2.4.1-A0006_Attachment 5 - Cybersecurity.xlsx
XLSX spreadsheet 50 KB Posted
- Attached to
- ICE TELERADIOLOGY SERVICES
- Solicitation number
- 70CDCR26R00000016
- Issued by
-
Immigration and Customs Enforcement
About this file
This file is a cybersecurity authorization and continuous monitoring deliverables template for Immigration and Customs Enforcement (ICE) systems, designed to establish Authority to Operate (ATO) requirements and maintain compliance with federal security standards.
The template outlines thirteen primary security authorization deliverables that contractors must provide, including a signed Security Authorization Package due 90 days prior to go-live or ATO expiration. Key deliverables include System Characterization, System Security Plan (developed per NIST SP 800-18 and NIST SP 800-53 Rev 5 controls with minimum moderate baseline), e-Authentication Workbook, Standard Operating Procedures, Contingency Plan and testing documentation, Configuration Management Plan, Security Control Artifacts, Security Assessment Plan and Report, Security Control Assessment artifacts, Plans of Action and Milestones, and Interconnection Security Agreements. Additionally, contractors must submit Privacy Threshold Analysis and Privacy Impact Analysis documentation, security and privacy training artifacts, and continuous monitoring artifacts monthly. The template requires 100% compliance with DHS and ICE policy, the Safeguarding of Controlled Unclassified Information (CUI) directive, and federal regulations. Incident notification must occur within one hour for incidents involving personally identifiable information (PII) or sensitive personally identifiable information (SPII), and within eight hours for other incidents, directed to SOC@ice.dhs.gov. The supplementary Readiness Assessment Report (RAR) template addresses system information, security personnel identification, authorization boundary validation, contingency capabilities, configuration management maturity, continuous monitoring capabilities, and change management functions, requiring independent risk assessor validation and signed security packages at least 90 days prior to processing ICE data or within six months of award.
View the file
Other files
Show all 33
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Cybersec Deliverables
| Immigration and Customs Enforcement (ICE) Cybersecurity Authorization and Continuous Monitoring Deliverables | |
| Cybersecurity System: Enter System Name | Reference(s): |
| Submission Date: MM/DD/YY | HSAR Deviation 15-01 Rev 1 Safeguarding of CUI.pdf (dhs.gov) |
| Submission Deliverable Description | Format & Delivery instructions: | ||||
| System ATO Must Use ICE Template? YES | Frequency | Acceptable Quality Level | Document Reference | ||
| Signed Security Authorization Package (SA): The System Security Package supports evaluation of whether a system presents an acceptable risk to the ICE environment and can receive Authority to Operate (ATO). The package includes the SAP, SAR, POA&Ms, and other artifacts, as applicable. The package must be validated and signed by a third-party assessor. | Upload Word or pdf formatted documents to the government approved security repository. | The SA is due 90 days prior desired go-live and 90 days prior to ATO expiration and 90 days prior to major system changes or as agreed upon with the government security team (IAD). | 100% compliance: The SA package must be prepared in accordance with Department of Homeland Security (DHS) and ICE policy and procedures, in approved templates, as applicable. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 1. System Characterization (SC): The System Characterization (SC) document describes the system’s authorization boundary and will serve as the basis for the System Security Plan (SP). | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance: ICE offers a SC template, but information may be provided in a different template and/or separate deliverables if all required information is provided, current, and accurate. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 2. System Security Plan (SP): The purpose of the system security plan is to provide an overview of the security requirements of the system and describe the controls in place or planned for meeting those requirements. | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance: The SP must be developed in accordance with NIST SP 800-18 to include NIST SP 800-53 Rev 5 controls for the risk rating identified by the government FIPS-199 security categorization and a minimum baseline of moderate for confidentiality, integrity, and availability. The SP must contain all elements contained within the DHS SP template. All Controls require an implementation control statement and implementation status. Plan of Action and Milestones (POA&M) must be provided for controls with a status of Not Implemented or Planned. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 3. E-Authentication Workbook: This document determines if a e-authentication risk assessment is needed for the system. The risk assessment and e-authentication level are also determined in the document. | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 4. Standard Operating Procedures (SOP): Standard operating procedures provide step by step instructions to complete specific processes which implement the various security controls in accordance with DHS 4300A. | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 5. Contingency Plan (CP): This document defines the disaster recovery capabilities and processes for the system, in accordance with the Business Impact Analysis (BIA) requirements. | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 6. Contingency Plan Test (CPT): The CPT documents the test of the Contingency Plan and is the final step of the CP process. | Upload Word or pdf formatted documents to the government approved repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 7. Configuration Management Plan: A comprehensive description of the roles, responsibilities, policies, and procedures that apply when managing the configuration of products and systems. | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 8. Security Control Artifacts: These artifacts provide evidence that security controls and control enhancements are implemented and operating as intended. Artifacts are used to prepare and self-assess controls in advance of the Security Control Assessment (SCA). | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 9. Security Assessment Plan (SAP): The security assessment provides the objectives for the security and a detailed roadmap of how the assessment will be conducted. | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 10. Security Assessment Report (SAR): The SAR documents outcomes of the SCA including recommendations for correcting identified weaknesses or deficiencies in the controls. The SAR is submitted to the Authorizing Official (AO) as part of the ATO request package. | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 11. Security Control Assessment (SCA) Artifacts and Testing: An SCA is the testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements in accordance with DHS and ICE policy, NIST, FEDRAMP and federal regulation, as applicable. The outcome of the SCA supports the AO’s decision to authorize a system to operate or not. Artifacts of the SCA outcomes may be requested to support the AO’s decision. | Upload Word or pdf formatted documents to the government approved security repository. | Full SCA of all controls must be completed in advance of processing ICE and at least every third year following initial ATO. Annual assessment must be performed of at least 1/3 controls. | 95% of artifacts must be provided within two (2) business days of request; 100% of artifacts must be received within five (5) business days. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 12. Plans of Action and Milestones (POA&M): A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones. | |||||
| The remediation or “rem” plan is living document that provides a current list of security weaknesses identified through all RMF steps and the system owner’s plan to correct the finding. A POA&M must be created for findings not corrected within 30 days and will be entered into the DHS security compliance system. | Upload Word or pdf formatted documents to the government approved security repository. | Submit as part of the Security Assurance package and Monthly. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| SA 13. Interconnection Security Agreement (ISA): An Interconnection Security Agreement (ISA), Memorandum of Understanding (MOU), or Memorandum of Agreement (MOA) is needed between that share data that are owned or operated by different organizations. | Upload Word or pdf formatted documents to the government approved security repository. | Refer to SA package requirements. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| Privacy Threshold Analysis (PTA): The PTA is the privacy tool used to determine if the information system is privacy sensitive and will require a Privacy Impact Assessment (PIA) and System of Records Notice (SORN). The contractor will assist with completing the PTA development and updates, as applicable. | Upload the ICE approved Word PTA document to the government approved security repository. | Within three (3) business days of request. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| Privacy Impact Analysis (PIA): A Privacy Impact Assessment, or PIA, is an analysis of how personally identifiable information is collected, used, shared, and maintained. The purpose of a PIA is to demonstrate that program managers and system owners consciously incorporated privacy protections throughout the development life cycle of a system or program. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. | Upload Word or pdf formatted documents to the government approved security repository. | Within five (5) business days of request. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| Authority to Operate Letter: Memo documenting whether the AO grants or denies the system an Authorization to Operate (ATO). | The government will convey the ATO memo to the contractor upon approval. | N/A | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| Federal Reporting Requirements: Reporting requirements are determined by the Government and are defined in the current Fiscal Year DHS Information Security Performance Plan. | Upload Word or pdf formatted documents to the government approved security repository. | Monthly. | 95% of artifacts must be provided within three (3) business days of request; 100% of artifacts must be received within five (5) business days. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| Security and Privacy Training Artifacts | Upload Word, Excel, or pdf formatted documents to the government approved security repository. | Prior to processing ICE data and annually thereafter. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| Incident Notification | Email: SOC@ice.dhs.gov | All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery. | 100% compliance. | Safeguarding of Controlled Unclassified Information (July 2023) | |
