Appendix A_2019StatewideInformationAndCyberSecurityStandardsV1.0.pdf

Level 1, Published

Statewide Information and Cyber Security Standards

Initial Release Version 1.0

June 24, 2019

APPENDIX A

Initial Release, Version 1.0 2019 STATEWIDE INFORMATION AND

CYBER SECURITY STANDARDS

Level 1, Published

AUTHORITY

The Oregon Office of the State Chief Information Officer (OSCIO) has the responsibility for developing and overseeing the implementation of statewide information and cyber security standards, and policies on information security, under the authority of Oregon Revised Statute 276A.300. The Enterprise Security Office (ESO) operates as part of OSCIO and is responsible for creation and maintenance of the Statewide Information and Cyber Security Standards.

APPROVAL

Level 1, Published PAGE i

ACKNOWLEDGEMENTS

The 2019 Statewide Information and Cyber Security Standards Workgroup

Core Workgroup Members Steve Harvath, Oregon Enterprise Security Office, Co-Chair Norm Walters, Oregon Department of Employment, Co-Chair Brian Goergen, Oregon Department of Transportation Monte Hogan, Oregon Emergency Management Bill Kellogg, Oregon Department of Corrections Dave Komanecky, Oregon Enterprise Technology Services Anthony Mingus, Oregon Department of Justice Paul Musack, Oregon State Police Skip Pikl, Oregon Department of Fish and Wildlife Karina Stewart, Oregon Department of Transportation Greg Verharst, Oregon Department of State Lands

Additional Contributors Cinnamon Albin, Vince Almberg, Kristine Cornett, Nick Ettel, Teresa Furnish, Mark Johnston, Steve Ketchum, Uma Krishnan, Dave McMorries, Mike Poverud, Jaya Srinivasan, Dustin VanElverdinghe

Level 1, Published PAGE ii

Table of Contents AUTHORITY ............................................................................................................................................................................. II APPROVAL............................................................................................................................................................................... II ACKNOWLEDGEMENTS ............................................................................................................................................................. I

EXECUTIVE SUMMARY

ABOUT THIS DOCUMENT

STATEWIDE SECURITY CONTROLS

ACCESS CONTROL - AC

AC-2 - ACCOUNT MANAGEMENT (L, O)

AC-2(1) - Account Management | Automated System Account Management (M, O) AC-2(2) - Account Management | Removal of Temporary / Emergency Accounts (M, S) AC-2(3) - Account Management | Disable Inactive Accounts (M, S) AC-2(4) - Account Management | Automated Audit Actions (M, S) AC-2(10) - Account Management | Shared and Group Account Credential Change (M, O) AC-2(12) - Account Management | Account Monitoring for Atypical Usage (H, O) AC-2(13) - Account Management | Disable Accounts for High-Risk Individuals (M, O)

AC-3 - ACCESS ENFORCEMENT (L, S)

AC-3(7) - Access Enforcement | Role-Based Access Control (NS, O/S)

AC-4 - INFORMATION FLOW ENFORCEMENT (M, S)

AC-5 - SEPARATION OF DUTIES (M, O)

AC-6 - LEAST PRIVILEGE (M, O)

AC-6(1) - Least Privilege | Authorize Access to Security Functions (M, O) AC-6(2) - Least Privilege | Non-privileged Access for Non-privileged Functions (M, O) AC-6(5) - Least Privilege | Privileged Accounts (M, O) AC-6(7) - Least Privilege | Review of User Privileges (L, O) AC-6(9) - Least Privilege | Auditing Use of Privileged Functions (L, S) AC-6(10) - Least Privilege | Prohibit Non-privileged Users From Executing Privileged Functions (M, S)

AC-7 - UNSUCCESSFUL LOGON ATTEMPTS (L, S)

AC-7(2) - Unsuccessful Logon Attempts | Purge / Wipe Mobile Device (M, S)

AC-8 - SYSTEM USE NOTIFICATION (L, O/S)

AC-11 - DEVICE LOCK (M, S)

AC-11(1) - Device Lock | Pattern Hiding Displays (M, S) AC-11(2) - Device Lock | Require User-Initiated Lock (NS, O)

AC-12 - SESSION TERMINATION (M, S)

AC-14 - PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION (L, O)

AC-17 - REMOTE ACCESS (L, O)

AC-17(1) - Remote Access | Automated Monitoring and Control (M, S) AC-17(2) - Remote Access | Protection of Confidentiality / Integrity Using Encryption (M, S) AC-17(3) - Remote Access | Managed Access Control Points (M, S) AC-17(4) - Remote Access | Privileged Commands / Access (M, O)

AC-18 - WIRELESS ACCESS (L, O)

AC-18(1) - Wireless Access | Authentication and Encryption (M, S) AC-18(3) - Wireless Access | Disable Wireless Networking (M, O/S)

AC-19 - ACCESS CONTROL FOR MOBILE DEVICES (L, O)

AC-19(5) - Access Control for Mobile Devices | Full Device / Container-based Encryption (M, O)

AC-20 - USE OF EXTERNAL SYSTEMS (L, O)

AC-20(2) - Use of External Systems | Portable Storage Devices (M, O) AC-20(3) - Use of External Systems | Non-Organizationally Owned Systems and Components (NS, O)

AC-22 - PUBLICLY ACCESSIBLE CONTENT (L, O)

AWARENESS AND TRAINING – AT

AT-2 - SECURITY AWARENESS TRAINING (L, O)

AT-2(2) - Security Awareness Training | Insider Threat (M, O) AT-2(3) - Security Awareness Training | Social Engineering and Data Mining (M, O)

AT-3 - ROLE-BASED TRAINING (L, O)

AT-4 - SECURITY TRAINING RECORDS (L, O)

Level 1, Published PAGE iii

AUDIT AND ACCOUNTABILITY – AU

AU-2 - AUDIT EVENTS (L, O)

AU-2(3) - Audit Events | Review and Update (M, O)

AU-3 - CONTENT OF AUDIT RECORDS (L, S)

AU-3(1) - Content of Audit Records (M, S)

AU-4 - AUDIT STORAGE CAPACITY (L, O/S)

AU-5 - RESPONSE TO AUDIT PROCESSING FAILURES (L, S)

