Access-Control_CIO-IT-Security-Rev-5_2022-8-18 (1).pdf

Office of the Chief Information Security Officer

Revision 5

August 18, 2022

IT Security Procedural Guide:

Access Control (AC)

CIO-IT Security-01-07

DocuSign Envelope ID: EF35B48C-3CA5-4928-B32B-F9CE3AB36896

CIO-IT Security-01-07, Revision 5 Access Control

U.S. General Services Administration

VERSION HISTORY/CHANGE RECORD

Change Number

Person Posting Change

Change Reason for Change Page

Number of Change

Revision 2 – January 30, 2008

1 Scott/Heard Changes made throughout the document to reflect FISMA, NIST and GSA CIO P 2100.1B requirements.

Updated to reflect and implement various FISMA, NIST and GSA CIO P 2100.1B requirements.

Various

2 Scott/Heard Changes throughout the document to correspond with revisions made to CIO-IT Security- 01-09, CIO-IT Security-06-30 and CIO-IT Security-01-04.

Updated to reflect the correlation of the CIO-IT Security Guides; and to further express policy within them as standalone documents

Various

3 Hummel/ Windelberg

Changes throughout the document to correspond with update of the current version of

GSA CIO P 2100

The most current version of GSA CIO P 2100 and more detailed guidance on implementing policy

Various

Revision 3 – April 1, 2015

1 Sitcharing Changes throughout to correspond with revisions made to CIO-IT-Security-06-30.

Updated to reflect correlation of the CIO-IT Security Guide and CIO P 2100.1.

Throughout

2 Heard Changes the document to Implement ADM O 5440.667

Updated to reflect CISO GSA IT responsibilities

Throughout

3 Heard/Mott Privacy access information included

Appendix J controls included in table 1 as well as explained within the guide

Throughout

Revision 4 – May 8, 2017

1 Feliksa/Dean/ Klemens

Update to current format, style, and policies.

Updated to latest guide structure.

Revised to reflect updates to Federal policies, NIST documents, and GSA processes.

Throughout

Revision 5 - August 18, 2022

1 Dean/ McCormick/ Klemens

Revisions include:

● Updated to NIST SP 800-53, Revision 5 controls, GSA parameters, and implementation statements.

● Updated format, style, and content.

Align to current NIST and GSA guidance and GSA parameters.

New or substantively changed controls in Revision 5 are: AC-2, AC-2(1), AC-2(4), AC-2(5, AC-2(13), AC-3(14), AC-4(4), AC-6(1), AC-6(7), AC-7, AC-11, AC-17(4), AC-18(3), AC-20, AC-20(2).

Throughout

U.S. General Services Administration

Approval

IT Security Procedural Guide: Access Control (AC), CIO-IT Security-01-07, Revision 5, is hereby approved for distribution.

Bo Berlas GSA Chief Information Security Officer

Contact: GSA Office of the Chief Information Security Officer (OCISO), Policy and Compliance Division (ISP) at ispcompliance@gsa.gov.

U.S. General Services Administration i

Table of Contents

Contents

1 Introduction

1.1 Purpose

1.2 Scope

1.3 Policy

1.4 References

1.5 Access Control Roles and Responsibilities

2 Access Control Overview

2.1 What Are Access Controls

2.2 Why Access Controls Are Important

3 Implementation Guidance for AC Controls

3.1 AC-1 Access Control Policy and Procedures

3.2 AC-2 Account Management

3.3 AC-3 Access Enforcement

3.4 AC-4 Information Flow Enforcement

3.5 AC-5 Separation of Duties

3.6 AC-6 Least Privilege

3.7 AC-7 Unsuccessful Logon Attempts

3.8 AC-8 System Use Notification

3.9 AC-10 Concurrent Session Control

3.10 AC-11 Device Lock

3.11 AC-12 Session Termination

3.12 AC-14 Permitted Actions without Identification or Authentication

3.13 AC-17 Remote Access

3.14 AC-18 Wireless Access

3.15 AC-19 Access Control for Mobile Devices

3.16 AC-20 Use of External Systems

3.17 AC-21 Information Sharing

3.18 AC-22 Publicly Accessible Content

Appendix A: CSF Categories/Subcategories

Appendix B: GSA Order CIO 2100.1 Policy Statements on Access Control

Appendix C: Roles and Responsibilities

Appendix D: Access Controls Best Practices

Appendix E: Definitions

Table 3-1. Designation of AC Controls Table 3-2: AC Control Applicability Table A-1: CSF Categories/Subcategories and the AC Control Family Figure D-1: Access Credentials Figure D-2: Account Creation and Termination

U.S. General Services Administration ii

Notes:

● Hyperlinks in running text will be provided if they link to a location within this document (i.e., a different section). Hyperlinks will be provided for external sources unless the hyperlink is to a web page or document listed in Section 1.4. For example, Google Forms, Google Docs, and websites will have links.

● It may be necessary to copy and paste hyperlinks in this document (Right-Click, Select Copy Hyperlink) directly into a web browser rather than using Ctrl-Click to access them within the document.

