CIO_P_21001I__CHGE_1_GSA_Information_Technology_IT_Security_Policy__Signed_on_10-20-2015.pdf

GENERAL SERVICES ADMINISTRATION

Washington, DC 20405

CIO P 2100.1I CHGE 1

GSA POLICY AND PROCEDURE

SUBJECT: GSA Information Technology (IT) Security Policy

1. Purpose. This Order issues and transmits Handbook (HB), GSA Information Technology Security Policy.

2. Cancellation(s). GSA Order CIO P 2100.1H – GSA Information Technology (IT) Security Policy is hereby cancelled.

3. Nature of revision. This Order provides updates for consistency with federal requirements and program instruction implementation.

4. Applicability. This IT Security Policy applies to all GSA employees, contractors, subcontractors, anyone specified in Memoranda of Understanding (MOUs) or other agreement vehicles, government agencies, individual corporations, other organizations that process or handle GSA-owned information, data, all GSA IT systems, or any GSA data processed on IT systems owned and operated by any of the Services, Staff Offices, and Regions (S/SO/R).

5. Explanation of change paragraph.

a. Chapter 4, section 25, paragraph a changes OERR to Office of Mission Assurance.

b. Chapter 4, section 25, paragraph c changes OERR to OMA.

c. Chapter 4, section 25, addition of paragraph c which allows GSA employees (with the exception of Office of Inspector General employees) who hold a National Security clearance, issuance of loaner devices when traveling outside the United States or European Union, or any area deemed to have an elevated risk during the period of travel.

https://insite.gsa.gov/portal/content/541986 https://insite.gsa.gov/portal/content/541986

6. Signature.

/S/______________________________ October 20, 2014

SONNY HASHMI

Chief Information Officer Office of GSA IT

GENERAL TABLE OF CONTENTS

CHAPTER 1. THE GSA INFORMATION TECHNOLOGY SECURITY PROGRAM

CHAPTER 2. SECURITY ROLES AND RESPONSIBILITIES

CHAPTER 3. POLICY ON MANAGEMENT CONTROLS

CHAPTER 4. POLICY ON OPERATIONAL CONTROLS

CHAPTER 5. POLICY ON TECHNICAL CONTROLS

CHAPTER 1. THE GSA INFORMATION TECHNOLOGY SECURITY PROGRAM

Paragraph Titles

Paragraph Numbers

Introduction………………………………………………………………………………………. 1 Objectives………………………………………………………………………………………... 2 Application……………………………………………………………………………………….. 3 Federal Laws, Regulations, and GSA Policies………………………………………………. 4 Compliance and Deviations……………………………………………………………………. 5 Maintenance…………………………………………………………………………………….. 6 Definition of Information System………………………………………………………………. 7 National Institute of Standards and Technology (NIST) and GSA Guidance Documents 8 Privacy Act Systems……………………………………………………………………………. 9 IT Security Controls…………………………………………………………………………….. 10 Contractor Operations………………………………………………………………………….. 11

CHAPTER 1. THE GSA INFORMATION TECHNOLOGY SECURITY PROGRAM

1. Introduction. The purpose of this Order is to document and set forth the General Services Administration (GSA) Information Technology (IT) Security Policy. This IT Security Policy establishes controls required to comply with Federal Regulations and Laws, thus ensuring adequate protection of GSA IT resources.

2. Objectives. IT Security Policy objectives will enable GSA to meet its mission/business objectives by implementing systems with due consideration of IT-related risks to GSA, its partners, and customers. The security objectives for system resources are to provide assurance of confidentiality, integrity, availability, and accountability, by employing management, operational, and technical security controls as part of risk-based management. An important component of risk-based management is to integrate technical and non-technical security mechanisms into the system to reflect sound risk management practices. All incorporated security mechanisms must be well founded, configured to perform in the most effective manner, and add value to GSA’s IT-related investments. A risk-based management approach will enable the GSA IT Security Program to meet its goals by better securing IT systems, enabling management to justify IT Security expenditures, and by assisting management in authorizing IT systems for processing.

GSA IT Security objectives include the following:

a. Confidentiality. Private or confidential information is not disclosed to un-authorized individuals while in storage, during processing, or in transit.

b. Integrity. Safeguards must ensure that information retains its content integrity. Hardware and software resources of the system must operate according to requirements and design documents. Un-authorized personnel must not be able to create, alter, copy, or delete data processed, stored, or handled by the system. System information and application software is considered “official” and trusted to be complete and accurate as the basis for payment actions.

c. Availability. The system works promptly and service is not denied to authorized users. Systems and data are available for intended use only. The system must be ready for use by authorized users when needed to perform his/her duties.

d. Accountability. Accountability must be to the individual level. Only personnel with proper authorization and need-to-know must be allowed access to data processed, handled, or stored on IT system components.

e. Assurance. Confidence that the other four security objectives have been met. The security measures, including: technical, managerial, and operational, work as intended to protect the system and the information it processes. This is accomplished through monitoring and review of controls.

