Att 1a Appendix B to DMCA Final Enterprise Standards.pdf

ENTERPRISE

INFORMATION

SECURITY STANDARDS

Commonwealth of Massachusetts Executive Office of Health and Human Services

I. CONTENTS

II. PURPOSE AND INTRODUCTION

III. REQUESTS FOR NON-CONFORMANCE

IV. SECURITY PLANNING

V. ACCEPTABLE USE AND INFORMATION SECURITY TRAINING

VI. ACCESS CONTROL

VII. AUDIT AND ACCOUNTABILITY

VIII. INVENTORY AND CLASSIFICATION

IX. ASSESSMENT AND MONITORING

X. AUTHORIZATION TO OPERATE AND OPERATIONAL RISK ASSESSMENT

XI. INCIDENT RESPONSE AND SECURITY INCIDENT RESPONSE TEAM

XII. CONTINGENCY PLANNING

XIII. CONFIGURATION MANAGEMENT

XIV. IDENTITY AND AUTHENTICATION

XV. MEDIA PROTECTION

XVI. SYSTEM AND COMMUNICATIONS

XVII. PHYSICAL AND ENVIRONMENTAL PROTECTIONS

XVIII. PERSONNEL SECURITY

XIX. SYSTEM AND SERVICES ACQUISITION

XX. SYSTEM AND INFORMATION INTEGRITY

XXI. DEFINITIONS

II. PURPOSE AND INTRODUCTION

The EOHHS Information Security Office’s mission is to safeguard EOHHS’s and its Agencies’ collective data in any form and prevent the inappropriate use, exfiltration, or manipulation of that data. The Security Office works constantly to maximize preservation of the confidentiality, availability, and integrity of EOHHS data through the promulgation, implementation, and enforcement of administrative, physical, and technical safeguards.

This document outlines the specific ways such data should be preserved. It provides the bare minimum standards that apply to all Information Resources in the EOHHS Environment and within third party environments contracted for by EOHHS or which use, process, or maintain EOHHS data. These have been drafted with an eye towards:

• Federal and State legal requirements

• Specific data source contractual requirements

• Commonwealth enterprise policies and standards (available at:

https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards)

• Extant good practice at Agencies and within Information Systems

• Other factors as appropriate

The need for this broadly applicable set of standards is clear when looking at the EOHHS Environment in its entirety.

Table 1: Graphical Representation of EOHHS Environment

As illustrated in Table 1, all Information Systems in the EOHHS Environment are connected, either directly or through other Information Systems which share data downstream. Few systems in the EOHHS Environment are truly independent of that environment. To the extent those applications are used to support Agency operations alongside other applications and their data can impact Agency operations, they are not independent.

Additionally, very little—if any—physically held data (e.g.: paper documents, filing cabinets holding documents, etc.) maintained in the EOHHS Environment exists independently of EOHHS’s Information Systems. Those physical data stores either come from Information Systems or are used to populate https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards information into Information Systems. As such, all physical instances of data—or physical instances of information— maintained in the EOHHS Environment or by a third party fall within the purview of these Information Security standards.

Because of the extreme interconnectedness of all data held (in any form) at EOHHS, and to promote the common security of data shared among the EOHHS enterprise, these common controls are designed to protect all data with the same high standards no matter where it is used, processed, or maintained within the EOHHS Environment. However, due to the state of standardization across EOHHS, not all applications existing or in development can strictly adhere to this Enterprise Information Security Standards (also referred to as “Document”). The Security Office strongly recommends that all Information Systems strive to achieve compliance with this Document, however any gaps will be identified and tracked through gap assessments being conducted of the EOHHS Environment. EOHHS and Agency process must be updated to achieve compliance with applicable standards within twenty-four (24) months from publication of this Document. Compliance timelines have been included with each standard. Achieving compliance may be completed by implementing a corrective action plan with additional reasonable timelines for conformance—supported by business necessity and technical requirements—outlining why compliance cannot be attained within the timelines outlined in this Document. Such corrective action plans must follow the guidelines outlined in Section III, Requests for Non-Conformance. Additionally, all applications procured or developed after the publication date of version 1.0 of this Document must be developed in conformance with these requirements.

Additionally, EOHHS is bound by state and federal laws, contracts, and processes to comply with various notification procedures in the event of a loss of data, an impact of service, or a data breach, whether it happens at EOHHS or with one of its third party vendors, providers or other teaming partners. EOHHS will also face associated negative press, fines, and other penalties associated with loss of confidentiality, integrity, or availability of the data. As such, these standards also act as a guideline with regard to the security requirements EOHHS must push down to any third party vendor.

