Attachment_1_CIO_21001L_GSA_Information_Techn_(IT)_Security_Policy.pdf

GENERAL SERVICES ADMINISTRATION

Washington, DC 20405

CIO 2100.1L

January 14, 2019

GSA ORDER

SUBJECT: GSA Information Technology (IT) Security Policy

1. Purpose. This Order issues the General Services Administration’s (GSA) IT Security Policy.

2. Cancellation. This Order supersedes GSA Order CIO 2100.1K, GSA Information Technology (IT) Security Policy, dated June 30, 2017.

3. Revisions. This Order provides updates for consistency with Federal requirements and program instruction implementation. Changes include:

a. Removal of Chapter 6: Policy on Privacy Controls. GSA’s Privacy Act policy is provided in GSA Order CIO 1878.1, GSA Privacy Act Program;

b. Inclusion of information from new Directives: Executive Order (EO) 13800, Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure and NIST’s Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 (i.e., the Cybersecurity Framework [CSF]); and

c. Restructuring Chapters 3 through 7 and Appendix A to align with the CSF core functions of: (1) Identify, (2) Protect, (3) Detect, (4) Respond, and (5) Recover.

4. Applicability.

a. This IT Security Policy applies to all GSA Federal Employees, contractors, and vendors of GSA, who manage, maintain, operate, or protect GSA systems or data, all GSA IT systems, and any GSA data contained on or processed by IT systems owned and operated by or on the behalf of any of the Services or Staff Offices.

b. This policy applies to the Office of Inspector General (OIG) only to the extent that the OIG determines it is consistent with the OIG’s independent authority under the IG Act and it does not conflict with other OIG policies or the OIG mission.

c. This policy applies to the Civilian Board of Contract Appeals (CBCA) only to the extent that the CBCA determines it is consistent with the CBCA's independent authority https://insite.gsa.gov/portal/content/553345 https://insite.gsa.gov/portal/content/553345 https://insite.gsa.gov/portal/content/650534 https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf under the Contract Disputes Act and other authorities and it does not conflict with the CBCA's policies or the CBCA mission.

5. Signature.

/S/__________________________________

DAVID SHIVE

Chief Information Officer Office of GSA IT i

Table of Contents

CHAPTER 1: THE GSA INFORMATION TECHNOLOGY SECURITY PROGRAM

1. Introduction

2. Objectives

3. Federal laws and regulations

4. GSA policies

5. Compliance and deviations

6. Maintenance

7. Definitions

8. NIST SP (800 Series) and GSA guidance documents

9. Privacy Act systems

10. IT security controls

11. Contractor operations

12. Cybersecurity framework

13. Cloud services

CHAPTER 2: SECURITY ROLES AND RESPONSIBILITIES

1. GSA Administrator

2. GSA Chief Information Officer (CIO)

3. Chief Financial Officer (CFO)

4. GSA Senior Agency Official for Privacy (SAOP)

5. GSA Chief Information Security Officer (CISO)

6. Heads of Services and Staff Offices (HSSOs)

7. GSA Chief Privacy Officer (CPO)

8. Authorizing Official (AO)

9. Office of CISO Division Directors

10. Information Systems Security Manager (ISSM)

11. Information Systems Security Officer (ISSO)

12. System Owners

13. Program Managers

14. Project Managers

15. Data Owners

16. Contracting Officer (CO) and CO Representative (COR)

17. Custodians

18. Authorized users of IT resources

19. GSA Inspector General (IG)

20. GSA Personnel Security Officer/ Office of Mission Assurance (OMA)

21. Office of Human Resources Management (OHRM)

22. System/Network Administrators

23. Supervisors

CHAPTER 3: POLICY FOR IDENTIFY FUNCTION

1. Asset management

2. Business environment ii

3. Governance

4. Risk assessment

5. Risk Management Strategy

6. Supply Chain Risk Management

CHAPTER 4: POLICY FOR PROTECT FUNCTION

1. Identity management, authentication and access control

2. Awareness and training

3. Data security

4. Information protection processes and procedures

5. Maintenance

6. Protective technology

CHAPTER 5: POLICY FOR DETECT FUNCTION

1. Anomalies and events

2. Security continuous monitoring

3. Detection processes

CHAPTER 6: POLICY FOR RESPOND FUNCTION

1. Response planning

2. Communications

3. Analysis

4. Mitigation

5. Improvements

CHAPTER 7: POLICY FOR RECOVER FUNCTION

1. Recovery planning

2. Improvements

3. Communications

Appendix A: CSF CATEGORIES/SUBCATEGORIES

CHAPTER 1: THE GSA INFORMATION TECHNOLOGY SECURITY

PROGRAM

1. Introduction. The purpose of this Order is to document and set forth GSA’s IT Security Policy. This IT Security Policy establishes controls required to comply with Federal laws and regulations (including Department of Homeland Security (DHS) Binding Operational Directives), and thus facilitates adequate protection of GSA IT resources.

