FINAL Attachment J.9 - CWMD Sensitive Systems_Requirements Traceability Matrix_2020928.pdf

SECURITY CONTROL GUIDANCE

SENSITIVE SYSTEMS

REQUIREMENTS TRACEABILITY MATRIX

Department of Homeland Security Countering Weapons of Mass Destruction Office

Version Number: 1.0 September 28, 2020

For use with Countering Weapons of Mass Destruction Office Acquisitions and Procurements

Security

This page intentionally left blank.

Page i

Table of Contents

1.0 Purpose

2.0 Scope

3.0 References

4.0 Definitions

5.0 Responsibilities

6.0 Processes and Procedures

7.0 CWMD Sensitive Systems Control Guidance

Page ii

This page intentionally left blank.

Page 1 of 92 CWMD Sensitive Systems RTM, Version 1.0

1.0 Purpose

This document provides the Countering Weapons of Mass Destruction Office (“CWMD”) requirements regarding the selection and implementation of the security controls for managing and safeguarding Supplier systems to be used with DHS sensitive information. These requirements are collectively referred to as the “CWMD Sensitive Systems Requirements Traceability Matrix” (hereinafter, the “RTM”).

The RTM is established using the requirements of the DHS Sensitive Systems Policy Directive 4300A and supporting instructions and guides. These DHS publications are founded in U.S.

law—among others, the Federal Information Security Management Act of 2002 (“FISMA”) and Federal Information Security Modernization Act of 2014 (also “FISMA”)—and National Institute of Standards and Technology (“NIST”) Federal Information Processing Standards Publications (FIPS PUB) and Special Publication (“SP”) 800 series of publications. NIST publications are standards adopted and promulgated under the provisions of Section 5131 of the Information Technology Management Reform Act of 1996, Public Law (P.L.) 104-106, and the Federal Information Security Management Act (FISMA) of 2002, P.L. 107-347.

FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems,” directs Federal Government organizations to categorize their information systems as low, moderate, or high impact for each of the three information security objectives (confidentiality, integrity, and availability). The overall impact categorization of a system is generally equal to the highest impact assigned to any of the three objectives (high-water mark);

however, this is not necessarily the case for DHS systems.

DHS amplifies the FIPS PUB 199 high-water mark requirement to reflect actual security requirements, a Department-level risk-based decision that is consistent with FISMA policy, which requires Federal agencies to “cost-effectively reduce information security risks to an acceptable level.” The policy amplification is also consistent with the NIST information security guidance that promotes the concept of “risk-based decisions.”

Controls tailoring, and use of compensating controls, is consistent with providing the safeguards necessary to reduce the risks in a specific operational environment. A system is to have the security controls necessary to meet its security objectives without implementing unnecessary controls. However, CWMD may require additional controls when deemed appropriate and necessary.

2.0 Scope

This RTM applies to Supplier information technology used with DHS sensitive information.

These systems include networks, information systems, standalone systems, and applications for which the Supplier is responsible and has authority, regardless of the physical location.

Page 2 of 92 CWMD Sensitive Systems RTM, Version 1.0

All information furnished the Supplier by the Government, unless otherwise designated, is DHS Sensitive information as is all information produced by the Supplier under contract to the Government.

All Supplier information technology to be used with DHS sensitive information are sensitive systems and subject to DHS requirements for sensitive systems.

Sensitive information and the information technology on which it is processed are categorized based upon the guidance in FIPS 199. Using this categorization, appropriate initial security control set—baselines—and their applicability by security objective and provisional impact assessment (e.g., Low, Moderate, or High) are selected.

3.0 References

This list of references is representative and is not intended to be comprehensive.

a. Homeland Security Acquisition Regulation (HSAR) 48 CFR 3052.204-70, “Security

Requirements for Unclassified Information Technology”

b. HSAR 3052.204-71, “Contractor Employee Access”

c. Chief Procurement Officer Memorandum, “Class Deviation 15-01 from the Homeland

Security Acquisition Regulation: Safeguarding of Sensitive Information;” March 9, 2015

d. DHS Directive 140-01, Revision 02, Information Technology Security Program;” May 05,

e. DHS Sensitive Systems Policy Directive 4300A

f. DHS Directive 047-01, “Privacy Policy Compliance;” 7/7/2011

g. DHS Instruction 047-01-006, “Privacy Incident Responsibilities and Breach Team

Responsibilities;” 12/04/2017

h. DHS Instruction 047-01-008, Revision 00.1, “Privacy Incident Handling Guidance (PIHG);”

December 4, 2017

For a detailed listing of references that apply to DHS sensitive systems, refer to References d.

and e.

