CBP Directive HB1400-05D ISS Policies Procedures Handbook v.8.pdf

U.S. Customs and Border Protection

HB 1400-05D

Information Systems Security Policies and Procedures Handbook

Office of Information and Technology

Cybersecurity Directorate

Version 8.0

September 13, 2024

CBP Information Systems Security Policies and Procedures Handbook

HB 1400-05D Version 8.0

Table of Contents

Introduction Security Objectives IT Security Program Policy and Implementation Guidelines Applicability Authorities and References Information Systems Security Policy Hierarchy Policy Overview Changes to Policy Offenses and Penalties

1.0 General CBP Security Policy

2.0 Roles and Responsibilities

2.1 Commissioner

2.2 Executive Assistant Commissioner, Enterprise Services

2.3 Assistant Commissioner, Officer of Information Technology

2.4 Authorizing Official

2.5 Chief Financial Officer

2.6 Chief Information Officer

2.7 Financial System Owners

2.8 Other Assistant Commissioners

2.9 Chief Information Security Officer

2.10 Information System Security Manager

2.11 Security Control Assessor

2.12 Certification Agent

2.13 Information System Security Officer

2.14 Supervisors and Managers

2.15 Privacy Officer

2.16 Program Managers

2.17 Information System Owners and Information Owners

2.18 System and Network Administrators

2.19 System Control Officer

3.0 Management Policies

HB 1400-05D Version 8.0

3.1 Capital Planning and Investment Control

3.2 Contractors and Outsourced Operations

3.3 System Engineering Life Cycle

3.4 Configuration Management

3.5 Security Authorization and Security Control Assessments

3.6 Privacy Sensitive Systems

3.7 E-Authentication

3.8 CFO Designated Financial Systems

4.0 Operational Controls

4.1 Personnel

4.1.1 Citizenship, Personnel Screening, and Position Categorization

4.1.2 Segregation of Duties

4.1.3 Information Security and Privacy Awareness Training

4.2 Personal Use of Government Equipment and DHS/CBP Systems

4.3 Physical Security

4.4 Production, Input, Output/Information Handling

4.5 Hardware and Software

4.6 Storage Media

4.7 Removable Media

4.8 Voice Communication Security

4.9 Wireless Communications

4.9.1 Wireless Mobile Devices

4.10 Wireless Settings for Peripheral Equipment

4.11 Wireless Input Peripheral Devices

4.12 Personally Owned Equipment and Software

4.13 DHS and CBP Information Security Operations

4.14 Vulnerability Management

4.15 Information and Data Backup

4.16 Backup Strategy

4.17 Local Area Network Guidance

4.18 Converging Technologies

5.0 Technical Policies

5.1 Identification and Authentication

HB 1400-05D Version 8.0

5.2 Access Control

5.2.1 Automatic Account Lockout

5.2.2 Automatic Session Termination

5.2.3 Warning Banner

5.2.4 External User Account Recertifications

5.3 Auditing

5.4 Network and Communications Security

5.4.1 Remote Access and Dial-In

5.4.2 Network Security Monitoring

5.4.3 Network Connectivity

5.4.3.1 Interconnection Security Agreements

5.4.3.2 Trust Zones

5.4.4 Firewalls and Policy Enforcement Points

5.4.5 Router Device Management

5.4.6 Internet Security

5.4.7 Email Security

5.4.8 Personal Email Accounts

5.4.9 Group Mailing

5.4.10 Testing and Vulnerability Management

5.4.11 Peer-to-Peer Technology

5.5 Scanning and Monitoring Policy

5.5.1 Authorized/Approved Monitoring

5.5.2 Sniffer Devices

5.6 Cryptography

5.6.1 Encryption

5.6.2 Public Key Infrastructure

5.6.3 Public Key/Private Key

5.7 Malware Protection

5.7.1 What Is a Virus?

5.7.2 Types of Malware

5.7.3 How Malware Affects Systems

5.7.4 Procedures When Malware Is Detected on a System

5.8 Product Assurance

HB 1400-05D Version 8.0

5.9 Supply Chain

5.9.1 Business Impact

5.9.2 Supply Chain Risk Management Plans

Document Change Requests Questions and Comments Definitions Attachments

HB 1400-05D Version 8.0

Introduction U.S. Customs and Border Protection (CBP) must incorporate security safeguards within its information systems to support the DHS mission. This handbook serves as an aid to CBP Information Technology (IT) users to achieve confidentiality, integrity, availability, and non-repudiation within CBP IT infrastructure and operations. This handbook is based on DHS 4300A Information Technology System Security Program, Sensitive Systems Policy Directive and provides supplemental policy for CBP-specific mission needs. In addition, it implements as requirements many of the guidelines contained in various National Institute of Standards and Technology (NIST) publications, Office of Management and Budget (OMB) direction, Congressional and Executive Branch mandates. Due to its business mission, CBP systems may require policies and procedures that are more stringent than those required by federal or DHS security policy.

The intended audience includes all elements of CBP using information systems and networks within CBP. Specific procedures supporting these policies may be found in the attachments. The scope and contents of this handbook will change over time as new capabilities are added to CBP systems, as security standards are upgraded, and as a result of user experience and comment. This handbook is issued as implementation guidance under the authority of the Chief Information Officer (CIO) through the Chief Information Security Officer (CISO). This handbook addresses IT security only. However, those aspects of personnel, physical, information, and industrial security; investigations;

emergency preparedness; and counterterrorism that relate to IT security are addressed in this handbook.

