Attach 5 - BPISA.pdf

Part 8 - Information Resources Management Chapter 12 - Information Technology Security

8-12.1 INTRODUCTION

The Indian Health Service (IHS) is responsible for securing information that it collects, records, transmits, and uses in the performance of its mission. Since this information includes Agency-sensitive information, such as personnel and financial records as well as individually identifiable health information, it is necessary to establish the conditions and rules under which the IHS electronic systems and networks will operate to ensure the confidentiality, integrity, and availability of the information. This is especially critical in the health care environment, where health care personnel must balance the requirement for patient privacy with the requirement to provide sufficient data to health care professionals and Government agencies in support of each one’s mission and responsibility to improve health care in the United States.

This chapter contains the IHS policies for implementing the IHS Information Technology (IT) Security (ITS) program.

A. PURPOSE. In accordance with Title 18 of the United States Code (U.S.C.), the Computer Security Act, and Office of Management and Budget (OMB), Circular A-130, this chapter establishes standard requirements for the protection of IHS information and information system resources, and the management and oversight of the IHS ITS program. The IHS ITS program is intended to ensure that each IHS Automated Information System (AIS) has a level of security commensurate with the risk and magnitude of the harm that could result from the loss, misuse, disclosure, or modification of the information contained in the system. Generally accepted system security principles shall be implemented to ensure the following:

1. The ITS program supports the Agency mission.

2. The ITS program is an integral element of sound management.

3. The ITS program is cost-effective.

4. System owners have ITS responsibilities outside their own organization.

5. Information Technology System accountability is explicit.

6. The ITS program has an integrated approach.

7. The ITS program is periodically reviewed.

8. The ITS program is constrained by societal factors.

B. SCOPE. This policy applies to all IHS employees, contract personnel, interns, externs, and other non- Government employees including consultants, temporary staff, and business representatives (hereinafter, collectively referred to as IHS "users") accessing and utilizing IHS sensitive information or information system resources from within IHS facilities as well as from remote locations. Agency officials shall apply this chapter to contractor personnel, interns, externs, and other non-Government employees by incorporating such reference in contracts or memorandums of agreement as conditions for using Government-provided IT resources. Indian Health Service sensitive information is defined as all information processed, stored, or transmitted via information system resources within the organization and not available to the general public. This information includes data not originating from the IHS but identified as sensitive or critical to continued business operation and processed, stored, or transmitted via IHS information system resources. These resources include, but are not limited to stand-alone computers; network computers; remote computing devices; network resources, including servers and routers; and associated peripherals such as printers, scanners, backup devices, and both internal and external storage devices. This chapter applies to computer and network systems and data processed by these systems or stored in electronic format. This includes major applications, general support systems, databases, electronic storage media, local area networks and wide area networks. Although this chapter does not include the physical security of the overall facility, it does include the physical security of the actual IT components within a facility. This chapter does not cover data deemed "classified" by the United States Government. [See the Department of Health and Human Services (HHS), "Automated Information Systems Security (AISS) Program Handbook," Chapter II, Section C4.]

C. AUTHORITY.

1. "Information Technology Management Reform Act of 1996," Clinger-Cohen Act, Division E, Public

Law (P.L.) 104-106

2. Chief Financial Officers Act of 1990, P.L. 101-576

3. "Computer Fraud and Abuse Act of 1986, "P.L. 99-474

4. "Computer Security Act of 1987," P.L. 100-235

5. "Federal Information Technology," Executive Order 13011, Section 3(a)(1)

6. "Electronic Records; Electronic Signatures; Final Rule," Food and Drug Administration, HHS, 21

Code of Federal Regulations, Part 11, Federal Register, Volume 62, No. 54, Page 13429, March 20, 1997

7. Federal Acquisition Streamlining Act of 1994, P.L. 103-355

8. Federal Managers' Financial Integrity Act of 1982, P.L. 97-255

9. "The Freedom of Information Act," Amendments of 1996, P.L. 104-231

10. "Government Information Security Reform Act of 1999" P.L. 106-398, Title X, General

Provisions, Subtitle G, Government Information Reform, Sections 1061-1065

11. Government Paperwork Elimination Act, 44 U.S.C., 3504, Title XVII, October 8, 1998

12. Government Performance and Results Act of 1993, P.L. 103-62

13. The "HHS Automated Information Systems Security Program Handbook," May 1994

14. The "HHS Automated Information Systems Security Training and Orientation Program (AIS-

STOP) Guide," November 1991

15. The HHS General Administration Manual:

a. Chapter 5-10: Transmittal 90.05 dated August 15, 1990, "General Policy - Responsibility and Procedures for Reporting Misconduct and Criminal Offenses"

b. Chapter 5-10-40: "Procedures for Reporting and Investigating Allegations of Criminal Offenses"

16. Department of Health and Human Services Information Resources Management (IRM) Policy:

a. "Personal use of Information Technology Resources," HHS-IRM-2000-0003, January 8, 2001

b. "Use of Broadcast Messages, Spamming and Targeted Audiences," HHS-IRM- 2000-0004, January 8, 2001

c. "Information Technology Security for Remote Access," HHS-IRM-2000-0005, January 8, 2001

d. "Establishing an Incident Response Capability," HHS-IRM-2000-0006, January 8, 2001

e. "Prevention, Detection, Removal, and Reporting of Malicious Software," HHS-

IRM-2000-0007, January 8, 2001

f. "Health Insurance Portability and Accountability Act," P.L. 104-191, August 21, 1996.