4.0 Definitions

4.1 Acquirer means the organization responsible for the design, development, and delivery of capabilities

4.2 Acquisition means the acquiring by contract with appropriated funds of supplies or services (including construction) by and for the use of the Federal Government through purchase or lease, whether the supplies or services are already in existence or must be created, developed, Page 3 of 92 CWMD Sensitive Systems RTM, Version 1.0 demonstrated, and evaluated. Acquisition begins at the point when agency needs are established and includes the description of requirements to satisfy agency needs, solicitation and selection of sources, award of contracts, contract financing, contract performance, contract administration, and those technical and management functions directly related to the process of fulfilling agency needs by contract.

4.3 Procurement means the act of buying goods and services for the Government; The term “Procurement” applies to the process of obtaining goods or services at DHS S&T and differs from the term “Acquisition” which applies to formal programs in DHS and other components to acquire systems and services. Procurement focuses primarily on contracting or other purchasing activities, and is generally a subset of acquisition, which is a much broader term, especially as it relates to acquisition of systems.

4.4 Information security [also “Cybersecurity”] means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide-

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information;

and

(3) Availability, which means ensuring timely and reliable access to, and use of, information.

4.5 Information technology [also “Information System”] means any equipment, or interconnected system(s) or subsystem(s) of equipment, that is used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency.

(1) For purposes of this definition, equipment is used by an agency if the equipment is used by the agency directly or is used by a contractor under a contract with the agency that requires-

(i) Its use; or

(ii) To a significant extent, its use in the performance of a service or the furnishing of a product.

(2) The term “information technology” includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

(3) The term “information technology” does not include any equipment that-

(i) Is acquired by a contractor incidental to a contract; or

(ii) Contains imbedded information technology that is used as an integral part of the product, but the principal function of which is not the acquisition, storage, Page 4 of 92 CWMD Sensitive Systems RTM, Version 1.0 analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. For example, HVAC (heating, ventilation, and air conditioning) equipment, such as thermostats or temperature control devices, and medical equipment where information technology is integral to its operation, are not information technology.

4.6 National defense means any activity related to programs for military or atomic energy production or construction, military assistance to any foreign nation, stockpiling, or space, except that for use in subpart 11.6, see the definition in FAR 11.601.

4.7 Offer means a response to a solicitation that, if accepted, would bind the offeror to perform the resultant contract. Responses to invitations for bids (sealed bidding) are offers called “bids” or “sealed bids”; responses to requests for proposals (negotiation) are offers called “proposals”;

however, responses to requests for quotations (simplified acquisition) are “quotations,” not offers. For unsolicited proposals, see FAR subpart 15.6.

4.8 Offeror means offeror or bidder.

4.9. Public information means any information which can be disclosed to the public without restriction, but requires protection against erroneous manipulation or alteration (e.g., public websites).

4.10 Sensitive information means any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy of individuals, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy.

4.11 Sensitive system means any combination of facilities, equipment, personnel, procedures, and communications that is integrated for a specific purpose, and that may be vulnerable to an adversarial attack by an adversary seeking to violate or disrupt the system’s confidentiality, integrity, or availability.

4.12 Supplier means a person or organization that provides something needed such as a product or service.

4.13 Supply chain threat means a man-made threat achieved through exploitation of the system’s supply chain or acquisition process.

A system’s supply chain is composed of the organizations, people, activities, information, resources, and facilities for designing, creating and moving a product or service from suppliers

Page 5 of 92 CWMD Sensitive Systems RTM, Version 1.0 through to the integrated system (including its sub-Components), and into service by the original acquirer.

5.0 Responsibilities

Responsibilities are as delineated in DHS Sensitive Systems Policy Directive 4300A, the Homeland Security Acquisition Regulation (HSAR) Clause 3052.204-70, Class Deviation 15-01 from the Homeland Security Regulation: Safeguarding of Sensitive Information and the following:

5.1 Supplier.

When a Supplier is to use DHS sensitive information with Supplier information technology, the Supplier will coordinate with CWMD to

• determine the information to be o furnished by the Government and o be developed/produced by the Supplier;

• map the information to the information types of NIST SP 800-60, Volume II, “Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories;”

• derive and assess the security categorization using of NIST SP 800-60, Volume II;

• identify, using the assessed security categorization and NIST Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, the baseline security controls for the Offeror/Supplier information system;

• tailor the baseline of security controls to establish those to be incorporated in the Supplier system security plan;

6.0 Processes and Procedures

6.1 The RTM includes the high-level text of each security control from NIST SP 800-53

Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations.

