Attachment C - Cloud Security Architecture and Privacy Requirements_Framework.xlsx
XLSX spreadsheet 167 KB Posted
- Solicitation number
- 36C10B23Q0393
About this file
This document contains a government file outlining cloud security architecture and privacy requirements for the Department of Veterans Affairs. It details requirements across several domains including governance, protection, detection, response and recovery. Key requirements include developing cloud security policies and strategies, defining roles and responsibilities, establishing secure configurations, implementing identity and access management controls, performing security assessments, monitoring the physical and network environment, responding to cyber incidents, and ensuring continuity of operations. The related federal contract opportunity is for enterprise security architecture support services to assist the VA in addressing requirements outlined in the government file. The solicitation number is 36C10B23Q0393 from the Department of Veterans Affairs Technology Acquisition Center in Austin, Texas. Services will focus on governance, risk, compliance and security operations management to help secure the agency's cloud environment.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 36C10B23Q0393_1.docx | DOCX document | |
| 36C10B23Q0393.docx | DOCX document | |
| Attachment G - VA ESAF_v1_20210624.docx | DOCX document | |
| Attachment F - NIST.SP.800-207 ZTA.pdf | ||
| Attachment E - VA VIP_Guide_3_2.pdf | ||
| Attachment A - Cloud_Security_Architecture_Security_Patterns.pdf | ||
| Attachment B - Enterprise_Cloud Security Architecture Strategy.docx | DOCX document | |
| Attachment D - VA OIG-18-02127-64 Audit and Evaluation.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
EXECUTIVE SUMMARY
MAP TO NIST CSF
| VA Cloud Security Function | VA Cloud Security Capability | Asset Management (ID.AM) | Governance (ID.GV) | Risk Assessment (ID.RA) | Risk Management Strategy (ID.RM) | Access Control (PR.AC) | Awareness and Training (PR.AT) | Data Security (PR.DS) | Information Protection Processes and Procedures (PR.IP) | Maintenance (PR.MA) | Protective Technology (PR.PT) | Anomalies and Events (DE.AE) | Security Continuous Monitoring (DE.CM) | Detection Processes (DE.DP) | Response Planning (RS.RP) | Communications (RS.CO) | Analysis (RS.AN) | Improvements (RS.IM) | Recovery Planning (RC.RP) | Improvements (RC.IM) | Communications (RC.CO) |
| IDENTIFY | PROTECT | DETECT | RESPOND | RECOVER | |||||||||||||||||
| GOVERN | 1. Understand the Mission | X | X | X | |||||||||||||||||
| 2. Understand the Environment | X | X | X | X | |||||||||||||||||
| 3. IA Policy and Engagement | X | ||||||||||||||||||||
| 4. Portfolio Management | X | ||||||||||||||||||||
| 5. Acquisition | X | ||||||||||||||||||||
| 6. Secure Lifecycle Management | X | ||||||||||||||||||||
| 7. IA Training | X | ||||||||||||||||||||
| PROTECT | 8. Physical Protection | X | X | ||||||||||||||||||
| 9. Network Security | X | X | |||||||||||||||||||
| 10. Hardware and Software Inventory | X | X | |||||||||||||||||||
| 11. Configuration Management | X | X | X | ||||||||||||||||||
| 12. Data Protection | X | X | |||||||||||||||||||
| 13. Identity Management | X | X | |||||||||||||||||||
| 14. Attribute Management | X | X | |||||||||||||||||||
| 15. Credential Management | X | X | |||||||||||||||||||
| 16. Logical Access Control | X | X | |||||||||||||||||||
| DETECT | 17. Security Evaluations | X | X | X | X | ||||||||||||||||
| 18. Physical Enterprise Monitoring | X | X | X | X | |||||||||||||||||
| 19. Intrusion Detection and Prevention | X | X | X | X | |||||||||||||||||
| 20. Network Enterprise Monitoring | X | X | X | X | |||||||||||||||||
| RESPOND AND RECOVER | 21. Cyber Incident Response | X | X | X | X | X | X | X | |||||||||||||
| 22. Contingency and Continuity Management | X | X | X | X | X | X | X |
GOVERNANCE
| No. | VA ESA Function | VA ESA Cloud Security Requirements (High Level) | Priority | Current Status, Actions, Outcomes |
| Govern | ||||
| 1 | Understand VA's Mission. VA cloud security must support and enable VA's mission to serve our Veterans by securing VA systems and data in the cloud. Cloud-based systems and data support the necessary critical functions and services (Healthcare, Benefits, Cemetery and Coporate) to serve our Veterans | VA needs to support and enable its mission and strategy by adequately securing VA systems and data moving to the cloud environment. VA needs to identify, monitor and prioritize Healthcare, Benefits, Cemetery, and Corporate cloud initiatives. VA needs to identify mission-critical functions, systems and services that are being moved to the cloud environment. VA cloud strategy, initiatives, and mission-critical asset information allows VA to align cloud security resources, investments, capabilities, and activities with VA mission needs and priorities | High | TBD |
