Attachment 11 Alaska DHSS Sample Security Authorization.pdf

Attachment 11: Alaska DHSS Sample Security Authorization

1 | P a g e Version 2 TMR September 21, 2018

Reference H - DHSS Sample Security Authorization Package - Moderate Control Set

Purpose of Document This document is based on the NIST 800-53 Revision 4 information security and compliance framework, focusing on NIST 800-66 Revision 1 controls to address moderate level compliance legal requirements, such as HIPAA/HITECH/APIPA. When completed and kept up to date, it helps satisfy many compliance requirements and business needs. For instance, it documents who is responsible for what, what risk DHSS is assuming, how we are mitigating that risk, and how we are ensuring that the documented system or application will have the confidentiality, integrity, and availability you need to help you get your job done.

This document provides a list of some of the data required to complete a DHSS RSA Archer authorization package, also known as a security plan. DHSS uses the RSA Archer GRC Assessment and Authorization web application to automate the process. It is configured by the State of Alaska Department of Health and Social Services and is updated as needed. This document is provided as an example of the type of data requested, but it is not an exact representation of all data required by the DHSS Archer web application as configured today.

2 | P a g e Version 2 TMR September 21, 2018

Controls Purpose of Document

1. Information System Name/Title:

2. Information System Categorization:

3. Contact Information:

4. Information System Operational Status:

5. Information System Type:

6. General System Description/Purpose:

7. System Environment:

8. Privacy Threshold Analysis

9. System Interconnections/Information Sharing:

10. Related Laws/Regulations/Policies:

11. Minimum Security Controls

AC-01: ACCESS CONTROL POLICY AND PROCEDURES

AC-02: ACCOUNT MANAGEMENT

AC-03: ACCESS ENFORCEMENT

AC-04: INFORMATION FLOW ENFORCEMENT

AC-05: SEPARATION OF DUTIES

AC-11: SESSION LOCK

AC-12: SESSION TERMINATION

AC-17: REMOTE ACCESS

AC-19: ACCESS CONTROL FOR MOBILE DEVICES

AT-01: SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES

AT-02: SECURITY AWARENESS TRAINING

AT-03: ROLE-BASED SECURITY TRAINING

AT-04: SECURITY TRAINING RECORDS

AU-01: AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

AU-02: AUDIT EVENTS

AU-03: CONTENT OF AUDIT RECORDS

AU-04: AUDIT STORAGE CAPACITY

AU-06: AUDIT REVIEW, ANALYSIS, AND REPORTING

3 | P a g e Version 2 TMR September 21, 2018

AU-07: AUDIT REDUCTION AND REPORT GENERATION

AU-11: AUDIT RECORD RETENTION

CA-01: SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND PROCEDURES

CA-02: SECURITY ASSESSMENTS

CA-03: SYSTEM INTERCONNECTIONS

CA-06: SECURITY AUTHORIZATION

CA-07: CONTINUOUS MONITORING

CM-08: INFORMATION SYSTEM COMPONENT INVENTORY

CP-01: CONTINGENCY PLANNING POLICY AND PROCEDURES

CP-02: CONTINGENCY PLAN

CP-03: CONTINGENCY TRAINING

CP-04: CONTINGENCY PLAN TESTING

CP-06: ALTERNATE STORAGE SITE

CP-07: ALTERNATE PROCESSING SITE

CP-08: TELECOMMUNICATIONS SERVICES

CP-09: INFORMATION SYSTEM BACKUP

CP-10: INFORMATION SYSTEM RECOVERY AND RECONSTITUTION

IA-02: IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)