6.2 DHS defined values for organizationally-defined parameters defined by DHS are shown in red, bold italics.

6.3 Whenever the parameters for organizationally defined values do not contain DHS or CNSS values, then it is incumbent upon the appropriate Chief Information Security Officer (CISO) or Information System Security Manager (ISSM) to define those values based on mission/business needs.

6.4 For DHS Systems, the DHS 4300A Policy Series, along with the proper application and documentation of all relevant “-1” baseline controls, and DHS defined values, supplemental guidance, and any inheritable network or enterprise controls provide the basis for satisfying all “-1” security controls.

Page 6 of 92 CWMD Sensitive Systems RTM, Version 1.0

6.5 Within the table, there are three columns for the three security objectives (e.g., confidentiality, integrity, and availability) and three for the possible values (e.g., high, moderate, or low).

• An “X” within one of these columns signifies the security control allocated to that security objective and at what value(s).

• A blank column signifies that a security control is not allocated.

6.7 A security control may be:

(1) Common – Inherited from the organization, environment, or infrastructure where the system is intended to operate;

(2) System Specific – The responsibility of the Information System Owner

(ISO)/Program Manager (PM); or

(3) Hybrid – A portion of the control is Common and a portion is System Specific.

7.0 CWMD Sensitive Systems Control Guidance

See table below

Page 7 of 92 CWMD Sensitive Systems RTM, Version 1.0

Countering Weapons of Mass Destruction Office Sensitive Systems

Requirements Traceability Matrix

Page 8 of 92 CWMD Sensitive Systems RTM, Version 1.0

Access Control (AC)

IMPACT

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev 4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-1 Access Control Policy and Procedures

L M H C I A The organization: a. Develops, documents, and disseminates to DHS personnel: 1. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2.

Procedures to facilitate the implementation of the access control policy and associated access controls; and b. Reviews and updates the current: 1. Access control policy at least annually and 2. Access control procedures at least annually.

Enterprise

AC-2 Account Management

L M H C The organization: a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: privileged users, administrators; b.

Assigns account managers for information system accounts; c. Establishes conditions for group and role membership; d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e. Requires approvals by SOs, AOs, Program Managers for requests to create information system accounts; f. Creates, enables, modifies, disables, and removes information system accounts in accordance with system access control procesures;

g. Monitors the use of, information system accounts; h. Notifies account managers: 1. When accounts are no longer required; 2. When users are terminated or transferred; and 3. When individual information system usage or need-to-know changes; i. Authorizes access to the information system based on: 1. A valid access authorization; 2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements at least annually; and k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Enterprise

AC-2(1) Account Management | Automated System Account Management

M H C The organization employs automated mechanisms to support the management of information system accounts.

NA

AC-2(2) Account Management | Removal of

M H C The information system automatically [suggestion: removes] temporary and emergency accounts after [suggestion: subject to renewal every 24 hours].

Enterprise

Page 9 of 92 CWMD Sensitive Systems RTM, Version 1.0

IMPACT

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

Temporary / Emergency Accounts

AC-2(3) Account Management | Disable Inactive Accounts

M H C The information system automatically disables inactive accounts after 90 days for low confidentiality systems and 45 days for moderate and high confidentiality systems.

Enterprise

AC-2(4) Account Management | Automated Audit Actions

M H C The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies the System Owner, ISSM, ISSO and System Administrators.

Enterprise

AC-2(5) Account Management | Inactivity Logout

H C The organization requires that users log out when after 20 minutes of inactivity. Enterprise

AC-2(12) Account Management | Account Monitoring / Atypical Usage

H C The organization: (a) Monitors information system accounts for atypical use; and (b) Reports atypical usage of information system accounts to Component or DHS Headquarters Security Office pursuant to DHS Instruction 262-05-002.

