Attachment_J-10_-_AMIS_Publication_4814.pdf

Publication 4812 Contractor Security Controls

Handling and Protecting Information or Information Systems

***This Publication Pertains to IT Assets Owned and Managed at Contractor Sites***

CYBERSECURITY

Information Technology

Publicationn 4812 (Rev. 10-2015) Catalog Number 54170T Department of the Treasury Internal Revenue Service www.irs.gov

Highlights of Publication 4812

Publication 4812 is designed to identify security requirements for contractors and any subcontractors supporting the primary contract. It identifies security controls and requirements for contractors (and their subcontractors) who handle or manage Internal Revenue Service (IRS) Sensitive But Unclassified (SBU) information on or from their own information systems or resources. The level of required security controls may vary depending on the duration, size, and complexity of the contract.

Publication 4812 defines basic security controls, requirements and standards required of contractors (and contractor employees) when the contract is for services, contractors, and contractor employees who will either:

• Have access to, develop, operate, host, or maintain IRS SBU information or information systems for tax administration purposes (or provide related services) outside of IRS facilities or outside of the direct control of the Service, and/or

• Have access to, compile, process, or store IRS SBU information on their own information systems or that of a subcontractor or third-party Service Provider, or that use their own information systems (or that of others) and Electronic Information and Technology (as defined in FAR Part 2) to access, compile, process, or store IRS SBU information while working at an IRS owned or controlled facility.

SBU information includes all taxpayer returns and return information, as defined by Internal Revenue Code (IRC) Section 6103; all Personally Identifiable Information (PII), where there is information that can be associated to a specific individual; and other sensitive information to include, but not limited to Sensitive Law Enforcement Information, Employee Information, or other information protected by the Privacy Act, and organizationally sensitive information such as Information Technology (IT) system configurations, identification of vulnerabilities, etc.

Publication 4812 has been updated to include changes introduced by the NIST Special Publication (SP) 800-53 (Revision 4), Security and Privacy Controls for Federal Information Systems and Organizations.

Physical security controls have also been modified to clarify requirements at organizations housing IRS information.

IRS Publication 4812 i

Table of Contents Background

Purpose

Scope

3.1 IRS Security Controls Structure

3.1.1 IRM 10.8.1 Applicability

3.1.2 Publication 4812 Applicability

SBU Information

4.1 Returns and Return Information

4.2 Law Enforcement Sensitive Information

4.3 Employee Information

4.4 Personally Identifiable Information

4.5 Other Protected Information

Information and Information Systems

Disclosure of Information

Roles and Responsibilities

7.1 Government

7.1.1 Contracting Officer (CO)

7.1.2 Contracting Officer’s Representative (COR)

7.1.3 Information Technology and Contractor Security Assessments (CSA)

7.1.4 Privacy, Governmental Liaison and Disclosure (PGLD)

7.1.5 Agency Wide Shared Services and Facilities Management and Security Services (AWSS/FMSS)

7.1.6 Personnel Security

7.2 Contractor

7.2.1 Contractor Security Representative (CSR)

7.2.2 Contractor Employees

7.3 Contractor Program Requirements

7.3.1 Contractor Security Policies and Procedures

7.3.2 Contractor Investigative Requirements

7.3.3 Contractor Training

7.3.4 Contractor Information Protection

7.3.5 Rules of Behavior

Contractor Security Assessments (CSA)

8.1 Overview

8.2 Types of Assessments

ii

8.3 Notice of Assessments

8.4 Security Control Levels

8.5 Scope of Assessments

8.5.1 Collaboration on Contractor Security Assessments

8.5.2 Continuous Monitoring of Security Controls

8.5.3 State of Security Package

Security Categorization

Security Control Organization and Structure

Access Control and Approving Authorization for IT Assets (AC)

11.1 AC-1 Access Control Policy and Procedures

11.2 AC-2 Account Management

11.3 AC-3 Access Enforcement

11.4 AC-4 Information Flow Enforcement

11.5 AC-5 Separation of Duties

11.6 AC-6 Least Privilege

11.7 AC-7 Unsuccessful Login Attempts

11.8 AC-8 System Use Notification

11.9 AC-11 Session Lock

11.10 AC-12 Session Termination

11.11 AC-14 Permitted Actions without Identification or Authentication

11.12 AC-17 Remote Access

11.13 AC-18 Wireless Access

11.14 AC-19 Access Control for Mobile Devices

11.15 AC-20 Use of External Information Systems

11.16 AC-21 Information Sharing

11.17 AC-22 Publicly Accessible Content

Awareness and Training (AT)

12.1 AT-1 Security Awareness and Training Policy and Procedures

12.2 AT-2 Security Awareness Training

12.3 AT-3 Role Based Security Training

12.4 AT-4 Security Training Records

Audit and Accountability (AU)

13.1 AU-1 Audit & Accountability Policy and Procedures

iii

13.2 AU-2 Auditable Events

13.3 AU-3 Content of Audit Records

13.4 AU-4 Audit Storage Capacity

13.5 AU-5 Response to Audit Processing Failures

13.6 AU-6 Audit Review, Analysis, and Reporting

13.7 AU-7 Audit Reduction and Report Generation

13.8 AU-8 Time Stamps

13.9 AU-9 Protection of Audit Information

13.10 AU-11 Audit Record Retention

13.11 AU-12 Audit Generation

Security Assessment and Authorization (CA)