IA-03: DEVICE IDENTIFICATION AND AUTHENTICATION

IA-04: IDENTIFIER MANAGEMENT

IA-05: AUTHENTICATOR MANAGEMENT

IA-06: AUTHENTICATOR FEEDBACK

IR-01: INCIDENT RESPONSE POLICY AND PROCEDURES

IR-02: INCIDENT RESPONSE TRAINING

IR-03: INCIDENT RESPONSE TESTING

IR-04: INCIDENT HANDLING

IR-05: INCIDENT MONITORING

IR-06: INCIDENT REPORTING

IR-07: INCIDENT RESPONSE ASSISTANCE

MA-01: SYSTEM MAINTENANCE POLICY AND PROCEDURES

MA-02: CONTROLLED MAINTENANCE

MA-05: MAINTENANCE PERSONNEL

MA-06: TIMELY MAINTENANCE

4 | P a g e Version 2 TMR September 21, 2018

MP-01: MEDIA PROTECTION POLICY AND PROCEDURES

MP-04: MEDIA STORAGE

MP-05: MEDIA TRANSPORT

MP-06: MEDIA SANITIZATION

PE-01: PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY AND PROCEDURES

PE-02: PHYSICAL ACCESS AUTHORIZATIONS

PE-03: PHYSICAL ACCESS CONTROL

PE-04: ACCESS CONTROL FOR TRANSMISSION MEDIUM

PE-05: ACCESS CONTROL FOR OUTPUT DEVICES

PE-06: MONITORING PHYSICAL ACCESS

PE-08: VISITOR ACCESS RECORDS

PE-17: ALTERNATE WORK SITE

PE-18: LOCATION OF INFORMATION SYSTEM COMPONENTS

PL-01: SECURITY PLANNING POLICY AND PROCEDURES

PL-02: SYSTEM SECURITY PLAN

PS-01: PERSONNEL SECURITY POLICY AND PROCEDURES

PS-02: POSITION RISK DESIGNATION

PS-03: PERSONNEL SCREENING

PS-04: PERSONNEL TERMINATION

PS-05: PERSONNEL TRANSFER

PS-06: ACCESS AGREEMENTS

PS-07: THIRD-PARTY PERSONNEL SECURITY

PS-08: PERSONNEL SANCTIONS

RA-01: RISK ASSESSMENT POLICY AND PROCEDURES

RA-02: SECURITY CATEGORIZATION

RA-03: RISK ASSESSMENT

SA-04: ACQUISITION PROCESS

SA-09: EXTERNAL INFORMATION SYSTEM SERVICES

SC-08: TRANSMISSION CONFIDENTIALITY AND INTEGRITY

SC-12: CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

SI-01: SYSTEM AND INFORMATION INTEGRITY POLICY AND PROCEDURES

SI-03: MALICIOUS CODE PROTECTION

SI-04: INFORMATION SYSTEM MONITORING

5 | P a g e Version 2 TMR September 21, 2018

SI-05: SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

SI-07: SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

SI-08: SPAM PROTECTION

SI-10: INFORMATION INPUT VALIDATION

PM-15: CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS

Appendix A – Acronyms and Abbreviations

6 | P a g e Version 2 TMR September 21, 2018

1. Information System Name/Title:

Authorization Package Name:

Acronym:

2. Information System Categorization:

Security Category: Low/Moderate/High

3. Contact Information:

Name, Title, Email, Phone for:

• Program Manager:

• Security Control Assessor:

• Information Owner:

• Other Contacts:

• Security Designee:

• Vendor Contact(s):

• Technical Contact(s) (TC):

• Authorizing Officials: 1) DHSS CSO, 2) DHSS DTO, 3) DHSS Division Director

4. Information System Operational Status:

Operational Status: Production/In Development Financial System: Yes/No Critical Infrastructure: Yes/No Mission Critical: Yes/No FISMA Reportable: Yes/No

5. Information System Type:

Information System Type: System/Application

6. General System Description/Purpose:

Program Staff Description of Mission or Purpose

7 | P a g e Version 2 TMR September 21, 2018

7. System Environment:

Business Process Diagram Boundary Description Boundary Diagram Network Diagram Data Flow Diagram Software List Hardware List Database List Copy of last vulnerability scan Copy of last code scan Patching and support information Regular maintenance window schedule

8. Privacy Threshold Analysis

• PTA:1: Select an Information System status

• PTA-2: Does the Information System collect, maintain, use or disseminate personally identifiable information on any of the following parties?

• PTA-3: Does the Information System intend to collect, generate or retain any of the following information is considered PII , PHI, CJIS or confidential on individuals: (Please check all that apply).

• PTA-4: Does the Information System use or collect Social Security Numbers (SSNs)? This includes truncated SSNs (e.g. last 4 digits).