Security Objectives Confidentiality, availability, integrity, and non-repudiation are the CBP primary security objectives. A framework is provided to develop security policies and procedures for CBP.

Risk Management is another key objective, which is addressed in more detail in Section 3.8, Risk Management. The weighing of risks associated with each primary security objective may not be equal, nor will it be assessed in the same way for classified, Sensitive but Unclassified (SBU) information, and information systems at CBP. Federal Information Processing Publication (FIPS) -199, Standards for Security Categorization of Federal Information and Information Systems, offers guidance to categorize information systems based on the priority of each of the security objectives. CBP follows this guidance in categorizing its SBU information and information systems.

IT Security Program Policy and Implementation Guidelines This handbook provides procedures and techniques necessary to implement the Baseline Security Requirements (BLSRs) relating to management, operational, and technical controls that provide the foundation necessary to ensure confidentiality, integrity, availability, authenticity, and non-repudiation within the CBP IT infrastructure and operations. This handbook addresses the procedures necessary for implementing security requirements for sensitive IT systems. A CBP system is any information system that

HB 1400-05D Version 8.0 transmits, stores, or processes data or information and is (1) owned, leased, or operated by CBP, (2) operated by a contractor on behalf of CBP, or (3) operated by another Federal, state, or local Government agency on behalf of CBP. CBP policy mandates that all CBP computing resources be individually accounted for as part of an IT system. IT systems encompass major applications and general support systems.

The CBP Information Security Program does not apply to any IT that processes, stores, or transmits foreign intelligence information pursuant to Executive Order 12333, to Director of Central Intelligence directives governing the protection of intelligence information, and to other applicable orders.

Policy elements are effective when issued. Failure to implement any policy element within 135 business days shall be considered a weakness and either a system or program Plan of Action and Milestones (POA&M) must be generated by the organization for the identified weaknesses.

Applicability This handbook applies to all CBP personnel, contractors acting for CBP, and all authorized users who access CBP information systems. The CBP Information Systems Security Policies and Procedures Handbook apply to all CBP information systems used to process, store, transmit, or receive any CBP data.

CBP Mission Statement Information security principles and practices in this document support the basic CBP mission stated below:

We are the guardians of our Nation’s borders. We are America’s frontline.

We safeguard the American homeland at and beyond our borders.

We protect the American public against terrorists and the instruments of terror.

We steadfastly enforce the laws of the United States while fostering our Nation’s economic security through lawful international trade and travel.

We serve the American public with vigilance, integrity, and professionalism.

Authorities and References DHS established a department-wide IT security program presented in DHS 4300A Information Technology System Security Program, Sensitive Systems Policy Directive and DHS 4300B National Security Systems Handbook for classified systems. These policies and authorities extend to CBP, a component of DHS.

Applicable Executive Orders, public laws, national policy, external/internal guidance and DHS direction for this handbook include the following:

Public Law and U.S. Code

• Public Law 100-235, Computer Security Act of 1987 as amended

• Public Law 101-576, Chief Financial Officers (CFO) Act of 1990

HB 1400-05D Version 8.0

• Public Law 104-106, Clinger-Cohen Act of 1996, 40 U.S.C. 1401 (formerly, Information Technology Management Reform Act of 1996 (ITMRA))

• Privacy Act of 1974, As Amended. 5 United States Code (U.S.C.) 552a, Public Law 93-579, Freedom Act of 2002 as amended

• Public Law 106-398, National Defense Authorization Act of 2001

• Public Law 107-296, Homeland Security Act of 2002

• Public Law 107-347, E-Government Act of 2002.

• Public Law 113-283, 128 STAT 3073 Federal Information Modernization Act of 2014

• 5 Code of Federal Regulations (CFR) §2635, Office of Government Ethics, Standards of Ethical Conduct for Employees of the Executive Branch

Executive Orders

• Executive Order 12656, Assignment of Emergency Preparedness Responsibilities, dated November 18, 1988, as amended

• Executive Order 13200, President’s Information Technology Advisory Committee, Further Amendment to Executive Order 13035, as Amended, Signed: February 11,

• Executive Order 13215, President’s Information Technology Advisory Committee, Further Amendment to Executive Order 13035, as Amended, Signed: May 31, 2001

• Executive Order 13228, Establishing the Office of Homeland Security and the Homeland Security Council, Signed: October 8, 2001

• Executive Order 13231, Critical Infrastructure Protection in the Information Age, October 16, 2001

• Executive Order 13526, Classified National Security Information, December 29, 2009

• Homeland Security Presidential Directive 7, Critical Infrastructure Identification, Prioritization, and Protection, December 17, 2003

• Homeland Security Presidential Directive 12, Policy for a Common Identification

Standard for Federal Employees and Contractors, August 27, 2004

• Executive Order 13618, Assignment of National Security and Emergency

Preparedness Communications Functions, July 6,2012

Office of Management and Budget (OMB) Directives

• OMB Bulletin 24-02, Audit Requirements for Federal Financial Statements, July 29,

• OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002, September 2003

• OMB Memorandum M-04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

• OMB Memorandum M-06-15, Safeguarding Personally Identifiable Information, May 22, 2006

HB 1400-05D Version 8.0

• OMB Memorandum M-06-16, Protection of Sensitive Agency Information, June 23,

• OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

• OMB Memorandum M-09-02, Information Technology Management Structure and Governance Framework, October 21, 2008.

