USDA_Incident_Mgmt_Policy.doc

Attachment K 6680-6682

WO AMENDMENT 6600-2010-2

EFFECTIVE DATE: 05/11/2010

DURATION: This amendment is effective until superseded or removed.

6680-6682

FSM 6600 - SYSTEMS MANAGEMENT

CHAPTER 6680 - SECURITY OF INFORMATION, INFORMATION SYSTEMS,

AND INFORMATION TECHNOLOGY

Forest Service Manual national headquarters (wo)

Washington, DC

FSM 6600 - SYSTEMS MANAGEMENT

CHAPTER 6680 - SECURITY OF INFORMATION, INFORMATION SYSTEMS,

AND INFORMATION TECHNOLOGY

Amendment No.: 6600-2010-2 Effective Date: May 11, 2010 Duration: This amendment is effective until superseded or removed.

Approved: THELMA J. STRONG

Acting Associate Deputy Chief, OPS Date Approved: 05/04/2010

Posting Instructions: Amendments are numbered consecutively by title and calendar year. Post by document; remove the entire document and replace it with this amendment. Retain this transmittal as the first page(s) of this document. The last amendment to this title was 6600-2010-1 to FSM 6683-6684.

New Document

(Amendment 6600-2008-1, 09/17/2008) 81 Pages

Digest:

6680.15 - Removes “Department Personnel Bulletin 735-1, Employee Responsibilities and Conduct” and adds “USDA Incident Notification Plan”.

6680.15b - Adds reference to Departmental Regulation 4070-735-001, Employee Responsibilities and Conduct.

6680.5 - Adds definitions for Anonymized Information, Audit Reduction, Collaborative Computing, Computer, Cryptography, De-identified Information, Harm, Linkable Information, Linked Information, Management Security Controls, Media, Mobile Code, Obscured Information, Operational Security Controls, Personally Identifiable (PII) Information Confidentiality Impact Level, Technical Security Controls.

Digest:

6680.61a - Adds publication NIST SP 800-27 Revision A, NIST SP 800-58, NIST SP 800-95, and NIST SP 800-122 to Exhibit 01.

6682.02 - Revises the Objective statement.

6682.04 - 6682.04r - Adds requirements for protecting the confidentiality of personally identifiable information (PII) to the responsibilities for Chief Information Officer in paragraph 26, Agency Information Systems Security Program Manager (ISSPM) in paragraph 29, Privacy Officer in paragraph 1, Information System Security Officer (ISSO) in paragraph 7, System Owners in paragraph 4, Information System or Application Program Managers and Application Developers in paragraph 1, Information Owners in paragraph 4, and Users in paragraph 4. Adds requirements for approving or denying requests for exceptions to FS policy to responsibilities for ISSPM, ISSO, and System Owners.

6682.3 - Adds new policy statement and paragraph 1 that addresses PII issues.

6682.4 - Removes paragraph 2 under paragraph 3(1)(a) and direction on security.

6682.42 - Adds paragraph a. under paragraph 3 and direction on PII.

6682.47 - Removes code and direction and recodes caption and direction to 6682.51.

6682.51 - Establishes code and recodes to this section caption and direction previously found in 6682.47.

6682.8 - Establishes code, caption and sets forth new direction “Planning Security Related Activity”.

6682.9 - Establishes code, caption and sets forth new direction “Protecting the Confidentiality of Personally Identifiable Information (PII)”.

Table of Contents

56680.1 - Authority

56680.11 - Laws

66680.12 - Executive Orders

76680.13 - Regulations

76680.14 - Government-wide Directives and Standards

86680.15 - U.S. Department of Agriculture Directives

96680.15a - Departmental Manuals

116680.15b - Departmental Regulations

126680.2 - Objectives

126680.3 - Policy

136680.4 - Responsibility [Reserved]

136680.5 - Definitions

356680.51 - Abbreviations and Acronyms

406680.6 - References

406680.61 - National Institute of Standards and Technology (NIST) Publications

406680.61a - National Institute of Standards and Technology (NIST) Special Publications

476680.61b - National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) Publications

486681 - SECURITY PROGRAM MANAGEMENT [RESERVED]

486682 - SECURITY MANAGEMENT CONTROLS

486682.02 - Objective

486682.04 - Responsibility

486682.04a - Chief Information Officer

516682.04b - Line Officers

526682.04c - Agency Information System Security Program Manager (ISSPM)

556682.04d - Change Management Board Secretariat

556682.04e - Privacy Officer

566682.04f - Information System Security Officer (ISSO)

576682.04g - Accrediting Authority

586682.04h - Accrediting Authority’s Designated Representative

586682.04i - Certifying Official

596682.04j - System Owners

626682.04k - Information System or Application Program Managers and Application Developers