14.1 CA-1 Security Assessment and Authorization Policies and Procedures . 38

14.2 CA-2 Security Assessments

14.3 CA-3 Information System Connections

14.4 CA-5 Plan of Action and Milestones

14.5 CA-6 Security Authorization

14.6 CA-7 Continuous Monitoring

14.7 CA-9 Internal System Connections

Configuration Management (CM)

15.1 CM-1 Configuration Management Policy and Procedures

15.2 CM-2 Baseline Configuration

15.3 CM-3 Configuration Change Control

15.4 CM-4 Security Impact Analysis

15.5 CM-5 Access Restrictions for Change

15.6 CM-6 Configuration Settings

15.7 CM-7 Least Functionality

15.8 CM-8 Information System Component Inventory

15.9 CM-9 Configuration Management Plan

15.10 CM-10 Software Usage Restrictions

15.11 CM-11 User-Installed Software

Contingency Planning (CP)

16.1 CP-1 Contingency Planning Policy and Procedures

16.2 CP-2 Contingency Plan

iv

16.3 CP-3 Contingency Training

16.4 CP-4 Contingency Plan Testing and Exercises

16.5 CP-6 Alternate Storage Site

16.6 CP-7 Alternate Processing Site

16.7 CP-8 Telecommunications Services

16.8 CP-9 Information System Backup

16.9 CP-10 Information System Recovery and Reconstitution

Identification and Authentication (IA)

17.1 IA-1 Identification and Authentication Policy and Procedures

17.2 IA-2 Identification and Authentication (Organizational Users)

17.3 IA-3 Device Identification and Authentication

17.4 IA-4 Identifier Management

17.5 IA-5 Authenticator Management

17.6 IA-6 Authenticator Feedback

17.7 IA-7 Cryptographic Module Authentication

17.8 IA-8 Identification and Authentication (Non-Contractor Users)

Incident Response (IR)

18.1 IR-1 Incident Response Policy and Procedures

18.2 IR-2 Incident Response Training

18.3 IR-3 Incident Response Testing

18.4 IR-4 Incident Handling

18.5 IR-5 Incident Monitoring

18.6 IR-6 Incident Reporting

18.7 IR-7 Incident Response Assistance

18.8 IR-8 Incident Response Plan

Maintenance (MA)

19.1 MA-1 System Maintenance Policy and Procedures

19.2 MA-2 Controlled Maintenance

19.3 MA-3 Maintenance Tools

19.4 MA-4 Non-Local Maintenance

19.5 MA-5 Maintenance Personnel

19.6 MA-6 Timely Maintenance

Media Protection (MP) v

20.1 MP-1 Media Protection Policy and Procedures

20.2 MP-2 Media Access

20.3 MP-3 Media Marking

20.4 MP-4 Media Storage

20.5 MP-5 Media Transport

20.6 MP-6 Media Sanitization

20.7 MP-7 Media Use

Physical and Environmental Protection (PE)

21.1 PE-1 Physical and Environmental Protection Policy and Procedures

21.2 PE-2 Physical Access Authorization

21.3 PE-3 Physical Access Control

21.4 PE-4 Access Control for Transmission Medium

21.4.1 Transporting IRS Material

21.5 PE-5 Access Control for Output Devices

21.6 PE-6 Monitoring Physical Access

21.7 PE-8 Visitor Access Records

21.8 PE-9 Power Equipment and Cabling

21.9 PE-10 Emergency Shutoff

21.10 PE-11 Emergency Power

21.11 PE-12 Emergency Lighting

21.12 PE-13 Fire Protection

21.13 PE-14 Temperature and Humidity Controls

21.14 PE-15 Water Damage Protection

21.15 PE-16 Delivery and Removal

21.16 PE-17 Alternate Work Site

Planning (PL)

22.1 PL-1 Security Planning Policy and Procedures

22.2 PL-2 System Security Plan

22.3 PL-4 Rules of Behavior

22.4 PL-8 Information Security Architecture

Program Management (PM)

Personnel Security (PS)

24.1 PS-1 Personnel Security Policy and Procedures

vi

24.2 PS-2 Position Risk Designation

24.3 PS-3 Personnel Screening

24.4 PS-4 Personnel Termination

24.5 PS-5 Personnel Transfer

24.6 PS-6 Access Agreements

24.7 PS-7 Third-Party Personnel Security

24.8 PS-8 Personnel Sanctions

Risk Assessment (RA)

25.1 RA-1 Risk Assessment Policy and Procedures

25.2 RA-2 Security Categorization

25.3 RA-3 Risk Assessment

25.4 RA-5 Vulnerability Scanning

System and Services Acquisition (SA)

26.1 SA-1 System and Services Acquisition Policy and Procedures

26.2 SA-2 Allocation of Resources

26.3 SA-3 System Development Life Cycle

26.4 SA-4 Acquisition Process

26.5 SA-5 Information System Documentation

26.6 SA-8 Security Engineering Principles

26.7 SA-9 External Information System Services

26.8 SA-10 Developer Configuration Management

26.9 SA-11 Developer Security Testing and Evaluation

System and Communications Protection (SC)