• OMB Memorandum 10-15, FY 2010 Reporting Instructions for the Federal Information

• Security Modernization Act of 2014 and Agency Privacy Management, April 21, 2010

• OMB Memorandum 11-06, WikiLeaks – Mishandling of Classified Information, November 28, 2010

• 9/11 Act of 2007, Increased Mission Requirements for Chief Privacy Officer

• OMB Circular A-123, Management’s Responsibility for Internal Control, Revised, December 21, 2004

• OMB Circular A-130, Management of Federal Information Resources, July 28,2016

Other External Guidance

• Intelligence Community Directive Number 503, Intelligence Community Information Technology Systems Security Risk management, Certification and Accreditation, September 15, 2008

• National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS), including:

o FIPS 140-3, Security Requirements for Cryptographic Modules. March o FIPS 199, Standards for Security Categorization of Federal Information and Information Systems o FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

• NIST Information Technology Security Special Publications (SP) 800 series, including:

o NIST SP-800-18, Guide for Developing Security Plans for Information

Technology Systems, Revision 1, February 2006 o NIST SP-800-30, Rev 1, Guide for Conducting Risk Assessments, September o NIST SP-800-34, Rev 1, Contingency Planning Guide for Information

Technology Systems, November 2010 o NIST SP-800-37, Rev 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

HB 1400-05D Version 8.0 o NIST SP-800-39, Integrated Enterprise-Wide Risk Management: Organization, Mission, and Information System View, March 2011 o NIST SP-800-47, Rev. 1, Managing the Security of Information Exchanges, July o NIST SP-800-50, Rev. 1, Building a Cybersecurity and Privacy Learning Program, September 2024 o NIST SP-800-53, Rev. 5, Security and Privacy Controls for Information Systems and Organization, December 2020 o NIST SP-800-53A, Rev. 5. Assessing Security and Privacy Controls in Information Systems and Organizations, January 2022 o NIST SP-800-53B, Control Baselines for Information Systems and Organizations, December 2020 o NIST SP-800-55, Rev 1, Performance Measurement Guide for Information Security, July 2008 o NIST SP-800-60 Rev. 2, Guide for Mapping Types of Information and Systems to Security Categories (Draft) o NIST SP-800-60 Vol. 1 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008 o NIST SP-800-60 Vol. 2 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices, August 2008 o NIST SP-800-61, Rev. 2, Computer Security Incident Handling Guide, August o NIST SP-800-63-3, Digital Identity Guidelines, March 2020 o NIST SP-800-63A, Digital Identity Guidelines: Enrollment and Identity Proofing, March 2020 o NIST SP-800-63B, Digital Identity Guidelines: Authentication and Lifecycle

Management, March 2020 o NIST SP-800-63C, Digital Identity Guidelines: Federation and Assertions, March o NIST SP-800-88, Rev. 1, Guidelines for Media Sanitization, December 2014 o NIST SP-800-92 Rev. 1, Cybersecurity Log Management Planning Guide, October 2023 o NIST SP-800-94, Guide to Intrusion Detection and Prevention Systems (IDPS), February 2007 o NIST SP-800-95, Guide to Secure Web Services, August 2007 o NIST SP-800-98, Guidelines for Securing Radio Frequency Identification

(RFID)Systems, April 2007 o NIST SP-800-100, Information Security Handbook: A Guide for Manager, March o NIST SP-800-115, Technical Guide to Information Security Testing and

Assessment, September 2008

HB 1400-05D Version 8.0 o NIST SP-800-122, Guide to Protecting the confidentiality of Personally Identifiable Information (PII), April 2010 o NIST SP-800-123, Guide to General Server Security, July 2008 o NIST SP-800-124 Rev. 2, Guidelines for Managing the Security of Mobile

Devices in the Enterprise, May 2023 o NIST SP-800-128, Guide for Security-Focused Configuration Management of

Information Systems, October 2019 o NIST SP-800-137, Information Security Continuous Monitoring for Federal o Information Systems and Organizations, September 2011 o NIST SP-800-175A, Guideline for Using Cryptographic Standards in the Federal

Government: Directives, Mandates and Policies o NIST SP-800-175B, Rev. 1, Guideline for Using Cryptographic Standards in the

Federal Government: Cryptographic Mechanisms

• NIST IR 7298, Glossary of Key Information Security Terms

• CNSS Instruction No. 4009, National Information Assurance Glossary

• CNSS Instruction No. 1001, National Instruction on Classified Information Spillage

• Code of Federal Regulations (CFR) §2635, Office of Government Ethics, Standards of

Ethical Conduct for Employees of the Executive Branch

Departmental/Agency Policy

• Department of Homeland Security Acquisition Regulation (HSAR)

• Department of State 12 Foreign Affairs Manual (FAM) 600, Information Security

Technology, June 22, 2000

• DHS Management Directives (e.g., MD 0470.1, MD 102-01, MD 140-01, MD 1030, MD

4400.1, MD 4500.1, MD 4600.1, MD 4900, MD 11042.1, MD 11050.2)