VA Cloud Strategy/VA Cloud Security Strategy VA needs to identify and monitor cloud security risks that may affect its mission. The IT-as-a-service model and cloud characteristics (on-demand self service, broad network access, elasticity, resource pooling, measured service) may introduce risks to VA environment and impact the security posture of VA. VA needs to identify mission risks to all components of the VA cloud environment including user access, applications, data, network, servers, end points, and Cloud Service Providers (CSPs). VA needs to continually review VA data and data flows to determine what risks to VA mission are present within the cloud environment High TBD VA Enterprise Cloud Risk Assessment VA needs to identify and manage cloud security utilization and performance metrics of the environment. These metrics should include all security and privacy controls categories including access control, audit and accountability, identification and authentication, system and communications protection, system and information integrity, configuration management, maintenance, privacy, etc. VA needs to analyze existing performance information to establish performance metric targets. VA needs to use performance metrics to establish and negotiate Service Level Agreements (SLAs) with CSPs High TBD VA Cloud Security Metrics/SLAs 2 Understand VA's Cloud Environment. VA must understand its cloud physical and logical environment to identify and address evolving cloud security threats VA needs to understand, define, and monitor the evolution of its physical and logical cloud environment. VA is establishing a hybrid cloud environment consisting of multiple cloud service providers, deployment models (public, community, private), and service models (Infrastructure-as-a-Service, Platform-as-a-Service, Software-as-a-Service) High TBD VA Cloud Architecture/VA Cloud Security Architecture
| VA needs to identify cloud security threats deriving from its cloud physical and logical environment. VA needs to identify authoritative sources of threat information, categorize threat sources, prioritize threats, and determine threat likelihood | Medium | TBD | ||
| 3 | VA Cloud Security Policy and Engagement. VA cloud security policies must provide direction to VA's information security program to adequately secure VA's cloud environment, and comply with federal and VA requirements | VA needs to define, implement, enforce and maintain cloud security policies that support and enable VA's cloud strategy and implementation. VA needs to review and analyze existing directives and handbooks to determine gaps for cloud implementation and execution. VA needs to revise and/or create new directives and handbooks to close gaps. The analysis and review of existing directives and handbooks needs to include 6500 and 6517, and all additional directives and handbooks that govern VA's security and privacy controls including access control, audit and accountability, identification and authentication, system and communications protection, system and information integrity, configuration management, maintenance, privacy, etc. | High | TBD |
VA Cloud Security Policies
| VA needs to establish or expand internal/external security collaboration to incorporate cloud security elements. VA needs to establish a cloud security collaboration mechanism or program to coordinate and share cloud security information with VA and partner organizations. VA needs to evaluate and update its information security training and awareness program periodically to address evolving cloud security needs and threats | Medium | TBD | ||
| 4 | VA Cloud Security Portfolio Management. VA must align cloud security activities and investments with mission needs and priorities | VA needs to incorporate cloud security elements to existing VA Portfolio Management practices that analyze, select, control and evaluate current and planned VA IT investments against VA mission needs. VA needs to ensure that IT investments taking advange of cloud technologies support VA mission needs without introducing unneccessary security and privacy risks to the environment. VA needs to incorporate cloud security and privacy requirements to the overall process and framework to evaluate and prioritize applications moving to the cloud, including response time, availability, reliability, encryption, bandwidth, capacity, scalability, latency, encryption, HIPAA, PII, PHI | High | TBD |
VA VIP In-Take Process for Cloud 5 VA Cloud Security Acquisition. VA must securely obtain cloud technologies and services, and address security threats to the cloud supply chain VA needs to incorporate cloud security considerations to existing VA Acquisition practices. VA needs to ensure that cloud-related acquisitions satisfy VA needs without introducing unneccesary security and privacy risks to the environment. VA needs to incorporate cloud security requirements to the acquisition of products and services including FedRAMP requirements. VA needs to incorporate cloud security requirements to the evaluation and selection of CSPs and other vendors to limit supply chain security breaches Medium TBD VA Cloud Acquisition Security Requirements (PWS, RTM)
