PS_5500_-_Information_Technology_Security.pdf

POLICY STATEMENT

Title Information Technology Security Number 5500 Effective Date December 21, 2016 Approval

Clifford T. Keenan, Director

PRETRIAL SERVICES AGENCY

for the

DISTRICT of COLUMBIA

INFORMATION TECHNOLOGY SECURITY

Table of Contents

Overview

Roles and Responsibilities

Security Control

Access Control Requirements (AC-1)

Awareness and Training (AT-1)

Audit and Accountability (AU-1)

Security Assessment and Authorization (CA-1)

Configuration Management (CM-1)

Contingency Planning (CP-1)

Identification and Authentication (IA-1)

Incident Response (IR-1)

Maintenance (MA-1)

Media Protection (MP-1)

Physical and Environmental Protection (PE-1)

Planning (PL-1)

Personnel Security (PS-1)

Policy Statement 5500 Information Technology Security

Effective Date: 12/21/2016

Risk Assessment (RA-1)

System and Services Acquisition (SA-1)

System and Communications Protection (SC-1)

System and Information Integrity (SI-1)

Program Management (PM-1)

Privacy Controls

Effective Date: 12/21/2016

Overview

Purpose Security planning is a core component of an information security program and is integral to understanding the state and effectiveness of the security controls of any information system. Security planning involves the establishment, documentation, and systematic maintenance of a system security plan.

On an annual basis, the Office of Information Technology (OIT) at the Pretrial Services Agency for the District of Columbia (PSA), reviews, and, if necessary, updates and disseminates an information technology security policy containing a clear:

• Purpose and scope;

• Description of roles and responsibilities;

• Commitment from management;

• Strategy for its implementation; and a

• Plan for organizational coordination, compliance, and security control.

In order to meet the security objectives of confidentiality, integrity and availability, PSA information systems PSA Enterprise and PSA Client Management System: Pretrial Real-time Information Systems Manager (PRISM), Drug Testing Management System (DTMS) and Performance Improvement Center (PIC)) are placed in a “moderate impact” category. This policy statement describes the requirements for the general security controls and the additional privacy controls necessary to meet the moderate designation.

Failure to comply with any provision of this policy may result in administrative or adverse action in accordance with Agency and Office of Human Capital Management (OHCM) policies. Perceived threats to system integrity, confidentiality, or availability shall result in suspension of system access, as necessary, to contain the perceived threat. An offense in violation of applicable local, state, or federal laws may result in suspension of system access and may be reported to the appropriate law enforcement authorities.

Coverage This policy applies to all PSA employees, including contractors and interns that develop, use, or manage/support PSA information systems. The term “employee” refers to all personnel categories unless otherwise specified.

Continued on next page

Effective Date: 12/21/2016

Overview, Continued

Coverage, (continued)

Because the responsibility to secure and protect PSA information systems (“security systems” or “IT systems”) and technological resources extends to every Agency employee, coordinating activities that strengthen PSA’s security posture, protect its technological environment, and lower its overall risk requires collaboration across various offices.

Supersedes This policy supersedes Policy Statement 5500- Information Security Policy, dated June 1, 2012.

Related Guidance

• Joint Policy Statement 2001- Personal Use of Information Technology Resources, dated June 22, 2004;

• Policy Statement 5002- Safeguarding Personally Identifiable Information, dated August 1, 2007;

• Policy Statement 4060- Personnel Security Program, dated December 17, 2015;

• Policy Statement 4040- Telework Program, dated May 17, 2011; and

• Court Services and Offender Supervision Agency (CSOSA) Policy

Statement 2036- Information Technology Security Policy, dated July 24, 2013.

Authorities The Federal Information Security Management Act (FISMA) requires federal agencies to develop an information security policy and implement information security procedures, which are derived from guidance provided by the National Institute of Standards and Technology (NIST), Security and Privacy Controls for Federal Information Systems and Organizations, NIST Special Publication 800-53 Revision 4, dated April 2013.

Administrator This Policy Statement is administered by the Office of Information

Technology (OIT) for control and review.

http://ipsa/Dir%20B%20JP%20Docs/Personal%20Use%20of%20IT%20Resources.pdf http://ipsa/Dir%20B%20JP%20Docs/Personal%20Use%20of%20IT%20Resources.pdf http://ipsa/Direct%20A%20%20P%20Docs/Safeguarding%20Personally%20Identifiable%20Information%20(PII).pdf http://ipsa/Direct%20A%20%20P%20Docs/Personnel%20Security%20Program.pdf http://ipsa/Direct%20A%20%20P%20Docs/Telework%20Program.pdf https://csosaweb.csosa.gov/Directives/policies/2036-IT-Security-Policy-07242013.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

Effective Date: 12/21/2016

Roles and Responsibilities

Executive Leadership

PSA senior leaders are Authorizing Officials (AO), which means they share responsibility with OIT for those systems in their area of responsibility.

Before information systems changes are implemented by OIT, senior PSA officials must review the Security Authorization Package (SAP) and sign the Authorization Decision Document.