• PTA-5: Does the system connect, receive, or share information with any other Information System?

• PTA-6: Does the Information System connect, receive or share information with any external systems?

• PTA-7: Are there regular (i.e. periodic, recurring, etc.) data extractions from the Information System?

• PTA-8: Who has access to your system that is not a workforce member of DHSS such as other State

Departments, Grantees, Providers, Public, etc?

• PTA-9: What procedures are in place to determine which users may access the information and how does the project determine who has access?

• PTA-10: How does the project team review information sharing agreements, MOUs, new uses of the information, new access to the system by organizations within the department and outside?

8 | P a g e Version 2 TMR September 21, 2018

9. System Interconnections/Information Sharing:

10. Related Laws/Regulations/Policies:

Alaska Statutes DHSS Policies HIPAA/HITECH (EPHI) CJIS Security Policy

Federal Statutes SoA Policies IRS PUB 1075 (FTI) PCI DSS

Alaska Personal Information Protection Act (PI)

CMS MARS-E Other

Interconnection Name

Type Date of

Agreement Connecting Third Party

Connecting Information

System

Connecting System Security Category

Connecting Authorization

Decision

9 | P a g e Version 2 TMR September 21, 2018

11. Minimum Security Controls

TABLE 1: SECURITY CONTROL IDENTIFIERS AND FAMILY NAMES

ID FAMILY ID FAMILY

AC Access Control MP Media Protection AT Awareness and Training PE Physical and Environmental Protection AU Audit and Accountability PL Planning CA Security Assessment and Authorization PS Personnel Security CM Configuration Management RA Risk Assessment CP Contingency Planning SA System and Services Acquisition IA Identification and Authentication SC System and Communications Protection IR Incident Response SI System and Information Integrity MA Maintenance PM Program Management

AC-01: ACCESS CONTROL POLICY AND PROCEDURES

Number

AC-01

Family Access Control

Name

ACCESS CONTROL POLICY AND PROCEDURES

Baseline Low; Moderate; High

Description The organization:

a. Develops, documents, and disseminates to applicable personnel:

1. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

2. Procedures to facilitate the implementation of the access control policy and associated access controls; and

b. Reviews and updates the current:

1. Access control policy (as necessary) within every three hundred sixty-five (365) days; and

2. Access control procedures (as necessary) within every three hundred sixty-five (365) days.

10 | P a g e Version 2 TMR September 21, 2018

NIST Guidance This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

Related control: PM-9.

References: NIST Special Publications 800-12, 800-100.

DHSS Guidance

System Response <Response Here>

AC-02: ACCOUNT MANAGEMENT

Number

AC-02

Family Access Control

Name

ACCOUNT MANAGEMENT

Baseline Low; Moderate; High

Description The organization:

a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: individual, group, system, application, guest/anonymous, emergency, and temporary;

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

11 | P a g e Version 2 TMR September 21, 2018

d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e. Requires approvals by defined personnel or roles for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system accounts in accordance with organizational standards and procedures;

g. Monitors the use of, information system accounts;

h. Notifies account managers:

1. When accounts are no longer required;

2. When users are terminated or transferred; and

3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements within every one hundred eighty (180) days; and

k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

NIST Guidance Information system account types include, for example, individual, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. Some of the account management requirements listed above can be implemented by organizational information systems. The identification of authorized users of the information system and the specification of access privileges reflects the requirements in other security controls in the security plan. Users requiring administrative privileges on information system accounts receive additional scrutiny by appropriate organizational personnel (e.g., system owner, mission/business owner, or chief information security officer) responsible for approving such accounts and privileged access. Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. Other attributes required for authorizing access include, for example, restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., scheduled maintenance, system upgrades) and mission/business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements). Failure to consider these factors could affect information system availability. Temporary and emergency accounts are accounts intended for short-term use. Organizations establish temporary accounts as a

12 | P a g e Version 2 TMR September 21, 2018 part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts (e.g., local logon accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include, for example: (i) when shared/group, emergency, or temporary accounts are no longer required; or (ii) when individuals are transferred or terminated. Some types of information system accounts may require specialized training.