U.S. General Services Administration 1

1 Introduction

Implementing an effective access control program and adhering to General Services Administration (GSA) CIO Order 2100.1, GSA Information Technology (IT) Security Policy, and federal mandates are the best ways to ensure the protection of GSA systems and resources from loss, misuse, disclosure, or impairment. An effective program carefully applies necessary controls to ensure that users are given access only to data and resources as needed and allowed by policy and authorization. Effective access control is implemented by a combination of personnel, physical, and logical practices, procedures, features, and mechanisms. This guide focuses on logical access controls as defined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations, in the Access Control (AC) family of security controls. Physical access controls are covered in CIO-IT Security-12-64, Physical and Environmental Protection.

Personnel access controls are covered in CIO-IT Security-18-90, Information Security Program Plan, and GSA’s personnel security policies.

Every GSA system must follow the practices described in this guide. Any deviations from the security requirements established in CIO 2100.1 must be coordinated by the appropriate Information Systems Security Officer (ISSO) through the appropriate Information Systems Security Manager (ISSM) and approved by the Authorizing Official (AO). Any deviations, exceptions, or other conditions not following GSA policies and standards must be submitted using the Security Deviation Request Google Form.

The access control principles and practices described in this guide are based on guidance from NIST, including NIST SP 800-53, Revision 5. This guide provides an overview of access control, roles and responsibilities, NIST SP 800-53 access control requirements per Federal Information Processing Standards (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems, security categorization level, and procedures for implementing these requirements.

Executive Order (EO) 13800, Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, requires all agencies to use “The Framework for Improving Critical Infrastructure Cybersecurity (the Framework) developed by NIST or any successor document to manage the agency’s cybersecurity risk.” This NIST document is commonly referred to as the Cybersecurity Framework (CSF). GSA uses the NIST SP 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, commonly referred to as the Risk Management Framework (RMF) as its foundation for managing risk, including the implementation of NIST SP 800-53 controls. Further information on how AC controls relate to the CSF is provided in Appendix A.

https://docs.google.com/forms/d/e/1FAIpQLSew38lCEj9FnE7Tmpi6ajMn700NYbe4fZtjo2Ol5MA9Of8eUw/viewform

U.S. General Services Administration 2

1.1 Purpose

The purpose of this guide is to provide guidance for the AC controls identified in NIST SP 800-53 and access control requirements specified in CIO 2100.1. The guide provides GSA Federal employees, contractors with significant security responsibilities (as identified in CIO 2100.1), and other IT personnel involved in implementing access control, guidance on the specific procedures they are to follow for implementing AC features and functions for systems under their purview.

1.2 Scope

The requirements outlined within this guide apply to and must be followed by all GSA Federal employees and contractors who are involved in implementing access control features and functions for GSA systems and information. All GSA systems must adhere to the requirements and guidance provided with regard to the procedures, processes, and methods for implementing access control as described in this guide. Per CIO 2100.1, a GSA system is a system:

● used or operated by GSA; or

● used or operated on behalf of GSA by a contractor of GSA or by another organization.

1.3 Policy

CIO 2100.1 contains many policy statements regarding access control, privilege management, and user account management. The following policy statements summarize the high-level policies on how access to and between systems is managed at GSA. For more detailed policy requirements, see Appendix B: GSA Order CIO 2100.1 Policy Statements on Access Control.

● All GSA systems must implement logical access controls to authorize or restrict the activities of users and system personnel to authorized transactions and functions IAW GSA CIO-IT Security-01-07. (Chapter 4, 1.z)

● Supervisors of GSA employees and contractors coordinating and arranging system access requests for all new or transferring employees and verifying an individual’s need-to-know (authorization) and modifying or terminating access for transferring or terminating personnel. (Chapter 2, 25.c, d, e).

● User authorizations must be verified annually for all systems. (Chapter 4, 1.ee)

● Data or system owners must grant access to the system based on a valid need-to-know/need-to-share that is determined during the account authorization process and the intended system usage. (Chapter 4, 1.g)

● All interconnections between GSA and external entities including off-site contractors or Federal agency/departments must be documented in an Interconnection Security Agreement (ISA) that is approved by the AOs and concurred by the GSA CISO. ISA’s must, at a minimum, be reviewed annually. (Chapter 3, 1.d)

U.S. General Services Administration 3

1.4 References

Federal Laws, Standards, Regulations, and Publications:

● EO 13800, Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

● FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems

● NIST Cybersecurity Framework, Framework for Improving Critical Infrastructure Cybersecurity

● NIST SP 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

● NIST SP 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations

● NIST SP 800-161, Revision 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

● Public Law 113-283, Federal Information Security Modernization Act of 2014

GSA Policies, Procedures, Guidance:

The GSA policies listed below are available on the GSA.gov Directives Library page. The GSA CIO-IT Security Procedural Guides listed below are available on the GSA.gov IT Security Procedural Guides page with the exception of CIO-IT Security-18-90 which is restricted. It is available on the internal GSA InSite IT Security Procedural Guides page.

