Attachment_J.9_ACF_Incident_Response_Policy.pdf

July 10, 2018 ACF-OCIO-2018-0001

Incident Response Policy

ADMINISTRATION FOR CHILDREN & FAMILIES

Office of the Chief Information Officer

July 10, 2018

Version 1.0

Incident Response Policy Version 1.0 ii

Table of Contents

1. Purpose

1.1. Authority

2. Background

3. Scope

4. Policy

5. Roles and Responsibilities

5.1. ACF Chief Information Officer (CIO)

5.2. ACF Chief Information Security Officer (CISO)

5.3. ACF Senior Official for Privacy (SOP)

5.4. ACF Program Office Leadership

5.5. ACF System Owners

5.6. ACF Incident Response Team

5.7. ACF Federal Employees and Contractors

5.8. HHS CSIRC

5.9. Hosting and Operations Personnel

5.10. External Organizations

6. Applicable Laws and Guidance

7. Information and Assistance

8. Effective Date/Implementation

9. Approval

Appendix A: Glossary

Appendix B: Acronyms

Incident Response Policy Version 1.0 1

1. Purpose This Incident Response Policy (IRP) lays the foundation for the implementation of an ACF-wide incident response program in compliance with federal laws, regulations, and standards for the reporting of information technology (IT) security incidents and any incidents that may involve the loss of personally identifiable information (PII). This policy highlights the Health and Human Services (HHS) Computer Security Incident Response Center (CSIRC) as the primary HHS entity responsible for maintaining operational IT security and situational awareness and a partnership between the HHS CSIRC and the ACF Incident Response Team (IRT) for the coordination and execution of incident reporting and response services.

1.1. Authority

The Office of Management and Budget (OMB) designated the Department of Homeland Security (DHS) and the National Institute of Standards and Technology (NIST) as authorities for providing guidance to federal agencies on the implementation of information security and privacy laws and regulations, including the Federal Information Security Modernization Act (FISMA) of 2014, the United States Computer Emergency Readiness Team (US-CERT) Federal Incident Reporting Guidelines, and the Privacy Act of 1974. This policy addresses the federal requirements specific to incident response (IR) capabilities and the IR requirements and guidelines outlined by the HHS Information Systems Security and Privacy Policy (IS2P2).

For a full listing of authorities, see Section 6: Applicable Laws and Guidance.

2. Background Increased threats to critical cyber-based infrastructure systems have created a need for government agencies to augment their computer security efforts. Incidents involving cybersecurity and privacy threats, such as viruses, malicious user activity, and vulnerabilities associated with highly interconnected technology require agencies to have a skilled, rapid response to mitigate their risk to computing resources, loss, or destruction of data, loss of funds and productivity, as well as damage to the agency’s reputation and regulatory infractions. These circumstances require agencies to have a coordinated computer security IR capability as an extension to their contingency plan.

The US-CERT was established in 2003 and is responsible for providing response support and defense against cyberattacks for the Federal Civil Executive Branch (.gov) and facilitating information sharing and collaboration with state and local government, industry, and international partners. Per FISMA, HHS is required to consult with and report security and privacy incidents to US-CERT. To help the Department meet these requirements, the ACF IRT works with the HHS CSIRC, which serves as the lead

Incident Response Policy Version 1.0 2 organization for coordinating all cybersecurity information sharing, analysis, and response activities.

Documented IR procedures include a specific process for responding to breaches of PII.

In accordance with the OMB M-17-12, the process includes actions to access and mitigate the risk of harm to individuals potentially affected by the breach, as well as guidance on whether and how to provide notification and services to those individuals.

Organizations can prepare to handle common incident types through standard operating procedures, but incidents can occur in numerous ways and it is infeasible to detail procedures for each and every scenario. The following list outlines common event1 types and can be used to establish the standard operating procedures.

• External/Removable Media: A user inserts an infected flash drive or compact disc

(CD), in turn deploying malware onto a system

• Attrition: An information system, network, or service is compromised, degraded, or destroyed by gradually reducing effectiveness through flooding it with traffic

• Web/Online: A user opens a web page or uses a web application which activates a threat, or an attacker gains access to an organization’s network by exploiting a vulnerability in computer code or hardware configuration

• Electronic Communication: A user opens an infected e-mail, instant message, or file attachment which introduces a computer virus to the system

• Improper Use: An authorized user violates an organization’s acceptable use policy (e.g. sending an email containing PII without using encryption/password protected files)

• Loss or Theft of Equipment: A user loses an employer-furnished laptop, smartphone, or other electronic device or has one stolen

3. Scope The ACF Chief Information Security Officer (CISO), under the Office of the Chief Information Officer (OCIO), is responsible for the overall execution and maintenance of the IR program. This policy shall be applied to all ACF organizational components (program offices and divisions) and organizations conducting business for and on behalf

1 Defined as: Any observable occurrence in a system or network

Incident Response Policy Version 1.0 3 of the Operating Division (OpDiv), through contractual relationships that make use of ACF IT resources. This policy supersedes no other applicable law, higher-level agency directive, or existing labor management agreement in place as of the effective date of this policy.

