ATTACHMENT 9- SECURITY-RELATED GUIDELINES AND REFERENCES.pdf

ATTACHMENT 9

SECURITY-RELATED GUIDELINES AND REFERENCES

Section H of the contract references four security documents that are specific to the U.S.

Department of Health and Human Services (HHS) and the Food and Drug Administration (FDA). Section H states that the documents are found in ATTACHMENT 9 of the solicitation.

The following four documents have been combined into one document-Attachment 9.

Within Attachment 9, the documents are found in the order listed below:

U.S. Food and Drug Administration Staff Manual Guides (SMG) 3250 Series

U.S. Department of Health and Human Services (HHS)

Information Security Program Handbook, June 2009.

HHS Information Security Program Policy, June 2009.

HHS Plan of Action and Milestones (POA&M) Guide, December

2008.

FDA

Staff Manual Guide 3250

Information Technology Security1

This document contains information about FDA IT Security Policy and is being provided to support FDA’s Office of Acquisition & Grants Services. Creation date: 5/11/2010.

For Official Use Only

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

Table of Contents

STAFF MANUAL GUIDE 3251.1

RESPONSIBILITY FOR INFORMATION SECURITY

STAFF MANUAL GUIDE 3251.2

DISCIPLINE AND TERMINATION

STAFF MANUAL GUIDE 3251.3

SECURITY AWARENESS AND TRAINING

STAFF MANUAL GUIDE 3251.4

OUTSOURCING

STAFF MANUAL GUIDE 3251.5

CERTIFICATION AND ACCREDITATION

STAFF MANUAL GUIDE 3251.6

PLAN OF ACTION AND MILESTONES (POA&M)

STAFF MANUAL GUIDE 3251.7

RISK MANAGEMENT

STAFF MANUAL GUIDE 3252.1

HUMAN RESOURCE MATTERS - BACKGROUND CHECKS

STAFF MANUAL GUIDE 3252.2

SEPARATION OF DUTIES

STAFF MANUAL GUIDE 3252.3

INCIDENT RESPONSE

STAFF MANUAL GUIDE 3252.4

SANITIZATION OF COMPUTER-RELATED STORAGE MEDIA

STAFF MANUAL GUIDE 3252.5

MALICIOUS SOFTWARE

STAFF MANUAL GUIDE 3252.6

SOFTWARE DEVELOPMENT AND CONTROL PROCESS

STAFF MANUAL GUIDE 3252.7

WIRELESS SECURITY

STAFF MANUAL GUIDE 3253.1

SYSTEM ACCESS CONTROL AND SOFTWARE SECURITY

STAFF MANUAL GUIDE 3253.2

PRIVILEGE CONTROL AND SOFTWARE SECURITY

STAFF MANUAL GUIDE 3253.3

LOGGING SOFTWARE SECURITY

STAFF MANUAL GUIDE 3253.4

DATA SECURITY

STAFF MANUAL GUIDE 3253.5

SYSTEM AND DATA AVAILABILITY

STAFF MANUAL GUIDE 3253.6

ACCESS PATHS

STAFF MANUAL GUIDE 3253.7

ENCRYPTION COMMUNICATIONS SECURITY

STAFF MANUAL GUIDE 3253.8

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

DIAL-UP COMMUNICATIONS AND DOWN-LOADED DATA

STAFF MANUAL GUIDE 3253.9

ELECTRONIC MAIL SYSTEMS

STAFF MANUAL GUIDE 3253.10

FLEXIBLE WORKPLACE ARRANGEMENTS

STAFF MANUAL GUIDE 3253.11

INTERNET AND INTRANET CONNECTIONS

STAFF MANUAL GUIDE 3253.12

SECURE REMOTE ACCESS

STAFF MANUAL GUIDE 3253.13

EXTERNAL NETWORK CONNECTIVITY REQUESTS - ESTABLISHMENT AND

REVIEW

STAFF MANUAL GUIDE 3253.14

HAND HELD DEVICE SECURITY

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

STAFF MANUAL GUIDE 3251.1

GENERAL ADMINISTRATION

EFFECTIVE DATE: 01/16/2007

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

FOOD AND DRUG ADMINISTRATION

INFORMATION RESOURCES MANAGEMENT - INFORMATION

TECHNOLOGY SECURITY

MANAGEMENT CONTROL POLICIES

RESPONSIBILITY FOR INFORMATION SECURITY

1. Purpose

2. Background

3. Policy

4. Responsibilities

5. Effective Date

6. Document History

Attachment A - References Attachment B - Terms and Definitions

1. PURPOSE

The purpose of this document is to outline the overall Agency-wide policy for the assignment of information system security roles and responsibilities. This policy describes the general duties of managers, system owners, and users, as well as those of the Information Systems Security Officers (ISSO). These individuals are charged with creating and implementing the overall security program which meets the basic goal of protecting Food and Drug Administration (FDA) data, information and systems; assuring operational continuity, integrity, availability, and confidentiality of automated information; reducing Information Technology (IT) security risk; and, complying with applicable rules and regulations.

