2-ADOT_ECD_DLSSU_RFP--NEC_Arizona_Baseline_Security_Controls_FINAL_2022-04-18.xlsx

NIST 800-53 r4 controls

[Control and Control Enhancement]

Implementation Status (Reference on Comments Page )

Documentation

(If you can't meet this control at all please explain why)

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

1. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

2. Procedures to facilitate the implementation of the access control policy and associated access controls; and

b. Reviews and updates the current:

1. Access control policy [at least every 3 years]; and

2. Access control procedures [at least annually]. ARS follows NEC’s User Access Control policy. This policy has been developed based on the business and information security requirements. The policy is maintained and reviewed by the Information Security Officer on no less than an annual basis.

“Policies for Information Security,” are reviewed by the corporate Policy Committee no less than annually or at significant changes for continued applicability to our business. This process is defined by NEC in the Information Security Organizations (ISM-01-01A) policy and augmented as necessary. Corporate policy is internal only and does not take into consideration customer-specific requirements. The Information Security Committee reviews security policies before they are sent to the corporate Policy Committee. Upon completion of review and final approval, ARS is notified if any changes were made. Updates are distributed via mass email to all employees. Implemented Service Provider Corporate

ISMS SOA A5.1.1, A5.1.2

ARS documents on the Integrated Management System SharePoint site:

ISMS Awareness Training

• NEC policies at http://www.mynec.com/Policies/:

Acceptable Use Policy ISM-01-01A – Information Security Organizations, Section 1 ISM-03-01 – Information Security Requirements, Section 1 ISM-04-01 – Security of IT Facilities and Equipment ISM-05-01 – Information Technology Operations and Management, Section 1 ISM-06-01 – User Access Control ISM-09-01 – Use of Company IT Systems and the Internet, Section 1

ISMS SOA 6.1.1

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.9.1.1

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.12.1.1

ARS documents on the Integrated Management System SharePoint site::

ISMS SOA A.18.1.1

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.18.2.2

ARS documents on the Integrated Management System SharePoint site:

2) Is the policy or standard reviewed and if needed, updated on a scheduled basis?

Obtain access control policy and procedures; other relevant documents or records and ascertain if

(I) the organization develops and documents access control policy and procedures;

(ii) the organization disseminates access control policy and procedures to appropriate elements within the organization;

(iii) responsible parties within the organization periodically review access control policy and procedures; and

(iv) the organization updates access control policy and procedures when organizational review indicates updates are required. Access provided is not consistent with job function as Access Control Policy is not documented, communicated, and understood. 8120 6.2 8270 6.2 8280 6.1 - 6.7.1 8310 6.1 - 6.10 8320 6.1 - 6.18 [CobiT v5 - High Level Control Objective AP013; DSS02; DSS05]Controls have been defined to ensure system security by defining IT security policies, procedures and standards, and monitoring, detecting, reporting security vulnerabilities and incidents. ID.GV-1, PR.AC-1 Critical Control 15: Controlled Access Based on the Need to Know 9.3.1.1 Access Control Policy and Procedures (AC-1) A.5.1.1, A.5.1.2, A.6.1.1, A.6.1.2, A.6.1.3, A.8.1.1, A.10.1.1, A.10.8.1, A.11.1.1, A.11.3.3, A.11.4.1, A.11.6.1, A.11.7.1, A.11.7.2, A.12.3.2, A.15.1.1, A.15.2.1 5.1.1, 5.1.2, 6.1.1, 6.1.3, 8.1.1, 10.1.1, 10.8.1,11.1.1, 11.2.1, 11.2.2, 11.4.1, 11.7.1, 11.7.2,15.1.1, 15.2.1 HIPAA Security Section - 45 CFR 164.308(a)(3)(ii)(B) HIPAA Security Section - 45 CFR 164.312(a)(1)

The organization:

a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

g. Monitors the use of, information system accounts;

h. Notifies account managers:

1. When accounts are no longer required;

2. When users are terminated or transferred; and

3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements [At least annually]; and

k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Control Enhancement:

(1) ACCOUNT MANAGEMENT | AUTOMATED SYSTEM ACCOUNT MANAGEMENT

The organization employs automated mechanisms to support the management of information system accounts.

(2) ACCOUNT MANAGEMENT | REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS

The information system automatically [Selection: removes; disables] temporary and emergency accounts after [no more than 30 days for temporary and emergency account types].

(3) ACCOUNT MANAGEMENT | DISABLE INACTIVE ACCOUNTS

The information system automatically disables inactive accounts after [90 days for user accounts].

(4) ACCOUNT MANAGEMENT | AUTOMATED AUDIT ACTIONS

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles]. Control Enhancement:

(5) ACCOUNT MANAGEMENT | INACTIVITY LOGOUT

The organization requires that users log out when [Assignment: organization-defined time-period of expected inactivity or description of when to log out].