27.1 SC-1 System and Communications Protection Policy and Procedures ... 75

27.2 SC-2 Application Partitioning

27.3 SC-4 Information in Shared Resources

27.4 SC-5 Denial of Service Protection

27.5 SC-7 Boundary Protection

27.6 SC-8 Transmission Confidentiality and Integrity

27.7 SC-10 Network Disconnect

27.8 SC-12 Cryptographic Key Establishment and Management

27.9 SC-13 Cryptography Protection

27.10 SC-15 Collaborative Computing Devices

vii

27.11 SC-17 Public Key Infrastructure Certificates

27.12 SC-18 Mobile Code

27.13 SC-19 Voice over Internet Protocol (VoIP)

27.14 SC-20 Secure Name/Address Resolution Services (Authoritative Source) 77

27.15 SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)

27.16 SC-22 Architecture and Provisioning for Name/Address Resolution Service 78

27.17 SC-23 Session Authenticity

27.18 SC-28 Protection of Information at Rest

27.19 SC-39 Process Isolation

System and Information Integrity (SI)

28.1 SI-1 System and Information Integrity Policy and Procedures

28.2 SI-2 Flaw Remediation

28.3 SI-3 Malicious Code Protection

28.4 SI-4 Information System Monitoring

28.5 SI-5 Security Alerts, Advisories, and Directives

28.6 SI-7 Software Firmware, and Information Integrity

28.7 SI-8 Spam Protection

28.8 SI-10 Information Input Validation

28.9 SI-11 Error Handling

28.10 SI-12 Information Output Handling and Retention

28.11 SI-16 Memory Protection

Privacy Controls

29.1 AR-3 Privacy Requirements for Contractors and Service Providers

29.2 AR-5 Privacy Awareness and Training

29.3 DM-2 Data Retention and Disposal

29.4 DM-3 Minimization of PII Used in Testing, Training, and Research

29.5 SE-1 Inventory of Personally Identifiable Information

29.6 SE-2 Privacy Incident Response

Termination of Contract

30.1 Destruction or Return of SBU Information

viii

Taxpayer Browsing Protection Act of 1997 and Unauthorized Access and Disclosures

APPENDIX A: ACRONYMS

APPENDIX B: GLOSSARY

APPENDIX C: SECURITY CONTROL LEVELS

APPENDIX D: PHYSICAL ACCESS CONTROL GUIDELINES

APPENDIX E: REFERENCE

1 Background The E-Government Act of 2002 (Public Law 107-347) Title III, Federal Information Security Management Act (FISMA) of 2002, as amended by Federal Information Security Modernization Act of 2014 (Public Law 113-283), requires each agency to provide security for “the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.” FISMA requires federal agencies to develop and implement policies for information security oversight of contractors and other users with access to federal information and information systems.

To ensure FISMA compliance, the National Institute of Standards and Technology (NIST) identifies specific security controls/criteria in NIST Special Publication (SP) 800- 53 (Revision 4), Security and Privacy Controls for Federal Information Systems and Organizations. NIST provides a series of recommended security controls to be employed by agencies and service providers to provide for the confidentiality, integrity, and availability of federal information and information systems and guidelines for effective security controls that support federal operations and assets.

Because of requirements distinct to IRS mission objectives, as well as specific laws or rulings, such as the Gramm-Leach Bliley (GLB) Act, the Federal Trade Commission (FTC) Financial Privacy Rule and Safeguards Rule, and the Sarbanes-Oxley Act, IRS contractors, their affiliates, subcontractors, and service providers are subject to additional requirements for protecting information and information systems, when appropriate or applicable.

2 Purpose This publication defines basic security controls, requirements and standards that apply to contractors, contractor employees, and subcontractor employees supporting the primary contract, based on the security controls framework under NIST SP 800-53 (Revision 4), where those contractor employees have access to develop, operate, or maintain IRS information or information systems. While NIST SP 800-53 (Revision 4), is a general guide, the intent of Publication 4812 is to provide IRS security requirements in the IRS contracting environment.

This publication also describes the framework and general processes for conducting security assessments and responsibilities of the Government and the contractor in implementing security controls and safeguards to protect SBU information and information systems.

As described in NIST SP 800-53 (Revision 4), “The ultimate objective is to conduct the day-to-day operations of the organization and to accomplish the organization’s stated missions and business functions with what Office of Management & Budget (OMB) Circular A-130 defines as adequate security, or security commensurate with risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information.”

3 Scope The requirements in this publication and the security controls contained hereinafter are based on NIST SP 800-53 (Revision 4).

3.1 IRS Security Controls Structure

NIST provides Federal agencies flexibility to apply the security concepts and principles in NIST SP 800-53 (Revision 4) within the context of and with due consideration to each agency’s mission, business functions, and environments of operation.

As part of its information security program, IRS identifies security controls for the organization’s information and information systems in the following two (2) key documents:

• Internal Revenue Manual (IRM) 10.8.1 – Information Technology (IT) Security, Policy and Guidance (The public document is redacted.), and

• Publication 4812 – Contractor Security Controls.

