FAA_Order_1370.121.pdf

Distribution: Electronic Initiated By: AIS-1

Consistent with the Federal Information Security Modernization Act of 2014 (FISMA), Office of Management and Budget (OMB) Circular A-130, Federal policies, related laws, regulations, and other mandatory guidance and standards related to information security, information assurance, network security, and privacy, the Federal Aviation Administration (FAA) must protect the confidentiality, integrity, and availability of all FAA information and information systems.

The FAA maintains information and information systems that support the Agency, aviation safety and security, and the National Airspace System (NAS). FAA information systems rely on comprehensive information security to insure proper operation and protect against unauthorized access. This order establishes the FAA National Information Security and Privacy (IS&P) Program and Policy. The FAA Chief Information Security Officer (CISO) developed this FAA National IS&P Program and Policy through a collaborative effort involving cross-organizational security representatives from all FAA Lines of Business (LOB) and Staff Offices (SO).

The core component of the FAA IS&P Program and Policy is the formal adoption of the Department of Transportation (DOT) Cybersecurity Compendium, the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4, Presidential directives, Executive Orders, OMB Memorandums, Department of Defense (DOD) requirements (as appropriate), Department of Homeland Security (DHS) cybersecurity guidelines, Federal Risk and Authorization Management Program (FedRAMP), other Federal policies and guidance, and future revisions.

This policy allows the FAA to meet organizational and mission requirements as well as FAA strategic objectives. It specifies the Agency-wide minimum security and privacy requirements for all FAA systems and defines roles and responsibilities for key cybersecurity positions.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 USC 552

Effective Date:

12/23/16

National Policy

SUBJ: FAA Information Security and Privacy Program & Policy

ORDER

1370.121

12/23/16 1370.121 ii

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 USC 552

This order applies to all FAA employees, contract and sub-contract personnel, grant and sub grant recipients, as well as Information System Owners (IS Os), program managers, and security and privacy personnel responsible for the FAA' s information and information systems. This order also applies to any person or entity having a written agreement with the FAA as a service provider or involving the access, use, management, or oversight of FAA :;;;/i0stems.

Michael P. Huerta Administrator iii

TABLE OF CONTENTS

Table of Contents ........................................................................................................................... iii List of Figures ................................................................................................................................ iv List of Tables ................................................................................................................................. iv Chapter 1. General Information ............................................................................................. 1-1 Chapter 2. Roles and Responsibilities ................................................................................... 2-1 Chapter 3. FAA Policy .......................................................................................................... 3-1 Appendix 1. FAA Information Security and Privacy Program Management (PM) ................. 4-1 Appendix 2. Access Control (AC) ............................................................................................ 5-1 Appendix 3. Awareness and Training (AT) ............................................................................. 6-1 Appendix 4. Audit and Accountability (AU) ........................................................................... 7-1 Appendix 5. Security Assessment and Authorization (CA) ..................................................... 8-1 Appendix 6. Configuration Management (CM) ....................................................................... 9-1 Appendix 7. Contingency Planning (CP) ............................................................................... 10-1 Appendix 8. Identification and Authentication (IA)............................................................... 11-1 Appendix 9. Incident Response (IR) ...................................................................................... 12-1 Appendix 10. Maintenance (MA) ......................................................................................... 13-1 Appendix 11. Media Protection (MP) .................................................................................. 14-1 Appendix 12. Physical and Environmental Protection (PE) ................................................. 15-1 Appendix 13. Planning (PL) ................................................................................................. 16-1 Appendix 14. Personnel Security (PS) ................................................................................. 17-1 Appendix 15. Risk Assessment (RA) ................................................................................... 18-1 Appendix 16. System and Services Acquisition (SA) .......................................................... 19-1 Appendix 17. System and Communication Protection (SC) ................................................ 20-1 Appendix 18. System and Information Integrity (SI) ........................................................... 21-1 Appendix 19. Authority and Purpose (for Collection of PII) ............................................... 22-1 Appendix 20. Accountability, Audit and Risk Management (of PII) ................................... 23-1 Appendix 21. Data Quality and Integrity (of PII)................................................................. 24-1 Appendix 22. Data Minimization & Retention (of PII) ........................................................ 25-1 Appendix 23. Individual Participation and Redress (of PII) ................................................ 26-1 Appendix 24. Security (of PII Data) ..................................................................................... 27-1 Appendix 25. Transparency (of PII Collection) ................................................................... 28-1 Appendix 26. Use Limitation (of PII)................................................................................... 29-1 Appendix 27. FAA Rules of Behavior Policy ...................................................................... 30-1 Appendix 28. Use of Non-Government Furnished Equipment and Services ....................... 31-1 Appendix 29. Bring Your Own Device (BYOD) ................................................................. 32-1 Appendix 30. Cloud Computing ........................................................................................... 33-1 Appendix 31. Software Development................................................................................... 34-1 Appendix 32. Use of Social Media ....................................................................................... 35-1 Appendix 33. Limited Personal Use ..................................................................................... 36-1 Appendix 34. International Travel with GFE ....................................................................... 37-1 Appendix 35. Voice Over Internet Protocol (VOIP) ............................................................ 38-1 Appendix 36. FAA Remote Connectivity Policy ................................................................. 39-1 iv