AU-5(1) - Response to Audit Processing Failures | Audit Storage Capacity (H, S)

AU-6 - AUDIT REVIEW, ANALYSIS, AND REPORTING (L, O)

AU-6(1) - Audit Review, Analysis, and Reporting | Process Integration (M, O) AU-6(3) - Audit Review, Analysis, and Reporting | Correlate Audit Repositories (M, O) AU-6(4) - Audit Review, Analysis, and Reporting | Central Review and Analysis (M, S)

AU-7 - AUDIT REDUCTION AND REPORT GENERATION (M, S)

AU-7(1) - Audit Reduction and Report Generation | Automatic Processing (M, S)

AU-8 - TIME STAMPS (L, S)

AU-8(1) - Time Stamps | Synchronization With Authoritative Time Source (M, S) AU-8(2) - Time Stamps | Secondary Authoritative Time Source (NS, S)

AU-9 - PROTECTION OF AUDIT INFORMATION (L, S)

AU-9(4) - Protection of Audit Information | Access by Subset of Privileged Users (M, O) AU-9(6) - Protection of Audit Information | Read Only Access (M, O/S)

AU-11 - AUDIT RECORD RETENTION (L, O)

AU-12 - AUDIT GENERATION (L, S)

AU-16 - CROSS-ORGANIZATIONAL AUDITING (NS, O)

SECURITY ASSESSMENT AND AUTHORIZATION (CA)

CA-2 - SECURITY ASSESSMENTS (L, O)

CA-2(1) - Security Assessments | Independent Assessors (M, O) CA-2(2) - Security Assessments | Specialized Assessments (H, O)

CA-3 - SYSTEM INTERCONNECTIONS (L, O)

CA-3(5) - System Interconnections | Restrictions on External System Connections (M, O)

CA-5 - PLAN OF ACTION AND MILESTONES (L, O)

CA-6 - SECURITY AUTHORIZATION (L, O)

CA-7 - CONTINUOUS MONITORING (L, O)

CA-7(1) - Independent Assessments (M, O) CA-7(4) - Risk Monitoring (L)

CA-8 - PENETRATION TESTING (H, O)

CA-8(1) - Penetration Testing | Independent Penetration Agent or Team (H, O) CA-8(2) - Penetration Testing | Red Team Exercises (NS, O) CA-8(3) - Penetration Testing | Facility Penetration Testing (NS, O)

CA-9 - INTERNAL SYSTEM CONNECTIONS (L, O)

CONFIGURATION MANAGEMENT (CM)

CM-2 - BASELINE CONFIGURATION (L, O)

CM-2(2) - Baseline Configuration | Automation Support for Accuracy and Currency (M, O) CM-2(3) - Baseline Configuration | Retention of Previous Configurations (M, O) CM-2(7) - Baseline Configuration | Configure Systems and Components For High-Risk Areas (M, O)

CM-3 - CONFIGURATION CHANGE CONTROL (M, O)

CM-3(2) - Configuration Change Control | Test / Validate / Document Changes (M, O) CM-3(4) - Configuration Change Control | Security Representative (M, O)

CM-4 - SECURITY AND PRIVACY IMPACT ANALYSIS (L, O)

CM-4(2) - Security and Privacy Impact Analysis | Verification of Security and Privacy Functions (M, O)

CM-5 - ACCESS RESTRICTIONS FOR CHANGE (L, O)

CM-6 - CONFIGURATION SETTINGS (L, O)

CM-7 - LEAST FUNCTIONALITY (L, O)

CM-7(1) - Least Functionality | Periodic Review (L, O) CM-7(5) - Least Functionality | Authorized Software / Whitelisting (M, O)

CM-8 - SYSTEM COMPONENT INVENTORY (L, O)

CM-8(1) - System Component Inventory | Updates During Installation / Removals (M, O) CM-8(3) - System Component Inventory | Automated Unauthorized Component Detection (M, O)

CM-9 - CONFIGURATION MANAGEMENT PLAN (M)

Level 1, Published PAGE iv

CM-10 - SOFTWARE USAGE RESTRICTIONS (L, O)

CM-10(1) - Software Usage Restrictions (NS, O)

CM-11 - USER-INSTALLED SOFTWARE (L, O)

CM-12 - INFORMATION LOCATION (M, O)

CM-12(1) - Information Location | Automated Tools to Support Information Location (M, O)

CONTINGENCY PLANNING (CP)

CP-2 - CONTINGENCY PLAN (L, O)

CP-2(1) - Contingency Plan | Coordinate With Related Plans (M, O) CP-2(3) - Contingency Plan | Resume Essential Missions / Business Functions (M, O) CP-2(8) - Contingency Plan | Identify Critical Assets (M, O)

CP-3 - CONTINGENCY TRAINING (L, O)

CP-4 - CONTINGENCY PLAN TESTING (L, O)

CP-4(1) - Contingency Plan | Coordinate With Related Plans (M, O)

CP-6 - ALTERNATE STORAGE SITE (M, O)

CP-6(1) - Alternate Storage Site | Separation from Primary Site (M, O) CP-6(3) - Alternate Storage Site | Accessibility (M, O)

CP-7 - ALTERNATE PROCESSING SITE (M, O)

CP-7(1) - Alternate Processing Site | Separation from Primary Site (M, O) CP-7(2) - Alternate Processing Site | Accessibility (M, O) CP-7(3) - Alternate Processing Site | Priority of Service (moderate, O)

CP-8 - TELECOMMUNICATIONS SERVICE (M, O)

CP-8(1) - Telecommunications Service | Priority of Service Provisions (M, O) CP-8(2) - Telecommunications Service | Single Points of Failure (M, O)

CP-9 - SYSTEM BACKUP (L, O)

CP-9(1) - System Backup | Testing for Reliability / Integrity (M, O) CP-9(8) - System Backup | Cryptographic Protection (M, O)

CP-10 - SYSTEM RECOVERY AND RECONSTRUCTION (L, O)

CP-10(2) - System Recovery and Reconstruction (M, O)

IDENTIFICATION AND AUTHENTICATION (IA)

IA-2 - IDENTIFICATION AND AUTHENTICATION (L, O/S)