Related controls: AC-3, AC-4, AC-5, AC-6, AC-10, AC-17, AC-19, AC-20, AU-9, IA-2, IA-4, IA-5, IA-8, CM-5, CM-6, CM-11, MA-3, MA-4, MA-5, PL-4, SC-13.

References: None.

DHSS Guidance

System Response <Response Here>

AC-03: ACCESS ENFORCEMENT

Number

AC-03

Family Access Control

Name

ACCESS ENFORCEMENT

Baseline Low; Moderate; High

Description The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

NIST Guidance Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, domains) in information systems. In addition to enforcing authorized access at the information system level and recognizing that information systems can host many applications and

13 | P a g e Version 2 TMR September 21, 2018 services in support of organizational missions and business operations, access enforcement mechanisms can also be employed at the application and service level to provide increased information security.

Related controls: AC-2, AC-4, AC-5, AC-6, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AU-9, CM-5, CM-6, CM-11, MA-3, MA-4, MA-5, PE-3.

References: None.

DHSS Guidance

System Response <Response Here>

AC-04: INFORMATION FLOW ENFORCEMENT

Number

AC-04

Family Access Control

Name

INFORMATION FLOW ENFORCEMENT

Baseline Moderate; High

Description The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on applicable policy.

NIST Guidance Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information. Flow control restrictions include, for example, keeping export-controlled information from being transmitted in the clear to the Internet, blocking outside traffic that claims to be from within the organization, restricting web requests to the Internet that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between information systems representing different security domains with different security policies introduces risk that such transfers violate one or more domain security policies. In such situations, information owners/stewards provide guidance at designated policy enforcement points between interconnected systems. Organizations consider mandating specific architectural solutions when required to enforce specific security policies. Enforcement includes, for example: (i) prohibiting information transfers between interconnected systems (i.e., allowing access only); (ii) employing hardware mechanisms to

14 | P a g e Version 2 TMR September 21, 2018 enforce one-way information flows; and (iii) implementing trustworthy regrading mechanisms to reassign security attributes and security labels.

Organizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations (e.g., networks, individuals, and devices) within information systems and between interconnected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices (e.g., gateways, routers, guards, encrypted tunnels, firewalls) that employ rule sets or establish configuration settings that restrict information system services, provide a packet-filtering capability based on header information, or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Organizations also consider the trustworthiness of filtering/inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Control enhancements 3 through 22 primarily address cross-domain solution needs which focus on more advanced filtering techniques, in-depth analysis, and stronger flow enforcement mechanisms implemented in cross-domain products, for example, high-assurance guards. Such capabilities are generally not available in commercial off-the-shelf information technology products.

Related controls: AC-3, AC-17, AC-19, AC-21, CM-6, CM-7, SA-8, SC-2, SC-5, SC-7, SC-18.

References: Web: ucdmo.gov.

DHSS Guidance

System Response <Response Here>

AC-05: SEPARATION OF DUTIES

Number

AC-05

Family Access Control

Name

SEPARATION OF DUTIES

Baseline Moderate; High

Description The organization:

a. Separates duties of individuals as necessary to prevent malevolent activity without collusion;

b. Documents separation of duties of individuals; and

15 | P a g e Version 2 TMR September 21, 2018

c. Defines information system access authorizations to support separation of duties.

NIST Guidance Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes, for example: (i) dividing mission functions and information system support functions among different individuals and/or roles; (ii) conducting information system support functions with different individuals (e.g., system management, programming, configuration management, quality assurance and testing, and network security); and (iii) ensuring security personnel administering access control functions do not also administer audit functions.

Related controls: AC-3, AC-6, PE-3, PE-4, PS-2.

References: None.

DHSS Guidance

System Response <Response Here>

Number

AC-06

Family Access Control

Name

LEAST PRIVILEGE

Baseline Moderate; High

Description The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

NIST Guidance Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege.

Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.

Related controls: AC-2, AC-3, AC-5, CM-6, CM-7, PL-2.

16 | P a g e Version 2 TMR September 21, 2018

References: None.