Office of Information Technology

As the manager of PSA’s information system’s enterprise and its risk management program, OIT has the following responsibilities:

• Develop, maintain and oversee the PSA IT Security Program, including:

o Determining acceptable levels of risk;

o Monitoring program compliance with applicable laws and PSA policies;

o Updating IT security policies in a timely manner;

o Serving as the liaison with external organizations;

o Ensuring a PSA Computer Incident Response Team (CIRT) is staffed, trained and maintained in a state of readiness and that other IT staff have appropriate role-based training; and o Managing the IT Security Awareness and Training Program, which involves:

♦ Staffing, funding and annually updating training materials;

and

♦ Course completion and program evaluations.

• Appoint an official Senior Information Security Officer (SISO) to implement PSA’s IT Security Program and resource managers with authorization to ensure that resources are available and security objectives are met within designated timeframes, and to work with the CSOSA’s OIT and Information Security Office;

• Coordinate with senior PSA officials to meet the requirements of the IT Security Program as specified in §3544, paragraph (b) of the FISMA, and, assisting and advising them regarding their responsibilities, which include:

o Approving System Security Plans (SSPs); and o Completing security status reports to the Director and other senior

PSA officials regarding critical security issues, security program strengths, weaknesses and the progress of remedial actions; and

Effective Date: 12/21/2016

Roles and Responsibilities, Continued

Office of

Technology, continued

• Perform an annual, independent evaluation of the practices within the IT Security Program, which includes:

o Providing assistance and feedback to oversight groups in completing compliance reviews and other reporting requirements.

CSOSA

Security Office

CSOSA collaborates with PSA though an information security and privacy governance organizational structure to cost-effectively adhere to all Federal requirements related to information technology. Some security controls are the primary responsibility of the CSOSA Security Office and are inherited by the PSA Information Security Program.

All Users • Protect PSA information systems;

• Comply with the provisions of this policy; and

• Sign and maintain a current, written agreement to comply with the provisions of this policy.

Effective Date: 12/21/2016

Security Control

Overview OIT reviews and, if necessary, updates and disseminates a formal, written security control policy on a yearly basis.

Controls are organized by the National Institute of Standards and Technology (NIST) into eighteen families:

ID Family AC Access Control AT Awareness and Training AU Audit and Accountability CA Security Assessment and Authorization CM Configuration Management CP Contingency Planning IA Identification and Authentication IR Incident Response

MA Maintenance MP Media Protection PE Physical and Environmental Protection PL Planning PS Personnel Security RA Risk Assessment SA System and Services Acquisition SC System and Communications Protection SI System and Information Integrity

PM Program Management

Effective Date: 12/21/2016

Access Control Requirements (AC-1)

Introduction to Access Control

Access control is the system-based mechanisms used to designate who should have access to a specific information system and the type of transactions or functions permitted. These controls restrict users to authorized transactions and functions only and limit public access to the network/system altogether.

PSA has a moderate security control baseline and must comply with the applicable control baselines as outlined in the table below.

Moderate

Baselines

CNTL# Control Name Moderate Control Baselines

AC-1 Access Control Policy and Procedures AC-1 AC-2 Account Management AC-2 (1-4) AC-3 Access Environment AC-3 AC-4 Information Flow Enforcement AC-4 AC-5 Separation of Duties AC-5 AC-6 Least Privilege AC-6 (1,2,5,9,10) AC-7 Unsuccessful Logon Attempts AC-7 AC-8 System Use Notification AC-8 AC-11 Session Lock AC-11 (1) AC-12 Session Termination AC-12 AC-14 Permitted Actions without Identification or Authentication

AC-14

AC-17 Remote Access AC-17 (1-4) AC-18 Wireless Access AC-18 (1) AC-19 Access Control for Mobile Devices AC-19 (5) AC-20 Use of External Information Systems AC-20 (1-2) AC-21 Information Sharing AC-21 AC-22 Publicly Accessible Content AC-22

Effective Date: 12/21/2016

Access Control Requirements (AC-1)

Control # Control Name Control / Procedure / Requirement

AC-2 Account Management Network administrators and security specialists manage information system accounts by:

Requirement Action 1 Identifying account types (i.e., individual, group, system, application, guest/anonymous and temporary);

2 Assigning account managers to information system accounts;

3 Establishing conditions for group membership;

4 Identifying authorized information system users and specifying access privileges;

5 Requiring appropriate approvals for requests to establish accounts;

6 Maintaining accounts annually (i.e., establishing, activating, modifying, disabling and deleting accounts);

7 Authorizing and monitoring access to guest/anonymous and temporary accounts;

8 Notifying account managers when guest/temporary accounts have been deactivated or guest/temporary users’ access has been updated, transferred or terminated;

9 Reactivating account access credentials when previous users return to a group.

AC-2.1 Automated System Account Management

PSA uses automated mechanisms to manage information systems accounts when possible. Examples include: a) NetWrix account management software; b) PRISM and DTMS automatic account de-activation after 90 days of inactivity; and c) Active Directory policies that disable user accounts after 45 days of inactivity.

AC-2.2 Removal of Temporary / Emergency Accounts

PSA automatically terminates guest/anonymous and temporary accounts after 45 days of inactivity and PRISM and DTMS user accounts after 90 days of inactivity.