IA-2(1) - Identification and Authentication | Multifactor Authentication to Privileged Accounts (L, S) IA-2(2) - Identification and Authentication | Multifactor Authentication to Non-Privileged Accounts (L, S) IA-2(8) - Identification and Authentication | Access to Accounts – Replay Resistant (L, S)

IA-3 - DEVICE-LEVEL IDENTIFICATION AND AUTHENTICATION (M, S)

IA-4 - IDENTIFIER MANAGEMENT (L, O)

IA-5 - AUTHENTICATOR MANAGEMENT (L, O)

IA-5(1) - Authenticator Management | Password-Based Authentication (L, O/S) IA-5(5) - Authenticator Management | Change Authenticators Prior to Delivery (L, O)

IA-6 - AUTHENTICATOR FEEDBACK (L, S)

IA-7 - CRYPTOGRAPHIC MODULE AUTHENTICATION (L, S)

IA-8 - IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) (L, S)

IA-11 - IDENTIFICATION AND AUTHENTICATION | RE-AUTHENTICATION (L, O, S)

IA-12 - IDENTITY PROOFING (M, O)

IA-12(2) - Identity Proofing | Identity Evidence (M, O) IA-12(3) - Identity Proofing | Identity Evidence Validation and Verification (M, O) IA-12(5) - Identity Proofing | Address Confirmation (M, O)

INCIDENT RESPONSE – IR

IR-2 - INCIDENT RESPONSE TRAINING (L, O)

IR-3 - INCIDENT RESPONSE TESTING (M, O)

IR-3(2) - Incident Response Testing | Coordination With Related Plans (M, O)

IR-4 - INCIDENT HANDLING (L, O)

IR-4(1) - Incident Handling | Automated Incident Handling Processes (M, O) IR-4(10) - Incident Handling | Supply Chain Coordination (NS, O)

IR-5 - INCIDENT MONITORING (L, O)

IR-6 - INCIDENT REPORTING (L, O)

IR-6(1) - Incident Reporting | Automated Reporting (M, O) IR-6(2) - Incident Reporting | Vulnerabilities Related to Incidents (M, O) IR-6(3) - Supply Chain Coordination (M, O)

Level 1, Published PAGE v

IR-7 - INCIDENT RESPONSE ASSISTANCE (L, O)

IR-7(1) - Incident Response Assistance | Automation Support for Availability of Information and Support (M, O) IR-7(2) - Incident Response Assistance | Coordination With External Providers (NS, O)

IR-8 - INCIDENT RESPONSE PLAN (L, O)

IR-9 - INFORMATION SPILLAGE RESPONSE (M, O)

MAINTENANCE (MA)

MA-2 - CONTROLLED MAINTENANCE (L, O)

MA-3 - MAINTENANCE TOOLS (M, O)

MA-3(1) - Maintenance Tools | Inspect Tools (M, O) MA-3(2) - Maintenance Tools | Inspect Media (M, O) MA-3(3) - Maintenance Tools | Prevent Unauthorized Removal (M, O)

MA-4 - NONLOCAL MAINTENANCE (L, O)

MA-5 - MAINTENANCE PERSONNEL (L, O)

MA-6 - TIMELY MAINTENANCE (M, O)

MEDIA PROTECTION (MP)

MP-2 - MEDIA ACCESS (L, O)

MP-3 - MEDIA MARKING (L, O)

MP-4 - MEDIA STORAGE (M, O)

MP-5 - MEDIA TRANSPORT (M, O)

MP-6 - MEDIA SANITIZATION (L, O)

MP-6(1) - Media Sanitization | Review / Approve / Track / Document / Verify (H, O)

MP-7 - MEDIA USE (L, O)

PHYSICAL AND ENVIRONMENTAL PROTECTION (PE)

PE-2 - PHYSICAL ACCESS AUTHORIZATIONS (L, O)

PE-3 - PHYSICAL ACCESS CONTROL (L, O)

PE-4 - ACCESS CONTROL FOR TRANSMISSION (M, O)

PE-5 - ACCESS CONTROL FOR OUTPUT DEVICES (M, O)

PE-6 - MONITORING PHYSICAL ACCESS (L, O)

PE-6(1) - Intrusion Alarms / Surveillance Equipment (M, O)

PE-8 - VISITOR ACCESS RECORDS (L, O)

PE-9 - POWER EQUIPMENT AND CABLING (M, O)

PE-10 - EMERGENCY SHUTOFF (M, O)

PE-11 - EMERGENCY POWER (M, O)

PE-12 - EMERGENCY LIGHTING (L, O)

PE-13 - FIRE PROTECTION (L, O)

PE-13(1) - Detection Devices and Systems (M, O) PE-13(2) - Automatic Suppression Devices and Systems (M, O)

PE-14 - TEMPERATURE & HUMIDITY CONTROLS (L, O)

PE-15 - WATER DAMAGE PROTECTION (L, O)

PE-16 - DELIVERY AND REMOVAL (L, O)

PE-17 - ALTERNATE WORK SITE (M, O)

PE-18 - LOCATION OF SYSTEM COMPONENTS (H, O)

PLANNING (PL)

PL-2 - SECURITY PLANS (L, O)

PL-2(3) - Plan / Coordinate With Other Organizational Entities (M, O)

PL-4 - RULES OF BEHAVIOR (L, O)

PL-4(1) - Rules of Behavior | Social Media and Networking Restrictions (L, O)

PL-8 - SECURITY ARCHITECTURE (L, O)

PL-10 - BASELINE SELECTION (L, O)

PL-11 - BASELINE TAILORING (L, O)

PROGRAM MANAGEMENT (PM)

PM-1 - INFORMATION SECURITY PROGRAM PLAN (O)

PM-4 - PLAN OF ACTION AND MILESTONES PROCESS (O)

PM-5 - SYSTEM INVENTORY (L, O)

PERSONNEL SECURITY (PS)

PS-2 - POSITION RISK DESIGNATION (L, O)

PS-3 - PERSONNEL SCREENING (L, O)

Level 1, Published PAGE vi

PS-4 - PERSONNEL TERMINATION (L, O)

PS-5 - PERSONNEL TRANSFER (L, O)

PS-6 - ACCESS AGREEMENTS (L, O)

PS-7 - THIRD-PARTY PERSONNEL SECURITY (L, O)

PS-8 - PERSONNEL SANCTIONS (L, O)

