17 GSA Control Tailoring Workbook 2023 07 11.xlsx

Instructions

(a) Dark gray - withdrawn controls

(b) Gray - controls not applicable at any FIPS 199 Level or any GSA A&A process

(c) Light Green - controls that are in the Privacy baseline, but not applicable at this time.

(2) Control applicability markings are as follows:

X - control is applicable at the FIPS 199 Level or GSA A&A process in the column heading X* - control is applicable per the GSA Office of the Chief Information Security Officer (OCISO), conditional text may follow the marking X** - control is applicable per the GSA OCISO Tailored Moderate Baseline (also included in High controls if not already selected), conditional text may follow the marking X^ - control is applicable if PII is stored, processed, or transmitted

Conditional applicability information may be included.

E - Privacy Baseline F - FIPS 199 Low Baseline G - FIPS 199 Moderate Baseline H - FIPS 199 High Baseline I - Lightweight Security Authorization Process (LATO) control set J - Moderate Impact Software-as-a-Service (MiSaaS) control set Column K - Vendor/Contractor Defined Values To be used to enter vendor/contractor recommended settings for the NIST security controls/enhancements where the specific parameter/settings is reserved for the system to define (or if the setting differs from the GSA defined value). Cells where information is required (or may be required in a few instances) are highlighted in light yellow.

Column L - GSA Approval of Vendor/Contractor Defined Values To be used by GSA to indicate that the GSA CISO and AO have approved the vendor/contactor recommended setting. Cells where approval must be noted (or may be required in a few instances) are highlighted in light yellow.

GSA Defined Settings

1. [Organization-level] access control policy that:

(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the access control policy and the associated access controls;

b. Designate an [CISO] to manage the development, documentation, and dissemination of the access control policy and procedures; and

c. Review and update the current access control:

1. Policy [annually, as part of CIO 2100.1 update] and following [changes to Federal or GSA policies, requirements, or guidance]; and

b. Assign account managers;

c. Require [GSA SSO or Contractor recommended prerequisites and criteria (based on defined user role(s) matrix in GSA SSPP Template Section 9: Types of Users) as approved by the CISO and AO] for group and role membership;

d. Specify:

1. Authorized users of the system;

2. Group and role membership; and

3. Access authorizations (i.e., privileges) and [the following attributes as defined in the user role(s) matrix in GSA SSPP Template Section 9: Types of Users - Internal or External; Privileged (P), Non-Privileged (NP), or No Logical Access (NLA); Sensitivity Level; Authorized Privileges; Functions Performed; MFA Authentication Method] for each account;

e. Require approvals by [designated account managers as specified in AC-2.b] for requests to create accounts;

f. Create, enable, modify, disable, and remove accounts in accordance with [CIO-IT Security-01-01, Identification and Authentication, CIO-IT Security-01-07, Access Control, and GSA-defined procedures or conditions (as applicable)];

g. Monitor the use of accounts;

h. Notify account managers and [System Owner, System/Network Administrator, and/or ISSO] within:

1. [14 days] when accounts are no longer required;

2. [14 days] when users are terminated or transferred; and

3. [14 days] when system usage or need-to-know changes for an individual;

i. Authorize access to the system based on:

1. A valid access authorization;

2. Intended system usage; and

3. [Role privileges identified in GSA SSP Section 9: Types of Users];

j. Review accounts for compliance with account management requirements [annually];

k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and

(a) Have expired;

(b) Are no longer associated with a user or individual;

(c) Are in violation of organizational policy; or

(b) Monitor privileged role or attribute assignments;

(c) Monitor changes to roles or attributes; and

(a) Is uniformly enforced across the covered subjects and objects within the system;

(b) Specifies that a subject that has been granted access to information is constrained from doing any of the following;

(1) Passing the information to unauthorized subjects or objects;

(2) Granting its privileges to other subjects;

(3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components;

(4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and

(5) Changing the rules governing access control; and

(c) Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints.

NA AC-3(4) Access Enforcement | Discretionary Access Control Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:

(a) Pass the information to any other subjects or objects;

(b) Grant its privileges to other subjects;

(c) Change security attributes on subjects, objects, the system, or the system’s components;

(d) Choose the security attributes to be associated with newly created or revised objects; or

(e) Change the rules governing access control.

(a) The receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls]; and

(b) [Assignment: organization-defined controls] are used to validate the appropriateness of the information designated for release.

(b) Provide an enforcement mechanism to prevent unauthorized access; and

(c) Approve access changes after initial installation of the application.

(b) Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.

(b) [Selection (one or more): Block; Strip; Modify; Quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined security or privacy policy].

application; service; individual] for information transfer.

(a) Content filtering mechanisms successfully complete execution without errors; and

(b) Content filtering actions occur in the correct order and comply with [Assignment: organization-defined policy].

(a) Does not filter message content;

(b) Validates filtering metadata;

(c) Ensures the content associated with the filtering metadata has successfully completed filtering; and

(d) Transfers the content to the destination filter pipeline.

AC-5 Separation of Duties a. Identify and document [GSA SSO or Contractor recommended duties of individuals requiring separation, to be approved by the GSA CISO and AO];

b. Define system access authorizations to support separation of duties.

(a) [GSA SSO or Contractor recommended security functions (deployed in hardware, software, and firmware) approved by the GSA CISO and AO]; and

(b) Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts through use of the alternative factors by a user during a [Assignment: organization-defined time period].

AC-8 System Use Notification a. Display [a system use notification message or banner as defined in GSA Order CIO 2100.1] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:

1. Users are accessing a U.S. Government system;

2. System usage may be monitored, recorded, and subject to audit;

3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and

4. Use of the system indicates consent to monitoring and recording;

b. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and

c. For publicly accessible systems:

1. Display system use information [when accessed via logon interfaces with human users], before granting further access to the publicly accessible system;

2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

(1) 30 minutes of inactivity,

(2) the following timeframes, regardless of user activity:

a. Thirty (30) days for systems at AAL1

b. Ensure that the attribute associations are made and retained with the information;

c. Establish the following permitted security and privacy attributes from the attributes defined in AC-16a for [Assignment: organization-defined systems]: [Assignment: organization-defined security and privacy attributes];

d. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges for established attributes];

e. Audit changes to attributes; and

f. Review [Assignment: organization-defined security and privacy attributes] for applicability [Assignment: organization-defined frequency].

(b) Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information:

(1) Connection of unclassified mobile devices to classified systems is prohibited;

(2) Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official;

(3) Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and

(4) Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by [Assignment: organization-defined security officials], and if classified information is found, the incident handling policy is followed.

(c) Restrict the connection of classified mobile devices to classified systems in accordance with [Assignment: organization-defined security policies].

1. Access the system from external systems; and

2. Process, store, or transmit organization-controlled information using external systems; or

(a) Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or

GSA Additional Guidance: Portable Storage Devices include digital media such as flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs.

b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

c. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and

1. [Organization-level] awareness and training policy that:

(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;

b. Designate an [CISO] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and

c. Review and update the current awareness and training:

1. Policy [annually, as part of CIO 2100.1 update] and following [changes to Federal or GSA policies, requirements, or guidance]; and

1. As part of initial training for new users and [annually] thereafter; and

2. When required by system changes or following [the analysis of security trends, signficant events, and user feedback];

b. Employ the following techniques to increase the security and privacy awareness of system users [by frequent phishing, security vignettes via emails];

c. Update literacy training and awareness content [annually] and following [the analysis of security and privacy trends, signficant events, and user feedbacks]; and