36C10B18R2676-003.pdf

1 O F F I C E O F I N FORMAT I ON S E CUR I T Y

Addendum C – Authorization Requirements Quick Reference Guide

Authorization Requirements Requirement Roles / Responsibilities References

Technical/Testing Requirements Nessus Scan A credentialed vulnerability scan against all instances of the operating system and desktop configurations must be conducted to identify security flaws.

Actual scan results must be provided for analysis.

All Critical and High deficiencies should be mitigated with documented mitigation evidence provided, and Moderate and Low deficiencies should be mitigated or have a documented mitigation plan.

Within the uploaded mitigation strategy, each system should conduct an analysis on the results of the vulnerability scans to determine and document those findings that are false positives, not applicable to the system, or otherwise mitigated.

Additionally, findings that must be remediated through or from the vendor should also be documented as part of this analysis and should be documented.

Refer to the Threat & Vulnerability Manager (TVM) guidance material located on the OIS portal at Training and Brown Bag Materials for detailed information on how to access TVM within RiskVision.

If the system’s Nessus Scan data is currently displayed in TVM within RiskVision:

Browse to Nessus Enterprise Web Tool (NEWT) and use the Remediation Effort Entry Form (REEF) to document your manual remediation effort. For each deficiency identified from the scan, the System Owner or delegate creates a response within REEF for mitigating the deficiencies and / or provides evidence that the deficiencies have been mitigated. Also, include the scheduled completion date and status of each deficiency within REEF.

Once all manual remediation has been documented within REEF, run this report https://spsites.cdw.va.gov/sites/FODW_PVT/Progr ess%20Reports/Progress_ReportbyRegion_Chart.rd l within NEWT.

Export the report by going to the upper left side of the screen select the Actions Menu. Choose Export and select Excel. Save the file.

System Owner or delegate then uploads the report from step 3 above to the Documents tab within RiskVision. Mitigation information can also be provided in the Vulnerabilities tab within RiskVision.

Within the uploaded mitigation strategy, each system should conduct an analysis on the results of the vulnerability scans to determine and document those findings that are false positives, not applicable to the system, or otherwise mitigated.

Contact the Office of Cyber Security (OCS) at:

CertificationPMO@va.gov with any questions.

TVM guidance material located on the OIS portal at Training and Brown Bag Materials

2 O F F I C E O F I N FORMAT I ON S E CUR I T Y

Additionally, findings that must be remediated through or from the vendor should also be documented as part of this analysis.

If the system’s Nessus Scan data is not currently displayed in TVM within RiskVision:

: If Nessus Scan data is not currently provided in TVM for the system and instead raw Nessus Scan results exist from NSOC, the System Owner or delegate shall upload the actual Nessus Scan results to the Documents tab in RiskVision; along with a mitigation strategy for each finding. Also, within NEWT, if the ISO/System Owner does not have an option to pull a report for their FISMA reportable system, then contact the VA GRC Service Desk to provide the IP address range of the system accreditation boundary to add it to NEWT to pull the report.

System Owner or delegate creates one finding and a response in the Findings tab within RiskVision for the Nessus scan to serve as a reminder to resolve the deficiencies.

Quality Code Review Quality code reviews of custom developed VA applications using the approved VA static code analysis tool should be conducted to identify code quality issues within VA applications.

Applications written in languages that are not supported, such as MUMPS, shall be targeted for manual review of testing with other applicable tools; notify the VA Software Assurance (SwA) Program Office if this is the case at:

OISSwASupportGroup@va.gov.

V&V Quality Code Reviews VA Application Developers open a NSD ticket [(855) NSD HELP] to request VA static code analysis tools in order to perform scans according to the procedures in the VA Quality Code Review SOP and guidance materials.

VA Application Developers scan their own application source code.

VA Application Developers open a NSD ticket [(855) NSD HELP] to request validation of a final V&V quality code review.

VA Application Developers deliver the scan results to the VA SwA Program Office at: OISSwASupportGroup@va.gov for review, work with the VA SwA Program Office to schedule the validation, and coordinate with them to resolve any issues identified during validation.

The scan results are reviewed to ensure that minimum

For detailed instructions on the code reviews process, reference the VA Quality Code Review SOP and guidance materials, which are posted on the VA SwA Program Office Resource Site.

3 O F F I C E O F I N FORMAT I ON S E CUR I T Y

VA standards have been met. The VA SwA Program Office determines whether additional analysis is needed, and works with the VA Application Developers to ensure that they understand how to meet the standards required.

System Owner or delegate uploads full test results to the Documents tab in RiskVision.