646682.04l - Information Technology (IT) System Administrators

646682.04m - Acquisition Management Personnel

646682.04n - Information Owners

656682.04o - Law Enforcement and Investigations

656682.04p - Investment Manager

666682.04q - Contracting Officer

666682.04r - Users

666682.07 - Team, Committee, and Group Roles

666682.07a - Certification Team

676682.07b - Security Test and Evaluation Team

676682.07c - Change Management Board

686682.07d - Risk Assessment Team

686682.1 - Risk Assessment and Update

696682.2 - Security Controls Review [Reserved]

696682.3 - System Development Life Cycle Security Planning (SDLC)

756682.4 - Certification, Accreditation, and Security Assessments Policies and Procedures

766682.41 - Security Assessments

766682.42 - Information System Interconnections

776682.43 - Security Certification

776682.44 - Plan of Action and Milestones

786682.45 - Security Accreditation

796682.46 - Continuous Monitoring

796682.5 - System Security Plan and Update

806682.51 - Privacy Impact Assessment

816682.6 - Configuration Management

826682.61 - Baseline Configuration

826682.62 - Configuration Change Control

826682.63 - Monitoring Configuration Changes

826682.64 - Access Restrictions for Change

836682.65 - Configuration Settings

836682.66 - Least Functionality

836682.67 - Information System Component Inventory

846682.7 - Information System Documentation

846682.8 - Planning Security Related Activity

856682.9 - Protecting the Confidentiality of Personally Identifiable Information (PII)

6680.1 - Authority

6680.11 - Laws Title 5, United States Code, section 301 (5 U.S.C. 301), provides that the head of an executive department or military department may prescribe regulations for the use of its property.

Title 18, United States Code, section 1030 (18 U.S.C. 1030), prohibits unauthorized access to and use of Government computer systems.

Federal Managers’ Financial Integrity Act of 1982 (Pub. L. 97-255; 96 Stat. 814), requires that the Office of Management and Budget (OMB) evaluate agencies' accounting and administrative control systems and that agencies self-evaluate those systems.

Chief Financial Officers (CFO) Act of 1990 (Pub. L. 101-576; 31 U.S.C. 501; 104 Stat. 2838), requires that Forest Service Chief Financial Officers comply with applicable accounting principles, standards, and requirements and with internal control standards; to provide complete, reliable, consistent, and timely information.

The Paperwork Reduction Act of 1995 (44 U.S.C. 3501), mandates promoting the use of information technology to improve the productivity, efficiency, and effectiveness of Forest Service programs, and requires development and implementation of policies, principles, standards, and guidelines for information technology functions and activities.

Federal Information Security Management Act (FISMA) of 2002 (Pub. L. 107-347, Title 3; 44 U.S.C. 3541-3549), sets minimum information security requirements, requires agencies to implement information security protections commensurate with the magnitude of harm that could result from a security incident, and requires sufficient training for all personnel.

Clinger-Cohen Act, formerly known as the Information Technology Management Reform Act (ITMRA) of 1996 (41 U.S.C. 251), repeals the Brooks Act (40 U.S.C. 759) and abolishes the Federal Information Resources Management Regulation (FIRMR).

Rehabilitation Act of 1973 (21 U.S.C. 812), prohibits discrimination against people with disabilities, applies to programs conducted by Federal agencies; those receiving Federal funds, such as colleges participating in Federal student loan programs; Federal employment; and employment practices of businesses with Federal contracts. The standards for determining employment discrimination under the Rehabilitation Act are the same as those used in Title I of the Americans with Disabilities Act.

Title 7, Code of Federal Regulations, section 2.60 (a)(27) (7 CFR 2.60 (a)(27)), sets out the delegation to the Forest Service to administer radio spectrum management for U.S. Department of Agriculture (USDA).

Computer Security Act of 1987 (15 U.S.C. 271), provides for IT security in Federal agencies and establishes the framework for Federal agencies to improve the security of their computer systems.

Children’s Online Privacy Protection Act (COPPA) of 1998 (15 U.S.C. 6501-6506), applies to the online collection of personal information by persons or entities under U.S. jurisdiction from children under 13 years of age. It details what a web site operator shall include, in a privacy policy, when and how to seek verifiable consent from a parent or guardian, and what responsibilities an operator has to protect for children's privacy and safety online, including restrictions on marketing to children under 13 years of age. The Federal Trade Commission (FTC) has the authority to issue regulations and enforce COPPA.

Privacy Act of 1974 (5 U.S.C. 552), states in part, “No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains....”

6680.12 - Executive Orders

Executive Order 10450, Security Requirements For Government Employment, issued April 27, 1953, specifies particular criteria and responsibilities for investigating the background and character of individuals employed or seeking employment in the Federal government to ensure that the interests of national security are met.

Executive Order 12968, Access to Classified Information, issued August 2, 1995, establishes a uniform Federal personnel security program for employees who will be considered for initial or continued access to classified information.