RISK ASSESSMENT (RA)

RA-2 - SECURITY CATEGORIZATION (L, O)

RA-3 - RISK ASSESSMENT (L, O)

RA-3(1) - Risk Assessment | Supply Chain Risk Assessment (M, O)

RA-5 - VULNERABILITY SCANNING (L, O)

RA-5(2) - Vulnerability Scanning | Update by Frequency / Prior to New Scan / When Identified (L, O) RA-5(5) - Vulnerability Scanning | Privileged Access (M, O)

RA-7 - RISK RESPONSE (L, O)

RA-9 - CRITICALITY ANALYSIS (M, O)

SYSTEM AND SERVICES ACQUISITION (SA)

SA-2 - ALLOCATION OF RESOURCES (L, O)

SA-3 - SYSTEM DEVELOPMENT LIFE CYCLE (L, O)

SA-4 - ACQUISITION PROCESS (L, O)

SA-4(1) - Acquisition Process | Functional Properties of Security Controls (M, O) SA-4(2) - Acquisition Process | Design and Implementation Information for Security Controls (M, O) SA-4(9) - Functions / Ports / Protocols / Services in Use (M, O)

SA-5 - SYSTEM DOCUMENTATION (L, O)

SA-8 - SECURITY ENGINEERING PRINCIPLES (L, O)

SA-9 - EXTERNAL SYSTEM SERVICES (L, O)

SA-9(2) - External System Services | Identification of Functions, Ports, Protocols, and Services (M, O)

SA-10 - DEVELOPER CONFIGURATION MANAGEMENT (M, O)

SA-11 - DEVELOPER SECURITY TESTING AND EVALUATION (M, O)

SA-12 - SUPPLY CHAIN RISK MANAGEMENT (M, O)

SA-15 - DEVELOPMENT PROCESS, STANDARDS, AND TOOLS (M, O)

SA-22 - UNSUPPORTED SYSTEM COMPONENTS (L, O)

SYSTEM AND COMMUNICATION PROTECTION (SC)

SC-2 - APPLICATION PARTITIONING (M, S)

SC-3 - SECURITY FUNCTION ISOLATION (H, S)

SC-4 - INFORMATION IN SHARED SYSTEM RESOURCES (M, S)

SC-5 - DENIAL OF SERVICE PROTECTION (L, S)

SC-7 - BOUNDARY PROTECTION (L, S)

SC-7(3) - Boundary Protection | Access Points (M, S) SC-7(4) - Boundary Protection | External Telecommunications Services (M, O) SC-7(5) - Boundary Protection | Deny by Default / Allow by Exception (M, S) SC-7(7) - Boundary Protection | Prevent Split Tunneling For Remote Devices (M, S) SC-7(8) - Boundary Protection | Route Traffic to Authenticated Proxy Servers (M, S) SC-7(10) - Boundary Protection | Prevent Exfiltration (NS, S) SC-7(11) - Boundary Protection | Restrict Incoming Communications Traffic (NS, S) SC-7(12) - Boundary Protection | Host-Based Protection (NS, S) SC-7(14) - Boundary Protection | Protect Against Unauthorized Physical Connections (NS, S) SC-7(21) - Boundary Protection | Isolation of System Components (H, O/S)

SC-8 - TRANSMISSION CONFIDENTIALITY AND INTEGRITY (M, S)

SC-8(1) - Transmission Confidentiality and Integrity | Cryptographic or Alternate physical Protection (M, S)

SC-10 - NETWORK DISCONNECT (M, S)

SC-12 - CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT (L, O/S)

SC-13 - CRYPTOGRAPHIC PROTECTION (L, S)

SC-15 - COLLABORATIVE COMPUTING DEVICES (L, S)

SC-17 - PUBLIC KEY INFRASTRUCTURE (M, O/S)

SC-18 - MOBILE CODE (M, O)

SC-18(4) - Mobile Code | Prevent Automatic Execution (NS, S)

SC-19 - VOICE OVER INTERNET PROTOCOL (M, O)

SC-20 - SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE) (L, S)

SC-21 - SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) (L, S)

Level 1, Published PAGE vii

SC-22 - ARCHITECTURE & PROVISIONING FOR NAME / ADDRESS RESOLUTION SERVICE (L, S)

SC-23 – SESSION AUTHENTICITY (M, S)

SC-28 - PROTECTION OF INFORMATION AT REST (M, S)

SC-28(1) - Protection of Information at Rest | Cryptographic Protection (M, S)

SC-39 - PROCESS ISOLATION (L, S)

SC-41 - PORT AND I/O DEVICE ACCESS (NS, O)

SYSTEM AND INFORMATION INTEGRITY (SI)

SI-2 - FLAW REMEDIATION (L, O)

SI-2(2) - Flaw Remediation | Automated Flaw Remediation Status (M, O)

SI-3 - MALICIOUS CODE PROTECTION (L, O)

SI-3(1) - Malicious Code Protection | Central Management (M, O)

SI-4 - SYSTEM MONITORING (L, O/S)

SI-4(2) - System Monitoring | Automated Tools for Real-Time Analysis (M, S) SI-4(4) - System Monitoring | Inbound and Outbound Communications Traffic (M, S) SI-4(5) - System Monitoring | System Generated Alerts (M, S) SI-4(11) - System Monitoring | Analyze Communications Traffic Anomalies (NS, O/S) SI-4(14) - System Monitoring | Wireless Intrusion Detection (H, S) SI-4(23) - System Monitoring | Host-Based Devices (M, O)

SI-5 - SECURITY ALERTS, ADVISORIES, AND DIRECTIVES (L, O)

SI-7 - SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY (M, O/S)

SI-7(1) - Software, Firmware, and Information Integrity | Integrity Checks (M, S) SI-7(7) - Software, Firmware, and Information Integrity | Integration of Detection and Response (M, O)

SI-8 - SPAM PROTECTION (M, O)

SI-8(1) - Spam Protection | Central Management (M, O) SI-8(2) - Spam Protection | Automatic Updates (M, S)

SI-10 - INFORMATION INPUT VALIDATION (M, S)

SI-11 - ERROR HANDLING (M, S)

SI-12 - INFORMATION MANAGEMENT & RETENTION (L, O)

SI-16 - MEMORY PROTECTION (M, S)

Level 1, Published PAGE 1

EXECUTIVE SUMMARY

The Office of the State Chief Information Officer (OSCIO) has established the following Statewide Information and Cyber Security Standards. These Standards facilitate the development, implementation, and operation of secure information and process control systems by establishing a minimum set of security controls for accessing, processing, and storing information at defined information asset classification levels. These Standards facilitate a consistent, comparable, and repeatable approach for applying security controls. The controls specified in this document can be referenced by state and agency policies and procedures instead of redefining the same controls within an individual policy or procedure.