While IRM 10.8.1 and Publication 4812 are both based on NIST SP 800-53 (Revision 4), they apply to different operating environments – internal and external to the organization, respectively; and, as would be expected, vary greatly in the level of direct control the agency has over the host’s or service provider’s normal business operations.

3.1.1 IRM 10.8.1 Applicability

IRM 10.8.1 provides overall security control guidance for the IRS, and uniform policies and guidance to be used by each office, or business, operating, and functional unit within the IRS that uses IRS information systems to accomplish the IRS mission. This manual also applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, who have access to, and/or use or operate IRS information systems containing IRS information at facilities controlled by IRS. (Note: Beyond appropriate references to the manual, IRM 10.8.1 is outside of the scope of Publication 4812 and contractors who need to refer to that document for guidance may access it at http://www.irs.gov/irm/part10/irm_10-008-001.html.)

3.1.2 Publication 4812 Applicability

Publication 4812 is a layperson's guide of security controls specific to IRS, based on controls established in NIST SP 800-53 (Revision 4). Publication 4812 contains IRS-specific requirements that meet the standard for NIST SP 800-53 (Revision 4), and the security controls, requirements, and standards described herein are to be used in lieu of the common, at-large security control standards enumerated in NIST SP 800-53 (Revision 4). Contractors may, at their discretion, refer to NIST SP 800-53 (Revision 4), to gain a better understanding of the common standards, but shall coordinate with the Contracting Officer's Representative (COR) for their contract, or Pub4812@irs.gov, for clarification on Publication 4812 security controls/standards or guidance/requirements specific to IRS. (Note: All NIST Special Publication (800 series) are available at the following web site: http://csrc.nist.gov/publications/PubsSPs.html.)

Publication 4812 defines basic security controls, requirements and standards required of contractors (and contractor employees) in which contractors and contractor employees (or subcontractors and subcontractor employees) will either:

• Have information systems for tax administration purposes (or provide related services) outside of IRS facilities or outside of the direct control of the Service, and/or

• Have access to, compile, process, or store IRS SBU information on their own information systems or that of a subcontractor or third-party Service Provider, or that use their own information systems (or that of others) and Electronic Information and Technology (as defined in FAR Part 2) to access, compile, process, or store IRS SBU information while working at an IRS owned or controlled facility.

Publication 4812 is typically incorporated into IRS contracts, agreements or orders (directly or through flow down provisions). IRS IT Security/FISMA Contract language is also included in any contracts or orders (directly or through flow down provisions) for IT acquisitions, which include IT hardware and/or software, telecommunications software or equipment, and maintenance/service (including consulting services) on any hardware and/or software products.

As used in this publication, the term “contract,” unless specified otherwise, includes (and the requirement or meaning of the text applies to) contracts, task/delivery/purchase orders, blanket purchase agreements, and interagency agreements in which IRS is the servicing agency and contractor services and resources, equipment and systems are being used to support the agreement. The publication may also be used and incorporated into interagency agreements in which IRS is the requesting agency and the servicing agency does not have a publication (or security controls consistent with NIST SP 800-53 (Revision 4)) in place comparable to Publication 4812.

As described in greater detail in subsequent sections, there are four (4) basic levels of security controls (from the first level requiring the least number of security controls and overall scrutiny, to the last level requiring the greatest number of security controls and overall scrutiny). One of which shall be assigned (or assignable) to all applicable service contracts, based on a number of risk-based factors (operators) that take into account and are responsive to individual users (e.g., individual, residential non-networked users) and business concerns of any size, with due deference to higher risk factors (operators) such as networked environments and software development. The specific security controls associated with each security control level can be found in Publication 4812, Section 8.4 and Publication 4812, Appendix C. The use of basic levels of security controls notwithstanding, IRS always reserves the right to add other security controls to any given contract to protect its assets–based on the work being performed, the environment in which the work is being performed, perceived risks

(threats and vulnerabilities), the suitability and effectiveness of existing controls, and other factors, as appropriate, and in the best interests of the Government.

Publication 4812 also describes the framework and general processes for conducting contractor security assessments to monitor compliance and assess the effectiveness of security controls applicable to any given contracting action subject to Publication 4812.

4 SBU Information “SBU Information” as defined by OMB Circular No A-130 Revised, means “any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual forms.”

“Sensitive But Unclassified,” as described in the Department of the Treasury Security Manual, is a term that “originated” with the Computer Security Act of 1987. It defined SBU as ‘any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United States Code (USC) (the Privacy Act) but which has not been specifically authorized under criteria established by an executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy.’

Access to SBU information shall be provided on a “need to know” basis. SBU information shall never be indiscriminately disseminated, and no person shall be given access to (or allowed to retain) more SBU information than is needed for performance of their duties, and for which that individual has been authorized to receive as a result of their having been successfully investigated and adjudicated, and trained to receive, and what is strictly necessary to accomplish the intended business purpose and mission.

