Attachment 8_Additional Security Info for Air-Gapped MOU.docx
DOCX document 39 KB Posted
- Solicitation number
- 36C25524Q0065-2
About this file
This document is Attachment 8, which provides additional security information requirements for air-gapped Memorandum of Understanding (MOU) specifically related to VA-provided internet access services. The document serves as a template for security implementation requirements.
The attachment outlines specific security parameters including implementation of advisory banners, security and content filtering solutions, physical security controls, and audit trail responsibilities. Key requirements include maintaining audit logs for one year, implementing user agreements and access controls in domiciliary settings, and establishing security logging parameters to capture user activity. The document requires documentation of physical security measures like locked doors and CCTV cameras, and mandates review of audit logs at specified intervals. While this is an appendix template, it does not specify products or services to be procured, but rather provides security guidelines that must be followed for VA internet access implementations.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Appendix F: Additional Security Information for Air-Gapped MOU For VA Provided Internet Access Section 1.4.1 Security
1.4.1. Security
The parties agree to work together to ensure the security of [Organization 1].
System Security Considerations and Parameters for VA wired and/or wireless public Internet access services.
Complete this section for any wired and/or wireless public Internet access services. These are often paid for by local charitable organizations or by the facility but are not connected to the VA Network. Remove section 1.4.1.1 and 1.4.1.2 if it does not apply.
· Advisory Banner Implementation:
Insert a screen shot of advisory banner. Approved public banners and guidance are located in VA Handbooks 6102 and 6500.
Implementation Guidance
The Information System Owner, local Chief Information Officer (CIO), or designee must select and configure the operating system to display a warning banner screen (or close approximation) at log in, and require users to electronically acknowledge the warning, such as clicking an “OK” or “I agree” button to proceed. Banners can also be posted in the physical location of the network and/or user sign-in sheets.
Banner/User Agreement: See the OIS portal > FSS > Document Library > MOU ISA Templates for banner examples. Edit the examples to best suit the needs of the site.
· Identify Security Solutions and Content Filtering Solutions:
Document security solutions and content filtering solutions used to mitigate risk. Include the identification of the application (Surf Control, etc.) and selected content filtering options. Changes can be made as necessary based upon audit log review results.
· Identify Physical Security Controls:
Document what physical security controls are used to protect the wired and/or wireless Internet public Internet. (Examples are locked doors, CCTV Cameras, or VA Security Points of Contact ((POC(s)) for monitoring user activities. Computers may also be positioned in a location where the site manager may monitor computer activities. Document the location of the Physical security controls in Appendix E.
· Additional Requirements for Domiciliary Settings, Access Control Implementation:
For domiciliary settings, implement user agreements, advisory banners, access controls including user name and password. (This may be implemented as a physical login book)
Audit Trail Responsibilities The information system provides the capability for authorized users to capture/record and log content related to a user session. Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention.
· Security Logging Parameters: Explain what and how the logs are captured and maintained. What information is logged (i.e. access controls, users, duration, search/URL history, and login attempts).
· Audit Log(s) Review: Provide the frequency that the audit log will be reviewed by the VA.
· Audit Log Storage - Log files must be maintained for a one-year period: Identify how and where the audit logs are stored.
The facility may implement these services through existing Internet service provider and the service provider must be able to provide log file as requested for investigation.
Signatories:
[VA Organization 1] System Owner:
[Name of [VA Organization 1] ’s System Owner] [Job Title of [VA Organization 1] ’s System Owner]
X__________________________ Date __________
[VA Organization 1] Business Owner:
[Name of [VA Organization 1] ’s Business Owner] [Job Title of [VA Organization 1] ’s Business Owner]
X__________________________ Date __________ image1.gif
File details come from the government source that posted it. Updated .