AC-2.3 Disable Inactive Accounts

PSA automatically disables network accounts after 45 days of inactivity and PRISM and DTMS user accounts after 90 days of inactivity.

AC-2.4 Automated Audit Actions

PSA conducts audits and notifies the account user and/or system administrator automatically when:

• New accounts are created;

• Accounts are modified or disabled; and

• Accounts are terminated.

Effective Date: 12/21/2016

Access Control Requirements (AC-1), Continued

AC-3 Access Environment PSA information systems control logical access to information systems by using identification, authorization, authentication and accounting tools and protocols.

AC-4 Information Flow Enforcement

PSA information systems control the flow of information within and between information systems by enforcing authorizations based on policies, Memoranda of Understanding (MOUs); Service Level Agreements (SLAs);

Memoranda of Agreement (MOAs) and related agreements.

AC-5 Separation of Duties To control the risk of malevolent activity with collusion, PSA separates the duties related to operating and managing its information systems by:

• Declaring the separation of duties in writing;

• Authorizing different levels of information system access;

• Requiring a different administrative account for each role or function;

• Separating mission-based functions from system support functions; and

• Ensuring that a different individual performs each system support function (e.g., system management, programming, configuration management, quality assurance/auditing and testing and information/network security).

AC-6 Least Privilege PSA reduces security risks to information systems by controlling unauthorized system access or managing access by least privilege. This means users gain only the system access necessary to do their assigned jobs.

AC-6.1 Authorize Access to Security Functions

PSA personnel with access to secure information system functions are authorized to:

• Establish identifiable system accounts;

• Configure privileges and permissions to meet security standards;

• Automatically audit certain account activities; and

• Set robust intrusion detection parameters.

AC-6.2 Non-Privileged Access for Non-Security

Functions

PSA personnel with access to establish identifiable system accounts; configure privileges and permissions to meet security standards; automatically audit certain account activities; and set robust intrusion detection parameters must use non-privileged accounts to access other, non-security system functions. PSA audits the use of privileged accounts for compliance.

Effective Date: 12/21/2016

AC-6.5 Privileged Accounts PSA manages security risks to information systems by restricting access to privileged accounts to system administrators.

AC-6.9 Auditing Use of Privileged Functions

PSA audits privileged account information system functions to detect misuse and mitigate the risks of internal and external threats, whether they are incidental or advanced and persistent. (See AC-6.2)

AC-6.10 Prohibit Non-Privileged Users from Executing Privileged Functions

PSA prevents non-privileged users from executing privileged functions and/or disabling, circumventing, or altering security controls by restricting access to privileged functions to system administrators. PSA also limits the use of local administrator privileges.

AC-7 Unsuccessful Logon Attempts

PSA information systems prevent malicious access attempts by:

• Limiting the number of consecutive, invalid attempts to five (5) within a 15-minute period; and

• Locking the account on the 6th invalid attempt; and

• Requiring that a system administrator release a locked account.

AC-8 System Use Notification PSA complies with information security policies, federal laws, Executive Orders and other applicable regulations by displaying an approved security notification (“system use notification”) before granting a user access to an information system. The notification is displayed until the user logs on and indicates that:

• The user is accessing an information system that is the property of the U.S. Government;

• The user’s activity on the information system may be monitored, recorded or audited;

• Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and

• Accessing the information system is considered consent to being monitored, recorded or audited.

For information systems that are accessible to the general public, the system use notification:

• Is displayed only as necessary;

• Explicitly indicates the special privacy accommodations that permit the user’s access to be monitored, recorded and audited; and

• Provides the user a list of authorized uses of the information system.

AC-11 Session Lock PSA prevents unauthorized access to secure information systems by automatically locking a session after 15 minutes of inactivity, whether or not the session lock is requested by the user. The session lock remains in place until the authorized user accesses the system according to identification and authentication procedures.

Effective Date: 12/21/2016

AC-11.1 Pattern Holding

Displays PSA limits the loss of secure system information by displaying a generic (‘CTRL+ALT+DELETE’) image to conceal system information that was viewable prior to a session lock.

AC-12 Session Termination PSA prevents unauthorized access to secure system information by automatically terminating a locked session, whether or not the termination is requested by the user. (See AC-11)

AC-14 Permitted Actions Without Identification or Authentication

PSA outlines in its Information Security Plan the functions that can be performed on an information system without identification or authentication, but only to the extent necessary to meet critical mission/business objectives and to recover valuable data that might otherwise be lost to non-functioning systems.

AC-17 Remote Access PSA monitors unauthorized remote access to information systems by:

• Providing guidance in Policy Statement 4040-Telework Program for accessing information systems remotely;

• Publishing restrictions and guidance for remote access;

• Blocking remote connection until authorized access is granted; and

• Enforcing the requirements for sustained remote connection to information systems.

AC-17.1 Automated Monitoring/Control

PSA uses automated strategies to monitor and control remote access to information systems where available.

(See AC-17)

AC-17.2 Protection of Confidentiality / Integrity Using

Encryption

PSA uses cryptography to monitor the confidentiality and integrity of remote access to information systems where available.

AC-17.3 Managed Access Control Points

PSA information systems route all remote access connections through a limited number of secure, managed access control points.