This Order supports GSA's IT Security Program objectives by identifying roles and assigning responsibilities in support of GSA’s IT Security Program. In addition, the order defines comprehensive and integrated security requirements that are necessary to obtain management authorization (accreditation) to allow GSA IT systems to operate within an acceptable level of security risk.

3. Applicability. This IT Security Policy applies to:

a. All GSA employees.

b. Contractors, subcontractors, as specified in Memorandum of Understanding (MOUs) or other agreement vehicles, government agencies, individuals, corporations, or other organizations that process or handle any GSA-owned information, data, or IT system equipment.

4. Federal laws, regulations, and GSA policies. The primary focus of this policy is to support the implementation of the following Federal Regulations and the latest versions of the following GSA directives:

a. Federal Information Security Management Act (FISMA) of 2002.

b. Clinger-Cohen Act of 1996 also known as the “Information Technology Management Reform Act of 1996.”

c. Federal Financial Management Improvement Act of 1996 (FFMIA); OMB Implementation Guidance for the FFMIA.

d. Paperwork Reduction Act (PRA) of 1995 (Public Law 104-13).

e. Federal Managers Financial Integrity Act (FMFIA) (Public Law 97-255).

f. Government Paperwork Elimination Act (GPEA) (Public Law 105-277).

g. Privacy Act of 1974 (5 U.S.C. § 552a).

h. Homeland Security Presidential Directive (HSPD-20), “National Continuity Policy.”

i. Homeland Security Presidential Directive (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors.”

j. Homeland Security Presidential Directive (HSPD-7), “Critical Infrastructure Identification, Prioritization, and Protection.”

k. Office of Management and Budget (OMB) Circular A-130, “Management of Federal Information Resources,” and Appendix III, “Security of Federal Automated Information Systems as amended.”

l. GSA Order 9297.2, “GSA Information Breach Notification Policy.”

m. GSA Order CIO 2110.2, “GSA Enterprise Architecture Policy.”

http://csrc.nist.gov/groups/SMA/fisma/overview.html http://www.gsa.gov/graphics/staffoffices/Clinger.htm http://www.whitehouse.gov/omb/financial_ffs_ffmia http://www.archives.gov/federal-register/laws/paperwork-reduction/ http://www.whitehouse.gov/omb/financial_fmfia1982 http://www.whitehouse.gov/omb/fedreg_gpea2 http://www.justice.gov/opcl/privstat.htm http://www.fema.gov/guidance-directives#1 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-7 http://www.whitehouse.gov/omb/circulars_a130 https://insite.gsa.gov/portal/content/520570 https://insite.gsa.gov/portal/content/521898

n. GSA Order CIO 2135.2, “GSA Information Technology (IT) Capital Planning and Investment Control.”

o. GSA Order CIO P 2181.1 “GSA HSPD-12 Personal Identity Verification and Credentialing Handbook.”

p. GSA Order ADM 7800.11, “Personal Use of Agency Office Equipment,”

q. GSA Order 2100.2A, “GSA Wireless LAN Security.”

r. GSA Order CIO P 2140.3 “Systems Development Life Cycle (SDLC) Policy.”

s. GSA Order CIO P 2165.1, “GSA Internal Telecommunications Management.”

t. GSA Order CIO 2160.2 “GSA Electronic Messaging and Related Services.”

u. GSA Order CIO 2104.1, “GSA Information Technology (IT) General Rules of Behavior.”

v. GSA Order CPO 1878.1, “GSA Privacy Act Program.”

w. GSA Order ADM P 9732.1 “Suitability and Personnel Security”

x. GSA Order CIO P 2182.2 “Mandatory Use of Personal Identity Verification (PIV) Credentials”

y. Digital Government “A Toolkit to Support Federal Agencies Implementing Bring Your Own Device (BYOD) Programs” August 23, 2012

Additional guidance can be found in the series of CIO-IT Security Procedural Guides. The guides provide more detailed information on how to implement security processes and controls and provide worksheets and forms to meet reporting requirements. The guides are updated as needed to reflect the latest regulations and technologies. A current list of government-wide security guidance is located at http://csrc.nist.gov.

5. Compliance and deviations. Compliance is mandatory. This IT Security Policy requires all GSA

Services, Staff Offices, Regions (S/SO/R), Federal employees, and authorized users of GSA's IT resources to comply with the security requirements outlined in this Policy. This policy must be properly implemented, enforced, and followed to effectively protect GSA's IT resources and data. Appropriate disciplinary actions must be taken in a timely manner in situations where individuals and/or systems are found non-compliant. Violations of GSA IT Security Policy may result in penalties under criminal and civil statutes and laws.

All deviations from this Order must be approved by the appropriate Authorizing Official with a copy of the approval forwarded to the GSA Senior Agency Information Security Officer (SAISO) in the Office of the Chief Information Officer (OCIO).

6. Maintenance. The GSA Office of the Chief Information Officer (OCIO) will review this policy annually and revise it to:

a. Reflect any changes in Federal Laws and Regulations;

b. Satisfy additional business requirements;

c. Encompass new technology;

d. Adopt new government IT standards.