| VA needs to establish or expand supply chain risk management (SCRM) processes to incorporate cloud security risks and limit supply chain security breaches. NIST Special Publication 800-161 Supply Chain Risk Management Practices for Federal Information Systems and Organizations, provides guidance to identify, assess, and mitigate supply chain risks | Medium | TBD | ||
| 6 | Secure VA Cloud Lifecycle Management. VA must incorporate cloud security considerations across VA's lifecycle, including conception, design, development, implementation, operation, maintenance, and disposal | VA needs to incorporate cloud security considerations to VA's Veteran-focused Integration Process (VIP) lifecycle, including the integration of FedRAMP, NIST Risk Management Framework (RMF), NIST SP 800-53 security controls, and the VA Authorization to Operate (ATO) process. VA needs to incorporate cloud considerations and FedRAMP requirements to VA's RMF process including: 1) Categorization of system; 2) Selection of security controls; 3) Implementation of security controls; 4) Assessment of security controls; 5) Authorization of the system; and 6) Monitor the system. VA needs to incorporate cloud security considerations to all VIP phases and decision points: 1) Intake and Initiation; 2) Project Planning; 3) Critical Decision #1; 4) Contract Award and On-Boarding; 5) Product Start and Build Start; 6) Build and Development; 7) Critical Decision #2; 8) Release Preparation and Release; and 9) Project Close. VA needs to define a repeatable and automated process that integrates and aligns VA's RMF and ATO processes with the VIP lifecyle. | High | TBD |
VA Secure VIP/RMF/FedRAMP/NIST 800-53 Control Overlays
| VA needs to establish a Continuous Integration/Continuous Delivery (CI/CD) methodology that incorporates cloud security (DevOps and Security). VA needs to secure the software supply chain including code integrity checks, hardening and patching automation tools, manage access to automated tools, and logging and monitoring across the CI/CD process | Medium | TBD | ||
| 7 | VA Cloud Security Training. VA workforce must be adequately trained to execute cloud security roles and responsibilities including governance, access control, data and application security, network security configuration, and incident detection, response and recovery functions | VA needs to require that personnel, including contractors, satisfy and complete required cloud security training and/or certifications to be able to execute security responsibilities in a cloud environment. VA personnel needs to be trained to perform security governance; physical, access, application, data, network, and end-point protection; incident detection; and incident response and recovery activities | Medium | TBD |
VA Cloud Security Training program VA needs to define and document cloud security roles and authorities along with assigned position responsibilities. VA needs to designate positions to fill cloud security functional requirements. VA needs to align hiring and workforce development requirements with established position qualifications High TBD VA Cloud Security Roles and Responsibilities
| VA needs to identify gaps, and incorporate cloud security and privacy considerations to VA's Privacy and Information Security Awareness program. VA needs to provide role based training , including specialized training for anyone with privilege access to the VA cloud environment | High | TBD |
| VA needs a cloud security training, test and evaluation exercise that complements VA cloud security training, and evaluate VA cloud operational readiness. VA needs to validate the effectiveness of the cloud security exercise and identify areas for improvement. VA needs to document lessons learned and actions to influence cloud security operational changes and remedy deficiencies | Medium | TBD |
PROTECT
| No. | VA ESA Function | VA ESA Cloud Security Requirements (High Level) | Priority | Current Status, Actions, Outcomes | ||
| Protect | ||||||
| 1 | Physical Protection | VA needs to clearly define physical security roles and responsibilities of VA cloud environment facilities, resources and utilities. VA needs to verify cloud service providers' physical security accordingly. VA needs to revise its current physical security plan to incorporate and address cloud security threats. VA needs to identify and use performance metrics to establish and negotiate SLAs with CSPs | High | TBD | ||