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 USC 552

Appendix 37. Trusted Internet Connection (TIC) ................................................................ 40-1 Appendix 38. Digital Signatures........................................................................................... 41-1 Acronyms ................................................................................................................................... 42-1 Terms and Definitions................................................................................................................ 43-1 References .................................................................................................................................. 44-1 Index .......................................................................................................................................... 45-1

LIST OF FIGURES

Figure 1 Role Interrelationships................................................................................................... 2-3 Figure 2 Tiered Approach to Security Roles ............................................................................... 2-4 Figure 3 FAA Cybersecurity Governance Structure Overview ................................................... 2-6 Figure 4 FAA Risk Management Framework ............................................................................. 4-3 Figure 5 Mandatory System Use Notification ........................................................................... 5-38 Figure 6 Contingency Planning Tailoring Baseline Security Controls ...................................... 10-1 Figure 7 Sanitization Requirements for FIPS 199 Categorized Media.................................... 14-11 Figure 8 Note on Requests for Personal Information ................................................................ 29-2 Figure 9 Mapping Security Authorizations to SDLC ................................................................ 34-2 Figure 10 Overview of Security Activities Embedded in the DOT Waterfall SDLC ............... 34-4 Figure 11 Mapping of SDLC to FISMA Inventory Operational Status..................................... 34-5 Figure 12 Message - Leaving FAA Web site........................................................................... 34-15 Figure 13 Example of Exit Disclaimer .................................................................................... 34-16 Figure 14 Approved FAA Warning Banner............................................................................... 36-6 Figure 15 Lobbying and Political Activity Rules for Political Appointees ............................... 36-6 Figure 16 The FAA Telework Policy ........................................................................................ 39-1 Figure 17 Reference Notes ......................................................................................................... 44-1

LIST OF TABLES

Table 1 FAA Orders Cancelled.................................................................................................... 1-2 Table 2 FAA Memos Cancelled .................................................................................................. 1-3 Table 3 NIST 800-53 Program Management Controls .............................................................. 4-16 Table 4 Bluetooth Power Levels ................................................................................................ 5-54 Table 5 NIST 800-53 Access Controls ...................................................................................... 5-64 Table 6 Key ISS Roles ................................................................................................................. 6-5 Table 7 Specialized Training Core Competencies Table Legend ................................................ 6-5 Table 8 NIST 800-53 Awareness and Training Controls ............................................................ 6-8 Table 9 NIST 800-53 Summary of Privacy Controls .................................................................. 6-8 Table 10 NIST 800-53 Audit and Accountability Controls ....................................................... 7-27 Table 11 NIST 800-53 Security Assessment and Authorization Controls ................................ 8-11 v

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 USC 552

Table 12 NIST 800-53 Configuration Management Controls ................................................... 9-15 Table 13 NIST 800-53 Contingency Plan Goals ..................................................................... 10-15 Table 14 NIST 800-53 Identification and Authentication Controls ........................................ 11-17 Table 15 NIST 800-53 Incident Response Controls ................................................................ 12-15 Table 16 NIST 800-53 Maintenance Controls ........................................................................... 13-8 Table 17 NIST 800-53 Media Protection Controls .................................................................. 14-16 Table 18 NIST 800-53 Physical and Environmental Protection Controls ............................... 15-17 Table 19 NIST 800-53 Planning Controls ................................................................................. 16-9 Table 20 NIST 800-53 Personnel Security Controls ................................................................. 17-9 Table 21 NIST 800-53 Risk Assessment Controls .................................................................. 18-11 Table 22 NIST 800-53 System and Service Acquisition Controls ............................................ 19-4 Table 23 NIST 800-53 System and Communication Protection Controls ............................... 20-32 Table 24 NIST 800-53 System and Information Integrity Controls ........................................ 21-18 Table 25 NIST 800-53 Privacy Controls - Authority and Purpose ............................................ 22-5 Table 26 NIST 800-53 Privacy Controls - Accountability, Audit, and Risk Management ..... 23-17 Table 27 NIST 800-53 Privacy Controls - Data Quality and Integrity ...................................... 24-3 Table 28 NIST 800-53 Privacy Controls - Data Minimization and Retention .......................... 25-3 Table 29 NIST 800-53 Privacy Controls - Individual Participation and Redress .................... 26-12 Table 30 NIST 800-53 Privacy Controls - Security................................................................... 27-6 Table 31 NIST 800-53 Privacy Controls - Transparency .......................................................... 28-3 Table 32 NIST 800-53 Privacy Controls - Use Limitation ........................................................ 29-2 Table 33 Summary of FAA’s Non-GFE and Non-GFS Policy ................................................. 31-8 Table 34 Summary of FAA’s BYOD Policy ............................................................................. 32-7 Table 35 Summary of FAA’s Cloud Computing Policy .......................................................... 33-19 Table 36 Summary of FAA’s Software Development Policy ................................................. 34-18 Table 37 Summary of FAA’s Social Media Policy ................................................................... 35-4 Table 38 Summary of FAA’s Limited Personal Use Policy .................................................... 36-11 Table 39 Summary of FAA’s Software Development Policy ................................................... 37-7 Table 40 VOIP Security Checklist ............................................................................................. 38-7 Table 41 Summary of FAA’s Voice over IP Policy ................................................................ 38-10 Table 42 Summary of FAA’s Remote Connectivity Policy ...................................................... 39-4 Table 43 Summary of FAA’s Trusted Internet Connection Policy ........................................... 40-6 Table 44 Summary of Digital Signature Policy ....................................................................... 41-10