System Owner or delegate creates a response for mitigating the deficiencies and/or provides evidence that the deficiencies have been mitigated for each deficiency identified from the V&V quality code review. Also, include the scheduled completion date and status of each deficiency. Information should be provided in Excel or Word format; refer to the OCS preferred template located on the OIS Portal at A&A Home Documents. System Owner or delegate uploads the aforementioned document to the Documents tab in RiskVision.

System Owner or delegate creates one finding and a response in the Findings tab within RiskVision for the V&V quality code review to serve as a reminder to resolve the deficiencies.

Secure Code Review V&V secure code reviews of custom developed VA applications must be conducted according to the VA Secure Code Review SOP located at

VA SwA Program Office Resource

V&V secure code reviews are conducted by the VA Application Developers.

Applications written in languages that are not supported, such as MUMPS, shall be targeted for manual review or testing with other applicable tools (notify OCS if this is the case at:

OISSwASupportGroup@va.gov).

V&V Secure Code Reviews VA Application Developers open a NSD ticket [(855) NSD HELP] to request VA static code analysis tools; they scan their own application source code; open a NSD ticket to request validation of a final V&V secure code review;

deliver the scan results to the VA SwA Program Office at OISSwASupportGroup@va.gov for review; work with the VA SwA Program Office to schedule the validation; and coordinate with them to resolve any issues identified during validation.

System Owner or delegate is responsible for coordinating the mitigation of deficiencies, documenting the mitigation plans, and uploading them along with the secure code review results to RiskVision under Entity Details: Documents tab.

System Owner or delegate creates one finding and a response in the Findings tab within RiskVision for the

Contact the NSD Help Desk [(855) NSD HELP] to request tools (Fortify), reviews, or technical support

4 O F F I C E O F I N FORMAT I ON S E CUR I T Y

secure code review to serve as a reminder to resolve the deficiencies.

Penetration Test/Application Assessment A full penetration test/application assessment must be performed that includes automated and manual assessment tools and techniques on Internet Facing and/or High Impact Systems.

Actual test results must be provided for analysis.

All Critical and High deficiencies should be mitigated with documented mitigation evidence provided, and Moderate and Low deficiencies should be mitigated or have a documented mitigation plan.

System Owner or delegate contacts CPO at CertificationPMO@va.gov to request penetration test/application assessment from NSOC.

NSOC conducts penetration test/application assessment and provides results to system POCs. Please allow 30 days for NSOC to schedule/conduct the penetration test/application assessment.

System Owner or delegate is responsible for coordinating the mitigation of deficiencies, documenting the mitigation plans, and uploading them along with the test results to RiskVision under Entity Details: Documents tab.

System Owner or delegate creates one finding and a response in the Findings tab within RiskVision for the penetration test/application assessment to serve as a reminder to resolve the deficiencies.

Contact OCS at:

CertificationPMO@va.gov with any questions

Security Control Assessment (SCA) (if applicable) An SCA will be required only upon request from

OCS.

If an SCA is required, all Critical and High POA&Ms should be mitigated with documented mitigation evidence provided, and Moderate and Low POA&Ms should be mitigated or have a documented mitigation plan.

Once notified by OCS that an SCA is required, the appropriate audit team will be notified by OCS to schedule the assessment.

The assigned audit team will conduct the SCA.

OCS will create a SCA program for the appropriate entity in GRC that was audited.

The audit team lead will upload the deliverables, to include the SCA report and import the POAMs, within 4 weeks of completion of the audit.

System Owner or delegate creates responses to the POAMs/findings within 15 days of the POAMs uploaded.

Contact OCS at:

CertificationPMO@va.gov

Security Configuration Compliance Data Compliance data must be obtained for all IP addresses that make up a system and must check against VA approved hardening guidance for all Operating Systems, Databases, Networks, and Security Devices, where guidance exists.

For systems with IP address ranges internal to the VA that have the IBM Endpoint Manager (IEM) agent installed:

System Owner or delegate contacts CPO at CertificationPMO@va.gov to request compliance reports for the IP addresses that make up their system(s).

System Owners/Administrators should input IP address ranges for their system(s) by following the compliance scan ‘Report’ request process on the OIS Portal at

Contact OCS at:

CertificationPMO@va.gov and NSOC, or the Enterprise Visibility Team at:

OISEVSupportGroup@va.go v with any questions Internal Compliance reports location:

5 O F F I C E O F I N FORMAT I ON S E CUR I T Y

Compliance Scan Report Request.

CPO provides directions on how to retrieve the compliance reports for these systems. New compliance reports will be available daily as compliance configuration data changes. System Owners\Administrators will be required to go to this location:

http://dashboard.tic.va.gov/ibmcognos/cgi bin/cognosisapi.dll to pull the compliance reports for their system(s).