SBU information shall only be released or accessible to those individuals who have been approved to receive such information (or in the case of information systems, approved for access) by IRS Personnel Security (PS), for interim or final staff-like access and have a bona fide “need to know” in order to perform the work required under the contract for which they have been granted access to such information.

SBU shall be categorized in one (1) or more of the following groups:

• Returns and Return Information,

• Law Enforcement Sensitive (LES) Information,

• Employee Information,

• Personally Identifiable Information, and

• Other Protected Information.

4.1 Returns and Return Information

Returns and return information includes all information covered by § 6103 of the IRC, 26 U.S.C. § 6103. This includes tax returns and return information.

4.2 Law Enforcement Sensitive Information

This includes grand jury, informant, and undercover operations information and procedural guide.

4.3 Employee Information

All employee information covered by the Section 552a of Title 5, United States Code (USC) (5 U.S.C. 552A (g) (1). Examples include personnel, payroll, job applications, disciplinary actions, performance appraisals, drug tests, health exams, and evaluation data.

4.4 Personally Identifiable Information

The term “personally identifiable information” (PII) refers to information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

OMB 07-16:

http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2007/m07- 16.pdf

PII includes the uniquely identifiable personal information of taxpayers, employees, contractors, applicants, and visitors to the IRS. Examples of PII include, but are not limited to:

• Name,

• Home address,

• Social Security number,

• Date and place of birth,

• Mother’s maiden name,

• Home telephone number,

• Biometric data (e.g., height, weight, eye color, fingerprints, etc.), and

• Other numbers or information that alone or in combination with other data can identify an individual.

PII includes any information related to an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information, to distinguish or trace an individual's identity as shown above. This is discussed in the Incident Handling section 18.4, IR-4 Incident Handling of this document.

4.5 Other Protected Information

Other protected information includes any knowledge or facts received by or created by IRS in support of IRS work. This includes all information covered by the Trade Secrets Act, the Procurement Integrity Act, and similar statutes. Examples include, but are not limited to:

• Records about individuals requiring protection under the Privacy Act,

• Information that is not releasable under the Freedom of Information Act,

• Proprietary data,

• Procurement sensitive data, such as contract proposals,

• Information, which if modified, destroyed, or disclosed in an unauthorized manner could cause: loss of life, loss of property, or funds by unlawful means, violation of personal privacy or civil rights, gaining of an unfair procurement advantage by contractors bidding on government contracts, or disclosure of proprietary information entrusted to the Government,

• Information related to the design and development of application source code,

• For contracting organizations providing IT support to the IRS, this includes specific IT configurations, where the information system security configurations could identify the state of security of that information system; Internet Protocol (IP) addresses that allow the workstations and servers to be potentially targeted and exploited; and source code that reveals IRS processes that could be exploited to harm IRS programs, employees or taxpayers,

• Security information containing details of serious weaknesses and vulnerabilities associated with specific information systems and/or facilities, and

• Any information, which if improperly used or disclosed could adversely affect the ability of the agency to accomplish its mission.

5 Information and Information Systems Information requires protection whether or not it resides on an information system.

Per OMB Circular A-130 (Section 6, Paragraph j), the definition of Information is as follows:

The term "information" means any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual forms.

Information System, as defined by OMB Circular A-130, means “a discrete set of information resources organized for the collection, processing, maintenance, transmission, and dissemination of information, in accordance with defined procedures, whether automated or manual.”

In all instances, security controls apply to both information and information systems.

6 Disclosure of Information Disclosure of returns and return information is generally prohibited unless authorized by statute. The IRC makes the confidential relationship between the taxpayer and the IRS quite clear, and stresses the importance of this relationship by making it a crime to violate this confidence. Designed to protect the privacy of taxpayers, IRC Section 26 U.S.C. § 7213 prescribes criminal penalties for contractors and their contractor employees who make unauthorized disclosures of returns and return information and Privacy Act protected information. (Note: IRC Section 26 U.S.C. § 7213 criminal penalties do not apply to PII information unless it falls under the banner of tax information.) The sanctions of the IRC are designed to protect the privacy of taxpayers.

Additionally, IRC Section 26 U.S.C. § 7213A makes the unauthorized inspection of returns and return information a misdemeanor punishable by fines, imprisonment, or both. And finally, IRC Section 26 U.S.C. § 7431 allows for civil damages for unauthorized inspection or disclosure of returns and return information, and upon conviction, the notification to the taxpayer that an unauthorized inspection or disclosure has occurred. IRC Section 26 U.S.C. § 6103 (n) gives the contractor the authority to disclose returns and return information to its employees whose duties or responsibilities require the returns and return information for a purpose described in paragraph (a) of the section. Prior to releasing any returns and return information to a subcontractor, the contractor must have written authorization from the IRS.

Contractors shall have adequate programs in place to protect the information received from unauthorized use, access, and disclosure. The contractor’s programs for protecting information received must include documenting notification to employees and subcontractors (at any tier), who will have access to SBU information, the importance of protecting SBU information in general, and returns and return information, and information protected by the Privacy Act in particular. The documented notification must also include the disclosure restrictions that apply and the criminal or civil sanctions, penalties or punishments that may be imposed for unauthorized disclosure or inspection. Disclosure practices and the safeguards used to protect the confidentiality of information entrusted to the Government (and, as provided under the IRC and the Privacy Act) are subject to continual assessment and oversight to ensure their adequacy and efficacy.