1-1

CHAPTER 1. GENERAL INFORMATION

1. Purpose of this Order

This order defines the Federal Aviation Administration’s (FAA) Information Security and a.

Privacy (IS&P) Program and policy, and augments the Department of Transportation’s (DOT) policies and guidance defined in DOT Order 1351.37, the Departmental Cybersecurity Compendium: Supplement to DOT Order 1351.37 Departmental Cybersecurity Policy (as amended), June 2015, Version 4, hereafter referred to as DOT Compendium, Cybersecurity Action Memos (CAMs), and other DOT policy documents with FAA-specific policy, Federal Risk and Authorization Management Program (FedRAMP), and guidance.

This order establishes FAA’s IS&P Program and Policy and assigns organizational and b.

management responsibilities to ensure the FAA IS&P Program and policy are implemented consistent with Federal statutes, laws, and regulations about information security management.

Federal information security laws include but are not limited to the Federal Information c.

Security Modernization Act (FISMA) 2014, Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource, National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, and U.S. DOT policy, DOT Compendium, and supplemental documents.

Additionally, this order implements the Privacy Act of 1974 (the Privacy Act) as d.

amended by the Computer Matching and Privacy Protection Act of 1988; supplements the guidance provided by the OMB, the DOT Chief Information Officer Policy (CIOP) Order 1351.18, Privacy Risk Management Policy (as amended). This order provides instructions and guidance to all FAA elements to assist them in carrying out the provisions of the Privacy Act.

2. Whom this Order Affects

This order applies to: a.

All FAA organizations, systems, domains, employees, contract and sub-contract (1) personnel, grant and sub-grant recipients, as well as Information System Owners (ISOs), program managers, and security and privacy personnel responsible for the FAA’s information and information systems, as well as any Agency or person sharing the FAA’s information.

This order also applies to any person or entity having a written agreement with the (2) FAA as a service provider or involving the access, use, management, or oversight of FAA information or information systems.

FAA information systems and contractor information systems that operate on (3) behalf of the FAA that collect, store, process, send, receive, or dispose of FAA information.

1-2

Information system owners, program managers, and those information security and (4) information technology (IT) personnel who are responsible for the FAA’s information and information systems.

Any person or entity having a written agreement with the FAA involving the (5) access, use, management, or oversight of FAA information or information systems.

National Air Space (NAS), mission support, administrative, prototype, operational (6) and administrative network systems funded by the FAA or connected to FAA networks.

This order does not apply to members of the general public that access information on b.

FAA’s public-facing Web sites.

3. Where Can I Find this Order?

You can find this order on the MyFAA employee Web site at: a.

https://employees.faa.gov/tools_resources/orders_notices/.

This order contains hyperlinks and cross-references and is best viewed online. b.

4. What this Order Cancels

This order cancels and supersedes the orders listed in Table 1 or their subsequent versions a.

to date. The list below may not be all encompassing. Additional national and organizational specific orders may be canceled or updated to comply with this order.

Table 1 FAA Orders Cancelled

FAA Order Title Date 1280.1B, CHG 1 Protecting Personally Identifiable Information (PII) 08/16/2011 1370.79A Internet Use Policy 10/12/1999 1370.81A Electronic Mail 05/13/2002 1370.82A Information Systems Security Program 09/11/2006

1370.83 Internet Access Points 02/08/2001

1370.84 Internet Services 03/04/2002

1370.89 Information Operations Conditions 08/25/2003

1370.90 Internet Access Point configuration Management 08/01/2003

1370.91 Information Systems Security Patch Management 05/19/2004

1370.91 AC SUP 1 Aeronautical Center Assistant Administrator for Regions and Center Operations Patch and Vulnerability Scanning Policy