2. BACKGROUND

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

No set of security policies, standards, plans, procedures, or guidelines can prevent any security-related problems unless it is carefully implemented and strongly enforced. Such implementation and enforcement must receive active support at all levels of management and staff. In accordance with Federal mandates (see References); the Agency is required to provide "adequate security" to manage potential risk to its automated information. Adequate security calls for the assignment of responsibility for information security at the levels in the organization where specialists, managers, supervisors, and users can control the security aspects of the systems they manage and use, thereby limiting the risk and magnitude of the harm which incidents can cause and which could adversely affect the ability of FDA to accomplish its mission.

3. POLICY

It is the policy of FDA that the roles relating to information system security be defined and specifically assigned to individuals and groups. Management, the Chief Information Officer (CIO), Chief Information Security Officer (CISO), Information Systems Security Officers (ISSOs), system owners, data custodians, users, and various specific offices and agencies have specific duties that must be fulfilled to ensure the ongoing security of FDA information systems. To accomplish this, the assigned duties of the involved persons and offices must include the responsibilities as assigned in this policy.

4. RESPONSIBLITIES

The roles and responsibilities described in the paragraphs below are assigned to the offices and positions identified to ensure effective implementation and management of FDA's IT Security Program. The establishment of a security management structure and the assignment of security responsibilities is a requirement by Title III of Public Law 107-347, the Federal Information Security Management Act of 2002 (FISMA), and OMB Circular A-130, Management of Federal Information Resources.

a) Chief Information Officer (CIO). The CIO has the overall responsibility for management of the Agency IT security program. The CIO is the senior management official with the responsibility to evaluate the overall mission requirements for an IT system or application. In all instances, all decisions made by the CIO must be in full compliance with FDA IT security policies, guidelines, and standards. Responsibilities include:

(1) Ensuring effective implementation of FDA IT Security Policy.

(2) Appointing a Chief Information Security Officer (CISO) in writing, maintaining a record of this appointment, and ensuring compliance with FDA IT security regulations and guidelines.

(3) Ensuring IT Security is included in management planning, programming budgets, and the IT Capital Planning process.

(4) Ensuring annual security reviews, to include the annual review and update of security policies, and reporting to OMB of all IT Systems.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

b) FDA Chief Information Security Officer (CISO). The FDA CISO, appointed by the CIO, serves as the Agency focal point to direct and oversee the IT security program within the Agency. The FDA CISO is responsible to the CIO for ensuring that IT security is implemented on the systems assigned to the CISO. The CISO is the focal point for all IT system security matters for the systems under their authority. Responsibilities include or delegation of the following:

(1) Prepare and distribute FDA policies, standards, and guidelines as necessary to implement the FDA IT Security Program, and monitor their implementation.

(2) Establish a security awareness and training program, including tracking the funds expended, the courses taken, and the personnel who received the training and their positions.

(3) Review FDA business cases, contracts, and budget submissions to ensure that IT security requirements are addressed and adequately resourced.

(4) Prepare and submit a written report to the CIO for all technical security exceptions.

The report shall outline the risks and vulnerabilities and/or advantages that could result from granting the exception or from implementing any alternatives.

(5) Providing guidance to the Information Systems Security Officers (ISSOs) in the Center/Office which they support.

(6) Ensuring accreditation support documentation is developed and maintained for each major application (MA) and general support system (GSS).

(7) Reviewing and coordinating reporting of security advisory alerts, compliance reviews, security training, incident reports, and other IT security program issues.

(8) Ensuring that a risk analysis is conducted at least every three (3) years or when a major change occurs for IT systems processing sensitive information.

(9) Providing day-to-day management of the FDA IT Security IT Security Program.

(10) Ensuring the successful implementation of security controls to satisfy FDA security policies.

(11) Serving as the focal point for FDA security coordination. Making policy and procedural recommendations as required to the FDA CIO.

(12) Assisting with policy interpretations.

(13) Performing other security-related duties as directed by the FDA CIO.

(14) Conducting annual security review and reporting to CIO on status of security controls in all IT systems.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

(15) Lead for Incident Response and Computer Incident Team (CIRT).

c) Management Role.

(1) Managers are responsible for implementing information system controls in a manner that is consistent with generally accepted business practices, approved policies, standard procedures and applicable regulations. Managers are responsible for implementing these controls in a fashion that is consistent with the criticality, value, and sensitivity of the information being handled.