2. Objectives. IT Security Policy objectives will enable GSA to meet its mission and business objectives by implementing systems with due consideration of IT related risks to GSA, its partners, and customers. The security objectives for system resources are to provide assurance of confidentiality, integrity, availability, and accountability by employing security controls to manage cybersecurity risk IAW Executive Order (EO) 13800 and the Cybersecurity Framework (CSF). An important component of risk-based management is to integrate technical and non-technical security mechanisms into the system to reflect sound risk management practices. All incorporated security mechanisms must be well founded, configured to perform in the most effective manner, and add value to GSA’s IT-related investments. This risk based approach will enable the GSA IT Security Program to meet its goals by better securing IT systems, providing management the information necessary to justify IT Security expenditures, and assisting GSA personnel in authorizing IT systems for operation.

GSA IT security objectives include the following:

a. Confidentiality. Preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and Controlled Unclassified Information (CUI). Private or confidential information is not disclosed to unauthorized individuals while at rest, during processing, or in transit.

b. Integrity. Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. Safeguards must ensure information retains its content integrity. Unauthorized personnel must not be able to create, alter, copy, or delete data processed, stored, or handled by the system.

c. Availability. Ensuring timely and reliable access to and use of information. The system works promptly and service is not denied to authorized users. The system must be ready for use by authorized users when needed to perform their duties.

d. Accountability. Accountability must be to the individual level. Only personnel with proper authorization and need-to-know must be allowed access to data processed, handled, or stored on IT system components.

e. Assurance. Measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy. This assurance (i.e., confidence that the other four security https://cyber.dhs.gov/bod/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ objectives have been met), is provided through assessment and monitoring of security mechanisms and controls.

This Order supports GSA's IT Security Program objectives by:

Identifying roles and assigning responsibilities in support of GSA’s IT Security Program;

Defining comprehensive and integrated security requirements that are necessary to obtain authorization to allow GSA IT systems to operate within an acceptable level of residual risk;

Supporting GSA’s objective to ensure that all outsourced cloud services are from Federal Risk and Authorization Management Program (FedRAMP) authorized (or in the process of obtaining authorization) cloud service providers, and leverage existing authorizations to operate (ATOs) from other agencies to maximize savings; and

Supporting GSA’s objective to ensure that all systems which process, store, or transmit payment card data or purchase/credit card numbers are compliant with the current version of security requirements defined in the Payment Card Industry Data Security Standard (PCI DSS).

3. Federal laws and regulations. This Order provides policies that support the implementation of the following Federal regulations and laws, and GSA directives.

Federal Information Security Modernization Act (FISMA) of 2014 (Public Law 113-283)

Clinger-Cohen Act of 1996 also known as the Information Technology Management Reform Act (ITMRA) of 1996

CFO Act of 1990, Chief Financial Officers Act of 1990

Paperwork Reduction Act (PRA) of 1995 (Public Law 104-13)

Federal Financial Management Improvement Act of 1996 (FFMIA)

Federal Managers Financial Integrity Act of 1982 (FMFIA) (Public Law 97-255)

Government Paperwork Elimination Act (GPEA) (Public Law 105-277)

Privacy Act of 1974 (5 U.S.C. § 552a)

Homeland Security Presidential Directive (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors

Homeland Security Presidential Directive (HSPD-7), Critical Infrastructure Identification, Prioritization, and Protection

OMB Circular A-11, Preparation, Submission and Execution of the Budget

OMB Circular A-130, Managing Information as a Strategic Resource

OMB M-10-23, Guidance for Agency Use of Third-Party Websites and Applications

OMB M-13-13, Open Data Policy -- Managing Information as an Asset

OMB M-14-03, Enhancing the Security of Federal Information and Information Systems

OMB M-16-16, 2016 Agency Open Government Plans https://www.pcisecuritystandards.org/document_library https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2011-title40/pdf/USCODE-2011-title40-subtitleIII.pdf https://www.congress.gov/bill/101st-congress/house-bill/5687/text https://www.reginfo.gov/public/reginfo/pra.pdf https://www.congress.gov/104/bills/hr4319/BILLS-104hr4319ih.pdf https://obamawhitehouse.archives.gov/omb/financial_fmfia1982 https://obamawhitehouse.archives.gov/omb/fedreg_gpea2/ https://www.justice.gov/opcl/privacy-act-1974 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-7 https://www.whitehouse.gov/wp-content/uploads/2018/06/a11_2018.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2010/m10-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2013/m-13-13.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2014/m-14-03.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-16.pdf

