

L/M/H SA-4

Contractors and Outsourced Operations

Category Relevant

Controls

3.3.a All statements of work and contract vehicles shall identify and document the specific security requirements for information system services and operations required of the contractor.

L/M/H SA-4

3.3.b Contractor information system services and operations shall adhere to all applicable LC information security LCRs and directives.

L/M/H SA-9

3.3.c Statements of work and contracts shall include a provision stating that, upon the end of the contract, the contractor shall return all information and information resources provided during the life of the contract and certify that all LC information has been purged from any contractor-owned system used to process LC information.

L/M/H SA-4

Continuity Planning for Critical LC Assets

The Continuity Planning for critical LC assets is vital to the success of the LC IT Security

Program. The Business Impact Analysis (BIA), which is part of the Contingency Plan, is essential in the identification of critical LC assets. Once critical systems are identified, continuity planning shall address the following two complementary but different elements:

Continuity of Operations Planning (COOP)

Contingency Planning (CP)

Continuity of Operations Planning

ID

LC Policy Statements

Category Relevant

Controls

3.4.1.a To ensure that accounts can be created in the absence of the usual account approval authority, systems that are deemed

Critical shall have provisions to allow a Contingency Planning

Coordinator or service unit head to approve new user accounts as part of a COOP scenario.

M/H AC-2

3.4.1.c Information System Business Owners shall develop, test, implement and maintain comprehensive ITCPs to ensure the continuity and recovery of essential LC functionality.

L/M/H CP-2

LC Policy Statements

Category Relevant

Controls

3.4.1.d The Information System Business Owner shall complete, and annually update, a BIA for the LC BCDR Official to review and for ITSEC final approval.

IT Contingency Planning and Testing

ID

LC Policy Statements

Category Relevant

Controls

3.4.2.a The LC CIO shall provide guidance, direction, and authority for a standard LC-wide process for contingency planning for all LC information systems.

L/M/H CP-1

3.4.2.b ISBOs shall develop and document information system

Contingency Plans (CP) for their systems in accordance with

NIST SP 800-34 Rev 1, “Contingency Planning Guide for

Information Technology Systems” This includes assignment to manage plan changes, and distribute copies of the plan to key contingency personnel as identified in the IT CP.

L/M/H CP-1, CP-

3.4.2.c The LC CISO shall ensure that CP testing is performed in accordance with the Availability security objective and must include full recovery and reconstitution of the IT system. All testing will be done with the participation of OCIO. The minimum contingency testing for each impact level follows:

High – System recovery roles, responsibilities, procedures, and logistics in the CP shall be used to recover from a simulated contingency event at the alternate processing site within a year prior to accreditation. The system recovery procedures in the CP shall be used to simulate system recovery in a test facility at least annually.

Moderate – The CP shall be tested at least annually by reviewing and coordinating with organizational elements responsible for related plans. This is achieved by performing a walk-through/tabletop exercise.

Low – CP contact information shall be verified at least annually.

L/M/H CP-4, CP-

3.4.2.d On an annual basis, OCIO shall review the contingency planning policy, updating as necessary, and disseminate to Library of

Congress staff.

L/M/H CP-1

LC Policy Statements

Category Relevant

Controls

3.4.2.e Key personnel responsible for managing the IT CP activation must have ready access to contingency plans at the designated recovery site.

L/M/H CP-2

3.4.2.f IT CPs shall be developed and maintained by all LC service units in accordance with the requirements for the FIPS 199 potential impact level for the Availability security objective.

These plans shall be based on three essential phases:

Activation/Notification, Recovery, and Reconstitution. Service units shall review the IT CP for the information system at least annually and revise the plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing.

L/M/H CP-1, CP-

3.4.2.g Service units shall coordinate, as appropriate, CP testing and/or exercises with COOP related plans for systems with Moderate and High availability FIPS-199 categorization.

L/M/H CP-4

3.4.2.h The LC CISO shall ensure that contingency training is performed in accordance with the Availability security objective. The minimum IT contingency planning for each impact level follows:

High – All personnel involved in IT contingency planning efforts shall be identified and trained in their IT contingency planning and implementation roles, responsibilities, procedures, and logistics. This training shall incorporate simulated events.

Refresher training shall be provided at least annually.

Low/Moderate – All system personnel involved in IT contingency planning efforts shall be trained. Refresher training shall be provided at least annually.

L/M/H CP-3

3.4.2.i Disaster recovery procedures must be documented. L/M/H CP-2

3.4.2.j Each IT CP must be integrated into the service unit Continuity of Operations Plan.

M/H CP-2

3.4.2.k All IT CPs must be reviewed annually, at a minimum, and updated if necessary.

L/M/H CP-2

3.4.2.l The ISBO must ensure that the necessary agreements are in place to permit the storage of IT system information at the designated alternate site.

M/H CP-6

LC Policy Statements

Category Relevant

Controls

3.4.2.m The alternate storage site must be at least 20 miles from the primary storage site.

M/H CP-6

3.4.2.n The alternate storage site must be configured to allow the system to be reconstituted within the allowable outage time determined in the BIA.