DHSS Guidance

System Response <Response Here>

AC-11: SESSION LOCK

Number

AC-11

Family Access Control

Name

SESSION LOCK

Baseline Moderate; High

Description The information system:

a. Prevents further access to the system by initiating a session lock after fifteen (15) minutes of inactivity or upon receiving a request from a user; and

b. Retains the session lock until the user reestablishes access using established identification and authentication procedures.

NIST Guidance Session locks are temporary actions taken when users stop work and move away from the immediate vicinity of information systems but do not want to log out because of the temporary nature of their absences. Session locks are implemented where session activities can be determined. This is typically at the operating system level, but can also be at the application level. Session locks are not an acceptable substitute for logging out of information systems, for example, if organizations require users to log out at the end of workdays.

Related control: AC-7.

References: OMB Memorandum 06-16.

DHSS Guidance

17 | P a g e Version 2 TMR September 21, 2018

AC-12: SESSION TERMINATION

Number

AC-12

Family Access Control

Name

SESSION TERMINATION

Baseline Moderate; High

Description The information system automatically terminates a user session after fifteen (15) minutes of inactivity.

NIST Guidance This control addresses the termination of user-initiated logical sessions in contrast to SC-10 which addresses the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination terminates all processes associated with a user's logical session except those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events requiring automatic session termination can include, for example, organization-defined periods of user inactivity, targeted responses to certain types of incidents, time-of-day restrictions on information system use.

Related controls: SC-10, SC-23.

References: None.

DHSS Guidance

System Response <Response Here>

AC-17: REMOTE ACCESS

Number

AC-17

Family Access Control

18 | P a g e Version 2 TMR September 21, 2018

REMOTE ACCESS

Baseline Low; Moderate; High

Description The organization:

a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

b. Authorizes remote access to the information system prior to allowing such connections.

NIST Guidance Remote access is access to organizational information systems by users (or processes acting on behalf of users) communicating through external networks (e.g., the Internet). Remote access methods include, for example, dial-up, broadband, and wireless. Organizations often employ encrypted virtual private networks (VPNs) to enhance confidentiality and integrity over remote connections. The use of encrypted VPNs does not make the access non-remote; however, the use of VPNs, when adequately provisioned with appropriate security controls (e.g., employing appropriate encryption techniques for confidentiality and integrity protection) may provide sufficient assurance to the organization that it can effectively treat such connections as internal networks. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. Also, VPNs with encrypted tunnels can affect the organizational capability to adequately monitor network communications traffic for malicious code. Remote access controls apply to information systems other than public web servers or systems designed for public access. This control addresses authorization prior to allowing remote access without specifying the formats for such authorization. While organizations may use interconnection security agreements to authorize remote access connections, such agreements are not required by this control. Enforcing access restrictions for remote connections is addressed in

AC-3.

Related controls: AC-2, AC-3, AC-18, AC-19, AC-20, CA-3, CA-7, CM-8, IA-2, IA-3, IA-8, MA-4, PE-17, PL-4, SC-10, SI-4.

References: NIST Special Publications 800-46, 800-77, 800-113, 800-114, 800-121.

DHSS Guidance

System Response <Response Here>

AC-19: ACCESS CONTROL FOR MOBILE DEVICES

AC-19

19 | P a g e Version 2 TMR September 21, 2018

Access Control

Name

ACCESS CONTROL FOR MOBILE DEVICES

Baseline Low; Moderate; High

Description The organization:

a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

b. Authorizes the connection of mobile devices to organizational information systems.

NIST Guidance A mobile device is a computing device that: (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable or removable data storage; and (iv) includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the device to capture information, and/or built-in features for synchronizing local data with remote locations.

Examples include smart phones, E-readers, and tablets. Mobile devices are typically associated with a single individual and the device is usually in close proximity to the individual; however, the degree of proximity can vary depending upon on the form factor and size of the device. The processing, storage, and transmission capability of the mobile device may be comparable to or merely a subset of desktop systems, depending upon the nature and intended purpose of the device. Due to the large variety of mobile devices with different technical characteristics and capabilities, organizational restrictions may vary for the different classes/types of such devices. Usage restrictions and specific implementation guidance for mobile devices include, for example, configuration management, device identification and authentication, implementation of mandatory protective software (e.g., malicious code detection, firewall), scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware (e.g., wireless, infrared).