| Continuous Monitoring Artifacts: All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the Information Security Continuous Monitoring (ISCM) requirements identified in the current Fiscal Year DHS Information Security Performance Plan. Artifacts of ISCM will be reviewed by the government on a recurring basis. | Upload Word or pdf formatted documents to the government approved security repository. | Monthly and within three (3) business days of receipt of the request. | 95% of artifacts must be provided within three (3) business days of request; 100% of artifacts must be received within five (5) business days. | Safeguarding of Controlled Unclassified Information (July 2023) |
https://www.dhs.gov/sites/default/files/2023-07/HSAR%20Deviation%2015-01%20Rev%201%20Safeguarding%20of%20CUI.pdf Readiness Rpt Immigration and Customs Enforcement (ICE) Operational Authorization (ATO) Readiness Assessment Information (HIGH/MOD)
Provide and validate the information below. This RAR template is intended for systems categorized at the High or Moderate security impact level, in accordance with the FIPS Publication 199 security categorization.
| System Information | ||
| Component: | Immigration and Customs Enforcement (ICE) | Office or Program: |
| System Name: | Acronym, if applicable: | |
| FISMA Name (if applicable): | FISMA Number (if applicable): | |
| FISMA ID: | System Operational Status: | |
| ATO Status (if applicable): | Not started | Expected ATO date (if applicable): |
| System Overview: | [Briefly describe the functionality of the system and service being provided.] | |
| FIPS PUB 199 System Security Level: |
| System Security Confidence | |
| IMPORTANT: System must have a plan to provide a complete NIST 800-53-based and DHS 4300A compliant security package based on current revisions, signed by an independent risk assessor, for review and authority to operate 90 days prior to processing ICE data or within 6 months of award, as applicable. | |
| Evaluate security personnel understanding of DHS security policy, directives, and procedures. | [Fully, Partial, or None] |
| Do the system have an established security program? | |
| If Yes, is it based on NIST 800-53 and DHS 4300A compliance? | |
| Security Confidence Overview: | [Briefly describe the system's security compliance process, if any.] |
| Does the system fully support user authentication via Personal Identity Verification (PIV) or Common Access Card (CAC) credentials? | |
| Does the system require Multi-Factor Authorization (MFA) for administrative accounts and functions? | |
| Does the system employ automated mechanisms to support account management? | |
| Does the system restrict non-authorized personnel’s access to resources? | |
| Does the system restrict non-privileged users from performing privileged functions? | |
| Does the system ensure secure separation of customer data? Processing environments? |
| System Security Personnel | |
| Project, Program, or System Manager | |
| Name: | Title: |
| Office: | |
| Phone: | Email: |
| Information System Security Officer (ISSO) (If applicable) | |
| Name: | |
| Office: | |
| Phone: | Email: |
| Additional Security Personnel | |
| Name: | |
| Office: | |
| Phone: | Email: |
SSS 1. System Characterization (SC) - Authorization Boundary
| Full authorization boundary validation for the RAR is required through independent assessment The authorization boundary is inserted within the system's SP. System should ensure that all system-identified items are currently present and are part of the system inventory including, but not limited to, discovery scans, in-person interviews, and physical examinations where appropriate. |
| IMPORTANT: Ensuring authorization boundary accuracy in the RAR is critical to ICE authorization activities. Inaccuracies within the RAR may give Authorizing Officials (AO) grounds for removing a system from assessment and authorization activities. |
| Has the system completed an authorization boundary network and architecture diagram? |
| Has the system provided a written description of the authorization boundary? |
| Have additional environments been identified and included in the Authorization Boundary? |
| Have interconnected systems been identified in the Authorization Boundary? |
| Have alternate processing sites been included in the Authorization Boundary? |
| List APIs implemented within the system Authorization Boundary ? |
Has the system's Authorization Boundary been validated through assessment?