(2) Managers are responsible for ensuring adequate resources are allocated for the mitigation of all unacceptable information security risks and to properly resource information security to ensure compliance with regulation and policy.

(3) Managers are responsible for noting variances from generally accepted information system control practices, published agency policies and standards, and also for promptly initiating corrective action.

(4) Managers must specifically assign responsibility for the control measures protecting every major information asset.

(5) Managers will ensure that security safeguards and management controls are maintained during changes in organizational structure. Reorganization transition plans will provide for the transfer of security roles and responsibilities from the old to the new without loss of control or lapses in management oversight.

(6) Managers will notify applicable ISSOs when a user undergoes disciplinary actions that may warrant a change in the user’s security clearance and/or a review of the user’s system access.

(7) If there are several potential information owners, higher-level management must assign ownership responsibility to the single individual who makes the greatest use of the information. An information owner's responsibility for the specification of appropriate information controls may not be delegated to contractors.

d) IT Directors. The designated senior IT Directors serve as the central focus for all aspects of the security program within a particular IT office. The responsibilities include:

(1) IT Directors are responsible for advising the CIO and Center/Office management on all security issues relating to each Center/Office, and ensuring that all security requirements are met.

(2) IT Directors will appoint a system specific security officer for each system under their purview.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

(3) The IT Directors shall also appoint an Information Systems Security Officer (ISSO), and give this person sufficient training, supporting materials, and other resources to properly perform the job.

e) Information Systems Security Officers (ISSOs). The ISSO is the focal point for ensuring implementation of adequate system security in each system supporting a particular Center/Office. Every Center/Office system, including networks, regardless of physical location, will have an ISSO assigned as the point-of-contact for security. The responsibilities include:

(1) Ensuring the system is operated, used, maintained and disposed of in accordance with internal security policies and procedures.

(2) Advising Program Managers/Project Managers/Owners of risks to their systems and obtaining assistance from the CISO, if necessary, in assessing risk.

(3) Ensuring the system security plan (SSP) is completed and maintained.

(4) Assist with accrediting the system by generating and maintaining accreditation documentation.

(5) Ensuring users have the required authorization and need-to-know, and are familiar with internal security practices before access is granted to the system.

(6) Reviewing proposals for access by contractors and third parties.

(7) Promoting information security awareness and ensuring that all Center staff completes all required security training.

(8) Responding to and reporting security incidents.

(9) Reviewing Security Advisory Alerts on vulnerabilities.

(10) Ensuring media handling procedures are followed.

(11) Reviewing system security audit trails and system security documentation to ensure security measures are implemented effectively.

(12) Evaluating known vulnerabilities to ascertain if additional safeguards are needed;

ensuring system patches are kept current and security hardening procedures are used.

(13) Beginning protective or corrective measures if a security breach occurs.

(14) Ensuring effective contingency plans are developed and maintained for their systems.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

(15) Managing and providing oversight of the POA&M process for systems in the centers they support.

(16) Working in conjunction with appropriate management, the CISO and the ISSOs supporting the Center/Office are responsible for annually preparing plans for the improvement of information security on all major FDA information systems.

(17) The CISO and supporting ISSO will establish incident response teams for identifying, reporting, documenting, and resolving incidents (e.g., breaches) of IT security. These teams may include (but are not limited to) representatives of the system users as well as hardware, software and communications-oriented technical personnel.

f) Supervisor. Supervisors are responsible for ensuring that their users are aware of all the security requirements of the IT resources they use and of the potential consequences if policies are either violated or otherwise not complied with. Working in conjunction with the supporting ISSO, supervisors are responsible for insuring that all users complete the security awareness training by the assigned deadline.

g) Owner, Custodian, and User Responsibilities. Responsibility for information security on a day-to-day basis is every user's duty. Specific responsibility for information security is NOT solely vested in any ISSO. Specific information security responsibilities must be incorporated into all user job descriptions. Compliance with information security policies and procedures must be considered in all employee performance evaluations.

(1) All users of FDA IT systems must be subject to the same information security requirements.

(2) All information possessed by or used by a particular organizational unit must have a designated owner. Owners must determine appropriate sensitivity designations as well as criticality ratings. Owners must make decisions about who will be permitted to access the information, and the uses to which this information will be put. Owners must take steps to ensure that appropriate controls are utilized in the storage, handling, distribution, and regular usage of information.

(3) System owners must establish personnel controls such as least privilege, separation of duties and individual accountability on the systems under their control.

(4) Access to FDA information must always be authorized by the designated business owner of such information and must be granted on a need-to-know basis.

(5) Each major type of information must have a designated custodian. Information custodians are responsible for defining specific control procedures, administering information access controls, implementing and maintaining cost-effective information control measures, and providing recovery capabilities consistent with the instructions of information owners.