Enterprise

AC-2(13) Account Management | Disable Accounts For High-Risk Individuals

H C The organization disables accounts of users posing a significant risk within 30 minutes unless otherwise defined in formal organizational policy of discovery of the risk.

Enterprise

AC-3 Access Enforcement L M H C The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

NA

AC-4 Information Flow Enforcement

M H C The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on DHS Information And Data Flow Guidelines Version 2.0.

Enterprise

AC-5 Separation of Duties M H C The organization: a. Separates critical information system functions; b. Documents separation of duties of individuals; and c. Defines information system access authorizations to support separation of duties.

Enterprise

AC-6 Least Privilege M H C The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

NA

Page 10 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-6(1) Least Privilege | Authorize Access to Security Functions

M H C The organization explicitly authorizes access to privileged functions (e.g., System Administrator, Security Administrator, Database Administrator (DBA)).

Enterprise

AC-6(2) Least Privilege | Non-Privileged Access For Nonsecurity Functions

M H C The organization requires that users of information system accounts, or roles, with access to privileged functions, use non-privileged accounts or roles, when accessing nonsecurity functions.

Enterprise

AC-6(3) Least Privilege | Network Access to Privileged Commands

H C The organization authorizes network access to organization/component-defined privileged commands only for defined compelling operational needs pursuant to the DHS Integrating Identity Management into Systems and Applications Appendix version 1.0 and documents the rationale for such access in the security plan for the information system.

Enterprise

AC-6(5) Least Privilege | Privileged Accounts

M H C The organization restricts privileged accounts on the information system to authorized personnel with assigned duties within the system.

Enterprise

AC-6(9) Least Privilege | Auditing Use of Privileged Functions

M H C The information system audits the execution of privileged functions. NA

AC-6(10) Least Privilege | Prohibit Nonprivileged Users from Executing Privileged Functions

M H C The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

NA

AC-7 Unsuccessful Logon Attempts

L M H C The information system: a. Enforces a limit of three (3) consecutive invalid logon attempts by a user during a [time period intentionally undefined]; and b. Automatically locks the account/node for 20 minutes until released by an administrator when the maximum number of unsuccessful attempts is exceeded.

Page 11 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-8 System Use Notification

L M H C The information system: a. Displays to users a warning banner specified by the DHS CISO before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: 1. Users are accessing a U.S. Government information system; 2.

Information system usage may be monitored, recorded, and subject to audit; 3.

Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and 4. Use of the information system indicates consent to monitoring and recording; b. Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and c. For publicly accessible systems: 1. Displays system use information in a security and a privacy statement at every entry point, before granting further access; 2. Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and 3. Includes a description of the authorized uses of the system.

Enterprise

AC-10 Concurrent Session Control

H C The information system limits the number of concurrent sessions for each user of DHS systems with a Federal Information Processing Standard (FIPS) 199 confidentiality categorization of high to one (1) unless strong authentication is used.

Enterprise

AC-11 Session Lock M H C The information system: a. Prevents further access to the system by initiating a session lock after twenty (20) minutes of inactivity or upon receiving a request from a user; and b.

Retains the session lock until the user reestablishes access using established identification and authentication procedures.

Enterprise

AC-11(1) Session Lock | Pattern-Hiding Displays

M H C The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

NA

AC-12 Session Termination M H C The information system automatically terminates a user session after thirty (30) minutes of inactivity.

Enterprise

AC-14 Permitted Actions Without Identification or Authentication

L M H C I The organization: a. Identifies no user actions that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and b. Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.

Enterprise

AC-17 Remote Access L M H C The organization: a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b.

Authorizes remote access to the information system prior to allowing such connections.

Page 12 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-17(1) Remote Access | Automated Monitoring / Control

M H C The information system monitors and controls remote access methods. NA

AC-17(2) Remote Access | Protection of Confidentiality / Integrity Using Encryption

M H C The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

NA

AC-17(3) Remote Access | Managed Access Control Points

M H C The information system routes all remote accesses through [network access control points are not restricted by number] managed network access control points.

Enterprise

AC-17(4) Remote Access | Privileged Commands / Access

M H C The organization: (a) Authorizes the execution of privileged commands and access to security-relevant information via remote access only for accounts approved to use privileged commands and access secuirty relevant information only after identification and authentication; and (b) Documents the rationale for such access in the security plan for the information system.

Enterprise

AC-18 Wireless Access L M H C The organization: a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and b. Authorizes wireless access to the information system prior to allowing such connections.