07/02/2007

1370.92 Password and Pin Management 06/28/2004

1370.93 FAA Web Management 08/17/2004

1370.94A Wireless Technology Security Policy 09/10/2008

1370.95 Wide Area Network Connection Security 09/12/2006

1370.100 Media Sanitizing and Destruction Policy 10/01/2007

1370.102 System Use Notification and Disclaimer Statement Policy 07/21/2008

1370.103 Encryption Policy 11/12/2008

1370.104 Digital Signature Policy 10/31/2008

1370.105 Logical Access Control Policy 12/10/2008

1370.106 Information Systems Security Awareness and Training 06/16/2009 https://employees.faa.gov/tools_resources/orders_notices/

1-3

FAA Order Title Date Policy

1370.107 Rules of Behavior/System Use Policy 06/04/2009

1370.108 Voice over Internet Protocol (VoIP) security policy 09/21/2009

1370.109 Software Assurance Policy 10/23/2009

1370.110 Secure Telework Policy 09/15/2010

1370.111 Removable Media Security Policy 09/15/2010

1370.112 FAA Application Security Policy 10/05/2010

1370.113 Web Security Management Policy 04/16/2012

1370.115 Domain Name System (DNS) Security Policy 04/16/2012

1370.116 Boundary Protection Policy 04/16/2012

This IS&P Policy incorporates the applicable language from the memorandums listed in b.

Table 2. Upon signature of this IS&P policy, the FAA will cancel the listed memorandums.

Table 2 FAA Memos Cancelled

FAA Memo Title Date FAA P2P Memo 06/18/2007 User Remote Access Memo 2/5/2009 Internet Access Points 02/08/2001 FAA Teleconferencing Services 2/14/2013

5. Explanation of Policy Changes

The changes to FAA policy include: a.

Updating and consolidating many FAA IT, information security, and privacy (1) orders into a single policy document including FAA Order 1370.82A, Information Systems Security Program and FAA Order 1280.1B, Protecting Personally Identifiable Information

(PII).

The FAA’s adoption of the DOT 1351-37 Departmental Cybersecurity Policy, (2) DOT Cybersecurity Compendium, FedRAMP, and supporting policies and procedures to fulfill the requirements for the FAA-wide Information Systems Security Program.

Inclusion of updated Federal laws, standards, regulations, and guidelines that FAA (3) personnel must follow to implement a risk-based IS&P program.

Defining and updating the IS&P responsibilities for key FAA positions and (4) functions based on recent FAA reorganizations.

Providing policy and guidance on new technologies such as social media, wireless, (5) mobile devices, Bring Your Own Device (BYOD), cloud computing, software development, etc.

New security authorization responsibilities based on NIST and OMB guidance. (6)

Incorporating FedRAMP requirements for cloud computing. (7) https://employees.faa.gov/documentLibrary/media/Order/1370.82A.pdf http://www.faa.gov/documentLibrary/media/Order/FAA_Order_1280.1B_w-chg1.pdf

1-4

New Federal policies, directives, and guidance will be incorporated in subsequent b.

releases of this IS&P program and policy document. The CISO may release interim policy memorandum as deemed necessary.

6. Effective Date

This IS&P Policy is effective upon signature. a.

All FAA organizations have one year to comply with this policy unless otherwise noted. b.

All organizations have one year from the effective date to bring their systems into c.

compliance with this policy.

New systems developed after the effective date must comply with this policy. d.

When updates to Federal, DOT, or FAA policy occur, the CISO will issue supplemental e.

policy and guidance as needed with implementation requirements and compliance timeframes.

7. Distribution

The FAA intends to widely distribute this policy to all Lines of Business (LOBs), Staff a.

Offices (SOs), organizations, facilities, and personnel to ensure knowledge of and compliance with this IS&P Policy.

This order is available on the MyFAA employee Web site at: b.

https://employees.faa.gov/tools_resources/orders_notices/, and is best viewed online as the document contains hyperlinks and cross-references.

8. Background

Federal law requires that all Federal departments and agencies develop, disseminate, a.

update, and maintain a cohesive information security and privacy program and policy to protect their cyber assets, personnel, and data.

Advances in technology and increased reliance on digital data systems have complicated b.

the challenge of managing the security and privacy of information and information systems. The FAA developed this IS&P program and policy to meet this challenge.

9. Delegation of Authority

FISMA and other authoritative sources designate the head of the Agency as the person a.

ultimately responsible for ensuring that the Agency develops and implements an effective Agency-wide information system security and privacy program. The FAA Administrator has the ultimate responsibility for securing FAA systems, information, facilities, and personnel.

FISMA (44 U.S.C. § 3541) authorizes the FAA Administrator to delegate this b.

responsibility to an individual or organization with the authority, responsibilities, and resources necessary to fulfill the cybersecurity and privacy protection obligations of the Agency.

https://employees.faa.gov/tools_resources/orders_notices/

1-5

Consistent with FISMA and the Clinger-Cohen Act of 1996, the FAA (1) Administrator delegates the authority and responsibility for the FAA’s information security and privacy programs to the FAA Chief Information Officer (CIO) to establish and maintain an enterprise-wide information security and privacy program, policy, and standards.