Supplemental Guidance: Related control: SC-23.

(7) ACCOUNT MANAGEMENT | ROLE-BASED SCHEMES

The organization:

(a) Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;

(b) Monitors privileged role assignments; and

(c) Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate.

(9) ACCOUNT MANAGEMENT | RESTRICTIONS ON USE OF SHARED GROUPS / ACCOUNTS

The organization only permits the use of shared/group accounts that meet [Assignment:

organization-defined conditions for establishing shared/group accounts].

(10) ACCOUNT MANAGEMENT | SHARED / GROUP ACCOUNT CREDENTIAL TERMINATION

The information system terminates shared/group account credentials when members leave the group.

(12) ACCOUNT MANAGEMENT | ACCOUNT MONITORING / ATYPICAL USAGE

The organization:

(a) Monitors information system accounts for [Assignment: organization-defined atypical use];

and

(b) Reports atypical usage of information system accounts to [Assignment: organization-defined personnel or roles]. Access control policy is in place and enforced.

ISMS Annex A Manual Section 9.2 User Access Management

The objective of this section is to ensure authorized user access and to prevent unauthorized access to ARS systems and services. ARS controls access to its server environment using Active Directory and Azure active directory for the cloud access control.

Implemented Shared (Service Provider and Customer Responsibility) ISMS SOA A.9.2.1 ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.9.2.2

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.9.2.3

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.9.2.5

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.9.2.6

ARS documents on the Integrated Management System SharePoint site:

ISMS Annex A Manual (this document), Section 7.3.1, “Termination or Change of Employment Responsibilities”

NeoFace Reveal Core Configuration Requirements Documents (CCRD) (SharePoint: QMS_Core_Config_Reqs_Doc_(CCRD)_Reveal_Template_DRAFT_2021-10-14.docx)

NeoFace Reveal Customer-Specific Configuration Requirements Document (CSCRD)

(I) the organization manages information system accounts, including authorizing, establishing, activating, modifying, reviewing, disabling, and removing accounts;

(ii) the organization defines in the security plan, explicitly or by reference, the frequency of information system account reviews and the frequency is at least annually;

(iii) the organization reviews information system accounts in accordance with organization-defined frequency; and

(iv) the organization initiates required actions on information system accounts based on the review.

(v) determine if the organization employs automated mechanisms to support information system account management functions.

(vi) the organization defines in the security plan, explicitly or by reference, a time period for each type of account after which the information system terminates temporary and emergency accounts; and

(vii) the information system automatically terminates temporary and emergency accounts after organization-defined time period for each type of account.

(viii) the organization defines in the security plan, explicitly or by reference, a time period after which the information system disables inactive accounts; and

(ix) the information system automatically disables inactive accounts after organization-defined time period.

(x) the organization employs automated mechanisms to audit account creation, modification, disabling, and termination actions; and

(xi) the organization employs automated mechanisms to notify, as required, appropriate individuals.

Section 6.2 Mobile Devices and Teleworking The objective of this section is to ensure that there are security controls over teleworking and the use of mobile devices in ARS.

Section 9.1 Business Requirements of Access Control The objective of this section is to limit access to ARS information and information processing facilities.

Section 9.4 System and Application Access Control The objective of this section is to prevent unauthorized access to ARS systems and applications. Implemented Shared (Service Provider and Customer Responsibility) ISMS SOA A.6.2.2 ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.9.1.2

ISMS SOA A.9.4.1

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A. 9.4.4

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.9.4.5

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.13.1.1

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.14.1.2

ISMS SOA A.14.1.3

ARS documents on the https://necam0.sharepoint.com/teams/IntegratedManagementSystem/ISMS%20Process%20Documents/Forms/AllItems.aspx

ISMS SOA A.18.1.3

ARS documents on the Integrated Management System SharePoint site:

Not applicable Not applicable Are information systems (applications, operating systems, network devices, databases, etc.) configured and access enforcement mechanisms employed per approved policy to provide protection from unauthorized access by malicious users, software or systems? Obtain access control policy; procedures addressing access enforcement; information system configuration settings and associated documentation; list of assigned authorizations (user privileges); information system audit records; other relevant documents or records and ascertain if

(I) the information system enforces assigned authorizations for controlling access to the system in accordance with applicable policy; and

The information system separates information flows logically or physically using [Assignment:

organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization defined required separations by types of information]. Access control policy is in place and enforced.

Section 13.1 Network Security Management ARS operates segregated networks. They are managed as a separate sub-domain in the Rancho Cordova location range IP addresses.

Section 13.2 Information Transfer Formal exchange of policies and procedures have been implemented throughout the ISMS including but not limited to: ISMS A-12 Operations Security and ISMS A-15 Supplier Relationships to protect the exchange of information, covering the use of all types of communications facilities and data storage media.