Organizations are cautioned that the need to provide adequate security for mobile devices goes beyond the requirements in this control. Many safeguards and countermeasures for mobile devices are reflected in other security controls in the catalog allocated in the initial control baselines as starting points for the development of security plans and overlays using the tailoring process. There may also be some degree of overlap in the requirements articulated by the security controls within the different families of controls. AC-20 addresses mobile devices that are not organization-controlled.

Related controls: AC-3, AC-7, AC-18, AC-20, CA-9, CM-2, IA-2, IA-3, MP-2, MP-4, MP-5, PL-4, SC-7, SC-43, SI-3, SI- 4.

20 | P a g e Version 2 TMR September 21, 2018

References: OMB Memorandum 06-16; NIST Special Publications 800-114, 800-124, 800-164.

DHSS Guidance

System Response <Response Here>

AT-01: SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES

Number

AT-01

Family Awareness and Training

Name

SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES

Baseline Low; Moderate; High

Description The organization:

a. Develops, documents, and disseminates to applicable personnel:

1. A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

2. Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and

b. Reviews and updates the current:

1. Security awareness and training policy within every three hundred sixty-five (365) days; and

2. Security awareness and training procedures within every three hundred sixty-five (365) days.

NIST Guidance This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AT family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

21 | P a g e Version 2 TMR September 21, 2018

Related control: PM-9.

References: NIST Special Publications 800-12, 800-16, 800-50, 800-100.

DHSS Guidance

System Response <Response Here>

AT-02: SECURITY AWARENESS TRAINING

Number

AT-02

Family Awareness and Training

Name

SECURITY AWARENESS TRAINING

Baseline Low; Moderate; High

Description The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):

a. As part of initial training for new users;

b. When required by information system changes; and

c. Within every three hundred sixty-five (365) days thereafter.

NIST Guidance Organizations determine the appropriate content of security awareness training and security awareness techniques based on the specific organizational requirements and the information systems to which personnel have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security. Security awareness techniques can include, for example, displaying posters, offering supplies inscribed with security reminders, generating email advisories/notices from senior organizational officials, displaying logon screen messages, and conducting information security awareness events.

Related controls: AT-3, AT-4, PL-4.

References: C.F.R. Part 5 Subpart C (5 C.F.R 930.301); Executive Order 13587; NIST Special Publication 800-50.

22 | P a g e Version 2 TMR September 21, 2018

System Response <Response Here>

AT-03: ROLE-BASED SECURITY TRAINING

Number

AT-03

Family Awareness and Training

Name

ROLE-BASED SECURITY TRAINING

Baseline Low; Moderate; High

Description The organization provides role-based security training to personnel with assigned security roles and responsibilities:

a. Before authorizing access to the information system or performing assigned duties;

b. When required by information system changes; and

c. Within every three hundred sixty-five (365) days thereafter.

NIST Guidance Organizations determine the appropriate content of security training based on the assigned roles and responsibilities of individuals and the specific security requirements of organizations and the information systems to which personnel have authorized access. In addition, organizations provide enterprise architects, information system developers, software developers, acquisition/procurement officials, information system managers, system/network administrators, personnel conducting configuration management and auditing activities, personnel performing independent verification and validation activities, security control assessors, and other personnel having access to system-level software, adequate security-related technical training specifically tailored for their assigned duties. Comprehensive role-based training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical safeguards and countermeasures. Such training can include for example, policies, procedures, tools, and artifacts for the organizational security roles defined. Organizations also provide the training necessary for individuals to carry out their responsibilities related to operations and supply chain security within the context of organizational information security programs. Role-based security training also applies to contractors providing services to federal agencies.

Related controls: AT-2, AT-4, PL-4, PS-7, SA-3, SA-12, SA-16.

23 | P a g e Version 2 TMR September 21, 2018

References: C.F.R. Part 5 Subpart C (5 C.F.R. 930.301); NIST Special Publications 800-16, 800-50.

DHSS Guidance

System Response <Response Here>

AT-04: SECURITY TRAINING RECORDS

Number

AT-04

Family Awareness and Training

Name

SECURITY TRAINING RECORDS

Baseline Low; Moderate; High

Description The organization:

a. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

b. Retains individual training records for a minimum of five (5) years.