The Security Office has been tasked with preserving the confidentiality, integrity, and availability of all EOHHS Information Resources. As such, this Document outlines the minimum acceptable requirements at EOHHS for the information security controls outlined herein. Agencies may develop their own documentation to supplement and exceed these requirements, which are generic for the EOHHS Environment at large, and are encouraged to do so. Agencies may not undertake any action or promulgate documentation to supplant or undermine the controls or activities described in this Document, whether specifically identified as intended to do so or not.

These Enterprise Information Security Standards supersede all EOHHS and/or Agency documentation existing before the publication date of this Document which also covers the same subject matter as these standards or any portion thereof. No other EOHHS or Agency documentation covering the same subject matter as these Enterprise Information Security Standards, unless as expressly required to be developed by these Enterprise Information Security Standards, shall be effective without the review and approval of the EOHHS Security Office.

The consequences for violating these Enterprise Information Security Standards are serious. By violating this policy, you create an immediate and automatic audit finding for your Agency. These Audit findings could result in significant negative press for your Agency, additional oversight and reporting requirements, and fines. In addition, depending on the objectives violated and the method of violation, you may be subject to discipline including termination of employment, civil penalties including monetary fines, and criminal penalties including jail time. Conformance to these policies will be actively monitored on an ongoing basis and violations will be reported to Agency and Secretariat executive staff.

III. REQUESTS FOR NON-CONFORMANCE

Any non-conformance to these standards could have dire and unintended impacts to other Information Resources or Information Systems in the EOHHS Environment. Additionally, the failure to appropriately record non-conformance to standards and any activities undertaken to minimize the impact to EOHHS’s security posture could result in audit findings, fines, and other penalties. Given the nature of these controls and the interconnectedness of the EOHHS Environment, no individual Agency group is appropriately equipped to approve non-conformance to these standards. The process outlined in this section will detail how a request for non-conformance should be made and processed. For promotion of vulnerabilities from a lower to a production environment, or for risk acceptance of ongoing vulnerabilities, see the Authorization to Operate and Operational Risk Assessment Policy and Process.

a. All requests for non-conformance should be submitted to the EOHHS Security Office mailbox at: EOHHS-SecurityOffice@MassMail.State.MA.US. All requests must include “Request for Non-Conformance” in the title and the application/program name for which a request for non-conformance is sought.

The body of the email should describe:

i. the request being made,

ii. the justification,

iii. any compensating controls put in place to address the security gap (or a reason why there is no security gap)

iv. timelines to address the security gap

v. the name, title, and contact information of the individual responsible for the request

b. The request will be evaluated by the Security Office, which may seek additional information from the requester, members of EOHHS and/or impacted Agency legal teams, impacted Agency operations, and the EOHHS SCIO and/or impacted ACIOs. Response times may vary depending on the request, but all requests will be addressed within forty-eight (48) hours of receipt.

c. Once the Security Office has completed its evaluation, it will provide a memorandum to the requester outlining any research performed, recommendations, and agreed-upon timelines during which there will be a security gap.

d. Quarterly, the Security Office will meet with requesters to discuss the status of implementation of compensating controls or closing the security gap. Biennially, the Security Office will circulate the master list of requests for non-conformance to Agency and IT leadership for review and analysis.

mailto:EOHHS-SecurityOffice@MassMail.State.MA.US

IV. SECURITY PLANNING

a. Policy Statement

EOHHS must develop, maintain, and disseminate a security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. Compliance with these standards must be achieved within twenty-four (24) months of publication of this Document.

b. Security Planning Standards

This information security plan outlines the minimum functions necessary to ensure the effective and efficient operations of the Secretariat in a way that maximizes the safety of sensitive information. While many of the organizational roles and responsibilities are outlined herein, not all specific roles and responsibilities are identified. It is the responsibility of application teams and business units to ensure that they appropriately identify critical or material positions within their respective organizations. Information security planning is a comprehensive, organization-wide effort to ensure that information in all forms is protected.

i. Roles and Responsibilities

1. Agency heads and Secretariat Chief Information Officer – these individuals are responsible for business unit and information technology planning and setting priorities for their respective organizations. These individuals are also accountable for the responsible development of programs and systems within their purview. This includes considerations of legal and policy compliance; implementation of industry standard best practices; and ensuring appropriate custodianship of constituent data that protects the confidentiality, integrity, and availability of that data.

2. Agency management teams and Assistant Chief Information Officers – these individuals are responsible for direct oversight, management and implementation of business unit and information technology planning and projects as well as for the development of programs and systems within their purview.

3. Chief Security Officer – this individual is responsible for the creation and verification of standards at EOHHS to support the responsible development of programs and systems at EOHHS.

