Attachment 6 - HRConnect Control Objectives and Description of Controls.pdf

ATTACHMENT 6

HRCONNECT

CONTROL OBJECTIVES & DESCRIPTION OF CONTROLS

Security Management Controls

Control Objective 1: System Security Plan

Controls provide reasonable assurance that management has established, implemented, and monitored HRConnect system security plans.

Description of Controls

The Treasury Department is mandated to comply with Federal Information Security Modernization

Act of 2014, Public Law 113–283 (December 18, 2014) which requires agencies to have effective information security controls over Information resources to support federal operations, assets and provide a mechanism for improved oversight of agency information security programs.

HRConnect SSP is the foundation of a security control structure and a reflection of EBS’ commitment to addressing security risks. The SSP establishes a framework and continuous cycle of activity for assessing risk, developing and implementing effective security procedures, and monitoring the effectiveness of these procedures.

EBS has supplemented the Department level controls by implementing specific procedures and controls at the HRConnect applications. EBS has followed and documented Departmental Offices, EBS, and HRConnect specific security policies that have been made available to affected personnel, including HRConnect employees and contractors. These policies include system and application rules and expected user behaviors.

The HRConnect SSP provides an overview of the security requirements as it applies to

HRConnect, and it describes the controls in place for meeting those requirements. The HRConnect

SSP delineated responsibilities and expected the behavior of all individuals who access the system.

The HRConnect Cyber Security team maintains the HRConnect SSPs and housed within the

TFIMS.

EBS applied RMF to HRConnect, which included conducting the activities of security categorization, security control selection and implementation, security control assessment, information system authorization, and security control monitoring. EBS uses TFIMS to document this process.

The security plan establishes security categories for both information contained in HRConnect and the HRConnect application based on Federal Information Processing Standards Publication (FIPS

Pub) 199: Standards for Security Categorization of Federal Information and Information Systems.

EBS used the FIPS Pub 199 to determine the Security Categories risk level of high, moderate, or low. EBS selected the controls to implement based on FIPS Pub 200: Minimum Security

Requirements for Federal Information and Information Systems and NIST Special Publication

800-53 Rev. 4 Revision 4: Security and Privacy Controls for Federal Information Systems and

Organizations. An independent party performs SA&A at least annually to determine the extent to which the system’s security controls are implemented correctly, operating as intended. The assessor evaluates management, operational, and technical controls. As a result of the SA&A process, findings are analyzed, and a POA&M is created for each control that has failed. When the

SA&A is completed, the assessor issues the Security Assessment Reports (SARs). The SAR is performed annually on approximately one-third (1/3) of the security controls, which constitutes a

Risk Assessment. The Authorizing Official inspects the SSP, SA&A, SAR, and POA&Ms to determine whether to Authorize to Operate (ATO) for HRConnect EBS maintains and updates

SA&A documentation at least annually.

In accordance with the Department’s Continuous Monitoring Strategy, a set of controls from NIST

SP 800-53 Rev. 4 are defined for system authorization testing annually. The test results are placed in TFIMS by June 30th of every year. HRConnect follows Continuous Monitoring actions throughout the year to review system changes for security impacts. These include monthly and ad-hoc security vulnerability assessment and security configuration across the system layers, security impact/risk assessments on system changes.

TFIMS provides a centralized system for the management artifacts that support assessments, documentation, and reporting on the status of IT security risk assessments and implementation of

Federal and NIST standards. TFIMS helps manage and track POA&Ms to include creating, tracking, and closing, as well as automating system inventory and FISMA reporting capabilities.

Sufficient evidence must be provided in order to close each POA&M. POA&Ms are utilized to identify any findings, deficiencies, or weaknesses noted in all types of reviews. EBS program management, via System Owner (SO), Information System Security Officer (ISSO), Information

System Security Manager (ISSM), and Director, Enterprise Applications Cybersecurity (EAC), monitor and track any findings identified in internal and external audits as POA&Ms.

Control Objective 2: Security Related Personnel Policies

Controls provide reasonable assurance that Security related personnel policies are established, implemented, and monitored, including hiring practices of background investigations, confidentiality agreements, termination, and transfer procedures, IT Cybersecurity Awareness training, and exit interviews, which encompass the returning of property, keys, and removal of logical and physical access.

