5-BPM004656 Solicitation Attachment 5 - Arizona Baseline Security Controls Assessment.xls

NIST 800-53 r4 controls

[Control and Control Enhancement]

Implementation Status (Reference on Comments Page )

Documentation

(If you can't meet this control at all please explain why)

a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

g. Monitors the use of, information system accounts;

h. Notifies account managers:

1. When accounts are no longer required;

2. When users are terminated or transferred; and

3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements [At least annually]; and

k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. ICM Document Solutions (ICM) utilizes user and administrator accounts to provide access to our or corporate network and resources(a) and has several designated IT Administrators that provide and maintain system accounts(b).

ICM has a process in place that defines group and role membership for corp users(c); has clearly defined membership for system administrators that provide user access to system resources(d) and ICM requires that account creation requests are made by authorized personnel i.e. managers(e).

ICM IT Systems Administrators have procedures in place to create, maintain and disable system accounts as circumstances warrant(f). ICM IT Administration Staff monitor account usage and will notify account managers when the original use of the account changes(g,h,1,2,3).

Access to ICM's information systems require an account name and secure password and are basesd on a user's need to execute their job functions(i,1,2,3).

(I) the organization manages information system accounts, including authorizing, establishing, activating, modifying, reviewing, disabling, and removing accounts;

(ii) the organization defines in the security plan, explicitly or by reference, the frequency of information system account reviews and the frequency is at least annually;

(iii) the organization reviews information system accounts in accordance with organization-defined frequency; and

(iv) the organization initiates required actions on information system accounts based on the review.

(v) determine if the organization employs automated mechanisms to support information system account management functions.

(vi) the organization defines in the security plan, explicitly or by reference, a time period for each type of account after which the information system terminates temporary and emergency accounts; and

(vii) the information system automatically terminates temporary and emergency accounts after organization-defined time period for each type of account.

(viii) the organization defines in the security plan, explicitly or by reference, a time period after which the information system disables inactive accounts; and

(ix) the information system automatically disables inactive accounts after organization-defined time period.

(x) the organization employs automated mechanisms to audit account creation, modification, disabling, and termination actions; and

(I) the information system enforces assigned authorizations for controlling access to the system in accordance with applicable policy; and

1) to "authorize" and regulate connections to and from applicable information systems, and [Note: supporting processes can include security considerations when interfaces are created to and from the information system; controlling administrative type access that can enable interface accounts, etc.].

2) to restrict and control the allocation and use of administrative access to information systems?

a. Separates [Assignment: organization-defined duties of individuals];

b. Documents separation of duties of individuals; and

(I) the organization establishes appropriate divisions of responsibility and separates duties as needed to eliminate conflicts of interest in the responsibilities and duties of individuals; and

(I) the organization assigns the most restrictive set of rights/privileges or accesses needed by users for the performance of specified tasks; and

a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

(i) providing secure remote access to information systems, including rules on when privileged access is provided,

(ii) monitoring and authorizing remote access to information systems, and

(iii) enforcing requirements for remote connections to the information system in place?

[Note: Documentation on methods should also include usage restrictions and implementation guidance for each allowed remote access method; secure remote connections include proper configuration and use of encryption; example of privileged remote access include approval(s) required based on business need, and use of stronger authentication such as two-factor]. Obtain access control policy; procedures addressing remote access to the information system; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if

(I) the organization authorizes, monitors, and controls remote access to the information system for all allowed methods of remote access to include both establishment of the remote connection and subsequent user actions across that connection.

(ii) the information system employs automated mechanisms to facilitate the monitoring and control of remote access methods.

a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

b. Authorizes wireless access to the information system prior to allowing such connections.