(6) All users of FDA information must comply with the control requirements specified by the information's owner and/or custodian.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

(7) Every FDA multi-user computer system must have a designated security administrator responsible for the security of the system commensurate with the system security categorization. This security administrator must also have a designated and trained backup employee who can fill-in when necessary.

5. EFFECTIVE DATE

The effective date of this guide is January 16, 2007. This guide supersedes SMG 3250.2, "Responsibility for Information Security".

6. DOCUMENT HISTORY

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

SMG 3251.1, Responsibility for Information Security

STATUS

(I, R, C)

DATE

APPROVED

LOCATION

OF CHANGE

HISTORY CONTACT APPROVING

OFFICIAL

Revised 01/16/2007 n/a Office of the Chief Information Officer

(HFA-80)

E. Glenn Rogers, Deputy Chief

Information Officer, OCIO

Change 04/05/2007 Sect.Heading 4, a), (4)

Office of the Chief Information Officer

(HFA-80)

E. Glenn Rogers, Deputy Chief

Information Officer, OCIO

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

STAFF MANUAL GUIDE 3251.2

GENERAL ADMINISTRATION

EFFECTIVE DATE: 01/16/2007

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

FOOD AND DRUG ADMINISTRATION

INFORMATION RESOURCES MANAGEMENT - INFORMATION

TECHNOLOGY SECURITY

MANAGEMENT CONTROL POLICIES

DISCIPLINE AND TERMINATION

1. Purpose

2. Background

3. Policy

4. Responsibilities

5. Effective Date

6. Document History

Attachment A - References Attachment B - Terms and Definitions

1. PURPOSE

The purpose of this section is to outline the overall Agency-wide policy for security-related human resources matters concerning the discipline and termination of personnel. The section describes the general requirements for discipline and termination policies to meet the basic goal of protecting Food and Drug Administration (FDA) information systems and data;

assuring operational continuity, integrity, availability, and confidentiality of automated information; reducing Information Technology (IT) security risk; and, complying with applicable rules and regulations. The policy also outlines the responsibilities of key personnel in support of these requirements.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

The knowledge that disciplinary measures are available and will be used, up to and including involuntary termination of employment, can serve as a significant deterrent to violations of security. If they are not effective against a given individual, their impartial and vigorous enforcement may yet serve as a deterrent to others. In accordance with Federal mandates (see References), the Agency is required to provide "adequate security" to manage potential risk to its automated information. Adequate security includes providing means to discipline and terminate violators of security policy and procedures. These, in turn, help to reduce the risk of loss, misuse, or unauthorized access to information, which could adversely affect the ability of FDA to accomplish its mission.

3. POLICY

It is the policy of FDA to impose disciplinary actions for violations of or non-compliance with system security policies. Disciplinary action may include demotion, suspension, and termination of employment. Upon termination for any reason, all access to FDA data and systems will be revoked. Disciplinary actions are the responsibility of FDA management. The Information Systems Security Officer’s (ISSO) role in disciplinary action is to advise on matters of policy and respond to management requests for information. Each Center/Office must assure that all personnel are aware of the following policies:

a) Management will notify the supporting ISSO when users of systems under their control become the subject of disciplinary action. The supporting ISSO will, in coordination with the user's supervisor, determine what action regarding access and privileges is appropriate to ensure the protection of FDA information assets and will take action accordingly.

b) At the request of appropriate management, Labor Relations, or the Office of the Inspector General or at the discretion of the FDA Chief Information Security Officer (CISO), users against whom disciplinary action is being taken can be subject to more frequent and detailed monitoring of computer access and activity.

c) Upon termination of employment, users must not retain, give away or remove from FDA premises any non-public FDA data and information. All other FDA information in the custody of the departing user must be provided to the user's immediate supervisor at the time of departure.

d) Upon termination or expiration of their contract, all contractors, consultants, temporaries, and third parties, must hand over to their FDA project manager all copies of FDA information received or created during the performance of the contract unless other provisions have been made regarding the information.

e) At the time that every user terminates his or her relationship with FDA, all FDA property must be returned.

f) In the event that a user is terminating his or her relationship with FDA, the user's immediate manager is responsible for:

(1) Ensuring all property in the custody of the user is returned before the user leaves

FDA,

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

(2) Immediately notifying the supporting ISSO, who will in turn immediately notify all administrators handling the computer and communications accounts used by the user, and

(3) Terminating all other work-related privileges of the user at the time that the termination takes place.

g) Former users, consultants, contractors, and third parties who were involuntarily terminated must not be re-hired or retained without the written permission of a senior manager.

h) Extended investigations of security violations will be conducted in accordance with Employee and Labor Relations guidance and procedures.