● GSA Oder CIO 2100.1, GSA Information Technology (IT) Security Policy

● GSA Order OSC 2140.2, Management of GSA’s Digital Presence

● GSA Order CIO 2164.1, Internal Clearance Process for GSA Data Assets

● GSA Order CIO 2183.1, Enterprise Identity, Credential, and Access Management (ICAM)

Policy

● GSA Order CIO 2231.1, GSA Data Release Policy

● GSA Order CIO 9297.2, GSA Information Breach Notification Policy

● CIO-IT Security-01-01, Identification and Authentication (I&A)

● CIO-IT Security-01-02, Incident Response (IR)

● CIO-IT security-03-23, Termination and Transfer

● CIO-IT Security-01-08, Audit and Accountability (AU)

● CIO-IT Security-06-30, Managing Enterprise Cybersecurity Risk

● CIO-IT Security-09-44, Plan of Action and Milestones (POA&M)

● CIO-IT Security-12-64, Physical and Environmental Protection (PE)

● CIO-IT Security-14-69, SSL/TLS Implementation

● CIO-IT Security-18-90, Information Security Program Plan (ISPP)

DocuSign Envelope ID: EF35B48C-3CA5-4928-B32B-F9CE3AB36896 https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.gsa.gov/directives-library https://www.gsa.gov/policy-regulations/policy/information-technology-policy/it-security-procedural-guides https://www.gsa.gov/policy-regulations/policy/information-technology-policy/it-security-procedural-guides http://insite.gsa.gov/node/166494

U.S. General Services Administration 4

1.5 Access Control Roles and Responsibilities

There are many roles associated with implementing an effective access control program.

System owners for each information system are responsible for ensuring that access control processes exist for their specific system and that the appropriate people have been assigned access control related roles and responsibilities. The system owners have direct responsibility to ensure effective implementation and management of GSA’s access control requirements, processes, and procedures for each of their systems. Appendix C provides a listing of the roles and responsibilities related to implementing, administering, and managing access control at

GSA.

2 Access Control Overview

2.1 What Are Access Controls

Access control, as it relates to this guide, pertains to granting or denying logical access to a resource, such as data/information or a system. Access is typically gained by an individual (a user of the resource), for example a GSA employee or a contractor; sometimes individuals are aggregated into groups. It is also possible to have automated system-to-system access, known as a system interconnection.

Identification, authentication, and authorization are key terms regarding access control. Each user of a resource should have a unique identifier. In some situations, access for anonymous users may be considered as an option. However, this type of access must be based on a sound risk management decision, with documented controls and approved by the AO of the resource.

Authentication involves verifying a user (or device) identity through mechanisms such as Personal Identity Verification (PIV) cards, passwords, etc. More details about identification and authentication are available in CIO-IT Security-01-01. Authorization determines what the individual or device is allowed and is not allowed to do with the resource, such as view the resource but not delete it.

An access control list (ACL) specifies what access rights are permitted to a user. Groups of users may also be classified by assigned and documented roles and the access rights may be assigned to the roles; in role-based access controls, users obtain only the rights assigned to the group (role) as a whole.

2.2 Why Access Controls Are Important

Employing effective access controls based on sound risk management decisions protects GSA resources from internal and external threats and provides a level of assurance that the agency can successfully perform its mission.

Effective access controls also improve the overall security posture of GSA by:

● Ensuring the confidentiality, integrity, and availability of IT resources and data;

U.S. General Services Administration 5

● Enhancing the ability to determine where a breach has occurred;

● Creating greater individual accountability for personnel;

● Limiting user access only to needed information required to perform specific responsibilities (i.e., need-to-know/need-to-share, least privilege access);

● Limiting access to sensitive resources (e.g., financial records, personally identifiable information (PII), security software programs, or data centers).

● Ensuring GSA complies with Federal regulations and mandates.

Without effective access controls, GSA increases the possibility of information loss or theft, regardless of its sensitivity, and limits its ability to control who has access to information.

Confidentiality, integrity, and availability of information are also an issue when access controls are not properly implemented. If a security breach affects one area of the network, and there are insufficient access controls present to contain or mitigate the breach, its reach may be expanded, affecting additional systems, components, and data. Improperly implemented access controls can result in negative consequences, ranging from a lack of information being available to compromised data integrity and/or lack of confidentiality. There is also a possibility of a negative financial impact due to the response to or recovery from a breach. Furthermore, legal issues may also occur for not complying with laws and regulations, resulting in regulatory admonishment, fines and more.

Ineffective access controls also hinder accountability for the actions of users of an IT resource, whether it is a system or its information. Appendix D provides information on best practices for access controls, including:

● Authorization of personnel, interconnection of systems, automated processes, and devices;

● Technical access controls; and

● Protection of media.

3 Implementation Guidance for AC Controls

In the implementation guidance text, the GSA-defined parameter settings included in the control requirements are in blue, italicized text and offset by brackets. As stated in Section 1.2, Scope, the requirements outlined within this guide apply to all GSA systems and must be followed by all GSA Federal employees and contractors involved in the contingency planning of GSA information systems and data. The GSA implementation guidance stated for each control applies to personnel and/or the information systems operated on behalf of GSA. Any additional instructions or requirements for contractor systems will be included in the “Additional Contractor System Considerations” portion of each control section.