. ICM’s wireless access points are strictly managed by enterprise-level equipment. Additionally, wireless access is heavily restricted and requires ICM-Managed equipment and credentials to access. AES-256 is standard. Implemented Service Provider Corporate IT-0010_Rev1 N/A N/A Are wireless device(s) and access point(s) securely managed through:

(i) a defined and effective process for authorizing the setting up of wireless access points;

(ii) a defined and documented standard for configuring wireless access points for security;

(iii) having in place a process to regularly review wireless access points for proper configuration and rogue wireless access points; and

(iv) having a defined architecture where wireless access points are properly segregated from wired network (e.g., use of Firewalls)? Obtain access control policy; procedures addressing wireless implementation and usage (including restrictions); NIST Special Publications 800-48 and 800-97; activities related to wireless authorization, monitoring, and control; information system audit records; other relevant documents or records and ascertain if

(I) the organization establishes usage restrictions and implementation guidance for wireless technologies;

(ii) the organization authorizes, monitors, and controls wireless access to the information system; and

(iii) the wireless access restrictions are consistent with NIST Special Publications 800-48 and 800-97.

a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

b. Authorizes the connection of mobile devices to organizational information systems. In some cases, ICM provides company-managed laptops for employee use. Employees have no reasonable expectation of privacy in regard to the use of such devices, and all use is subject to monitoring, to the maximum extent permitted by applicable law. This includes as permitted the right to monitor personal communications as necessary.

Email communications sent via a PCD is also subject to monitoring if sent through the ICM's networks and the PCD must allow ICM IT to manage the account on the device before it is provisioned.

All conversations, text messages and e-mails must be professional. When sending a text message or using a PCD for business purposes, whether it is a ICM-provided or personal device, employees must comply with applicable ICM guidelines, including policies on sexual harassment, discrimination, conduct, confidentiality, equipment use and operation of vehicles.

Using a Company-issued PCD to send or receive personal text messages is prohibited at all times and personal use during working hours should be limited to emergency situations. If an employee who uses a personal PCD for business resigns or is terminated, the employee will be required to submit the device to the IT department for resetting on or before his or her last day of work. At that time, the IT department will reset and remove all information from the device, including but not limited to, Company information and personal data (such as contacts, e-mails and photographs). The IT department will make efforts to provide employees with the personal data in another form (e.g., on a disk) to the extent practicable; however, the employee may lose some or all personal data saved on the device.

Employees may not use their personal PCD for business unless they agree to allow ICM IT department to manage the account on the device. This form of management is crucial to ensure compliance with the Company's confidentiality and proprietary information policies and objectives.

[Note: Example controls include: policies that define how such devices are used in context of business; and technical controls such as password requirements to access the device, use of "containers" to segregate confidential information, use of encryption on containers, remote wipe-out capabilities for PDAs/Smartphones, etc.] Obtain access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if

(I) the organization establishes usage restrictions and implementation guidance for organization-controlled portable and mobile devices; and

a. As part of initial training for new users;

b. When required by information system changes; and

c. [Assignment: organization-defined frequency] thereafter. ICM Team Managers proactively advance information security concerns across the organization to address actual and/or potential incidents. Activities include:

- Communicate concerns

- Contribute to resource planning through risk assessment or other means

- Participate in training and awareness initiatives ICM team members participate in information security awareness training and comply with safeguards. Incidents are reported to team leads and/or managers as appropriate to:

- Prevent security breaches, if possible

- Mitigate security breaches

- Contain security threats

- Document incident

- Provide for Corrective / Preventive action Implemented Service Provider Corporate ICM-0041_Rev_1 Section 4 N/A N/A 1. Does the institution or department provide on-going basic security awareness training to all information system users (including department heads, senior executives, and contractors)? Are awareness and training materials updated periodically for addressing relevant security behaviors of the current time based on industry trends, past incidents, etc., as well as indicators of insider threat?

2. Does the organization have targeted training in place for positions with higher risk profile (e.g., system administrators, personnel with access to student records, etc.? Obtain Security awareness and training policy; procedures addressing security awareness training implementation; NIST Special Publication 800-50; appropriate codes of federal regulations; security awareness training curriculum; security awareness training materials; security plan; other relevant documents or records and ascertain if (I)the organization provides basic security awareness training to all information system users (including managers and senior executives) before authorizing access to the system and when required by system changes;

(ii)the security awareness training is consistent with applicable regulations and NIST Special Publication 800-50;

(iii)the security awareness and training materials address the specific requirements of the organization and the information systems to which personnel have authorized access;

(iv)the organization defines in the security plan, explicitly or by reference, the frequency of refresher security awareness training and the frequency is at least annually.

a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of Parameter: [at least weekly]; and

b. Reports findings to [Assignment: organization-defined personnel or roles]. ICM's IT Administrators coordinate activities to regularly audit the data security processes as appropriate and maintains records as needed to demonstrate effectiveness. ICM's IT Administrators coordinate activities to regularly test the data security mechanisms as appropriate and maintains records as needed to demonstrate effectiveness.