AC-17.4 Privileged Commands / Access

PSA outlines in its Information Security Plan the privileged commands that can be executed remotely to access secure information on a system, but only to the extent necessary to meet critical mission/business objectives or to address compelling operational needs.

http://ipsa/Direct%20A%20%20P%20Docs/Telework%20Program.pdf

Effective Date: 12/21/2016

AC-18 Wireless Access PSA establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and authorizes wireless access to the information system prior to allowing such connections.

AC-18.1 Authentication and Encryption

PSA uses authentication and encryption methods to monitor the confidentiality and integrity of wireless access to information systems where available

AC-19 Access Control for Mobile Devices

PSA establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and authorizes the connection of mobile devices to organizational information systems.

AC-19.5 Full Device / Container Based Encryption

To protect the confidentiality and integrity of data on information systems, PSA uses full-device encryption for laptops and tablets and container-based encryption for smart phones.

AC-20 Use of External Information Systems

PSA establishes terms and conditions for the external information systems of partner organizations to interface with PSA information systems. The relationship of trust that PSA maintains with partner organizations authorizes non-PSA individuals to:

• Access PSA information systems through the external information system;

• Process information through the external information system;

• Transmit information through the external information system; and

• Store information on the external information system.

Effective Date: 12/21/2016

AC-20.1 Limits of Authorized

Use PSA permits the external information systems of partner organizations to interface with PSA information systems when the partner organization:

• Can verify that its external systems meets the security control requirements of PSA’s information security policy and plan; or

• Has a pre-approved connection and/or processing agreement with PSA.

AC-20.2 Portable Storage Devices

PSA limits the use of portable storage media for authorized individuals interfacing with PSA information systems via external information systems.

AC-21 Information Sharing PSA permits information sharing with partner organizations if authorized PSA individuals determine that the partner’s authorized access complies with restrictions to sensitive information, PII or proprietary information.

PSA provides real-time responses to user questions regarding such information sharing restrictions.

AC-22 Publicly Accessible Content

PSA designates individuals to post organizational information to an information system that is accessible to the public. The designated individuals are trained to:

• Review organizational information system to ensure it does not contain secure information prior to being posted; and

• Review the organization information system annually and remove any secure information that was inadvertently or inappropriately posted.

Effective Date: 12/21/2016

Awareness and Training (AT-1)

Awareness and Training

Awareness and training encompasses a strong IT security program that places significant attention on training its users on the security policy, procedures, and technical controls necessary to operate and secure IT resources. To ensure the infrastructure of the IT security program is operated effectively and secured with the lowest risk of human error, employees who are responsible for managing the IT infrastructure receive specialized training that is mandatory and updated on an annual basis. PSA has a moderate security control baseline and must comply with the applicable control baselines as outlined in the table below.

Controls for Awareness and Training

Awareness and Training CNTL# Control Name Moderate Control

Baselines AT-1 Security Awareness and Training Policy and Procedures

AT-1

AT-2 Security Awareness Training AT-2 (2) AT-3 Role-Based Security Training AT-3 AT-4 Security Training Records AT-4

Effective Date: 12/21/2016

Awareness and Training (AT-1), Continued

AT-2 Security Awareness Training

PSA provides basic security awareness training to all information system users:

• When new users receive initial training on the information system;

• When information system changes are required; and

• Every fiscal year.

AT-2.2 Insider Threat PSA’s security awareness training includes exercises on how to recognize and report a potential insider threat, which is a malicious threat to PSA that comes from an employee, former employee, contractor or business associate who possesses information concerning PSA’s security practices, data, and information systems.

AT-3 Role-Based Security Training

PSA provides role-based security training to personnel with assigned security roles and responsibilities:

• Before authorizing access to the information system or performing assigned duties;

• When required by information system changes; and

• Every fiscal year.

AT-4 Security Training Records

PSA monitors and logs the activities of every user receiving either basic or advanced security awareness training, as defined by the National Archives and Records Administration, General Records Schedule 1, Civilian Records Item 29, Training Records.

Effective Date: 12/21/2016

Audit and Accountability (AU-1)

Audit and Accountability

Audit and accountability requires an audit trail (or event log) as a record of activity on a network/system by application or user for the purpose of monitoring and enforcing IT security policies. When audit trails are used in conjunction with the appropriate tools, they ensure individual accountability and provide a means to reconstruct events, detect intrusions, and identify problems. Although event logs are subject to recording and routine monitoring for illegal activity by the PSA SISO and auditors, system owners must ensure the security of information systems by clarifying and separating responsibilities, regulating access-level permissions and implementing any other safeguards necessary to secure the varying levels of sensitive information on the system.