On-Boarding and Off Boarding

HRConnect inherits NIST SP 800-53 Rev 4 Personnel Security (PS-1) controls, e.g., background investigation from the Department of the Treasury Security Manual (Treasury Department

Publication (TD P)) 15-71.

All Treasury EBS employees and users with access to Sensitive But Unclassified Information

(SBU) data are restricted to those who have completed and favorably adjudicated background investigations. All approved users who require elevated privileges must complete the Treasury

Shared Services Center access request forms, comply with all HRConnect Rules of Behavior and related requirements. Federal employees and contractors/subcontractors are required to have a completed and favorably adjudicated background investigation that is, at a minimum, compliant with Homeland Security Presidential Directive-12 ((HSPD-12) requirements. The HSPD-12 minimum investigation is a National Agency Check with Inquiries (NACI) or such higher-level investigation may be required by the risk level or sensitivity of the position. Individuals lacking

Personnel Security approval, regardless of permission levels, will be denied access.

Employee exit procedures, including a Provisioning for Personnel (P4P) form, are completed for termination of access privileges and the return of property. EBS receives Personal Identity

Verification (PIV) cards of terminated employees and deactivates their physical access privileges.

Training

EBS personnel are provided with and required to take IT Cybersecurity Awareness training, Ethics training, and Privacy Awareness training on an annual basis. EBS offers application specific training to HRConnect customers. Treasury employees and contractors are required to complete and sign a Rules of Behavior and confidentiality agreements prior to obtaining access to the

Treasury network. New employees are required to complete the Cyber Security Awareness training and acknowledge the Departmental Offices Rules of Behavior agreement prior to obtaining access to the Treasury network. Security-related subject matters are regularly emailed to personnel and posted to the internal share drive.

Access Controls

Control Objectives 3: Access to Facilities

Controls provide reasonable assurance that access to facilities is limited to appropriately authorized personnel.

EBS Location

EBS’ physical location has a security guard located within the lobby of the building requiring the signature of guest and escort by an EBS employee. The guest’s signature is maintained in a hard copy logbook at the guard station. Access to EBS’ physical location is controlled using pre-numbered access cards to the elevators and floors. Access cards control access to facilities, as well as the physical access of computer equipment.

Physical access to facilities is gained after an employee/contractor completes the paperwork and fingerprints required for a background investigation. An access badge is issued to a new employee/contractor only after a favorable Special Agreement Check (SAC) is completed. The

SAC is a limited investigation (or a series of checks) done only through special agreement between

OPM and an agency. Access badges are required for entry and must always be displayed.

Each employee and contractor has an issued PIV card after the appropriate security approval.

Employees and contractors must use their PIV cards to access their floors in the elevators and to enter the work area on the floor itself, as well. Signs on floor entrances instruct all personnel to use their badges and not allow others to “piggyback.”

PIV Cards

Within the OCIO’s Infrastructure and Operations is the Treasury Enterprise Identity Credential and Access Management (TEICAM). Its mission is to improve security, efficiency, and promote interoperability through Identity and Access Management for Treasury personnel, organizations, partners, and external agencies including EBS’ HRConnect. The TEICAM provides requirements, coordination, management processes, technical coordination for personal identity verification, credential and access management compliance and solutions for HSPD-12. TEICAM and Federal

Public Key Infrastructure (PKI) initiatives are established Treasury-wide. TEICAM capabilities include: PIV Data Synchronization (PDS); Physical Access Controls (PACs); Logical Access

Controls (LACs) for local, remote, and mobile devices, including Derived PIV credential infrastructure and issuance; Single Sign-On (SSO); Federation; Enterprise Identity Management;

and PKI.

All users are required to go through the authentication process in order to access the system. Once logged in, users have access to pages and menus that are defined by their permission lists and roles.

The data accessed is controlled by Row Level Security, based on each bureau’s department tree.

Data Centers

Datacenter hard drives, storage devices, Storage Area Network (SAN) storage devices1, removable devices, etc. must be pulverized and can never be traded-in to the vendor or disposed of as being surplus. The destruction of this equipment is tracked. Visitors accessing the Datacenter must be escorted while inside the Datacenter.