7. Definition of information system. The term information system as defined in this document shall include major applications and general support systems as defined in OMB A-130. Major Applications shall include those information systems with an Exhibit 300 (also referred to as Major Programs) and any Exhibit 53 information systems that are not specifically covered in a general support system security plan.

In addition, any IT system that stores privacy act data that is not specifically covered in a general support system shall be considered its own information system.

https://insite.gsa.gov/portal/content/519386 https://insite.gsa.gov/portal/content/523110 https://insite.gsa.gov/portal/content/520142 https://insite.gsa.gov/portal/content/521574 https://insite.gsa.gov/portal/content/522478 https://insite.gsa.gov/portal/content/522330 https://insite.gsa.gov/portal/content/520818 https://insite.gsa.gov/portal/content/533042 https://insite.gsa.gov/portal/content/519678 https://insite.gsa.gov/portal/content/520918 https://insite.gsa.gov/portal/content/590890 http://www.whitehouse.gov/digitalgov/bring-your-own-device https://insite.gsa.gov/portal/content/627230

Smaller information systems (minor applications) may be coalesced together as subsystems of a single larger, more comprehensive system for the purposes of security authorization. Subsystems must be under the same management authority, have the same function or mission objective, the same operating characteristics and information security needs, and reside in the same general operating environment(s).

8. NIST and GSA guidance documents. All policies shall be implemented using the appropriate special publications from NIST and/or GSA procedural guides to the greatest extent possible. Where there is a conflict between NIST guidance and GSA guidance, contact the GSA Office of the Senior Agency Information Security Officer. Where there are no procedural guides, use industry best practices. Federal Information Processing Standards (FIPS) publication requirements are mandatory for use at GSA.

There are no waivers. NIST special publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

9. Privacy act systems. In addition to the security requirements in this order, systems that contain privacy act data must implement the additional security controls as defined in GSA Order CPO 1878.1

“Privacy Act Program” under “Information Security.”

10. IT security controls. All IT systems, including those operated by a contractor on behalf of the government, must implement proper security controls according to their security categorization level in accordance with FIPS Publication 200, “Minimum Security Requirements for Federal Information and Information Systems,” the current version of NIST SP 800-53, “Recommended Security Controls for Federal Information Systems,” and FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems.”

11. Contractor Operations. GSA system program managers and contracting officers shall ensure that the appropriate security requirements of this order are included in task orders and contracts for all IT systems designed, developed, implemented, and operated by a contractor on behalf of the government, including systems operating in a Cloud Computing environment including but not limited to Software as a Service (SaaS). In addition, the government shall ensure that the contract allows the government or their designated representative (i.e. third party contractor) to review, monitor, test, and evaluate the proper implementation, operation, and maintenance of the security controls. This includes, but is not limited to:

documentation review, server configuration review, vulnerability scanning, physical data center reviews, and operational process reviews. Contracts and task orders for Information Systems Security Managers (ISSM) and Information Systems Security Officers (ISSO) services in support of GSA systems must include performance goals and requirements for the ISSM and ISSO services. Additional information may be found in IT Security Procedural Guide: Security Language for IT Acquisition Efforts, OCIO-IT Security- 09-48, and GSAM 539-7002-clause 552-239-70 and 552-23971.

CHAPTER 2. SECURITY ROLES AND RESPONSIBILITIES

Paragraph Titles

Paragraph Numbers

GSA Administrator…………………………………………………………………………………….. 1 GSA Chief Information Officer (CIO)………………………………………………………………... 2 Chief Financial Officer (CFO)………………………………………………………………………... 3 GSA Senior Official for Privacy…………………………………….. 4 Senior Agency Information Security Officer (SAISO)……………………………………………... 5 Heads of Services and Staff Offices (HSSOs)…………………………………………………..… 6 Authorizing Official (AO) ……………………….. 7 Services, Staff Offices, or Regions (S/SO/R) Information Systems Security Manager (ISSM) 8 Information Systems Security Officer (ISSO)……………………………………………………… 9 http://csrc.nist.gov/publications/PubsFIPS.html http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf https://insite.gsa.gov/graphics/staffoffices/securitylang.doc http://www.acquisition.gov/gsam/gsam.html

System Owners (aka. System Program Managers/Project Managers/CIO IT Managers)…… 10 Data Owners (aka. Functional Business Line Managers)……………………………………….. 11 Acquisitions/ Contracting (Contracting Officers/Contracting Officers Technical Representative)………………………………………………………………………………………..

Custodians…………………………………………………………………………………………….. 13 Users of IT Resources……………………………………………………………………………….. 14 Inspector General (IG)……………………………………………………………………………….. 15 GSA Personnel Security Officer…………………………………………………………………… 16 System/Network Administrators……………………………………………………………………... 17 Supervisors……………………………………………………………………………………………………….. 18

CHAPTER 2. SECURITY ROLES AND RESPONSIBILITIES

The roles and responsibilities described in the paragraphs below are assigned to the offices and positions identified to ensure effective implementation and management of GSA’s IT Security Program. The establishment of a security management structure and assigning of security responsibilities is a requirement of the Federal Information Security Management Act (FISMA).

