693KA8-24-DRAFTSIR-INVERSE_Attachment J-5 Tailored Security Controls.pdf

INVERSE DRAFT SIR

ATTACHMENT J-5 Tailored Security Controls

693KA8-24-R-XXXXX

ATO Rev5

Ctl No. ATO Rev5 Language INVERSE Tailored Security Control Allocation

SC-18.a For MC-OE, ME-OE, and A-OE systems, acceptable mobile code technologies are as follows:

(1) Mobile code run within the FAA internal networks,

(2) Mobile code as included in the standard configurations of ATO LAN workstations, and

(3) Mobile code required to run automatic updates (e.g., anti-virus updates, patch updates, etc.).

All other mobile code usage, other than those defined in SC-18.a, are not approved unless explicitly identified, documented and included as part of system approved authorization.

For the INVERSE system. acceptable mobile code technologies are as follows:

(1) Mobile code run within the FAA internal networks,

(2) Mobile code as included in the standard configurations of ATO LAN workstations, and

(3) Mobile code required to run automatic updates (e.g., anti-virus updates, patch updates, etc.).

All other mobile code usage, other than those defined in SC-18.a, is not approved.

Spec

CM-04EN02 After implementing an approved change to the system, the System Owner must ensure that the system and privacy security functions are implemented correctly and operating as intended.

After implementing an approved change to the system, the INVERSE Contractor must ensure that the system and privacy security functions are implemented correctly and operating as intended.

SOW

AT-02 The FAA must provide basic Security awareness training (Security Awareness Virtual Initiative (SAVI) and DOT Information Security and Privacy

Awareness Training (SAT)), including recognizing and reporting potential indicators of insider threat, to all system users (including managers, senior executives, and contractors) within 30 days of initial hire, and annually, thereafter, or when there are significant changes in the security environment per FAA Order 1370.121B, FAA Information Security and Privacy: Policy, as amended.

The FAA must increase Security and Privacy awareness of system users using the following techniques: displaying posters, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events.

The FAA must update literacy training and awareness content annually or when there are significant changes in the security environment.

Lessons learned from internal or external security or privacy incidents must be incorporated into literacy training and awareness techniques.

Note: This incorporates the requirements of AT-02EN02.

All INVERSE Contractor staff supporting the FAA must successfully complete the FAA security and privacy awareness training and read and acknowledge the approved FAA Rules of Behavior upon initial support of the FAA and annually thereafter.

SOW

AC-18EN04 As applicable, System Owners must identify and document in the SSP under AC-18EN04, individual user roles authorized to configure wireless networking capabilities.

As applicable, the INVERSE Contractor must identify and document in the SSP under AC-18EN04, individual user roles authorized to configure wireless networking capabilities.

DID

SI-04EN04 MC-OE, ME-OE, and A-OE systems must rely on the NCO and FAA SOC to continuously monitor inbound and outbound communications for unusual or unauthorized activities or conditions.

Vendor provided NAS services (SBSS, FFSP) not monitored by the NCO must continuously monitor inbound and outbound communications for unusual or unauthorized activities or conditions, to include unauthorized access, modification or deletion of information, system, and unauthorized disclosure of FAA SUI, including SSI, PII, SPII, SFD, NAS STI, and ATO CAVI.

For INVERSE assets not connected to the FAA network (A-OE), INVERSE must continuously monitor inbound and outbound communications for unusual or unauthorized activities or conditions, to include unauthorized access, modification or deletion of information, system, and unauthorized disclosure of FAA SUI, including SSI, PII, SPII, SFD, NAS STI, and ATO CAVI.

Spec

SI-04.f FAA-designated entities (NCO, FENS/FTI SOC, FAA SOC) must coordinate monitoring activities with the Office of Emergency Operations (AEO). For INVERSE assets not connected to the FAA network (A-OE), the INVERSE Contractor must coordinate monitoring activities with the Office of Emergency

Operations (AEO).

SOW

SI-04.a.3 The NCO must monitor the MC-OE and ME-OE to detect unauthorized local, network, and remote connections.

A-OE system assets on the FAA MC-OE and ME-OE or FCS Operating Environment(s) must be monitored by the FAA SOC to detect unauthorized local, network, and remote connections, in accordance with FAA Order 1370.121B, as amended.

MC-OE, ME-OE, and A-OE Systems that are not monitored by NCO or FAA SOC must monitor systems to detect unauthorized local, network, and remote connections. This includes vendor-provided NAS services (SBSS, FFSP, etc.).

For INVERSE assets not connected to the FAA network (A-OE), INVERSE must monitor INVERSE assets to detect unauthorized local, network, and remote connections.

Spec

SI-04.b The NCO in conjunction with the FAA SOC must monitor system events, detect attacks and detect and identify unauthorized system use.

Vendor provided Mission Critical Operating Environment services (SBSS, FFSP) not monitored by the NCO must monitor system events, detect attacks and detect and identify unauthorized system use.

For INVERSE assets not connected to the FAA network (A-OE), INVERSE must monitor system events, detect attacks and detect and identify unauthorized system use.

Spec

SI-04.e FAA-designated entities (NCO, FENS/FTI SOC, FAA SOC) must increase monitoring activities whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations or the Nation based upon law enforcement information, intelligence information, or other credible sources of information.