IRS Data Center Location

EBS performs site visit reviews to verify data center implementation of physical and environmental (PE) controls surrounding the HRConnect equipment annually across the EBS

HRLOB systems. On behalf of Treasury EBS HRConnect, the data center sufficiently provides those inherited controls, such as physical access controls to the building and the individual data centers (no one is allowed in unless previously authorized or escorted by approved escort), physical access controls (armed building guards, identity checks, sign-in sheets, closed-circuit television

(CCTV) cameras, locked doors, alarmed emergency exits), visitor access controls and escorting, fire protection and suppression mechanisms (smoke & ion detectors, sprinkler systems, fire extinguishers), protected and redundant power conditioning equipment and cabling, emergency power shutoff, temperature and humidity controls, water damage protection (raised floors, water detectors), information system backups, secure and redundant telecommunication services, and

1 A storage area network (SAN) is a secure high-speed data transfer network that makes a network of storage devices accessible to multiple servers.

other controls. Based on the hosting center’s policies, visitors accessing the Datacenter must be escorted while inside the IRS Datacenter and inside the Treasury Enterprise Infrastructure

Operations Services (EIOS) facility module.

HRConnect resides within the IRS’ Memphis (MEM) and Martinsburg (MTB) facilities; IRS

Memphis serves as the primary site; hosting production services. IRS Martinsburg serves as the alternate facility. HRConnect inherits its Physical and Environmental controls from the IRS data center on which it resides and the Treasury EIOS hardware hosting services, which comply with

Treasury and IRS security policies. EBS CyberSecurity validates IRS and EIOS controls (Physical and Environmental, and Access Controls, System Communication, Media Protection, etc.) via site visits and checklists. HRConnect development and support staff inherit their physical access controls from the Treasury leased building staff that resides within and the Treasury network they access.

NOTE: EBS plans to perform an RA and ATO after HRConnect converts to the Oracle CSP OCI

GovCloud in November 2019 (Q1 FY20). HRConnect verified Oracle CSP OCI’s FedRAMP compliance prior to the HRConnect ATO. HRConnect will decommission data, services, connections, etc. from Memphis.

Control Objective 4: Access to Computerized Applications

Controls provide reasonable assurance that access to computerized applications and sensitive information is limited to appropriately authorized personnel.

EBS HRConnect system stores PII data and the data is encrypted at rest and in transit. Access to

HRConnect system is restricted to users with a valid logon identification and password or PIV card. Non-privileged users gain access to HRConnect through on-line account registration by entering a combination of their email address, the last four digits of their social security number, their last name, and a pin number that they create themselves upon registration. This process allows the user to then create a unique password that must be 12 characters long and must include at least one upper case and one lower case letter, one number and one special character. Users with access to PII are required to complete the HRConnect Program Office (HRCPO) Agreement to Safeguard

Sensitive Data.

All passwords expire every 90 days and users are required to use the UserID or Password link to reset their password and facilitated via the Password Management System (PWMS). Users are also required to use the Forgot Password link after 3 failed login attempts. The Forgot Password link is located on the HRConnect login page. This process is the same as the account registration process that requires the user to enter a combination of their email address, last four digits of their social security number, their last name, and a custom pin number.

Access to HRConnect is dependent on the level of access needed. Non-privileged level access is granted dynamically upon account registration. This includes Employee, Contingent Worker, and

Manager basic level access. All managers get access to initiate actions. Managers can assign proxies to initiate, approve, or initiate and approve actions on their behalf. Access privileges are granted based on the level of access required to support the process (e.g. for HR - processor, specialist). Privileged user accounts in production are controlled by strong passwords. Accounts are locked after inactivity. Privileged roles that are no longer needed are manually removed by the

Help Desk.

Privileged level access can be granted by Bureau Administrators at each customer agency via User

Access Maintenance. More advanced privileged-level access and Super-level access can only be granted by the EBS Customer Solutions team and requires a Treasury Shared Service Center

Security Access Form to be completed. Bureau/Sub-agency super and privileged users are created using forms requiring agency and supervisor approval. These forms are either submitted to

Customer Solutions via Service Desk ticketing system or emailed to the Customer Solutions Team

E-mail box. The Security Access form is required for the following access:

Super User access, which grants users access to all panels and agencies in HRConnect.

Privileged level access to HRConnect, which includes any roles not available to the agency via Bureau Maintenance User Access Maintenance. Examples of these roles include, but are not limited to, HR Super role and TR Bureau Super role.