4. EOHHS Staff – these individuals are responsible for following acceptable rules of behavior, including the EOHHS Acceptable Use Policy. Additionally, these individuals are responsible for ensuring the confidentiality, integrity, and availability of data maintained by EOHHS and its Agencies.

ii. Information Resource Security Plans

All Information Resources and business units must complete a security plan. This security plan must cover, at a minimum, the following topics:

1. How the information resource or business process operates consistently with enterprise architecture or planning;

2. The boundaries of the information resource or business process;

3. How the information resource or business process supports Agency operations and the Agency mission;

4. The security posture, security requirements and risk level of the information resource or business process;

5. Relationships and interconnections between the information resource or business process and other information resources or business processes;

6. Security controls in place based on the NIST 800-53 standards appropriate to that application as expressed by these Enterprise Information Security Standards, security controls not in place, and planned remediation or workarounds (including compensating controls);

7. How the information resource or business process architecture/design protects the confidentiality, integrity, and availability of information; and

8. Any assumptions about internal or external services and their impact to security.

These requirements will be satisfied by compliance with:

• Section VIII, Inventory and Classification,

• Section IX, Assessment and Monitoring,

• The EOHHS IT Control Plan,

• The EOHHS Technology Office Secretariat Application Reference Manual, and

• The Project Integration Process & Controls Guide.

The security plan must be reviewed and updated no less frequently than every three years.1 While the security plan should be communicated to relevant internal and external authorized parties, it should be safeguarded from inappropriate disclosure that would compromise the security of the Information Resource.

iii. Rules of Behavior

The rules of behavior for use of EOHHS information resources is outlined in Section V, Acceptable Use and Information Security Training. Agency management teams and ACIOs are responsible for devising plans to ensure review, attestation, and compliance with the Acceptable Use Policy.

V. ACCEPTABLE USE AND INFORMATION SECURITY TRAINING

a. Purpose and Introduction

The key to ensuring a safe and secure environment is by having a staff that is competent and capable with respect to information security. No matter how secure and airtight an

1 Pursuant to 45 CFR § 95.621, for APD-funded operations and Information Resources, this is every two years.

https://massforge.state.ma.us/sf/sfmain/do/downloadAttachment/projects.cto/wiki/HomePage?id=atch48487 https://massforge.state.ma.us/sf/go/doc86833 organization’s technical environment, if its employees cannot handle information appropriately, each of those employees poses a significant vulnerability to the organization.

This Section V, Acceptable Use and Information Security Training, will offer the requirements for training and provide managers and staff the tools they need to ensure the EOHHS Environment is adequately protected against external and internal threats.

Agencies are encouraged to develop information security training in addition to the requirements outlined in this section. If, at the time of publication of this policy, Agencies have documentation they believe satisfies the requirements herein for acceptable use or information security training, or if the Agency develops any related documentation after the publication of this policy, the Security Office must review and approve of such documentation before implementation.

b. Policy Statement

All EOHHS employees must review and acknowledge the EOHHS Acceptable Use Policy within one (1) month of hire and on an annual basis thereafter, as determined by EOHHS. All EOHHS employees must take EOTSS and EOHHS training within one (1) month of hire and on an annual basis thereafter. If an EOHHS employee has not met these requirements, they shall not be provided access to Information Resources in the EOHHS Environment.

Compliance with these standards must be achieved within twelve (12) months of publication of this Document.

c. Acceptable Use Standards

The EOHHS Acceptable Use Policy details its purpose, requirements and scope. In summary, the Acceptable Use Policy explains the difference between appropriate and inappropriate— or permissible and impermissible—use of Information Resources across EOHHS.

In the event that any staff is found to have violated the Acceptable Use Policy, depending on factors such as the magnitude of the violation(s), the number of violation(s), and the kind of violation(s), those staff may be disciplined. Such discipline may include limitation of or removal of rights to access Information Resources, suspension or termination of employment, or civil and criminal penalties such as fines and incarceration.

The current version of record of the EOHHS Acceptable Use Policy is hosted on PACE and is attached to this document as Attachment 1. Older versions of the EOHHS Acceptable Use Policy may be stored elsewhere but should not be relied upon for compliance purposes.

Agencies may not under any circumstances create documentation to supplant or replace the EOHHS Acceptable Use Policy. Agencies may, however, create documentation that effectively supplements or adds to the EOHHS Acceptable Use Policy based on demonstrated and legitimate Agency need. Agencies are strongly encouraged to do so where the EOHHS Acceptable Use Policy has perceived deficiencies based on the quality or kind of data being handled by the Agency or based on legal compliance. Any supplementary materials, whether or not identified as such, must be reviewed and approved by the Security Office prior to publication and dissemination to staff. Such supplementary materials will be made effective by appending them to the EOHHS Acceptable Use Policy as an exhibit.

d. Information Security Training Standards

All EOHHS staff must review and acknowledge the EOHHS Information Security Training, or an approved alternative, within one (1) month of hire and prior to accessing any Information Resources in the EOHHS Environment and then on an annual basis thereafter as defined by EOHHS. The EOHHS Information Security Training shall consist of two components:

i. Any required EOTSS information security training generally made available to

EOHHS staff, and

ii. Any required EOHHS information security training.