For INVERSE assets not connected to the FAA network (A-OE), the INVERSE Contractor must increase monitoring activities whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations or the Nation based upon law enforcement information, intelligence information, or other credible sources of information.

SOW

SI-04.c FAA-designated entities (e.g., FENS/FTI, FAA SOC) must use monitoring devices that collect essential information at strategic points within the infrastructure and track unauthorized data flows.

For INVERSE assets not connected to the FAA network (A-OE), INVERSE must use monitoring devices that collect essential information at strategic points within the infrastructure and track unauthorized data flows.

Spec

CP-10EN02 For all FIPS 199 MODERATE and HIGH impact transaction-based systems, System Owners must ensure the system implements transaction recovery.

For transaction-based systems utilizing database management systems and transaction processing systems, FAA must support transaction recovery mechanisms including, but not limited to, transaction rollback and transaction journaling.

System Owners must document, in the SSP under CP-10EN02, the transaction recovery process (e.g., transaction rollback or transaction journaling) for systems that are transaction-based (e.g., flight plan filing, e-Gov websites).

For INVERSE assets that are transaction-based, INVERSE must implement transaction recovery.

The INVERSE Contractor must document, in the SSP under CP-10EN02, the transaction recovery process (e.g., transaction rollback or transaction journaling) for systems that are transaction-based (e.g., flight plan filing, e-Gov websites).

Spec/DID

Security Sensitive Information (SSI) - Subject to the Terms and Conditions of the FENS NDA

693KA8-24-R-XXXXX

ATO Rev5

Ctl No. ATO Rev5 Language INVERSE Tailored Security Control Allocation

SI-18 Systems that collect, process or store PII must check the accuracy to verify the relevance, timeliness, impact, completeness, and de-identification of that information across the system life cycle.

The Privacy Act requires individuals to be active participants in making decisions regarding the use, collection, and accuracy of their information. Individuals must have a reasonable opportunity to make informed decisions regarding the collection and use of their PII. PII must be collected directly from the affected individual.

System Owners must check for and correct or delete data as necessary throughout the system life cycle including:

(1) Inaccurate or outdated PII.

(2) PII of incorrectly determined impact.

(3) Incorrectly de-identified PII.

(4) Improperly disposed PII.

(5) Delete PII upon request by individuals or their designated representatives.

(6) Notify individuals when PII has been corrected or deleted.

For PII collected or processed by INVERSE, the INVERSE Contractor must check the accuracy to verify the relevance, timeliness, impact, completeness, and de-identification of that information across the system life cycle.

The Privacy Act requires individuals to be active participants in making decisions regarding the use, collection, and accuracy of their information. Individuals must have a reasonable opportunity to make informed decisions regarding the collection and use of their PII. PII must be collected directly from the affected individual.

The INVERSE Contractor must check for and correct or delete data as necessary throughout the system life cycle including:

(1) Inaccurate or outdated PII.

(2) PII of incorrectly determined impact.

(3) Incorrectly de-identified PII.

(4) Improperly disposed PII.

(5) Delete PII upon request by individuals or their designated representatives.

(6) Notify individuals when PII has been corrected or deleted.

SOW

CM-08.a In addition to the HW/SW table contained in the SCD, System Owners must develop, document, and submit annually an inventory of system assets that:

(1) Ensures that the inventory accurately reflects the current system baseline,

(2) Includes all system components,

(3) Does not include duplicate components or components assigned to other systems,

(4) Ensure that the inventory is at a level of granularity deemed necessary for tracking and reporting, and

(5) Includes an inventory of physical and virtual system components to include, but not limited to: servers, workstations, mobile devices, databases, network devices, data diodes, firewall devices and associated Operating Systems, IP addresses, host/machine names, applications, installed software, etc.

Systems that employ cloud-hosted services must include a list of all Infrastructure as a Service (IaaS) Virtual machines, Platform as a Service

(PaaS), Software as a Service (SaaS), Storage components, operating systems, databases, etc.

Note: This includes the requirements from CM-07EN09 and CM-08EN05.

For system components under its control that support the delivery and/or operation of INVERSE services, the INVERSE Contractor must develop, document, and submit annually maintain (in the SCD) an inventory of system assets that:

(1) Accurately reflects the current information system baseline;

(2) Includes all components within the authorization boundary of the information system;

(3) Does not include duplicate components or components assigned to other systems,

(4) Is at the level of granularity deemed necessary for tracking and reporting; and

(5) Includes system assets and facility location where assets are hosted.

(6) Includes an inventory of physical and virtual system components to include, but not limited to: servers, workstations, mobile devices, databases, network devices, data diodes, firewall devices and associated Operating Systems, IP addresses, host/machine names, applications, installed software, etc.

For cloud-hosted systems, services and assets, the INVERSE Contractor must include a list of all Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), Virtual machines, Storage components, operating systems, databases, etc.

The INVERSE Contractor must provide a copy of or access to the component inventory upon the FAA's request.

DID

SI-03.c.2 In response to malicious code detection, MC-OE, ME-OE, and A-OE systems must configure the malicious code protection mechanisms to block or quarantine the malicious code.

In response to malicious code detection, the malicious code detection mechanism must be configured to send alerts to the system administrator or responsible personnel, as documented in the System and Information Integrity procedures.