The FAA CIO assigns organizational and management responsibilities for the (2) FAA enterprise information security and privacy program and policy to FAA Chief Information Security Officer (CISO) to oversee the Agency compliance with applicable Federal laws, policies, standards, and regulations about information security and privacy management.

The FAA CISO is responsible for developing, issuing, updating, and carrying out (3) the FAA Enterprise information systems security and privacy program.

10. Authority to Change this Order

The Director, Office of Information Security & Privacy Service is responsible for a.

maintaining and updating this order.

Consistent with FISMA (44 U.S.C. § 3506 and § 3554), the FAA Administrator delegates b.

the authority and responsibility to the FAA CIO to establish policy and standards, assign organizational and management responsibilities to FAA CISO, and oversee Agency compliance of Federal laws, polices, standards, and regulations about information security and privacy management.

11. Notice of Exception and Non-Compliance

Any system that cannot meet the requirements of this order within one year after a.

signature must:

Create a Plan of Action and Milestones (POA&M) in the DOT approved (1) POA&M tracking system, currently Cyber Security Assessment Management (CSAM).

Create a schedule for policy compliance. (2)

Submit a Notice of Exception and Noncompliance to the FAA CIO. (3)

Information System Owners (ISO) must document any noncompliance with this order b.

and submit it to the FAA CIO for review and approval in the form of a waiver. All waiver requests must be documented and submitted through the Office of Information Security and Privacy Service, Security Governance Division. At a minimum, the ISO, Domain Information System Security Manager (ISSM) (if applicable), the FAA CISO, and the Authorizing Official (AO) must sign the waiver. If the system is designated as a privacy system, the FAA Chief Privacy Officer (CPO) must also sign the waiver.

The notice must describe the compelling business need for noncompliance with (1) this order and explain the risk mitigation strategy.

1-6

The document must also contain the following paragraphs: background, system (2) description, vulnerabilities identified, risk mitigation strategy, residual risk, and recommendations.

The waiver cannot be valid for more than one year from the date of the signed (3) exception notice. A new waiver request must be submitted and approved annually until the issue is remediated.

The head of an LOB/SO, ISO, or AO can request the FAA CIO grant a waiver of (4) compliance for a compelling business reason. The request must include (1) justification, (2) what measures or compensating controls already exist, (3) risk acceptance, (4) risk mitigation measures, (5) waiver period, and (6) milestones to achieve compliance. The system’s authorization package must include the copy of the request and waiver decision.

National Airspace System (NAS) industrial control system assets used in the direct (5) support of air traffic control operations (e.g., operational air traffic control displays, NAS system monitoring and control devices, and other types of NAS equipment such as enroute, terminal, radar systems, etc.) must follow the guidance in Appendix 2 Access Control, Paragraph 26 Industrial Control Systems.

12. Notice of Exception and Noncompliance for Systems Containing Privacy Information

A Notice of Exception and Noncompliance cannot be submitted for any system of records a.

subject to the Privacy Act.

Any other system that contain privacy information and not subject to the Privacy Act and b.

cannot meet the requirements of this order within 90 days after signature must:

Create a POA&M in the DOT approved POA&M tracking system. (1)

Create a schedule for policy compliance. (2)

Submit a Notice of Exemption and Noncompliance to the FAA CIO. (3)

ISOs must document any noncompliance with this order and submit the documentation to c.

the FAA CIO for review and approval. However, noncompliance cannot be approved for any system subject to the Privacy Act. At a minimum, the ISO, Domain ISSM (if applicable), the FAA CISO, and AO must sign the notice of exception available for systems not subject to the Privacy Act.

The notice must describe the compelling business need for not adhering to this (1) order and explain the risk mitigation strategy.

The document must also contain the following paragraphs: background, system (2) description, vulnerabilities identified, risk mitigation strategy, residual risk, and recommendations.

1-7

The waiver cannot be valid for more than one year from the date of the signed (3) exception notice and must state which policies, orders, and controls with which they are not compliant.

13. Organization of this Policy

The organization of this document is provided below: a.

The cover sheet provides a brief description of this IS&P Policy. (1)

The Table of Contents provides a hyperlink to the beginning of each chapter and (2) appendix in this policy document.

The List of Tables and List of Figures identifies various tables and figures used in (3) the policy.

Chapter 1 provides general information for the IS&P Policy including orders (4) cancelled by this order, effective date, authority, and how to handle exceptions to the IS&P Policy.

Chapter 2 identifies the roles and responsibilities for enforcement of this IS&P (5) Policy.

Chapter 3 provides a brief overview of the FAA IS&P Policy. (6)

A number of appendices follow Chapter 3, which identify the policy for each of (7) the NIST 800-53 Revision 4 control families, privacy components, and various topics and issues requiring additional FAA policy. The appendices may change as necessity dictates.

The acronym appendix provides a list and definition of all acronyms used in this (8) policy.

The terms and definitions appendix defines various terms used in this policy. (9)

The reference appendix lists the documents and references used in the (10) preparation of the IS&P Policy.