17. National Institute of Standards and Technology (NIST) Special Publications:

a. 800-12, "An Introduction to Computer Security: the NIST Handbook," October 1995

b. 800-14, "Generally Accepted Principals and Practices for Securing IT Systems,"

June 1996

c. 800-18, "Guide for Developing Security Plans for Information Technology Systems,"

December 1998

18. Office of Management and Budget Circulars:

a. Circular A-11

i. Part 1, "Preparation and Submission of Budget Estimates,"

ii. Part 2, "Preparation and Submission of Strategic Plans and Annual Performance

Reports,"

iii. Part 3, "Planning, Budgeting, and Acquisition of Capital Assets,"

iv. and the supplement to Part 3, "Capital Programming Guide"

b. Circular No. A-130, "Management of Federal Resources," Appendix III, "Security of Federal Automated Information Resources"

19. "Paperwork Reduction Act of 1995," P.L. 104-13

20. Presidential Decision Directive 63, "Critical Infrastructure Protection," May 22,1998

21. "Privacy Act of 1974," P.L. 93-579

D. ACRONYMS.

1. AIS - Automated Information Systems

2. AISS - Automated Information Systems Security

3. AIS-STOP - Automated Information Systems Security Training and Orientation Program

4. C&A - Certification and Accreditation

5. CIO - Chief Information Officer

6. CSSP - Computer System Security Plan

7. DAA - Designated Approving Authority

8. FIPS - Federal Information Processing Standard

9. GSS - General Support Systems

10. HHS - Department of Health and Human Services

11. HIPAA - Health Insurance Portability and Accountability Act

12. I&A - Identification and Authentication

13. IHM - Indian Health Manual

14. IHS - Indian Health Service

15. IHSNET - IHS Network

16. IRM - Information Resources Management

17. ISC - Information Systems Coordinator

18. ISSO - Information Systems Security Officer

19. IT - Information Technology

20. ITS - Information Technology Security

21. I/T/U - IHS/Tribes/Urban

22. JCAHO - Joint Commission on Accreditation of Healthcare Organizations

23. MA - Major Applications

24. NIST - National Institute of Standards and Technology

25. OMB - Office of Management and Budget

26. PUB - Publication

27. RFP - Request for Proposal

28. SPSO - Servicing Personnel Security Officer

29. U.S.C. - United States Code

30. WAN - Wide Area Network

31. WWW - World-Wide Web

E. DEFINITIONS.

1. Application. The use of information resources (information and IT) to satisfy a specific set of user requirements.

2. Authenticate. To confirm the identity of an entity when that identity is presented.

3. Authentication. Security measure designed to establish the validity of a transmission, message, or originator, or a means of verifying an individual's authorization to receive specific categories of information.

4. Computer Security Incident. An event that may result in, or has resulted in:

a. the unauthorized access to or disclosure of sensitive or classified information,

b. the unauthorized modification or destruction of systems data,

c. reduced, interrupted, or terminated processing capability,

d. malicious logic or virus activity, or

e. the loss, theft, damage, or destruction of any IT resource.

5. Examples of a Computer Security Incident. Examples include:

a. unauthorized use of another user's account,

b. unauthorized scans or probes, successful, and unsuccessful intrusions,

c. unauthorized use of system privileges,

d. execution of malicious code (e.g., viruses, Trojan horses, or back doors),

e. unauthorized scans or probes,

f. successful or unsuccessful intrusions, and

g. insider attacks.

6. Computer Virus. An executable or self-replicating program spread from executables, boot records, and macros as a set of instructions that attaches itself to programs, files, diskettes, or other storage media. This set of instructions can then be spread to other programs, files, disks, systems, or networks. The instructions can display a message, erase or alter files or stored data, or potentially render a workstation or network inoperable. Sometimes, instead of disruptive instructions, a virus can cause damage by replicating itself and depleting resources such as disk space, memory, or network connections. Non-virus threats to user systems include worms, Trojan horses, and logic bombs.

7. Detection. Determining that a record, data file, or storage media is contaminated with a virus.

8. Event. Any observable occurrence in a system and/or network. Examples of events include the system boot sequence, a system crash, and packet flooding within a network.

9. Firmware. The Read-Only-Memory (ROM)-based software that controls a computer between the time it is turned on and the time the primary operating system takes control of the machine.