In response to malicious code detection, INVERSE must block or quarantine the malicious code.

In response to malicious code detection, INVERSE must send alerts to the NCO and FAA SOC, as documented in the System and Information Integrity procedures.

Spec

SI-07EN07 In the event an unauthorized change is detected, System Owner must alert the NCO and/or FAA SOC in accordance with the system's documented Incident Response procedures.

ATO requires email notification to the NCO for all security related incidents, including incidents involving changes to the system integrity.

In the event an unauthorized change is detected, INVERSE must alert the NCO and/or FAA SOC in accordance with the system's documented Incident Response procedures.

The INVERSE Contractor must send an email notification to the NCO for all security related incidents, including incidents involving changes to the system integrity.

Spec

CP-07EN01 System Owners of Moderate or High Availability systems must identify an alternate processing site separate and geographically distinct from the primary processing site so as not to be susceptible to the same hazards and threats.

FAA must determine an adequate distance separation between the primary site and the alternate site based on an analysis many risk factors including, but not limited to the following:

(1) Weather (e.g., tornados, hurricanes, frequency of ice and snowstorms, etc.). The primary and alternate sites must not be affected by the same weather event.

(2) Earthquake zones and fault lines. The primary and alternate sites must not be affected by the same seismic event.

(3) Proximity to areas susceptible to flooding (e.g., near dams, flood plains, rivers and streams, etc.). The primary and alternate sites must not be affected by the same flooding event.

(4) Availability of utilities (e.g., water, electrical, sewage, natural gas, communications facilities, Internet access, and other necessary utilities).

The primary and alternate sites must not be affected by the same loss of utilities.

(5) Proximity to high-value targets (e.g., military installations, power plants, etc.), the primary and alternate sites must not be affected by disrupting events at neighboring high-value targets.

(6) Availability of access (e.g., highways, local roads, bridges, etc.). The primary and alternate sites must not be dependent upon the same access routes.

(7) Closeness to tourist areas that may be susceptible to increase traffic during certain times of the year. The primary and alternate sites must not be affected by same seasonal activities in the region.

The alternate processing must be located in a facility approved by the DOT CIO for the hosting of Departmental systems and must be

INVERSE alternate processing sites must be sufficiently separated from the primary processing site so that they are not susceptible to the same regional natural disasters as the primary site.

Spec

693KA8-24-R-XXXXX

ATO Rev5

Ctl No. ATO Rev5 Language INVERSE Tailored Security Control Allocation

IA-

05EN02.a.2

Mission Critical and Mission Essential Operating Environments

The IAM enterprise service must provide a directory service that maps authenticated identity information to digital credential accounts.

Administrative Operating Environment

System assets connected to the Mission Support domain that use PKI-based authentication must map the authenticated identity to the user account.

INVERSE assets connected to the ASNC (Mission Support domain) that use PKI-based authentication must map the authenticated identity to the user account. Spec

IA-

05EN02.a.1

Mission Critical and Mission Essential Operating Environments

The IAM enterprise service must prevent unauthorized access to private keys used by the PKI Credential Issuance, Renewal and Revocation

Service and encrypt keys in accordance with the requirements of SC-13.

Administrative Operating Environment

System assets connected to the Mission Support domain that use PKI-based authentication must protect private keys from unauthorized disclosure and/or modification via access enforcement.

INVERSE assets connected to the ASNC (Mission Support domain) that use PKI-based authentication must protect private keys from unauthorized disclosure and/or modification via access enforcement.

Spec

IA-08EN01 System assets connected to the Mission Support domain must accept and electronically verify PIV-compliant credentials from other federal agencies.

Note: This requirement has been tailored out for OPIP connected assets. PIV-based user authentication must not be implemented for assets residing in the MC-OE or ME-OE.

INVERSE assets connected to the ASNC must accept and electronically verify PIV-compliant credentials from other federal agencies. Spec

IA-08EN02 System assets connected to the Mission Support domain must accept only NIST-approved external authenticators. System Owners must document and maintain a list of accepted external authenticators.

Note: This requirement has been tailored out for OPIP connected assets. PIV-based user authentication must not be implemented for assets residing in the MC-OE or ME-OE.

INVERSE assets connected to the ASNC must accept only NIST-approved external authenticators. System Owners must document and maintain a list of accepted external authenticators.

Spec

IA-08EN04 System assets connected to the Mission Support domain must conform to NIST-issued profiles for identity management and must accept only non-organizational user credential that meet the NIST-issued profile standards.

Note: This requirement has been tailored out for OPIP connected assets. PIV-based user authentication must not be implemented for assets residing in the MC-OE or ME-OE.

INVERSE assets connected to the ASNC must conform to NIST-issued profiles for identity management and must accept only non-organizational user credential that meet the NIST-issued profile standards.

Spec

IA-

05EN02.b.1

Mission Critical and Mission Essential Operating Environments (MC-OE, ME-OE)

The IAM enterprise service must validate, in real-time, PKI credentials that are used for accessing OPIP assets by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Administrative Operating Environment (A-OE)

System assets connected to the Mission Support domain that use PKI-based authentication must validate certificates by constructing and verifying a certification path to an accepted trust anchor.

INVERSE assets connected to the ASNC that use PKI-based authentication must validate certificates by constructing and verifying a certification path to an accepted trust anchor.

