5-(DOCUM~1.XLS

NIST 800-53 r4 controls

[Control and Control Enhancement]

Implementation Status (Reference on Comments Page )

Documentation

(If you can't meet this control at all please explain why)

a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

g. Monitors the use of, information system accounts;

h. Notifies account managers:

1. When accounts are no longer required;

2. When users are terminated or transferred; and

3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements [At least annually]; and

k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. SecureOne Outsource Solutions, Inc. will be bidding on the conversion portion only of this RFP.

For almost 4 decades we have specialized in large back-file document conversion services. We can convert paper, microfiche, microfilm, aperture cards, and engineering drawings to digital format.

We have converted documents for import into many different document management systems. To include most of the off-the-shelf document management systems, as well as, custom written document management systems for NASA and New York City Department of Finance.

(I) the organization manages information system accounts, including authorizing, establishing, activating, modifying, reviewing, disabling, and removing accounts;

(ii) the organization defines in the security plan, explicitly or by reference, the frequency of information system account reviews and the frequency is at least annually;

(iii) the organization reviews information system accounts in accordance with organization-defined frequency; and

(iv) the organization initiates required actions on information system accounts based on the review.

(v) determine if the organization employs automated mechanisms to support information system account management functions.

(vi) the organization defines in the security plan, explicitly or by reference, a time period for each type of account after which the information system terminates temporary and emergency accounts; and

(vii) the information system automatically terminates temporary and emergency accounts after organization-defined time period for each type of account.

(viii) the organization defines in the security plan, explicitly or by reference, a time period after which the information system disables inactive accounts; and

(ix) the information system automatically disables inactive accounts after organization-defined time period.

(x) the organization employs automated mechanisms to audit account creation, modification, disabling, and termination actions; and

(I) the information system enforces assigned authorizations for controlling access to the system in accordance with applicable policy; and

1) to "authorize" and regulate connections to and from applicable information systems, and [Note: supporting processes can include security considerations when interfaces are created to and from the information system; controlling administrative type access that can enable interface accounts, etc.].

2) to restrict and control the allocation and use of administrative access to information systems?

a. Separates [Assignment: organization-defined duties of individuals];

b. Documents separation of duties of individuals; and

(I) the organization establishes appropriate divisions of responsibility and separates duties as needed to eliminate conflicts of interest in the responsibilities and duties of individuals; and

(I) the organization assigns the most restrictive set of rights/privileges or accesses needed by users for the performance of specified tasks; and

a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

b. Authorizes remote access to the information system prior to allowing such connections. Does the institution or department have policies and processes in place for:

(i) providing secure remote access to information systems, including rules on when privileged access is provided,

(ii) monitoring and authorizing remote access to information systems, and

(iii) enforcing requirements for remote connections to the information system in place?

[Note: Documentation on methods should also include usage restrictions and implementation guidance for each allowed remote access method; secure remote connections include proper configuration and use of encryption; example of privileged remote access include approval(s) required based on business need, and use of stronger authentication such as two-factor]. Obtain access control policy; procedures addressing remote access to the information system; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if

(I) the organization authorizes, monitors, and controls remote access to the information system for all allowed methods of remote access to include both establishment of the remote connection and subsequent user actions across that connection.

(ii) the information system employs automated mechanisms to facilitate the monitoring and control of remote access methods.

a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

b. Authorizes wireless access to the information system prior to allowing such connections.

. Are wireless device(s) and access point(s) securely managed through:

(i) a defined and effective process for authorizing the setting up of wireless access points;

(ii) a defined and documented standard for configuring wireless access points for security;

(iii) having in place a process to regularly review wireless access points for proper configuration and rogue wireless access points; and

(iv) having a defined architecture where wireless access points are properly segregated from wired network (e.g., use of Firewalls)? Obtain access control policy; procedures addressing wireless implementation and usage (including restrictions); NIST Special Publications 800-48 and 800-97; activities related to wireless authorization, monitoring, and control; information system audit records; other relevant documents or records and ascertain if

(I) the organization establishes usage restrictions and implementation guidance for wireless technologies;

(ii) the organization authorizes, monitors, and controls wireless access to the information system; and

(iii) the wireless access restrictions are consistent with NIST Special Publications 800-48 and 800-97.

a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

b. Authorizes the connection of mobile devices to organizational information systems. Are there documented policies, standards, and procedures in place for addressing and enforcing security related to usage of mobile devices (e.g., USB drives, PDAs, Smart Phones, tablets, etc.), including Bring Your Own Device (BYOD)?

