Attachment_4_-_CM_Policy.pdf

CUI

Federal Energy Regulatory Commission

Configuration Management Policy

June 25, 2018

Federal Energy Regulatory Commission

Information Security and Systems Assurance Division 888 1st Street NE

Washington, DC 20426

Configuration Management Policy Federal Energy Regulatory Commission i

Document Control

This is a controlled document produced by the Federal Energy Regulatory Commission. The control and release of this document is the responsibility of the document owner. This includes any amendment that may be required.

Document Control

Date June 25, 2018

Author Matthew Edwards

Document Title Configuration Management Policy

Customer Details

Name Mittal Desai

Office/Region Federal Energy Regulatory Commission, Washington, DC 20426

Contact Number (202) 502-6432

E-mail Address Mittal.Desai@ferc.gov

Revision History

Issue Date Author Comments

1.0 February 18, 208 Mittal Desai Official Release

2.0 February 8, 2011 William Murray Updated policy to comply with NIST 800-53 Rev.3

3.0 September 27, 2013 Mittal Desai • Removed Deputy

• Removed “D” from DCIO

4.0 June 23, 2016 Dan Girard Updated policy addition and removal of various boards

4.1 June 20, 2018 Dan Girard

Matthew Edwards

• Updated the references

• Clarified the purpose of the policy

• Added a responsibilities section.

• Delineated where CM fits in the SDLC process

• Delineated between types of change requests ii

Contents

1 INTRODUCTION

1.1 Authority

1.2 Purpose

1.3 Scope

1.4 Responsibilities

2 POLICY

2.1 Change Control Board (CCB)

2.2 Change Request (CRQ)

2.3 Standard CRQ (SCRQ)

2.4 Emergency CRQ (ECRQ)

2.5 Break Fix CRQ (BFCRQ)

APPENDIX A: ACRONYMS/TERMS AND DEFINITIONS

APPENDIX B: APPROVAL

1 INTRODUCTION

1.1 Authority

Applicable Executive Orders, National Policy, and Public Laws for this policy include the following:

• OMB Circular A-130, section 8b(3), Security Agency Information Systems

• FISMA, Public Law 107-47

• NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach

• NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View

• NIST SP 800-53 Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations

• NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems

• NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

• FERC Change Control Board Charter

1.2 Purpose

The purpose of this Configuration Management (CM) policy is to establish and maintain integrity and traceability of the Federal Energy Regulatory Commission (FERC) Information System(s) throughout the system’s life cycle. The goal of this CM policy is to ensure that changes to the system do not unintentionally or unknowingly diminish security. CM involves identification of hardware, software and infrastructure changes and ensures accountability for any modifications.

1.3 Scope

The scope of this document applies to FERC staff (employees and contractors) that plan, program, manage, develop and maintain FERC information systems.

1.4 Responsibilities

The following are the roles and responsibilities of FERC employees and contractors:

Role Responsibility

CIO • Chairs the Change Control Board (CCB), a formal board that is composed of senior FERC Federal personnel representing potential areas of impact within the Agency that evaluates any proposed Enterprise changes (Change Requests / CRQ) for impacts to security and mission; and

• Appoints and oversees the Division directors and sets risk acceptance levels.

Chief Information Security Officer

(CISO)

• Co-Chairs the CCB and voting member of the board;

• As the head of the ISSA division, evaluates security impacts and vulnerability mitigations for new network appliances and network configurations;

• Coordinates the assistance to IT Operations and Systems Development and Engineering, when necessary, with analyzing operations risk of new operating systems and other major software changes;

• Coordinates the exchange of information, requirements, and results between FERC divisions;

• Submits security related CRQs to the board; and

• Informs senior management of emerging trends and status of the overall IT security posture of the FERC enterprise.

IT Operations (IT Ops) Director

• Voting member of the board;

• Analyzes operational risk of proposed changes and creates mitigation options; and

• Manages resources for project implementation and vulnerability mitigation on servers, network devices, and other system software.

Systems Development and

Engineering (SDE) Director

• Voting member of the board;

• Analyzes operational risk of proposed changes and creates mitigation options;

• Manages resources to implement and/or advise and assist with vulnerability mitigations on web servers, databases and FERC customized applications software;

• Evaluates security impacts and vulnerability mitigations for new network appliances and network configurations; and

• Coordinates the assistance to IT Operations staff, when necessary, with analyzing operations risk of new operating systems and other major software changes.