Table 2-1 identifies the designation of AC controls as Common, Hybrid, or System-Specific controls for Federal and Contractor systems. Effectively, common controls are provided by GSA at the enterprise level or by one of GSA’s Major Information Systems (e.g., General Support System), system-specific controls are implemented at the system level, and hybrid controls

U.S. General Services Administration 6 have shared responsibilities. CIO-IT Security 18-90, the ISPP, describes the GSA enterprise-wide controls and outlines the responsible parties for implementing them.

Note: Until the ISPP is updated to NIST SP 800-53, Revision 5, contact ispcompliance@gsa.gov for guidance if there is a discrepancy between this guide and the ISPP.

Table 3-1. Designation of AC Controls

System Type Federal Contractor Common AC-1, AC-2(5), AC-19, AC-20(2)

Hybrid AC-2(6), AC-20, AC-20(1) AC-1

System-Specific

AC-2, AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-

2(5), AC-2(7), AC-2(11), AC-2(12), AC-2(13),

AC-3, AC-3(14), AC-4, AC-5, AC-6, AC-6(1), AC-

6(2), AC-6(3), AC-6(5), AC-6(7), AC-6(9), AC-

6(10), AC-7, AC-8, AC-10, AC-11, AC-11(1), AC-

12, AC-14, AC-17, AC-17(1), AC-17(2), AC-

17(3), AC-17(4), AC-18, AC-18(1), AC-18(3),

AC-18(4), AC-18(5), AC-19(5), AC-22

AC-2, AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-

2(5), AC-2(6), AC-2(7), AC-2(11), AC-2(12), AC-

2(13), AC-3, AC-3(14), AC-4, AC-5, AC-6, AC-

6(1), AC-6(2), AC-6(3), AC-6(5), AC-6(7), AC-

6(9), AC-6(10), AC-7, AC-8, AC-10, AC-11, AC-

11(1), AC-12, AC-14, AC-17, AC-17(1), AC-

17(2), AC-17(3), AC-17(4), AC-18, AC-18(1),

AC-18(3), AC-18(4), AC-18(5), AC-19, AC-19(5)

AC-20, AC-20(1), AC-20(2), AC-21, AC-22

Table 3-2 identifies GSA’s AC control applicability at the FIPS 199 Low, Moderate, and High levels, and for GSA’s Lightweight (LATO) and Moderate Impact Software-as-a Service (MiSaaS) authorization processes.

Table 3-2: AC Control Applicability

FIPS 199

Level/A&A

Process Applicable Controls

Low AC-1, AC-2, AC-3, AC-7, AC-8, AC-14, AC-17, AC-18, AC-19, AC-20, AC-22

Moderate

AC-1, AC-2, AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-2(5), AC-2(6)**, AC-2(13), AC-3, AC- 3(14)^, AC-4, AC-5, AC-6, AC-6(1), AC-6(2), AC-6(5), AC-6(7), AC-6(9), AC-6(10), AC-7, AC-8, AC-11, AC-11(1), AC-12, AC-14, AC-17, AC-17(1), AC-17(2), AC-17(3), AC-17(4), AC-18, AC-18(1), AC-18(3), AC-19, AC-19(5), AC-20, AC-20(1), AC-20(2), AC-21, AC-22

High

AC-1, AC-2, AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-2(5), AC-2(6)**, AC-2(11), AC-2(12), AC-2(13), AC-3, AC-3(14)^, AC-4, AC-4(4), AC-5, AC-6, AC-6(1), AC-6(2), AC-6(3), AC- 6(5), AC-6(7), AC-6(9), AC-7, AC-8, AC-10, AC-11, AC-11(1), AC-12, AC-14, AC-17, AC- 17(1), AC-17(2), AC-17(3), AC-17(4), AC-18, AC-18(1), AC-18(3), AC-18(4), AC-18(5), AC-19, AC-19(5), AC-20, AC-20(1), AC-20(2), AC-21, AC-22

LATO AC-2, AC-6(5), AC-6(9)

MiSaaS AC-2, AC-2(7), AC-3, AC-3(14), AC-5, AC-6, AC-6(2), AC-6(9), AC-8, AC-12, AC-21

*-control is applicable at the level listed per GSA OCIO tailoring **-control is applicable at the level listed per GSA OCIO Tailored Moderate Baseline ^-control is applicable if PII is stored, processed, or transmitted

3.1 AC-1 Access Control Policy and Procedures

U.S. General Services Administration 7

Control:

a. Develop, document, and disseminate to [personnel with IT security responsibilities as defined in GSA Order CIO 2100.1]:

1. [Organization-level] access control policy that:

(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the access control policy and the associated contingency planning controls;

b. Designate an [CISO] to manage the development, documentation, and dissemination of the access control policy and procedures; and

c. Review and update the current access control:

1. Policy [annually, as part of CIO 2100.1, GSA IT Security Policy] and following

[changes to Federal or GSA policies, requirements, or guidance]; and

2. Procedures [at least every three (3) years] and following [changes to Federal or GSA policies, requirements, or guidance].

GSA Implementation Guidance: Control designation as common, hybrid, or system-specific is provided in Table 3-1. Control applicability per FIPS 199 Level/A&A process is listed in Table 3-2.

Common Control Implementation:

GSA’s access control policy is defined in the GSA IT Security Policy, CIO 2100.1, which addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance regarding access control for GSA systems. This policy is maintained to be consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines by updating the policy via Changes, Instructional Letters, or the annual update as applicable. This policy is disseminated GSA-wide via GSA’s InSite centralized agency website.