Moderate Audit

Accountability Baselines

CNTL# Control Name Moderate Control Baselines

Audit and Accountability AU-1 Audit and Accountability Policy and

Procedures

AU-1

AU-2 Audit Events AU-2 (3) AU-3 Content of Audit Records AU-3 (1) AU-4 Audit Storage Capacity AU-4 AU-5 Response to Audit Processing Failures AU-5 AU-6 Audit Review, Analysis, and Reporting AU-6 (1, 3) AU-7 Audit Reduction and Report Generation AU-7 (1) AU-8 Time Stamps AU-8 (1) AU-9 Protection of Audit Information AU-9 (4) AU-11 Audit Record Retention AU-11 AU-12 Audit Generation AU-12

Effective Date: 12/21/2016

Audit and Accountability (AU-1), Continued

AU-2 Audit Events PSA limits unauthorized access to information systems by:

• Randomly or semi-annually auditing certain events, including:

o Successful and unsuccessful network connections (i.e., log ins and log outs); and o File creations, updates and deletions;

• Guiding the organizational management team in gathering and coordinating audit event data; and

• Investigating security incidents that precede selective audits.

AU-2.3 Reviews and Updates PSA ensures the integrity of information systems by randomly or semi-annually reviewing primary and secondary lists of auditable events, including privileged functions, and updating them as needed.

AU-3 Content of Audit Records

PSA produces audit records that establish the identity of the user as well as the event:

• Type (application, security, system);

• Date and time;

• Outcome (i.e., whether the event was a success or failure).

AU-3.1 Additional Audit Information

PSA retains backup electronic copies of audit records according to event type, location, and source.

AU-4 Audit Storage Capacity PSA configures and monitors the audit record storage capacity to ensure it is not exceeded.

AU-5 Response to Audit

Processing Failures PSA responds to audit processing failures by:

• Notifying the appropriate management team member of the failure;

• Exporting, reviewing and over-writing the oldest existing audit logs; and

• Shutting down the faulty information system.

AU-6 Audit Review, Analysis and Reporting

PSA controls unusual or inappropriate activity on information systems by:

• Reviewing and analyzing audit records randomly or semi-annually; and

• Reporting the findings to the appropriate management team member.

AU-6.1 Process Integration PSA integrates audit reviews, analysis, and reporting information into its process of investigating and responding to suspicious and/or malicious information system activity.

Effective Date: 12/21/2016

Audit and Accountability (AU-1), Continued

Control # Control Name Control / Procedure / Requirement / Requirement

AU-6.3 Correlate Audit Repositories

PSA analyzes and correlates information system audit records across the spectrum of its repositories to ensure that suspicious and/or malicious information system activity is brought to the attention of the appropriate IT representatives and reported, as appropriate, to PSA management.

AU-7 Audit Reduction and Report Generation

PSA information systems possess an audit reduction and report generation capacity that enables them to:

• Meet on-demand audit review, analysis and reporting requirements;

• Support investigations of security incidents; and

• Protect the original content and sequence of audit records.

AU-7.1 Automatic Processing PSA IT staff reviews audit records according to selected event types and sources and assigns resources to research or resolve current or potential issues, as required.

AU-8 Time Stamps PSA information systems generate time stamps on folders and/or files that are created and audit log entries.

AU-8.1 Synchronization with

Authoritative Time Source

PSA information system clocks synchronize with the Domain Controller server.

AU-9 Protection of Audit Information

PSA information systems are equipped with mechanisms to protect audit tools and information against unauthorized access, modification, and deletion.

AU-9.4 Access by Subset of Privileged Users

PSA permits only system administrators with privileged access to manage the audit functionality of information systems.

AU-11 Audit Record Retention PSA retains audit records for a minimum of one year. Audit records retained in that time support security incident investigations and meet the agency’s record-retention requirements.

AU-12 Audit Generation PSA information systems generate partial- or full-content audit records according to event types selected and defined at either the server or user level. System administrators with privileged access determine which event types are to be audited and by which component of the information system.

Effective Date: 12/21/2016

Security Assessment and Authorization (CA-1)

Security Assessment and Authorization

Security assessment and authorization is the process of formally assessing and authorizing the security controls that protect IT systems and the data stored in and processed by those systems. The assessment process not only recognizes, evaluates and assigns responsibility for the risks of operating an IT system, but accounts for that risk across the life of the system and ensures that responsibility for the risk is recognized, evaluated, and accepted. The authorization process recognizes the need for security levels commensurate with the risks of operating an IT system, including countermeasures that address unauthorized access, use, disclosure, disruption, modification, or destruction of information, as defined in OMB Circular A-130.

Security Assessment and Authorization Baselines

CNTL# Control Name Moderate Control Baselines

Security Assessment and Authorization CA-1 Security Assessment and Authorization

Policy and Procedures

CA-1

CA-2 Security Assessments CA-2 (1) CA-3 System Interconnections CA-3 (5) CA-5 Plan of Action Milestones CA-5 CA-6 Security Authorization CA-6 CA-7 Continuous Monitoring CA-7 (1) CA-9 Internal System Connections CA-9 https://www.whitehouse.gov/omb/circulars_a130

Effective Date: 12/21/2016

Security Assessment and Authorization (CA-1), Continued

Control # Control Name Control / Procedure / Requirement / Requirement

CA-2 Security Assessments PSA develops a security control assessment plan that:

• Describes the scope of security controls and enhancements being assessed for effectiveness;

• Outlines assessment procedures;

• Provides the roles, responsibilities and location of the assessment team members;

• Is reviewed randomly or annually to ensure correct implementation, operation and production of desired outcomes;

• Leads to an annual report that summarizes findings for the authorizing official or designee.

