12-Appendix H - Enterprise Security Framework and Standards.pdf
PDF 245 KB Posted
- Attached to
- Family Medical Leave Assistance
- Solicitation number
- BYZ25 - 00028078
- Issued by
- Dallas County, Texas
About this file
This document is Appendix H from the City of Dallas Enterprise Reference Architecture, detailing the city's Enterprise Security Framework and Standards. The framework is structured around five core security principles: Identify, Protect, Detect, Respond, and Recover, which are designed to help the city manage cybersecurity risks across its technology infrastructure. The framework is organized into four primary domains: Data Management Services, Business Application Services, Infrastructure Services, and Security Services, with the overarching goal of protecting data and information through three primary security objectives: Confidentiality, Integrity, and Availability.
The document comprehensively lists numerous security standards, primarily drawn from FedRAMP and NIST guidelines, including specific publications like SP 800-53 (Security and Privacy Controls), FIPS 140-2 (Cryptographic Module Security Requirements), and additional City Extensions to FedRAMP. These standards provide detailed guidance for information system security, covering areas such as risk management, incident response, configuration management, personal identity verification, and privacy protection. The framework emphasizes that all proposed technology solutions must map their security mechanisms to the appropriate domain layer, ensuring a comprehensive and standardized approach to cybersecurity across the city's technological ecosystem.
View the file
Other files
Show all 30
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Appendix H - Enterprise Security Framework and Standards
To enable a common understanding of the security needs of the City, an enterprise security framework was constructed. The framework relies upon readily recognizable operational security principles to facilitate communication.
Security Principles
The security principles upon which the Enterprise Security Framework organize basic cybersecurity activities at their highest level. The principles are Identify, Protect, Detect, Respond, and Recover.
These principles were selected to aid an organization in expressing its management of cybersecurity risk by organizing information, enabling risk management decisions, and addressing threats.
To assist in communication, these principles have been defined as follows:
Identify – Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities Protect – Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services Detect – Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event Respond – Develop and implement the appropriate activities to take action regarding a detected cybersecurity event Recover – Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event
1. Enterprise Security Framework The Enterprise Security Framework relies upon a generalized layered approach to focus attention to areas of concern to the City. The four domains of the Security Framework are illustrated as follows:
Figure 1 City Security Principles
City of Dallas Enterprise Reference Architecture Security Framework | High Level Reference Diagram – V01 00
Security Management Services
DATA MANAGEMENT SERVICES
Data Governance
Data Standards
Structured Data
Master Data Management
Data Quality
Data Security
Unstructured Data
Business Intelligence
Data Analytics
Data Visualization
Data Distribution
Data Storage
Business Intelligence
Data Analytics
Data Visualization
Data Distribution
Data Storage
IDENTIFY
Business Environment
Governance
Risk Mgmt Strategy
Risk Assessment
Asset Management
PROTECT
Access Control
Awareness Training
Information Protection Proces s and Procedures Maint enance
Data Security
DETECT
Anomalies and Events
Security Monitoring
Detection Processes
RESPOND
Response Planning
Communications
Analysis Mitigation
Improvements
RECOVER
Recovery Planning
Communications
Improvements
BUSINESS APPLICATION SERVICES
Presentation Services Presentation Platforms
Application Services
Application Lifecycle Integration Middleware
Customer Service Platform
Collaboration
Search
End Points
Mobile Devices
Portable Devices
Fixed Devices
Enterprise Service Platform
Business to Business
Peer to Peer
Business to Mobile
Desktops
Interfaces
Smart Applications
INFRASTRUCTURE SERVICES
On-Prem/Colocation Infrastructure
Storage Virtualization
Block Based Virtualization
File-Based Virtualization
Server Virtualization
Virtual Machine (Host based)
O S
Virtuali zation
TPM
Virtuali zation Se ssi on Ba se d
Application Virtualization
Client Application Streaming
Server Application Streaming
Cloud InfrastructureNetwork Services
Server Virtualization
Virtual Machine (Host based)
OS
Virtuali zation
T PM
Virtuali zation Sessi on Based
Network Availability
Network Segmentation
Network Build
LAN
WAN
Cloud Service
Cloud Deployment
Model
Portability and Interoperability
Cloud Provider
DataCenter Architecture
& Design
Cloud Business Continuity and
Disaster Recovery
Storage Virtualization
Block Bas ed Virtu alization
File-Based Virtualizatio n
Network Virtualization
Network Space Virtualization
Network Virtualization
Network Space Virtualization
Desktop Virtualization
Local Remote
Data Management Services is dedicated to focusing on and protecting organizational data.