NIST Guidance Documentation for specialized training may be maintained by individual supervisors at the option of the organization.

Related controls: AT-2, AT-3, PM-14.

References: None.

DHSS Guidance

System Response <Response Here>

AU-01: AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

AU-01

24 | P a g e Version 2 TMR September 21, 2018

Audit and Accountability

Name

AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

Baseline Low; Moderate; High

Description The organization:

a. Develops, documents, and disseminates to applicable personnel:

1. An audit and accountability policy that addresses purpose, people, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

2. Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and

b. Reviews and updates the current:

1. Audit and accountability policy within every three hundred sixty-five (365) days; and

2. Audit and accountability procedures within every three hundred sixty-five (365) days.

NIST Guidance This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AU family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

Related control: PM-9.

References: NIST Special Publications 800-12, 800-100.

DHSS Guidance

25 | P a g e Version 2 TMR September 21, 2018

AU-02: AUDIT EVENTS

Number

AU-02

Family Audit and Accountability

Name

AUDIT EVENTS

Baseline Low; Moderate; High

Description The organization:

a. Determines that the information system is capable of auditing the following events:

1. Server alerts and error messages;

2. Log onto system;

3. Log off system;

4. Change of password;

5. All system administrator commands, while logged on as system administrator;

6. Switching accounts or running privileged actions from another account, (e.g., Linux/UNIX SU or Windows RunAs);

7. Creation or modification of super-user groups;

8. Subset of security administrator commands, while logged on in the security administrator role;

9. Subset of system administrator commands, while logged on in the user role;

10. Clearing of the audit log file;

11. Startup and shutdown of audit functions;

12. Use of identification and authentication mechanisms (e.g., user ID and password);

13. Change of file or user permissions or privileges (e.g., use of suid/guid, chown, su);

14. Remote access outside of the corporate network communication channels (e.g., modems, dedicated Virtual Private Network) and all dial-in access to the system;

26 | P a g e Version 2 TMR September 21, 2018

15. Changes made to an applications or database by a batch file;

16. Application-critical record changes;

17. Changes to database or application records, where the application has been bypassed to produce the change (via a file or other database utility);

18. User log-on and log-off (successful or unsuccessful);

19. System shutdown and reboot;

20. System errors;

21. Application shutdown;

22. Application restart;

23. Application errors;

24. Security policy modifications; and

25. Printing sensitive information;

b. Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events;

c. Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and

d. Determines that the following events are to be audited within the information system: All applicable events listed under AU-02 a, audited on a continuous basis or in response to specific situations as appropriate based on current threat information and ongoing assessment of risk.

NIST Guidance An event is any observable occurrence in an organizational information system. Organizations identify audit events as those events which are significant and relevant to the security of information systems and the environments in which those systems operate in order to meet specific and ongoing audit needs. Audit events can include, for example, password changes, failed logons, or failed accesses related to information systems, administrative privilege usage, PIV credential usage, or third-party credential usage. In determining the set of auditable events, organizations consider the auditing appropriate for each of the security controls to be implemented. To balance auditing requirements with other information system needs, this control also requires identifying that subset of auditable events that are audited at a given point in time. For example, organizations may determine that information systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Auditing requirements, including the need for auditable events, may be referenced in other security controls and control enhancements. Organizations also include auditable events that are required by applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Audit records can

27 | P a g e Version 2 TMR September 21, 2018 be generated at various levels of abstraction, including at the packet level as information traverses the network.

Selecting the appropriate level of abstraction is a critical aspect of an audit capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of auditable events, the auditing necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented architectures.

Related controls: AC-6, AC-17, AU-3, AU-12, MA-4, MP-2, MP-4, SI-4.

References: NIST Special Publication 800-92; Web: csrc.nist.gov/pcig/cig.html, idmanagement.gov.

DHSS Guidance

AU-03: CONTENT OF AUDIT RECORDS

AU-03

Family Audit and Accountability

Name

CONTENT OF AUDIT RECORDS

Baseline Low; Moderate; High

Description The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

NIST Guidance Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred).