Firmware tests and initializes the hardware, determines the hardware configuration, loads (or boots) the operating system, and provides interactive debugging facilities in case of faulty hardware or software.

10. Information Resources. Information and related resources, such as personnel, equipment, funds, and IT.

11. Information Resources Management. The process of managing information resources to accomplish Agency missions and to improve Agency performance, including the reduction of information collection burdens on the public.

12. Information System. A discrete set of IT, data, and related resources, such as personnel, hardware, software, and associated IT services organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of information.

13. Information Technology. Any equipment or interconnected system or subsystem of equipment used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission or reception of data or information by the Agency.

Information technology includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources. Information technology does not include any equipment that is acquired by a Federal contractor incidental to a Federal contract. For purposes of this definition, equipment is "used" by the IHS whether the IHS uses the equipment directly or it is used by a contractor under a contract with the IHS that:

a. requires the use of such equipment; or

b. requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product.

14. Indian Health Service IT Resources. The IHS IT resources include but are not limited to: personal computers and related peripheral equipment; and software, network and Web servers, library resources, telephones, facsimile machines, photocopiers, Internet connectivity and access to Internet services, all forms of e-mail and, for the purposes of this policy, office supplies. It does not include data stored in or transported by such resources.

15. Internet. A worldwide electronic system of computer networks, which provides communications and resource-sharing services to Government employees, businesses, researchers, scholars, librarians, and students as well as the general public.

16. Logic Bomb. A type of virus or malicious software that is usually timed or event-triggered to do damage.

17. Maintenance. A set of activities which result in changes to the originally accepted baseline product set and which is done to keep the system functioning in an operational, evolving, and expanding-user environment.

18. Major Application System. An application that requires special security measures due to the potential risk or magnitude of harm that would result from the loss, misuse, unauthorized access to, or modification of the information in the application.

19. Malicious Software. Any code that is intentionally included in software or firmware for an unauthorized purpose.

20. Program Area. A representation of customer organizations.

21. Program Management. The planning, organizing, directing, and controlling of the resources and schedules that coordinate the prioritization and sequencing of a collection of similar or interdependent projects.

22. Remote Access. Computer access to IHS networks (IHSNET) or systems by authorized users accessing IHS automated information and systems from outside the protection of Agency firewalls.

23. Remote Access Connections. Resource components required to provide remote access to the IHSNET (e.g., hardware, software, service, link/signal). Requirements will vary depending on the remote access location and work to be performed.

24. Security Incident. An event that may result in or has resulted in the unauthorized access to or disclosure of sensitive or classified information; unauthorized modification or destruction of systems data; reduced, interrupted, or terminated processing capability; malicious logic or virus activity; or the loss, theft, damage, or destruction of any IT resource.

25. Sensitive System. A system required for accomplishment of an Agency's mission in a sensitive system (it need not contain any sensitive data). Any system or systems that require some degree of protection for integrity, availability, or confidentiality. This includes systems and data of which improper use or disclosure could adversely affect the ability of an Agency to accomplish its mission. Examples:

a. Propriety data

b. Records about individuals requiring protection under the Privacy Act

c. Data not releasable under the Freedom of Information Act

26. Spam. Generally refers to commercial senders of massive amounts of e-mail to all addresses they can find. Spam is frequently sent from addresses that are forged to bypass filters intended to block them. The content of spam often involves commercial scams, gambling, messages presenting a religious or political bias, chain-letter e-mail, computer viruses, and the sale of pornography.

27. Trojan Horse. A destructive program that comes concealed in software that not only appears harmless but attractive to an unsuspecting user (such as, a game or graphic application).

28. Unauthorized Software. Any software that does not have a certificate of authority to operate.

29. Website. A collection of Web files on a particular subject that includes a beginning file called a home page.

30. Worms. Infiltrators of programs that alter or destroy data.

31. World Wide Web. A collection of Web pages (documents), which are developed in accordance with the Hyper Text Markup Language Web format standard and may be accessed via Internet connections using a World Wide Web (WWW) browser. NOTE: Events such as natural disasters and power-related disruptions are not generally within the scope of the IRT and should be addressed in the IHS's business continuity and contingency plan.

F. COMPLIANCE. This chapter provides rules and guidelines to ensure the confidentiality, integrity, and availability of business and medical information contained in IHS's computer systems and networks.

The following sections define the ITS policies for management, information, operational, and technical controls required to provide ITS.

1. Users. All IHS users are responsible for assisting in the protection of IHS automated correspondence, data, systems, and equipment by complying with the security requirements contained in this chapter.

2. Violations. Any IHS user who violates this policy may be subject to disciplinary action.

3. Legal Action. Legal action may be initiated where employee/contractor actions are also in violation of Federal, State, or local laws, or when damage to IHS assets or facilities has resulted from employee or contractor violation of this chapter.