GSA’s access control procedures are documented in GSA IT Security Procedural Guide: CIO-IT Security-01-07, “Access Control (AC)” [this guide]. The procedures facilitate the implementation of the access control policy and associated controls. This guide is disseminated GSA-wide via GSA’s InSite centralized agency website.

Per 2100.1, the CISO is responsible for managing the development and publishing of all security policies and IT security procedural guides. The GSA OCISO is responsible for reviewing and updating CIO 2100.1 annually. The GSA OCISO is responsible for reviewing and updating CIO-IT Security-12-64 every three years and following changes to Federal or GSA policies, requirements, or guidance.

U.S. General Services Administration 8

Federal System System-Specific Expectation:

None, Control AC-1 is a Common Control. However, GSA Service and Staff Officers (SSOs) or system owners may augment the access control policies and procedures included in 2100.1 and CIO-IT Security-01-07 to address additional organizational or system-specific access control requirements. Any such policies and procedures must establish timeframes for updates.

Additional Contractor System Considerations: Vendors/contractors must implement their own access control policies and procedures which comply with the control statements, GSA’s requirements, and are approved by the GSA CISO and AO as part of the ATO process.

3.2 AC-2 Account Management

Control:

a. Define and document the types of accounts allowed and specifically prohibited for use within the system;

b. Assign account managers;

c. Require [GSA SSO or Contractor recommended prerequisites and criteria (based on defined user role(s) matrix in GSA SSPP Template Section 9: Types of Users) as approved by the CISO and AO] for group and role membership;

d. Specify:

1. Authorized users of the system;

2. Group and role membership; and

3. Access authorizations (i.e., privileges) and [the following attributes as defined in the user role(s) matrix in GSA SSP Template Section 9: Types of Users) Internal or External; Privileged (P), Non-Privileged (NP), or No Logical Access (NLA); Sensitivity Level; Authorized Privileges; Functions Performed; MFA Authentication Method] for each account;

e. Require approvals by [designated account managers as specified in AC-2.b] for requests to create accounts;

f. Create enable, modify, disable, and remove accounts in accordance with [CIO-IT Security-01-01, Identification and Authentication, CIO-IT Security-01-07, Access Control, and GSA-defined procedures or conditions (as applicable)];

g. Monitor the use of accounts;

h. Notify account managers and [System Owner, System/Network Administrator, and/or ISSO] within:

1. [14 days] when accounts are no longer required;

2. [14 days] when users are terminated or transferred; and

3. [14 days] when system usage or need-to-know changes for an individual;

U.S. General Services Administration 9

i. Authorize access to the system based on:

1. A valid access authorization;

2. Intended system usage; and

3. [Role privileges identified in GSA SSPP Section 9: Types of Users];

j. Review accounts for compliance with account management requirements [annually];

k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and

l. Align account management processes with personnel termination and transfer processes.

Control Enhancements:

(1) Account Management | Automated System Account Management. Support the management of system accounts using [GSA SSO or Contractor recommended automated mechanisms as approved by the GSA CISO and AO];

(2) Account Management | Automated Temporary and Emergency Account Management.

Automatically [disable] temporary and emergency accounts after [no more than 90 days];

(3) Account Management | Disable Accounts. Disable accounts within [30 days for GSA users; for non-GSA users as determined by the System Owner and approved by AO and CISO] when the accounts:

(a) Have expired;

(b) Are no longer associated with a user or individual;

(c) Are in violation of organization policy; or

(d) Have been inactive for [90 days].

(4) Account Management | Automated Audit Actions. Automatically audit account creation, modification, enabling, disabling, and removal actions;

(5) Account Management | Inactivity Logout. Require that users log out when [they have completed their workday];

(6) Account Management | Dynamic Privilege Management. Implement [dynamic privilege management capabilities provided by enterprise endpoint and network security tools].

(7) Account Management | Privileged User Accounts

(a) Establish and administer privileged user accounts in accordance with [a role-based or attribute-based access scheme];

(b) Monitor privileged role or attribute assignments;

U.S. General Services Administration 10

(c) Monitor changes to roles or attributes;

(d) Revoke access when privileged role or attribute assignments are no longer appropriate.

(11) Account Management | Usage Conditions. Enforce [GSA SSO or Contractor recommended circumstances and/or usage conditions to be approved by the GSA CISO and AO] for [GSA SSO or Contractor recommended system accounts to be approved by the GSA AO].

(12) Account Management | Account Monitoring for Atypical Usage.

(a) Monitor system accounts for [atypical times of day and originating IP address for a known privileged account user that are inconsistent with normal usage patterns]; and

(b) Report atypical usage of system accounts to [the ISSO and the GSA OCISO].

(13) Account Management | Disable Accounts for High-Risk Individuals. Disable accounts of individuals posing a significant risk within [24 hours] of discovery of [account compromise relating to an incident or Insider Threat event (per the OMA Insider Threat Program) as directed but the GSA CISO, AO, and/or GSA Incident Response Team].

GSA Implementation Guidance: Control designation as common, hybrid, or system-specific is provided in Table 3-1. Control applicability per FIPS 199 Level/A&A process is listed in Table 3-2.