Spec

IA-02EN12 MC-OE and ME-OE and A-OE System assets connected to the Mission Support domain must be capable of using PIV credentials in accordance with FIPS Publication 201.

For MC-OE and ME-OE System assets connected to the OPIP network, the ATO has tailored this control out and PIV-based user authentication must not be implemented for assets residing in the MC-OE and ME-OE.

For MC-OE and ME-OE Systems not connected to any shared LAN/WAN this requirement has been tailored out, provided physical security requirements are satisfied.

Note: Also see requirements for IA-02EN01.

INVERSE assets connected to the INVERSE ASNC must be capable of using PIV credentials in accordance with FIPS Publication 201. Spec

IA-

05EN02.b.2

Mission Critical and Mission Essential Operating Environments

If required by system availability parameters, MC-OE and ME-OE systems that utilize IAM services must maintain a local cache of Certificate

Revocation List (CRL) information to provide continued authenticated access during a loss of IAM service.

Administrative Operating Environment

System assets connected to the Mission Support domain that use PKI-based authentication must implement a local cache of revocation data to support path discovery and validation.

INVERSE assets connected to the Mission Support domain that use PKI-based authentication must implement a local cache of revocation data to support path discovery and validation.

Spec

SI-03.c.1 MC-OE, ME-OE, and A-OE systems must be configured to perform real-time scans of files from external sources as the files are downloaded, opened, or executed.

MC-OE, ME-OE, and A-OE systems with assets located in the IAP DMZ and Mission Support domain must be configured to perform scans, at least monthly.

MC-OE systems in the NESG DMZ and Mission Support domain must identify and document in the SSP under SI-03.c.1, the frequency of scans and provide rationale for not meeting weekly scan requirements.

INVERSE assets must be configured to perform real-time scans of files from external sources as the files are downloaded, opened, or executed.

INVERSE assets located in the IAP DMZ and Mission Support domain must be configured to perform scans, at least monthly.

Spec

SC-45EN01 Systems connected to the OPIP network must use the FENS/FTI NTP common time source.

System Owners must ensure that systems and system assets, where applicable, are correctly configured to synchronize time successfully and regularly with an authoritative time source. When a non-GPS alternative authoritative time source is implemented at the Agency level, systems must be synchronized to that authoritative source.

INVERSE assets must be configured to synchronize system clocks against an FAA approved time source. Spec

SC-20.b FAA authoritative name servers, when operating as part of a distributed, hierarchical namespace, must maintain delegation signer (DS) resource records for all child zones.

INVERSE authoritative name servers, when operating as part of a distributed, hierarchical namespace, must maintain delegation signer (DS) resource records for all child zones.

693KA8-24-R-XXXXX

ATO Rev5

Ctl No. ATO Rev5 Language INVERSE Tailored Security Control Allocation

SC-07.c.1 Connections between the MC-OE and any other operating environment must occur through an ATO AO-approved boundary protection infrastructure. Examples of ATO AO-approved boundary protection infrastructures for bi-directional communications with the MC-OE are the

NAS Enterprise Security Gateway (NESG) and the Remote Management Access Gateway (RMAG). The NESG is used for providing data exchange between the MC-OE and ME-OE for data exchange (machine-machine connections) and is not intended for system remote management access. The RMAG is used to for providing authorized users with secure remote access from the MC-OE to the ME-OE for management and administration (user-machine connections).

Connections between the ME-OE and any other operating environment other than the MC-OE must occur through an ATO AO-approved segregation infrastructure. All other interconnections are prohibited. An example of an ATO AO approved segregation infrastructure for communication with the A-OE is the Enterprise - Operational Support Environment (E-OSE). An example of an ATO AO approved segregation infrastructure for communication with external vendor operating environments is the Vendor Management Access Gateway (VMAG).

Operating environment external interfaces must be in accordance with ATO Order JO 1370.114, as amended.

A-OE system assets must use one of the FAA approved IAPs or extranet connections to connect to external networks.

Note 1: This incorporates the requirements of SC-07EN04.a.

Note 2: JO 1370.114 will be superseded by JO 1370.129, “Information Security Requirements for Federal Aviation Administration (FAA)

Telecommunications Services in the Mission Critical and Mission Essential Operating Environments”, after it has been signed and published.

INVERSE connections between the MC-OE and any other operating environment must occur through an ATO AO-approved boundary protection infrastructure.

INVERSE connections between the ME-OE and any other operating environment other than the MC-OE must occur through an ATO AO-approved segregation infrastructure. All other interconnections are prohibited.

INVERSE A-OE system assets must use one of the FAA approved IAPs or extranet connections to connect to external networks.

Spec

AU-05.b.1 Personnel receiving alerts must take the following actions based on receiving an audit processing failure alert:

(1) When there is a failure in the system event generation /audit capturing mechanism; the system administrator must perform a controlled restart of the system or a controlled restart of the auditing mechanism.

(a) If the system event generation/audit capture function is not available, the controlled restart should occur manually when the next maintenance window becomes available.

(2) Follow system-level procedures for audit storage capacity being reached or exceeded.

INVERSE Contactor personnel receiving alerts must take the following actions based on receiving an audit processing failure alert:

(1) When there is a failure in the system event generation /audit capturing mechanism; the system administrator must perform a controlled restart of the system or a controlled restart of the auditing mechanism.

a. If the system event generation/audit capture function is not available, the controlled restart should occur manually when the next maintenance window becomes available.