4. RESPONSIBILITIES

a) Chief Information Officer (CIO). The CIO has the overall responsibility for management of the Agency IT security program. The CIO is responsible for ensuring that disciplinary and terminations policies are created and enforced.

b) FDA Chief Information Security Officer (CISO). Responsibilities include the creation of procedures, standards, and guidance for the recovery of sensitive information and property from individuals leaving FDA employment and for the expeditious revocation of system access for such persons.

c) Contracting Officers (COs). COs and specialists will ensure that appropriate language is incorporated into Statements of Work (SOW), performance standards, and other applicable documents informing contractors of FDA policy regarding discipline and/or termination of personnel for security violations. Contractors who were involuntarily terminated will not be re-hired without the written permission of a senior manager.

d) Human Resources Personnel. Human resources personnel will ensure that all new FDA users are specifically informed regarding discipline and/or termination policies relating to security violations.

e) Center/Office IT Directors. The designated IT Directors serve as the central focus for all aspects of the security program within a Center/Office. The IT Director is responsible for advising the Center/Office Director, the project manager, and others regarding security incidents which may be grounds for disciplinary action.

f) Information Systems Security Officers (ISSOs). Supporting ISSOs will cause to be investigated known or suspected cases of unauthorized actions, improper procedures, and any related policy violation. Responsibilities include the creation of procedures, standards, and guidance for the recovery of sensitive information and property from individuals leaving FDA employment and for the expeditious revocation of system access for such persons.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

g) System-Specific Security Managers. System-specific security managers will ensure that access to their systems is revoked for persons leaving FDA employment and will implement procedures to recover FDA property and information as appropriate.

h) Supervisors. Supervisors are responsible for ensuring that their users are aware of all the security requirements of the IT resources they use and of the potential consequences if policies are either violated or otherwise not complied with. In particular, supervisors will ensure that users are aware of the discipline and termination policies and procedures within the FDA. Supervisors will ensure changes that might affect an employee’s eligibility to maintain a sensitive position are properly acted upon and will support efforts to recover FDA information and property from departing users.

i) Users. Users of automated information systems are responsible for complying with all security requirements pertaining to data they use and are accountable for all activity performed under their User ID/password. Users will promptly report status changes, including convictions for job-related crimes and outside business activities, to their supervisor. Users will cooperate with requests to return FDA property and information, and will refrain from using, or attempting to use FDA information systems. Users are required to act ethically at all times, take initiative, and accept responsibility for safeguarding information resources under their control, whether that control is official or de facto.

5. EFFECTIVE DATE

The effective date of this guide is January 16, 2007. This guide supersedes SMG 3250.3 "Human Resource Matters - Discipline and Termination".

6. Document History

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

SMG 3251.2, Discipline and Termination

STATUS

(I, R, C)

DATE

APPROVED

LOCATION

OF CHANGE

HISTORY CONTACT APPROVING

OFFICIAL

Revised 01/16/2007 n/a Office of the Chief Information Officer

(HFA-80)

E. Glenn Rogers, Deputy Chief

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

STAFF MANUAL GUIDE 3251.3

GENERAL ADMINISTRATION

EFFECTIVE DATE: 01/16/2007

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

FOOD AND DRUG ADMINISTRATION

INFORMATION RESOURCES MANAGEMENT - INFORMATION

TECHNOLOGY SECURITY

MANAGEMENT CONTROL POLICIES

SECURITY AWARENESS AND TRAINING

1. Purpose

2. Background

3. Policy

4. Responsibilities

5. Effective Date

6. Document History

Attachment A - References Attachment B - Terms and Definitions

1. PURPOSE

The purpose of this section is to outline the overall Agency-wide policy for security-related human resources matters concerning the discipline and termination of personnel. The section describes the general requirements for discipline and termination policies to meet the basic goal of protecting Food and Drug Administration (FDA) information systems and data;

assuring operational continuity, integrity, availability, and confidentiality of automated information; reducing Information Technology (IT) security risk; and, complying with applicable rules and regulations. The policy also outlines the responsibilities of key personnel in support of these requirements.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

The extent to which information system security functions and features can be made transparent to the user is limited. Some activities require the user to make conscious, informed decisions regarding security actions. FDA system security can be compromised when operated by an untrained user or by one unaware of the implications of their actions. In accordance with Federal mandates (see References), the FDA is required to provide "adequate security" to manage potential risks to its automated information. Security training is an essential component of risk management, as is an awareness of FDA security policies and standards.

Failure to provide training or to ensure IT user awareness could adversely affect the ability of FDA to accomplish its mission resulting from the loss, misuse, or unauthorized access to information. These policies identify specific IT security requirements which, when met, assure that training is adequate to eliminate or reduce risks to an acceptable level. Beyond a certain point, further risk reduction is not cost effective and the residual may be accepted as a normal part of doing business.

3. POLICY

It is the policy of FDA to provide security training before a user is granted access to a system.