The focus of this control is maintaining control over who is able to access GSA system resources to protect against internal and external threats. The first step in this process is to identify the types of users for the system, this is documented in Section 9.4 of GSA’s SSPP templates.

Account types documented therein are allowed, any account that is not documented is not allowed (prohibited), e.g., group, shared accounts. Account managers for systems are designated by the system owner in collaboration with the data owner. Access must be requested for any individual and their need-to-know/need-to-share documented in order for an account to be provided. As specified in the control parameter for part c of the control any prerequisites and criteria for role membership and associated privileges must be documented and approved.

GSA’s default access to any resource is DENY. ALLOW access is granted based on the approved role and privileges an account for a user is provisioned when an account is created. When account requests are approved, the ISSO and the appropriate administrators are responsible for establishing accounts with unique account identifiers; shared accounts are not allowed.

Establishing, maintaining, and removing access rights to GSA systems in accordance with GSA-defined procedures must be conducted by system/network administrators, in conjunction with system and data owners, ISSMs and ISSOs. All allowed accounts must be documented and defined and include group and role memberships and access authorizations. Account usage is

U.S. General Services Administration 11 monitored by tracking activity, details on monitoring activity (i.e., auditing/logging) can be found in CIO-IT Security-01-08.

Supervisors of users must notify account managers and system owners, system/network administrators, and ISSOs within two weeks of when an account change is required. For example, if an individual transfers, terminates, or their relationship to GSA/a system changes under any circumstances, accounts and authorization rights must be reviewed and modifications, disablement, or revocation of their accounts made, as appropriate.

On an annual basis ISSOs must coordinate with System Owners and Data Owners to validate continued need for an individual’s account to access a system as well as the roles and privileges for the individual/account. The ISSO must coordinate with administrators and account managers, as appropriate, when modifications are required based on the review. Similarly, when an individual leaves a group, any group account authenticators must be changed to ensure that former group members do not retain access. CIO-IT Security-03-23 contains information on handling personnel terminations and transfers.

For enhancement AC-2(1), FIPS 199 Moderate and High systems must manage accounts using automated mechanisms, the approval of which is based on the assessment conducted as part of the system’s ATO process. For example, the use of automated mechanisms to identify inactive accounts is one use case.

For enhancement AC-2(2), FIPS 199 Moderate and High systems must disable temporary and emergency accounts after no more than 90 days. For example, if possible, any emergency or temporary account should be set to automatically expire in 90 days, otherwise a manual process will have to be established.

For enhancement AC-2(3), FIPS 199 Moderate and High systems GSA user accounts that are no longer associated with a user, are expired, are in violation of GSA policy, or have been inactive for 90 days must be disabled within 30 days. For non-GSA users the time period for disablement can be determined by the system owner, but it must be approved by the GSA CISO and AO. If appropriate, restored access for disabled accounts may be requested by the user.

For enhancement AC-2(4), FIPS 199 Moderate and High systems account actions (creation, modification, enabling, disabling, removal) must be automatically audited. Additional information on auditing can be found in CIO-IT Security-01-08.

For enhancement AC-2(5), FIPS 199 Moderate and High systems must require users to log out of their account at the end of their workday.

For enhancement AC-2(6), FIPS 199 Moderate and High systems must implement dynamic privilege management capabilities provided by enterprise endpoint and network security tools.

For enhancement AC-2(7), systems following the MiSaaS process must follow a role-based or attribute-based access scheme to establish and administer privileged user accounts. A process

U.S. General Services Administration 12 must be established to monitor role and attribute assignments and changes to them. Access must be revoked when privileged roles or attribute assignments are no longer needed. For example, when an individual’s role changes, the role assignment and/or attributes must reflect and changes between the previous and new role.

For enhancement AC-2(11), FIPS 199 High systems must enforce any circumstances or usage conditions for specified accounts that have been approved by the GSA CISO and AO. For example, if a specific account is only to be used at certain times of the month, the system should be configured to only allow its use during that time.

For enhancement AC-2(12), FIPS 199 High system, privileged accounts must be monitored for atypical usage (e.g., time of day, originating IP address) that differ from that account’s normal patterns. Since such activity could be an indicator of an insider or external threat, this behavior must be reported to the ISSO and the GSA OCISO (i.e., Incident Response Team).

For enhancement AC-2(13), FIPS 199 Moderate and High systems accounts belonging to individuals who pose a significant risk must be disabled within 24 hours after it has been discovered that there has been an incident related to an account compromise or a credible insider threat has been identified per GSA’s Insider Threat Program. Accounts should only be disabled as directed by the GSA CISO, AO, and/or Incident Response Team

Additional Contractor System Considerations: Vendor/contractor systems must comply with the control in accordance with the guidance above.

3.3 AC-3 Access Enforcement

Control: Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Control Enhancements:

(14) Access Enforcement | Individual Access. Provide [a self service mechanism or use GSA’s Privacy Act Request for Access process] to enable individuals to have access to the following elements of their personally identifiable information: [as defined in the GSA PII Rules Matrix].