Section 14.1 Security Requirements of Information Systems The objective of this section is to ensure that information security is an integral part of ARS’s information systems across the entire lifecycle, including requirements for ARS information systems that provide services over public networks. Implemented Service Provider Hybrid (Corporate and System Specific) ISMS SOA A.13.1.3 ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.13.2.1

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.14.1.2

ISMS SOA A.14.1.3

ARS documents on the https://necam0.sharepoint.com/teams/IntegratedManagementSystem/ISMS%20Process%20Documents/Forms/AllItems.aspx

1) to "authorize" and regulate connections to and from applicable information systems, and [Note: supporting processes can include security considerations when interfaces are created to and from the information system; controlling administrative type access that can enable interface accounts, etc.].

2) to restrict and control the allocation and use of administrative access to information systems?

[Note: examples may include approvals needed to grant administrative type access; monitoring for administrative access need and usage; etc.]. Obtain access control policy; procedures addressing information flow enforcement; information system design documentation; information system configuration settings and associated documentation; information system baseline configuration; list of information flow authorizations; information system audit records; other relevant documents or records and ascertain if the information system enforces assigned authorizations for controlling the flow of information within the system and between interconnected systems in accordance with applicable policy. Users gain access to information that is beyond their appropriate level of privilege. 8320 6.3 [CobiT v5 - High Level Control Objective AP013; DSS02, DSS05] Controls have been defined to ensure system security by defining IT security policies, procedures and standards, and monitoring, detecting, reporting security vulnerabilities and incidents. PR.AC-4, PR.PT-3 Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches.

Critical Control 15: Controlled Access Based on the Need to Know.

Critical Control 17: Data Loss Prevention 9.3.1.4 Information Flow Enforcement (AC-4) 5.10.1 AC-04 A.7.2.2, A.10.7.3, A.10.8.1, A.11.4.5, A.11.4.7, A.12.5.4 10.6.1, 10.8.1, 11.4.5, 11.4.7, 11.7.2, 12.4.2,12.5.4 HIPAA Security Section - 45 CFR 164.308(a)(3)(ii)(B) HIPAA Security Section - 45 CFR 164.308(a)(4)(ii)(B) HIPAA Security Section - 45 CFR 164.308(a)(4)(ii)(c )

a. Separates [Assignment: organization-defined duties of individuals];

b. Documents separation of duties of individuals; and

c. Defines information system access authorizations to support separation of duties. Access control policy is in place and enforced.

Section 6.1.2 Segregation of Duties Conflicting duties and areas of responsibility are segregated, thus reducing opportunities for unauthorized or unintentional modifications or misuse of ARS assets. Implemented Service Provider Hybrid (Corporate and System Specific) ISMS SOA A.6.1.2 ARS documents on the Integrated Management System SharePoint site:

(I) the organization establishes appropriate divisions of responsibility and separates duties as needed to eliminate conflicts of interest in the responsibilities and duties of individuals; and

Control Enhancement:

(1) LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY FUNCTIONS

The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].

(2) LEAST PRIVILEGE | NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS

The organization requires that users of information system accounts, or roles, with access to [all security functions] use non-privileged accounts or roles, when accessing non-security functions.

(5) LEAST PRIVILEGE | PRIVILEGED ACCOUNTS

The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].

(9) LEAST PRIVILEGE | AUDITING USE OF PRIVILEGED FUNCTIONS

The information system audits the execution of privileged functions.

(10) LEAST PRIVILEGE | PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED FUNCTIONS The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. Access control policy is in place and enforced.

Section 9.1.2 ARS has limited access to its network and network services through the use of a firewall and implementation of the Access Control Policy. Individuals at ARS are granted access to the network based on their roles and responsibilities. Access is reviewed on no less than an annual basis. Users who have received proper clearances will get a VPN account created after a user creation form is filled out and signed off by their manager and the Support Center. User clearance records are stored in DocuSign and CJIS Online.

Section 9.4 System and Application Access Control

ISMS SOA A.9.2.3

ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.9.4.4

ISMS SOA A.9.4.5

ARS documents on the Integrated Management System SharePoint site:

(I) the organization assigns the most restrictive set of rights/privileges or accesses needed by users for the performance of specified tasks; and

HIPAA Security Section - 45 CFR 164.308(a)(3)(ii)(B)

a. Enforces a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [not more than three]; and [Fifteen Minutes]

b. Automatically [Selection: locks the account/node for an [locks the account/node for thirty minutes]; locks the account/node until released by an administrator; delays next logon prompt according to [Assignment: organization-defined delay algorithm]] when the maximum number of unsuccessful attempts is exceeded. Access control policy is in place and enforced.

Section 9.4 System and Application Access Control The objective of this section is to prevent unauthorized access to ARS systems and applications.