CA-2.1 Independent Assessors PSA uses an independent assessor or assessment team to continuously evaluate the effectiveness of information systems security controls.

CA-3 System Interconnections

PSA uses Interconnection Security Agreements to facilitate connections between PSA information systems and those beyond its boundary. OIT records and monitors each connection as well as the interface content, characteristics and security control requirements.

CA-3.5 Restrictions on External System Connections

PSA permits users to connect to external information systems from web-based information systems, according to its blacklisting policy, which means allow all access and deny access by exception. Users connect to external information systems from non-web-based information systems according to PSA’s whitelisting policy, which means deny all access and allow by exception.

CA-5 Plan of Action and Milestones

PSA develops an Information Security Plan that:

• Describes the plan of action and milestones;

• Defines the remedial actions to correct system deficiencies or vulnerabilities discovered during the security control assessment; and

• Is updated randomly or semi-annually in response to the security control assessment, threat/impact analysis and other important findings from continuous monitoring activities.

CA-6 Security Authorization Every three years, PSA assigns the role of authorizing official for information systems to a senior-level executive or manager, who determines an information system is security-ready before being introduced to operations.

Effective Date: 12/21/2016

Security Assessment and Authorization (CA-1), Continued

CA-7 Continuous Monitoring

PSA maintains a continuous monitoring program that:

• Identifies the activities on an information system to be monitored, such as:

o Quarterly and annual information system access reauthorization; and o Security control and impact activities (e.g., accessing external information systems from non-web-based information systems);

• Analyzes security control assessment findings and recommendations for remediation in accordance with the agency’s overall security strategy;

• Provides reports to the appropriate agency officials, randomly or annually, regarding the general state of security vis-à-vis each information system; and

• Complies with the guidance in NIST Special Publication 800-37, Revision 1, Guide to Applying the

Risk Management Framework in its overall security control assessment.

CA-7.1 Independent

Assessment PSA uses an independent assessor or assessment team to continuously evaluate the effectiveness of information systems security controls.

CA-9 Internal System Connections

PSA monitors and records the internal connections of its information systems for authorization, interface characteristics, content, and security control.

Effective Date: 12/21/2016

Configuration Management (CM-1)

Configuration Management

Configuration management is the process in which baseline configurations are developed and maintained for information systems and their constituent components. The configuration management process provides a controlled environment in which changes to software and hardware are consistent with security program requirements, formally authorized, tested, and approved before implementation.

Configuration Management Baselines

CNTL# Control Name Moderate Control Baselines

Configuration Management CM-1 Configuration Management Policy and

Procedures

CM-1

CM-2 Baseline Configuration CM-2 (1,3,7) CM-3 Configuration Change Control CM-3 (2) CM-4 Security Impact Analysis CM-4 CM-5 Access Restrictions for Change CM-5 CM-6 Configuration Settings CM-6 CM-7 Least Functionality CM-7 (1,2,4) CM-8 Information System Component Inventory CM-8 (1,3,5) CM-9 Configuration Management Plan CM-9 CM-10 Software Usage Restrictions CM-10 CM-11 User-Installed Software CM-11

Effective Date: 12/21/2016

Configuration Management (CM-1), Continued

CM-2 Baseline Configuration PSA designs, produces, and maintains a current, documented baseline configuration of its information systems.

CM-2.1 Reviews and Updates PSA reviews and/or updates the baseline configuration of its information systems annually as well as when security controls are updated or integral information system components are installed or upgraded.

CM-2.3 Retention of Previous Configurations

PSA retains previous versions of baseline configurations for contingency planning purposes and maintains a list of software programs authorized (whitelist) and not authorized (blacklist) to be installed on its information systems according to blacklisting or whitelisting protocols.

CM-2.7 Configure Systems, Components or

Devices for High-Risk Areas

PSA employees or contractors planning to travel with agency-owned equipment must check with the Information Security Program prior to leaving. PSA issues mobile devices with baseline configurations in place and may require additional safeguards when traveling, or ask the device to be reimaged upon return.

CM-3 Configuration Change Control

Before operationalizing changes to information systems, PSA:

• Determines which changes are configuration-controlled, which means all changes are performed with the knowledge and consent of senior executive management;

• Conducts security impact analyses; and

• Tests, validates, and records configuration-controlled changes.

PSA manages and audits each change for 3 years, coordinating change control activities with Change Control Boards (CCB), which meet once a month minimally.

CM-3.2 Test / Validate / Document Changes

PSA tests, validates, and records configuration-controlled changes to information systems before operationalizing them.

CM-4 Security Impact Analysis

PSA minimizes the risk of security threats to information systems by conducting security impact analyses before operationalizing configuration-controlled changes.

Effective Date: 12/21/2016

CM-5 Access Restrictions for Change

PSA enforces logical access restrictions to information systems by developing, approving and enforcing logical access protocols.

CM-6 Configuration Settings In accordance with the Department of Defense, Secure Technical Implementation Guides (STIG), PSA maintains written and mandatorily most-restrictive configuration settings when implementing information technology, and all exceptions are approved in writing. PSA information systems detect, track, correct and record unauthorized configuration changes in accordance with information security policy.