All proposed technology solutions must map their data-centric security mechanisms to this layer as appropriate.
Structured Data Unstructured Data Data Governance
Business Application Services is focused upon the secure and authorized delivery of data and information to achieve desired business outcomes. All proposed technology solutions that address infrastructure elements must map their security mechanisms to this layer as appropriate.
Presentation Services Presentation Platforms Application Services
Infrastructure Services is dedicated to the protection of infrastructure elements supporting business applications. All proposed technology solutions that address infrastructure elements must map their security mechanisms to this layer as appropriate.
Network Services OnPrem/Colocation Infrastructure Cloud Infrastructure
Security Services is focused upon the governance, management, and operation of security mechanisms within the City Standards and Compliance Services performs those activities such as risk assessment and risk management, threat and vulnerability management, infrastructure protection and security monitoring. All proposed technology solutions directly impacting or complementing security activities must map their security mechanisms to this layer as appropriate.
Identify Protect Detect Respond Recover
All four domains of the Enterprise Security Framework are directed to the one goal of the protection of data and information. As with most security frameworks, the primary information security goals of the framework are Confidentiality, Integrity, and Availability.
These terms are defined as:
Confidentiality – preserving authorized restrictions on access and disclosure, including means for protecting privacy and proprietary information.
Integrity – guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity.
Availability – ensuring timely and reliable access to – and use of – information.
When mapping security mechanisms to a domain, Proposers are encouraged to provide responses within the context of the previously identified security principles which underpin the City’s Enterprise Security Framework.
2. Enterprise Security and Privacy Standards
Enterprise Security and Privacy Standards have been identified as necessary elements of any Security and Privacy Program for the City and as such are designated as appropriate standards for use at the City.
The following enterprise security standards are categorized by major frameworks or groupings for the convenience of Proposers that provide solutions and services within known frameworks or groupings of standards. All standards noted are applicable to all solution and services deployed and operated for the benefit of the City.
FedRAMP NIST Standards
SP 500-292: NIST Cloud Computing Reference Architecture SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems SP 800-37 Revision 1: Guide for Applying the Risk Management Framework to Federal
Information Systems: Security Life Cycle Approach SP 800-39: Managing Information Security Risk: Organization, Mission, and Information
System View SP 800-53 Revision 4: Security and Privacy Controls for Federal Information Systems and Organizations SP 800-53a Revision 4: Guide for Assessing the Security Controls in Federal Information
Systems and Organizations, Building Effective Security Assessment Plans
SP 800-60 Revision 1, Volume 1: Guide for Mapping Types of Information and Information Systems to Security Categories
SP 800-60 Revision 1, Volume 2: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories
SP 800-61 Revision 2: Computer Security Incident Handling Guide SP 800-86: Guide to Integrating Forensic Techniques into Incident Response SP 800-92: Guide to Computer Security Log Management SP 800-94: Guide to Intrusion Detection and Prevention Systems (IDPS) SP 800-115: Technical Guide to Information Security Testing and Assessment SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable
Information (PII) SP 800-128: Guide for Security-Focused Configuration Management of Information
Systems Federal Information Processing Standards (FIPS) 140-2: Security Requirements for
Cryptographic Modules FIPS 199: Standards for Security Categorization of Federal Information and Information
Systems FIPS 200: Minimum Security Requirements for Federal Information and Information
Systems FIPS 201: Personal Identity Verification (PIV) of Federal Information and Information
Systems Office of Management and Budget Circular A-130.
City Extensions to FedRAMP
SP 800-30, Revision 1: Risk Management Guide for Information Technology Systems SP 800-31: Intrusion Detection Systems SP 800-35: Guide to Information Technology Security Services SP 800-50: Building an Information Technology Security Awareness and Training
Program SP 800-55, Revision 1: Performance Measurement Guide for Information Security SP 800-64: Security Considerations in the Information System Development Life Cycle SP 800-82: Guide to Industrial Control Systems (ICS) Security SP 800-83: Guide to Malware Incident Prevention and Handling for Desktops and
Laptops National Institute of Standards and Technology Internal Report (NISTIR) 8062
(DRAFT): Privacy Risk Management for Federal Information Systems.
File details come from the government source that posted it. Updated .