The use of system utilities is strictly prohibited and accessible only to those individuals with administrator privileged access. Each employee has their unique login for each system under Active Directory (or another directory service). Implemented Service Provider Hybrid (Corporate and System Specific) ISMS SOA A.9.4.2 ARS documents on the Integrated Management System SharePoint site:

(I) the organization defines in the security plan, explicitly or by reference, the maximum number of consecutive invalid access attempts to the information system by a user and the time period in which the consecutive invalid access attempts occur;

(ii) the information system enforces the organization-defined limit of consecutive invalid access attempts by a user during the organization-defined time period;

(iii) the organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period;

(iv) the organization selects either a lock out mode for the organization-defined time period or delays next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts;

a. Displays to users [Assignment: organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:

1. Users are accessing a State of Arizonainformation system;

2. Information system usage may be monitored, recorded, and subject to audit;

3. Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and

4. Use of the information system indicates consent to monitoring and recording;

b. Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

c. For publicly accessible systems:

1. Displays system use information [Assignment: organization-defined conditions], before granting further access;

2. Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

3. Includes a description of the authorized uses of the system. Access control policy is in place and enforced.

Section 9.4 System and Application Access Control The objective of this section is to prevent unauthorized access to ARS systems and applications.

The use of system utilities is strictly prohibited and accessible only to those individuals with administrator privileged access. Each employee has their unique login for each system under Active Directory (or another directory service).

Implemented Service Provider Hybrid (Corporate and System Specific) ISMS SOA A.9.4.2 ARS documents on the Integrated Management System SharePoint site:

(I) the information system displays a system use notification message before granting system access informing potential users:

- that the user is accessing a State of Arizonainformation system;

- that system usage may be monitored, recorded, and subject to audit;

- that unauthorized use of the system is prohibited and subject to criminal and civil penalties; and

- that use of the system indicates consent to monitoring and recording;

(ii) the system use notification message provides appropriate privacy and security notices (based on associated privacy and security policies or summaries);

(iii) the organization approves the information system use notification message before its use; and

a. Prevents further access to the system by initiating a session lock after [three (3) sessions for privileged access and two (2) sessions for non-privileged access] of inactivity or upon receiving a request from a user; and

b. Retains the session lock until the user reestablishes access using established identification and authentication procedures. Access control policy is in place and enforced.

Section 11.2 Equipment

All users are made aware of the secu rity requirements and procedures for protecting unattended equipment, as well as their responsibilities for implementing such protection.

Session time-out for laptops and desktops are set at 15 minutes with a password required for re-entry. ARS has also required every employee to adhere to this standard. All employees caught not adhering to this standard are subject to disciplinary action. Implemented Service Provider Hybrid (Corporate and System Specific) ISMS SOA A.11.2.8 ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.11.2.9

ARS documents on the Integrated Management System SharePoint site:

(I) the organization defines in the security plan, explicitly or by reference, the time period of user inactivity after which the information system initiates a session lock;

(ii) the information system initiates a session lock after the organization-defined time period of inactivity;

(iii) the information system provides the capability for users to directly initiate session lock mechanisms; and

a. Prevents further access to the system by initiating a session lock after [Assignment: organization-defined time period] of inactivity or upon receiving a request from a user; and

b. Retains the session lock until the user reestablishes access using established identification and authentication procedures.

Control Enhancement:

(1) SESSION LOCK | PATTERN-HIDING DISPLAYS

The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image. Access control policy is in place and enforced.

Section 11.2 Equipment

All users are made aware of the security requirements and procedures for protecting unattended equipment, as well as their responsibilities for implementing such protection.

Session time-out for laptops and desktops are set at 15 minutes with a password required for re-entry. ARS has also required every employee to adhere to this standard. All employees caught not adhering to this standard are subject to disciplinary action. Implemented Service Provider Hybrid (Corporate and System Specific) ISMS SOA A.11.2.8 ARS documents on the Integrated Management System SharePoint site:

ISMS SOA A.11.2.9

ARS documents on the Integrated Management System SharePoint site:

(I) the organization defines in the security plan, explicitly or by reference, the time period of user inactivity after which the information system initiates a session lock;

(ii) the information system initiates a session lock after the organization-defined time period of inactivity;

(iii) the information system provides the capability for users to directly initiate session lock mechanisms; and

Section 11.2 Equipment

All users are made aware of the security requirements and procedures for protecting unattended equipment, as well as their responsibilities for implementing such protection.

Session time-out for laptops and desktops are set at 15 minutes with a password required for re-entry. ARS has also required every employee to adhere to this standard. All employees caught not adhering to this standard are subject to disciplinary action. Implemented Service Provider Hybrid (Corporate and System Specific) ISMS SOA A.11.2.8 ARS documents on the Integrated Management System SharePoint site:

ISMS SOA…