The Treasury Shared Service Center Security Access form should be signed by the user, the user’s manager, and the agency representative. The approved form is then sent to Customer Solutions via

Service Desk ticketing system or emailed to the Customer Solutions Team E-mail box. A ticket is created for setup. Customer Solutions will grant the access and notify the user of the UserID and password. Customer Solutions will then notify the agency that the access has been granted and the user has been provided with their credentials.

User accounts are deactivated via the PAR process for terminating users. User IDs that have been deactivated due to termination are automatically locked. An automated process runs every night.

First, it scans all the PARs for any users that are contingent workers or employees that are no longer active as of that day or prior. The process then updates those user profiles as follows: locks the account, removes the primary permission list, and removes all the roles. This prevents the account from accidentally being unlocked and being usable.

HRCPO Customer Solutions performs additional audits on user accounts. Privileged and

Superuser accounts are analyzed by Customer Solutions quarterly to determine which accounts and roles are no longer needed due to termination or transfer. Health check reports are generated twice a month. The health check consists of several reports that are reviewed by Customer

Solutions. Customer Solutions reviews the health check report to identify user accounts with duplicate IDs. The health check review includes a review of the PAR Approving Officials table for both Terminated users and name changes. The following two reports are sent to the agencies to review: Positions that are encumbered by more than one employee, Active employees reporting to inactive positions.

The Treasury Shared Service Center Security Access form is also used to grant access to the following applications that are included in this audit review:

Border Server o Customer Solutions collects the forms, ensures they are complete, and then forwards the form to the UNIX team for set up. The UNIX team communicates the userID and Password to the user. Once the account is set up, Customer Solutions notifies the agency that the account set up is complete.

Toad Access o Customer Solutions collects the forms, ensures they are complete, and then forwards the form to the DBA team for set up. The DBAs communicate the userID and Password to the user. Once the account is set up, Customer Solutions notifies the requester that the account set up is complete.

STAT Access o Customer Solutions collects the forms, ensures they are complete, and then forwards the form to the UNIX team for set up. The UNIX team communicates the userID and Password to the user. Once the account is set up, Customer Solutions notifies the requester that the account set up is complete.

InCompass Privileged and Non-Privileged Access o EBS’ Customer Solutions collects the forms, ensures they are complete, and then forwards the form to the InCompass team for setting up. Access is restricted to users with a valid logon identification and password. Once the account is set up, Customer Solutions notifies both the user (with the credentials) and the agency that the account set up is complete. Password reset requests are facilitated through automated email notification. Daily reports are provided to all users who have accessed the system within a specified number of days. Admin accounts are manually reconciled intermittently; non-admin accounts are inserted/reconciled by the HRConnect Data Feed.

Complementary User Entity Controls

User entity auditors should determine whether user entities have established controls to provide reasonable assurance to properly grant access to the systems to users who have been vetted by their organization’s security requirements. Additionally, reasonable assurance to properly provide appropriate levels of privileged user access to the systems to users who have a bona fide need and have met their organization’s security requirements. Finally, user entity auditors must determine whether user entities have established controls to provide reasonable assurance to properly assign security roles to users based on their role in the system (e.g. personnel specialists would hold the

HR Specialist role vs. a manager who would hold the manager role in HRConnect).

Remote Access

An EBS supervisor sends an email to the Departmental Offices network authorizing employee/contractor’s remote access. Once remote access is granted, the employee/contractor can use their workstation to remote access to the same systems they access at their duty station.

Information provided in the authorizing email is used for completing a P4P form.

Configuration Management Controls

Control Objective 5: Software Development and Maintenance Activities

Controls provide reasonable assurance that software development and maintenance activities are authorized, documented, tested, and approved as described in the HRConnect System

Development Life Cycle (SDLC) methodology.

EBS has documented the configuration management process for HRConnect applications that includes roles, responsibilities, reviews, and approvals of configuration changes.

The most effective way to protect information and information systems is to integrate security into every step of the system development process, from the initiation of a project to develop a system to its disposition. The multistep process that starts with the initiation, analysis, design, and implementation, and continues through the maintenance and disposal of the system, is called the

SDLC. EBS uses ClearQuest change management software to control changes for HRConnect and maintain application baselines throughout the SDLC. The ClearQuest change management software manages the approvals, audit trails, coding, testing, and publication of the software changes. The management software allows automated workflows and email notifications to ensure that appropriate team members are alerted in near real-time when action is required; and software changes, along with associated requirements, are documented. Production ClearQuest change requests are tested according to development organization guidelines and approved prior to implementation. Once approvals have been received, the change is migrated to the production environment by the change management software or an EBS staff member who is independent of application developers.