The last appendix provides an index. (11)

This document uses hyperlinks and cross-references and is best viewed online. b.

14. How to Read this Policy

For any particular policy topic, read this IS&P document first. a.

If the FAA is using the requirement from the DOT Compendium without (1) modification, then read the current version of the DOT Compendium.

1-8

If the FAA has modified or does not use the DOT Compendium control, then the (2) requirement is specified in this document.

If a control is marked as optional, refer to the current version of the DOT (3) Compendium and the current version of NIST 800-53 for implementation guidance unless it is a cloud system.

In some cases, the FAA has chosen to implement NIST controls that the DOT (4) Compendium specifies as optional. The control reference table at the end of each appendix marks the additional FAA selected controls with “FAA” in the security base line control section.

If implementing a cloud system, organizations must consider implementing the (5) system in the FAA Cloud Services (FCS) environment where applicable. If the system cannot be implemented in the FCS, then the organization follow the FedRAMP documentation and requirements as specified in Appendix 30, Cloud Computing. NAS cloud systems require coordination with the FAA CIO and CISO, but the implementation of the NAS cloud must follow the tailored NIST 800-53 controls for NAS operations.

At the end of each appendix is a summary table of the NIST control family for that b.

appendix. An “X” in the Federal Information Processing Standards (FIPS) 199 Impact Level column indicates that the control is mandatory. If the field is blank, the control is optional and is left to the ISO to determine if the system will implement that particular control. If the FIPS 199 impact level contains “FAA”, the control is an FAA enhancement and systems must implement that control.

12/2316 1370.121

2-1

CHAPTER 2. ROLES AND RESPONSIBILITIES

1. Introduction

Assigning responsibilities to personnel with enforcement authority ensures FAA a.

uniformly applies and enforces policy across the Agency. This section of the order assigns Roles and Responsibilities for various aspects of the FAA Cybersecurity and Privacy Program.

Roles and responsibilities were revised to formalize the establishment of FAA’s Risk b.

Executive (function) as fulfilled by the FAA Cybersecurity Steering Committee (CSC) and to articulate alignment with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, Revision 1 (as amended), SP 800-39 Managing Information Security Risk (as amended), and Executive Order 13636, Improving Critical Infrastructure Cybersecurity, and other NIST cybersecurity guidance.

All FAA organizations must comply with this order and carry out responsibilities as c.

defined herein.

1.1. Background

All FAA goals, objectives, initiatives, and activities must support its mission to ensure a.

the safety and efficiency of the United States of America national aerospace system.

In support of the mission, ensuring the secure delivery of information, and the IT (1) systems used to deliver, store, and process information necessary for employees to accomplish their work, ultimately enables the FAA to meet its obligations to ensure aviation safety.

More specifically, the strategic priority, “Make Aviation Safer and Smarter” is (2) focused on initiatives that will allow the FAA to continually increase the level of aviation safety by reducing safety risks and the implementation of NextGen technology.

LOBs and SOs across FAA are supporting this strategic goal by working (3) collaboratively through the CSC to quickly address high value risks and progressively improve the Agency’s risk posture through the implementation of vulnerability management processes.

The FAA Chief Information Officer (CIO) and Chief Information Security Officer b.

(CISO) are responsible for the security of all FAA information systems and are ultimately accountable for implementing the necessary safeguards and technology to manage IT risk and secure FAA information Systems.

The FAA is an Operating Administration (OA) of the DOT and operates a Cybersecurity c.

Program in accordance with DOT direction. The FAA Mission is to provide the safest, most

2-2 efficient aerospace system in the world. The mission is executed within three distinct FAA Domains listed below.

While each FAA Domain operator is responsible for the security of its (1) infrastructure, the FAA CISO and CIO have overall responsibility for the FAA’s cybersecurity and ensuring that domain operators comply with Agency, Departmental, and Federal requirements.

Protecting and securing these systems is a collaborative priority of all of the FAA (2) Domains and FAA employees.

The FAA IT Enterprise is composed of three domains: National Airspace System (NAS) d.

Domain, the Mission Support (MS) Domain, and Research and Development (R&D) Domain.

All three domains are required to perform the FAA’s mission, but are distinct domains that perform the specific operational or business processes of the FAA. For the purpose of this policy, the definition of domain is an environment or context that includes a set of system resources and a set of system entities having the right to access the resources as defined by a common security policy, security model, or security architecture.

The NAS Domain, operated by the Chief Operating Officer (COO), Air Traffic (1) Organization (ATO), encompasses mission critical systems and services used in Air Traffic Control operations.

The MS Domain, operated by the CIO, Information & Technology (AIT), provides (2) a common infrastructure of interconnected general support systems and services for the operation of administrative functions such as messaging services, financial and grants applications, non-mission critical NAS applications, airman and aircraft certification and regulatory services, commercial space applications Airport services, etc.

The R&D Domain, operated by the Assistant Administrator (AA), NextGen (3) (ANG), provides a secure environment for software and systems development and research.