(2) Follow system-level procedures for audit storage capacity being reached or exceeded.

SOW

IA-05.e System Owners must change default authenticator content prior to first use. INVERSE Contractor must change default authenticator content prior to first use. SOW

AC-02EN05 Users must log out when departing from the immediate area of the workstation, server, or networking device or assets.

Users of MC-OE and ME-OE operational ICS assets, as defined in IA-02.2, are exempt from this requirement.

INVERSE Contractor personnel must log out when departing from the immediate area of the workstation, server, or networking device or assets, in compliance with the FAA Rules of Behavior (found in FAA Order 1370.121B).

SOW

SC-21 MC-OE and ME-OE DNS servers must configure DNSSEC to implement data origin authentication and data integrity validation for resolution responses the system receives from authoritative sources when requested by client systems, in accordance with NIST 800-81-2.

A-OE servers that use DNS, must use DNS services provided by Shared Services (AFN).

INVERSE DNS servers must configure DNSSEC to implement data origin authentication and data integrity validation for resolution responses the system receives from authoritative sources when requested by client systems, in accordance with NIST 800-81-2.

Spec

SI-08EN02 Systems that implement mail servers must automatically update spam protection mechanisms. INVERSE mail servers must be configured to automatically update spam protection mechanisms. Spec

AC-19EN05 Mobile computers and devices must employ full-device encryption to protect the confidentiality and integrity of sensitive information in accordance with the FAA Order 1370.121B, as amended, and the NAS Security Advisory for USB Drives dated February 13, 2013.

INVERSE mobile computers and devices must employ full-device encryption to protect the confidentiality and integrity of sensitive information in accordance with the FAA Order 1370.121B, and the NAS Security Advisory for USB Drives dated February 13, 2013.

Spec

AU-04.1 All system assets (MC-OE, ME-OE, A-OE, and Service Provider's assets) capable of generating audit logs, must allocate sufficient storage capacity to store 14 days of security-relevant audit records in online storage.

OPIP network connected Systems must send generated audit logs to the NCMS enterprise service for storage. The NCMS must allocate sufficient storage capacity to store 14 days of security-relevant audit records in online storage.

Systems must configure the system auditing capacity to reduce the likelihood of audit record storage capacity being exceeded (e.g., provide

25% capacity above estimated need).

INVERSE must allocate sufficient storage capacity to store 14 days of security-relevant audit records in online storage.

INVERSE must configure the system auditing capacity to reduce the likelihood of audit record storage capacity being exceeded (e.g., provide 25% capacity above estimated need).

Spec

IA-05EN01.f The System must allow users to select long password and passphrases, including spaces and all printable characters. INVERSE must allow users to select long password and passphrases, including spaces and all printable characters. Spec

AC-02EN02 Systems must automatically disable or remove temporary and emergency user accounts within 24 hours after the need for the account is no longer valid.

INVERSE must automatically disable or remove temporary and emergency user accounts within 24 hours after the need for the account is no longer valid. Spec

AC-02EN03 Systems must automatically disable user accounts (Operating System and Application) after 90 days that:

(1) Have expired;

(2) Are no longer associated with a user or individual;

(3) Are in violation of organizational policy; or

(4) Have been inactive for 90 days.

ICS Tailoring: Local logical access accounts for ICS assets are exempt from implementation of the requirement. However, ICS tailoring and compensating controls must be documented in the SSP.

Note: This is being required for all systems, including LOW, to be compliant with the requirements of IA-04.e.

INVERSE must automatically disable user accounts (Operating System and Application) after 90 days that:

(1) Have expired;

(2) Are no longer associated with a user or individual;

(3) Are in violation of organizational policy; or

(4) Have been inactive for 90 days.

Spec

AC-12 Systems must automatically terminate a user initiated logical session after 30 minutes of user inactivity. INVERSE must automatically terminate a user initiated logical session after 30 minutes of user inactivity. Spec

693KA8-24-R-XXXXX

ATO Rev5

Ctl No. ATO Rev5 Language INVERSE Tailored Security Control Allocation

AU-05.a Systems must be configured to alert at least one of the following in the event of an audit processing failure (e.g. software/hardware errors, failure in audit capturing mechanisms, audit storing capacity being reached or exceeded):

(1) The centralized audit service provider (NCMS),

(2) The System Operations Center (SOC), or

(3) System Administrator.

System must define their reporting timeframe in the SSP under AU-05.a.

INVERSE must be configured to alert each of the following entities in the event of an audit processing failure (e.g., software/hardware errors, failure in audit capturing mechanisms, audit storing capacity being reached or exceeded):

(1) NAS Cyber Operations (NCO),

(2) The FAA System Operations Center (SOC), and

(3) INVERSE System Administrator/INVERSE Security Operations Control Center (SOCC)

Spec

AC-07.b System assets must be configured to automatically:

(1) Notify System Administrator, or

(2) Lock the account for 15 minutes or until released by an administrator when the maximum number of unsuccessful attempts is exceeded.

The control applies regardless of whether the login occurs via a local or network connection.

ICS Tailoring: Local logical access accounts for ICS assets are exempt from (2) - Locking accounts. ICS assets, when technically feasible, must notify System Administrators (1) of 5 failed login attempts within 15 minutes. ICS tailoring and compensating controls must be documented in the SSP.