| 2 | Network Security | VA needs to clearly define network security roles and responsibilities of the VA cloud environment. VA needs to verify cloud service providers' network security accordingly. | High | TBD | ||
| VA needs to develop and establish a secure network architecture including secure cloud system interconnections, secure inbound and outband information traffic flows, and adequate routing and gateways. VA needs to define a secure network architecture that addresses cloud security threats including Distributed Denial of Service, data breaches, insufficient identity and access management control, insecure interfaces and services, and shared technology issues | ||||||
| VA needs to establish managed interfaces at interconnection points with CSPs and other external entities (Cloud Access Points) to monitor and filter information, block prohibited traffic, prevent data leakage, and follow Trusted Internet Connection guidelines. VA needs to perform a cloud impact analysis of the VA TIC infrastructure. VA needs to use virtual local area networks to segment and configure the network to support VA health, benefits, cemetery, and corporate services. VA needs to define sub-networks to support VA routing requirements including public, private, and protected sub-networks. VA needs to assign adequate IP addressing schemas to resources in the network and sub-networks. VA needs to monitor and filter information, block prohibited traffic, and prevent data leakage, among segmented networks and sub-networks. VA needs to establish a Web Application Firewall (WAF) for Internet facing Web services | Medium | TBD | ||||
| VA needs to manage ports, protocols and cloud services. VA needs to identify and configure ports, protocols and services accessible to consumers of cloud services. VA needs to limit the use of ports, protocols, and services by allowing only those required to support VA's mission and conduct official business | ||||||
| VA needs to identify and use network security performance metrics, including latency, capacity, availability to establish and negotiate SLAs with CSPs. VA needs to use SLAs to establish proper network monitoring components | ||||||
| 3 | VA Cloud Asset Inventory | VA needs to clearly define roles and responsibilities for managing VA assets in the cloud environment. VA needs to verify cloud service provider's asset inventory services | High | TBD | ||
| VA needs to identify and track all assets in the cloud including services and information systems. VA needs to maintain the cloud asset inventory up to date. VA needs to define procedures to incorporate assets to the cloud environment. VA needs to detect unauthorized assets in the cloud and define procedures to handle them. VA needs to incorporate the cloud asset inventory to its Continuous Diagnosis and Monitoring (CDM) program | Medium | TBD | ||||
| 4 | VA Configuration Management | VA needs to clearly define roles and responsibilities for configuration management in the cloud environment. VA needs to verify cloud service provider's configuration management services. VA needs to revise its current configuration management plan to incorporate changes to the cloud environment | High | TBD | ||
| VA needs to establish and maintain secure baselines of assets in the cloud, including operating systems, cloud services, and systems. VA needs to define Security Technical Implementation Guides (STIG) to adequately secure assets in the cloud. VA needs to implement whitelisting to ensure that only authorized services are allowed to run in the cloud environment. VA needs to define regression test procedures to verify functionality of configuration changes in the cloud | ||||||
| VA needs to manage configuration changes in the cloud environment. VA needs to incorporate cloud configuration changes procedures to existing authorized VA Change Control Boards including the Enterprise Security Change Control Board (ESCCB) | ||||||
| VA needs to manage vulnerabilities to track and remediate adequately vulnerabilities in the cloud environment. VA needs to define procedures to identify, deploy and test remediations for cloud vulnerabilities. VA needs to establish automated procedures to monitor VA's cloud environment configuration | ||||||
| 5 | Data Protection | VA needs to secure cloud data from unauthorized modification, destruction, or disclosure, in each of the three potential states: in transit, in use, and at rest. VA needs to define data protection mechanisms depending on its availability, sensitivy, classification or regulation requirements (e.g., PIA, PHI, HIPAA). VA needs to develop a mitigation response plan to address any VA sensitive data breaches, integrity failures, and non-availability | Medium | TBD | ||