CM-7 Least Functionality PSA information systems are configured to provide users the least functionality or essential functions only. Unless considered essential to the functioning of PSA information systems, non-essential functions are prohibited, which are:

• Hypertext Transfer Protocol (HTTP) functions, which define how messages are formatted and transmitted and what actions Web servers and browsers should take in response to various commands;

• File Transfer Protocol (FTP) functions, which transfer files between users and servers over the internet;

• Telnet functions, in which another user can access someone else’s computer remotely;

• Peer-to-peer protocols in which a computer can act as a server for another, eliminating the need for a central server;

• Unauthorized passwords;

• Instant messaging; and

• Voice Over Internet Protocols (VOIP), which is a technology that allows a user to make voice calls using a broadband internet connection instead of a regular (analog) phone line.

CM-7.1 Periodic Review PSA reviews the controlled configurations of information systems randomly or annually to eliminate non-essential functions, ports, protocols and/or services that were activated without authorization.

Effective Date: 12/21/2016

CM-7.2 Prevent Program

Execution PSA maintains a list of authorized information system software programs and prevents the execution of unauthorized programs.

CM-7.4 Unauthorized Software Blacklisting

PSA reviews and/or updates the list of authorized (whitelisted) information system software programs annually in accordance with NIST Special Publication 800-167, Guide to Application Whitelisting. PSA identifies and updates the list of blacklisted, unauthorized programs and prevents their execution on information systems.

CM-8 Information System Component Inventory

PSA maintains an accurate inventory of information system components that is:

• Reviewed randomly or annually;

• Updated when changes occur; and

• Authorized, tracked and accessible; and

• Specifies the date of purchase, serial number, price, and warranty information.

CM-8.1 Updates During Installations/ Removals

The inventory of PSA information system software and hardware components is updated every time a component is installed, updated, or removed anywhere within the system’s network.

CM-8.3 Automated Unauthorized

Component Detection

PSA deploys automated mechanisms to detect the installation, update, or removal of information system software or hardware components on a quarterly basis; disable the components; and notify the appropriate system owner.

CM-8.5 No Duplicate Accounting of Components

PSA maintains an accurate inventory of information system software and hardware components that is not duplicated from information system to information system.

CM-9 Configuration Management Plan

PSA maintains an information systems configuration management plan with:

• Clearly-defined roles and responsibilities;

• Procedures for identifying, defining and configuring system components through their development life cycle;

• Rules for when configured system components are placed under configuration management protocols;

and

• Protection from unauthorized disclosure and/or modification.

Effective Date: 12/21/2016

CM-10 Software Usage Restrictions

PSA ensures that:

• Software is used in accordance with contract agreements and copyright laws;

• The quantity of software licenses is tracked and recorded to prevent unauthorized copying and distribution; and

• Peer-to-peer software and file-sharing protocols are tracked and recorded to prevent unauthorized distribution, display, operation, or reproduction of copyrighted material.

CM-11 User-Installed

Software PSA maintains policies that outline permitted and prohibited actions regarding user-installed software, and enforces those policies by regularly monitoring user accounts for least privilege and other policy compliance.

Effective Date: 12/21/2016

Contingency Planning (CP-1)

Contingency Planning

Contingency planning requires Federal agencies to have a plan in place to minimize the risk of disruptions to services when information systems become unavailable.

The contingency plan outlines the procedures necessary to:

• Assess the damages that follow an outage and notify affected users and system owners;

• Recover and protect critical business functions and services, including IT services; and

• Reconstitute all business functions and services to the pre-crisis level of operation.

Contingency Planning Baselines

CNTL# Control Name Moderate Control Baselines

Contingency Planning CP-1 Contingency Planning Policy and

Procedures

CP-1

CP-2 Contingency Plan CP-2 (1,3,8) CP-3 Contingency Training CP-3 CP-4 Contingency Plan Testing CP-4 (1) CP-6 Alternate Storage Site CP-6 (1,3) CP-7 Alternate Processing Site CP-7 (1,2,3) CP-8 Telecommunications Services CP-8 (1,2) CP-9 Information System Backup CP-9 (1) CP-10 Information System Recovery and

Reconstitution

CP-10 (2)

Effective Date: 12/21/2016

Contingency Planning (CP-1), Continued

CP-2 Contingency Plan PSA maintains a Contingency Plan that is developed by OIT and distributed to executive officials and program directors. The Contingency Plan:

• Identifies effective assessment and notification, recovery and reconstitution requirements for maintaining reliable critical business operations in the event of system disruption, compromise or failure;

• Identifies the roles, responsibilities and contact information of the Contingency Assessment Team

(CAT);

• Aligns appropriately with incident handling policies and protected against unauthorized disclosure or modification;

• Is reviewed, tested and updated annually in accordance with organizational changes in PSA;

information systems configuration changes or changes necessary to test or execute the plan;

• Is approved by designated agency officials, and any changes are communicated to the appropriate personnel.

CP-2.1 Coordinate With Related Plans

PSA’s Contingency Plan is coordinated with the Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Business Recovery Plan, Incident Response Plan, Emergency Action Plan and other emergency-related plans.