NA

AC-18(1) Wireless Access | Authentication and Encryption

M H C The information system protects wireless access to the system using authentication of users and devices and encryption.

Enterprise

AC-18(4) Wireless Access | Restrict Configurations by Users

H C The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.

NA

AC-18(5) Wireless Access | Antennas / Transmission Power Levels

H C The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.

NA

AC-19 Access Control For Mobile Devices

L M H C The organization: a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

b. Authorizes the connection of mobile devices to organizational information systems.

Page 13 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-19(5) Access Control For Mobile Devices | Full Device / Container-Based Encryption

M H C The organization employs full-device encryption to protect the confidentiality and integrity of information on all mobile devices.

Enterprise

AC-20 Use of External Information Systems

L M H C The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to: a. Access the information system from external information systems; and b. Process, store, or transmit organization-controlled information using external information systems.

NA

AC-20(1) Use of External Information Systems | Limits on Authorized Use

M H C The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization: (a) Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or (b) Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.

NA

AC-20(2) Use of External Information Systems | Portable Storage Devices

M H C The organization restricts the use of organization-controlled portable storage devices by authorized individuals on external information systems.

Enterprise

AC-21 Information Sharing M H C I The organization: a. Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for information sharing circumstances where user discretion is required; and b. Employs automated mechanisms or manual processes to assist users in making information sharing/collaboration decisions.

Enterprise

AC-22 Publicly Accessible Content

L M H C I A The organization: a. Designates individuals authorized to post information onto a publicly accessible information system; b. Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c. Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and d. Reviews the content on the publicly accessible information system for nonpublic information monthlyand removes such information, if discovered.

Page 14 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-1 Access Control Policy and Procedures

L M H C I A The organization: a. Develops, documents, and disseminates to DHS personnel: 1. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2.

Procedures to facilitate the implementation of the access control policy and associated access controls; and b. Reviews and updates the current: 1. Access control policy at least annually and 2. Access control procedures at least annually.

Enterprise

AC-2 Account Management

L M H C The organization: a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: privileged users, administrators; b.

Assigns account managers for information system accounts; c. Establishes conditions for group and role membership; d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e. Requires approvals by SOs, AOs, Program Managers for requests to create information system accounts; f. Creates, enables, modifies, disables, and removes information system accounts in accordance with system access control procesures;

g. Monitors the use of, information system accounts; h. Notifies account managers: 1. When accounts are no longer required; 2. When users are terminated or transferred; and 3. When individual information system usage or need-to-know changes; i. Authorizes access to the information system based on: 1. A valid access authorization; 2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements at least annually; and k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Enterprise

AC-2(1) Account Management | Automated System Account Management

M H C The organization employs automated mechanisms to support the management of information system accounts.

NA

AC-2(2) Account Management | Removal of Temporary / Emergency Accounts

M H C The information system automatically [suggestion: removes] temporary and emergency accounts after [suggestion: subject to renewal every 24 hours].

Enterprise

AC-2(3) Account Management | Disable Inactive Accounts

M H C The information system automatically disables inactive accounts after 90 days for low confidentiality systems and 45 days for moderate and high confidentiality systems.

Page 15 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-2(4) Account Management | Automated Audit Actions

M H C The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies the System Owner, ISSM, ISSO and System Administrators.

Enterprise

AC-2(5) Account Management | Inactivity Logout

H C The organization requires that users log out when after 20 minutes of inactivity. Enterprise

AC-2(12) Account Management | Account Monitoring / Atypical Usage

H C The organization: (a) Monitors information system accounts for atypical use; and (b) Reports atypical usage of information system accounts to Component or DHS Headquarters Security Office pursuant to DHS Instruction 262-05-002.

Enterprise

AC-2(13) Account Management | Disable Accounts For High-Risk Individuals

H C The organization disables accounts of users posing a significant risk within 30 minutes unless otherwise defined in formal organizational policy of discovery of the risk.

Enterprise

AC-3 Access Enforcement L M H C The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

NA

AC-4 Information Flow Enforcement

M H C The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on DHS Information And Data Flow Guidelines Version 2.0.

Enterprise

AC-5 Separation of Duties M H C The organization: a. Separates critical information system functions; b. Documents separation of duties of individuals; and c. Defines information system access authorizations to support separation of duties.