OMB M-16-24, Role and Designation of Senior Agency Officials for Privacy

OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information

Public Law No: 113-274, Cybersecurity Enhancement Act of 2014

PCI DSS, Payment Card Industry Data Security Standard

Presidential Policy Directive (PPD-21), Critical Infrastructure Security and Resilience

EO 13556, Controlled Unclassified Information

EO 13800, Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

CSF, Version 1.1, Framework for Improving Critical Infrastructure Cybersecurity

FIPS 199, Standards for Security Categorization of Federal Information and Information Systems

FIPS 200, Minimum Security Requirements for Federal Information and Information Systems

NIST SP 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems

NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems

NIST SP 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach Planning Guide for Federal Information Systems

NIST SP 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-63-3, Digital Identity Guidelines

NIST SP 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations

NIST SP 800-171, Revision 1, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations

OPM 5 CFR Part 930.301, Subpart C, Information Security Responsibilities for Employees who Manage or Use Federal Information Systems

Department of Homeland Security Binding Operational Directives

4. GSA policies:

GSA Order ADM 7800.11A, Personal Use of Agency Office Equipment

GSA Order ADM P 9732.1, Suitability and Personnel Security

GSA Order CIO 1878.1, GSA Privacy Act Program

GSA Order CIO 1878.2A, Conducting Privacy Impact Assessments (PIAs) in

GSA

GSA Order CIO 2100.2B, GSA Wireless Local Area Network (LAN) Security

GSA Order CIO 2102.1, Information Technology (IT) Integration Policy

GSA Order CIO 2103.1, Controlled Unclassified Information (CUI) Policy

GSA Order CIO 2104.1A CHGE 1, GSA Information Technology (IT) General Rules of Behavior https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m_16_24_0.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://www.gpo.gov/fdsys/pkg/PLAW-113publ274/pdf/PLAW-113publ274.pdf https://www.pcisecuritystandards.org/document_library https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://www.whitehouse.gov/the-press-office/2010/11/04/executive-order-13556-controlled-unclassified-information https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r1.pdf https://www.gpo.gov/fdsys/pkg/CFR-2012-title5-vol2/pdf/CFR-2012-title5-vol2-part930.pdf https://cyber.dhs.gov/bod/ https://insite.gsa.gov/portal/content/520142 https://insite.gsa.gov/portal/content/520918 https://insite.gsa.gov/portal/content/650534 https://insite.gsa.gov/portal/content/658270 https://insite.gsa.gov/portal/content/636958 https://insite.gsa.gov/portal/content/673470 https://insite.gsa.gov/portal/content/550053 https://gsa.gov/portal/getMediaData?mediaId=161998

GSA Order CIO 2110.4, GSA Enterprise Architecture Policy

GSA Order CIO 2135.2B, GSA Information Technology (IT) Capital Planning and Investment Control

GSA Order CIO 2140.4, Information Technology (IT) Solutions Life Cycle (SLC) Policy

GSA Order CIO 2160.2B CHGE 1, GSA Electronic Messaging and Related Services

GSA Order CIO 9297.1, GSA Data Release Policy

GSA Order CIO 9297.2C, GSA Information Breach Notification Policy

GSA Order CIO P 2165.2, GSA Telecommunications Policy

GSA Order CIO P 2180.1, GSA Rules of Behavior for Handling Personally Identifiable Information (PII)

GSA Order CIO P 2181.1, Homeland Security Presidential Directive-12 (HSPD-

12) Personal Identity Verification and Credentialing

GSA Order CIO P 2182.2, Mandatory Use of Personal Identity Verification (PIV) Credentials

GSA Order OAS P 1820.1, GSA Records Management Program

GSA Order OSC 2106.2, GSA Social Media Policy

All GSA CIO-IT Security Procedural Guides and Technical Guides and Standards

A current list of Government-wide security guidance provided by the National Institute of Standards and Technology (NIST) is located at https://csrc.nist.gov/publications/sp.

5. Compliance and deviations.

a. Compliance is mandatory immediately upon the signing of this Order. This IT Security Policy requires all GSA Services, Staff Offices, Regions (S/SO/R), Federal employees, contractors, and other authorized users of GSA's IT resources, to comply with the security requirements outlined in this policy. This policy must be properly implemented, enforced, and followed to effectively protect GSA's IT resources and data.