| VA needs to classify, tag, and segregate its data as required. VA needs to apply the appropiate safeguards for sensitive data confidentiality impact levels (low, moderate, or high) including data encryption, masking, and tokenization. VA needs to conduct Privacy Impact Assessments to identify and mitigate risk to VA data in the cloud. VA needs to implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all VA information on the cloud environment. VA needs to implement encryption mechanisms that provide confidentiality, integrity, and authentication services in the cloud environment. VA needs to identify and protect all internal and external cloud communications. VA needs to maintain the confidentiality of cloud-related communication by using encryption mechanisms and allowing access only to the components sharing data. VA needs to establish adequate data resilience in the cloud, as needed to support VA business functions requirements | ||||||
| VA needs to establish a process to maintain data security in the cloud environment. VA needs to incorporate cloud-based data to its existing data privacy program. VA needs to establish a program that maintains data classification. VA needs to perform periodic audits to verify the protection of VA sensitive data and cloud communication infrastructure. VA needs to protect its data across the lifecycle including creation, storage, use, share, archive, and destruction of VA data | Medium | TBD | ||||
| 6 | Cloud Identity Management | VA needs to validate person and non-person entities that require access to cloud resources. VA needs to review its identity management plan, procedures, and technologies to incorporate cloud identity management requirements. VA needs to create and issue, distribute, manage, and archive cloud identities throughout the lifecycle of the VA identity verification process. | High | TBD | ||
| 7 | VA needs to review its attribute management plan, procedures, and technologies to incorporate establishing, publishing, and maintaining attributes for VA entities in a cloud environment. | |||||
| VA needs to establish cloud attributes to enable least privilege principles and separation of duties, to minmize the risks associated with the the abuse of authorized privileges. | High | TBD | ||||
| 8 | Cloud Credential Management | Credential Management is the means of asserting digital identity (Identity Management) and |
permissions (Attribute Management) to create a secure enterprise where only those with a need to know can access information. Operating in a digital environment requires enterprises to control access to their systems.
| VA needs to revisit existing credential management policy, methods and technologies to clearly define how credentials are being created, established and passed (federation method) in the VA cloud and legacy environments. VA needs to restrict the boundary (network space, valid time restriction etc.) for the credential, and perform on-going maintenance of the credential, to minimize the risks of credential abuse . VA needs to protect the systems generating credentials for the cloud environment. VA needs to establish formal agreements with partner organizations, including VA Credential Service Providers to increase interoperability and system accessbility. | High | TBD | |
| 9 | Logical Access Control in | ||
| Cloud Environment | VA needs to develop a cloud authentication and authorization plan, method, and technologies to verify the identity or attributes of entities, and grant privilege access to these entities in the VA cloud environment. VA needs to enforce password complexity and expiration, multifactor, privileged access, re-authentication, and remote access requirements in the cloud environment. VA needs to define access policies for all resources in the cloud environment. VA needs to protect access control management systems in the cloud environment. VA needs to evaluate the use of Attribute Based Access Control that provides flexibility and granularity to implement the roles and authorities of groups and individuals in the cloud environment. VA needs to review FedRAMP packages from CSPs and identify additional requirements and gaps for VA-specific cloud implementation. | High | TBD |
DETECT
| No. | VA ESA Function | VA ESA Cloud Security Requirements (High Level) | Priority | Current Status, Actions, Outcomes |
| Detect | ||||
| 1 | Security Evaluation for Cloud Security Service and Cloud Management service | VA needs to clearly define the Security Assessment and Authorization Policies and Procedures to comprehensively analyzes a system or network in VA Cloud Environment, identifies vulnerabilities, and provides feedback to system owners. |
VA shall start with Security Evaluation Planning by determining the appropriate scope and approach of the security evaluation, and developing rules of engagement.
VA needs to clearly define how to conduct security assessment, how to perform penetration testing and vulnerability scanning in VA cloud environment.
VA needs to develop mitigation strategies to address identified vulnerabilities in VA cloud environment.