• Federal Financial Management Improvement Act of 1996 (FFMIA), P.L. 104-208

• Federal Managers’ Financial Integrity Act of 1982 (FMFIA), P.L. 97-255

• The National Security Act of 1947, dated July 26, 1947

• DHS Policy Directive 4300A: Information Technology System Security Program, Sensitive Systems, February 2023

• DHS, IT Security Procedural Guide, Developing a Contingency Plan (Appendix 1 of

DHS Security Program Handbook)

• CBP, System Life Cycle Handbook, CIS HB 5500-07B, Version 1.2, October 16, 2008

• Department of Defense Directive 8100.2, April 14, 2004, Use of Commercial Wireless

Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG)

• CBP Directive No. 1450-26 Use of Secure Messaging Platforms, June 29, 2023 o Annex A, Use of Secure Messaging Service and Multimedia Messaging Service;

Limited Use of Personal Devices, August 28, 2024

• CBP Records Information Management (RIM) Directive, 2210-040, January 3, 2019

HB 1400-05D Version 8.0 o CBP RIM Handbook, HB2100-05B, Version 1.0, June 3, 2019 o Capstone Email Policy, January 2021 o CBP RIM Program Annex D: Essential Records and Databases, Version 1.0, September, 18, 2020 o Minimum RIM Requirements for Electronic Information System (EIS), Version

1.0, January 2023 CBP RIM SharePoint site

Information Systems Security Policy Hierarchy Federal security policy flows from the executive level and Public Law to Department and Bureau levels. Development of policy at the national level generally begins with the creation of an Executive Order (EO), a Presidential Decision Directive (PDD), or a Public Law (PL). Other organizations such as the National Security Agency (NSA), the National Institute of Standards and Technology (NIST), and OMB also provide guidance and directives for policy development. Federal agencies use these orders, directives, laws, and guidance to generate policies and practices applicable to their organizations. Figure 1.6, Security Policy Development depicts the flow of points of policy origination for CBP

Figure 5.1: Security Policy Development https://cbpgov.sharepoint.com/sites/OIT/RIM/Pages/RIM_Policies_and_Mandates_2.1.aspx?xsdata=MDV8MDJ8amFzbWluZS5hdmlsYUBjYnAuZGhzLmdvdnwxOGIzYWZlOTk0ZmI0YTYwNWE3ZjA4ZGNjNzllOWEyYnxlNGIxNmI4NDRjNTY0ZjI3OWFmNzMwMzQ1YTE2MWFkNHwwfDB8NjM4NjA0NzMxMjA2MjYwMTUyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=YzJPVUV1UVZWcHdBYXBZdmJEeDU1NjkxdGlQTTZ4d0hNb2pFQnhONFlqbz0%3d

HB 1400-05D Version 8.0

Policy Overview Security of federal information systems is mandated by law (see References). Information security policy regulates how an organization protects and assigns resources to achieve its security objectives. Security safeguards and countermeasures are selected as a result of risk assessment activities. The overall CBP information technology security program encompasses the architectural framework that contains applications, networks, hardware, software, services, processes, policies, documentation, and resources that assist in accomplishing the CBP mission. Funding of CBP is closely tied to the robustness of its security program, which must be reported annually to OMB. Great importance is given to security authorization of applications and systems. Security status of a project is weighted heavily in Congressional funding considerations. Section II.B of the OMB Exhibit 300 annual report, requires detailed reporting on the security program.

CBP IT security policies delineate the security management structure and foundation to ensure adequate control over DHS sensitive information and systems. Policies in this document are organized under three areas: management, operational, and technical.

• Management controls - Focus on managing both system information security system and system risk. These controls consist of risk mitigation techniques and concerns normally addressed by management.

• Operational Controls – Focus on mechanisms primarily implemented and executed by the people responsible for the use of the system. These controls are designed to improve security or a particular system or group of systems. These controls require technical or specialized expertise and often rely on management and technical controls.

• Technical Controls – Focus on security controls executed by the information systems. These controls provide automated protection from unauthorized access or misuse. They facilitate detection of security violations, and support security requirements for applications and data.

Changes to Policy Procedures and guidance for implementing this policy are outlined in a companion publication and DHS 4300A Sensitive Systems Handbook and its attachments. The Handbook serves as the foundation for Components to use in developing their information security programs. However, there are additional policy areas addressed within the 1400-05D that are not addressed by DHS or are addressed more strictly than the DHS 4300A policy. For clarification of CBP information security policies or change requests, cyber.training.policy@cbp.dhs.gov.

• The CBP CISO is the authority for interpretation, clarification, and modification of the CBP 1400-05D Handbook (inclusive of all appendices and attachments).

• The CBP 1400-05D is reviewed at least annually.

Offenses and Penalties All users authorized to access CBP systems are responsible for complying with the policies in this handbook, as well as other CBP policies that govern standards of behavior within CBP.

mailto:cyber.training.policy@cbp.dhs.gov

HB 1400-05D Version 8.0

Failure to comply with these policies subjects a violator to the published penalties. Supervisors and managers are responsible for determining appropriate disciplinary action and applicable penalties for violations. Although some infractions may incur progressive disciplinary actions, others may be serious enough to warrant removal. Refer to the CBP Table of Offenses and Penalties for more information.