GSA Implementation Guidance: Control designation as common, hybrid, or system-specific is provided in Table 3-1. Control applicability per FIPS 199 Level/A&A process is listed in Table 3-2.

To control access, GSA systems must be configured to automatically manage the identification of users, processes, and devices. ISSOs are responsible for administering the user identification and authentication scheme used in the system. Authenticators must follow GSA policies per

2100.1 and 2183.1 and CIO-IT Security 01-01.

For enhancement AC-3(14), FIPS 199 Low, Moderate, and High systems with PII must provide users with the ability to access personally identifiable information about themselves to

DocuSign Envelope ID: EF35B48C-3CA5-4928-B32B-F9CE3AB36896 https://insite.gsa.gov/organizations/staff-offices/office-of-mission-assurance/divisions-program-offices/personnel-security-division/insider-threat-program https://docs.google.com/spreadsheets/d/1Yb9I9C3qCee8dnkVIIUqIZgrWsA1DoW0xYF2yPjgz0I/edit#gid=1521803081

U.S. General Services Administration 13 understand how their information is being used and to ensure it is accurate. As stated in the control parameter, GSA PII Rules Matrix identifies PII for GSA and either a self service mechanism provided by the system or GSA’s Privacy Act Request Access process can be used to satisfy the control requirement.

Additional Contractor System Considerations: Vendor/contractor systems must comply with the control in accordance with the guidance above.

3.4 AC-4 Information Flow Enforcement

Control: Enforce approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Web Services Security (WS Security), WS-Security Policy, WS Trust, WS Policy Framework, Security Assertion Markup Language (SAML), and extensible Access Control Markup Language (XACML)].

Control Enhancements:

(4) Information Flow Enforcement | Flow Control of Encrypted Information. Prevent encrypted information from bypassing [any information flow control mechanisms] by [decrypting the information, blocking the flow of the encrypted information, or by terminating communications sessions attempting to pass encrypted information].

GSA Implementation Guidance: Control designation as common, hybrid, or system-specific is provided in Table 3-1. Control applicability per FIPS 199 Level/A&A process is listed in Table 3-2.

The focus of this control is to maintain control of information flow within a system and between systems. Information flow must be documented in the system SSPP. Controlling the flow of information between GSA systems and external systems using persistent connections is covered in interconnection security agreements specified in control CA-3, additional information is available in CIO-IT Security-06-30.

Information flow control within a system and interconnected systems should be governed by the frameworks and services in the control parameter. Flow enforcement is also provided by the architectures of the systems and their networks, i.e., firewall rules, router policies, etc.

For enhancement AC-4(4), FIPS 199 High systems must employ mechanisms that preclude encrypted information from circumventing flow control mechanisms. For example, if all web traffic must be visible for inspection, encrypted web traffic must either be decrypted and inspected, blocked if decryption is not possible, terminating the connection.

Additional Contractor System Considerations: Vendor/contractor systems must comply with the control in accordance with the guidance above.

https://docs.google.com/spreadsheets/d/1Yb9I9C3qCee8dnkVIIUqIZgrWsA1DoW0xYF2yPjgz0I/edit#gid=1521803081

U.S. General Services Administration 14

3.5 AC-5 Separation of Duties

Control:

a. Identify and document [GSA S/SO or Contractor recommended duties of individuals requiring separation, to be approved by the GSA CISO and AO];

b. Define system access authorizations to support separation of duties.

GSA Implementation Guidance: Control designation as common, hybrid, or system-specific is provided in Table 3-1. Control applicability per FIPS 199 Level/A&A process is listed in Table 3-2.

When granting access to a GSA system, the system owner must ensure separation of duties which ensures that no single user has complete control over a single critical process (i.e., enough authorizations to perform fraudulent actions or inflict other damage). The roles and privileges for users are defined in the system’s SSPP in Section 9.4, Types of Users. This section defines the authorized privileges (system access) based on functions performed, which supports separation of duties. The system owner, ISSO, and ISSM sign the SSPP, effectively approving the separation of duties described therein. The CISO and AO approve the separation of duties when the authorization package is approved by issuing an ATO for the system. Any issues related separation of duties should have been identified during the system’s security assessment which, in turn, would need to be addressed before an ATO is issued, or the risk accepted via a POA&M and/or an AOR with regard to separation of duties.

Additional Contractor System Considerations: Vendor/contractor systems must comply with the control in accordance with the guidance above.

3.6 AC-6 Least Privilege

Control: Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Control Enhancements:

(1) Least Privilege | Authorize Access to Security Functions. Authorize access for [any individual or role] to:

(a) [GSA SSO or Contractor recommended security functions (deployed in hardware, software, and firmware) approved by the GSA CISO and AO]; and

(b) [security-relevant information as approved by the GSA CISO and AO].

(2) Least Privilege | Non-Privileged Access for Non-Security Functions. Require that users of system accounts (or roles) with access to [all security functions (examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security

U.S. General Services Administration 15 administration, other privileged functions)], use non-privileged accounts or roles, when accessing non-security functions.

(3) Least Privilege | Network Access to Privileged Commands. Authorize network access to [all privileged commands (i.e., any command requiring privileges above a standard user)] only for [GSA SSO or Contractor recommended compelling operational needs as approved by the GSA CISO and AO] and document the rationale for such access in the security plan for the system.

