36C25519Q0371-010.docx

Appendix F: Additional Security Information for Air-Gapped MOU For VA Provided Internet Access Section 1.4.1 Security

1.4.1. Security

The parties agree to work together to ensure the security of [Organization 1].

System Security Considerations and Parameters for VA wired and/or wireless public Internet access services.

Complete this section for any wired and/or wireless public Internet access services. These are often paid for by local charitable organizations or by the facility but are not connected to the VA Network. Remove section 1.4.1.1 and 1.4.1.2 if it does not apply.

· Advisory Banner Implementation:

Insert a screen shot of advisory banner. Approved public banners and guidance are located in VA Handbooks 6102 and 6500.

Implementation Guidance

The Information System Owner, local Chief Information Officer (CIO), or designee must select and configure the operating system to display a warning banner screen (or close approximation) at log in, and require users to electronically acknowledge the warning, such as clicking an “OK” or “I agree” button to proceed. Banners can also be posted in the physical location of the network and/or user sign-in sheets.

Banner/User Agreement: See the OIS portal > FSS > Document Library > MOU ISA Templates for banner examples. Edit the examples to best suit the needs of the site.

· Identify Security Solutions and Content Filtering Solutions:

Document security solutions and content filtering solutions used to mitigate risk. Include the identification of the application (Surf Control, etc.) and selected content filtering options. Changes can be made as necessary based upon audit log review results.

· Identify Physical Security Controls:

Document what physical security controls are used to protect the wired and/or wireless Internet public Internet. (Examples are locked doors, CCTV Cameras, or VA Security Points of Contact ((POC(s)) for monitoring user activities. Computers may also be positioned in a location where the site manager may monitor computer activities. Document the location of the Physical security controls in Appendix E.

· Additional Requirements for Domiciliary Settings, Access Control Implementation:

For domiciliary settings, implement user agreements, advisory banners, access controls including user name and password. (This may be implemented as a physical login book)

Audit Trail Responsibilities The information system provides the capability for authorized users to capture/record and log content related to a user session. Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention.

· Security Logging Parameters: Explain what and how the logs are captured and maintained. What information is logged (i.e. access controls, users, duration, search/URL history, and login attempts).

· Audit Log(s) Review: Provide the frequency that the audit log will be reviewed by the VA.

· Audit Log Storage - Log files must be maintained for a one-year period: Identify how and where the audit logs are stored.

The facility may implement these services through existing Internet service provider and the service provider must be able to provide log file as requested for investigation.

Signatories:

[VA Organization 1] System Owner:

[Name of [VA Organization 1] ’s System Owner] [Job Title of [VA Organization 1] ’s System Owner]

X__________________________ Date __________

[VA Organization 1] Business Owner:

[Name of [VA Organization 1] ’s Business Owner] [Job Title of [VA Organization 1] ’s Business Owner]

X__________________________ Date __________ image1.gif