1. GSA administrator. The Clinger-Cohen Act assigns the responsibility for ensuring “that the information security policies, procedures, and practices of the executive agency are adequate.” FISMA provides the following details on agency head responsibilities for information security:

a. Providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of an agency, and on information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.

b. Ensuring that an information security program is developed, documented, and implemented to provide security for all systems, networks, and data that support the operations of the organization.

c. Ensuring that information security processes are integrated with strategic and operational planning processes to secure the organization’s mission.

d. Ensuring that senior agency officials within the organization are given the necessary authority to secure the operations and assets under their control.

e. Designating a CIO and delegating authority to that individual to ensure compliance with applicable information security requirements.

f. Ensuring that the agency has trained personnel to support compliance with information security policies, processes, standards, and guidelines.

g. Ensuring that the CIO, in coordination with the other senior agency officials, reports annually to the agency head on the effectiveness of the agency information security program, including the progress of remedial actions.

2. GSA chief information officer (CIO). Mandated by the Clinger-Cohen Act of 1996 and FISMA, the

GSA Chief Information Officer (CIO) has overall responsibility for the GSA IT Security Program.

Responsibilities include:

a. Developing and maintaining an agency-wide GSA IT Security Program.

b. Ensuring the agency effectively implements and maintains information security policies and guidelines.

c. Providing guidance, advice, and assistance to the Heads of Services and Staff Offices (HSSOs), and Regional Administrators (RAs) on implementing GSA’s IT Security Policy.

d. Providing management processes to enable the Authorizing Official to implement the components of the IT Security Program for which they are responsible.

e. Ensuring information assurance and the protection of GSA's cyber-based critical infrastructure.

f. Designating a Senior Agency Information Security Officer (SAISO) to assist in carrying out the GSA CIO’s agency-wide IT security responsibilities.

g. Establishing reporting requirements within GSA to assess GSA’s IT security posture, verifying compliance with Federal requirements and approved policies, and identifying agency-wide IT security needs.

h. Conducting independent activities and compliance reviews including oversight of GSA’s Assessment and Authorization (A&A) process.

i. Coordinating and reporting on HSPD-7 critical assets.

j. Reporting annually, in coordination with the other senior agency officials, to the GSA Administrator on the effectiveness of the agency information security program, including progress of remedial actions.

k. Reviewing Privacy Impact Assessments prepared by GSA organizations for security considerations.

l. Ensuring Privacy Impact Assessments are part of GSA’s System Development Life Cycle Guidance for Information Technology.

m. Providing guidance or input for periodic assessments of S/SO/R security measures and goals to assure implementation of GSA policy and procedures.

3. GSA chief financial officer (CFO). The GSA Chief Financial Officer (CFO) also has major statutory security responsibilities under the CFO Act of 1990 and the Clinger-Cohen Act of 1996. Responsibilities include:

a. Ensuring the sufficiency of management and information security controls pertaining to GSA's financial management systems and compliance with FMFIA and FFMIA requirements.

b. Supporting the GSA IT Capital Planning Process. To achieve satisfactory assurance levels of information security for the financial systems of GSA, close cooperation between the offices of the CFO and the CIO is necessary, including supporting the GSA IT Capital Planning process.

c. Reporting financial management information to OMB as part of the President’s budget.

d. Complying with legislative and OMB-defined responsibilities as they relate to IT capital investments.

4. GSA senior agency official for privacy. The GSA Senior Agency Official for Privacy has major statutory responsibilities under the Privacy Act of 1974, GSA Order CPO1878.1 “GSA Privacy Act Program,” and the Consolidated Appropriations Act of 2005. Responsibilities include:

a. Establishing and overseeing the Privacy Act Program in GSA.

b. Ensuring GSA’s compliance with privacy laws, regulations and GSA policy in collaboration with the

GSA CIO.

c. Ensuring Privacy Impact Assessments (PIAs) are conducted for electronic information systems and collections and coordinating submission of all GSA Privacy Analysis Worksheets and PIA Summaries to

OMB.

d. Developing, implementing, and overseeing personnel security controls for access to personally identifiable information.

e. Encouraging awareness of potential privacy issues and policies.

http://govinfo.library.unt.edu/npr/library/misc/cfo.html http://www.gpo.gov/fdsys/pkg/PLAW-108publ447/html/PLAW-108publ447.htm

f. Directing the planning and implementation of the GSA Privacy Program to ensure agency personnel, including contractors, receive appropriate privacy awareness training.

g. Signing GSA Privacy Act notices for publication for public comment in the Federal Register.

h. Reporting to OMB and Congress on the establishment or revision of Privacy Act systems.

i. Reporting periodically to OMB on GSA Privacy Act activities, as required by law and OMB information requests.

j. Policy making role in GSA’s development and evaluation of legislative, regulatory and other policy proposals which implicate information privacy issues.

k. Chairing the GSA Data Integrity Board that reviews and approves GSA's Computer Matching Program.