System Owner or delegate uploads the Compliance Trending and Checklist Trending reports to the Documents tab in RiskVision. The Compliance Trending and Checklist Trending reports can be found at https://dashboard.tic.va.gov/s/28U/ and https://dashboard.tic.va.gov/s/28T/ respectively.

System Owner or Delegate creates one finding and a response in the Findings tab within RiskVision for the compliance scan to serve as a reminder to resolve the deficiencies.

System Owner or Delegate continues to remediate deficiencies identified from the Compliance Trending and Checklist Trending reports.

System Owner or Delegate uploads new Compliance Trending and Checklist Trending reports to Documents tab within RiskVision as evidence to show the remediation progress.

For systems with IP address ranges external to the VA that do not have the IBM Endpoint Manager (IEM) agent installed:

System Owners or delegate must submit a ‘Supplemental Scan Request’ form found at A&A Home Documents to CPO at CertificationPMO@va.gov. Ensure that the ‘Compliance’ check box is checked.

CPO will submit this form to the NSOC and an NSOC POC will contact the System Owner/Administrator to schedule the compliance scan.

NSOC will submit compliance results/reports to system http://dashboard.tic.va.gov /ibmcognos/cgi bin/cognosisapi.dll OCS preferred template location on the OIS Portal at A&A Home Documents

Supplemental Scan Request form location A&A Home Documents

6 O F F I C E O F I N FORMAT I ON S E CUR I T Y

POCs for compliance scans that are conducted.

System Owner or delegate uploads the Compliance Trending and Checklist Trending reports to the Documents tab in RiskVision. The Compliance Trending and Checklist Trending reports can be found at https://dashboard.tic.va.gov/s/28U/ and https://dashboard.tic.va.gov/s/28T/ respectively.

System Owner or Delegate creates one finding and a response in the Findings tab within RiskVision for the compliance scan to serve as a reminder to resolve the deficiencies.

System Owner or Delegate continues to remediate deficiencies identified from the Compliance Trending and Checklist Trending reports.

System Owner or Delegate uploads new Compliance Trending and Checklist Trending reports to Documents tab within RiskVision as evidence to show the remediation progress.

Requirement Roles / Responsibilities References Security Documentation Requirements

System Security Plan (SSP) The SSP is developed within RiskVision.

All required diagrams and confirmation of the security authorization boundary to include all devices and supporting software architecture should be included.

All controls must be addressed. A finding will need to be created in RiskVision for every control that is not in place.

System Steward completes the assessments in RiskVision and develops findings and responses in the Findings tab for controls not in place.

ISO validates information added by the System Steward in RiskVision.

The ISO, System Owner or delegate/System Steward exports the SSP from RiskVision and uploads the document to the Documents tab in RiskVision.

NIST SP 800 18 and VA Handbook 6500.3 Additional guidance for completion of the SSP can be provided by OCS

Minor Application Self Assessment Minor Application Self Assessment must be completed for all minor applications.

The ISO, Project team, and the SS, working in conjunction should prepare the Minor Application Security Control Summary and provide implementation detail for all applicable security controls and upload the Self Assessment to GSS/MA Documents repository in RiskVision.

Minor Application Self Assessment SOP (Appendix D)

7 O F F I C E O F I N FORMAT I ON S E CUR I T Y

Signatory Authority The Signatory Authority must be signed and dated by the appropriate parties.

System Owner or delegate completes the Signatory Authority using the template provided at A&A Home Documents and uploads the Signatory Authority to RiskVision under Entity Details:

Documents tab.

NIST SP 800 18

Additional guidance for completion of the Signatory Authority can be provided by OCS

Risk Assessment (RA) The RA is developed within RiskVision.

System Steward completes the assessments in RiskVision.

ISO validates information added by the System Steward in RiskVision.

The ISO, System Owner or delegate/System Steward exports the RA from RiskVision and uploads the document to the Documents tab in RiskVision.

NIST SP 800 30

Additional guidance for completion of the RA can be provided by the Office of Risk Management and Incident Reporting

(RMIR)/OCS

Configuration Management Plan (CMP) The CMP should include processes for managing configuration and change management.

The CMP should include infrastructure devices and baseline configurations (e.g., switches, routers, firewalls).

The CMP should include a configuration file for each operating system(s), database(s), application(s), and network device(s) to validate compliance with baseline configuration.

System Owner or delegate completes the CMP using the template provided at A&A Home Documents and uploads the CMP as evidence to RiskVision under Entity Details: Documents tab.

NIST SP 800 70 and VA Handbook 6500 Additional guidance for completion of the CMP can be provided by OCS

Incident Response Plan (IRP) The IRP must be created using RA and SSP.

The IRP must meet the following standards:

Information Access and Privacy Program NIST Special Publication 800 61 Computer Security Incident Handling Guide VA Handbook 6500.3, Certification and Accreditation of Federal Information Systems

Each site is responsible for developing local level procedures incorporating VA NSOC areas of responsibility.