Appropriate disciplinary actions must be taken in a timely manner in situations where individuals and/or systems are found non-compliant. Violations of this GSA IT Security Policy may result in penalties under criminal and civil statutes.

b. All deviations from this Order must be approved by the appropriate Authorizing Official (AO) with a copy of the approval forwarded to the GSA Chief Information Security Officer (CISO) in the Office of GSA IT for concurrence. Deviations must be documented using the Acceptance of Risk process defined in GSA CIO-IT Security-06- 30, Managing Enterprise Risk, including a date of resolution to comply.

c. Additionally, any exceptions or deviations to GSA IT technical guides and standards shall follow the guidelines defined therein.

6. Maintenance. The GSA Office of the Chief Information Security Officer (OCISO) is required to review this policy at least annually and revise it to:

https://insite.gsa.gov/portal/content/550585 https://insite.gsa.gov/portal/content/519386 https://insite.gsa.gov/portal/content/526137 https://insite.gsa.gov/portal/content/520818 https://insite.gsa.gov/portal/content/674050 https://insite.gsa.gov/portal/content/555377 https://insite.gsa.gov/portal/content/634938 https://insite.gsa.gov/portal/content/658222 https://insite.gsa.gov/portal/content/523110 https://insite.gsa.gov/portal/content/590890 https://insite.gsa.gov/portal/content/629686 https://insite.gsa.gov/portal/content/579797 https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-technical-guides-and-standards https://csrc.nist.gov/publications/sp https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-technical-guides-and-standards https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-technical-guides-and-standards

Reflect any changes in Federal laws and regulations;

Satisfy additional business requirements;

Encompass new technology; and

Adopt new Government IT standards.

7. Definitions. The following terms are defined as listed.

a. Accountability. The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity. This supports non-repudiation, deterrence, fault isolation, intrusion detection and prevention, and after-action recovery and legal action.

b. Assurance. Substantiate with confidence that the other four security goals (integrity, availability, confidentiality, and accountability) have been adequately met by a specific implementation. “Adequately met” includes (1) functionality that performs correctly, (2) sufficient protection against unintentional errors (by users or software), and

(3) sufficient resistance to intentional penetration or by-pass.

c. Availability. Ensuring timely and reliable access to and use of information.

d. Confidentiality. Preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and CUI information. The property that sensitive information is not disclosed to unauthorized individuals, entities, or processes.

e. Federal information system. An information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency (per 40 U.S.C. § 11331).

(1) Contractor system. An information system processing or containing GSA or Federal data where the infrastructure and applications are wholly operated, administered, managed, and maintained by a contractor in non-GSA facilities.

(2) Federal system (i.e., Agency system). An information system processing or containing GSA or Federal information where the infrastructure and/or applications are NOT wholly operated, administered, managed, and maintained by a Contractor.

g. Federal information. Information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

h. Integrity. Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity. The property that sensitive data has not been modified or deleted in an unauthorized and undetected manner.

i. Major information system. A system that is part of an investment that requires special management attention as defined in Office of Management and Budget (OMB) guidance and agency policies, a “major automated information system” as defined in 10 U.S.C. § 2445, or a system that is part of a major acquisition as defined in Part 7 of OMB Circular A-11, Capital Programming Guide. Major information systems include those information systems with an Exhibit 300 (also referred to as Major Programs) and any Exhibit 53 information systems that are not specifically covered by a major information system’s security plan.

j. Major IT investment. An investment within an IT investment portfolio that is designated as major, IAW capital planning guidance issued by the Director of OMB.

k. Minor applications (non-major information systems). Systems/applications that may be coalesced together as subsystems of a single larger, more comprehensive system for the purposes of security authorization. Minor applications/subsystems must be under the same management authority, have the same function or mission objective, the same operating characteristics, and information security needs, and reside in the same general operating environment(s).

8. NIST SP (800 Series) and GSA guidance documents. All policies shall be implemented using the appropriate special publication from NIST and/or GSA procedural guides to the greatest extent possible. Where there is a conflict between NIST guidance and GSA guidance, contact the GSA OCISO for clarification. Where there are no procedural guides, use industry best practices (e.g., Center for Internet Security Benchmarks, Defense Information Systems Agency Benchmarks). Federal Information Processing Standards (FIPS) publication requirements are mandatory for use at GSA.

Deviations from compliance to NIST special publications must be documented and approved in the same manner as described in Chapter 1, Section 5 of this policy.