1.0 General CBP Security Policy

All information technology that generates, stores, processes, transfers, or communicates sensitive information shall be protected at a level commensurate with the threat. The following security practices, therefore, are necessary:

1. New system acquisitions, system development, and modifications to existing systems must be coordinated with the Office of Information and Technology Cybersecurity Directorate

2. It is recommended that a label be affixed to media containing Sensitive-But- Unclassified (SBU) information, especially in environments where both sensitive information and classified information are processed. Labels stating “this medium is unclassified” are available from General Services Administration (GSA) Standard Form (SF) 710. Unless otherwise specified, SBU data should be labeled as “For Official Use Only” and safeguarded against unauthorized disclosure, modification, access, use, or destruction. (See Table Information Handling Policies by Classification Level for details.)

3. All Major Applications (MAs) and General Support Systems (GSSs) must be authorized to comply with required security controls.

4. Connections between CBP information systems and any other systems or networks not under CBP authority are unauthorized, unless documented by a formally approved Interconnection Security Agreement (ISA) signed by the CBP Chief Information Security Officer (CISO). The non-CBP signatory representative(s) must have the authority to accept the system risk incurred by the connection to CBP. One non-CBP signatory authority would belong to the organization owning the information system and the point of connection to CBP.

The organization that owns the data to be transferred through the interconnection may also be a stakeholder in the interconnection. Therefore, an induvial from one or more organizations participating in the interconnection (e.g., the system owner and the data owner) may be the signatory authorities representing the non-CBP side of the connection. Because non-CBP organizations are participants in the ISA and are required to sign the agreement, CBP may have to be somewhat flexible in adhering to the ISA Template. The Information System Security Officer (ISSO) assigned to the system should be contacted before any modifications to the template are made.

5. CBP information systems are for authorized CBP business only.

6. Appropriate physical administrative, and technical safeguards will be implemented and maintained to ensure the most cost-effective security safeguards exist. These safeguards will be consistent with the approved CBP enterprise architecture to ensure proper integration and interoperability, HB 1400-05D Version 8.0

7. Installation of assistive software, hardware, or other adaptive devices is subject to standard CBP security testing and change request processes before introducing these products to the production environment. Such adaptive devices and/or software must not degrade or circumvent established system security controls.

8. The requirement to protect privacy information is a federal law. CBP systems of record will be afforded the level of security protection commensurate with the level of safeguards required by Federal Privacy Law. For more information on Privacy Law implementation within CBP, contact the Privacy and Diversity Office, Privacy Division.

9. Users have no expectation of privacy when using CBP network resources, including the use of electronic messaging, internet, and other CBP applications and systems. Acceptance of this condition is positively validated when users log onto the network.

10. Security of Non-CBP Sites:

Organizations providing contracted services to CBP at other than CBP facilities must adhere to the security policies described within this document to include federal policies and regulations. Services provided by non-CBP sites are integral parts of CBP MAs or GSSs and must be considered within the system boundaries of the security authorization process of the applicable information system.

All CBP information systems must be properly authorized. The Assistant Commissioner, OIT must authorize information systems that are functionally owned and managed by CBP. Any CBP information system operating without the approval of the Assistant Commissioner, OIT is not considered accredited, regardless of any other security authorization, unless there is an explicit written Memorandum of Understanding (MOU) that provides a different policy.

Non-CBP sites are subject to the same security review as government owned or controlled sites. The reviews are conducted in accordance with FISMA, which states:

“The head of each agency shall be responsible for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of the agency.” (H.R. 2458—51, section 3544).

The goal of the information system security review effort is to ensure that sensitive CBP information being processed at non-CBP facilities is appropriately protected commensurate with federal law, CBP policies, DHS regulations, and security best practices. The objectives of the security reviews are to assess the effectiveness of security controls in place at all facilities, identify areas of strength and weakness, assist in corrective measures, and issue resolution where necessary.

Guidance for a self-evaluation of the security controls implemented to protect CBP information systems (i.e., MAs and GSSs as listed in the CBP system inventory) compliance with CBP security policy. The self-assessment used by CBP is found in the NIST SP 800-53, which provides a detailed checklist for 17

HB 1400-05D Version 8.0 security areas. STP staff, namely the ISSOs will complete the self-assessment templates generated by the DHS IACS. Based on DHS requirements, artifacts produced by security reviews of government or contractor/consultant facilities will be completed for each MA or GSS system, but not necessarily for each individual site. Independent audit agencies may validate the results of the completed self-assessments of CBP information systems.

11. Digital and Other Electronic Signatures, the following DHS Policy Statements are applicable to both digital signatures and other electronic signature methods.

Policy ID CBP Policy Statement Relevant Controls

1.0a Digital signatures or other electronic signature methods are used whenever practical, except where handwritten signatures are required by law, regulation, Executive Order, or other agency requirement. Digital signature or other electronic signature methods, when properly executed, shall be accepted to the maximum extent practicable.