Executive Order 13011, Federal Information Technology (IT), issued July 16, 1996, requires that agencies significantly improve the management of their information systems, including the acquisition of IT, by implementing the provisions of the Paperwork Reduction Act of 1995 (Pub. L.104-13; 44 U.S.C. 3501), the Information Technology Management Reform Act of 1996 (Pub. L. 104-106; 41 U.S.C. 251), and the Government Performance and Results Act of 1993 (Pub.L.103-62; 107 Stat. 285).

6680.13 - Regulations

Title 5, Code of Federal Regulations, Part 731, Office of Personnel Management - Suitability. Requires that every competitive service position have a risk determination and requires some specific procedural strategies, such as background investigations.

Title 5, Code of Federal Regulations, Part 732, Office of Personnel Management - National Security Positions. Defines sensitivity level designations and investigative requirements for positions determined to be sensitive to national security.

Title 5, Code of Federal Regulations, Part 736, Personnel Investigations. Describes investigation process for Federal employees.

Title 5, Code of Federal Regulations, Part 930, subpart C (5 CFR part 930, subpart C), Information Security Responsibilities for Employees Who Manage or Use Federal Information Systems. Requires initial, continued and refresher security training for Forest Service employees responsible for the management or use of computer systems that process sensitive information.

Title 5, Code of Federal Regulations, Part 2635, Standards of Ethical Conduct for Employees of the Executive Branch, section 2635.702. Prohibits use of public office for private gain.

6680.14 - Government-wide Directives and Standards

General Accounting Office, Federal Information Systems Controls Audit Manual. Describes the control activities, control techniques, and audit procedures for evaluating the separation of duties principles used in Federal agencies.

Office of Management and Budget Circular A-123, Management Accountability and Control. Provides guidance to Federal managers on improving the accountability and effectiveness of Federal programs and operations by establishing, assessing, correcting, and reporting on management controls.

Office of Management and Budget Circular A-130, Security of Federal Automated Information Resources. Establishes minimum controls to be included in Federal automated information security programs and assigns responsibilities for the security of automated information.

Office of Management and Budget Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information. Establishes requirements to safeguard PII, to develop rules of conduct for handling PII, and to develop procedures for responding to and reporting PII breaches, and for external breach notification procedures.

Presidential Decision Directive 67, Enduring Constitutional Government and Continuity of Government. Requires Federal agencies to develop Continuity of Operations Plans for Essential Operations.

Federal Information System Controls Audit Manual. Provides guidance to auditors in evaluating internal controls over the integrity, confidentiality, and availability of maintained data.

Homeland Security Presidential Directive 7, Critical Infrastructure Identification, Prioritization, and Protection. Establishes a national policy for Federal departments and agencies to identify and prioritize United States critical infrastructure, key resources, and to protect them from terrorist attacks.

Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors. Requires the establishment of a mandatory, government-wide standard for secure and reliable forms of identification issued by the Federal government to its employees and contractors (including contractor employees).

6680.15 - U.S. Department of Agriculture Directives

Department Personnel Manual, Chapter 751, Discipline. Provides guidelines for disciplinary action.

USDA Interim Guidance Memo, CS-010, Peer-to-Peer Networking and Copyright Protection. Defines conditions for the authorized use of the Internet and protection of USDA information technology resources.

Departmental Notice 3300-012, Commercial Wireless Technologies in USDA - Unclassified Security Requirements for Wireless Networks in Unlicensed Frequencies. Provides direction for the secure use of wireless network technologies.

USDA Incident Notification Plan, September, 2007. Provides requirements and procedures for notification of officials, individuals, and the press when a breach of personally identifiable information has occurred.

6680.15a - Departmental Manuals

Departmental Manual 3140-001, Management Automated Data Processing (ADP) Security Manual. Requires all U. S. Department of Agriculture (USDA) agencies to use individual user identifications and passwords to control access to any computing systems that process personal, financial, market–related, or other sensitive data.

Departmental Manual 3300-001, Telecommunications & Internet Services and Use. Provides authority for information resource management and provides guidelines for electronic mail and Internet use.

Departmental Manual 3505-000, USDA Computer Incident Response Procedures Manual. Identifies different types of computer incidents and establishes procedures for reporting and handling them.

Departmental Manual 3510-001, Chapter 2, Part I, Physical Security Standards for Information Technology (IT) Restricted Space. Directs that information technology restricted space be considered part of the Forest Service’s critical infrastructure and provides detailed guidance for physically securing facilities containing critical information technology infrastructure and for identifying, reporting, mitigating, and correcting deficiencies.

Departmental Manual 3515-001, Collection of Web Page Cookies & Privacy Requirements Manual. Requires all USDA agencies collect or create only that information necessary for the proper performance of agency functions and which has practical utility.

Departmental Manual 3515-002, Privacy Impact Assessment (PIA) Manual. Requires all USDA agencies to initiate a PIA in the early stages of the development of a system and to ensure that the PIA is completed as part of the required system life cycle reviews.