9. Privacy Act systems. In addition to the security requirements in this Order, systems that contain Privacy Act data or PII must implement the additional privacy controls as defined in NIST SP 800-53, Revision 4, Appendix J: Privacy Control Catalog, GSA Order CPO 1878.1, Privacy Act Program, and GSA Order CIO P 1878.2A.

10. IT security controls. All IT systems, including those operated by a contractor on behalf of the Government, must implement proper security controls according to:

a. Its security categorization level IAW FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS 200; and

b. The current version of NIST SP 800-53, Revision 4.

11. Contractor operations.

https://www.whitehouse.gov/wp-content/uploads/2018/06/a11_2018.pdf https://www.whitehouse.gov/omb/management/egov/#A3 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://insite.gsa.gov/portal/content/650534 https://insite.gsa.gov/portal/content/650534 https://insite.gsa.gov/portal/content/658270 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

a. GSA System Program Managers and Contracting Officers shall ensure that the appropriate security requirements of this Order are included in task orders and contracts for all IT systems designed, developed, implemented, and operated by a contractor on behalf of GSA, including but not limited to systems operating in a Cloud Computing environment. In addition, GSA shall ensure that the contract allows GSA or its designated representative (i.e., third-party contractor) to review, monitor, test, and evaluate the proper implementation, operation, and maintenance of the security controls. This requirement includes, but is not limited to: documentation review, server configuration review, vulnerability scanning, code review, physical data center reviews, and operational process reviews and monitoring of Service Organization Control (SOC) 2/Statements on Standards for Attestation Engagements (SSAE) 18 reports.

b. The security controls implemented as part of contracts and task orders must include specific language that requires solutions to align with existing Information Security architecture. Security deliverables must be provided in a timely manner for review and acceptance by GSA. Additional information may be found in GSA CIO-IT Security-09-48, Security and Privacy Requirements for IT Acquisition Efforts. Note: As indicated in Chapter 1, Section 5, GSA has a deviation request process by which a deviation from approved security architecture/standards may be requested.

12. Cybersecurity framework.

a. EO 13800 requires all agencies to use the NIST CSF or any successor document to manage an agency’s cybersecurity risk. To support this mandate, GSA has adapted this security policy and its primary procedural guides for managing risk, GSA CIO-IT Security-06-30, GSA CIO-IT Security-18-90, Information Security Program Plan, and GSA CIO-IT Security-18-91, Risk Management Strategy, to align with the CSF. GSA has also started updating its security procedural guides (based on NIST SP 800-53, Revision 4 security control families) to show alignment with the CSF. This process will continue until all guides have been updated. The CSF is organized into five core CSF Functions:

Identify (ID): Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities.

Protect (PR): Develop and implement appropriate safeguards to ensure delivery of critical services.

Detect (DE): Develop and implement appropriate activities to identify the occurrence of a cybersecurity event.

Respond (RS): Develop and implement appropriate activities to take action regarding a detected cybersecurity event.

Recover (RC): Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.

b. Chapters 3-7 of this policy are organized into the five core functions. Each chapter is further organized by the CSF’s categories and subcategories which divide the https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides functions into outcomes and activities. Appendix A details the category and subcategory definitions and unique identifiers. Additional information is available in CSF Version 1.1.

13. Cloud services. No GSA user or S/SO/R shall conduct or acquire any type of pilot involving the use of GSA data or logons to a cloud service, platform, application or tool without first consulting with the OCISO's Security Engineering Division (ISE). Such coordination can be made by contacting ISE representatives at SecEng@gsa.gov.

a. No procurement for such products/services shall be completed without coordination through the OCISO and having obtained a valid ATO granted by a GSA AO or a FedRAMP provisional ATO.

b. GSA users or S/SO/Rs may leverage GSA authorized Cloud Service Provider offerings reviewed by the GSA Security Engineering Division (ISE) and approved by the GSA CISO. Allowed CSP offerings are identified in CSP approval memos on the IT Security Procedural Guides page.

c. The use of PII can only be involved in such products/services when the ATO grants such authorization specifically. PII shall never be introduced into any pilot program at any time.

d. Multi-Factor Authentication (MFA) shall be used when implementing any Cloud service, application or tool.

(1) Privileged accounts must use MFA when accessing any Cloud system via a network.

(2) Non-privileged accounts must use MFA when accessing a FIPS 199 Moderate or High Cloud system via a network.

e. Mobile applications that use a Cloud platform for the storage, transmission or processing of GSA data or Federal information under the management or control of GSA is subject to the above conditions.

https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf

CHAPTER 2: SECURITY ROLES AND RESPONSIBILITIES

The roles and responsibilities described in the paragraphs below are assigned to the offices and positions identified to ensure effective implementation and management of GSA’s IT Security Program. The establishment of a security management structure and assigning of security responsibilities is a requirement of the FISMA.