Proposed change requests (CRs) are submitted to the Intake team. These can be submitted by

Customer representatives or internal team members. Proposed CRs are reviewed weekly by a team of program representatives including functional analysts, developers, project and program managers, and directors. Recommendations are shared with the team for approval/concurrence. If the CR is recommended and approved to move forward, a Business Requirement Document (BRD) and Cost Estimate Baseline Document (CEBD) (if customer-funded) are created and shared with the customer.

CRs are discussed in the monthly Configuration Control Board (CCB) meeting and feedback is requested from the customers. EBS records the CCB minutes and distributes them to the participants. If the CR is recommended/selected, alternative impacts, both positive and negative, are documented if appropriate, and the Functional Design Document (FDD) is approved by the

Director of HRConnect Products and the Functional Architect. If the CR LOE is less than 40 hours

(data only update, one-time script, minor text changes to pages, emails, etc.), an FDD and/or

Technical Design Document (TDD) may not be required. A waiver is submitted and documented for approval.

An EBS Developer performs a TDD review to walk through the changes and impact based on the

FDD. The TDD is a working document and is completed at the end of development. The development and technical documentation are considered complete, when the CR includes:

a functional design document or FDD waiver, a technical design document or TDD waiver, and;

technical peer review performed as described in the Software Peer Review Procedure.

Minutes from the technical peer review session should be included in the technical data package for the CR on the shared J drive and ClearQuest.

Each stage/lifecycle is separate for purposes of creating an independent process (intake, design, development, testing, internal validation, and customer user acceptance). At the end of the cycle

(whether internal or customer acceptance), approval is required for the changes made.

Control Objective 6: Processes and Procedures to Respond to Unusual Activity or Intrusion

Attempts

Controls provide reasonable assurance that management has processes and procedures in place to monitor unusual activity and intrusion attempts.

Annual Manual security inspection, and monthly automated security vulnerability and security configuration scans are performed on all EBS Cisco firewalls. On behalf of a System Owner, ISSO, and ISSM, EBS CyberSecurity security engineers conduct a monthly vulnerability assessment, and system security configuration scans to identify network vulnerabilities. EBS analyzes the identified vulnerabilities and either mitigates the vulnerability or documents it is required for production processes. EBS scans the various layers of HRConnect based on Treasury policy and

EBS CyberSecurity team formal SOP. Vulnerabilities are provided to System Owners and

Technical staff for remediation. All monthly scans that are conducted by EBS cyber engineers are tracked in a Vulnerability Executive Summary spreadsheet. Findings are tracked for remediation, and vulnerabilities identified from monthly scans are added as POA&Ms based on policy’s remediation schedule. EBS CyberSecurity manually inspects the security of the HRConnect firewalls and delivers reports semi-annually and upon changes.

EBS’ vulnerability management process follows Departmental policy on Patch Management and

System Updates to ensure system flaws are identified, reported, and corrected. Patches are prioritized and approved through EBS and are tested on non-production systems prior to installation on all production systems.

Penetration testing is conducted annually to exploit vulnerabilities and insufficiently configured security controls to determine whether a user could obtain unauthorized access to EBS’ IT operational environment; specifically, to demonstrate whether technical weaknesses were present in EBS’ computer systems that may allow employees or outsiders to inflict harm to, attack, and/or impact HRConnect.

Control Objective 7: Accuracy Testing Methods

Controls provide reasonable assurance that reconciliations, exception reports, and transmittal process are designed to ensure interfaces are working accurately.

inCompass

After HRConnect data is transferred to CSOD, the inCompass program team performs an annual review process to evaluate the data feed to ensure that the information populating the system is still relevant and necessary for CSOD to work as designed. The inCompass program team looks at the current data feed and compares the data collected against the new functionality deployed or newly available data to determine potential efficiencies that could be gained through additional data elements or structurally changed data. If there are opportunities to make improvements, the inCompass program team works with the HRConnect team to institute these changes.

With an automated data feed, an error report is generated by CSOD each night, Monday through

Friday, specifically identifying errors that prevent the system from updating core user information.