EOHHS has published the EOHHS Information Security Training on PACE. Previous versions of the EOHHS Information Security Training may be stored elsewhere but should not be relied upon for compliance purposes. At a minimum, all staff are required to take that calendar year’s information security training posted to PACE. The Security Office has also developed other information security training for specific types of data that may be required based on job duties and role.

All EOHHS staff must take information security training that covers the following subject matter:

• Definition of sensitive information,

• An explanation of the need to safeguard sensitive information,

• How to protect sensitive information,

• Least access privilege,

• Password requirements,

• Kinds of data breaches and attack vectors,

• Email management,

• Incident reporting, and

• Steps that staff can take to prevent a data breach.

The current EOHHS information security training is deemed to meet the requirements of Executive Order 504 training for EOHHS employees. Additionally, the training is designed to contain information that is intended to meet the training requirements of the HIPAA Security Rule and applicable Third Party Agreements.

Agencies may create documentation that effectively supplants or replaces the EOHHS Information Security Training. Agencies may also create documentation that effectively supplements or adds to the EOHHS Information Security Training. Agencies are strongly encouraged to do so where the EOHHS Information Security Training has perceived deficiencies based on the quality or kind of data being handled by the Agency or based on legal compliance. Any supplanting or supplementary materials, whether or not identified as such, must be reviewed and approved by the Security Office prior to publication and dissemination to staff.

VI. ACCESS CONTROL

Access Control, in the broadest sense, deals with who has access to what and how. The standards outlined in this Access Control section address specific requirements about how permission to view, use, change, or update Information Resources should be granted, modified, and revoked in the EOHHS Environment. For access controls for facilities themselves, please see Section XVII, Physical and Environmental Protections.

Agencies may—and are encouraged to—promulgate desk level procedures and standards to implement the requirements outlined herein for their Information Resources. Agencies may already have access control documentation. This Access Control standard is not intended to supplant those documents. Care should be taken to ensure those standards conform to the requirements expressed herein. Agencies may not implement documentation, standards, or requirements that supplant these Access Control standards or modify, compromise, or circumvent the underlying controls in this document in any way.

While this document is drafted with a focus to managing access to Information Systems, the process outlined herein can—and should—be applied to all EOHHS Information Resources in whatever form and to all processes which utilize such data.

All EOHHS Information Resources must have appropriate access controls in place to prevent unauthorized access. All access to Information Resources must be appropriate based on role, employment status, and business need. All Information Resource Owners must have the ability to control, audit, and terminate access to Information Resources. Compliance with these standards must be achieved within twenty-four (24) months of publication of this Document.

c. Access Control Standards

Every Information Resource must have clearly defined and readily identifiable Owners.

Owners must be capable of independently making material decisions and modifications with respect to the direction and operations of the Information Resource. In the event an Information Resource does not have a clearly defined and readily identifiable Owner upon request, the Chief Operating Officer (or equivalent position) and ACIO of the Agency to which the Information Resource is associated and/or belongs shall be assigned such roles by default. In the event an Information Resource does not belong to a specific Agency, the EOHHS Assistant Secretary for Administration and Finance and SCIO shall be assigned to such roles by default.

i. Defining Roles and Accounts

Information Resource Owners are responsible for identifying Roles and accompanying accounts in the Information Resource. To simplify the relationship between Roles and accounts: Roles address business function and accounts address technical access based on business function. Those Owners must ensure implementation of the following requirements when defining Roles and accounts:

1. Roles: Each Information Resource must have clearly defined and documented Roles (including group Roles) based on responsibility, business need, staff role, or other logical association. The documentation of such Roles must include criteria for membership in that Role and an overview of the permissions granted to that role.

2. Types of Roles: Each identified Role must have an accompanying account, permission group, or other configuration which defines the access permissions an individual with that Role will have with respect to the Information Resources. Roles and accounts should be pared on a one-to-one basis. Multiple accounts may have the same access permissions to an Information Resource if necessitated by their accompanying Roles.

3. Least Privilege: Assignment of permissions and capabilities must be narrowly tailored and follow the Principle of Least Privilege. Each individual, Role, and account may have only the minimum level of access required to perform their authorized function.