1. GSA Administrator. The Clinger-Cohen Act of 1996 assigns the responsibility for ensuring “that the information security policies, procedures, and practices of the executive agency are adequate” to the agency head. FISMA provides the following details on agency head responsibilities for information security:

a. Providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of an agency, and on information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;

b. Ensuring that an information security program is developed, documented, and implemented to provide security for all systems, networks, and data that support the operations of the organization;

c. Ensuring that information security management processes are integrated with agency strategic and operational, and budgetary processes;

d. Ensuring that senior agency officials within the organization are given the necessary authority to secure the information and information systems that support the operations and assets under their control;

e. Designating a Chief Information Officer (CIO) and delegating authority to that individual to ensure compliance with applicable information security requirements;

f. Ensuring that the agency has trained personnel to support compliance with information security policies, processes, standards, and guidelines; and

g. Ensuring that the CIO, in coordination with the other senior agency officials, reports annually to the GSA Deputy Administrator on the effectiveness of the agency information security program, including the progress of remedial actions.

2. GSA Chief Information Officer (CIO). Mandated by the Clinger-Cohen Act of 1996 and FISMA, the GSA CIO has overall responsibility for the GSA IT Security Program and reports to the GSA Deputy Administrator. Information security responsibilities include:

a. Developing and maintaining an agency-wide GSA IT Security Program;

https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2011-title40/pdf/USCODE-2011-title40-subtitleIII.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2011-title40/pdf/USCODE-2011-title40-subtitleIII.pdf

b. Ensuring the agency effectively implements and maintains information security policies and guidelines;

c. Providing guidance, advice, and assistance to the Heads of Services and Staff Offices (HSSOs), and Regional Administrators (RAs) on implementing GSA’s IT Security Policy;

d. Providing management processes to enable AOs to implement the components of the IT Security Program for which they are responsible;

e. Ensuring information assurance and the protection of GSA's cyber-based critical infrastructure;

f. Designating a CISO to assist in carrying out the GSA CIO’s agency-wide IT security responsibilities;

g. Establishing reporting requirements within GSA to assess GSA’s IT security posture, verifying compliance with Federal requirements and approved policies, and identifying agency-wide IT security needs;

h. Conducting independent activities and compliance reviews including oversight of GSA’s Assessment and Authorization (A&A) process;

i. Coordinating and reporting on PPD-21 critical infrastructure assets;

j. Reporting annually, in coordination with the other senior agency officials, to the GSA Deputy Administrator on the effectiveness of the agency information security program, including progress of remedial actions;

k. Ensuring Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs) prepared by GSA organizations for security considerations are reviewed;

l. Providing guidance or input for periodic assessments of S/SO/R security measures and goals to assure implementation of GSA policy and procedures; and

m. Participating as a member of the GSA Full Response Team IAW GSA Order 9297.2C to determine if a major incident has occurred.

3. Chief Financial Officer (CFO). The CFO also has major statutory security responsibilities under the CFO Act of 1990 and the Clinger-Cohen Act of 1996.

Responsibilities include:

a. Developing and maintaining an integrated agency accounting and financial management system, including financial reporting and internal controls, which comply with FMFIA and FFMIA requirements;

https://insite.gsa.gov/portal/content/555377 https://www.congress.gov/bill/101st-congress/house-bill/5687/text https://www.gpo.gov/fdsys/pkg/USCODE-2011-title40/pdf/USCODE-2011-title40-subtitleIII.pdf https://obamawhitehouse.archives.gov/omb/financial_fmfia1982 https://www.congress.gov/104/bills/hr4319/BILLS-104hr4319ih.pdf

b. Complying with such policies and requirements as may be prescribed by the Director of OMB;

c. Complying with applicable accounting principles, standards, and requirements, and internal control standards and any other requirements applicable to such systems;

d. Supporting the GSA IT Capital Planning Process. To achieve satisfactory assurance levels of information security for the financial systems of GSA, close cooperation between the offices of the CFO and the CIO is necessary, including supporting the GSA IT Capital Planning process; and

e. Reporting financial management information to OMB as part of the President’s budget to include:

(1) Complying with legislative and OMB-defined responsibilities as they relate to IT capital investments; and

(2) Ensuring the appropriate security requirements of this Order are included in all contracts for IT systems designed, developed, implemented, and operated by a contractor that hosts GSA financial systems. This includes, but is not limited to:

documentation review of operational processes and reviews that monitor SSAE 18 reporting submissions.