CP-2.3 Resume Essential Mission / Business

Functions

PSA’s Contingency Plan specifies a timeframe in which essential mission and business functions will resume after the Contingency Plan has been activated.

CP-2.8 Identify Critical Assets PSA identifies all information system assets that are critical to the support of mission and business functions.

CP-3 Contingency Training PSA trains personnel in their Contingency Plan roles and responsibilities annually, within 6 months of assuming a new role or responsibility and as required by information system changes.

CP-4 Contingency Plan Testing

PSA tests the Contingency Plan annually, makes corrective actions as required, and uses the Eagle Horizon exercise to determine the Plan’s effectiveness and the Agency’s readiness to execute the Plan.

Effective Date: 12/21/2016

CP-4.1 Coordinate With Related Plans

PSA incorporates the testing of other emergency-related plans into Contingency Plan testing.

CP-6 Alternate Storage Site PSA maintains an alternate storage site, the necessary agreements to operationalize backup (essential mission and business related) systems information in the event of system disruption, compromise, or failure, and a detailed backup plan of action should the alternate storage site ever become inaccessible.

CP-6.1 Separation From Primary Site

PSA maintains an alternate storage site, separate from the primary site, in order to continue operations in the event of a system disruption, compromise, or failure.

CP-6.3 Accessibility PSA maintains a detailed backup plan of action should the alternate storage site become inaccessible due to a system disruption, compromise or failure.

CP-7 Alternate Processing Site

PSA maintains:

• An alternate processing site with security controls equal to the primary site;

• Equipment and supplies; and

• The necessary agreements to operationalize backup (essential mission and business related) systems information within 48 hours of a system disruption, compromise or failure at the primary processing site.

CP-7.1 Separation From Primary Site

PSA maintains an alternate processing site, separate from the primary site, to continue operations in the event of a system disruption, compromise, or failure.

CP-7.2 Accessibility PSA maintains a detailed backup plan of action should the alternate processing site become inaccessible due to a system disruption, compromise or failure.

CP-7.3 Priority of Service PSA maintains alternate processing site agreements that include priority-of-service provisions in accordance with the Agency’s requirement that its continuity of operations take precedence.

CP-8 Telecommunications Services

PSA maintains the necessary telecommunications service agreements to operationalize backup (essential mission and business related) systems information within 48 hours of a system disruption, compromise or failure at the primary processing site.

Effective Date: 12/21/2016

CP-8.1 Priority of Service Provisions

PSA maintains the necessary alternate site telecommunications service agreements to operationalize backup (essential mission and business related) systems information within 48 hours of a system disruption, compromise or failure at the primary site. PSA is given telecommunications service priority in accordance with national security emergency preparedness protocols if primary and alternate sites are serviced by a common carrier.

CP-8.2 Single Points of Failure PSA maintains alternate telecommunications services to reduce the risk of sharing a single point of failure with primary telecommunications services.

CP-9 Information System Backup

PSA creates backup information records on a selective or daily basis at the user level, system level and security controls level, and protects the confidentiality and integrity of the backup information at the backup storage site.

CP-9.1 Testing for Reliability / Integrity

PSA tests backup information each quarter to verify the reliability of media and the integrity of backup information.

CP-10 Information System Recovery and Reconstitution

PSA recovers and reconstitutes information systems to their pre-crisis level of functioning after service disruption, compromise, or failure.

CP-10.2 Transaction Recovery PSA recovers information by activating the information systems contingency plan to restore essential mission and business functions. Reconstitution takes place following recovery and includes activities for returning information systems to a fully operational state. The recovery and reconstitution phases of the contingency plan can include both automated mechanisms and manual procedures.

Effective Date: 12/21/2016

Identification and Authentication (IA-1)

Identification

Authentication

Identification and authentication is a security control that identifies and differentiates users/processes and prevents unauthorized users/processes from accessing an IT system. All PSA IT systems must have identification and authentication controls in place, means to clarify duties, and identify and differentiate users/processes. These controls ensure that all:

• IT system activity can be tracked;

• Users can be identified, (e.g., by user name); and

• Users can be authenticated (e.g., by password, token or fingerprint).

Identification and Authentication Baselines

CNTL# Control Name Moderate Control Baselines

Identification and Authentication IA-1 Identification and Authentication Policy and Procedures

IA-1

IA-2 Identification and Authentication (Organizational Users)

IA-2 (1,2,3,8,11,12)

IA-3 Device Identification and Authentication IA-3 IA-4 Identifier Management IA-4 IA-5 Authenticator Management IA-5 (1,2,3,11) IA-6 Authenticator Feedback IA-6 IA-7 Cryptographic Module Authentication IA-7 IA-8 Identification and Authentication (Non-

Organizational Users)

IA-8 (1-4)

Effective Date: 12/21/2016

Identification and Authentication (IA-1), Continued

IA-2 Identification and Authentication

(Organizational Users)

PSA identifies and authenticates every organizational (i.e., internal) and non-organizational (i.e., external) users and automatic process on its information systems.

IA-2.1 Network Access to Privileged Accounts

PSA information systems require one-time authentication (i.e., a password that is valid for only one login session), and multifactor authentication (i.e., a security system that requires more than…