[Note: Example controls include: policies that define how such devices are used in context of business; and technical controls such as password requirements to access the device, use of "containers" to segregate confidential information, use of encryption on containers, remote wipe-out capabilities for PDAs/Smartphones, etc.] Obtain access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if

(I) the organization establishes usage restrictions and implementation guidance for organization-controlled portable and mobile devices; and

a. As part of initial training for new users;

b. When required by information system changes; and

c. [Assignment: organization-defined frequency] thereafter. 1. Does the institution or department provide on-going basic security awareness training to all information system users (including department heads, senior executives, and contractors)? Are awareness and training materials updated periodically for addressing relevant security behaviors of the current time based on industry trends, past incidents, etc., as well as indicators of insider threat?

2. Does the organization have targeted training in place for positions with higher risk profile (e.g., system administrators, personnel with access to student records, etc.? Obtain Security awareness and training policy; procedures addressing security awareness training implementation; NIST Special Publication 800-50; appropriate codes of federal regulations; security awareness training curriculum; security awareness training materials; security plan; other relevant documents or records and ascertain if (I)the organization provides basic security awareness training to all information system users (including managers and senior executives) before authorizing access to the system and when required by system changes;

(ii)the security awareness training is consistent with applicable regulations and NIST Special Publication 800-50;

(iii)the security awareness and training materials address the specific requirements of the organization and the information systems to which personnel have authorized access;

(iv)the organization defines in the security plan, explicitly or by reference, the frequency of refresher security awareness training and the frequency is at least annually.

a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of Parameter: [at least weekly]; and

(I)the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity;

(ii)the organization investigates suspicious activity or suspected violations;

(iii)the organization reports findings of inappropriate/unusual activities, suspicious behavior, or suspected violations to appropriate officials; and

a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [all information system and network components where audit capability is deployed/available]

b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3. Does the institution or department have a documented logging standard that defines the minimum requirements for logging (e.g., fields to log, type of events, log protection requirements, retention requirements, etc.)? Obtain audit and accountability policy; procedures addressing audit record generation; security plan; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if :

(I) the organization defines the information system components that provide audit record generation capability for the list of auditable events defined in AU-2;

(ii) the information system provides audit record generation capability, at organization-defined information system components, for the list of auditable events defined in AU-2;

(iii) the information system allows designated organizational personnel to select which auditable events are to be audited by specific components of the system; and

a. Develops a security assessment plan that describes the scope of the assessment including:

1. Security controls and control enhancements under assessment;

2. Assessment procedures to be used to determine security control effectiveness; and

3. Assessment environment, assessment team, and assessment roles and responsibilities;

b. Assesses the security controls in the information system and its environment of operation[at least annually] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

c. Produces a security assessment report that documents the results of the assessment; and

d. Provides the results of the security control assessment to [individuals or roles to include ADOA/ASET]. Does the institution or department have a defined information security program that includes:

i) developing a plan and executing periodic assessments of security control effectiveness;

ii) identifying objective and qualified assessors; and iiI) reporting results of such assessment(s) to the appropriate stakeholders? Obtain security assessment policy; procedures addressing security assessments; security plan; security assessment plan; security assessment report; assessment evidence; security authorization package (including security plan, security assessment report, plan of action and milestones, authorization statement); other relevant documents or records and ascertain if :

(I)the organization defines in the security plan, explicitly or by reference, the frequency of security control assessments and the frequency is at least annually (ii)the organization conducts an assessment of the security controls in the information system at an organization-defined frequency.

a. Establishment of [Assignment: organization-defined metrics] to be monitored;

b. Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring;

c. Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

d. Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; [To meet State of Arizona's requirements]

e. Correlation and analysis of security-related information generated by assessments and monitoring;

f. Response actions to address results of the analysis of security-related information; and

g. Reporting the security status of organization and the information system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency]. Has the institution or department implemented a continuous monitoring program that includes configuration management, ongoing security control assessments, and reporting on the information system and its constituent components? Obtain certification and accreditation policy; procedures addressing continuous monitoring of information system security controls; NIST Special Publications 800-37 and 800-53A; security plan; security assessment report; plan of action and milestones; information system monitoring records; security impact analyses; status reports; security plan; other relevant documents or records and ascertain if:

(I)the organization monitors the security controls in the information system on an ongoing basis.

(ii)the organization employs a security control monitoring process consistent with NIST Special Publications 800-37 and 800-53A.

(iii)the organization conducts security impact analyses on changes to the information system.