For example, a normal desktop user should not have administrator-level access on their machine and should not be able to change basic system settings or install new software; similarly, a web application should not be run with administrator rights (or root in the Linux/Unix context) to the operating systems on which it runs. At a minimum, Information Resources must have the following separate Roles and associated Accounts defined by EOTSS standard IS.003 Access Management:

a. User Account

b. System (or Application) Account

c. Service Account

d. Administrator (or Root) Account

e. Firecall (or breakglass/emergency recovery) Account

4. Ability to Review Access Controls: All Information Resources must have a type of account (included in or in addition to the above) that is capable of reviewing lists of all individuals authorized to access an Information Resource and the accounts assigned to those individuals.

5. Limit and Audit Privileged Accounts: For any Accounts or Roles that have broad access to information or the ability to modify Information Resource operations (“privileged” accounts or roles), Owners must develop a mechanism to ensure that (a) account creation and use are expressly authorized based on well-defined criteria; (b) accounts are limited to the individuals whose function requires broad privilege; (c) account creation and use is tracked and auditable; and (d) appropriate mechanisms are in https://www.mass.gov/advisory/access-management-standard place to timely offboard privileged accounts. For example, an employee providing desktop support may need to be able to elevate to administrator-level access on workstations in the group they support, but should not be able to use administrator-level access on workstations in areas of the organization they do not support, nor on servers administered by a separate group.

6. Logical Separation: Accounts must ensure logical separation of access to different components and data within the Information Resource based on Role. That logical separation must ensure that accounts and individuals have only the minimal amount of access necessary to fulfill their business and technical requirements. Additionally, Owners must ensure that such access constraints are uniformly enforced (across Information Resources and in each instance of access). Access must be constrained, procedurally or logically, in a way that ensures that account holders are generally prohibited from:

a. Passing information to unauthorized individuals;

b. Inappropriately downloading or saving information;

c. Inappropriately passing information to other Information Resource components;

d. Sharing account information or otherwise granting their account privileges to others;

e. Changing security attributes to data, Information Resources, or

Information Resource components;

f. Changing security attributes for newly created data or Information

Resources; or

g. Changing how access control is governed.

Notwithstanding the foregoing, Owners may define privileged accounts which do permit some or all of the above if business requirements warrant.

ii. Assigning Accounts

Information Resource Owners are responsible for developing, documenting, implementing, and auditing the processes for assigning Roles and accounts. These processes must meet the following requirements:

1. Documented Process: Owners must ensure that there is a documented process for approving, creating, modifying, monitoring, and terminating accounts and/or Roles in the Information Resource. Such process must account for:

a. Defining who can approve the creation of new Roles and types of accounts;

b. Defining who can approve the creation of new accounts for individuals, modifying existing accounts, and terminating accounts;

c. Defining how monitoring of accounts in and access to the Information Resource occurs; and

d. Defining the conditions under which accounts and Roles can be created, enabled, modified, disabled, and/or removed.

In addition, the process should identify the roles of one or more individuals responsible for approving, administering, monitoring, and terminating access to the Information Resource. The individual(s) must be readily identifiable upon request. If the individual(s) are not, that role will default to the applicable ACIO.

2. Change Documentation: With respect to account creation, modification, and termination, Owners must ensure that they receive appropriate and timely information to support a change with an account. It is the shared responsibility of Owners and the individuals best suited to know when an account should be created, changed, or decommissioned. Such individuals may include the end user, the end user’s manager (if applicable), the end user’s organization (if a third party), human resources, and others. Owners should determine what information sources are most appropriate to support account determinations and coordinate appropriately to receive that data. Account creation, modification, and termination cannot occur spontaneously and must be (a) supported by request documentation; and

(b) recorded when such action is taken.

3. Least Privilege with Multiple Accounts: Some individuals may have different Roles with respect to the Information Resource and, therefore, multiple different sets of access rights. Owners should ensure that individuals accessing the Information Resource utilize the account or access rights associated with the Role being performed. For example, if an individual is both an administrator and developer for an Information Resource (where they have greater access rights as an administrator), that individual must only use the administrator access for their administrator Role and not for their developer role. Users are also responsible for ensuring that they do not misuse their more privileged accounts to perform work inappropriately in a Role for which they do not require a heightened level of access. Under no circumstances may a user access or fulfill a non-privileged Role with a privileged account. All activities undertaken with a Privileged account must be logged, and such logs either (a) shared automatically with EHS log-correlation service; or (b) maintained for at least 180 days.

4. Identification & Authorization: All Information Resources must require identification and authorization procedures for users to access the Information Resource. Access to Information Resources must require controls such as user credentialing and passwords meeting EOTSS and EOHHS standards. For legacy Information Resources not requiring identification and authorization procedures, a supplemental security plan must be provided which explains why user actions do not require identification and authorization and which demonstrates compensating controls for user authentication.