Departmental Manual 3555-001, USDA Certification and Accreditation Manual. Provides direction for security certification and accreditation of information technology systems.

Departmental Manual 3505-001, Incident Response Procedures. Requires all agencies to establish and implement an internal incident response capability and to have computer security incident response procedures in place that can be activated immediately.

Departmental Manual 3520-001, Configuration Management Policy and Responsibilities. Sets requirements for system and product configuration and change management, including documentation and tracking.

Departmental Manual 3525-001, USDA Internet Access Security for Private Internet Service Providers. Requires use of only the USDA Internet Access Network for entry to the Internet and specifies terms and conditions of exceptions to that requirement.

Departmental Manual 3525-002, USDA Internet Use and Copyright Restrictions. Establishes policy on the use of government computers or networks for unauthorized purposes.

Departmental Manual 3525-003, Telework and Remote Access Security. Requires that remote access be through secure firewalls/gateways using robust authentication and also requires agencies to centrally manage their remote access and dialup connections.

Departmental Manual 3530-001, Vulnerability Scan Procedures. Requires vulnerability scanning of all Forest Service networks, systems, servers, and desktops, and establishes scanning procedures and responsibilities.

Departmental Manual 3530-004, Firewall Technical Security Standards. Requires the use of firewalls between Forest Service and USDA networks and the use of secure Internet protocol (IP) connectivity from the Internet to USDA networks. This policy also details procedures, including equipment and services, for meeting those requirements.

Departmental Manual 3530-005, Encryption Security Standards. Provides direction to all USDA agencies and staff offices to use the Approved Protocols and Protection Techniques.

Departmental Manual 3535-001, USDA’s C2 Level of Trust. Requires that all USDA servers that store, process, or maintain mission-critical or sensitive information must be secured according to the Departmental Manual (DM) standards, including the DM minimum password management requirements.

Departmental Manual 3540-001, Risk Assessment Methodology. Provides direction and requirements for risk assessment and provides Forest Service information system security program manager (ISSPM) responsibilities.

Departmental Manual 3540-002, Risk Assessment and Security Checklists. Provides direction on use of security program assessment checklists and provides Forest Service Chief Information Officer and ISSPM responsibilities.

Departmental Manual 3545-001, Security Awareness and Training. Requires agencies to develop, implement, and maintain an information technology security awareness and training program to ensure the security of information systems.

Departmental Manual 3550-002, Sensitive but Unclassified information Protection. Requires all USDA agencies and staff offices to identify and provide adequate security protection for Sensitive but Unclassified (SBU)/Sensitive Security Information (SSI).

Departmental Manual 3550-002, Portable Electronic Devices & Wireless Technology. Requires all USDA agencies and staff offices to develop an agency secure approach for the implementation of portable electronic devices (PEDs) and wireless technology.

Departmental Manual 3560-001, Security Requirements for Capital Planning and Investment Control (CPIC). Requires all USDA agencies and staff offices to institute a formal CPIC process and execute all CPIC responsibilities for both the overall security program and all major IT investments.

Departmental Manual 3565-001, Annual Security Plans for Information Technology (IT) Systems. Requires agencies to develop and maintain security plans, provides security plan guidance, and provides Forest Service Chief Information Officer and ISSPM responsibilities.

Departmental Manual 3570-001, IT Contingency and Disaster Planning. Defines and describes information technology (IT) contingency planning and provides requirements and responsibilities for developing and implementing disaster recovery and business resumption plans.

Departmental Manual 3575-001, Security Controls in the Systems Development Life Cycle. Requires USDA agencies and staff offices to select a systems development life cycle and implement the appropriate baseline security controls during the life of all information technology systems.

Departmental Manual 9610-2, USDA Security Policies and Procedures for Laboratories and Technical Facilities (Excluding Biosafety Level (BSL) 3 Facilities). Establishes policy for the security of critical assets.

6680.15b - Departmental Regulations

Departmental Regulation 3140-1, USDA Information Systems Security Policy. Directs all USDA agencies to design, implement, and maintain an adequate security program for information resources; establishes guidelines for system usage; and requires implementation of comprehensive information protections, including individual accountability, throughout Forest Service functions and mandates the practice of separation of duties to the extent possible.

Departmental Regulation 3140-2, Internet Security Policy. Directs all USDA agencies to develop and implement an Internet security policy, establishes minimum security requirements, and identifies some prohibited uses.

Departmental Regulation 3440-002, Control and Protection of “Sensitive Security Information”. Directs all USDA agencies to safeguard unclassified but sensitive security information within its control.

Departmental Regulation 4070-735-001, Employee Responsibilities and Conduct. Sets out requirements for all U.S. Department of Agriculture (USDA) employees in a variety of areas related to employee conduct; section 16 addresses use of computers.