Identify -> Critical Information Asset Inventory The organization:

a. Establishes and documents configuration settings for information technology products employed within the information system using [State of Arizona Configuration Baseline (SACB)] that reflect the most restrictive mode consistent with operational requirements;

b. Implements the configuration settings;

c. Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and

d. Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures. Does the institution or department have processes in place to monitor and control changes to the baseline configuration settings of information systems in accordance with organizational policies and procedures? Obtain configuration management policy; procedures addressing configuration settings for the information system; information system configuration settings and associated documentation; NIST Special Publication 800-70; other relevant documents or records and ascertain if:

(I)the organization establishes mandatory configuration settings for information technology products employed within the information system.

(ii)the organization configures the security settings of information technology products to the most restrictive mode consistent with operational requirements.

(iii)the organization documents the configuration settings.

Protect -> Network Access and Perimeter Controls The organization:

a. Configures the information system to provide only essential capabilities; and

b. Prohibits or restricts the use of the following functions, ports, protocols, and/or services: [Assignment: organization-defined prohibited or restricted functions, ports, protocols, and/or services]. Do the institution or department's configuration management procedures include processes for providing only essential functionality and restrict the use of functionality, ports, protocols, and/or services based on risk? Obtain configuration management policy; procedures addressing least functionality in the information system; security plan; information system configuration settings and associated documentation and ascertain if:

(I)the organization defines in the security plan, explicitly or by reference, prohibited or restricted functions, ports, protocols, and services for the information system.

(ii)the organization configures the information system to provide only essential capabilities.

(iii)the organization configures the information system to specifically prohibit and/or restrict the use of organization-defined functions, ports, protocols, and/or services.

(iv)the organization defines in the security plan, explicitly or by reference, the frequency of the information system reviews to identify and eliminate unnecessary functions, ports, protocols, and services; and

Identify -> Critical Information Asset Inventory The organization:

a. Develops and documents an inventory of information system components that:

1. Accurately reflects the current information system;

2. Includes all components within the authorization boundary of the information system;

3. Is at the level of granularity deemed necessary for tracking and reporting; and

4. Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and

b. Reviews and updates the information system component inventory [At least monthly]. 1) Does the institution or department assign owner and custodian to all information and IT assets, and is there an approved document which describes and distinguishes the roles and responsibilities of an owner, custodian, and user? 2) Is there a current and accurate inventory of systems, that provides details such as associated owners, location, security requirements, data classification, etc., for the department? Obtain configuration management policy; procedures addressing information system component inventory; information system inventory records; security plan; component installation records; other relevant documents or records and ascertain if :

(I)the organization develops and documents an inventory of the components of the information system:

-that is at the level of granularity deemed appropriate by the organization for the components included in the inventory that are subject to tracking and reporting.

-that includes any information determined to be necessary by the organization to achieve effective property accountability.

-that is consistent with the accreditation boundary of the system.

(ii)the organization maintains the inventory of the components of the information system to reflect the current state of the system.

a. Conducts backups of user-level information contained in the information system [daily incremental; weekly full];

b. Conducts backups of system-level information contained in the information system [daily incremental; weekly full]];

c. Conducts backups of information system documentation including security-related documentation [daily incremental; weekly full]; and

d. Protects the confidentiality, integrity, and availability of backup information at storage locations. Does the institution or department backup user-level and system-level information, system documentation, and security-related documentation consistent with recovery objectives and protect the confidentiality and integrity of backups? Obtain contingency planning policy; contingency plan; procedures addressing information system backup; security plan; backup storage location(s);information system backup test results; other relevant documents or records and ascertain if :

(I)the organization defines the frequency of information systems backups.

(ii)the organization backs up user-level and system-level information (including system state information) in accordance with the organization-defined frequency.

(iii)the organization backs up information to alternate storage sites (if so designated) at a frequency and transfer rate consistent with the organization’s recovery time objectives and recovery point objectives.

(iv)the organization protects backup information at the designated storage locations.

(v)the organization defines in the security plan, explicitly or by reference, the frequency of information system backup testing.

(vi)the organization conducts information system backup testing in accordance with organization-defined frequency.

2) Are strong authentication controls (e.g., two-factor authentication and proper encryption of credentials) in place for administrative type access to information system(s)? Obtain identification and authentication policy; NIST Special Publication 800-63; procedures addressing user identification and authentication; information system design documentation; e-authentication risk assessment results; information system configuration settings and associated documentation; information system audit records; security plan; other relevant documents or records and ascertain if:

(I)the information system uniquely identifies and authenticates users (or processes acting on behalf of users).

(ii)the information system employs multifactor authentication for remote system access that is NIST Special Publication 800-63 compliant in accordance with the organizational selection of level 3, level 3 using a hardware authentication device, or level 4.