4. Exceptions. Requests for exceptions to this chapter may be made to the IHS Chief Information Officer (CIO). All requests shall be in writing and shall state the reason for the requested exception.

G. RESPONSIBILITIES. An effective security program is dependent upon supportive management and the assignment of responsibilities to personnel throughout the organization for implementing and enforcing the various aspects of the ITS program. This section describes the roles and responsibilities of each IHS employee in implementing, enforcing, and assessing the effectiveness of the IHS security policies and ITS program.

1. Director, IHS. The Director, IHS, has the ultimate responsibility to ensure the IHS conforms to applicable laws and regulations. The Director, IHS, shall be responsible for ensuring:

a. an IHS ITS program is implemented to protect the privacy and security of IHS IT resources;

b. security-aware individuals implement security measures in the IHS, and

c. funding is available to adequately support security efforts.

2. Director, Office of Management Support. The Director, Office of Management Support (OMS), is responsible for:

a. physical security of facilities and equipment external to computers or telecommunication lines, and

b. all matters relating to background and security clearance investigations of personnel.

3. Chief Information Officer. The IHS CIO shall be responsible for:

a. the security of all IHS information while the information is being processed and/or transmitted electronically, and for the security of the resources associated with these functions;

b. the status of ITS within the IHS and the adequacy of operating unit ITS programs;

c. reporting on the status of ITS, as required, to the Department;

d. reviewing and approving system security policies;

e. granting exceptions to the security policies, as necessary;

f. ensuring all security controls as stated in this policy are being implemented on all IHS systems;

g. ensuring certification and accreditation activities are performed for all major applications and general support systems; and

h. coordinating with the IHS Privacy Officer and IHS Records Management Officer for interpretation of privacy and records management policies and ensuring these policies are being correctly implemented in IHS systems.

4. Information Systems Security Officer. The IHS Information System Security Officer (ISSO) shall be responsible for the following:

a. Monitoring, evaluating, and reporting, as required, to the CIO on the status of ITS within the

IHS and the adequacy of the ITS programs administered by the operating units.

b. Developing policies, procedures, and guidance establishing, implementing, maintaining, and overseeing requirements for the IHS’s ITS program to be followed by all IHS organizations.

c. Providing guidance and technical assistance to operating units, including analyzing, evaluating, and approving all IT system security plans and requirements for IT systems security.

d. Ensuring IHS ITS oversight through compliance reviews of operating units and organizations and ITS verification reviews of individual systems, and by participating in program management oversight processes.

e. Maintaining a tracking system and records concerning implementation of the required controls and accreditation status of all IHS IT systems.

f. Coordinating with Area ISSOs and periodically scheduling conference calls to discuss/disseminate information on ITS matters and concerns.

g. Coordinating the review of controls and evaluating the adequacy of technical controls for accreditation.

h. Acting as the central point of contact for the Agency for ITS-related incidents or violations.

i. Investigating or initiating an investigation of any incidents or violations; maintaining records and preparing reports; disseminating information concerning potential threats; and reporting to the HHS senior ISSO any violations that come under his/her areas of responsibility or to the Assistant Inspector General for investigation any activity that may constitute a violation of law or otherwise is reportable to that office in accordance with District Attorney Order 207-10, "Inspector General Investigations."

j. Coordinating information resources, security awareness, and training needs assessments;

determining appropriate training resources; and coordinating training activities for target populations. (See HHS AISS Program Handbook Chapter VII, "Personnel Security/Suitability Training" and AIS-STOP.

k. Assisting project officers and appropriate application system managers in carrying out the provisions of the HHS AISS Program Handbook for solicitations and contracts; and certifying the proposals received in response to a Request for Proposal (RFP) and certified as winning proposals by the Project Officer, as in the HHS AISS Program Handbook, Chapter XIV, "Acquisitions and Contracts."

l. Coordinating with the HHS senior ISSO on security matters of mutual interest.

5. Area Director. Each Area Director shall administer an Area ITS security program that ensures appropriate and adequate levels of protection for all IT systems within the Area. The Area Director is responsible for the following:

a. Designing an Information Systems Coordinator (ISC).

b. Designating an Area ISSO and alternate for the Area. The Area ISSO and alternate shall have staff responsibility for the Area ITS program.

c. Ensuring appropriate and adequate levels of protection based on the security level designations of the AIS.

d. Ensuring systems may only be run in a facility that has at least the same of higher security level designation.

6. Area Information Systems Coordinator. The Area ISC is responsible for the following:

a. Serving as the designated accreditation authority for all sensitive systems within their organization. This approval authority may only be delegated to a senior management official of a subordinate organizational unit if that official does not have direct control over the IT system being accredited. Delegation of accreditation authority must be requested and approved in advance by the CIO.

b. Ensuring ownership is assigned for all IT resources within the operating unit (i.e., hardware, software, data, telecommunications, etc.).