5. Senior agency information security officer (SAISO). The Federal Information Security Management Act (FISMA) establishes the designation of a Senior Agency Information Security Officer (SAISO). The SAISO is the focal point for all GSA IT security and must ensure that the security requirements described in this Order are implemented agency-wide. The SAISO reports directly to the CIO as required by FISMA. Responsibilities include:

a. Reporting to the GSA CIO on the implementation and maintenance of the GSA's IT Security Program and Security Policies.

b. Assisting in the oversight of GSA’s IT Security Program and Security Policies.

c. Reporting to the GSA CIO on activities and trends that may affect the security of systems and applications assigned to GSA.

d. Implementing and overseeing GSA's IT Security Program by developing and publishing IT Security Procedural Guides that are consistent with this policy.

e. Ensuring that written agreements assign security-related functions and identify security responsibilities of each S/SO/R or activity when two or more activities use the same IT.

f. Providing guidance and advice to all S/SO/R on IT security issues.

g. Assisting S/SO/R in implementing the IT Security Program and Security Policies when requested.

h. Reporting to management on policy compliance.

i. Directing the planning and implementation of the GSA IT Security Awareness Training Program to ensure agency personnel, including contractors, receive appropriate information security awareness training.

j. Managing the CIO Office of the SAISO which implements the GSA IT Security Program as defined in chapter 1 of this order.

k. Establishing reporting deadlines for IT Security related issues requiring an agency response affecting the GSA IT Security Program.

l. Performing information security duties as the primary duty.

m. Periodically assessing risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency.

n. Periodically testing and evaluating the effectiveness of information security policies, procedures, and practices.

https://www.federalregister.gov/

o. Establishing and maintaining a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency.

p. Developing and implementing procedures for detecting, reporting, and responding to security incidents.

q. Ensuring preparation and maintenance of plans and procedures to provide continuity of operations for information systems that support the operations and assets of GSA.

r. Supporting the GSA CIO in annual reporting to the GSA Administrator on the effectiveness of the agency information security program, including progress of remedial actions.

s. Developing and implementing IT security performance metrics to evaluate the effectiveness of technical and nontechnical safeguards used to protect GSA information and information systems.

t. Assessing S/SO/R security measures and goals periodically to assure implementation of GSA policy and procedures.

u. Concurring ISSM and ISSO appointments.

v. Administering FISMA requirements and coordinating GSA’s annual FISMA security program review and Plan of Action and Milestones (POA&M) implementation.

6. Heads of services and staff offices (HSSOs). The Heads of Services and Staff Offices (HSSOs) are responsible for authorizing the operation of all systems, networks, and applications for which they have responsibility. They may delegate some of their authority, (i.e., the role of Authorizing Official in writing), to appropriately qualified individuals within their organizations (usually, their respective Chief Information Officers).

a. Ensuring that the systems of records under their jurisdiction meet the requirements of the Privacy Act and GSA privacy policies and procedures.

b. Ensuring that contractors performing services associated with systems of records (such as system development, maintenance, or operation) are subject to the provisions of the Privacy Act and security requirements.

c. Tracking the measures and goals described in Chapter 3, Paragraph 9 (Performance Measures) of this policy and ensuring that AOs, ISSMs, and ISSOs support these measures.

7. Authorizing official (AO). The Authorizing Official (AO) is the federal government management official with the responsibility to identify the level of acceptable risk for an IT system or application and to determine whether the acceptable level of risk has been obtained. Final authority to operate or not operate the system rests with the AO. An AO must be assigned to every information system.

Responsibilities include:

a. Ensuring effective implementation of GSA’s IT Security Policy.

b. Reviewing and approving security safeguards of information systems and issuing accreditation statements for each information system under their jurisdiction based on the acceptability of the security safeguards of the system (risk-management approach).

c. Ensuring that an Interim Approval To Operate (IATO) is granted only if the necessary security enhancements to bring the system to the acceptable level of risk have been identified and a formal plan of action and milestones has been developed. Per Chapter 3, Paragraph 5, sub-section d of this policy, an IATO can be issued for no longer than twelve (12) months, but does not count towards a system being certified and accredited per OMB direction.

d. Appointing an Information System Security Manager (ISSM), in writing, maintaining a record of this appointment, and providing an update to the SAISO when there are any changes.

e. Appointing an Information Systems Security Officer (ISSO) for each information system, in writing and with the concurrence of the SAISO, maintaining a record of this appointment designation, and providing an update to the SAISO when there are changes in responsibilities.

f. Ensuring Information Assurance is included in management planning, programming budgets, and the IT Capital Planning process.

g. Requiring written notification of point(s) of contacts within other Federal agencies or outside organizations that manage GSA systems.

h. Ensuring that the ISSM and ISSO receive applicable training to carry out their duties.

i. Ensuring that IT systems that handle privacy data meet the privacy and security requirements of the Privacy Act and IT information security laws and regulations.

j. Reviewing and approving Privacy Impact Assessments (PIAs) for their organizations.

k. Supporting the security measures and goals described in Chapter 3, Paragraph 9 (Performance Measures) of this policy.