The FDA must provide annual security awareness to users and must ensure that security policies and procedures are followed in the normal course of doing business. This training requirement applies to all FDA IT users. The Agency must assure that its security training efforts meet the IT security goals by compliance with the following requirements:

a) Every FDA user must attend an initial security awareness briefing prior to gaining initial access to FDA information systems.

b) All users of FDA automated information systems must complete the general FDA information security awareness course within 30 days of initial employment, and annually thereafter, including acknowledgement and acceptance of the end user responsibilities.

Failure to accept these responsibilities shall result in loss of computing access and/or privileges.

c) All users of FDA information systems will receive security awareness and training that is commensurate with the individual’s duties and responsibilities.

d) FDA users with significant security responsibilities must participate in specialized security training appropriate to their security role.

e) FDA users must not use any FDA-custom or special purpose software for mission critical business processes unless they have first completed approved training for such software.

4. RESPONSIBILITIES

a) Chief Information Officer (CIO). The CIO has the overall responsibility for management of the Agency IT security program. The CIO is responsible for ensuring that an IT security training program is instituted and that a security awareness program is developed.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

b) FDA Chief Information Security Officer (CISO). The FDA CISO responsibilities include, developing standards and guidance for the conduct of information system security training.

c) Center/Office IT Directors. Designated officials serve as the central focus for all aspects of the security program within a Center/Office. IT directors are responsible for advising the Center/Office Director, the project manager, and others on all security training and awareness-related issues within their organization. IT directors will support the FDA information system security awareness program developed by the Office of the Chief Information Officer (OCIO).

d) Information Systems Security Officers (ISSOs). The supporting ISSO’s are responsible for: overseeing compliance with Agency-provided user awareness training requirements, notifying users of this training, establishing Center-wide deadlines, notifying management and disabling network access for those who do not complete the training by the Center ISSO’s announced deadline, assisting users with questions related to the training, insuring that new users complete the training within 30 days of their arrival.

e) Supervisors. Supervisors are responsible for ensuring that their users receive necessary training to perform their jobs including security training, and that they complete the Agency-provided annual user awareness training by the stated deadline. Supervisors will also support the FDA security awareness program to ensure that all users are aware of all the security requirements of the IT resources they use. In particular, supervisors will ensure that users are aware of the requirement to receive security training prior to system use. Supervisors will also ensure that users are aware of the potential for severe negative effects which could result from failure to follow established procedures.

f) Users. Users are required to complete the Agency-provided user awareness training annually by the stated deadline. Users will attend system security training as required and will report any problems, errors, or omissions in the training received.

5. EFFECTIVE DATE

The effective date of this guide is January 16, 2007. This guide supersedes SMG 3250.24, "Administrative Security - Training and Awareness".

6. Document History

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

SMG 3251.3, Security Awareness and Training

STATUS

(I, R, C)

DATE

APPROVED

LOCATION

OF CHANGE

HISTORY CONTACT APPROVING

OFFICIAL

Revised 01/16/2007 n/a Office of the Chief Information Officer

(HFA-80)

E. Glenn Rogers, Deputy Chief

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

STAFF MANUAL GUIDE 3251.4

GENERAL ADMINISTRATION

EFFECTIVE DATE: 01/16/2007

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

FOOD AND DRUG ADMINISTRATION

INFORMATION RESOURCES MANAGEMENT - INFORMATION

TECHNOLOGY SECURITY

MANAGEMENT CONTROL POLICIES

OUTSOURCING

1. Purpose

2. Background

3. Policy

4. Responsibilities

5. Effective Date

6. Document History

Attachment A - References Attachment B - Terms and Definitions

1. PURPOSE

The purpose of this document is to outline the overall Agency-wide policy regarding the security aspects of outsourcing and third party contracts. The policy describes the general requirements for outsourcing and third-party contracts needed to meet the basic goals of protecting Food and Drug Administration (FDA) automated information; assuring operational continuity, integrity, availability, and confidentiality of automated information; reducing Information Technology (IT) security risk; and, complying with applicable security-related rules and regulations. The policy also outlines the responsibilities of key personnel in support of such requirements.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

From time to time, the FDA may perform portions of its information systems operations and management operations through outsourcing. This policy imposes certain requirements on those contracts specifically to meet FDA security needs. In accordance with Federal mandates (see References), the Agency is required to provide "adequate security" to manage potential risk to its automated information. Adequate security includes the imposition of requirements, which ensure that outsourced contractors comply with FDA standards regarding the handling of sensitive data. This allows the FDA to compel outsourcers to control the risk and magnitude of the harm that security incidents can cause and which could adversely affect the ability of the FDA to accomplish its mission.