7. Area Information Systems Security Officer. The Area ISSO shall serve as the central point of contact for the Area ITS program in coordination with the Agency ISSO. The Area ISSO is responsible for the following:

a. Attending annual ISSO training conferences.

b. Participating in conference calls to obtain current information on issues relating to Federal or

IHS ITS policies, regulations, or guidelines.

c. Sharing information with the other ISSOs about issues or concerns, and participating on special committees working to solve IHS-wide IT issues.

d. Ensuring that a security-aware individual for each subordinate organizational component within the Area implements the component's ITS program (e.g., ensuring a security assistant is appointed for each service unit and IT system within the Area).

e. Establishing and maintaining an up-to-date list of all IT systems within the operating unit and providing a copy of the list to the IHS ISSO when requested by the Department.

f. Ensuring ITS plans are prepared for all major applications and general support systems owned and operated by the operating unit.

g. Reviewing and commenting on individual ITS plans, ensuring that all corrective actions are completed, and submitting all plans to the IHS ISSO. Specific requirements for ITS plans are contained in the HHS AISS Program Handbook and in the NIST Special Publication (PUB) 800-18, "Guide for Developing Security Plans for Unclassified Systems."

h. Ensuring a risk analysis is completed for all sensitive IT systems within the operating unit.

Specific requirements for risk analysis are contained in this document and the HHS AISS Program Handbook, Chapter V, "Risk Management."

i. Ensuring contingency and disaster recovery plans are developed for all sensitive IT systems within each operating unit. Specific requirements for contingency and disaster recovery planning are contained in the HHS AISS Program Handbook Chapter VI, "Contingency Planning."

j. Maintaining a tracking system of the required controls and accreditation status for all operating unit sensitive IT systems, as listed in the HHS AISS Program Handbook Chapter III, "Security Level Requirements".

k. Acting as the central point of contact for accreditation of all sensitive IT systems within the operating unit. Ensuring all certification requirements have been met for each system prior to accreditation. Specific certification and accreditation requirements are contained in the HHS AISS Program Handbook, page IX-6 and the Federal Information Processing Standard (FIPS), PUB 102, "Guideline for Computer Security Certification and Accreditation."

l. Conducting or initiating ITS verification reviews of all operating unit sensitive IT systems every 3 years.

m. Ensuring all operating unit personnel are provided appropriate ITS awareness and training.

Specific ITS awareness and training requirements are contained in the HHS AIS- STOP.

n. Acting as the central point of contact for the operating unit for any type of ITS related incidents or violations.

o. Investigating or initiating an investigation of any incident or violation. Maintaining records and ensuring reports are submitted to the IHS ISSO.

p. Disseminating information on potential threats to system owners.

q. Ensuring the operating unit complies with required virus detection and elimination software, and procedures are available to protect against these threats. Specific malicious software protection and reporting requirements are contained in Part 8, Chapter 10, "Prevention, Detection, Removal, and Reporting of Malicious Software" of the Indian Health Manual (IHM) and in HHS AISS Program Handbook Chapter XIII, "Malicious Software and Intrusions."

r. Assisting application system managers and users in establishing and implementing the appropriate security safeguards required to protect microcomputer hardware and data from improper use or abuse (see HHS AISS Program Handbook Chapter XI, "Microcomputers").

s. Ensuring the operating unit has publicized the established IHS policy against the illegal duplication of copyrighted software. (See Section 8-12.1H(1)f, “Software Copyright Laws.”) Ensuring all systems are audited for illegal software at least annually and inventories of all software on each individual system are maintained to verify that only legal copies of software are being used. Specific requirements for software copyright protection, auditing and reporting are contained in the Copyright Act, as amended.

t. Coordinating with the IHS ISSO on security matters of mutual concern. In the absence of the ISSO, the ISSO alternate shall be designated to perform all functions normally assigned to the ISSO for the Area ITS program.

8. Component ISSO. Not all operating units within the Areas will require a position at this level. Any large organizational component with management responsibility for a number of individual IT systems performing separate functions (i.e., hospital, service unit, Area Office) may or may not require a component ISSO. The Area ISSO shall serve as the central point of contact for the component organization’s ITS program within the Area. If this position is determined to be appropriate for the Area, the functions of the ISSO for the component organizations generally parallel those specified for the Area ISSO.

9. Custodial Ownership Responsibility. All information resources (hardware, software, facilities, data, and telecommunications) will be assigned to an “owner,” designated in writing to the senior IRM official of the operating unit, i.e., an owner of the general support system information resources in an operating unit may be the facility’s manager. Custodial responsibility for the protection of IT resources includes:

a. an obligation to comply with applicable security policies and directives, and

b. administering application owner specified controls and safeguards for the owner’s data and programs.

10. Determination of Ownership. Resources located within user areas (i.e., offices or service units) may be “owned” by the manager of those areas. To assist with the determination of ownership, individual system boundaries must be established. A system is identified by logical boundaries being drawn around the various processing, communications, storage, and related resources. The systems must be under the same direct management control with essentially the same function, reside in the same environment, and have the same characteristics and security needs. Each system will be designated either a general support system or an application system.