l. Ensuring all incidents involving data breaches which could result in identity theft are coordinated through the GSA OCIO Office of the Senior Agency Information Security Officer (OSAISO) and the GSA Management Incident Response Team (MIRT) using the GSA breach notification plan per OMB Memorandum M-07-16, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information” and IT Security Procedural Guide: Incident Response (IR), CIO-IT Security-01-02.

m. Ensuring contingency and continuity of support plans are developed and tested annually in accordance with Office of Management and Budget (OMB) Circular No. A-130, NIST SP 800-34, “Contingency Planning Guide for Information Technology Systems, and IT Security Procedural Guide:

Contingency Planning, OCIO-IT Security-06-29.

n. Implementing detailed separation of duties policies for IT systems based on the specific processes, roles, permissions, and responsibilities of personnel involved in GSA business operations.

o. Establishing physical and logical access controls to enforce separation of duties policy and alignment with organizational and individual job responsibilities.

p. Ensuring access to systems by members of the GSA Office of Inspector General as described in paragraph 15 of this chapter.

8. Services, staff offices, or regions (S/SO/R) information systems security manager (ISSM). The

Information Systems Security Manager (ISSM) is responsible to the Authorizing Official for ensuring that security is implemented. There is at least one ISSM per Authorizing Official. The ISSM is the focal point for all IT system security matters for the systems under their authority. The ISSM is appointed in writing by the AO and concurred by the SAISO. An individual appointed as ISSM for a system cannot also be assigned as the ISSO for the same system. A current list of ISSMs is located on InSite.. Responsibilities include:

a. Providing guidance to the ISSOs in their organization.

b. Assisting the AO in appointing ISSOs.

c. Verifying annually the list of ISSOs and providing an updated designation letter to the SAISO when changes occur or designations expire.

d. Ensuring accreditation support documentation is developed and maintained.

e. Reviewing and coordinating reporting of Security Advisory Alerts (SAA), compliance reviews, security training, incident reports, contingency plan testing, and other IT security program issues.

http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf https://insite.gsa.gov/graphics/staffoffices/irguide.doc http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf https://insite.gsa.gov/graphics/staffoffices/cpguide.doc http://insite.gsa.gov/portal/content/511638

f. Managing system certifications, signing certification statements, and forwarding them to the Authorizing Official.

g. Forwarding to the SAISO copies of accreditation statements once they have been signed by the Authorizing Official.

h. Supporting the security measures and goals described in Chapter 3, Paragraph 9 (Performance Measures) of this policy.

i. Complying with GSA training requirements for individuals with significant security responsibilities.

9. Information systems security officer (ISSO). The Information Systems Security Officer (ISSO) is the focal point for ensuring implementation of adequate system security in order to prevent, detect, and recover from security breaches. An ISSO must be assigned for every information system. An ISSO may have responsibility for more than one system, provided there is no conflict. An individual assigned as the ISSO cannot also be the ISSM for the same system. The ISSO is appointed in writing by the AO and concurred in by the SAISO. The ISSO must be knowledgeable of the information and processes supported by the system. A current list of ISSOs is located on InSite. Responsibilities include:

a. Ensuring the system is operated, used, maintained, and disposed of in accordance with documented security policies and procedures. Necessary security controls should be in place and operating as intended.

b. Advising System Owners of risks to their systems and obtaining assistance from the ISSM, if necessary, in assessing risk.

c. Assisting System Owners in completing and maintaining the appropriate security documentation including the system security plan.

d. Assisting the Authorizing Official in the system assessment and authorization (process) and creating and maintaining authorization documentation. The ISSO will assist the System Owner to develop and update the system security plan, manage and control changes to the system, and assess the security impact of those changes.

e. Assisting the Authorizing Official, Data Owner and Contracting Officer / Contracting Officer Technical Representative in ensuring users have the required background investigations, the required authorization and need-to-know, and are familiar with internal security practices before access is granted to the system.

f. Promoting information security awareness.

g. Identifying, reporting and responding to security incidents.

h. Reviewing Security Advisory Alerts on vulnerabilities.

i. Administering the user identification and authentication scheme used in the system.

j. Ensuring media handling procedures are followed.

k. Reviewing system security audit trails and system security documentation to ensure security measures are implemented effectively.

l. Evaluating known vulnerabilities to ascertain if additional safeguards are needed; ensuring systems are patched, and security hardened.

m. Beginning protective or corrective measures if a security breach occurs.

n. Assisting in the development and maintenance of contingency plan and contingency plan test report documentation.

o. Supporting the security measures and goals described in Chapter 3, Paragraph 9 (Performance Measures) of this policy.

p. Complying with GSA training requirements for individuals with significant security responsibilities.

q. Ensuring Privacy Impact Assessments (PIAs) are completed for IT systems that are new, under development, or undergoing major modifications which impact Privacy Act data.

r. Working with the ISSM and System Owners to develop, implement, and manage POA&Ms for assigned systems in accordance with IT Security Procedural Guide: Plan of Action and Milestones (POA&M), OCIO-IT Security-09-44.

s. Reviewing system role assignments to validate compliance with principles of least privilege.