5. Central Identity Management: Wherever possible, Information Systems shall be designed and implemented to use central identity management services (IDM) provided by EOHHS or the Commonwealth, such as Active Directory, LDAP, or web-based authentication protocol. Owners are free to use groups/roles defined in the IDM system, or to use IDM only to authenticate users, managing and assigning roles entirely within their Information System.

6. Logging of Identification Attempts: Every login attempt, whether successful or rejected, and whether or not using a central identity management service, must be logged. Wherever possible, these logs must be shared automatically with EOHHS log-correlation services, such as SolarWinds, and unless such log forwarding is in place, Information System Owners are responsible for maintaining the identification logs for at least 180 days.

Wherever possible, these logs must include source IP address or other source-identifying information.

iii. Access to Information and Data Management

Information Resource Owners are responsible for ensuring appropriate access to information and management of the data in their Information Resource. Those Owners must ensure implementation of the following requirements when managing data within their Information System:

1. Information Sharing: Information within an Information Resource should not be shared outside of that Information Resource unless the data recipient abides by the requirements outlined and referenced in these EOHHS Enterprise Information Security Standards. With respect to determinations in the EOHHS Environment, the EOHHS Security Office is undertaking application risk assessments and gap analyses. Consequently, the EOHHS Security Office has determined that EOHHS is making progress toward a generally effective control environment. As such, information sharing within EOHHS and among EOHHS Information Resources is deemed appropriate based on information security considerations. Owners must still take care to ensure appropriate custody of their information. Owners must continue to ensure that sharing of data external to EOHHS is appropriately evaluated against these standards, documented, authorized, and supported by written agreement holding external parties to at least the same standards required of EOHHS, including compliance with relevant Third Party Agreements.

2. Protect Data Transmission: Owners must enforce appropriate control over the transmission mechanisms for data. Some data must be encrypted before being transmitted outside an Information System, outside the EOHHS Environment, or outside the MAGNet environment. When transmitting data outside of the EOHHS Environment or interfacing with an Information Resource outside of the EOHHS Environment, Owners must establish and document rules and procedures governing data transmission, processing, and storage. See Section XVI, System and Communications for more information.

3. Oversee and Manage Authorizations: Owners must also facilitate information sharing by maintaining oversight of Information Resources.

Authorized administrators of access must determine whether access to its Information Resources is appropriate, based on but not limited to, the user’s roles, business justifications and other standards consistent with those outlined herein. When applicable, Owners may employ either automated mechanisms or manual processes to assist users in making information sharing and collaboration decisions.

4. Previous Logons: Owners must ensure that the Information Resource notifies the user, upon successful logon and/or access to the system, of the date and time of the last successful logon and/or access.

5. Concurrent Sessions: Owners must ensure that the Information Resource limits the number of concurrent sessions for each Role and account to one concurrent session, unless required by business, programmatic, or technical need. For any account, role, or Information Resource that allows multiple concurrent sessions, Information Resource Owners must (a) document why this is allowed; and (b) ensure that auditable events (including successful logins, re-authorizations, file additions/modifications/deletions, and changes to security attributes) are traceable to a specific session.

6. Session Time-Out: All Information Systems must automatically terminate a user’s session (timeout) and conceal or remove information displayed on-screen after no more than 15 minutes of user inactivity. Upon session termination, the user must be required to reenter credentials to reestablish access to the Information System.

7. Protect Physical Information Resources: Owners must develop and enforce policies governing physical copies of data, including practices for the creation and distribution of physical copies of sensitive data, consistent with the Secretary of State’s Record Retention Schedule. Access to physical Information Resources must be controlled based upon requirements provided by the Business Owner. If physical copies are required, Owners must ensure that they are maintained in a locked and secure environment accessible by key, badge swipe, PIN-entry pad, guard, or other authorization mechanism. Paper documents containing sensitive information may not be left unattended in the open where they can be easily taken. If electronic sensitive information is printed or otherwise converted into paper-based sensitive information, it must be printed to a non-publicly-accessible location and must be picked up immediately. Sensitive information in physical Information Resources may not be left unattended, especially in public spaces or shared office settings. Owners must be cognizant of more restrictive compliance requirements under various Third Party Agreements, depending on the type of data contained within an Information System.

8. Minimize Duplication of Electronic Information: Owners must restrict the creation of unnecessary or duplicative collections of sensitive information and ensure that non-authoritative electronic copies of Information Resources are securely deleted or destroyed as soon as they are no longer needed. Such electronic files should never be stored locally on a user’s computer or on shared drives, calendars, collaborative tools, external parties’ systems, or anywhere on the internet without prior authorization.