6680.2 - Objectives

To evaluate, regulate, and monitor the effectiveness of security controls that safeguard information technology (IT) resources that support the Forest Service mission.

6680.3 - Policy

1. Implement and monitor appropriate security controls at all levels of the Forest Service to protect the confidentiality, integrity, and availability of the information, information systems, and information technology (IT) that supports the Forest Service mission.

2. Include appropriate provisions in contracts, agreements with cooperators, and other instruments to ensure that non-Forest Service personnel who work with Forest Service information, information systems, and IT follow requirements for appropriate use and security of Forest Service-owned and leased information resources as set out for employees in the Forest Service Directive System and other authorities (FSM 6680.1).

3. Allow exceptions to the requirements in FSM 6680 only through exception-specific waivers granted by the Forest Service Chief Information Officer or, if authority is delegated by the Chief Information Officer (CIO), by the information system security program manager (ISSPM).

a. Before granting exceptions to the requirements in FSM 6680, execute form FS-6600-11, Request for Exception-Specific Waiver of a Forest Service Security Policy Requirement.

4. Implement this policy, within six months of issuance for existing system and immediately for new systems, by following standard CIO-approved procedures.

6680.4 - Responsibility [Reserved]

6680.5 - Definitions

Access. A connection between users, or processes acting on behalf of users, and devices, files, records, processes, programs, domains or other objects in an information system that allow reading, writing, modification or deletion of those objects depending on level of access.

Access Control. Mechanisms and policies that restrict or control access to an information system and the data in that system. An access control list (ACL) specifies what operations different users can perform on specific files and directories (assets).

Account Requester. An account requester is a Forest Service employee authorized to request an account on behalf of another employee, contractor, or cooperator.

Accreditation. The official management decision by the accrediting authority to authorize operation of an information system and to explicitly accept the risk to Forest Service operations (including mission, functions, image, or reputation), assets, or individuals, based on the implementation of an agreed-upon set of security controls.

Accrediting Authority (AA). Official with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals.

Accrediting Authority’s Designated Representative. An individual selected by an authorizing official to act on his or her behalf in coordinating and carrying out the necessary activities required during the security certification and accreditation (C&A) of an information system.

Administrative Controls. Safeguards that require proper management and control of information and information systems. These safeguards include policy and certification and accreditation programs (NIST SP 800-12).

Anonymized Information XE "Anonymized" . Previously identifiable information that has been de-identified and for which a code or other link no longer exists.

Asset. A major application (MA), general support system (GSS), high impact program, physical plant, mission critical system, or logically related group of systems. Also, a physical or intangible item of value to an organization or individual.

Assurance. The grounds for confidence that the security controls being used will operate correctly and will be effective in the operational environment.

Audit Reduction. Reduction in the amount of information contained in audit records as well as the filtering of raw log data into useful information.

Authentication. A security control or service that ensures only authenticated individuals are allowed access to information system resources.

Authenticator. A device or piece of information that uniquely identifies a user of an information system. Authenticators include, but are not limited to: tokens, public key infrastructure (PKI), certificates, passwords, and key cards.

Authorized Investigation. A formal investigation, of known or suspected illegal or improper activity, that is allowed, initiated, and conducted in accordance with applicable law, regulation, and policy. Authorized investigations are normally conducted by Human Capital Management (HCM) or Law Enforcement and Investigations (LEI) personnel.

Authorized Software. Software that is part of the standard Forest Service image, for which the Forest Service owns a Forest Service license, or that has received technical approval (FSM 6610).

Availability. A requirement intended to assure that systems work promptly and service is not denied to authorized users (NIST SP 800-12).

Background Investigation. An investigation to determine the suitability, eligibility, or qualifications of individuals for Federal employment, for work on Federal contracts, or for access to classified information or restricted information systems or functions. The level of scrutiny will vary depending on the sensitivity of the functions to be performed or the information to be accessed by the individual being investigated. A background investigation can include written or telephone inquiries and/or personal contacts.

Backup. Copying information system files and data to a second, separate medium or area, such as a disk, tape, or alternate disk partition, as a precaution in case the first or primary medium fails, or data contained on the first or primary medium is damaged or lost.

Back-up Site (Alternate Site). A facility that is able to support system operations in restoring critical systems to an acceptable level as defined in the disaster recovery plan (DRP). Sites are referred to as: cold, warm, hot, mobile, and mirrored.

Baseline Configuration. The documentation, hardware, and software that make up a configuration item (CI) at a given point in its life cycle. The baseline serves as a point of departure or reference for the next life cycle stage. In the Forest Service standard life cycle, baselines are established after each life cycle phase.

Baseline Controls. The minimum security controls recommended for an information system based on the system’s security categorization in accordance with Federal Information Processing Standard (FIPS) 199.