10. System owners (a.k.a. system program managers/project managers). System Owners are management officials within GSA who bear the responsibility for the acquisition, development, maintenance, implementation, and operation of GSA's IT systems. System Owners represent the interests of the system throughout its lifecycle. Primary responsibility for managing risk should rest with the System Owners. Responsibilities include:

a. Ensuring their systems and the data each system processes have necessary security controls in place and are operating as intended and protected in accordance with GSA regulations and any additional guidelines established by the ISSO or ISSM.

b. Obtaining the security resources for their respective systems.

c. Developing and implementing a configuration management plan for their respective systems.

d. Using the advice of the ISSM and ISSO along with the approval of the Authorizing Official, selecting the mix of controls, technologies, and procedures that best fit the risk profile of the system.

e. Participating in activities related to the assessment and authorization of the system to include security planning, risk assessments, security and incident response testing, and contingency planning.

f. Defining and scheduling software patches.

g. Ensuring IT security requirements are included in IT contracts or contracts including IT.

h. Ensuring implementation of privacy requirements for their system of records.

i. Conducting PIAs on all systems to ascertain whether the system collects information on individuals or when new systems are developed, acquired, or purchased.

j. Developing, implementing and maintaining an approved IT Contingency Plan which includes an acceptable Business Impact Analysis (BIA).

k. Ensuring that information and system categorization has been established for their systems and data in accordance with FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems.”

l. Conducting annual reviews and validations of system users’ accounts to ensure the continued need for access to a system and verify users’ authorizations (rights/privileges).

m. Ensuring that for each information system, security is planned, documented, and integrated into the system development life cycle (SDLC) from the information system’s initiation phase to the system’s disposal phase.

n. Reviewing the security controls for their systems and networks annually as part of the FISMA review, when significant changes are made to the system and network and at least every three years or via continuous monitoring based on continuous monitoring plans reviewed and accepted by the GSA

SAISO.

o. Defining, implementing, and enforcing detailed separation of duties by ensuring that single individuals do not have control of the entirety of a critical process, roles, permissions, and/or responsibilities.

p. Ensuring that physical or environmental security requirements are implemented for facilities and equipment used for processing, transmitting, or storing sensitive information based on the level of risk.

q. Obtaining written authorization from the Authorizing Official prior to connecting with other systems and/or sharing sensitive data/information.

r. Developing and maintaining the system security plan and ensuring that the system is deployed and operated according to the agreed-upon security requirements.

s. Ensuring that system users and support personnel receive the requisite security training (e.g., instruction in rules of behavior) and assisting in the identification, implementation, and assessment of the common security controls.

t. Supporting the security measures and goals described in Chapter 3, Paragraph 9 (Performance Measures) of this policy.

u. Complying with GSA training requirements for individuals with significant security responsibilities.

v. Integrating and explicitly identifying security funding for information systems and programs into IT investment and budgeting plans.

w. Working with program officials and the system developer on the system’s privacy issues, preparing a PIA report, obtaining the Program Manager’s approval of the PIA report, and submitting the PIA report to the GSA Personnel security Officer and OCIO officials for review and approval.

x. Coordinating with IT security personnel including the ISSM and ISSO and Data Owners to ensure implementation of system and data security requirements.

y. Working with the ISSO and ISSM to develop, implement, and manage POA&Ms for their respective systems in accordance with IT Security Procedural Guide: Plan of Action and Milestones (POA&M), OCIO-IT Security-09-44.

z. Ensuring proper separation of duties for GSA IT system maintenance, management, and development processes.

aa. Conducting annual assessments to review the effectiveness of control techniques, with an emphasis on activities that cannot be controlled through logical, physical, or compensating controls. The reviews determine whether in-place control techniques are maintaining risks within acceptable levels (e.g., periodic risk assessments).

bb. Working with the Data Owner, granting access to the information system based on a valid need-to-know/need-to-share that is determined during the account authorization process and the intended system usage.

cc. Working with Data Owners with assistance from the ISSO, will ensure system access is restricted to authorized users that have completed required background investigations, are familiar with internal security practices, and have completed requisite training programs, such as the annual Privacy Act training curriculum. System access authorizations must enforce job function alignment, separation of duties, and be based on the principle of need-to-know.

dd. Working with Data Owners to ensure the appropriate level of auditing and logging data is enabled and generated to support monitoring activities.

ee. Working with Data Owners to ensure that log data is archived for a period of not less than 180 days.

ff. Working with Data Owners to audit user activity for indications of fraud, misconduct, or other irregularities.

gg. Working with Data Owners to document all phases of monitoring activity including monitoring procedures, response processes, and steps performed when reviewing user activity.