9. Control the Release of Information: Prior to releasing information pursuant to a public records request, litigation, or other similar request for data, Owners must engage trained EOHHS staff who are authorized to post information onto a public-facing system or application or release data to the requesting third party. These trained individuals must review the proposed content to ensure that the proposed release does not contain nonpublic information, and if it does, remove or redact such information such that it cannot be recovered from the publicly released information.

10. Automate Key Account-Management Practices: Within one (1) calendar year of the issuance of this Document, Owners must certify and demonstrate that the following account management functionality has been automated:

a. Information Resource account management – this can include measures like automated emails notifying Owners when users are terminated or their roles change, necessitating a change in their account, monitoring of account usage, automated alerts around atypical account usage, etc.

b. Automated removal of any temporary accounts, which also includes any “emergency” accounts that may be created.

c. Automatic disabling of Information Resource accounts that are inactive for 60 days or more and that meet other criteria, defined by the Owner, for account inactivity.

d. Automatic auditing of account creation; modification; enabling, disabling, and removal action. Additionally, Information Resource rules must be created to distinguish between appropriate and inappropriate action and which will be used to automatically notify the Owners of inappropriate actions.

e. Automatic logging and auditing of all privileged account activity, as well as the execution of privileged functions.

f. Automatic prevention of non-privileged users from executing privileged functions. This should include the inability to circumvent, disable, or otherwise modify systems and functionality designed to protect an Information Resource from modification, improper access, other malicious activity, and accidental harm.

11. Data Mining Protections: Within one (1) calendar year of the issuance of this Document, EOHHS must gauge the feasibility of, and employ if feasible, techniques to detect and prevent unauthorized data mining within Information Resources. These techniques should be designed to protect against users’ unauthorized discovery and extraction of anomalies, patterns, and correlations within large data sets. They may include, but are not limited to: limiting the types of responses provided to database queries, limiting the allowed frequency of database queries to increase the work factor needed to extract or infer information from such databases, and notifying appropriate personnel when atypical database queries, accesses, or workloads occur.

iv. Access Reviews

In order to support and enforce these standards, Owners must ensure implementation of periodic access reviews for each of their Information Resources, taking into consideration the following standards:

1. Personnel and Procedures: Owners must ensure that sufficient personnel, procedures, and systems are in place to effectuate the access controls they adopt. Access enforcement will be based on the decisions of these authorized systems or individuals.

2. Review Schedule: Information Resource access must be reviewed and updated to reflect changes to operational, business, or IT requirements, based on the following schedules:

a. Annual Policy Review: All Information Resource access policies and procedures must be reviewed at least yearly.

b. Annual Access Log Sampling: A random sampling of Information

Resource accounts must be reviewed (audited) at least once annually to ensure that access was (i) granted; and (ii) used appropriately. Such review must be designed to verify to a high degree of certainty that appropriate processes were followed and access grants were proper.

c. Unused Accounts: Information Resource accounts must be reviewed (manually or automatically) at least every 60 days to determine whether or not such accounts are still actively in use.

Accounts that have not been used within the past 60 days must at least be disabled to prevent access using that account. Managers should determine a timeline and process for documenting and re-enabling such disabled accounts based on criteria such as legitimate business need, including being notified by the account holder that they still require use of the account. Managers must determine a timeline for deletion of disabled accounts that remain unused;

however, such timeline may not exceed 180 days.

d. After an Event: Access control policies and procedures must be reviewed and updated for any Information System or Resource identified by the SCIO or appropriate ACIO as having been involved in an Event.

e. As Needed: Access control policies and procedures must be reviewed and updated as needed, as systems, roles, and personnel change.

v. Wireless and Remote Access

Owners of any Information Resource or Information System that is accessible via a wireless connection, from a mobile device, or from outside MAGNet (e.g., from the internet) (“remote availability”) must establish controls for all such wireless, mobile, and remote access connections, including:

1. Documented Authorization: Documented usage restrictions, configuration requirements, and procedural guidance must be put into place before making the system remotely available, including per-user and per-device authorization processes to be completed prior to granting remote or wireless access.

2. Minimum Necessary Amount of Wireless, Mobile Device, and Remote

Access: Access to wireless, mobile, and remote-access connections must be limited to the minimum amount necessary required to accomplish the authorized function. Instances in which remote users are granted access to privileged data must be documented with the business justification for the level of access.

3. Monitoring: Manual and/or automated processes that manage, monitor and track all remote accesses through audit logs and network access control points.

VII. AUDIT AND ACCOUNTABILITY

In support of access control monitoring and ensuring the confidentiality, integrity, and availability of Information Resources, Owners must ensure that they are able to assess and verify who accessed what with respect to their Information Resources. The controls outlined herein are predominately targeted at Information Systems, but physical Information Resources should be similarly safeguarded to the extent feasible.