3. POLICY

It is the policy of FDA to include definitive provisions for handling of FDA data in any outsourcing (third party) contract. It is further FDA policy that all contracts will provide for termination at no expense to the government in the event of security violations. Each Center/Office must assure that its outsourcing or third-party contracts meet FDA security goals by compliance with the following requirements:

a) If procurement of software is being considered, management must obtain a written integrity statement from the involved vendor, or conduct testing/monitoring on the software to verify its integrity. This statement must provide assurances that the software in question does not contain any hidden mechanisms and will not require the modification of controls found in the platform and environment under which it runs.

All software written for the FDA or any of its subordinate offices, organizations, or divisions, becomes property of the FDA.

b) Outsourcing:

(1) All agreements dealing with the handling of FDA information by contractors must include a special clause that allows FDA to audit the controls used for these information-handling activities, and to specify the ways in which FDA information will be protected.

(2) Before any outsourced users are permitted to reach FDA systems via real-time computer connections, specific written approval of the supporting Information Systems Security Officer (ISSO) is required. All real-time connections by outsourced personnel must abide by appropriate FDA remote access policies. An exception to this policy is access to public sources of FDA information such as web sites and Internet pages.

Center/Office ISSOs must coordinate all outsourced real-time connections with the Office of Information Technology Shared Services (OITSS) prior to approval and establishment to ensure proper support is available for the connection.

(3) All information-systems-related outsourcing contracts must be reviewed and approved by the originating Center/Office ISSO. It is this officer's responsibility to make sure that these contracts sufficiently define information security responsibilities, as well as how to respond to a variety of potential security problems. The use of foreign vendors will only be used when necessary and the Center/Office ISSO will confer with

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only necessary agencies, such as the U.S State Department, to confirm the interest of the vendor is aligned with the interest of the FDA. It is also this officer's responsibility to make sure that all such contracts allow FDA to terminate the contract for cause if it can be shown that the outsourcing firm does not abide by the information security terms of the contract. Such terminations for cause shall be at no expense to the government. The Center/Office ISSO will verify the correct contractual security information is included and sign off on the appropriate contract approval form.

4. RESPONSIBILITIES

a) Chief Information Officer (CIO). The CIO has the overall responsibility for management of the Agency IT security program, including the security aspects of outsourcing. The CIO is responsible for ensuring that suitable and appropriate provisions are included in contracts as necessary to ensure the protection of FDA sensitive data and that appropriate remedies are provisioned in the event of a security violation.

b) FDA Chief Information Security Officer (CISO). The FDA CISO, appointed by the CIO, serves as the Agency focal point to direct and oversee the IT security program within the Agency, including the security of outsourcing and third-party contracts. Responsibilities include reviewing all outsourcing and third-party contracts to ensure that appropriate language is used, and giving advice and assistance to Agency managers and other organizational personnel concerning such contracts and provisions. The FDA CISO will review and validate contracts for proper application of this policy.

c) Contracting Officers (COs). COs and specialists will ensure that appropriate definitive provisions for handling of FDA data are incorporated into Statements of Work (SOW), performance standards, and other applicable portions of outsourcing and third-party contracts.

COs will provide for penalties up to and including termination at no expense to the government in the event of security violations or other failures to comply with FDA security requirements commensurate with the criticality of the system involved. COs will ensure the appropriate supporting ISSO signs off on the contract approval showing validation of security contractual information.

d) Information Systems Security Officers (ISSOs). Supporting ISSOs serve as the focal point to direct and oversee the security aspects of outsourced operations and third-party contract activities within the Center/Office. Responsibilities include providing technical guidance and support to Center/Office staff on issues relating to the security aspects of outsourcing and third-party contracts. They will also conduct periodic reviews to ensure compliance with applicable policies and will report on the effectiveness of these policies to appropriate management. The supporting ISSO will review and validate contracts for the proper application of this policy.

e) System-Specific Security Managers. System-specific security managers will ensure that suitable and appropriate provisions relating to system security are written into all third-party and outsourcing contracts relative to their systems. They will also ensure that such provisions are fully and properly implemented as necessary.

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

f) System Development Project Managers. The individual tasked as project manager (PM) for a specific system development effort must be aware of and comply with third-party and outsourcing contract policies and procedures. They will monitor the performance of all contracts within the scope of their projects to ensure full compliance or to initiate remedial/punitive action.

5. EFFECTIVE DATE

The effective date of this guide is January 16, 2007. This guide supersedes SMG 3250.27, "Administrative Security - Outsourcing and Third-party Contracts".