4. GSA Senior Agency Official for Privacy (SAOP). The SAOP has major statutory responsibilities under the Privacy Act of 1974, GSA Order CIO 1878.1, OMB A-130, and OMB M-16-24. Information security responsibilities include:

a. Ensuring GSA information systems that contain PII address any recommendations of the SAOP as part of the system A&A, including addressing the privacy controls in Appendix J of NIST SP 800-53, Revision 4, as appropriate;

b. Ensuring that GSA data assets go through media protection processes IAW GSA CIO-IT Security-06-32: Media Protection (MP) prior to public release and that applicable Privacy Policies are followed;

c. Ensuring PTAs and PIAs are conducted for electronic information systems and collections and coordinating submission of all GSA Privacy Analysis Worksheets and PIA Summaries to OMB;

d. Developing, implementing, and overseeing personnel security controls for access to PII;

e. Directing the planning and implementation of the GSA Privacy Program to ensure agency personnel, including contractors, receive appropriate privacy awareness training based on their roles and access to privacy data; and https://www.justice.gov/opcl/privacy-act-1974 https://insite.gsa.gov/portal/content/650534 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m_16_24_0.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides

f. Participating as the GSA Full Response Team leader IAW GSA Order 9297.2C if a major incident involving privacy has occurred.

5. GSA Chief Information Security Officer (CISO). FISMA establishes the designation of a Senior Agency Information Security Officer. GSA has assigned that responsibility to the CISO. The CISO is the focal point for all GSA IT security and must ensure the security requirements described in this Order are implemented agency-wide. The CISO reports directly to the CIO as required by FISMA. Responsibilities include:

a. Reporting to the GSA CIO on the implementation and maintenance of the GSA's IT Security Program and Security Policies;

b. Reporting to the GSA CIO on activities and trends that may affect the security of systems and applications assigned to GSA;

c. Implementing and overseeing GSA's IT Security Program by developing and publishing security policies and IT security procedural guides that are consistent with this policy;

d. Ensuring written agreements assign security-related functions and identify security responsibilities of each S/SO/R or activity when two or more activities use the same IT;

e. Providing guidance, advice, and assistance to all S/SO/R on IT security issues, the IT Security Program, and security policies;

f. Reporting to agency senior management on policy compliance;

g. Directing the planning and implementation of the GSA IT Security Awareness Training Program to ensure agency personnel, including contractors, receive appropriate security awareness training based on their roles and access to information and information systems;

h. Managing the CIO Office of the CISO which implements the GSA IT Security Program;

i. Establishing reporting deadlines for IT Security related issues requiring an agency response affecting the GSA IT Security Program;

j. Performing information security duties as the primary duty;

k. Assessing risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems supporting the operations and assets of the agency on a periodic basis;

l. Testing and evaluating the effectiveness of information security policies, procedures, and practices on a periodic basis;

m. Establishing and maintaining a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency;

n. Ensuring the development and implementation of procedures for detecting, reporting, and responding to security incidents;

o. Ensuring preparation and maintenance of plans and procedures to provide continuity of operations for information systems that support the operations and assets of GSA;

p. Supporting the GSA CIO in annual reporting to the GSA Administrator on the effectiveness of the agency information security program, including progress of remedial actions;

q. Developing and implementing IT security performance measures to evaluate the effectiveness of technical and non-technical safeguards used to protect GSA information and information systems;

r. Assessing S/SO/R security measures and goals periodically to assure implementation of GSA policy and procedures;

s. Ensuring the appointment in writing of Information Systems Security Managers (ISSMs) and Information Systems Security Officers (ISSOs) for GSA systems;

t. Administering FISMA requirements and coordinating GSA’s annual FISMA security program review and Plan of Action and Milestones (POA&M) implementations;

u. Ensuring IT Acquisitions align with GSA information security requirements;

v. Participating as the GSA Full Response Team leader IAW GSA Order 9297.2C , if a major non-privacy incident has occurred; and

w. Concurring/Non-concurring on ATOs as specified in GSA CIO-IT Security-06-30 and its related A&A procedural guides.

6. Heads of Services and Staff Offices (HSSOs). HSSOs are senior officials or executives within GSA with specific mission or line of business responsibilities. They are responsible for coordinating the efforts of management and technical personnel under their jurisdiction in meeting GSA IT Security requirements. Responsibilities include:

https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides

a. Ensuring that contractors performing services associated with GSA systems (such as system development, maintenance, or operation) are subject to GSA security requirements; and

b. Tracking the performance measures and goals established by the CISO and ensuring AOs, ISSMs, and ISSOs support these measures.