To ensure the FAA meets its cybersecurity obligations to protect the FAA systems and e.

continue its mission, the FAA employs NIST Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, Revision 1 (as amended) for assigning responsibilities associated with the positional cybersecurity roles.

The FAA assigns various cybersecurity roles and responsibilities at both the (1) Agency level and at the organizational level to execute its Cybersecurity Program.

Figure 1 shows a high-level depiction of the DOT and FAA cybersecurity (2) positional structure.

2-3

Figure 1 Role Interrelationships

The IS&P controls to protect these domains exist as system controls, common controls, f.

or hybrid controls implemented and operated by individuals and organizations across the

FAA.

Enterprise and Agency Cybersecurity oversight roles: (1)

• Head of Agency (FAA Administrator)

• FAA Assistant and Associate Administrators

• Risk Executive Function (provided by the CSC)

• Chief Information Officer (CIO)

• Chief (Senior) Information Security Officer (CISO)

• FAA Chief Privacy Officer (CPO)

Common Control Function: (2)

• Common Control Provider

• National Cybersecurity Threat Information/intelligence (ASH)

• FAA Security Operations Center (SOC)

• Security Control Assessor (SCA)

Organization and System roles: (3)

• Authorizing Official (AO)

2-4

• Authorizing Official Designated Representative (AODR) (optional role)

• Information Security Architect (ISA)

• Information System Owner (ISO)

• Information System Security Officer (ISSO)

• Information System Security Engineer (ISSE)

• Information Steward

The CISO allocates primary responsibility for each of the FAA Domains to specific g.

FAA organizations. The roles and responsibilities required to manage the domain IS&P controls or functions are distributed across FAA organizational boundaries.

Federal law prescribes several roles and responsibilities while NIST guidance h.

specifies others.

Figure 2 Tiered Approach to Security Roles

2-5

As shown in Figure 2, some roles are defined at the Agency (Tier 1) level and provide i.

information security leadership across all Agency organizations and systems. Other roles are defined for specific business or mission functions (Tier 2) level. Some roles are defined at the system (Tier 3) level and only apply to the specific system.

2. Cybersecurity Governance

FAA cybersecurity management is structured using a hybrid governance model as a.

described in NIST SP 800-39 Managing Information Security Risk (as amended).

In the FAA’s hybrid cybersecurity governance structure, the authority, (1) responsibility, and decision-making power are distributed between a central body and individual FAA organizations.

The central body is comprised of the Cybersecurity Steering Committee (CSC), (2) which includes the FAA CIO, FAA CISO, and FAA organization cybersecurity executives.

The CSC provides the means through which FAA coordinated mission-focused (3) cyber planning occurs. As stated in the CSC Charter, “Each committee member's role will be to advocate and champion for the mission space they represent as well as advocate and champion the cybersecurity priorities, strategies and operational guidelines to their system, network, and information owners in order to bring together the whole of FAA in protecting the Agency.”

The CSC engages FAA organizations that perform cybersecurity functions in support of b.

the FAA Mission in an ongoing risk management exchange to effectively manage cross-organization risk. Through this structure, risk is managed holistically across the FAA while each organization maintains the necessary flexibility to align risk management to its mission requirements.

Figure 3 depicts the governance structure for the FAA’s Information Security and Privacy c.

program. Cybersecurity intelligence, policy, threat assessment, and risk management performed at the enterprise level.

Information flows to the individual FAA domains where business decisions are (1) made within each organization based on the unique attributes of its mission space.

This allows organizational AOs to perform their NIST SP 800-37 defined primary (2) function “to formally assume responsibility for operating an information system at an acceptable level of risk.”

The AOA/ADA role is documented below in Section 3.1, Head of Agency. (3)

INTEL is documented under common control providers in Section 4.2. (4)

The Cybersecurity Steering Committee, CIO, and CISO roles are documented in (5) Sections 3.3, 3.4 and 3.5 respectively in Enterprise and Agency Cybersecurity Oversight.

2-6

The AVS role is documented in section 6.4. (6)

Figure 3 FAA Cybersecurity Governance Structure Overview

Authorizing officials coordinate with the FAA CIO and FAA CISO to ensure that d.

authorization documentation and activities comply with FISMA requirements and support annual FISMA reporting on the overall effectiveness of the organization’s information security program, including progress of remedial actions.

With respect to cybersecurity, when functions overlap or disagreements arise, the CSC e.

will be the independent body charged with assessing the risk, making recommendations, and if necessary, bringing the issue to the awareness of the FAA Business Council.

Strategic objectives are also developed at the organization level for mission planning. f.

Organizational risk decisions and strategic objectives are coordinated with the CSC to support an FAA-wide view of risk and to define and prioritize cybersecurity strategic objectives for the Agency.

2-7

3. Enterprise and Agency Cybersecurity Oversight

3.1. Head of Agency (FAA ADMINISTRATOR)

Under FISMA (44 U.S.C. § 3541), OMB Circular A-130, and other Federal laws, the a.

head of the Agency is ultimately responsible for the security of Agency systems, networks, information, personnel, and facilities.