System Owner works with the assigned ISO to create the

IRP.

System Owner or designee uploads the signed IRP into RiskVision once completed and tested.

NIST SP 800 61

Useful tools and websites:

Agiliance RiskVision Enterprise Operations GRC Instance Agiliance RiskVision National Release GRC Instance Office of Cyber Security (OCS) Portal

Information Security Contingency Plan (ISCP) The ISCP must be created using following inputs:

Preliminary Information System Contingency Plan Primary Site System Security Plan

System Owner or delegate develops or revises the Information System Contingency Plan.

System Owner or designee uploads the Information System Contingency Plan into RiskVision.

Additional guidance for completion of the ISCP can be provided by the OBC Useful tools and websites:

8 O F F I C E O F I N FORMAT I ON S E CUR I T Y

Backup Site System Security Plan The ISCP must meet the following standards:

NIST Special Publication 800 34 Rev. 1 Contingency Planning Guide for Federal Information Systems Office of Information Security, Accreditation Requirements Guide Standard Operating Procedures VA Handbook 6500.8, Information System Contingency Planning

Agiliance RiskVision Enterprise Operations GRC Instance Agiliance RiskVision National Release GRC Instance Business Continuity Portal Office of Cyber Security (OCS) Portal Technical Services Project Repository (TSPR)

Disaster Recovery Plan (DRP) The DRP must be created using following inputs:

Primary Site System Security Plan Backup Site System Security Plan

The DRP must meet the following standards:

Office of Information Security, Accreditation Requirements Guide Standard Operating Procedures

System Owner or designee develops the DRP as the entry point for the creation of both the facility and data center plans.

System Owner or designee uploads the DRP into RiskVision once completed and tested.

Additional guidance for completion of the ISCP can be provided by the OBC Useful tools and websites:

Agiliance RiskVision Enterprise Operations GRC Instance Agiliance RiskVision National Release GRC Instance Business Continuity Portal Office of Cyber Security (OCS) Portal

9 O F F I C E O F I N FORMAT I ON S E CUR I T Y

Privacy Impact Assessment (PIA) A complete PIA must have:

A previously completed Privacy Threshold Analysis (PTA).

Been completed in the most up to date and Privacy Services approved template for both the PTA and PIA. The PTA and PIA template can be found at A&A Home Documents

Been completed in coordination with the VA Privacy Services Office.

Been signed by the System Owner, Privacy Officer, and ISO.

Been re submitted whenever there are major changes to the system or within 3 years.

System Owner, Privacy Officer, and ISO work together to submit a PTA, which is reviewed by the Privacy Services Office. After review and determination by analysts, the PTA must be signed by the System Owner, Privacy Officer, ISO, and any other relevant stakeholders and re submitted to the Privacy Services Office via PIASupport@va.gov. If a PIA is required as an outcome of the PTA analysis by the Privacy Services Office, a PIA must be completed and submitted to the Privacy Services Office and then comments by the analysts, if any, must be incorporated.

Privacy Services verifies PIA and provides results.

System Owner or delegate re submits the PIA as a PDF file with the signatures of the System Owner, Privacy Officer, ISO, and any other relevant stakeholders to PIASupport@va.gov.

System Owner or delegate uploads the PIA to RiskVision under Entity Details: Documents tab.

Authority is found in E Government Act of 2002, OMB Circular 03 22, VA Directive 6502, VA Directive 6508, and VA Handbook 6508.1 Additional guidance for completion of the PIA/PTA can be provided by the Privacy Services Office. Any questions may be sent to PIASupport@va.gov

Interconnection Security Agreement (ISA)/ Memorandum of Understanding (MOU) An ISA/MOU must be provided for all external interconnections.

System Owner in coordination with the entities identified in NIST SP 800 47 will complete the ISA/MOU using the latest template provided at: OIS Portal or A&A Home Documents.

ISO will upload all final draft MOU/ISA documents to the MOU/ISA Review Submissions SharePoint site for a review prior to requesting signatures.

VA review team will assess the documents against a checklist for quality and content.

Reviewer and the ISO will work collaboratively to correct deficiencies found in the documentation.

Reviewer will notify the ISO via email informing them that the document is ready for signatures.

ISO will process the document for signature.

ISO will upload the document to the Enterprise Document SharePoint upon receipt of the completed and signed MOU/ISA document,.

The finalized document should also be added to the existing A&A artifacts in RiskVision.

NIST SP 800 47, VA

Handbook 6500, and FSS Bulletin#269 Additional guidance can be provided by the Health Information Security Division at vafsshisd@va.gov or the OIT ERM CRISP Team at Sharon.mcallister@va.gov