Enterprise

AC-6 Least Privilege M H C The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

NA

AC-6(1) Least Privilege | Authorize Access to Security Functions

M H C The organization explicitly authorizes access to privileged functions (e.g., System Administrator, Security Administrator, Database Administrator (DBA)).

Enterprise

AC-6(2) Least Privilege | Non-Privileged Access For Nonsecurity Functions

M H C The organization requires that users of information system accounts, or roles, with access to privileged functions, use non-privileged accounts or roles, when accessing nonsecurity functions.

Page 16 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-6(3) Least Privilege | Network Access to Privileged Commands

H C The organization authorizes network access to organization/component-defined privileged commands only for defined compelling operational needs pursuant to the DHS Integrating Identity Management into Systems and Applications Appendix version 1.0 and documents the rationale for such access in the security plan for the information system.

Enterprise

AC-6(5) Least Privilege | Privileged Accounts

M H C The organization restricts privileged accounts on the information system to authorized personnel with assigned duties within the system.

Enterprise

AC-6(9) Least Privilege | Auditing Use of Privileged Functions

M H C The information system audits the execution of privileged functions. NA

AC-6(10) Least Privilege | Prohibit Nonprivileged Users from Executing Privileged Functions

M H C The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

NA

AC-7 Unsuccessful Logon Attempts

L M H C The information system: a. Enforces a limit of three (3) consecutive invalid logon attempts by a user during a [time period intentionally undefined]; and b. Automatically locks the account/node for 20 minutes until released by an administrator when the maximum number of unsuccessful attempts is exceeded.

Enterprise

AC-8 System Use Notification

L M H C The information system: a. Displays to users a warning banner specified by the DHS CISO before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: 1. Users are accessing a U.S. Government information system; 2.

Information system usage may be monitored, recorded, and subject to audit; 3.

Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and 4. Use of the information system indicates consent to monitoring and recording; b. Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and c. For publicly accessible systems: 1. Displays system use information in a security and a privacy statement at every entry point, before granting further access; 2. Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and 3. Includes a description of the authorized uses of the system.

Enterprise

AC-10 Concurrent Session Control

H C The information system limits the number of concurrent sessions for each user of DHS systems with a Federal Information Processing Standard (FIPS) 199 confidentiality categorization of high to one (1) unless strong authentication is used.

Page 17 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-11 Session Lock M H C The information system: a. Prevents further access to the system by initiating a session lock after twenty (20) minutes of inactivity or upon receiving a request from a user; and b.

Retains the session lock until the user reestablishes access using established identification and authentication procedures.

Enterprise

AC-11(1) Session Lock | Pattern-Hiding Displays

M H C The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

NA

AC-12 Session Termination M H C The information system automatically terminates a user session after thirty (30) minutes of inactivity.

Enterprise

AC-14 Permitted Actions Without Identification or Authentication

L M H C I The organization: a. Identifies no user actions that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and b. Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.

Enterprise

AC-17 Remote Access L M H C The organization: a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b.

Authorizes remote access to the information system prior to allowing such connections.

NA

AC-17(1) Remote Access | Automated Monitoring / Control

M H C The information system monitors and controls remote access methods. NA

AC-17(2) Remote Access | Protection of Confidentiality / Integrity Using Encryption

M H C The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

NA

AC-17(3) Remote Access | Managed Access Control Points

M H C The information system routes all remote accesses through [network access control points are not restricted by number] managed network access control points.

Enterprise

AC-17(4) Remote Access | Privileged Commands / Access

M H C The organization: (a) Authorizes the execution of privileged commands and access to security-relevant information via remote access only for accounts approved to use privileged commands and access secuirty relevant information only after identification and authentication; and (b) Documents the rationale for such access in the security plan for the information system.

Enterprise

AC-18 Wireless Access L M H C The organization: a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and b. Authorizes wireless access to the information system prior to allowing such connections.

Page 18 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-18(1) Wireless Access | Authentication and Encryption

M H C The information system protects wireless access to the system using authentication of users and devices and encryption.

Enterprise

AC-18(4) Wireless Access | Restrict Configurations by Users

H C The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.

NA

AC-18(5) Wireless Access | Antennas / Transmission Power Levels

H C The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.

NA

AC-19 Access Control For Mobile Devices

L M H C The organization: a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

b. Authorizes the connection of mobile devices to organizational information systems.