OSCIO has the responsibility for developing and overseeing the implementation of statewide information and cyber security standards, and policies on information security, under the authority of Oregon Revised Statute 276A.300. These Standards address diverse requirements derived from mission and business needs, laws, Executive Orders, directives, regulations, policies, standards, and guidelines. These Standards apply to systems, policies, and procedures within all Executive Branch agencies. Agencies are responsible for complying with these Standards and ensuring that third parties acting on behalf of agencies have formal agreements that guarantee compliance with these Standards.

These Standards provide a catalog of security controls for State of Oregon information systems to protect state operations, assets, and individuals from a diverse set of threats including malicious acts, natural disasters, structural failures, information system errors and human errors. These Standards support and align with the published Statewide Information Security Plan and applicable statewide policies, including the relevant control families of the National Institute of Standards and Technology Special Publication 800-53 Revision 5 (NIST SP 800-53 R5).

Individual controls within these Standards specify techniques associated with protecting and securely providing access to the State’s information systems. Agencies may elect to exceed these Standards to achieve their organizational security goals and requirements by applying additional controls. The controls documented in these standards are interdependent and are intended to be implemented in their entirety.

These standards have been developed using reference documents from the following resources:

• National Institute of Standards and Technology (NIST)

• Center for Internet Security (CIS)

• Federal, State, and Local Statues and Rules

The NIST Glossary of Key Information Security Terms is used as the standard reference for terms utilized throughout this document.

In circumstances where these Standards cannot be implemented, agencies must document deviations and indicate the compensating controls that have been applied to adequately protect systems or information. A deviation document must be signed by the agency head and approved by OSCIO.

Level 1, Published PAGE 2

ABOUT THIS DOCUMENT

This document is one component of the Statewide Information and Cyber Security Program for the State of Oregon. Components of the security program are detailed in the following documents:

• Statewide Security Plan

• Statewide Information and Cyber Security Standards (this document)

• Statewide Information and Cyber Security Policies

• Agency Information and Cyber Security Plans

• Agency Information and Cyber Security Policies

• System Security Plans

The controls selected for these standards constitute the minimum set of controls necessary to meet the requirements for information system and organizational operations within the State of Oregon. These standards provide a set of common management, operational, and technical security controls that must be implemented. The inclusion of the control in a policy (typically by reference) officially makes the control a ‘common control’ for the State of Oregon (State policies) or for the specific agency (Agency policies).

The Control Identifiers defined in this document can also be referenced as common controls when a System Security Plan is created for a specific Information system.

The Oregon Statewide Information Asset Classification Policy (107-004-050) requires each agency to identify and classify its information assets for the purpose of defining the value, criticality, sensitivity, and legal implications of those assets.

Level 1, Published PAGE 3

The system security categorization process is carried out by the System Owner and the Information Owner, in collaboration with other appropriate organizational personnel (e.g. the Authorizing Official (or designee), Information System Auditor, Business Information Security Officer, Information System Specialist, etc.). The security categorization must be consistent with the potential impact and magnitude of harm to agency mission and business functions that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of State of Oregon information and systems.

This document designates the scope and applicability of listed controls as follows:

Control Scope/Applicability NIST Control Tailoring

• For non-system-specific controls o Enterprise Wide Low + Discretionary o For areas with systems or data (digital or Moderate + Discretionary non-digital) categorized at Level 3 (restricted) or higher

• For system-specific controls o All Systems Low + Discretionary o For Systems categorized as Moderate or higher Moderate + Discretionary o For Systems categorized as Moderate + Moderate + Further Discretionary

The system security categorization is dependent on the data classification as follows:

State of Oregon Data Classification Use Controls with the following Control Scope/Applicability

• Level 1, Published For all systems / Enterprise wide

• Level 2, Limited For all systems / Enterprise wide

• Level 3, Restricted Moderate

• Level 4, Critical Moderate +

The structure of the control labeling used throughout this document is as follows:

There are also references to CIS V7.1 embedded within the controls in this document where a specific control item aligns with the referenced CIS V7.1 control. These references have the form ‘(CIS-x.x)’.

Level 1, Published PAGE 4

STATEWIDE SECURITY CONTROLS

ACCESS CONTROL - AC

AC-2 - Account Management (L, O) • For all systems

a. Define and document the types of accounts to support organizational missions and business functions (CIS- 4.1);

b. Assign Account Managers for system accounts;

c. Establish conditions for group and role membership;

d. Specify authorized users of the system, group and role membership, and access authorizations (i.e.

privileges) for each account, and maintain an inventory of all accounts organized by the authentication system (CIS-16.6);

e. Approve requests to create system accounts;

f. Create, enable, modify, disable, and remove system accounts in accordance with documented account management procedures;

g. Monitor the use of system accounts, and alert when users deviate from normal login behavior (e.g. time of day, workstation location, duration, etc.) (CIS-16.13);

h. Notify Account Managers:

1. When accounts are no longer required;

2. When user employment is terminated or transferred; and

3. When individual system usage or need-to-know changes;

i. Authorize access to the system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Applicable federal and state laws and regulations;

j. Review accounts for compliance with account management requirements; at a minimum accounts must be reviewed annually for user accounts, and semi-annually for privileged accounts;

k. Establish a process for reissuing shared / group account credentials when individuals are removed from the group; and

l. Align account management processes with personnel termination and transfer processes.

NOTE: System account types include, for example, individual, shared, group, application, guest, anonymous, emergency, developer/manufacturer/vendor, temporary, and service.

AC-2(1) - Account Management | Automated System Account Management (M, O) .