ACF officials shall apply this policy to employees, contractor personnel, interns, and other non-government employees. All organizations collecting or maintaining information or operating systems on behalf of ACF are also subject to the stipulations of this policy. The content of and compliance with this policy shall be incorporated into applicable contract language and grant agreements.

This policy shall apply when addressing the following incident categories:

1) Security Incidents: the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system2

2) Privacy Incidents: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users have access or potential access to PII in usable form, whether physical or electronic, or where authorized users access PII for an unauthorized purpose.3

4. Policy The ACF IRT serves as the primary entity for executing and maintaining the incident response capabilities including each aspect of the incident handling lifecycle. It is also the responsibility of the ACF IRT to maintain a partnership with HHS CSIRC to ensure they are aware of security and privacy vulnerabilities, threats, and incidents that may hamper ACF’s ability to fulfill its mission and functions.

The ACF IR program applies the IR family of security and privacy controls of NIST SP 800-53 Revision 4 as the baseline to build out all plans and procedures for the implementation and execution of the program. This policy assists in fulfilling the first control, which requires the development, documentation, dissemination, and review of policies and procedures. Additional documentation completes the first control requirements and fulfills the requirements identified in controls two through eight, which include IR training, testing, and reporting.

2 45 CFR 164.304

3 DHS Privacy Incident Handling Guide.

Incident Response Policy Version 1.0 4

5. Roles and Responsibilities

5.1. ACF Chief Information Officer (CIO)

• Establish, implement, and enforce the ACF IR and handling policy

• Provide management oversight of the incident response and handling process

• Inform ACF senior leadership of any significant IT security and/or privacy incident

(i.e., major compromise of data)

• Provide recommendations to the Office of Workforce Planning and Development

(OWPD) should any employment action be appropriate after an incident investigation concludes

5.2. ACF Chief Information Security Officer (CISO)

• Ensure ACF-wide implementation of plans and procedures related to IT security and privacy incident response

• Oversee and manage the resources that support ACF IRT operations

• Notify the CIO of any significant IT security or privacy incident

5.3. ACF Senior Official for Privacy (SOP)

• Coordinate with the ACF IRT and the HHS Privacy Program concerning reports of a PII breach

5.4. ACF Program Office Leadership

• Disseminate and ensure compliance with policies, plans, and procedures related to security and privacy incident responses in their respective office

• Notify employees of any changes to exiting policy or creation of new policy pertaining to the IR program

• Cooperate with the ACF CISO and IRT on investigations into security and privacy incidents originating in their respective office

5.5. ACF System Owners

• Communicate to users, developers, and administrators of the system owner’s designated information system about security and privacy IR requirements as outlined in this policy and additional plan and procedure documentation

• Notify the ACF CISO and IRT of any suspected or confirmed IT security or privacy incidents occurring on the information system within one hour of discovery

• Cooperate with ACF CISO and IRT on any investigation into security or privacy incidents affecting their information system

5.6. ACF Incident Response Team

• Consist of personnel from the following functional teams in the OCIO: Enterprise

Security, Security Operations, Privacy Program, and IT Governance

Incident Response Policy Version 1.0 5

• Establish and maintain IT security and privacy IR capabilities ensuring that these capabilities are performed by the team or on their behalf

• Report IT security and privacy incidents to the HHS CSIRC following the CSIRC Concept of Operations (CONOPS), specifically for incidents involving the actual or suspected loss of control over PII

• Serve as the primary point of contact with HHS CSIRC and HHS Privacy Program

• Coordinate with the ACF SOP in OCIO about PII breaches in accordance with IRT processes

• Coordinate the ACF-wide response to IT security vulnerabilities, threats, and incidents

• Facilitate information sharing across ACF regarding IT security vulnerabilities, threats, and incidents

• Augment existing analysis capabilities and forensic services with respect to security vulnerabilities, threats, and incidents

• Comply with all reporting requirements and follow guidance from US-CERT and

NIST

• Report incidents involving confirmed or suspected violations of the law, or employee or contractor misconduct to the Office of Inspector General (OIG) using HHS policies and procedures

• Coordinate and provide IR support for ACF systems, applications, or data managed or hosted by another operating division or organization

5.7. ACF Federal Employees and Contractors

• Notify a supervisor and the IRT of any suspected or confirmed IT security or privacy incident within one hour of discovery

• Cooperate with the IRT on any investigation into the security or privacy incident

5.8. HHS CSIRC

• Serve as the primary entity responsible for maintaining HHS-wide operational IT security situational awareness and determining the overall IT security risk posture

• Report all IT security and privacy incidents to US-CERT

• Serve as the primary point of contact with US-CERT

• Report down to the ACF IRT on any action taken by the OIG regarding an ACF-reported incident involving confirmed or suspected violations of the law, or employee or contractor misconduct