SSS 2. System Security Plan (SP)
| System should explicitly state whether their SP is fully developed, partially developed, or non-existent. Identify any sections that the system has not yet developed. | |
| What is the state of the system's SP? | [Fully developed, Partially developed, or Non-existent] |
| What is the maturity level of the system's SP? | [Low, Moderate, High] |
| Describe all risks that could be introduced in a full assessment. |
SSS 3. e-Authentication Risk Analysis
| If Yes to below questions, system must complete e-Authentication workbook. |
| Does your system require authentication? |
| Is your system browser-based? |
| Is your system external facing with external users requiring authentication and following NIST 800-53 and FedRAMP guidance? |
SSS 4. Standard Operating procedure (SOP)
| Has the system identified that SOPs include specific processes which implement the various security controls in accordance with DHS 4300A and NIST800-53? |
| Has the system reviewed SOPs for any missing NIST 800-53 and DHS 4300A policies and procedures? |
SSS 5 & 6. Contingency Plan (CP) and Contingency Plan Test (CPT)
| Does the system have the capability to recover the system to a known and functional state following an outage, breach, DoS attack, or disaster? |
| Does the system have a Contingency Plan and a fully developed Contingency Test Plan in accordance with NIST Special Publication 800-34? |
| Does the system have alternate storage and processing facilities? |
| Does the system have primary and alternate telecommunications services from different providers? |
| Does the system have backup power generation or other redundancy? |
| Does the system have SLAs in place with all telecommunications providers? |
SSS 7. Configuration Management Plan
| Does the system maintain a current, complete, and accurate baseline configuration of the information system? |
| Does the system maintain a current, complete, and accurate inventory of the information system software, hardware, and network components? |
| Does the system have a configuration management plan? |
| Does the system follow a formal change control process that includes a security impact assessment? |
| Does the system employ automated mechanisms to detect inventory and configuration changes? |
| Does the system prevent unauthorized changes to the system? |
| Does the system establish configuration settings for products employed that reflect the most restrictive mode consistent with operational requirements? |
| Does the system implement automated tools, such as Security Information and Event Management (SIEM) technologies, to support the integrated auditing, logging, and real time analysis of security-related events and alerts? |
| Does the system retain online audit records for at least 90 days to provide support for after-the-fact investigations of security incidents and offline for at least one year to meet regulatory and organizational information retention requirements? |
| Does the system ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP)-validated or SCAP-compatible (if validated checklists are not available)? |
| Are FIPS 140-validated cryptographic modules (IAW SC-13) consistently used everywhere cryptography is required? |
| Identify any non-compliant crytographic modules. |
| Does the system’s DNS solution support DNS Security (DNSSEC) to provide origin authentication and integrity verification assurances? |
SSS 8. Security Control Artifacts
| Has the system completed a self-assessment to ensure that controls and control enhancements are implemented and operating as intended and can be supported by artifacts? |
| How often does the system complete a self-assessment? |
SSS 9. Security Assessment Plan (SAP)
Can the system provide a SAP to confirm recent assessment?
SSS 10. Security Assessment Report (SAR)
| Can the system provide a SAR for review of an assessment that has occurred less than one year and the outcomes of the SCA for correcting identified weaknesses or deficiencies of controls for the system? |
| How regularly are independent assessment assessments completed for the system? |
SSS 11. Security Control Assessment (SCA) Artifacts and Testing
These artifacts provide evidence that security controls and control enhancements are implemented and operating as intended.
Artifacts are used to prepare and self-assess controls in advance of the Security Control Assessment (SCA).
Has the system provided all requested SCA artifacts to support controls and control enhancements?