Note: ICS tailoring does not exempt this requirement for any Non-local Access and Administration.

INVERSE must be configured to either automatically:

(1) Lock the account for 15 minutes before unlocking the account, or

(2) Lock the account until released by an administrator, when the maximum number of unsuccessful attempts is exceeded. The control applies regardless of whether the login occurs via a local or network connection.

Spec

SC-

07EN04.h

System must block or prohibit management control/port traffic originating from an unauthorized external network/system. INVERSE must block or prohibit management control/port traffic originating from an unauthorized external network/system. Spec

IA-05.f Systems must change/refresh authenticators in accordance with the applicable Secure Configuration Baseline Standards:

(1) CIS, or

(2) DISA STIG, or

(3) USGCB, or

(4) Vendor/Industry Best Practice (when the above secure baseline standards are unavailable)

ICS Tailoring: Local logical access accounts for ICS assets are exempt from changing/refreshing authenticators in accordance with the above referenced baselines. ICS tailoring and compensating controls must be documented in the SSP. Any remote or non-local access is not exempt from this requirement.

Note: Password expiration varies depending upon OS baseline standard.

INVERSE must change/refresh authenticators in accordance with the applicable Secure Configuration Baseline Standards:

(1) CIS, or

(2) DISA STIG, or

(3) USGCB, or

(4) Vendor/Industry Best Practice (when the above secure baseline standards are unavailable)

Spec

SI-07 Systems must deploy integrity verification tools to detect unauthorized changes to software and configuration.

Legacy MC-OE and ME-OE systems that are unable to implement mechanisms to detect unauthorized changes to software and configuration must implement compensating configuration management controls and document these compensating controls in the SSP under SI-07.

INVERSE must deploy mechanisms to detect unauthorized changes to software and configuration. Spec

AC-08.b System assets must display the notification message or banner on the screen until users take explicit actions to acknowledge the notification.

ICS Tailoring: Local logical access accounts for ICS assets are exempt from this requirement. ICS tailoring and compensating controls must be documented in the SSP.

Note: ICS tailoring does not exempt this requirement for any non-local or remote access.

INVERSE must display the notification message or banner on the screen until users take explicit actions to acknowledge the notification. Spec

SC-13 Systems that implement cryptography must document those assets that use cryptography and the type of cryptography used, in the SSP under SC-13.

Systems must implement cryptographic modules for the encryption requirements defined in IA-05.g and SC-08 to comply with encryption standards approved by ATO in compliance with FAA Order 1370.121B, as amended.

The INVERSE Contractor must document assets that use cryptography and the type of cryptography used, in the SSP.

INVERSE must implement cryptographic modules for the encryption requirements defined in IA-05.g and SC-08 to comply with encryption standards approved by

ATO in compliance with FAA Order 1370.121B.

SOW/Spec

CM-

08EN03.a

The OPIP and Mission Support infrastructures must employ automated mechanisms (e.g., sensors, IDS/IPS) to detect the presence of unauthorized hardware, software, and firmware components through LAN/WAN data monitoring/modeling.

INVERSE must employ automated mechanisms, including LAN/WAN data monitoring/modeling, to detect the presence of unauthorized hardware, software, and firmware components visible to INVERSE monitoring and control functions.

Spec

IA-05EN01.g The System must employ automated tools to assist the user in selecting strong password authenticators. INVERSE must employ automated tools to assist the user in selecting strong password authenticators. Spec

SI-03.a Systems Owners must employ malicious code protection mechanisms (e.g., anti-virus software for workstations, IDS at the boundaries) for assets associated with the following:

(1) Network boundaries (may be implemented via NESG or IAP),

(2) All Windows devices (e.g., workstations, servers, web servers, or mobile computing devices),

(3) All externally facing web servers for all operating systems (or via gateway virus protection),

(4) All mail servers (all operating systems), and

(5) All externally facing FTP servers for all operating systems (or via gateway virus protection).

INVERSE must employ malicious code protection mechanisms (e.g., anti-virus software for workstations, IDS at the boundaries) for assets associated with the following:

(1) Network boundaries,

(2) All Windows devices (e.g., workstations, servers, web servers, or mobile computing devices),

(3) All externally facing web servers for all operating systems (or via gateway virus protection),

(4) All mail servers (all operating systems), and

(5) All externally facing FTP servers for all operating systems (or via gateway virus protection).

Spec

SI-10.2 Systems must employ the following information checking functionality for information types specified in SI-10.1, above, as follows:

(1) Check for accuracy, completeness, validity, and authenticity as close to the point of origin as possible in accordance with policy and operational requirements;

(2) Check the syntax of information inputs to verify that it matches specified format and content definitions; and

(3) Prescreen information inputs passed to interpreters to prevent the content from being unintentionally interpreted as commands.

INVERSE must employ the following information checking functionality for information types specified in SI-10.1, above, as follows:

(1) Check for accuracy, completeness, validity, and authenticity as close to the point of origin as possible in accordance with policy and operational requirements;

(2) Check the syntax of information inputs to verify that it matches specified format and content definitions; and

(3) Prescreen information inputs passed to interpreters to prevent the content from being unintentionally interpreted as commands.