(5) Least Privilege | Privileged Accounts. Restrict privileged accounts on the system to [GSA SSO or Contractor recommended employees and contractors as approved by the GSA CISO and AO];

(7) Least Privilege | Review of User Privileges. FIPS 199 Moderate and High systems

(a) Review [annually as part of the annual account review (per AC-2j)] the privileges assigned to [all roles and users] to validate the need for such privileges; and

(b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.

(9) Least Privilege | Log Use of Privileged Functions. Log the execution of privileged functions.

(10) Least Privilege | Prohibit Non-Privileged Users from Executing Privileged Functions.

Prevent non-privileged users from executing privileged functions.

GSA Implementation Guidance: Control designation as common, hybrid, or system-specific is provided in Table 3-1. Control applicability per FIPS 199 Level/A&A process is listed in Table 3-2.

When granting system access, assigned authorizations must follow the concept of “least privilege,” limiting users to only those resources necessary to satisfy organizational mission/business needs. Granting permissions beyond this scope increases the attack surface of the system, allowing users to operate in unwanted ways. When additional privileges are granted, they should be in effect for the shortest duration necessary. Appendix D contains additional information on best practices regarding least privilege.

For enhancement AC-6(1), for FIPS 199 Moderate and High systems, similar to the base AC-6 control, access to security functions should be identified in Section 9.4 of the SSPP and the approvals are based on approving the SSPP and the ATO of the system. Access to any security functions not addressed in Section 9.4 must be fully explained in the SSPP when AC-6(1 is addressed.

Security-relevant information includes, but is not limited to, filtering rules for routers or firewalls, configuration parameters for security services, cryptographic key management information, and access control lists. Authorized personnel include security administrators, system administrators, system security officers, system programmers, and other privileged

U.S. General Services Administration 16 users. Security-relevant functions include, but are not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, and other privileged functions.

For enhancement AC-6(2), for FIPS 199 Moderate and High systems and systems following the MiSaaS security authorization process, privileged users/roles who use system accounts or roles with access to security and privileged functions must use non-privileged accounts/roles when performing non-security functions.

For enhancement AC-6(3), FIPS 199 High systems must authorize network access to commands that require privileges above a standard user only when needed based on compelling operational needs of the system and its business function. The rationale for the network access to such privileges and the rationale for permitting such access must be described in the SSPP with approvals by the CISO and AO being provided when an ATO is signed based on an assessment of the control.

For enhancement AC-6(5), FIPS 199 Moderate and High systems and systems following the LATO process must provide privileged accounts (e.g., system administrator) only to those individuals approved by the GSA CISO and AO. The approval is granted by issuing an ATO based on an assessment that indicates this control has been met. In addition, as described in Appendix D, the level of investigation performed on an individual is based on the level of access that individual will need to a system.

For enhancement AC-6(7), FIPS 199 Moderate and High system the review of the account privileges assigned to all roles/users must be included in the annual review of accounts specified in control AC-2.j. This review is to ensure that privileges that are no longer relevant to an individual or role based on changes in the role or the individual’s required access are adjusted. If the needs have changed then the privileges for that individual or role must be changed to reflect the current needs.

For enhancement AC-6(9), FIPS 199 Moderate and High systems and systems following the and MiSaaS processes must log the execution of privileged functions. Additional information regarding the auditing/logging of events for GSA systems is covered in CIO-IT Security-01-08.

For enhancement AC-6(10), FIPS 199 Moderate and High systems must prevent non-privileged users from executing privileged functions. Effectively, this is accomplished by ensuring that non-privileged users, i.e., users that do not have a need to perform privileged functions based on their role or business need and/or users who do not have the required investigation for executing privileged functions are not granted them when they are assigned their account or role.

Additional Contractor System Considerations: Vendor/contractor systems must comply with the control in accordance with the guidance above.

U.S. General Services Administration 17

3.7 AC-7 Unsuccessful Logon Attempts

Control:

a. Enforce a limit of [not more than ten (10) failed access attempts] consecutive invalid logon attempts by a user during a [30-minute time period]; and

b. Automatically [lock the account/node for 30 minutes] when the maximum number of unsuccessful attempts is exceeded.

GSA Implementation Guidance: Control designation as common, hybrid, or system-specific is provided in Table 3-1. Control applicability per FIPS 199 Level/A&A process is listed in Table 3-2.

All GSA systems must enforce a limit on unsuccessful access attempts (not more than 10 failed attempts within a 30-minute period) and lock the account/node for 30 minutes when the maximum number of unsuccessful attempts is exceeded.

Additional Contractor System Considerations: Vendor/contractor systems must comply with the control in accordance with the guidance above.

3.8 AC-8 System Use Notification

Control:

a. Display [a system use notification message or banner as defined in GSA CIO Order 2100.1)] to users before granting access to the system that provides privacy and security notices consistent with applicable Federal laws, Executive Orders, directives, regulations, policies, standards, and guidance and state that:

1. Users are accessing a U.S. Government system;

2. System usage may be monitored, recorded, and subject to audit;

3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and

4. Use of the system indicates consent to monitoring and recording;

b. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and

c. For publicly accessible systems:

1. Display system use…