Role Responsibility

IT Policy and Resources

Management (ITPRM) Director

• Voting member of the board;

• Review and approve the Enterprise Architecture (EA) section of the CRQ to ensure compliance with FERC’s IT architecture standards;

• Reviews CRQ for adherence to software licensing compliance;

• Manages the closure of CRQs and checks the environment for accurate deployment of hardware and software assets;

• Manages the integrity and accuracy of the EA repository by updating with completed CRQ information;

• Chair of Enterprise Architecture Working Group (EAWG) which reviews proposed technical solutions detailed in CRQs; and

• Oversees the Capital Planning and Investment Control (CPIC) process which is the step before the CM process.

2 POLICY

All CIO IT actions are categorized and characterized within the FERC System Development Life Cycle (SDLC). The CM policy and process ensues that all of the steps after procurement, to include implementation, operations, and decommissioning, of all IT components are authorized, documented, and controlled. The primary mechanism for implementing this configuration control is through the FERC Change Control Board (CCB). Configuration change control shall implement the systematic process to include justification, implementation, test/evaluation, review, and disposition of changes to the IT System baseline. This process includes all additions, upgrades and modifications to the FERC IT enterprise.

2.1 Change Control Board (CCB)

The FERC governance process through the CCB is the framework for decision making and accountability required to ensure that all FERC information technology (IT) configuration changes to IT production systems meet the strategic and business objectives of the Commission in an efficient and effective manner. The FERC CCB further ensures enterprise changes are executed in accordance with statutory and regulatory direction from the National Institute of Standards and Technology (NIST), Office of Management and Budget (OMB), and other applicable federal oversight entities. The FERC CCB is composed of senior members of the CIO office and is separately chartered. The Configuration Management process is tracked within a CIO controlled SharePoint site. The CCB nominally meets once a week to review and vote on all proposed actions.

2.2 Change Request (CRQ)

The CRQ is the primary change control form used to capture planned and approved changes to the FERC Development, Test, and Production Networks. This document tracks the technical details of any planned changes, enumerates the specific technical steps planned for the implementation of the action, the results of any applicable risk analysis, and the formal approval of all actions. CRQs will be approved through a quorum vote by the CCB voting members.

2.3 Standard CRQ (SCRQ)

The purpose of the Standard Change Request (SCRQ) form is to effectively identify, track, approve and deploy routine changes to the FERC enterprise. The SCRQ process is a shortened version of the CRQ process to reduce the time to identify and deploy minor changes and small software installs yet still maintain configuration tracking and accountability.

2.4 Emergency CRQ (ECRQ)

Action may be required urgently if a production system has an issue with confidentiality, integrity, or availability. These efforts are classified as “Emergency Maintenance” within the CM process and any activities necessitate expedited action. ECRQs may be requested and authorized by a CIO division director, or their acting designee, through written communication to the CCB e-mail group.

The division director has three working days to facilitate a formal CRQ submittal detailing the actions and results of the ECRQ.

2.5 Break Fix CRQ (BFCRQ)

Action may be required immediately if a production system has an issue with confidentiality, integrity, or availability. A break fix is an immediate effort to investigate and resolve an urgent unplanned problem. This could include an immediate action by system security staff to preserve service in response to an outside cyberattack on the FERC infrastructure. BFCRQs may be requested and authorized by a CIO division director, or their acting designee, through verbal communication with other CCB members. The division director has three working days to facilitate a formal CRQ submittal detailing the actions and results of the BFCRQ.

APPENDIX A: ACRONYMS/TERMS AND DEFINITIONS

Acronym/Term Definition

BFCRQ Break Fix Change Request CCB Change Control Board CISO Chief Information Security Officer CIO Chief Information Officer CM Configuration Management CRQ Change Request EA Enterprise Architecture ECRQ Emergency Change Request FERC Federal Energy Regulatory Commission FIPS Federal Information Processing Standards ISSA Information Security and Systems Assurance Division IT Information Technology ITOps IT Operations Division NIST National Institute of Standards and Technology OMB Office of Management and Budget SDE Systems Development and Engineering Division SDLC System Development Life Cycle SCRQ Standard Change Request

APPENDIX B: APPROVAL

I hereby approve the implementation of this Configuration Management Policy. This Policy will become effective on June 25, 2018.

Signature: Date:

Mittal Desai Chief Information Security Officer (CISO)