Incidents are reported to team leads and/or managers as appropriate to:

- Prevent security breaches, if possible

- Mitigate security breaches

- Contain security threats

- Document incident

(I)the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity;

(ii)the organization investigates suspicious activity or suspected violations;

(iii)the organization reports findings of inappropriate/unusual activities, suspicious behavior, or suspected violations to appropriate officials; and

a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [all information system and network components where audit capability is deployed/available]

b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3. ICM's IT Administrators coordinate activities to regularly audit the data security processes as appropriate and maintains records as needed to demonstrate effectiveness. ICM's IT Administrators coordinate activities to regularly test the data security mechanisms as appropriate and maintains records as needed to demonstrate effectiveness.

Incidents are reported to team leads and/or managers as appropriate to:

- Prevent security breaches, if possible

- Mitigate security breaches

- Contain security threats

- Document incident

- Provide for Corrective / Preventive action Implemented Service Provider Corporate ICM-0041_Rev_1 N/A N/A Does the institution or department have a documented logging standard that defines the minimum requirements for logging (e.g., fields to log, type of events, log protection requirements, retention requirements, etc.)? Obtain audit and accountability policy; procedures addressing audit record generation; security plan; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if :

(I) the organization defines the information system components that provide audit record generation capability for the list of auditable events defined in AU-2;

(ii) the information system provides audit record generation capability, at organization-defined information system components, for the list of auditable events defined in AU-2;

(iii) the information system allows designated organizational personnel to select which auditable events are to be audited by specific components of the system; and

a. Develops a security assessment plan that describes the scope of the assessment including:

1. Security controls and control enhancements under assessment;

2. Assessment procedures to be used to determine security control effectiveness; and

3. Assessment environment, assessment team, and assessment roles and responsibilities;

b. Assesses the security controls in the information system and its environment of operation[at least annually] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

c. Produces a security assessment report that documents the results of the assessment; and

d. Provides the results of the security control assessment to [individuals or roles to include ADOA/ASET]. ICM's IT Administration serves as a business unit in providing software products and support services. It also provides corporate business information management including, but not limited to, technical support, software installation, new equipment, re-distribution of existing equipment, order fulfillment, training, etc.

ICM's IT creates or develops complete software, hardware, and/or business process solutions. These projects are typically software products or custom solutions that require a project plan and design reviews at suitable stages of development.

ICM's IT creates implementations of software, hardware, and/or business process solutions. These implementations usually have flexible constraints.

ICM's IT creates implementations for integrating software, hardware, and/or process solution tools in support of other ICM business units as standalone programs or with suitable interfacing to customer-based or vendorbased systems or tools.

ICM's IT provides consultative guidance in support of other ICM business units for addressing IT-sensitive, innovative solutions to customer/client services.

ICM's IT administers design, specification, and ongoing maintenance of computer systems, to include servers, networks, and related peripherals, including power, environmental, and security considerations. Implemented ICM-0023_Rev_3 Sections 1 and 2 N/A N/A Does the institution or department have a defined information security program that includes:

i) developing a plan and executing periodic assessments of security control effectiveness;

ii) identifying objective and qualified assessors; and iiI) reporting results of such assessment(s) to the appropriate stakeholders? Obtain security assessment policy; procedures addressing security assessments; security plan; security assessment plan; security assessment report; assessment evidence; security authorization package (including security plan, security assessment report, plan of action and milestones, authorization statement); other relevant documents or records and ascertain if :

(I)the organization defines in the security plan, explicitly or by reference, the frequency of security control assessments and the frequency is at least annually (ii)the organization conducts an assessment of the security controls in the information system at an organization-defined frequency.

a. Establishment of [Assignment: organization-defined metrics] to be monitored;

b. Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring;

c. Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

d. Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; [To meet State of Arizona's requirements]

e. Correlation and analysis of security-related information generated by assessments and monitoring;

f. Response actions to address results of the analysis of security-related information; and

g. Reporting the security status of organization and the information system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency]. ICM IT administers design and provide ongoing maintenance of infrastructure related to business access, to include facility badge access for staff as well as security monitoring devices.