(See “Definitions” for the definition of a general support system and an application system.)

Ownership of information and/or information processing resources may be assigned to an organization, subordinate functional element, a position, or a specific individual. When ownership is assigned to an organizational or functional element, the designated head of the unit shall be considered the resource owner. Some, but not necessarily all, factors to be considered in the determination of ownership are:

a. the originator or creator of data,

b. the organization or individual with the greatest functional interest, and

c. physical possession of the resource.

11. Support System Owners. Some general “support system owners” are suppliers of data processing services for applications owned by other organizations. Typically, these “support system owners” are custodians of software, data, input, and output produced by the data processing facility to support one or more application owners. Many of the IHS’s local area networks (LAN) will fit into this category.

12. System Owner. The system owner shall be responsible for the following:

a. Determining the sensitivity of the resources for which the owner is responsible.

b. Determining the appropriate level of required security consistent with all Federal laws, regulations, HHS, and IHS directives.

c. Ensuring the protection requirements of the system are maintained at an adequate level to protect the confidentiality and integrity of the system.

d. Serving as the certifying official and completing all required certification actions; issuing a certification statement; and preparing an accreditation package that will be forwarded to the Designated Approval Authority (DAA) for formal accreditation of the system every 3 years or when major changes occur to the system, whichever is less. If the certifying official is at a higher level in the organization, the system owner will complete all required certification actions and forward the accreditation package to the certifying official, who will issue the certification statement. Refer to the HHS AISS Program Handbook for specific certification requirements.

e. Monitoring compliance and periodically reevaluating previously specified levels of sensitivity and protection.

f. Ensuring all systems are audited at least annually to verify that no illegal software is present and to maintain an inventory of all software on each individual system as proof that only legal copies of software are being used. Specific requirements for software copyright protection, auditing, and reporting are contained in Section 8-12.1H(1)f, "Software Copyright Laws," of this chapter.

g. Ensuring that each automated data processing position (including contract positions) is properly designated by the Division of Human Resources according to position sensitivity criteria and receives appropriate investigative processing. Refer to the HHS AISS Program Handbook for further guidance.

h. Appointing an individual to serve as the ISSO with responsibility to develop, implement, and manage the security of the system.

13. System ISSO. The ISSO for each sensitive system shall perform the following functions:

a. Advise the IT system owner on matters pertaining to IT systems security.

b. Develop, implement, and manage the execution of the ITS program.

c. Prepare or initiate preparation of an IT system security plan in the proper format for the IT system. Requirements for ITS plans are contained in the HHS AISS Program Handbook.

d. Conduct or initiate a risk analysis on the system when there are major changes to the system or every 3 years, whichever occurs first. Requirements for risk analysis are contained in the HHS AISS Program Handbook.

e. Ensure contingency and disaster recovery plans are developed, maintained in an up-to-date condition, and tested at least annually. Requirements for contingency and disaster recovery plans are contained in the HHS AISS Program Handbook.

f. Establish and maintain liaison with any remote facilities or users served by the IT system, the Area ISSO, or if appropriate, the subordinate organization ISSO.

g. Monitor changes in hardware, software, telecommunications, facilities, and user requirements to ensure security is not compromised or degraded.

h. Exercise system responsibility or direct activities for password management.

i. Arrange for ITS awareness training for the system staff and monitor the user training programs to ensure personnel receive security orientation before being allowed access to sensitive IT resources.

j. Ensure positions requiring access to sensitive information or resources are identified and incumbents of these positions receive an appropriate level of security clearance before access is granted.

k. Investigate or initiate an investigation of known or suspected security incidents or violations.

l. Prepare reports of findings as required in the HHS AISS Program Handbook.

m. Refer all incidents involving a physical security violation, such as theft or violations of personnel security, sensitive information, or local security programs to the appropriate Agency for investigation.

n. Communicate through verbal and written reports to the IHS ISSO through the Area ISSO, if appropriate.

o. Ensure the organization abides by IHS "malicious software" policies and has the required virus detection software, elimination software, and procedures available to protect against these threats. Refer to the HHS AISS Program Handbook for specific "malicious software" protection and reporting requirements.

p. Audit all the systems at least annually and maintain inventories of all software on each individual system to verify only legal copies of software are being used. Requirements for software copyright protection, auditing, and reporting are contained in this chapter and the HHS AISS Program Handbook.

q. Review IT-related procurement specifications for hardware, software, or services to ensure they include adequate security requirements and/or specification commensurate with the sensitivity of the system.

r. Conduct or initiate all activities required for the certification of the system, including preparing the certification and accreditation packages for final approval every 3 years or when major changes occur to the system, whichever occurs first.

s. Coordinate with the Area ISSO or IHS ISSO on issues of mutual interest.