Best Practices.

a. For purposes of IT, those techniques or methodologies that, through experience and research, have proven to reliably lead to a desired result. A commitment to using the best practices in any field is a commitment to using all the knowledge and technology at one's disposal to ensure success.

b. In the software development process, those well-defined methods that contribute to a successful step in product development. Throughout the software industry, several best practices are widely followed; some of the more commonly used are: an iterative development process, requirement management, quality control, and change control.

Business Continuity Plan (BCP). A plan for sustaining organization business functions, and the information systems that support them, during and after a disruption. A BCP may be for a specific business process or all key business processes and may cover long term recovery in addition to interim business continuity requirements. A Disaster Recovery Plan (DRP), Business Resumption Plan, and occupant emergency plan may be appended to the BCP.

Business Impact Analysis (BIA). An analysis of the business processes and interdependencies used to characterize contingency requirements and priorities in the event of a significant disruption of service.

Business (Information) Owner. The agency official with statutory or operational authority for specified information and is responsible for establishing the controls for information generation, collection, processing, dissemination, and disposal.

Business Resumption Plan (BRP). A plan for the restoration of business processes and functions after a disruption, separate from plans and procedures to sustain business functions during a disruption.

C2 Level of Trust. A standard defined in Departmental Manual (DM) 3535-001, that describes minimum security measures to be taken on certain computing systems owned or operated by or on behalf of USDA and its agencies. C2 (Controlled Access Protection) is a security rating established by the National Computer Security Center, based on the Department of Defense Trusted Computer System Evaluation Criteria.

Certification. A comprehensive assessment of all security controls in an information system, made in support of accreditation, to determine if those controls are implemented correctly, operating as intended, and producing the desired outcome.

Certification Team. The group responsible for carrying out a security certification, usually consisting of technical personnel from the business unit responsible for the certification.

Certifying Official. An independent, objective, third-party, technical liaison for all stakeholders in a certification and accreditation (C&A) process, and the person responsible for reviewing and accepting the certification. The certifying official shall be a Forest Service employee.

Chain of Custody. The identification, protection, and tracking of evidence by each responsible party to prevent loss, breakage, alteration, or unauthorized handling.

Change Management Board (CMB). A body of qualified individuals responsible for controlling configuration management (CM), including approval of baseline documentation and the review, analysis, and approval of configuration changes.

Change Management Board Secretariat. The individual(s) or organization that provides administrative support to the CMB, such as coordinating meeting schedules, distributing read-ahead materials and Board correspondence, taking notes during meetings, and so forth.

Collaborative Computing. The use of information transfer technology to support input from more than one person into a work product. Collaborative computing mechanisms include, for example, video and audio conferencing capabilities and explicit indication of use includes, for example, signals to local users when cameras and/or microphones are activated.

Compensating Security Controls. Security control that can be applied to one or more agency information systems and has the following properties: the development, implementation, and assessment of the control can be assigned to a responsible official or organizational element (other than the system owner); and the results from the assessment of the control can be used to support the security C&A processes of an agency information system where that control has been applied.

Computer. A general-purpose machine that processes data according to a set of instructions that are stored internally either temporarily or permanently. The computer and all equipment attached to it are called hardware. The instructions that tell it what to do are called "software." A set of instructions that perform a particular task is called a "program" or "software program."

Computer Security Incident. Any adverse event that affects or threatens the confidentiality, integrity, or availability of some aspect of an information system or the data it contains.

Confidentiality. Preserving authorized restrictions on information access and disclosure, including controls for protecting personal privacy and proprietary information.

Configuration. The functional and/or physical characteristics of a system as specified in the technical documentation and realized in a product. It includes all of the characteristics of the system that must be controlled, such as version, content, technical documentation, data needed for operation, and other essential elements.

Configuration Audit and Verification. The process used to verify that a product’s performance requirements have been achieved by the product/system design and accurately documented.

Configuration Control Authority. The person, usually a project or system manager, responsible for controlling information system design solutions for meeting operational user requirements.

Configuration Item (CI). Any piece of hardware, software, or both that satisfies an end use function and is designated for separate configuration management, such as individual software applications contained by the same system.

Configuration Management (CM). Controlling and documenting the configuration of an information system throughout its life to ensure that the system components are well defined and cannot be changed without proper justification and full knowledge of the consequences.

Configuration Management Authority (CMA). The person, usually the Chief Technology Officer (CTO), responsible for approving the entire CM structure and processes and who has authority over all CM activities and roles for Forest Service information systems.

Configuration Management Library. The repository in which CIs are stored. For software and documents, the library may be an aggregation of electronic files that each store a separate or unique type of information. For hardware, it may be a shelf or other location where reference equipment is stored.

Configuration Management Specialist. The person responsible for managing and operating a CM system, including physically controlling system documentation and ensuring that CM processes are followed.

Configuration Status Accounting. The system of records that provides tracking of configuration documentation changes and documenting CIs. These records should include both current and historical information to ensure traceability from the initial requirements or previous baseline.