Related controls: AU-2, AU-8, AU-12, SI-11.

28 | P a g e Version 2 TMR September 21, 2018

References: None.

DHSS Guidance

AU-04: AUDIT STORAGE CAPACITY

AU-04

Family Audit and Accountability

Name

AUDIT STORAGE CAPACITY

Baseline Low; Moderate; High

Description The organization allocates audit record storage capacity in accordance with reducing the likelihood that storage capacity will be exceeded.

NIST Guidance Organizations consider the types of auditing to be performed and the audit processing requirements when allocating audit storage capacity. Allocating sufficient audit storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of auditing capability.

Related controls: AU-2, AU-5, AU-6, AU-7, AU-11, SI-4.

References: None.

DHSS Guidance

System Response <Response Here>

AU-06: AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-06

29 | P a g e Version 2 TMR September 21, 2018

Audit and Accountability

Name

AUDIT REVIEW, ANALYSIS, AND REPORTING

Baseline Low; Moderate; High

Description The organization:

a. Reviews and analyzes information system audit records regularly for indications of inappropriate or unusual activity; and

b. Reports findings to the Department Chief Security Officer.

NIST Guidance Audit review, analysis, and reporting covers information security-related auditing performed by organizations including, for example, auditing that results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of VoIP.

Findings can be reported to organizational entities that include, for example, incident response team, help desk, information security group/department. If organizations are prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), the review/analysis may be carried out by other organizations granted such authority.

Related controls: AC-2, AC-3, AC-6, AC-17, AT-3, AU-7, AU-16, CA-7, CM-5, CM-10, CM-11, IA-3, IA-5, IR-5, IR-6, MA-4, MP-4, PE-3, PE-6, PE-14, PE-16, RA-5, SC-7, SC-18, SC-19, SI-3, SI-4, SI-7.

References: None.

DHSS Guidance

System Response <Response Here>

AU-07: AUDIT REDUCTION AND REPORT GENERATION

Number

AU-07

Audit and Accountability

30 | P a g e Version 2 TMR September 21, 2018

AUDIT REDUCTION AND REPORT GENERATION

Baseline Moderate; High

Description The information system provides an audit reduction and report generation capability that:

a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and

b. Does not alter the original content or time ordering of audit records.

NIST Guidance Audit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. Audit reduction and report generation capabilities do not always emanate from the same information system or from the same organizational entities conducting auditing activities. Audit reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the information system can generate customizable reports. Time ordering of audit records can be a significant issue if the granularity of the timestamp in the record is insufficient.

Related control: AU-6.

References: None.

DHSS Guidance

AU-11: AUDIT RECORD RETENTION

AU-11

Family Audit and Accountability

Name

AUDIT RECORD RETENTION

Baseline Moderate; High

31 | P a g e Version 2 TMR September 21, 2018

Description The organization retains audit records for at least ninety (90) days and archives old records for six (6) years to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

NIST Guidance Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention.

Related controls: AU-4, AU-5, AU-9, MP-6.

References: None.

DHSS Guidance

32 | P a g e Version 2 TMR September 21, 2018

CA-01: SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND PROCEDURES

Number

CA-01

Family Security Assessment and Authorization

Name

SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND PROCEDURES

Baseline Low; Moderate; High

Description The organization:

a. Develops, documents, and disseminates to applicable personnel:

1. A security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

2. Procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls; and

b. Reviews and updates the current:

1. Security assessment and authorization policy within three hundred sixty-five (365) days; and

2. Security assessment and authorization procedures within three hundred sixty-five (365) days.

NIST Guidance This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the CA family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

Related control: PM-9.

References: NIST Special Publications 800-12, 800-37, 800-53A, 800-100.

33 | P a g e Version 2 TMR September 21, 2018

System Response <Response Here>

CA-02: SECURITY ASSESSMENTS

Number

CA-02

Family Security Assessment and Authorization

Name

SECURITY ASSESSMENTS

Baseline Low; Moderate; High

Description The organization:

a. Develops a security assessment plan that describes the scope of the assessment including:

1. Security controls and control enhancements under assessment;

2. Assessment procedures to be used to determine security control…