SSS 12. Plans of Action and Milestones (POA&M)
| Does the system have a process to identify the system's non-compliance /failures on controls and control enhancement and the subsequent remediation? |
| Can the system provide supporting documentation for the POA&Ms and a remediation plan to correct the findings? |
| Does the system have the ability to consistently remediate High vulnerabilities within 30 days, Moderate vulnerabilities within 90 days, and Low vulnerabilities within 180 days? |
SSS 13. Interconnection Security Agreement (ISA)
| Has the system reviewed the authorization boundary to ensure that all required ISAs, MOUs, and MOAs have been obtained from interconnecting systems? |
| List identified interconnected systems. |
Privacy Threshold Analysis (PTA)
| Does your system store Personal Identifiable Information (PII)? If Yes, then the system will be required to complete a Privacy Impact Analysis (PIA). |
| Does your system have a completed Privacy Threshold Analysis (PTA) that has been signed by the Privacy Office? |
Privacy Impact Analysis (PIA)
| If a PIA is required, system should contact the Privacy Office. |
| Does system have a completed PIA that has been reviewed and signed by the Privacy Office? |
Authority to Operate Letter
Has the system received a memo documenting whether the Authorizing Official (AO) grants or denies the system an Authorization to Operate (ATO).
Federal Reporting Requirements
| Is the system aware of the Federal reporting requirements and confirmed that they can fulfill the responsibility of providing the requested information regularly? |
| Does the system meet Federal Records Management Requirements, including the ability to support record holds, National Archives and Records Administration (NARA) requirements, and Freedom of Information Act (FOIA) requirements? |
Security and Privacy Training Artifacts
| Does the system train personnel on security awareness and role-based security responsibilities? |
| Can the system provide supporting artifacts for security awareness and role-based security training? |
Incident Response Notification
| Does the system protect audit information from unauthorized access, modification, and deletion? |
| Does the system have the capability to detect unauthorized or malicious use of the system, including insider threat and external intrusions? |
| Does the system have an Incident Response Plan and a fully developed Incident Response test plan? |
| Has the system exercised the Incident Response Plan within the last 12 months? |
| Does the system implement automated mechanisms for incident tracking, handling, reporting, and analysis? |
| Does the system notify customers and regulators of confirmed incidents in a timeframe consistent with all legal, regulatory, or contractual obligations? |
| Does the system notify customers and regulators of confirmed incidents in a timeframe consistent with all legal, regulatory, or contractual obligations? |
| Does the system employ automated mechanisms to make security alert and advisory information available throughout the organization? |
Continuous Monitoring (ConMon) Capabilities
| Question | Yes / No | Describe capability, supporting evidence, and any missing elements. | How long has the system been performing this ConMon? |
| Does the system have a lifecycle management plan that ensures products are updated before they reach the end of their vendor support period? | |||
| Does the system have a plan and capability to perform security code analysis and assess code for security flaws, as well as identify, track, and remediate security flaws? | |||
| Does the system have the ability to scan all hosts in the inventory? | |||
| Does the system have the ability to provide scan files in a structured data format, such as CSV, XML, or .nessus files? | |||
| Does the system have the capability to detect, contain, and eradicate malicious software? | |||
| Is the system properly maintaining their Plan of Action and Milestones (POA&M), including timely, accurate, and complete information entries for new scan findings, vendor check-ins, and closure of POA&M items? | |||
| When a High vulnerability is identified as part of ConMon activities, does the system consistently check audit logs for evidence of exploitation? | |||
| Does the system perform authenticated operating system/ infrastructure, web, database, and container vulnerability scans at least monthly, as applicable? |
| Additional ConMon Details |
| Include any additional system continuous monitoring details believed to be relevant to the system's capabilities: |
| Continuous Monitoring Artifacts |
| Can the system provide supporting artifacts for contiuous monitoring capabilities? |
| Change Management Maturity | ||
| Question | Yes / No | If No, describe how this function is accomplished. |
| Does the system’s change management capability include a fully functioning Change Control Board (CCB)? | ||
| Does the system have and use development and/or test environments to verify changes before implementing them in the production environment? |
Record of Changes
| Record of Changes for Template | |||
| Date | Description | Version | Author |
| 5/8/24 | Initial version. | 1.0 | ICE CRMA |
File details come from the government source that posted it. Updated .