693KA8-24-R-XXXXX

ATO Rev5

Ctl No. ATO Rev5 Language INVERSE Tailored Security Control Allocation

SC-28EN02 ATO systems must encrypt all data at rest including offline storage using approved cryptographic modules in accordance with the encryption requirements of SC-28.

NAS Mission Critical and Mission Essential systems that use offline backup and recovery data stored in secure FAA facilities are exempt from using encryption.

INVERSE must encrypt all data at rest including offline storage using approved cryptographic modules in accordance with the encryption requirements of SC-28.

INVERSE assets that use offline backup and recovery data stored in secure FAA facilities are exempt from using encryption.

Spec

SC-28 ATO systems must encrypt all data at rest using approved cryptographic modules.

Currently installed cryptographic modules not compliant with NIST FIPS 140-2 “Security Requirements for Cryptographic Modules" must be replaced with FIPS 140-2 (Valid Until 2026) or NIST FIPS 140-3 compliant encryption mechanisms. Newly installed cryptographic modules must be compliant with NIST FIPS 140-3, when available.

Note 1: Examples of data includes but not limited to mission data, Access Control Lists (ACLs), Configurations and/or rule sets for firewalls, gateways, intrusion detection/prevention systems, and filtering routers.

Note 2: Encryption may be implemented at the whole disk level or at the database level to achieve compliance.

Note 3: Examples of data storage devices includes local systems, network drives, laptops, portable storage devices, and mobile devices with storage capability.

Note 4: This incorporates the requirements of SC-28EN01.

INVERSE must encrypt all data at rest using approved cryptographic modules. Spec

SC-

08EN01.2

FAA Service Providers (Vendors) of MC-OE and ME-OE systems that are not using the FENS/FTI OPIP network must provide FIPS 140-2 compliant encryption of internal interfacility telecommunication and WAN requirements to protect transmission integrity and confidentiality.

This requirement must be included in the service level agreement with the shared service provider (i.e., SBSS, FENS/FTI, FFSP).

Note: Protection of authenticators is addressed in IA-05.h.

INVERSE must encrypt all traffic that is not transmitted via FENS. Spec

AC-07.a System assets must enforce a limit of 5 consecutive invalid attempts within a 15 minute period.

ICS Tailoring: Local logical access accounts for ICS assets are exempt from this requirement. ICS tailoring and compensating controls must be documented in the SSP.

Note: ICS tailoring does not exempt this requirement for any non-local or remote access.

Definitions:

(1) Local logical access is direct access on a machine or access from one machine to another on the system controlled facility LAN.

(2) Non-local access is across the FAA controlled WAN or other network within the facility not under the control of the system.

(3) Remote access is external to the domain.

INVERSE must enforce a limit of 5 consecutive invalid attempts within a 15-minute period. Spec

AC-03 Systems must enforce the access control technical policies and privileges for all operating system and application accounts, as defined in the

SSP under AC-02, including enhancements, through the use of access control mechanisms.

Note: This incorporates the LOGICAL access restriction requirements of AC-05.c, CP-09.d, and MA-02.b.

INVERSE must enforce the access control technical policies and privileges for all operating system and application accounts, as defined in the SSP under AC-02, including enhancements, through the use of access control mechanisms.

Spec

IA-

05EN01.b

The system must ensure all new or updated user passwords are not found on the list of commonly-used, expected, or compromised passwords.

Note: List of commonly-used, expected, and compromised passwords found in IA-05EN01.a

INVERSE must ensure that all new or updated user passwords are not found on the list of commonly-used, expected, or compromised passwords.

Note: List of commonly-used, expected, and compromised passwords found in IA-05EN01.a

Spec

IA-05.bc System Owners must ensure that authenticator strength (i.e., length, complexity) is in accordance with the applicable Secure Configuration

Baseline Standards:

(1) CIS, or

(2) DISA STIG, or

(3) USGCB, or

(4) Vendor/Industry Best Practice (when the above secure baseline standards are unavailable)

The System Owner must also ensure that initial authenticators issued by the system are in accordance with the same Secure Configuration

Baseline Standards.

ICS Tailoring: Local logical access accounts for ICS assets are exempt from the authenticator strength requirement in accordance with the above referenced baselines. ICS tailoring and compensating controls must be documented in the SSP. Any remote or non-local access is not exempt from this requirement.

Note: This incorporates the requirements of IA-05EN01.h.

INVERSE must ensure that authenticator strength (i.e., length, complexity) is in accordance with the applicable Secure Configuration Baseline Standards:

(1) CIS, or

(2) DISA STIG, or

(3) USGCB, or

(4) Vendor/Industry Best Practice (when the above secure baseline standards are unavailable)

The INVERSE Contractor must also ensure that initial authenticators issued by the system are in accordance with the same Secure Configuration Baseline

Standards.

693KA8-24-R-XXXXX

ATO Rev5

Ctl No. ATO Rev5 Language INVERSE Tailored Security Control Allocation

AU-02.a.1 Systems must generate audit logs for both Operating System and Application level events for local, non-local, and remote sessions on all devices capable of generating event logs. The following minimum events must be captured and recorded:

(1) Resource degradation alerts (e.g., 100% utilization, disk space full, volume full),

(2) Login and logout, successful and unsuccessful,

(3) Account creation/modification and permissions or configuration changes,

(4) Administrator level activities,

(5) Startup/Shutdown of System/Services/processes,

(6) Access to privileged functions (e.g., setting auditable event and intrusion detection devices) including maintenance,

(7) Results from malicious code protection (as capable),

(8) Access control list denials (as capable), and

(9) IDS signature based attacks (as capable).