1.0b When implementing legally binding signatures for a particular application using digital signatures or other electronic signature methods, the participants (signers and relying parties) ensure that they are implemented with an adequate level of security to reduce the risk of malfeasance and/or fraud to an acceptable level, so that the alleged signer or an interested third party cannot:

1) Repudiate that they signed it

2) Deny any intent to sign

3) Challenge the integrity of the signed content

1.0c When a signature is required on electronic documents, transactions, communications, etc. for use within DHS, or for use for intra-governmental transactions, communications, etc., where all potential signers possess a Personal Identity Verification (PIV) card, Department of Defense (DoD)-issued Common Access Card (CAC), or PIV-I card (and the associated card readers, software, and verification processes are in place), the signing process employs a digital signature created by a properly identified signer through the use of their PIV card, CAC issued by DoD or PIV-I card, whenever possible.

Signers may use their software-based digital signature certificate that meets the requirements specified in Section 1.12.2.a below, for signing, when their PIV card, DoD-issued CAC, or PIV-I card cannot be used.

Other electronic signature methods may be used when it is

HB 1400-05D Version 8.0 determined that it is not possible for the signer to use his/her PIV card, DOD-issued CAC, PIV-I card, or software-based digital signature certificate that meets the requirements specified in Section 1.12.2.a below.

Users should consult their legal counsel when primary authentication methods are unavailable.

1.0d The following requirements are met when implementing legally binding signatures using Digital Signature or an Other Electronic Signature Method:

1) The Signer uses an acceptable electronic form of signature

2) The electronic form of signature is executed or adopted by a person with the intent to sign the electronic record

3) The electronic form of signature is attached to or associated with the electronic record being signed

4) There is a means to identify and authenticate a particular person as the signer

5) There is a means to preserve the integrity of the signed record.

1.0e Minimally, all electronic correspondence and official digital documents need a digital signature except where a wet signature is required.

Electronic signatures, including digital signatures, are implemented by applications with the necessary security controls and practices such that:

1. The signer cannot successfully repudiate that he/she intended to sign, or that he/she applied the electronic signature; and

2. The integrity of the signed content cannot be successfully challenged.

Refer to DHS 4300A Attachment Z “Electronic Signature Use, Acceptance, and Implementation Guidance” for further details.

1.0f When implementing legally binding electronic signatures for a specific use, where Other Electronic Signature Methods are used, the risk assessment process, described in the “DHS Electronic Signature Policy Guidance” document, Section I.G.

“Determining Which Electronic Signature Method to Use - Risk Assessment and Cost-Benefit Analysis”, are used to determine the overall level of risk, and the specific approaches to be implemented to meet each of the following five requirements for legally binding signatures:

1) The Signer uses an acceptable electronic form of signature;

2) The electronic form of signature is executed or adopted by a person with the intent to sign the electronic record;

3) The electronic form of signature is attached to or associated

HB 1400-05D Version 8.0 with the electronic record being signed;

4) There is a means to identify and authenticate a particular person as the signer;

5) There is a means to preserve the integrity of the signed record.

1.0g The date and time that a legally binding signature is executed, using Digital Signature or an Other Electronic Signature Method, is captured and incorporated as part of the record of the signature. The captured date and time are accurate and trustworthy.

Within DHS, legally binding signatures using a digital signature or other electronic signature method shall be executed on systems whose system clocks have been synchronized via Network Time Protocol (NTP) with DHS networks, and are managed to prevent unauthorized changes to the system clock.

When the signature is executed, the date and time from the system clock are captured and incorporated as part of the record of the signature.

When a legally binding signature is executed on a system whose system clock is not synchronized via NTP and managed to prevent unauthorized changes to the system clock, the signer is responsible for ensuring that the date and time incorporated as part of the record of the signature is accurate.

1.0h The visual context of an electronic signature implemented using digital signature or other electronic signature method, shall be maintained. The Relying Parties for the electronically signed document, transaction, communication, etc., can view the exact format and content of the document, transaction, communication, etc. that the Signer saw when he or she signed it.

1.0i Where a DHS entity is the Relying Party for an electronic signature executed on a non-DHS system by an external signer, using a digital signature or other electronic signature method, the DHS entity determines whether the asserted signing date and time is sufficiently accurate and trustworthy to be acceptable for the intended use of the signature.

Electronically signed records are maintained based on operational needs, perception of risks, and historical value, as formalized through corresponding Records Disposition Schedules approved by the National Archives and Records Administration (NARA). Operational needs are determined on the basis of the approach taken to ensuring the availability, accessibility, and trustworthiness of electronically signed records

HB 1400-05D Version 8.0 over time.

1.0j The CISO approves the design, development, resources and infrastructure for implementations of electronic signatures using Digital Signatures or Other Electronic Signature Methods. The adoption and integration of legally binding electronic signature capabilities into workflows, business processes, specific document types, etc., shall be reviewed and approved by CBP General Counsel and by the CBP Chief Records Officer.

Additional review/endorsement by other cognizant officials (e.g., PO; Chief Financial Officer; Forms Management Officer;

etc.) is obtained when appropriate.

1.0k All implementations of digital signatures or other electronic signature methods in DHS comply with the requirements of DHS Sensitive Systems Policy Directive 4300A.

Existing (legacy) implementations of electronic signatures are brought into compliance with DHS Sensitive Systems Policy Directive 4300A as soon as is practical, but in no case later than 12 months, or a waiver is obtained. Waivers are requested in writing and submitted to the DHS CISO.