Contingency Plan (CP). A plan for responding to emergencies such as attacks, disruptions, or disasters to sustain or restore systems and functions affected by the event, minimize impact, and eventually repair damage and return to normal operations. CPs normally include emergency response and backup operations.

Contingency Planning. The dynamic development of a coordinated recovery strategy for information systems or application, operations, and data after a disruption. The planning process requires several steps: develop policy; conduct BIA; identify preventive controls; develop recovery strategies; develop contingency plan; test and exercise the plan; train personnel; and maintain the plan.

Contingency Planning Coordinator (CPC). A person who designates appropriate teams to implement the recovery strategy. Each team should be trained and ready to deploy in the event of a disruptive situation requiring plan activation.

Contingency Plan Testing. Either a tabletop or a functional test to validate and evaluate contingency procedures and the ability of recovery teams to implement the plan. It identifies any deficiencies in the plan that should be addressed during plan maintenance.

Continuity of Operations Plan (COOP). A plan for restoring Forest Service essential functions (often a headquarters or similar level element) at an alternate site for up to 30 days following a disaster or other event that makes the primary site unusable. Minor disruptions that do not require relocation to an alternate site are typically not addressed.

Corporate Data. Information owned, collected, maintained, or generated by the enterprise that has inherent value to and is intended for consistent, shared use within the enterprise. For example, a database of the enterprise’s customer information would be considered corporate data. Documents generated outside the Forest Service, but used by a single employee while executing assigned duties would not be considered corporate data.

Crisis Communication Plan. A plan for internal and external communications during an emergency or other crisis that details decisions, procedures, and actions to ensure that accurate, timely information flows efficiently between those who need to be kept informed, such as decision makers, emergency responders, managers, media, and those affected by the emergency.

Critical Control Functions. Tasks that are entrusted to one person with control of more than one critical stage of a process.

Cryptography. The study of mathematical techniques related to aspects of information security such as confidentiality, data integrity, entity authentication, and data origin.

Data Center. An area, room, group of rooms, building(s), or installation housing multiple general-purpose multi-user or specialized high-performance computers and related data/voice/video/radio communications facilities servicing the needs of one or more USDA agencies and conforming to the definition for a Type I or Type II automated data processing (ADP) facility found in DM 3140-001.

Database Administrator. A person responsible for the design and management of one or more databases and for the evaluation, selection, and implementation of database management systems. Tasks might include controlling an organization’s data resources, using data dictionary software to ensure data integrity and security, recovering corrupted data, eliminating data redundancy, and using tuning tools to improve database performance.

De-identified Information XE "De-identified" . Records that have had enough PII removed or obscured such that the remaining information does not identify an individual, De-identified information should provide no reasonable basis to believe that the information alone can be used to identify an individual.

Demilitarized Zone (DMZ). A network that connects an untrusted network to a trusted network, but is part of neither.

Determination of Suitability. A formal, documented determination of whether or not a person is eligible for federal work, and associated information system access, based on relevant aspects of that person’s character or conduct as revealed during the course of a background investigation and screening process.

Disaster Recovery Plan (DRP). A plan to restore operation of systems, functions, or facilities when major, usually catastrophic, events make them inoperable or inaccessible for an extended period. DRPs frequently address restoring operations at an alternate site or facility, but are usually narrower in scope and do not address minor disruptions not requiring relocation.

Disruption. An unplanned event, such as a power outage or facility damage, that causes an information system to be inoperable or unavailable for an unacceptable length of time.

Due Care. The minimum and customary practice of responsible protection of assets.

Due Diligence. The prudent management and execution of due care.

Emergency Account. A limited duration account granted during times of immediate, critical need, such as incident response or disaster recovery, when there is not time to follow established personnel screening and account creation procedures.

Employee Non-work Time. Time when the employee is not otherwise expected to be addressing official business.

Encryption. The process of transforming readable information, such as plain text, into cipher text, a type of code that requires a secret key or password to be transformed back into the original readable information.

Facility Manager. The line officer (or staff member(s) with authority delegated by the line officer) who has the responsibility for managing a facility (campus, building, or space within a building) that also contains IT controlled space or IT restricted space. Regardless of whether the facility is owned or leased by the Forest Service, this role includes those having responsibility for obtaining or coordinating utilities, janitorial, maintenance, space planning, engineering services, and other property or building management functions for the facility. The role also includes coordinating with Law Enforcement and Investigations (LEI) for HSPD-12 and physical security implementation, Information Resources Management Information Security Branch for IT controlled space or IT restricted space requirements, and Acquisition Management and/or Engineering or other architectural staff, to ensure that security requirements of the facility are met.

Failover. A configuration method that provides for the automatic transfer of operations from a primary system to a secondary or backup system, in the event of the failure of the primary.

