Appendix D System Security Assess and Auth Reqs.docx

NONPUBLIC//FDIC INTERNAL ONLY

NONPUBLIC//FDIC INTERNAL ONLY

System Security Assessment and Authorization Requirements

Authority to Operate The Contractor shall not input, store, process, output, and/or transmit FDIC data within a Contractor IT system without an Authority to Operate (ATO) signed by the FDIC Authorizing Official (AO) granted via the System Security Authorization (SSA) process. The FDIC process for obtaining and maintaining ATO, is in accordance with NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The Contractor shall adhere to current FDIC policies, procedures, and guidance for the SSA process as defined below.

Complete the Security Authorization Process. The SSA process shall proceed according to the NIST SP 800-37 Risk Management Framework for Information Systems and Organizations or any successor publication including templates.

a. System Security Assessment and Authorization Process Documentation. SSA documentation shall be developed by the Contractor using the FDIC provided security documentation templates. SSA documentation consists of the following: Security Categorization Worksheet, System Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

b. Independent Assessment. Contractor shall have an independent third party perform an assessment of the FDIC-prescribed security and privacy controls as outlined in NIST SP 800-53 to determine the extent to which the selected controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements for the system and the FDIC. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

c. Support the Completion of the Privacy Compliance Documentation. As part of the SSA process, the Contractor may be required to support the FDIC in the completion of a Privacy Threshold Analysis (PTA). The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a contractor IT system that will store, maintain and use PII. Upon review of the PTA, the OCISO Privacy Section determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the FDIC in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the FDIC about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the FDIC’s privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at www.fdic.gov/privacy.

d. Authorization to Operate. Upon completion of the SSA documentation and independent assessment, the Contractor shall submit a signed SSA package, validated by the independent third party, to the Oversight Manager for acceptance by the FDIC Authorizing Official (AO), or designee, at least thirty (30) days prior to the use of the system. The FDIC is the final authority on the compliance of the SSA package and may limit the number of resubmissions of a modified SSA package. Once the ATO has been granted by the FDIC AO the Contracting Officer shall incorporate the ATO letter into the contract as a compliance document. The FDIC’s issuance of the ATO does not alleviate the Contractor’s responsibility to ensure the controls are implemented and operating effectively. The SSA package must include the following:

Deliverables (30 Days Prior to System Use)

Security and privacy plans

Security and privacy assessment reports

Plan of action and milestones

Supporting assessment evidence or other documentation, as required.

e. Continuous Monitoring/Ongoing Assessment. After an initial authorization, the Contractor shall have the security and privacy controls assessed on an ongoing basis in accordance with NIST SP 800-37 and based on the FDIC Control Assessment Frequency. Ongoing assessment of the control effectiveness is part of the continuous monitoring activities of the FDIC. Adherence to the terms and conditions specified by the AO as part of the authorization decision are also monitored. Ongoing control assessment continues as the information generated as part of continuous monitoring is correlated, analyzed, and reported to the Oversight Manager for acceptance by the FDIC AO. The system needs to undergo a Security Impact Assessment (SIA) whenever any changes/modifications are made to the system. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.