VA needs to leverage FedRAMP process and identify if any additional requirements and/or gaps to be compliant with VA policies and procedures.
| VA needs to define SLAs and communication plan with CSP about how to perform penetration testing and vulnerability scanning, and incident response plan. | High | TBD | ||
| 2 | Physical Enterprise Monitoring for VA Cloud Environment | VA needs to clearly define VA Physical Enterprise boundary,including the VA cloud environment. |
VA needs to clearly define what level of physical enterprise monitoring/awareness to maintain for VA cloud facilities, resources and utilities, to ensure information and operations are not compromised.
| VA needs to evalauate Cloud Service Providers' physical security management process and implmentation plan about physical access control, personal screening and reinvestigation, and personal event handling, as part of the FedRAMP process and identify if any additional VA requirements apply to be compliant with VA policies and procedures. | High | TBD | ||||
| VA needs to define SLAs and communication plan with CSP to maintain VA physical enterprise monitoring capability. | ||||||
| 3 | Intrusion Detection and Prevention for VA Cloud Solution | VA needs to clearly define roles and responsibilities for Intrusion Detection and Prevention for VA Cloud Solution. | High | TBD | ||
| VA needs to clearly define Detection and Prevention Methods to be used, What Device to be used and Device Placemen and how to Manage Intrusion Detection and Prevention Systems for VA Cloud environment. | ||||||
| VA needs to develop a communication plan with CSP to work effectively together to defend VA cloud environment. | Medium | TBD | ||||
| 4 | Network Enterprise Monitoring | VA needs to clearly define the VA network enterprise boundary for VA cloud environment. | High | TBD | ||
| VA needs to clearly define roles and responsibilities for Network Enterprise Monitoring in the VA cloud environment. VA needs to verify cloud service provider's network management services. VA needs to revise its current network management plan to incorporate changes to the cloud environment, including CDM and cloud requirements, a legacy/cloud architecture, the use of analytics for user behavior, file integrity monitoring, threat hunting, data loss monitoring, changes to cloud configuration, cloud alert configurations, cloud availability, cyber physical, IoT, medical devices | ||||||
| VA needs to develop SLAs and communication plan about networking monitoring, security log management, and security/log data sharing, (what, how and how often) with CSP to maintain a realtime awareness of VA network enterprise, including VA cloud environment. |
RESPOND & RECOVERY
| No. | VA ESA Function | VA ESA Cloud Security Requirements (High Level) | Priority | Current Status, Actions, Outcomes |
| Respond & Recover | ||||
| 1 | VA Cloud Cyber Incident Response | VA needs to clearly define the security management boundary and roles and responsibilities for cyber incident response in VA cloud envronment. |
VA needs to revise its incident response plan to reflect changes introduced by VA cloud implementation.
VA needs to review CSP's incident response plan, as part of its FedRAMP process and identify if any additional requirements and/or gaps to be compliant with VA policies and procedures.
| VA needs to define SLAs and communication plan with CSP about how to handle cyber incident, collaborate with CSP to develop an incident response plan with details on how, what, and when to communicate, how to preserve evidence/information for forensics investigation, what information to share and how to measure the effectiveness of the collaboration, such as Establish an Incident Handling Program, Manage Operations to incorporate threat intelligence to proactively defend networks, Identify and Prioritize Events, Impact Analysis, Analyze Incidents, Conduct Response and Recovery, etc. | High | TBD | ||
| 2 | Contingency and Continuity Management for VA Cloud Environment | VA needs to clearly define VA asset boundary (physical and logical),including the VA cloud enrionment and clearly define the roles and responsbilities for VA business contingency and continuity. |
VA needs to revise it policy, procedures, and technical measures designed to maintain or restore operations in the event of emergencies, system failures, or disasters to adopt changes introduced by VA cloud implementation.
VA needs to evaluate Cloud Service Providers' business contigency and continuity management process and implmentation plan, as part of the FedRAMP process and identify if any additional VA requirements apply, to be compliant with VA policies and procedures.
| High | TBD | |
| VA needs to Test and Exercise the revised Contingency and Continuity Plans with its CSPs if possible. |
VA needs to develop a work and communication plan with its CSPs to Maintain Contingency and Continuity Plans.
image1.emf image2.emf
File details come from the government source that posted it. Updated .