14. Servicing Personnel Security Officer. The Servicing Personnel Security Officer (SPSO) is responsible for processing appropriate completed personnel clearance requests for each designated individual through the Deputy Assistant Secretary for Human Resources. (See HHS Instruction 731-1, Personnel Manual.) The SPSO is also responsible for maintaining a list of encumbered positions, with a corresponding list of clearances and the date each clearance was granted.

15. Privacy Act Officer. Each Privacy Act Officer/Coordinator is responsible for notifying his/her ISSO of developments, deletions, or changes to automated systems of records under the Privacy Act to permit assessment of the continued appropriateness of the system's security level designation and certification/accreditation status.

16. Contracting Officer. Each Contracting Officer is responsible for the following:

a. Ensuring all pertinent AISS requirements specified in this chapter are sufficiently detailed in each solicitation issued and contract awarded.

b. Ensuring the contractor's compliance with these security requirements.

c. Ensuring the pre-certification statements of AISS requirements for successful proposals are signed by both the Project Officer and organization ISSO and are submitted with the proposals.

d. Including a statement in the RFP requiring offerors to present a detailed outline of their present or proposed AISS Program in their proposals.

e. Including a statement in the RFP offerors are required to comply with the Statement of Work and with the requirements of the Departmental AISS Program.

f. Forwarding to the organization ISSO any forms a winning contractor must submit to verify or obtain personnel security clearances.

g. Ensuring the technical evaluation reports either detail any AISS deficiencies or confirm that the proposals are in compliance with the requirements.

17. Headquarters/Area Records Management Officer. Headquarters/Area Records Management Officers are responsible for providing consultation to database managers to ensure record retention schedules are adopted in accordance with IHS guidance and records disposal procedures are undertaken in accordance with the sensitivity of the data.

18. Supervisors. Supervisors are responsible for the following:

a. Ensuring their employees are aware of, and observe all the security requirements of the data, AIS, AIS facilities, Indian Health Service/Tribes/Service or Health Units, and microcomputers they use.

b. Monitoring employee activities to ensure strict compliance with all legal requirements concerning the use of proprietary software, e.g., respecting copyrights and obtaining site licenses.

c. Ensuring only authorized software runs on Government microcomputers and other Government hardware.

19. Users. The primary purpose of an IT system is to support the mission of the using organization.

User management bears a great deal of responsibility for the organization's systems and data. In addition to defining the functions to be performed by the system and its security requirements, the user is directly responsible for the system resources, such as terminals and printers, located within the user's area. In order to ensure adequate security where these resources are located, each user manager will appoint a person to be responsible for the ITS within the user manager's area. This individual is responsible for implementing and enforcing the security program at the user's location. The functions of this person generally parallel those specified for the Area ISSO.

Additionally, each employee of the IHS is responsible for the adequate protection of IT resources within his/her control or possession and for abiding by all HHS and IHS ITS policies. Users are responsible for the following:

a. Assisting in the development of contingency plans. This responsibility particularly involves determining which parts of automated processes can revert to manual processing and which need priority automated processing.

b. Using all of the security measures available to protect application systems and databases.

c. Assisting Application System/Data File Managers in determining the required security level designations for application systems/databases.

d. Assisting Application System Managers in defining security specifications and testing security features of application systems under development or being enhanced.

e. Running application systems/databases only at AIS facilities and I/T/Us are certified at a level of security equal to or higher than the security level designated for their application systems/databases.

f. Implementing specified security safeguards to prevent fraud, waste, or abuse of the hardware, application systems, and data of the microcomputers they are authorized to use.

g. Conforming to security policies and procedures minimize the risk to AIS, AIS facilities, and I/T/Us from malicious software and intrusions. (See Part 8, Chapter 10, "Prevention, Detection, Removal, and Reporting of Malicious Software," IHM, and the HHS AISS Program Handbook Chapter XIII, "Malicious Software and Intrusions.")

H. MAJOR CONTROL AREAS. The IHS is required to establish controls to ensure adequate security for all information processed, transmitted, or stored in its AIS. This section establishes three major management control areas for the IHS ITS program in accordance with the Computer Security Act of 1987 (P.L. 100-235), OMB Circular No. A-130, Appendix III, "Security of Federal Automated Information Resources," the General Accounting Office's "Federal Information System Controls Audit Manual," and the NIST Special PUB 800-26, "Security Self-Assessment Guide for IT Systems." The three IHS ITS major control areas are management, operational, and technical security control.