The error report identifies the issue and allows for correction of the data from the source system before the next feed occurs. This data correction process is inherited from HRConnect. If there is an error, it is the responsibility of the participating agency’s process owner to take appropriate steps to correct the findings. Follow-up communication with customers regarding interface variances is via email. The successful data interface is evidenced by customer email notification showing data feed log. User and organizational unit files are placed on the border server for customers to retrieve.

DOL Accounting

EBS accepts a daily delta file of accounting lines from the Department of Labor (DOL) financials application and applies changes and additions. Lines in the file must be coded as New, Replace, or Inactivate. New accounting lines are inserted into the HRConnect account code tables.

Inactivated lines have a new row inserted into the HRConnect account code tables, making the row inactive. Replacement lines are inserted, the replaced lines are deactivated, and the replacement is noted in a secondary table to support programmatic updates to the account code assignments on individual positions. This is a one-way feed. Logs are written to the N drive nightly

(Monday through Friday). Nothing goes back to DOL financials from the HRConnect application.

These files are then provided to DOL. An automated nightly process is run to send new payroll related DOL accounting lines and changes to existing payroll related DOL accounting lines to

HRConnect through border servers. EBS receives DOL’s NFC files after payroll is run every

Monday at 6 a.m.

Accounting lines that do not include all required fields will be reported as errors. This includes any accounting line that includes one or more Replaced fields but not the Replaced Effective Date.

Interface data will be written to this table without manipulation beyond the addition of the date/time stamp. Records in error are reported on the Invalid Accounting Lines report. There is a visual prompt for this on-demand report, letting the customer know when the report needs to be run.

With an automated data feed, an error report is generated by CSOD each night, Monday through

Friday, specifically identifying errors that prevent the system from updating core user information.

The error report identifies the issue and allows for correction of the data from the source system before the next feed occurs. This data correction process is inherited from HRConnect. If there is an error, it is the responsibility of the participating agency’s process owner to take appropriate steps to correct the findings. Follow-up communication with customers regarding interface variances is via email. The successful data interface is evidenced by customer email notification showing data feed log. User and organizational unit files are placed on the border server for customers to retrieve.

Control Objective 8: Customer Interagency Agreements

Controls provide reasonable assurance that Customer Interagency Agreements are appropriately monitored in accordance with established procedures to ensure efficiency and performance results.

EBS establishes an Interagency Agreement (IAA) with the Requesting Agency requesting services performed by EBS’ Shared Services Programs (SSP) and the Department of Treasury. The IAA conforms to the government-wide guidance prescribed by the Bureau of the Fiscal Service (Fiscal

Service) in TFM, Vol. I, Part 2, Ch. 4700, App. IO, (May 2019). The IAA authorizes SSP to provide the Requesting Agency service as described in the service description(s).

EBS works closely with its customers. Each year, EBS and its customers agree to the scope and nature of services to be provided by EBS, as well as responsibilities of the customer, as documented within the IAA.

EBS’ customers participate in survey polls conducted by the General Services Administration

(GSA) as well as surveys conducted by Treasury. EBS reviews the annual customer service survey provided by GSA to the ranking of EBS service. The results of the Treasury HRConnect surveys are discussed during the monthly configuration control board meetings. EBS documents changes to IAA using form 7600 A&B, as well as product-specific addendums. EBS does not have control of the questions or the timeliness of the surveys.

Control Objective 9: Secure Interface Processes

Controls provide reasonable assurance that processes are in place to establish secure interfaces.

Border Servers

The HRConnect border server securely exchanges interface files between HRConnect and user entities. The border server provides special security measures to ensure that all files are scanned for malware and are only accessible by approved individuals.

User entities place their interface files in a specified directory in the user entity server. The user entity accesses the HRConnect border server to pull or push interface files.

For user entities who contracted with a third-party hosting vendor to transfer interface files, HRConnect uses an automated process to push or pull interface files with the hosting vendor. The third-party hosting vendor does not have access privileges to HRConnect border server.

Interface files are encrypted in transit. Only the Secure File Transfer Protocol (SFTP) and Connect:

Direct FTP+ protocols are allowed for file transfers.