Incident Response Policy Version 1.0 6

5.9. Hosting and Operations Personnel

• Notify the ACF CISO, IRT, and System Owner of any suspected or confirmed IT security or privacy incidents involving ACF infrastructure, information systems, and data within one hour of discovery

• Notify the ACF CISO and IRT of any suspected or confirmed IT security or privacy incidents occurring on ACF-managed networks within one hour of discovery

• Ensure that security and privacy requirements are implemented and enforced

• Assist in the incident investigation efforts and coordinate with the IRT to execute remediation activities

5.10. External Organizations

• Notify the Program Office, ACF CISO, and IRT of any suspected or confirmed IT security or privacy incidents involving ACF data managed by the organization within one hour of discovery

• Assist in the incident investigation efforts and coordinate with the ACF IRT to execute remediation activities

6. Applicable Laws and Guidance

• Federal Information Security Modernization Act (FISMA) of 2014, Public Law

113-283, dated December 2014

• OMB Circular A-130 Revised Transmittal No. 4, Management of Federal

Information Resources, dated November 28, 2000

• OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information, dated January 3, 2017

• NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal

Information Systems and Organizations, dated April 2013

• NIST SP 800-61 Revision 2, Computer Security Incident Handling Guide, dated

August 2012

• Federal Information Processing Standard (FIPS) 200, Minimum Security

Requirements for Federal Information and Information Systems, dated March

• HHS-OCIO-2010-0004, HHS Policy for Information Technology Security and Privacy Incident Reporting and Response, signed April 5, 2010

• HHS-OCIO-2009-0003, HHS Policy for Information Systems Security and Privacy, signed June 25, 2009

Incident Response Policy Version 1.0 7

7. Information and Assistance All IT and security policies are posted on the IT Security Standards and Policies page, found under the Rights and Responsibilities tab of the ACF Connect website.

Any questions, comments, suggestions, or requests for information may be directed to the ACF Cybersecurity and Privacy Program via the following email address:

OCIO.Security@acf.hhs.gov

8. Effective Date/Implementation The effective date of this policy is the date on which it is approved.

Requirements stated in this policy follow laws, regulations, and other department policies referenced above in Section 6 and are applicable at the time of issuance.

Actions taken through implementing this policy must comply with the requirements of laws, rules and regulations, and the lawful provisions of applicable negotiated agreements for employees in exclusive bargaining units.

9. Approval

Signature: /s/

Sebrina Blake, ACF Chief Information Officer

Date: July 10, 2018 https://extranet.acf.hhs.gov/cls/index.cfm?&CFID=1277411&CFTOKEN=503622682922258d-8E25AC76-155D-4725-2407FEAB41DD2172 mailto:OCIO.Security@acf.hhs.gov

Incident Response Policy Version 1.0 8

Appendix A: Glossary Term Description

Breach (as it relates to PII)

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users, or for an other than authorized purpose, have access or potential access to personally identifiable information;

whether physical or electronic.4

Event Any observable occurrence in a system or network5

Incident The act of violating an explicit or implied security policy. These include:

attempt to gain unauthorized access to a system or its data; unwanted disruption or denial of service; unauthorized use of a system for the processing or storage of data; changes to system hardware, firmware, or software characteristics without the owner’s knowledge, instruction, or consent.6

Information Any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual forms.7

Information System

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.8

Personally Identifiable Information (PII)

Information that can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, alone or when combined with other personal or identifying information, which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, and so on.9

Privacy Incident The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users, have access or potential access to PII in usable form, whether physical or electronic, or where authorized users access PII for an unauthorized purpose.

4 OMB M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information.

5 NIST SP 800-61, Revision 2 Computer Security Incident Handling Guide 6 US-CERT Incident Reporting System.

7 OMB Circular A-130 Transmittal No. 4, Management of Federal Information Resources.

8 NIST SP 800-53, Revision 4, Recommended Security Controls for Federal Information Systems.

9 OMB M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information.

Incident Response Policy Version 1.0 9

Term Description

Security Incident

The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

Incident Response Policy Version 1.0 10

Appendix B: Acronyms Acronym Description

ACF Administration for Children and Families

CFR Code of Federal Regulations

CIO Chief Information Officer

CISO Chief Information Security Officer

CONOPS Concept of Operations

CSIRC Computer Security Incident Response Center

DHS Department of Homeland Security

FISMA Federal Information Security Management Act

HHS Department of Health and Human Services

HR Human Resources

IR Incident Response

IRT Incident Response Team

IS2P2 Information System Security and Privacy Policy

IT Information Technology

NIST National Institute of Standards and Technology

OCIO Office of the Chief Information Officer

OIG Office of the Inspector General

OMB Office of Management and Budget

OPDIV Operating Division

PII Personally Identifiable Information

SOP Senior Official for Privacy

US-CERT United States Computer Emergency Readiness Team