For systems categorized as Moderate, or higher

a. Employ automated mechanisms to support the management of system accounts; and

b. Establish and follow an automated process for revoking system access by disabling accounts immediately upon termination or change of responsibilities of an employee or contractor (CIS-16.7).

NOTE: Disabling these accounts, instead of deleting accounts, allows preservation of audit trails.

AC-2(2) - Account Management | Removal of Temporary / Emergency Accounts (M, S) .

For systems categorized as Moderate, or higher

Automatically disable temporary accounts upon completion of use, or pre-defined expiration time, and disable emergency accounts within one year.

AC-2(3) - Account Management | Disable Inactive Accounts (M, S) .

For systems categorized as Moderate, or higher

a. Automatically disable system accounts when the account:

1. Has expired (CIS-16.10);

Level 1, Published PAGE 5

2. Is no longer associated with a user (CIS-16.8);

3. Is in any way in violation of organizational policy;

4. Is no longer used by applications, services, or the system (CIS-16.8); and

5. Has been inactive for 60 days (CIS-16.9).

AC-2(4) - Account Management | Automated Audit Actions (M, S) .

For systems categorized as Moderate, or higher

Automatically audit account creation, modification, enabling, disabling, and removal actions, and notify appropriate personnel as defined in the applicable System Security Plan (CIS-14.9).

AC-2(10) - Account Management | Shared and Group Account Credential Change (M, O) For systems categorized as Moderate, or higher

Change shared and group accounts credentials when members leave the group.

AC-2(12) - Account Management | Account Monitoring for Atypical Usage (H, O) .

For systems categorized as Moderate +:

a. Monitor system accounts for atypical usage; and

b. Report atypical usage of system accounts to appropriate agency personnel as defined in the applicable system security plan (CIS-16.13).

NOTE: Atypical usage includes, for example, accessing systems at certain times of the day and from locations that are not consistent with the normal usage patterns of individuals working in organizations.

AC-2(13) - Account Management | Disable Accounts for High-Risk Individuals (M, O) .

For systems categorized as Moderate, or higher

Disable system accounts within one hour, where users pose a significant risk to the organization.

NOTE: Users posing a significant risk to organizations include individuals for whom reliable evidence or intelligence indicates either the intention to use authorized access to systems to cause harm or through whom adversaries will cause harm. Close coordination and cooperation among authorizing officials, system administrators, and human resource managers is essential for timely execution of this control enhancement.

AC-3 - Access Enforcement (L, S) .

For all systems

a. Enforce approved authorizations for logical access to information and system resources in accordance with statewide and agency access control policies, procedures, and standards, including applicable federal and state laws, and administrative rules; and

b. Automated tools must be used to enforce access controls to information, even when data is copied off a system (CIS-14.7).

AC-3(7) - Access Enforcement | Role-Based Access Control (NS, O/S) .

For systems categorized as Moderate, or higher

Enforce a role-based access control policy over defined subjects and objects, and control access based upon user job classification, position description, function, and need to know.

AC-4 - Information Flow Enforcement (M, S) .

For systems categorized as Moderate, or higher

a. Enforce approved authorizations for controlling the flow of information within the system, and between interconnected systems based on agency-defined information flow control policies; and

b. Document all configuration rules that allow traffic to flow through network devices. Documentation must be managed in a configuration management system with: a specific business reason for each rule; a

Level 1, Published PAGE 6 specific individual’s name responsible for that business need; and an expected duration of the need (CIS- 11.2).

AC-5 - Separation of Duties (M, O) .

For systems categorized as Moderate, or higher

a. Separate personnel duties to minimize the potential for abuse of authorized privileges and risk of malevolent activity without collusion;

1. Developers must not have unmonitored access to production environments (CIS-18.9);

b. Document separation of duties, including roles and permissions; and

c. Define system access authorizations in support of separation of duties.

NOTE: For example, personnel performing system administration duties must be separate from personnel performing system audit duties. Personnel performing system development duties must be separate from personnel performing system change duties. Personnel performing system security duties must be separate from personnel performing system security administration.

AC-6 - Least Privilege (M, O) .

For all systems

Employ the principle of least privilege, allowing only authorized access for users, or processes acting on behalf of users, which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions (CIS-4.1).

AC-6(1) - Least Privilege | Authorize Access to Security Functions (M, O) .

For all systems

a. Explicitly authorize access to administrative privileges, including security functions and security relevant information (CIS-4.1); and

b. Establish procedures to maintain documentation of privileged access, including any elevated privileges, and privileges that provide administrative access to network devices, operating systems, software application capabilities, or scripting tools (CIS-4.7).

AC-6(2) - Least Privilege | Non-privileged Access for Non-privileged Functions (M, O) .

For all systems

Require that users of system accounts, or roles, with access to privileged or administrative functions, use non-privileged accounts or roles when accessing systems for non-privileged, or non-security functions (CIS- 4.3).

AC-6(5) - Least Privilege | Privileged Accounts (M, O) .

For all systems

Restrict privileged accounts to authorized individuals with a need for elevated privileges (CIS-4.1).

AC-6(7) - Least Privilege | Review of User Privileges (L, O) .

For all systems

a. Ensure that privileges assigned to users are reviewed to validate the need for such privileges:

1. Initially upon hire;

2. Any time assigned job duties change;

3. Any time there is a change in job position (e.g. promotion, demotion, or transfer to another division or section within the Agency – see also: Personnel Transfer – PS-5); and

4. Annually thereafter; and

b. Reassign or remove privileges as necessary, to correctly reflect organizational mission and business needs.

Level 1, Published PAGE 7

AC-6(9) - Least Privilege | Auditing Use of Privileged Functions (L, S) .

For all systems

Audit the execution of privileged functions.

AC-6(10) - Least Privilege | Prohibit Non-privileged Users From Executing Privileged Functions (M, S) .

For all systems

Prevent non-privileged users from executing privileged functions; including disabling, circumventing, or altering implemented security safeguards and countermeasures.

AC-7 - Unsuccessful Logon Attempts (L, S) .

For all systems

a. Enforce a limit of no greater than five consecutive invalid logon attempts by a user during a 120-minute time period; and

b. Automatically lock the account for a period of at least 15 minutes.

AC-7(2) - Unsuccessful Logon Attempts | Purge / Wipe Mobile Device (M, S) .