OPIP network connected assets must send generated audit logs to the NAS Cyber Management System (NCMS) enterprise service.

System Owners of assets that are not connected to any shared LAN/WAN environment must document the specific assets for which the requirement cannot be satisfied.

Note: This incorporates the auditing requirements from AC-02.g, AC-06EN09, AU-02.c, AU-12.c, and MA-04EN01.a.

INVERSE must generate audit logs for both Operating System and Application level events for local, non-local, and remote sessions on all devices capable of generating event logs. The following minimum events must be captured and recorded:

(1) Resource degradation alerts (e.g., 100% utilization, disk space full, volume full),

(2) Login and logout, successful and unsuccessful,

(3) Account creation/modification and permissions or configuration changes,

(4) Administrator level activities,

(5) Startup/Shutdown of System/Services/processes,

(6) Access to privileged functions (e.g., setting auditable event and intrusion detection devices) including maintenance,

(7) Results from malicious code protection,

(8) Access control list denials, and

(9) IDS signature based attacks.

INVERSE must send generated audit logs to the NAS Cyber Management System (NCMS) enterprise service as defined in Attachment J-8b.

Spec

AU-12.c Systems must generate audit records based on the event types defined in AU-02.a.1. Audit record contents must meet the requirements defined in AU-03.1.

INVERSE must generate audit records based on the event types defined in AU-02.a.1. INVERSE audit record contents must meet the requirements defined in AU-

03.1.

Spec

AU-03.1 System assets must generate audit records that contain the type of event, date, time, system source (asset name and IP address) where the event occurred, user/subject identification, outcome of the event (success/failure), and session ID if applicable.

System Owners of MC-OE and ME-OE assets that are not connected to any shared LAN/WAN environment must document rationale for deviating from these requirements in the SSP.

Note: This contains the requirements of AU-12.c.

INVERSE must generate audit records that contain the type of event, date, time, system source (asset name and IP address) where the event occurred, user/subject identification, outcome of the event (success/failure), and session ID if applicable.

Spec

SI-11.a Systems must generate error messages for corrective actions without revealing sensitive information or information that could be exploited by adversaries (for example information such as software versions, directory locations of files, potential passwords, usernames, FAA sensitive information, privacy sensitive information, etc.).

INVERSE must generate error messages without revealing, in error logs or administrative messages, sensitive information (e.g., passwords, PII) or information that could be exploited by adversaries.

Spec

SC-07EN05 System Owners must ensure:

(1) All FAA systems with connections to external systems implement a deny-by-default and allow-by-exception policy for controlling network communications traffic.

(2) Verify the deny-all allow-by exception policy through implementation of continuous monitoring.

INVERSE must implement a deny-by-default and allow-by-exception policy for controlling network communications traffic at external interfaces.

The INVERSE Contractor must verify the deny-all allow-by exception policy through implementation of continuous monitoring.

SOW/Spec

SI-02EN02 System Owners must implement an automated mechanism to determine the current patch level for the following Operating Environment connected assets and appliances:

(1) IAP DMZ,

(2) Mission-support connected systems/assets, and

(3) Cloud implementations.

MC-OE and ME-OE systems connected to the OPIP must implement a manual process to determine the current patch level of system assets and appliances in conjunction with asset inventory and configuration management process.

INVERSE must implement an automated mechanism to determine the current patch level of all INVERSE devices. Spec

AC-17EN02 The system must implement cryptographic mechanisms, or obtain enterprise remote access encryption services (e.g., FRAC) to protect the confidentiality and integrity of data during Remote Data Exchange and Remote Access & Administration (RAA) sessions.

INVERSE must implement cryptographic mechanisms to protect the confidentiality and integrity of data as part of external boundary protection for remote management access as defined in the Functional and Performance Specification.

Spec

SC-

08EN01.1

MC-OE and ME-OE systems must use the authorized FTI services for all internal interfacility telecommunication and WAN requirements to protect transmission integrity and confidentiality.

A-OE systems must implement encryption and use the authorized FTI Mission Support services for all interfacility telecommunication and

WAN requirements to protect transmission integrity and confidentiality.

Note: The FAA is using a private NAS IP WAN (OPIP) as an alternative physical measure in lieu of cryptography to support integrity.

INVERSE must implement encryption and use the authorized FENS ASNC services for all interfacility telecommunication and WAN requirements to protect transmission integrity and confidentiality.

Spec

IA-02EN02 MC-OE, ME-OE, and A-OE system assets connected to the Mission Support domain (LAN or WAN) must use multifactor authentication when accessing non-privileged user accounts.

The ATO has tailored this control out for MC-OE and ME-OE assets in NAS operational facilities. PIV-based user authentication must not be implemented for assets residing in the OPIP domain.

OPIP domain assets located in non-operational facilities must use multifactor authentication for LAN/WAN access to non-privileged accounts, or secure the area where assets are located in accordance with the physical security requirements of NAS operational facilities, per the requirements of IA-02EN01.

INVE…