(I)the organization defines the devices for which identification and authentication is required before establishing connections to the information system.

a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, or device identifier;

b. Selecting an identifier that identifies an individual, group, role, or device;

c. Assigning the identifier to the intended individual, group, role, or device;

d. Preventing reuse of identifiers for [at least two years]; and

e. Disabling the identifier after [ninety days for user identifiers].

Control Enhancements: Does the institution or department manage information system identifiers for users and devices by receiving authorization from a designated official to assign a unique user identifier (user-id), preventing reuse of user-ids, and disabling user-ids to information resources and data under their authority? Obtain identification and authentication policy; procedures addressing identifier management; security plan; information system design documentation; information system configuration settings and associated documentation; list of information system accounts; other relevant documents or records and ascertain if :

(I)the organization manages user identifiers by uniquely identifying each user.

(ii)the organization manages user identifiers by verifying the identity of each user.

(iii)the organization manages user identifiers by receiving authorization to issue a user identifier from an appropriate organization official.

(iv)the organization manages user identifiers by issuing the identifier to the intended party.

a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator;

b. Establishing initial authenticator content for authenticators defined by the organization;

c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;

d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators;

e. Changing default content of authenticators prior to information system installation;

f. Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators;

g. Changing/refreshing authenticators [to include sixty days for passwords];

h. Protecting authenticator content from unauthorized disclosure and modification;

i. Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and

j. Changing authenticators for group/role accounts when membership to those accounts changes. 1) Has the institution or department established, documented, and implemented administrative procedures to manage information system authenticators such as passwords, key fobs, certificates, etc., for users and information systems, and ensure user identity when issuing or resetting them? [e.g., establishing and implementing administrative procedures for initial authenticator distribution; changing default content of authenticators upon information system installation, etc., as per institution requirement].

2) Are information system authenticators configured in a manner to reduce risk of "bad actors" from guessing passwords, brute forcing, and/or replaying authenticated sessions? [e.g., if passwords are used, are passwords configured with a reasonable minimum password length with complexity requirements, periodic expiration, encrypted, etc.] Obtain identification and authentication policy; password policy; list of authenticators that require in-person registration; authenticator registration documentation; security plan; procedures addressing authenticator management; information system design documentation; information system configuration settings and associated documentation; list of information system accounts; other relevant documents or records and ascertain if :

(I)the organization manages information system authenticators by defining initial authenticator content.

(ii)the organization manages information system authenticators by establishing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators.

(iii)the organization manages information system authenticators by changing default authenticators upon information system installation.

(iv)the organization manages information system authenticators by changing/refreshing authenticators periodically.

(v) the organization defines the minimum password complexity requirements to be enforced for case sensitivity, the number of characters, and the mix of upper-case letters, lower-case letters, numbers, and special characters including minimum requirements for each type;

(vi) the organization defines the minimum number of characters that must be changed when new passwords are created;

(vii) the organization defines the restrictions to be enforced for password minimum lifetime and password maximum lifetime parameters;

(iv) the organization defines the number of generations for which password reuse is prohibited; and

(ix) the information system, for password-based authentication:

enforces the minimum password complexity standards that meet the organization-defined requirements;

-enforces the organization-defined minimum number of characters that must be changed when new passwords are created;

-encrypts passwords in storage and in transmission;

-enforces the organization-defined restrictions for password minimum lifetime and ---password maximum lifetime parameters;

a. Sanitizes [Assignment: organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and

b. Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information. Has the institution or department implemented procedures to dispose of media containing departmental data in a manner that adequately protects the confidentiality of the data and renders it unrecoverable (e.g., as overwriting or modifying the electronic media to make it unreadable or indecipherable or otherwise physically destroying the electronic media), and in accordance with institutional records retention schedules? Obtain information system media protection policy; procedures addressing media sanitization and disposal; NIST Special Publication 800-88; media sanitization records; audit records; other relevant documents or records and ascertain if :

(I)the organization identifies information system media requiring sanitization and the appropriate sanitization techniques and procedures to be used in the process.

(ii)the organization sanitizes identified information system media, both paper and digital, prior to disposal or release for reuse.

a. Screens individuals prior to authorizing access to the information system; and

b. Rescreens individuals according to [for national security clearances; a reinvestigation is required during the 5th year for top secret security clearance, the 10th year for secret security clearance, and 15th year for confidential security clearance.

(I)the organization screens individuals requiring access to organizational information and information systems prior to authorizing access.

a. Disables information system access within [same day];

b.…