7 Roles and Responsibilities The following sections define roles and responsibilities in the contractor assessment process.

7.1 Government

7.1.1 Contracting Officer (CO)

• Enforces the government’s rights and remedies for all contractual matters.

• Ensures compliance with the terms and conditions of the contract.

• Ensures appropriate security-related clauses and language are included in applicable contracts.

• Ensures the contractor affords the Government access to the contractor’s facilities, installations, operations, documentation, records, IT systems, and databases to carry out a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, and availability of Government data. The Government shall perform inspections and tests in a manner that shall not unduly delay the work.

• Employs all rights and remedies available to the Government to ensure contractors take action to correct or mitigate identified security vulnerabilities.

• Modify contract, when risk level requires modification, based upon Cybersecurity recommendation.

7.1.2 Contracting Officer’s Representative (COR)

• Reviews the information provided in the State of Security Package for accuracy.

• Facilitates contractor security reviews and serves as the liaison between the

Contractor Security Assessments (CSA) team and the contractor when scheduling contractor security assessments and by being the primary IRS focal point for the contractor.

• Escalates key information to the Contracting Officer related to contractor risk.

• Provides quarterly status of the Plan of Action and Milestone (POA&M) to

Cybersecurity.

• Furnishes the Security Assessment Report (SAR) and related information to the contractor.

• Identifies to the contractor, the names of specialized IT Security Roles and the associated number of required hours for specialized Security Training.

• Provides a copy of the Privacy and Civil Liberties Impact Assessment (PCLIA) to the contractor and identifies any specific requirements required by the contractor, when a PCLIA is required.

7.1.3 Information Technology and Contractor Security Assessments (CSA)

• Establishes the schedule for Contractor Security Assessments in coordination with COs, CORs and targeted contractors.

• Conducts Contractor Site Assessments (and virtual site assessments, when appropriate) for the current FISMA year cycle (July 1st to June 30th).

• Coordinates with the COR to identify contractor security review timeframes to conduct assessments.

• Maintains and updates, as appropriate, Publication 4812 and related materials

(e.g., Contractor Statements of Security Assurance (CSSA), State of Security (SoS) Package content and format, and guidelines for examining such materials), and coordinates changes or updates with Procurement and other organizational components and stakeholders.

• Acts as a resource for CORs/ Business Operating Division (BODs) in developing POA&Ms and assessing compliance, and reconciliation or mitigation efforts.

• Acts as a point of contact for technical issues for BODs and Procurement Officials (and directly or indirectly for contractors). IT/CSA can be contacted at Pub4812@irs.gov.

• Furnishes SARs and appropriate briefings to contractors who are the subject of Contractor Security Assessments, and to BODs, COs, and CORs.

• Alerts Situation Awareness Management Center (SAMC) of any incidents, risks, or vulnerabilities discovered in the course of conducting a Contractor Security Assessment that represents immediate, actionable threat intelligence, or presents an unusually urgent demand for attention, correction, or remediation.

Similarly, alerts Disclosure, Facilities Management and Security Services (FMSS), Procurement, PGLD, or others, as appropriate, of issues of a pressing nature revealed in the course of conducting a Contractor Security Assessment that falls within each component’s areas of responsibility.

7.1.4 Privacy, Governmental Liaison and Disclosure (PGLD)

• Preserves and enhances public confidence by advocating for the protection and proper use of identity information.

• Promotes the privacy and protection of personally identifiable information in the trust of the IRS by integrating privacy protections in technology solutions and business practices.

7.1.5 Agency Wide Shared Services and Facilities Management and Security Services (AWSS/FMSS)

• Ensures readiness and preparedness activities enhancing IRS’s ability to continue ongoing services to taxpayers.

• Trains and supports IRS employees and contractors to adequately protect locations and sensitive information where IRS work is performed (FMSS Physical Security).

• Prepares and disseminates SAMC Incident Reports accordingly.

• Collaborates with CSA to conduct physical security portion of the Contractor

Security Assessment.

7.1.5.1 Contractor Security Management (CSM)

• Initiates and monitors investigative processing for all contractors for IRS contracts.

• Ensures Security Awareness Training (SAT) is provided to contractors annually, and tracked.

• Ensures Specialized Information Technology Security (SITS) training is tracked.

• Reports the number of contractors that complete the mandatory SAT and

SITStraining to IT Cybersecurity.

7.1.6 Personnel Security (PS)

• Receives and processes all investigative processing requests from CSM.

• Notifies the appropriate IRS stakeholders of any changes to access status.

• Intakes and assesses Position Designation Surveys from contractors (directly or through the COR), and uses the Office of Personnel Management Position Tool to assign the position risk designation (or make adjustments/updates, as needed) prior to granting contractor personnel interim or staff-like access to IRS information or information systems.

7.1.7 Project Manager/Task Manager

• Performs Privacy Threshold Analysis by filling out the PCLIA Qualifying

Questionnaire and emailing the completed form to * Privacy

• Forwards the PCLIA form to the COR, if Privacy determines a PCLIA is required

• Reviews findings and collaborates with the contractor to develop a Plan of Action and Milestone (POA&M) to correct or remediate identified risks.