NA

AC-19(5) Access Control For Mobile Devices | Full Device / Container-Based Encryption

M H C The organization employs full-device encryption to protect the confidentiality and integrity of information on all mobile devices.

Enterprise

AC-20 Use of External Information Systems

L M H C The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to: a. Access the information system from external information systems; and b. Process, store, or transmit organization-controlled information using external information systems.

NA

AC-20(1) Use of External Information Systems | Limits on Authorized Use

M H C The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization: (a) Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or (b) Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.

NA

AC-20(2) Use of External Information Systems | Portable Storage Devices

M H C The organization restricts the use of organization-controlled portable storage devices by authorized individuals on external information systems.

Page 19 of 92 CWMD Sensitive Systems RTM, Version 1.0

LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev

4)

L M H C I A CONTROL TEXT Enterprise or Component

Responsibility to Define

AC-21 Information Sharing M H C I The organization: a. Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for information sharing circumstances where user discretion is required; and b. Employs automated mechanisms or manual processes to assist users in making information sharing/collaboration decisions.

Enterprise

AC-22 Publicly Accessible Content

L M H C I A The organization: a. Designates individuals authorized to post information onto a publicly accessible information system; b. Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c. Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and d. Reviews the content on the publicly accessible information system for nonpublic information monthlyand removes such information, if discovered.

Page 20 of 92 CWMD Sensitive Systems RTM, Version 1.0

Awareness and Training (AT)

IMPACT LEVEL C I A

ID TITLE

(NIST SP 800-53 Rev 4) L M H C I A CONTROL TEXT Enterprise or

Component Responsibility to Define AT-1 Security Awareness and Training

Policy and Procedures L M H C I A The organization: a. Develops, documents, and disseminates to DHS personnel: 1. A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2. Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and b. Reviews and updates the current: 1. Security awareness and training policy at least annually;

and 2. Security awareness and training procedures at least annually.

Enterprise

AT-2 Security Awareness Training L M H C I A The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): a. As part of initial training for new users; b.

When required by information system changes; and c. at least annually thereafter.

Enterprise

AT-2(2) Security Awareness | Insider Threat M H C I A The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.

NA

AT-3 Role-Based Security Training L M H C I A The organization provides role-based security training to personnel with assigned security roles and responsibilities: a. Before authorizing access to the information system or performing assigned duties; b. When required by information system changes;

and c. at least annually thereafter.

Enterprise

AT-4 Security Training Records L M H C I A The organization: a. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and b. Retains individual training records for a minimum of three (3) years.

Page 21 of 92 CWMD Sensitive Systems RTM, Version 1.0

Audit and Accountability (AU)

(NIST SP 800-53 Rev 4) L M H C I A CONTROL TEXT Enterprise or

Component Responsibility to Define

AU-1 Audit and Accountability Policy and Procedures

L M H C I A The organization: a. Develops, documents, and disseminates to DHS personnel: 1. An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance;

and 2. Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and b. Reviews and updates the current:

1. Audit and accountability policy at least annually; and 2. Audit and accountability procedures at least annually.

Enterprise

AU-2 Audit Events L M H C I A The organization: a. Determines that the information system is capable of auditing the following events:

a. Identity of each user and device accessing or attempting to access the system;

b. Time and date of the access and the logoff;

c. Activities that might modify, bypass, or negate information security safeguards;

d. Security-relevant actions associated with processing;

e. All activities performed using an administrator’s identity;

b. Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; c. Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and d. Determines that the following events are to be audited within the information system: [Assignment:

organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].

Enterprise

AU-2(3) Audit Events | Reviews and Updates M H C I A The organization reviews and updates the audited events at least annually. Enterprise

AU-3 Content of Audit Records L M H C I A The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

NA

AU-3(1) Content of Audit Records | Additional Audit Information

M H C I A The information system generates audit records containing the following additional information: [Assignment: organization-defined additional, more detailed information].

Component

Page 22 of 92 CWMD Sensitive Systems RTM, Version 1.0

(NIST SP 800-53 Rev 4) L M H C I A CONTROL TEXT Enterprise or

Component Responsibility to Define

AU-3(2) Content of Audit Records | Centralized Management of Planned Audit Record Content

H C I A The information system provides centralized management and configuration of the content to be captured in audit records generated by [Assignment: organization-defined information system components].

Component

AU-4 Audit Storage Capacity L M H I A The organization allocates audit record storage capacity in accordance with the Component’s Record Schedule or with the DHS…