Secured Interface

New interface requests are handled through the EBS HRConnect change control process. EBS

CyberSecurity Team/ISSO reviews the change request that includes the information of data to be transmitted to or from HRConnect. The CyberSecurity Team inspects the information to determine whether the data is appropriate and can be adequately secured. The CyberSecurity Team and EBS

Technical Architecture (TA) meets with the user entity and third-party vendor, if any, to discuss and identify specific security issues. Once the security issues are resolved, the EBS CyberSecurity

Team approves the user entity request to begin testing of the connectivity and transfer of data.

When the new interface is approved, the EBS CyberSecurity team creates an ISA if required. An updated ISA is required every three years.

The user entity provides technical contacts to the TA team and to the third-party vendor, if necessary. The user entity or third-party vendor provides IP addresses of user entity’s data required to transmit the data to the EBS border servers (both test and production EBS border servers). The

EBS Deployment team provides the User Entity’s technical contact with an EBS Access Request

Form.

The EBS TA team creates a Fiscal Services Change Request (CR) requesting the Fiscal Services update firewall rules to allow the transmission between the user entity or third-party vendor to the

EBS border servers. The CR may take two to three weeks for processing from initiation to approval, to scheduling, and to completion.

The EBS TA team prepares a maintenance plan to update firewall rules to permit transmission between the user entity’s third-party vendor order servers and EBS border servers.

Data exchanges with third-party vendors are encrypted at rest using the recipient’s PGP public key. For example, data sent from the border server to the vendor is encrypted at rest using the vendor’s public PGP key. For data retrieved from the vendor and placed on the border server, the data is encrypted at rest using the HRCPO public PGP key.

The EBS TA team establishes password-based connectivity to the third-party vendor servers using

SFTP and the newly provided credentials. Then the EBS TA team provides the Treasury SSH public key to the partner and requests that they add the Treasury public key to the partner’s PKI

KeyStore. Once this is completed, the EBS TA team can establish key-based authentication instead of password-based authentication. Once key-based authentication is established, the EBS TA team automates the file transfer process. The EBS Deployment team provides the connectivity information (Unix ID and password, EBS border server name/IP address, and UNIX directory where interface files are stored) to the User Entity’s technical contact.

The EBS TA team and third-party vendor test the basic file transfers and PGP encryption/ decryption capabilities.

The EBS developer responsible for the interface program creates a ClearQuest Technical

Architecture (CQ TA) Work Order to have Control-M automate the pushing and pulling of files between the Control-M server and the EBS border server. The TA Work Order contains information including the names of the files being transferred, the size of the files being transferred, and the transfer schedule. The EBS developer refers to the CQ TA Work Order in the interface program Customer Service Request (CSR) migration notes so that the Control-M updates are made at the same time as the interface program is migrated.

The EBS Security team approves the production implementation, and file transfer automation is enabled in production.

reasonable assurance that the User Entity’s technical contact tests connectivity from the User

Entity’s border server to the EBS border server using SSH and SFTP. It is recommended, but not required that the User Entity’s technical contact places the User Entity’s border server public key on the EBS border server so that certificate-based authentication can take place. The User Entity’s technical contact should also test file transfers (pushes and pulls) between the User Entity’s border server and the EBS border server.

Control Objective 10: Subservice Organizations

Controls provide reasonable assurance that EBS monitors subservice organization and tests for compliances with complementary user entity controls.

Memphis Data Center

EBS reviews control at the MDC every 3 years and issues a site report. The IRS Memphis TN data center facility provides a secure data center to Treasury Enterprise Infrastructure Operations

Services (EIOS) within turn provides infrastructure for HRConnect productions data.

National Finance Center

Subservice Complementary User Entity Controls

EBS reviews SSAE 18 results or other control-related documentation provided by subservice organizations to determine whether deficiencies (if any) affect subservice organization controls that in turn may impact the related financial reporting of HRConnect systems. The EBS

CyberSecurity team reviews interconnected subservice organizations’ systems’ application

Security Assessment and Authorization (SA&A) documentation: the EBS CyberSecurity team performed a SA&A Documentation Review Visit of the NFC Payroll/Personnel System (PPS) application in 2018; to review an interconnected system’s FISMA status.

reasonable assurance that SINQ errors, HCUP Status, and mismatch cases are corrected to ensure transactions are processed. The user entity auditor should also determine whether user entities have established controls to provide reasonable assurance that the mismatch tables are reviewed and corrected.