• Coordinates with the contractor to update POA&M and provide updates to COR quarterly.

7.2 Contractor

In order to ensure IRS information and information systems are protected at all times, it is the responsibility of IRS contractors to develop and implement effective controls and methodologies in their business processes, physical environments, and human capital or personnel practices that meet or otherwise adhere to the security controls, requirements and objectives described in this publication, and their respective contracts.

As part of the award process, the contractor is required to include an assigned Contractor Security Representative (CSR) and alternate CSR to all contracts requiring access to Treasury/bureau information, information technology and systems, facilities, and/or assets. The CSR is the contractor’s primary point of contact for the Government on all security-related matters and the person responsible for ensuring the security of information and information systems in accordance with the terms and conditions of the contract and all applicable security controls.

Whenever PII is being collected by a contractor, the contractor is responsible for protecting this information as identified in the IRS Privacy and Civil Liberties Impact Assessment (PCLIA).

7.2.1 Contractor Security Representative (CSR)

Within 10 calendar days of contract award or order issuance, the CSR shall submit to the Contracting Officer’s Representative (COR) a list of contractor employees who will have a significant role or responsibility for information/IT security in the performance of the contract. The CSR will identify the specific IT security role the employee will perform under the contract, and will indicate whether such employee(s) has/have completed role-based training, as well as the source and title/subject of the training.

Significant responsibilities shall include but may not be limited to contractor employees who have access to either contractor-managed facilities or contractor managed systems/IT assets used to handle, process or store IRS SBU information, regardless of location or facility, to include contractors who need such access including the use of other IT resources, at contractor managed facilities.

The CSR is responsible for ensuring the following responsibilities are addressed through the life cycle of the contract. Specific roles and responsibilities shall include:

• Complete and submit the State of Security (SOS) package

• At least quarterly, provide updates to the CO/COR on all identified findings using

POA&Ms

• Report all incidents to the IRS, as required under Incident Reporting section of this document.

• Ensure all employees undergo the necessary security screening process and receive interim or final staff-like access approval prior to beginning work under the awarded contract or order. Ensure all employees take required IRS training annually related to the protection of information.

• Complete the PCLIA, if provided by the COR.

7.2.2 Contractor Employees

• Ensure all training is completed annually as required by contractor management.

• Ensure all security policies and procedures are followed during routine work.

• Ensure the safeguarding of all information provided to the contractor as part of the IRS contract.

7.3 Contractor Program Requirements

The contractor must develop a comprehensive security program that addressees all aspects of IT security.

7.3.1 Contractor Security Policies and Procedures

Contractors are responsible for developing processes and putting in place procedures to implement security controls and requirements in this publication and the contract.

As described in NIST SP 800-53 (Revision 4) the first security control in each family is also known as the “dash one (1)” control (e.g., AC-1, CP-1, SI-1, etc.). It generates the requirement for policy and procedures that are needed for the effective implementation of the other security controls and control enhancements in the family.

A contractor who is subject to the security controls under Publication 4812 does not necessarily have to develop a plan specific to each family if and when those policies and procedures are already established in some existing formal or institutional document that the contractor can readily identify (to the satisfaction of IRS), and the plan contains policies and procedures that address the material elements or requirements for that particular dash one (1) control and security control family. For example, if the PS-1–Personnel Security Policy and Procedures requirements for a formal documented personnel security policy (and procedures to implement those polices and associated personnel security controls) are already contained in the contractor’s existing Human Resources policies, the contractor would not have to recreate this documentation so long as the IRS determines (or is in a position to determine) these existing products or records fulfill the key, germane aspects and requirements for that particular dash one (1) control, as specified in Publication 4812.

Only when the contractor does not have standing policies and procedures that adequately and fully address each respective security control family dash one (1) requirement (or the existing policies and procedures are inadequate and need to be supplemented), does the contractor need to develop specific policies and procedures to address that particular control family.

7.3.2 Contractor Investigative Requirements

All contractors, subcontractors, experts, consultants, and paid/unpaid interns, like Federal employees, are subject to a security screening to determine their suitability and fitness for Department of the Treasury or IRS work, and the security screening must be favorably adjudicated. The level to which such contractor personnel and others are screened or investigated shall be comparable to that required for Federal employees who occupy the same positions and who have the same position sensitivity designation.

Security screening is required regardless of the location of the work. This includes contractor or subcontractor employees who use technology for remote access to information technology systems as well as those who have direct physical access to any IRS documents or data outside of any IRS facility.

Contractors shall ensure all contractor and subcontractor employees performing or proposed to perform under the contract are identified to the IRS at time of award (or assignment) in order to initiate appropriate security screening.

Contractors shall ensure that any personnel that are not favorably adjudicated or otherwise pose a security risk are immediately removed from performance under contracts with the IRS, and suitable replacement personnel agreeable to the IRS are provided.