1. Management Controls. This section emphasizes management controls affecting individual users of IT. Management controls are techniques are normally addressed by management in the organization's computer security program. In general, they focus on the management of the computer security program and of risk within the organization. The IHS management controls provide a centralized structure for reporting procedures and policies as well as provide Area Offices with considerable autonomy in managing their Area security programs. This section identifies a minimum set of management controls required for the IHS ITS program.

a. Security Level Designation. The importance of information is a major factor in determining the goals and objectives of the security requirements and controls that must be implemented. The security level designation of AIS should be determined by considering the requirements for confidentiality, integrity, and availability of the information. Laws, regulations, or policies may establish additional specific requirements.

b. Security Level. The system owner shall designate the security level of the AIS in terms of their information sensitivity and criticality. The security level designation may be low, medium, or high, depending on the need for protection of the data. (See NIST Special PUB 800-18 for further guidance.)

c. Appropriate Use of Government Equipment. All IHS employees are permitted "limited use" of Government office equipment for personal needs if the use does not interfere with official business and involves minimal additional expense to the Government. This privilege to use Government office equipment for non-Government purposes may be revoked or limited at any time by appropriate IHS of HHS officials. (See Part 8, Chapter 6, IHM.)

d. Information Controls. Information controls are management controls placed on the processing and storage of information in the organization. This includes controls placed on the sharing of information, electronic messaging, and the use of software for processing information.

e. Labeling Sensitive and Confidential Data.

i. Media (e.g., diskettes, CDs, printed material, and tapes) used to record and store sensitive information shall be labeled, protected, controlled, and secured when not in actual use.

ii. Media containing sensitive information shall be labeled "Sensitive Information."

iii. Users shall ensure media containing sensitive information are accessed only by persons with a clear "need to know" and proper security level clearance.

iv. When sensitive information is printed, a label identifying its sensitivity shall be displayed at the top of the page. The data owner may enforce additional requirements.

v. Data provided by one Department, Agency, or organization for use by another Department, Agency, or organization shall carry the security level designation assigned by the data owner.

vi. This policy does not cover data deemed "classified" by the US. Government.

(See HHS AISS Program Handbook, Chapter II, Section C4.)

f. Software Copyright Laws. The use of software purchased by the Government is governed by the terms and agreements established by the software vendors and the IHS procurement process. Infringement of software copyrights may constitute theft.

i. All IHS users shall not run unauthorized software programs on IHS computers and shall comply with all copyright requirements.

ii. The legality of software shall be established; it shall then be maintained by surprise audits, as needed.

iii. Requests to authorize a non-standard IHS application for use on IHS information system resources should be made through the appropriate ISC.

g. Use of Freeware or Shareware. Freeware or shareware is software provided free of charge or for a minimum charge and is generally posted on various Web sites and bulletin boards.

i. Only software authorized for business purposes shall be used on Federal computers.

ii. All software shall be officially procured by the IHS.

iii. All IHS users are prohibited from downloading software executables directly from external systems or Web sites to IHS systems without prior approval from the appropriate ISC.

h. Information Sharing. The IHS shall establish a written inter-Agency agreement with each external organization with which information is shared which states the terms and conditions of the information sharing. When information is provided, the written agreements will specify the type of protection required and the procedures for protecting the data.

i. Electronic Messaging. Electronic messaging can take many forms, such as facsimile, e-mail, and other types of Internet access. These forms of communication are intended for official and authorized purposes. The IHS computer systems, networks, and communication devices are provided for use as specified in Section 8-12.1H(1)c, “Appropriate Use of Government Equipment.” Any use perceived to be illegal, harassing, offensive, in violation of other Government policies, or any other use would reflect adversely on the IHS can be the basis for disciplinary action up to and including termination or judicial action. All users are expected to conduct their use of these systems with the same integrity as in face- to-face or telephonic business operations.

i. Every IHS organization shall identify its sensitive electronic data and provide effective and appropriate protection for data to be transmitted electronically.

ii. Electronic communications shall not be used to transmit confidential or sensitive information unless the communications are encrypted. The encryption shall meet the minimum Government standards based on the sensitivity of the data and the requirements of the written agreement between the IHS and the other Agency.

iii. All IHS electronic communications are Government property and IHS officials may access messages whenever there is a legitimate official purpose for such access.

iv. In situations where unclassified but sensitive information must be transmitted to respond to an emergency situation and encryption is not available, the sender shall obtain authorization to transmit the information from the owner of the data and verify the recipient has received the communication after it is transmitted.

j. Information Management.

i. Sensitive data shall only be given to those who have a need to know such data and are cleared to receive the data.

ii. The basis for disclosure of protected health information is informed consent.

iii. Sensitive data shall be secured and protected whenever unauthorized individuals are present, when the data is not in use, and at the close of business.

iv. Very sensitive data or data with restricted access within an office shall be properly labeled (See Section 8-12.1H(1)e, "Labeling Sensitive and Confidential Data") and stored in a locked cabinet or safe, or encrypted or password protected if stored on a computer system. Encryption shall meet the requirements of Section 8-12.1H(3)f, "Encryption."

v. Individually identifiable health information shall not be disclosed without the informed consent of the identified individual(s) except as required by law.

k. Joint Commission on Accreditation of Healthcare Organizations Accreditation and…