The FAA Administrator has the overall responsibility to provide information security b.

protections commensurate with the risk and magnitude of harm to FAA operations and assets, individuals, organizations, and the Nation. The FAA Administrator establishes appropriate accountability for information security and provides active support and oversight of monitoring and improvement for the information security program.

The FAA Administrator ensures that: c.

Information security management processes are integrated with strategic and (1) operational planning processes;

FAA senior officials provide information security for the information and (2) information systems that support the operations and assets under their control; and

The FAA has trained personnel sufficient to assist in complying with the (3) information security requirements in related legislation, policies, directives, instructions, standards, and guidelines.

FISMA 2014 permits the head of the Agency to delegate and assign the responsibilities d.

for information technology related matters to the Agency’s CIO.

The FAA Administrator has assigned the responsibility for all IT related matters to the e.

Deputy Assistant Administrator for the Office of Information & Technology (CIO).

Securing FAA information systems and protecting the FAA Mission areas requires input f.

and collaboration across the Executive, Operational and System levels. The roles and responsibilities necessary to provide this input and ensure collaboration and enterprise-wide risk management are listed in this document.

3.2. FAA Assistant and Associate Administrators

FAA Assistant and Associate Administrators must implement the FAA IS&P Program a.

within their respective organization under the requirements of this order, consistent with Federal mandates, policies, standards, requirements, and guidelines, including the Agency’s capital planning and investment control process.

Organizations, systems, and domains may tailor this policy to meet organization, system, b.

or domain specific requirements or business needs, but may not opt out of the FAA Information Security and Privacy Program and Policy.

2-8

3.3. Risk Executive Function Cybersecurity Steering Committee (CSC)

The Risk Executive function is fulfilled by the FAA CSC. a.

The FAA CSC was established by the FAA Business Council to address integrated b.

cybersecurity policy, strategy, and planning with a mission focus for FAA.

The committee is comprised of executives from the ATO, ANG, Finance and (1) Management (AFN), Security and Hazardous Materials Safety (ASH), and Aviation Safety (AVS), and is chaired by the FAA CISO.

The FAA CSC must prioritize, strategize, and operationalize cybersecurity (2) requirements, issues, mandates, programs, and projects to enable the FAA as a whole to come together as one team to protect FAA networks and systems as one FAA team.

The CSC coordinates with senior leadership of the FAA to ensure: c.

Authorization decisions by AOs for their respective information systems are (1) viewed from an FAA-wide perspective with regard to the overall strategic goals and objectives of the FAA in carrying out its core missions and business functions.

Information system-related security risk management is consistent across the FAA, (2) reflects FAA risk tolerance, and is considered along with other types of risks in order to ensure mission/business success. The Risk Executive function coordinates with senior leadership of the FAA to:

(a) Provide a comprehensive, FAA-wide, holistic approach for addressing risk—an approach that provides a greater understanding of the integrated operations of the

FAA.

(b) Provide a mechanism to share/exchange cybersecurity information for applicability through operational and airworthiness regulatory action.

(c) Develop a risk management strategy for the FAA providing a strategic view of information security-related risks with regard to the FAA as a whole.

(d) Facilitate the sharing of risk-related information among AOs and other senior leaders within the FAA.

(e) Provide oversight for all risk management-related activities across the FAA (e.g., security categorization) to ensure consistent and effective risk acceptance decisions.

(f) Provide guidance to help ensure that authorization decisions consider all factors necessary for mission and business success.

(g) Provide an FAA-wide forum to consider all sources of risk (including aggregated risk) to organizational operations and assets, individuals, other organizations, and the Nation.

2-9

(h) Promote cooperation and collaboration among AOs to include authorization actions requiring shared responsibility.

(i) Ensure that the shared responsibility for supporting organizational mission and business functions that use external providers of information and services receives the needed visibility and is elevated to the appropriate decision-making authorities.

(j) Identify the organizational risk posture based on the aggregated risk to information from the operation and use of the information systems for which the FAA is responsible.

Where overlapping functions exist, or interpretation or disagreements arise with respect d.

to cybersecurity, the CSC will serve as an independent body that assesses the risk, makes recommendations, and if necessary, brings to the FAA Business Council for awareness.

3.4. Chief Information Officer (CIO)

The CIO role, carried out by the Deputy Assistant Administrator for Information & a.

Technology, with the support of the Risk Executive function and the CISO, works closely with AOs and their designated representative to:

Communicate the mission priorities, available resources, and overall risk tolerance (1) to the business process level.

Ensure that an FAA-wide information security program is effectively implemented (2) resulting in adequate security for all organizational information systems and environments of operation.

Ensure that information security considerations are integrated into (3) programming/planning/budgeting cycles, enterprise architectures, and acquisition/system development life cycles.

Ensure that information systems are covered by an approved System Security Plan (4) (SSP)…