Firewall. A hardware and/or software system designed to prevent unauthorized access to or from a private network, particularly unauthorized access from the Internet. A firewall typically examines all traffic to or from a private network and blocks any that does not meet specified security criteria.

Forest Service IT Resources. Forest Service-owned or -leased components of the IT infrastructure, including but not limited to: personal computers and related peripheral equipment and software, library resources, telephones, cellular telephones, facsimile machines, photocopiers, Internet connectivity and access to Internet services, and e-mail.

Friendly Termination. Friendly termination may occur when an employee voluntarily transfers, resigns to accept a different position, or retires. To the extent possible, use consistent procedures for handling friendly suspensions and terminations.

Gap Analysis. A study to identify areas or issues in policies, plans, or processes that have been addressed either incompletely or not at all.

General Support System (GSS). An interconnected information resource under the same direct management control that shares common functionality. It normally includes hardware, software, information, data, applications, communications, facilities, and people, and provides support for a variety of users and/or applications that, in turn, support mission-related functions.

General Support System (GSS) /Application Program Manager. The official responsible for the system or application during its initial development and acquisition, and who is concerned with cost, schedule, and performance issues.

Generic System Access Account. A system, functional, multi-user or non-user-based account. The account is not directly assigned to a single user for the entire life of the account.

Generic System Access Account Manager. The Forest Service employee designated as custodian of a given generic system access account. The manager is responsible for the actions performed by those persons using said account. See Generic System Access Account.

Hacking or Cracking Tools. A class of software tools used to decrypt, usually via brute force methods, encrypted information, such as passwords.

Harm XE "Harm" . Any negative or unwanted effects that would be experienced by an individual XE "Individual" (i.e., that may be socially, physically, or financially damaging) or an organization if the confidentiality of PII were breached

Image. The current, approved operating system and corporate software, initially installed on IT devices. Images change as patches, updates, and new corporate software is installed.

Incident Handling. The mitigation of violations of security policies and recommended practices (NIST SP 800-61, p. D-2).

Incident Reporting. Notification to appropriate officials, such as Computer Incident Response Team (CIRT), that an incident is suspected, confirmed, or in progress, and ongoing communication and analysis related to the incident or its resolution.

Incident Response Plan (IRP). The plan that defines what constitutes an incident and provides a step-by-step process that should be followed when an incident occurs.

Individual. A citizen of the United States or an alien lawfully admitted for permanent residence.

Information. Corporate data in digital or hardcopy format at any stage of processing such as, but not limited to, input, output, storage, transmission, or hardcopy.

Information in Identifiable Form. Information in an IT system or online collection:

that directly identifies an individual (name, address, social security number, or other identifying number or code, telephone number, email address, etc.); or by which an agency intends to identify specific individuals in conjunction with other data elements, (indirect identification). These data elements may include a combination of gender, race, birth date, geographic indicator, and other descriptors.

Information Remanence. A residual representation of data that has been in some way nominally erased or removed.

Information System. The combination of hardware, software, and communications facilities that, together, provide for the processing and management of information.

Information System Security Officer (ISSO). The individual responsible to the information system security program manager (ISSPM) and to the AA or system owner for ensuring the required operational security is maintained for an information system.

Information System Security Program Manager (ISSPM). The agency official delegated by the Chief Information Officer to oversee the agency’s Information System Security Program (ISSP). The ISSPM may further delegate oversight responsibilities in certain areas to assistant ISSPMs (AISSPM).

Information Technology (IT). General purpose, commercially available, automated data processing components (equipment, software, and IT services) and the hardware systems created from them, regardless of size, use, capacity, price, or method of acquisition.

Information Technology-related Risk. The potential adverse impact on Forest Service operations (including mission, functions, image, or reputation), assets, or individuals, based on the level of impact of a threat to an information system and the likelihood of that threat occurring.

Information Technology Contingency Plan (ITCP). A coordinated strategy involving plans, procedures, and technical measures that enable the recovery of IT systems, operations, and data after a disruption.

Information Technology (IT) Controlled Space. Physical locations that contain telecommunication network access points (wired or wireless routers, switches, LAN or other network patch panels, modems, or other data circuit terminating equipment) or servers and associated IT equipment. Individual cabinets, cages, lockers, lockable racks, closets, or small rooms containing such equipment (including computer training rooms), and computer rooms servicing regional or smaller audiences are examples of IT controlled space.

Information Technology (IT) Help Desk. A service that provides information and assistance to the users of an information system.

Information Technology (IT) Restricted Space. Physical locations that house systems with a security categorization of “high” or that house highly sensitive critical Forest Service information technology infrastructure components. Locations housing major Forest Service data centers and telecommunications resources, Web farms, or locations servicing more than 10,000 users or that house consolidated national databases for major agency applications are examples of IT restricted space.

Instant Messaging. Two-way, real-time, internal or external communication via plain text messages, which are less secure than email because they can be intercepted and read and which are transmitted via commercial software and services (such…