All EOHHS Information Resources must have records for access to those resources managed and reviewed by Owners to ensure only appropriate and authorized access to Information

Resources occurs. Information Systems must generate logs which are capable of being absorbed by Commonwealth and EOHHS enterprise logging tools. Compliance with these standards must be achieved within twenty-four (24) months of publication of this

c. Audit and Accountability Standards

i. Audit Events

At a minimum, records for access to information Resources must identify:

1. Who accessed the Information Resource,

2. When the Information Resource was accessed,

3. What was accessed,

4. Whether or not data was taken (appropriately or inappropriately),

5. Whether or not any modification was made (for Information Systems), and

6. From where the access occurred (for Information Systems, if applicable).

These six pieces of information will provide a sufficient baseline for Information Resource Owners and the EOHHS Security Office to determine if improper access was made to an Information Resource and its data.

Owners must also determine what events will trigger automated alerts. Some of those events are outlined in Section VI, Access Controls. At a minimum, Owners must identify rules and methods for identifying the following events:

1. Disruption of Service (DOS) and Distributed Disruption of Service (DDOS) attacks;

2. Brute forcing passwords through excessive log-on attempts; and

3. Unauthorized exfiltration or access of data through indicators like file transfer size or volume of access, timing, irregular account usage, and other indicators.

Owners must also implement active monitoring for all administrative or otherwise privileged accounts which permit read access to all data in an Information System or modify access to some or all of the Information System.

Owners must develop such rules as soon as reasonably practicable, but no later than: 1) the EOHHS Security Office requests such information when implementing aggregated logging for existing Information Systems or 2) upon deployment of a new Information System to production. These events and audit rules must be reviewed and confirmed or updated annually to ensure new perceived threats are appropriately monitored.

Owners must ensure that all audit logs contain a timestamp for creation of the log of the event. All such logs must be recorded in Eastern Standard Time.

ii. Storage Capacity and Review

The EOHHS Security Office will only maintain audit logs in an aggregated logging system for events that generate an alert and will maintain such records for sixty (60) days. All other audit logs will be maintained on an as-needed basis and the oldest audit records which have not generated an alert will be deleted on an as-needed basis to free storage.

The EOHHS Security Office will perform an initial review of all alerts to ensure that the alert is genuine. In the event it is, the alert will be forwarded immediately to the Owners of the Information System generating the alert. The EOHHS Security Office will also mobilize its forensic and incident response units to address any potential malicious activity. If appropriate, the EOHHS Security Office will also report incidents to EOTSS pursuant to Section XI, Incident Response and Security Incident Response Team.

Owners are encouraged, but not required to, keep logs for longer. In the event an application has not been ingested into an aggregated logging system, within one (1) year of promulgation of these EOHHS Enterprise Information Security Standards Owners must produce, review, and store logs as outlined in this Section VII, Audit and Accountability and produce a copy of events that generate an alert to the EOHHS Security Office within twenty four (24) hours of generation of the alert for review and analysis.

iii. Audit System Integrity and Failures

Audit logging systems employed in the EOHHS Environment must be developed consistently with these standards to assure the integrity of data and security of that system. Access should be provided consistent with the principles of least access.

Audit logging systems must also be monitored to verify the continued integrity of generated audit files and events. Such logging must be performed in a way that review of any audit log does not modify the original content or time ordering of those logs. In the event an audit logging system is compromised, an alert must be generated notifying the Owner of such event. In the event an audit logging system fails, the audit logging system should be stopped, flushed, the source of the failure identified and repaired, and then restarted.

iv. Additional Requirements for Systems Accessing Internal Revenue Service Federal Tax

Information

Owners are responsible for developing procedures defining access requirements and protection of audit information among external organizations when audit information is transmitted across agency boundaries. This requirement applies to outsourced hosting with data centers or cloud providers.

VIII. INVENTORY AND CLASSIFICATION

a. Purpose

The purpose of this Document is to outline both the need and the method for carrying out an inventory of EOHHS’s applications and information. This Document is intended to satisfy Steps 1, “Categorize Information Systems” of the National Institute of Standards and Technology (“NIST”) Risk Management Framework Security Lifecycle.2 Furthermore, the processes outlined herein was drafted to conform to the precepts outlined in Federal Information Processing Standards (“FIPS”) Publication (“Pub”) 199, Standards for Security Categorization of Federal Information and Information Systems and NIST SP 800-60, Volume I: Guide for Mapping Types of Information and Information Systems to Security Categories.

FIPS Pub 199 outlines that an information system inventory and classification is necessary to mitigate the potential impact of a loss of confidentiality, integrity, or availability. For clarification:

i. A loss of confidentiality is defined as, “the unauthorized disclosure of information.”3

ii. A loss of integrity is defined as “the unauthorized modification or destruction of information.”4

iii. A loss of availability…