7. GSA Chief Privacy Officer (CPO). The CPO is responsible for overseeing GSA's Privacy Program whose mission it is to preserve and enhance privacy protections for all individuals whose personal information is handled by GSA and to encourage transparency of GSA operations involving personal information. The CPO reports to the SAOP. Information security responsibilities include:

a. Confirming that GSA information systems containing PII address any recommendations of the SAOP as part of the system A&A, including addressing the privacy controls in NIST SP 800-53, Revision 4, as appropriate;

b. Verifying that GSA data assets go through media protection processes IAW GSA CIO-IT Security-06-32, prior to public release and that applicable privacy policies are followed;

c. Verifying PTAs and PIAs are conducted for electronic information systems and collections and coordinating submission of all GSA Privacy Analysis Worksheets and PIA Summaries to OMB;

d. Managing the implementation of personnel security controls for access to PII;

and

e. Participating as a member of the GSA Full Response Team IAW GSA Order 9297.2C.

8. Authorizing Official (AO). An AO is the Federal Government management official with the responsibility of identifying the level of acceptable risk for an IT system or application and determining whether the acceptable level of risk has been obtained.

Final authority to operate or not operate the system rests with the AO. An AO must be assigned to every information system. An AO may have responsibility for more than one system, provided there is no conflict. Responsibilities include:

a. Reviewing and approving security safeguards of information systems and issuing ATO approvals for each information system under their purview based on the acceptability of the security safeguards of the system (risk-management approach);

b. Reviewing and approving all deviations from this Order as described in Chapter 1, Section 5 of this Order.

https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides

c. Ensuring all systems under their purview have a current ATO issued IAW A&A processes defined in GSA CIO-IT Security-06-30;

d. Ensuring ATO extensions are issued only based on the conditions identified in Chapter 3, Section 3.l and 3.m;

e. Ensuring vulnerability scans are able to be performed on systems under their purview IAW GSA CIO-IT Security-17-80: Vulnerability Management Process.

Vulnerabilities identified from the scans shall be resolved and/or tracked in the systems’ POA&M IAW GSA CIO-IT Security-09-44: POA&M and GSA CIO-IT Security-06-30;

f. Providing support to the ISSMs and ISSOs appointed by the GSA CISO for GSA systems under their purview;

g. Ensuring IA is included in management planning, programming budgets, and the IT Capital Planning process;

h. Requiring point(s) of contacts (POCs) within other Federal agencies or outside organizations that manage GSA systems be maintained for systems under their purview. These POCs will be used for notification and coordination of security issues;

i. Ensuring IT systems handling privacy data meet the privacy and security requirements of the Privacy Act and IT information security laws and regulations. This includes GSA Order CIO 1878.1, GSA Order CIO 1878.2A, and NIST SP 800-53, Revision 4;

j. Reviewing and approving PIAs for systems under their purview;

k. Supporting the security measures and goals established by the CISO;

l. Ensuring all incidents involving data breaches which could result in identity theft are coordinated through OCISO and the GSA Full Response Team using the GSA breach notification plan per OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, GSA CIO-IT Security-01-02: Incident Response (IR), and GSA Order 9297.2C;

m. Ensuring contingency plans are developed and tested annually IAW OMB Circular A-130, NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, and GSA CIO-IT Security-06-29: Contingency Planning (CP);

n. Implementing detailed separation of duties policies for IT systems based on the specific processes, roles, permissions, and responsibilities of personnel involved in GSA business operations;

o. Establishing physical and logical access controls to enforce separation of duties policies and alignment with organizational and individual job responsibilities;

https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/portal/content/650534 https://insite.gsa.gov/portal/content/658270 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/portal/content/555377 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides

p. Ensuring access to systems by members of the GSA OIG as described in paragraph 19 of this chapter;

q. Establishing, where appropriate, system/organization unique rules of behavior for systems under their purview; and

r. Ensuring IT systems handling payment card data meet the security requirements of the PCI DSS.

9. Office of CISO Division Directors. OCISO Directors serve as an intermediary to the AO for ensuring security is implemented. The Directors are the focal point for all IT system security matters for the IT resources under their responsibility. OCISO Directors report to the CISO. Responsibilities include:

a. Monitoring adherence and proper implementation of GSA’s IT Security Policy and reporting the results to the CISO;

b. Reviewing and approving A&A documents to be signed by the appropriate…