Enterprise wide

Configure mobile devices to purge or wipe stored information after 10 consecutive unsuccessful logon attempts.

NOTE: This control applies only to mobile devices for which a logon occurs. The logon is to the mobile device, not to any one account on the device. Successful logons to accounts on mobile devices reset the unsuccessful logon count to zero. Laptop computers are exempt from this requirement.

AC-8 - System Use Notification (L, O/S) .

For all systems

a. Display to users an approved system use notification that provides privacy and security notices consistent with applicable federal and state laws, Executive Orders, directives, policies, regulations, standards, and guidance. This must occur prior to granting access to the system. The system use notification message shall, at a minimum, provide the following information:

1. The user is accessing a restricted system;

2. System usage may be monitored, recorded, and subject to audit;

3. Unauthorized use of the system is prohibited and may be subject to criminal, civil, or administrative penalties; and

4. Use of the system constitutes consent to monitoring and recording;

b. Retain the notification message until users acknowledge the usage conditions and take explicit actions to log onto, or further access, the system; and

c. For publicly accessible systems:

1. Display system use notification before granting access;

2. Display references, if any, to monitoring, recording, or auditing that are consistent with the privacy accommodations for such systems that generally prohibit monitoring, recording, or auditing activities; and

3. Include a description of the authorized uses of the system.

AC-11 - Device Lock (M, S) .

For all systems

a. Automatically initiate a device lock after 15 minutes of inactivity (CIS-16.11); and

b. Retain the device lock until the authorized user reestablishes access using identification and authentication procedures.

Level 1, Published PAGE 8

AC-11(1) - Device Lock | Pattern Hiding Displays (M, S) .

For all systems

Conceal, via the device lock, information previously visible on the display, with a publicly viewable image.

The pattern-hiding display can include static or dynamic images, for example, patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen, with the caveat that controlled unclassified information is not displayed.

AC-11(2) - Device Lock | Require User-Initiated Lock (NS, O) .

Enterprise wide

Require the user to initiate a device lock before leaving the system unattended.

AC-12 - Session Termination (M, S) .

For systems categorized as Moderate, or higher

Automatically terminate user sessions after 30 minutes of inactivity, unless otherwise defined in the applicable system security plan.

AC-14 - Permitted Actions without Identification or Authentication (L, O) .

For all systems

a. Identify specific user actions that can be performed on the system without identification or authentication consistent with agency missions and business functions; and

b. Document and provide supporting rationale in system security plans for user actions that do not require identification and authorization.

NOTE: This control addresses situations in which organizations determine that no identification or authentication is required in organizational systems. Organizations may allow a limited number of user actions without identification or authentication including, for example, when individuals access public websites or other publicly accessible systems, when individuals use mobile phones to receive calls, or when facsimiles are received. This control does not apply to situations where identification and authentication have already occurred and are not repeated, but rather to situations where identification and authentication have not yet occurred.

AC-17 - Remote Access (L, O) .

For all systems

a. Establish and document usage restrictions, configuration / connection requirements, and implementation guidance for each type of remote access allowed; and

For systems categorized as Moderate, or higher

b. Explicitly authorize and document remote access to internal systems prior to allowing such connections.

Documentation must include the purpose for authorized remote access, conditions, duration, and approved connection methods; and

c. Require the use of multifactor authentication for all remote access.

AC-17(1) - Remote Access | Automated Monitoring and Control (M, S) .

For systems categorized as Moderate, or higher

a. Monitor and control remote access methods; and

b. Scan all enterprise devices remotely logging into the organization's network prior to accessing the network to ensure that each of the organization's security policies has been enforced in the same manner as local network device (CIS-12.12).

Level 1, Published PAGE 9

AC-17(2) - Remote Access | Protection of Confidentiality / Integrity Using Encryption (M, S) .

For systems categorized as Moderate, or higher

Implement a FIPS 140-2 validated cryptographic mechanism to protect the confidentiality and integrity of remote access sessions and information (CIS-12.11).

AC-17(3) - Remote Access | Managed Access Control Points (M, S) .

For systems categorized as Moderate, or higher

Route all remote accesses through a limited number of managed network access control points.

AC-17(4) - Remote Access | Privileged Commands / Access (M, O) .

For systems categorized as Moderate, or higher

a. Authorize the use of remote access for execution of privileged commands and access to security-relevant information only when there are compelling business needs; and

b. Document the rationale for such access in the system security plan.

AC-18 - Wireless Access (L, O) .

For all systems

a. Establish usage restrictions, configuration / connection requirements, and implementation guidance for wireless access; and

1. Wireless access on client machines that do have an essential business purpose for wireless access, must be configured to allow access only to authorized wireless networks, and to restrict access to other wireless networks; and (CIS-15.5); and

2. Agency guest wireless networks must be fully segregated and independent of agency internal networks; and

b. Authorize wireless access to the system prior to allowing such connections.

NOTE: Wireless technologies include, for example, microwave, packet radio (ultra-high frequency/very-high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide credential protection and mutual authentication.

AC-18(1) - Wireless Access | Authentication and Encryption (M, S) .

For all systems

a. Protect wireless access to the system using user authentication and approved cryptographic protections (CIS-15.7); and

b. Protect wireless access to the system using device authentication protocols, such as Extensible Authentication Protocol-Transport Layer Security (EAP/TLS), which require mutual multifactor authentication (CIS-15.8).

AC-18(3) - Wireless Access | Disable Wireless Networking (M, O/S) .

For systems categorized as Moderate, or higher

a. Disable, when not intended for use, wireless networking capabilities internally embedded within system components prior to issuance and deployment, including:

1. Wireless access for devices that do not have a business purpose for wireless access (CIS-15.4);

2. Peer-to-peer (ad-hoc) wireless network capabilities on wireless clients (CIS-15.6); and

3. Peripheral wireless access of devices (such as Bluetooth and NFC), unless such access is required for a documented business purpose (CIS-15.9).

AC-19 - Access Control for Mobile Devices (L, O) .

For all systems

Level 1, Published PAGE 10

a. Establish and document usage restrictions, configuration / connection requirements, and implementation guidance, for organization-controlled mobile devices;

b. Explicitly authorize the connection of mobile devices to organizational systems; and

c. Protect and control mobile devices using a mobile device management solution. Mobile devices must not be left unattended while outside of controlled areas.