7.3.3 Contractor Training

Ensure all contractor employees who require staff-like access to IRS information or information systems, where these are located at contractor managed facilities using contractor managed assets; regardless of their physical location complete the required Security Awareness Training. Contractor activities that require IRS security awareness training include but are not limited to:

• Manage, program or maintain IRS information in a development, test or production environment.

• Manage or operate an information system or IT asset for tax administration purposes.

• Conduct testing or development of information or information systems for tax administration purposes.

• Provide information system administrative support.

Maintain and furnish, as requested, records of initial and annual training and certifications. Establish additional internal training, as needed (or as required under the terms of the contract), for personnel in the organization who require access to IRS information or information systems to perform under the contract.

Please reference Section 12.2 AT-2 Security Awareness Training, for time requirements to complete training.

7.3.4 Contractor Information Protection

Ensure all SBU information is protected at rest, in transit, and in exchanges (i.e., internal and external communications). Limit access to SBU information to authorized personnel (those favorably adjudicated and trained) with a need to know, and ensure internal and external exchanges are conducted only through secure or encrypted channels. The contractor shall employ encryption concepts and approved standards to ensure the confidentiality, integrity, and availability of the SBU information, consistent with the security controls under Publication 4812 and any security requirements specified elsewhere in the contract.

7.3.5 Rules of Behavior

Contractors shall develop and distribute a set of internal rules of behavior with regard to access to and use of Government information and information systems. Rules of Behavior, which are required in OMB Circular A-130, Appendix III, and is a security control contained in NIST SP 800-53 (Revision 4), shall clearly delineate responsibilities and expected behavior of all individuals with access to information systems and/or Government information and/or IRS SBU information. The rules shall state the consequences of inconsistent behavior or noncompliance, and be made available to every user prior to receiving authorization for access to the system and/or IRS SBU information. It is required that the rules contain a signature page for each user to acknowledge receipt, indicating that they have read, understand, and agree to abide by the rules of behavior. Electronic signatures are acceptable for use in acknowledging the rules of behavior. Contractors must maintain (and furnish, as requested) records of signed acknowledgements on the rules of behavior, Non-Disclosure Agreements, and completion of all required security awareness training.

8 Contractor Security Assessments (CSA)

8.1 Overview

Security controls are the management, operational, and technical safeguards or countermeasures employed to protect the confidentiality, integrity and availability of an organization’s information and information systems.

Contractor Security Assessments are on-site evaluations performed by the IRS to assess and validate the effectiveness of security controls established to protect IRS information and information systems. Security control effectiveness addresses the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to protecting information and individual privacy, or meeting the security requirements for the information system in its operational environment. These assessments help to determine if and when additional controls or protections are necessary to protect returns and return information or personal privacy, or other SBU information, and organizational assets and operations.

All contracts subject to this publication are subject to an on-site Contractor Security Assessment each annual review cycle (i.e., the 12 month period beginning July 1st of each year, coinciding with the beginning of the FISMA calendar year).

Contractor Security Assessments are conducted by IRS and cannot be a self-assessment performed by the contractor. Contractor Statements of Security Assurance (CSSA) that are completed by contractors, as described herein after provide the means for the contractor to make a preliminary assertion to the IRS as to its perceived level of conformity to security requirements. Such assessments/assertions can provide contractors further insight into their own operating environments, and serve as one (1) of the tools used to determine if and when a Contractor Security Assessment will be performed by the IRS on any given contract, in any given annual assessment cycle.

8.2 Types of Assessments

As a general rule, the current contract conditions and stage of the acquisition lifecycle will dictate the type of Contractor Security Assessment the IRS will conduct. Qualifying events or conditions that may prompt or necessitate the IRS perform a security assessment include:

• Pre-Award Assessments: Pending the award of a contract, the IRS may require that the apparently successful offeror provide verification (or be subject to verification by IRS) that security controls are in place, as built into the solicitation.

With due consideration to the scope of the contract, and the urgency and immediacy of need for access to (and release of) SBU information and/or information systems, and other factors, as a general rule, IRS will not conduct pre-award assessments, but reserves that option.

• Immediate (Probationary) Post–Award Assessments: This type of assessment may be conducted within the first 30–90 days of award, and may be performed in lieu of a pre-award assessment when award is imminent and the need to make the contract award is urgent and compelling, but conducting a pre-award assessment is not viable. In such cases, the IRS would have determined that the award may proceed, and that IRS approved interim access to information or information systems is allowable, but that an assessment is necessary as soon as possible after award.

• Periodic Post–Award Assessments: Based upon the type of work being performed and the volume of SBU being processed, the IRS may schedule an assessment, at least annually, to ensure security controls are in place, and operating as intended.

• End of Contract Assessments: At contract expiration or termination, the IRS may elect to conduct a security assessment to ensure that all IT resources and SBU data have been adequately inventoried and returned or disposed of in accordance with the contract.

8.3 Notice of Assessments

For each contract the IRS selects for assessment in any given annual assessment cycle, the IRS will advise the contractor of the Service’s intent to conduct an on-site Contractor Security Assessment. As a general rule, approximately one (1) month prior to the projected timeframe or proposed date of the assessment, the IRS will coordinate a mutually agreed upon assessment date to visit the contractor’s facility or work site.

This advance notice is as much a…