ICM IT reviews risk management aspects associated with business information systems as appropriate, conducting tests/drills as warranted to ensure company data can be recovered in the event of a disaster or equipment failure.

ICM IT Maintains corrective action records via IT Helpdesk or CAPA.

ICM IT Logs incidents, as appropriate, to Security Incident Log ICM IT monitors performance of business information management activities against evaluative norms and metrics, as appropriate. Implemented ICM-0041_Rev_1 N/A N/A Has the institution or department implemented a continuous monitoring program that includes configuration management, ongoing security control assessments, and reporting on the information system and its constituent components? Obtain certification and accreditation policy; procedures addressing continuous monitoring of information system security controls; NIST Special Publications 800-37 and 800-53A; security plan; security assessment report; plan of action and milestones; information system monitoring records; security impact analyses; status reports; security plan; other relevant documents or records and ascertain if:

(I)the organization monitors the security controls in the information system on an ongoing basis.

(ii)the organization employs a security control monitoring process consistent with NIST Special Publications 800-37 and 800-53A.

(iii)the organization conducts security impact analyses on changes to the information system.

Identify -> Critical Information Asset Inventory The organization:

a. Establishes and documents configuration settings for information technology products employed within the information system using [State of Arizona Configuration Baseline (SACB)] that reflect the most restrictive mode consistent with operational requirements;

b. Implements the configuration settings;

c. Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and

d. Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures. ICM's IT Administrators document and maintain security configuration information in the following cases:

o Personnel key lock and photo-ID badge/key card access controls o Facility security credentials, such as security clearances o Personnel security credentials, such as security clearances o LAN server and support system with appropriate physical /connectivity access restrictions, environmental features, malicious software protections, security reminders, encryption capability, and firewall protections o LAN and PC user access rights, duties, and privileges control via log-in and password protocols o Workstation use and restrictions, as appropriate

Contracting services and/or third-party agreements and related security considerations, including:

- Access restrictions and revocation provisions

- Confidentiality Agreement(s) or NDAs

- Intellectual property rights (IPR) Information and data access protocols, including:

- PC user practices, including clear desk/clear screen considerations

- Rules for electronic mail and Internet usages

- Guidelines for the use of mobile devices especially for use outside ICM premises e.g. notebooks, palmtops, lap tops, smart cards, and mobile phones,

- Camera and cell phone (Smartphones) practices

- Personal Data Assistant (PDA), Portable media (flash drives), home computers or other non corporate equipment, or other devices Incident protocols, including:

- Incident response and reporting

- Incident investigations

- Corrective Action / Preventive Action Information security training, including:

- OPSEC awareness (Operational Security)

- Establishing priorities and budget

- Setting goals and objectives

- Providing guidance on curricula

- Maintaining records Information security metrics to aid in demonstrating effectiveness over time, including:

o LAN system uptime o Data breach incidents

5. The Corporate Security Officer or designate conducts and maintains security risks assessment(s),, as appropriate, to identify vulnerabilities of systems and threats to assets with plans and/or controls to prevent or mitigate incidents.

6. The Corporate Security Officer or designate develops and maintains additional processes and controls as appropriate. Plans may include:

o Asset Inventory(s) and ownership o Asset decommissioning and disposal o Business Continuity Plan, ICM-0042 o Disaster Recovery Planning o Emergency Response Planning o Functional proxy (per procurationem) o IT Information/Security Audit Plan o

7. The Corporate Security Officer or designate coordinates activities to regularly audit the data security processes as appropriate and maintains records as needed to demonstrate effectiveness and/or CA/PA.

8. The Corporate Security Officer or designate coordinates activities to regularly test the data security mechanisms as appropriate and maintains records as needed to demonstrate effectiveness and/or CA/PA.

9. Team Managers proactively advance information security concerns across the organization to address actual and/or potential incidents. Activities include:

o Communicate concerns o Contribute to resource planning through risk assessment or other means o Participate in training and awareness initiatives

10. ICM team members participate in information security awareness training and comply with safeguards. Incidents are reported to team leads and/or managers as appropriate to:

o Prevent security breaches, if possible o Mitigate security breaches o Contain security threats o Document incident o Provide for Corrective / Preventive action Implemented Service Provider Corporate ICM-0041_Rev_1 Sections C, D and E N/A N/A Does the institution or department have processes in place to monitor and control changes to the baseline configuration settings of information systems in accordance with organizational policies and procedures? Obtain configuration management policy; procedures addressing configuration settings for the information system; information system configuration settings and associated documentation; NIST Special Publication 800-70; other relevant documents or records and ascertain if:

(I)the organization establishes mandatory configuration settings for information technology products employed within the information system.