Information Sharing and Communication Strategy

The DHS Security Operations Center (SOC) exchanges information with CBP and other Component SOCs, Network Operations Centers (NOCs), the Homeland Secure Data Network (HSDN) SOC, the Intelligence Community, and with external organizations in order to facilitate the security and operation of the DHS network. This exchange enhances situational awareness and provides a common operating picture to network managers. The operating picture is developed from information obtained from “raw” fault, configuration management (CM), accounting, performance, and security data. This data is monitored, collected, analyzed, processed, and reported by the NOCs and SOCs.

The DHS ESOC is responsible for communicating other information such as incident reports, notifications, vulnerability alerts and operational statuses to the CBP SOC, CBP CISO, or other identified CBP points of contact.

The DHS ESOC portal implements role-based user profiles that allow CBP to use the website’s incident database capabilities. Users assigned to CBP groups shall be able to perform actions such as:

• Entering incident information into the DHS ESOC incident database

• Generating preformatted incident reports

• Initiating queries of the incident database

• Viewing FISMA incident reporting numbers

HB 1400-05D Version 8.0

• Automating portions of the Information Security Vulnerability Management (ISVM) program

• Automating portions of the vulnerability assessment program

2.0 Roles and Responsibilities

The following roles and responsibilities are detailed in 4300A:

• Authorizing Official (AO)

• Chief Financial Officer (CFO)

• Chief Information Security Officer (CISO)

• Certification Agent (CA)

• Information Systems Security Manager (ISSM)

• Information Systems Security Officer (ISSO)

• Privacy Officer

• Security Accessor

Figure 2.0 Security Management Roles and Responsibilities depict security responsibility relationships and key roles within the CBP Information Security Program.

Office of Information and Technology

Assistant Commissioner and Deputy Assistant Commissioners

Authorizing Official (AO)

U.S Customs and Border Protection

Commissioner

CISO-Designated Information Systems Security Managers

(ISSMs)

Cybersecurity Directorate

Chief Information Security Officer (CISO)

HB 1400-05D Version 8.0

2.1 Commissioner

The Commissioner of CBP is responsible for all CBP systems and the associated responsibilities described below cannot be delegated. However, the Commissioner’s operational authority for the CBP Information Security Program is delegated to the Assistant Commissioner (AC), Office of Information and Technology (OIT). The Assistant Commissioner, OIT is an Authorizing Official for CBP information systems. The Commissioner’s responsibility includes ensuring that all information, classified or unclassified, and all CBP automated information systems and their data are protected in accordance with congressional and presidential directives.

Policy ID CBP Policy Statement Relevant

Controls

2.1 The CBP Commissioner ensures that information systems and their data are sufficiently protected.

PL-1

Within the Department of Homeland Security (DHS) security structure, the CBP Commissioner will:

1. Establish, maintain, and oversee the CBP Information Security Program including its security authorization process program. This responsibility includes the highest level of security management oversight of the development and implementation of all new or substantially modified CBP systems.

2. Appoint the Assistant Commissioner, OIT as one of the Authorizing Officials of CBP.

Authority is delegated in writing to the AO to approve or disapprove the operation of all systems functioning within CBP. The Deputy Assistant Commissioner will also be an Authorizing Official of CBP.

3. Appoint Chief Information Officers (CIOs), as documented in DHS security policy.

4. Appoint in writing the Executive Director, Cyber Security Directorate, as the CISO of

CBP.

Supervisors, Managers, Administrators, and Users of CBP Information Systems

Information Systems Security Officer (ISSO)

Security Control Assessor

(SCA)

HB 1400-05D Version 8.0

5. Assess and report annually the adequacy of the CBP Information Security Program to the

DHS CISO.

6. Ensure that security of CBP information systems is an integral part of the life cycle management process.

7. Ensure that performance measurement requirements are implemented into management of the CBP security program.

8. Establish a SOC with an interface to DHS Computer Emergency Readiness Team (CERT) and CISA.

9. Establish a centralized program for information systems security education, training, and awareness.

10. Ensure that organizations plan, budget, allocate, and spend adequate resources in support of information systems security.

11. Ensure data for IT systems are entered into the appropriate DHS Security Management Tool to support DHS IT security oversight and Federal Information Security Modernization Act of 2014 (FISMA) reporting requirements.

2.2 Executive Assistant Commissioner, Enterprise Services

Executive Assistant Commissioner, Enterprise Services, responsible for integrating and coordinating CBP’s mission support functions, including CBP’s hiring, budget and acquisition activities.

2.3 Assistant Commissioner, Officer of Information Technology The Assistant Commissioner, OIT is appointed in writing by the Commissioner. The Assistant Commissioner, OIT is an Authorizing Official (AO) and has the authority to assume formal responsibility on behalf of the Commissioner for operating all CBP systems at an acceptable level of risk. The Assistant Commissioner, OIT may authorize all CBP information systems and accept risk for the security posture of the data and systems. The Deputy Assistant Commissioner is also an Authorizing Official with the same authority. Within the CBP security structure, the OIT Assistant Commissioner is also the Chief Information Officer (CIO) for CBP.

2.4 Authorizing Official

CBP has three Authorizing Officials which include: the Assistant Commissioner, Office of Information and Technology, and both Deputy Assistant Commissioners, Office of Information & Technology.