H CP-6

3.4.2.o The IT CP must address accessibility concerns and mitigation actions in regards to the alternate storage site or reference an external document that specifically details these items.

M/H CP-6

3.4.2.p The IT system must be recoverable at a designated alternate processing site.

M/H CP-7

3.4.2.q The ISBO must ensure that the necessary agreements are in place to permit the resumption of IT system operations at the alternate processing site for critical mission/business functions within the allowable outage time determined in the BIA when primary processing capabilities are unavailable.

M/H CP-7

3.4.2.r The ISBO must ensure that the alternate processing site agreements contain priority-of-service provisions in accordance with the availability requirements for the IT system.

M/H CP-7

3.4.2.s The alternate processing site must be fully configured to support a minimum required operational capability and ready to use as the operational site.

H CP-7

3.4.2.t The ISBO must ensure that the alternate telecommunications services agreements contain priority-of-service provisions in accordance with the Availability requirements for the IT system.

M/H CP-2

3.4.2.u The primary and alternate telecommunications service providers must have facilities separated by at least 1/4 mile regarding service to a particular physical site.

H CP-8

3.4.2.v The ISBO must ensure that the primary and alternate telecommunications service providers must have contingency plans in accordance with the availability requirements for the IT system.

H CP-8

3.4.2.w The ISBO must ensure that critical file backups occur of a type and with a frequency to adequately support recovery per the availability requirements for the IT system.

L/M/H CP-9

LC Policy Statements

Category Relevant

Controls

3.4.2.x The ISBO must ensure that critical file backups are rotated to an alternate storage site with a frequency to adequately support recovery per the availability requirements for the IT system.

L/M/H CP-9

3.4.2.y The ISBO must ensure that critical file backups are physically safeguarded from unauthorized access.

L/M/H CP-9

3.4.2.z The ISBO must ensure that critical file backups are physically safeguarded from environmental threat factors (e.g., fire, water, etc.).

L/M/H CP-9

3.4.2.a-1 An incremental or differential backup must be performed on all

Moderate and High impact IT systems nightly at a minimum.

M/H CP-9

3.4.2.b-1 Weekly full backup tapes must be rotated to an alternate storage site.

L/M/H CP-9

3.4.2.c-1 The ISBO must supply backup criteria for all information in the

OCIO-specified format, including FIPS 199 Security

Categorization, retention requirements, frequency, and type of backups.

L/M/H CP-9

3.4.2.d-1 Backup procedures must be documented for every system and documented as part of, or included within, the IT Contingency

Plan.

L/M/H CP-9

3.4.2.e-1 The ISBO must ensure that backup information is tested quarterly (e.g., by testing restore capability), at a minimum.

M/H CP-9

3.4.2.f-1 All system defaults must be reset to normal (secured) operating settings after restoring from backup.

L/M/H CP-10

3.4.2.g-1 After rebuilding a system, the ISSO must verify that the technical IT security controls are operating as documented in the systems SP.

L/M/H CP-10

3.4.2.h-1 The ISBO for the IT system must formally approve the IT CP. L/M/H CP-2

3.4.2.i-1 The ISBO must ensure that at least one copy of the system and application documentation and the IT CP must be securely stored at the designated primary and offsite locations.

L/M/H CP-2

3.4.2.j-1 The ISBO must conduct capacity planning such that necessary capacity for information processing, telecommunications, and environmental support exists during crisis situations.

H CP-2

LC Policy Statements

Category Relevant

Controls

3.4.2.k-1 ISSOs must ensure that each IT CP is updated to accurately reflect each of the current systems under their purview.

L/M/H CP-2

3.4.2.l-1 The ISBO must ensure that the necessary telecommunications service agreements are in place to permit the resumption of IT system operations for critical mission/business functions within the allowable outage time determined in the BIA when primary telecommunications services are unavailable.

M/H CP-8

3.4.2.m-1 The primary and alternate telecommunications services must not share a single point of failure (e.g., single building access conduit).

M/H CP-8

3.4.2.n-1 The ISBO must ensure that backup copies of the operating system and other critical information system software are stored in a separate facility or in a fire-rated container that is not co-located with the operational software.

L/M/H CP-9

3.4.2.o-1 The ISBO must ensure adequate controls are implemented to protect backups from unauthorized modification.

L/M/H CP-9

3.4.2.p-1 The IT CP must be completed during the development/ acquisition phase.

L/M/H SA-3

3.4.2.q-1 Roles and contact information for individuals supporting the contingency activities must be identified in the IT CP.

L/M/H CP-2

3.4.2.r-1 IT CP must identify emergency outage scenarios and the specific required responses to address each scenario, recovering the system within the allowable outage time as identified in the

BIA.

M/H CP-2

3.4.2.s-1 The IT CP must contain a succession plan to ensure that each role is fulfilled regardless of a specific individual performing that function.

L/M/H CP-2

3.4.2.t-1 The IT CP must contain a communications plan to interact with service providers and end users.

System Development Life Cycle (SDLC)

ID

LC Policy Statements

Category Relevant

Controls

3.5.a ISBOs shall ensure that system security is integrated into all phases of SDLC.

L/M/H SA-3

3.5.b ISBOs shall ensure that security requirements for sensitive information…