11. Data owners (a.k.a. functional business line managers). The Data Owner/Functional Business Line

Manager owns the information but not the system application or platform on which the information is processed. Responsibilities include:

a. Determining the security categorization of systems based upon the FIPS Publication 199 levels and ensuring that system owners are aware of the sensitivity of data to be handled.

b. Coordinating with System Owners, ISSMs, ISSOs, and Custodians to ensure the data is properly stored, maintained, and protected.

c. Working with the System Owner, with assistance from the ISSO, to ensure system access is restricted to authorized users that have completed required background investigations, are familiar with internal security practices, and have completed requisite training programs (such as the annual Privacy Act training curriculum. System access authorizations must enforce job function alignment, separation of duties, and be based on the principle of need-to-know/need-to-share that is determined during the account authorization process and the intended system usage.

d. Reviewing access authorization listings and determining whether they remain appropriate at least annually.

e. Ensuring protection of GSA's systems and data in accordance with GSA's IT Security Policy.

f. Ensuring that data is not processed on a system with security controls that are not commensurate with the sensitivity of the data.

g. Assisting in identifying and assessing the common security controls where the information resides.

h. Ensuring information systems that allow authentication of users for the purpose of conducting government business electronically (accessed via the Internet or via other external non-agency controlled networks, such as partner Virtual Private Networks (VPN)) complete an e-authentication risk assessment resulting in an authentication assurance level classification in accordance with OMB Memorandum M-04- 04, “E-Authentication Guidance for Federal Agencies.”

i. Coordinating with IT security personnel including the ISSM and ISSO and System Owners to ensure implementation of system and data security requirements.

j. Working with the System Owner to ensure the appropriate level of auditing and logging data is enabled and generated to support monitoring activities.

k. Working with the System Owner to ensure that log data is archived for a period of not less than 180 days.

l. Working with the System Owner to audit user activity for indications of fraud, misconduct, or other irregularities.

m. Working with the System Owner to document all phases of monitoring activity including monitoring procedures, response processes, and steps performed when reviewing user activity.

12. Acquisitions/contracting (contracting officers [CO]/contracting officer’s representative [CORs]). The

Acquisitions/Contracting function is responsible for managing contracts and overseeing their implementation. For additional information refer to GSAM 539-7002 clauses 552.239 and 552.239-71.

Personnel executing this function have the following responsibilities in regards to information security:

a. Collaborating with the SAISO or other appropriate official to ensure that the agency’s contracting policies adequately address the agency’s information security requirements.

b. Coordinating with the SAISO or other appropriate official as required ensuring that all agency contracts and procurements are compliant with the agency’s information security policy.

c. Ensuring that all personnel with responsibilities in the agency’s procurement process are properly trained in information security.

http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-04.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-04.pdf

d. Working with the SAISO to facilitate the monitoring of contract performance for compliance with the agency’s information security policy.

e. Identifying and initiating contractor background investigations in collaboration with the GSA Personnel Security Officer.

f. Ensuring contracts and task orders for ISSM and ISSO services include performance requirements that can be measured.

g. Ensuring that all IT acquisitions include the appropriate security requirements in each contract and task order.

h. Ensuring that the appropriate security contracting language is incorporated in each contract and task order.

i. Maintaining the integrity and quality of the proposal evaluation, negotiation, and source selection processes while ensuring that all terms and conditions of the contract are met.

j. Ensuring new solicitations include the language below from OMB Memorandum M-07-18, “Ensuring New Acquisitions Include Common Security Configurations.”

(1) “The provider of information technology shall certify applications are fully functional and operate correctly as intended on fully patched systems using the United States Government Configuration Baseline (USGCB).This includes the current version of Internet Explorer used by GSA, configured to operate on all currently supported versions of Windows. All installed applications (such as, but not limited to, Java, Adobe Reader and Adobe Flash) are also expected to be patched. For the Windows and Internet Explorer USGCB settings, see: http://usgcb.nist.gov/usgcb/microsoft_content.html.”

(2) “The standard installation; operation; maintenance; update; and/or patching of software shall not alter the configuration settings from the approved USGB configuration. The information technology should also use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall.”

(3) “Applications designed for normal end users shall run in the standard user context without elevated system administration privileges."

k. Ensuring all GSA contracts, Request for Proposals (RFP), and Request for Quotes (RFQ) involving Privacy Act information adhere to the Federal Acquisition Regulations (FAR) Privacy Act provisions (Subparts 24.1) and include the specified contract clauses (Parts 52.224-1 and 52.224-2), as appropriate, to ensure that personal information by contractors who work on GSA-owned systems of records and the system data are protected as mandated. In addition, COs and CORs shall review the statements of work to ensure IT security controls are put on contract consistent with the current version of NIST SP 800-53, “Recommended Security Controls for Federal Information Systems,” for their FIPS 199 Impact Level.

l. Ensuring industry and government information technology providers use Security Content Automation Protocol (SCAP) validated tools with USGB Scanner capability to certify their products operate correctly with USGB configurations and do not alter USGB settings.

m. Ensuring new solicitations where the information system is contractor owned and operated on behalf of GSA or the Federal Government (when GSA is the managing agency) includes the security contract language from IT Security Procedural Guide: Security Language for IT Acquisition Efforts, OCIO- IT Security-09-48.

13. Custodians. Custodians own the hardware platforms and equipment on which the data is processed.

They are the individuals in physical or logical possession…