The responsibilities of the AO include the following:

1. Grant the formal security Authorization or Approval-To-Operate (ATO) for a CBP information system.

2. Approve/disapprove system security authorization.

3. Terminate system operation if security conditions warrant such action.

4. Ensure key control compliance is well-documented and annually tested as part of the security authorization of systems supporting: 1) FISMA, 2) Privacy Sensitive Systems, and 3) Chief Financial Officer designated Financial Systems.

HB 1400-05D Version 8.0

5. Require security safeguards, if necessary, greater than the safeguards specified in the security authorization package submitted for approval. This determination will be based on the sensitivity or classification level of the data and the operating environment of an information system.

6. Withdraw security authorization and suspend operations when necessary. Grant waivers to CBP policy when circumstances warrant, and waivers are not in violation of applicable regulations. The AO can grant waivers to CBP policy.

7. Complete the following steps before authorizing an information system that does not include all the security requirements specified in this handbook:

a. Provide written notification to other Assistant Commissioners owning the data and information system of any security requirements that have not been implemented, residual risks, and mitigating safeguards. Review and approve corrective actions necessary to mitigate residual risk.

b. Provide the AO and/or an individual with the authority to accept the risk of a non- CBP system connected to a CBP system with a written list of any security requirements that are not implemented, residual risks, and mitigating safeguards.

c. State in the security authorization document that the Assistant Commissioner, OIT, understands and accepts responsibility for the residual risk, if any, of operating the system.

8. Task the CISO with the development, implementation, and maintenance of an adequate CBP-wide Information Security Program. Within this security program, include the development of procedures necessary to implement applicable security regulations, directives, and publications.

9. Task the Executive Director, Cybersecurity Directorate to formally review and approve all Interconnection Security Agreements (ISAs) that permit the interconnection of CBP-owned systems with any non-CBP-owned systems.

10. Ensure that operational information systems security policies are promulgated for each system for which the Assistant Commissioner and the Deputy Assistant Commissioner, OIT have approval authority.

11. Establish, implement, and maintain an information system security education, training, and awareness program.

12. Report security discrepancies, vulnerabilities, and threats, when applicable, to the non- CBP AO of interconnected systems.

13. Approve incident-reporting procedures.

14. Ensure technically qualified personnel perform security functions.

15. Ensure any individual requiring administrator privileges is reviewed and approved. The

AO may delegate this duty to the appropriate system owner or Program Manager.

16. Incorporate security throughout the System Life Cycle (SLC) process.

17. Ensure data ownership is established for each information system, to include accountability and access rights.

18. Review Notices of Findings and Recommendations (NFR) and Plan of Action and

Milestones (POA&M).

19. Review and approve corrective actions necessary to mitigate residual risks.

HB 1400-05D Version 8.0

2.5 Chief Financial Officer

The Assistant Commissioner of the Office of Finance is the CFO within CBP. The CBP CFO:

1. Works with the CIO and owners of all designated financial systems to help ensure the reliability of financial data processing through the systems.

2. Develops and establishes policies and procedures regarding automated application controls for software processing of financial data.

3. Remediates automated application controls deficiencies.

4. Works with system owners to designate an Information System Security Officer (ISSO) for each of the designated financial systems as defined in Section 2.9, Information System Security Officer.

5. Tracks and monitors progress of automated application controls remediation efforts.

6. Works with system owners of designated financial systems to ensure remediation of

Information Technology General Controls (ITGC) deficiencies related to IT policies and procedures.

7. Works with CIO to incorporate user requirements for new financial applications or upgrades to existing financial applications.

8. Works with the CIO to integrate and test CBP-wide business continuity plan.

9. Coordinates with the CIO to identify the financial data needed to be backed up and recovered.

2.6 Chief Information Officer

The Chief Information Officer (CIO) is responsible for overseeing implementation and compliance of CFO-designated financial systems and all other systems. The CIO:

1. Reviews and evaluate the CFO-designated financial systems to ensure ITGCs are in place and working effectively.

2. Works with the system owners to ensure remediation of ITGC deficiencies related to CFO-designated financial systems.

3. Tracks and monitor progress of ITGC POA&Ms and remediation efforts.

4. Ensures completion of Memorandums of Understanding (MOUs) and ISAs for CFO designated financial system interconnections with any system not owned by DHS; ensure that they include appropriate security clauses; and monitor service provider for compliance with MOUs and ISAs.

5. Implements the CBP-wide system development lifecycle methodology and monitor user compliance with this methodology.

6. As part of developing new financial applications or updating existing applications, integrates CFO feedback to ensure user requirement are adequately addressed.

7. Develops and tests CBP-wide disaster recovery plan. Coordinate with the CFO to incorporate business continuity requirements and test on a periodic basis.

HB 1400-05D Version 8.0

8. Based on CFO requirements, executes policies for the routine backing up and recovery of financial data. Implement policies and procedures for rotating back-up media offsite.

2.7 Financial System Owners

Systems owners are responsible for implementing and monitoring CBP policies, processes, and procedures related to the integrity of the data processed through the application and ongoing business processes. They are required to maintain the security of the technical and operational environment hosting the financial applications. Owners of CFO-designated financial systems:

1. Work with the CISO to ensure designated financial systems are properly secured.

2. Designate an ISSO for each of their respective designated financial systems

3. Ensure ITGCs are implemented and tested as required in DHS and CBP policy.

4. Develop, implement, and test application controls, as appropriate.

5. Ensure the completeness, accuracy,…