(ii)the organization configures the security settings of information technology products to the most restrictive mode consistent with operational requirements.

(iii)the organization documents the configuration settings.

Protect -> Network Access and Perimeter Controls The organization:

a. Configures the information system to provide only essential capabilities; and

(I)the organization defines in the security plan, explicitly or by reference, prohibited or restricted functions, ports, protocols, and services for the information system.

(ii)the organization configures the information system to provide only essential capabilities.

(iii)the organization configures the information system to specifically prohibit and/or restrict the use of organization-defined functions, ports, protocols, and/or services.

(iv)the organization defines in the security plan, explicitly or by reference, the frequency of the information system reviews to identify and eliminate unnecessary functions, ports, protocols, and services; and

Identify -> Critical Information Asset Inventory The organization:

a. Develops and documents an inventory of information system components that:

1. Accurately reflects the current information system;

2. Includes all components within the authorization boundary of the information system;

3. Is at the level of granularity deemed necessary for tracking and reporting; and

4. Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and

b. Reviews and updates the information system component inventory [At least monthly]. ICM's IT Department documents, develops and maintains an inventory of IT resources. This information is updated regularly and is used to properly identify the stakeholders and responsible parties for these assets.

ICM's IT Department develops and maintains additional processes and controls as appropriate. Plans may include:

o Asset Inventory(s) and ownership o Asset decommissioning and disposal o Business Continuity Plan;

o Functional proxy (per procurationem) o Emergency Response Planning o Disaster Recovery Planning o IT Information/Security Audit Plan o Statement of Applicability (SOA) Implemented Service Provider Corporate ICM-0041_Rev_1 N/A N/A 1) Does the institution or department assign owner and custodian to all information and IT assets, and is there an approved document which describes and distinguishes the roles and responsibilities of an owner, custodian, and user? 2) Is there a current and accurate inventory of systems, that provides details such as associated owners, location, security requirements, data classification, etc., for the department? Obtain configuration management policy; procedures addressing information system component inventory; information system inventory records; security plan; component installation records; other relevant documents or records and ascertain if :

(I)the organization develops and documents an inventory of the components of the information system:

-that is at the level of granularity deemed appropriate by the organization for the components included in the inventory that are subject to tracking and reporting.

-that includes any information determined to be necessary by the organization to achieve effective property accountability.

-that is consistent with the accreditation boundary of the system.

(ii)the organization maintains the inventory of the components of the information system to reflect the current state of the system.

a. Conducts backups of user-level information contained in the information system [daily incremental; weekly full];

b. Conducts backups of system-level information contained in the information system [daily incremental; weekly full]];

c. Conducts backups of information system documentation including security-related documentation [daily incremental; weekly full]; and

d. Protects the confidentiality, integrity, and availability of backup information at storage locations. ICM Document Solutions has a corporate backup policy. ICM backs up all user, and system level data and maintains documentation that provides the information to recover information from backups. ICM backups are located on secured (encrypted at rest) storage locations and are only accessable by authorized personnel. Implemented Service Provider Corporate ICM-0010_Rev1 N/A N/A Does the institution or department backup user-level and system-level information, system documentation, and security-related documentation consistent with recovery objectives and protect the confidentiality and integrity of backups? Obtain contingency planning policy; contingency plan; procedures addressing information system backup; security plan; backup storage location(s);information system backup test results; other relevant documents or records and ascertain if :

(I)the organization defines the frequency of information systems backups.

(ii)the organization backs up user-level and system-level information (including system state information) in accordance with the organization-defined frequency.

(iii)the organization backs up information to alternate storage sites (if so designated) at a frequency and transfer rate consistent with the organization’s recovery time objectives and recovery point objectives.

(iv)the organization protects backup information at the designated storage locations.

(v)the organization defines in the security plan, explicitly or by…