NOTE: A mobile device is a computing device that:

1. Has a small form factor such that it can easily be carried by a single individual;

2. Is designed to operate without a physical connection (e.g. wirelessly transmit or receive information);

3. Possesses local, non-removable or removable data storage; and

4. Includes a self-contained power source.

AC-19(5) - Access Control for Mobile Devices | Full Device / Container-based Encryption (M, O) .

Employ full-device encryption on all mobile devices to protect the confidentiality and integrity of information

(CIS-13.6).

AC-20 - Use of External Systems (L, O) .

For all systems

a. Establish terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and / or maintaining external systems, allowing authorized individuals to:

1. Access the system from external systems; and

2. Process, store, or transmit organization-controlled information using external systems.

NOTE: External systems are systems or components of systems that are outside of the authorization boundary established by organizations and for which organizations typically have no direct supervision and authority over the application of required security controls or the assessment of control effectiveness. This includes systems managed by contractors, and systems owned by other agencies. This control addresses the use of external systems for the processing, storage, or transmission of organizational information, including, for example, accessing cloud services from organizational systems.

AC-20(2) - Use of External Systems | Portable Storage Devices (M, O) .

Enterprise wide

a. Document and approve the use of agency-controlled portable storage devices when used on external systems. Documentation must include:

1. Device ID;

2. Personnel authorized to use the portable storage device;

3. Purpose for use; and

4. Date range of use.

AC-20(3) - Use of External Systems | Non-Organizationally Owned Systems and Components (NS, O) .

Enterprise wide

Provide an exception and approval process by which the agency grants and documents approval to attach portable devices (cameras, I-phones, USB drives, etc.) not owned by the agency, to agency owned equipment.

AC-22 - Publicly Accessible Content (L, O) .

a. Designate individuals that are authorized to post information onto a publicly accessible system;

Level 1, Published PAGE 11

b. Train authorized individuals to ensure that publicly accessible information does not contain non-public information, including information classified at Level 2 (Limited) or above according to the statewide Information Asset Classification Policy;

c. Review content after editing, and prior to posting onto the publicly accessible system to ensure that non-public information is not included; and

d. Review content on the publicly accessible system for non-public information, and remove such information if discovered. Personnel conducting these reviews shall be different from the personnel posting content, or conducting the reviews prior to posting content.

AWARENESS AND TRAINING – AT

AT-2 - Security Awareness Training (L, O) .

Enterprise wide

a. Provide all personnel (including but not limited to managers, senior executive staff, contractors, and volunteers) basic security awareness training:

1. As part of initial training for new personnel and before authorizing access to state systems, and information;

2. When required by system changes; and

3. At least annually thereafter; and

b. Create a security awareness program for all personnel to complete on a regular basis to ensure understanding of the necessary behaviors and skills to help support the security of the enterprise (CIS-17.3):

1. The Security Awareness Program must be updated at least annually to address new technologies, threats, standards, and business requirements (CIS-17.4); and

2. At a minimum, training must include:

i) Information on enabling and using secure authentication (CIS-17.5);

ii) Proper identification, storage, transfer, and destruction of sensitive information (CIS-17.7);

iii) Identification of common indicators of an incident; and

iv) How to report incidents (CIS-17.9);

c. All personnel with access to state information assets shall complete basic statewide security awareness training as required; and

d. Provide additional training, including any training required for access to regulated data to supplement the statewide mandated awareness training.

AT-2(2) - Security Awareness Training | Insider Threat (M, O) .

Enterprise wide

Include security awareness training that covers the recognition and reporting of potential indicators of insider threat, including unintentional data exposure (e.g. loss of mobile devices, sending an email to the wrong recipient, etc.) (CIS-17.8).

AT-2(3) - Security Awareness Training | Social Engineering and Data Mining (M, O) .

Enterprise wide

Include security awareness training that covers the recognition and reporting of potential and actual instances of social engineering and social mining (e.g. phishing, phone scams, impersonation, etc.) (CIS- 17.6).

AT-3 - Role-Based Training (L, O) .

Enterprise wide

a. Provide role-based security-related training to personnel with the following roles and responsibilities:

1. Software development personnel in secure coding practices for their specific development environment and responsibilities (CIS-18.6);

Level 1, Published PAGE 12

2. Personnel with privileged access; and

3. Other personnel as required by applicable laws, executive orders, directives, policies, regulations, standards, and guidance; and

b. Provide role-based security-related training:

1. As part of initial training for new users and before authorizing access to organization systems, information, and regulated data;

2. When required by system changes; and

3. At least annually thereafter.

AT-4 - Security Training Records (L, O) .

Enterprise wide

a. Document and monitor individual system security and privacy training activities, including basic security and privacy awareness training, and specific role-based system security and privacy training; and

b. Retain individual training records according to applicable laws, executive orders, directives, policies, regulations, standards, and guidance, but in no case less than the retention time specified by the Oregon Secretary of State Archive Division.

Level 1, Published PAGE 13

AUDIT AND ACCOUNTABILITY – AU

AU-2 - Audit Events (L, O) .

Enterprise wide

a. Verify that, at a minimum, all systems are capable of auditing the following events:

1. Startup and shutdown;

2. Installation and removal of software;

3. Error messages;

4. Account creation, modification, or deletion;

i) Systems must be configured to issue an alert when an account is added to or removed from any group assigned administrative privileges (CIS-4.8);

5. User logon and logoff;

6. Unsuccessful logon attempts (CIS-4.9);

7. Attempted access to deactivated accounts (CIS-16.12);

8. Successful and unsuccessful change of password;

9. Creation or modification of super-user groups; (CIS-4.8)

10. Startup and shutdown of audit functions;

11. Manual clearing or modification of the audit log file;

12. Change of file or user permissions or privileges (e.g. use of SUID/GUID, CHOWN, SU, etc.);

13. Execution of command-line processes for command shells such as Microsoft PowerShell and Bash (CIS-

8.8);

14. Changes made to an application or database by a batch file;

15. Changes to database or application records, where the application has been bypassed to produce the change (via file or other database utility);

16. Modifications to the application or database;

17. Accesses to information and files;

18. Configuration changes;

19. Remote access outside of the internal network, and…