6. Document History

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

SMG 3251.4, Outsourcing

STATUS

(I, R, C)

DATE

APPROVED

LOCATION

OF CHANGE

HISTORY CONTACT APPROVING

OFFICIAL

Revised 01/16/2007 n/a Office of the Chief Information Officer

(HFA-80)

E. Glenn Rogers, Deputy Chief

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only

STAFF MANUAL GUIDE 3251.5

GENERAL ADMINISTRATION

EFFECTIVE DATE: 01/16/2007

CAUTION: This Staff Manual Guide is not releasable to the general public. For further guidance, please contact the FDA Division of Freedom of Information.

FOOD AND DRUG ADMINISTRATION

INFORMATION RESOURCES MANAGEMENT - INFORMATION

TECHNOLOGY SECURITY

MANAGEMENT CONTROL POLICIES

CERTIFICATION AND ACCREDITATION

1. Purpose

2. Background

3. Policy

4. Responsibilities

5. Effective Date

6. Document History

Attachment A - References Attachment B - Terms and Definitions

1. PURPOSE

The purpose of this document is to outline the overall Agency-wide policy for Information Technology (IT) Certification and Accreditation (C&A) policy. C&A refers to the process that demonstrates and documents that an Information Technology (IT) system meets its established security requirements and that its security safeguards are adequate and appropriate and are commensurate with the protection needs of the system.

2. BACKGROUND

OMB Circular A-130, Appendix III, Security of Federal Automated Information Reserves, requires Federal departments and agencies to certify and accredit systems. The primary reason for requiring these periodic assessments is to ensure that the government official responsible

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only for the system has guaranteed that security controls are commensurate with the risk and magnitude of potential harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information contained in the system.

3. POLICY

It is the policy of FDA to perform, and maintain, full Certification and Accreditation (C&A) for all systems in the FDA IT system inventory consistent with current OMB and NIST guidelines.

a) Accreditation is required for all FDA IT systems in order to allow senior management to decide on authorization for an IT system to process or operate in its environment.

b) New IT systems or those not fully operational shall complete all requirements for C&A and be fully accredited prior to implementation.

c) Re-accreditation is required for all FDA IT systems at least every three years or when a significant change to the system configuration occurs.

The following criteria are established to define a significant change to an FDA information system:

• A breach of security, violation of system integrity, or any unusual situation that appears to invalidate the current status;

• A change in the information, security mode of operation, or its value;

• A change in the technology used;

• A change to the threats or vulnerabilities, which significantly impact the assessed risk to the system;

• A change to available and/or appropriate safeguards;

• A change in the user profiles or population;

• A change in the potential loss of the system;

• A change to the organization/enterprise, or to the ownership of the system;

• A change to the physical structure or location that houses the system that could affect the physical security of the system;

• Three years since last assessment or plan update.

4. RESPONSIBILITIES

a) Chief Information Officer (CIO).The CIO has the overall responsibility for management of the Agency IT Certification and Accreditation (C&A) program. The CIO is responsible for assuring that an IT C&A program is developed, implemented, and maintained, and that policies and procedures are in place to support the program.

b) Designated Approving Authority (DAA). The DAA is the primary government official responsible for allocating resources. The DAA is a senior government executive with the authority to oversee and influence the budget and business operations of the systems under its

This document contains information about FDA IT Security Policy and is being provided to support FDA’s

For Official Use Only jurisdiction. Through security accreditation, the DAA assumes responsibility and is accountable for the risks of operating the information system in a specific environment.

c) Certification Agent (CA). The CA is the individual responsible for conducting a comprehensive evaluation of the management, operational, and technical security controls in an information system to determine: (i) the effectiveness of the controls in a particular environment of operation; and (ii) the remaining vulnerabilities in the system after the implementation of such controls.

d) FDA Chief Information Security Officer (CISO). The FDA CISO will be responsible for the IT security program within the FDA. The FDA CISO will oversee the FDA C&A program.

e) Information Systems Security Officers (ISSOs). The supporting ISSO will be responsible for the IT security program within their Center/Office. The supporting ISSO will monitor and report on the Center/Office implementation of, and compliance with, the FDA C&A program.

f) Center/Office IT Director. The Center/Office IT Director has the overall responsibility for management of the Certification and Accreditation (C&A) process within a Center/Office.

The IT Director is responsible for assuring that all systems under their responsibility achieve and maintain a valid C&A in accordance with this policy.

g) Project Manager (PM)/System Owner (SO). The PM (may also be known as the Project Officer), is the individual responsible for coordinating all steps of the system’s life cycle, from design through implementation and maintenance. Throughout the C&A process, the PM will coordinate with the other key players, reviewing information and providing input to ensure that the C&A process is maintained and updated with the most accurate information throughout the system’s life cycle. PM’s are responsible for ensuring that adequate and appropriate levels of protection, that comply with the FDA IT security program are implemented for their individual IT systems.

h) User Representative. The User Representative is an individual who has intimate knowledge of the system’s purpose and goals and, therefore, provides valuable input to the C&A process.