Attachment F3 - BEP Rev 5 MSP Final Signed For Your Reference (2).pdf

Bureau of Engraving and Printing (BEP)

BEP Minimum Standard Parameters

Prepared By:

Cybersecurity Policy and Compliance Division (CPCD)

March 7th, 2022 ii

DOCUMENT CHANGE HISTORY

Version Date Comments/Notes

1.0 January 14, 2015 OCIITS Chief, ITDS Manager, ITAC Manager Review

2.0 October 24, 2016 OCIITS Chief, Updated Appendix Parameters

3.0 February 24, 2017 Review and Approval

3.1 March 20, 2017 Review and Approval

4.0 May 1, 2018 Updated parameters to match TDP85-01 Appendix A (2018)

5.0 November 18, Updated parameters to match TDP85-01 Appendix A version 3.0.1. Added: Critical Vulnerabilities must be remediated within 15 calendar days of initial detection.

Vulnerabilities must be remediated within 30 calendar days of initial detection (ref: SI-2(2) _T.255, SI-2(2) _T.256).

6.0 November 18, Updated parameters to reflect changes listed in TCIO M 20-01, TCIO M 20-03, TCIO M 20-04 and TCIO M 20-06.

Revisions effected the following controls:

AC-19_T.016 – Revised

AC-19_T.020 – WITHDRAWN

AC-19_T.022 – WITHDRAWN

AC-19_T.024 – WITHDRAWN

AC-19_T.025 – WITHDRAWN

CM-2_T.058 – WITHDRAWN

CM-2_T.059 – Revised CM-6_T.236 – Revised CM-10(1) – Added IA-5(1) – Revised IA-5(1)_N.03 – Revised IA-5(1)_N.04 – Revised SA-4_T.198 – Revised SA-22 – Added SA-22(1) – Added SC-28(1) – Revised

SC-28(1)_T.109 – WITHDRAWN

Additionally, High Value Assets (HVA) controls have been identif ied.

6.1 August 23, 2021 Addressed CISO comments from March 2021

6.2 December 8, 2021 Add Common/Hybrid/System Specific designations for each control

6.3 March 7, 2022 Migration from NIST 800-53 Rev 4 to Rev 5

The BEP Minimum Standard Parameters document contains the minimum parameters as determined by the Department of Treasury. Parameters are based on NIST SP 800-53 Rev 5 security controls that have an organization assignment, as well as Treasury-specific requirements.

Treasury requirements were mapped to the NIST controls they most closely relate to iii respectively. For reference purposes, some NIST controls that do not require a parameter to be defined are also included. Treasury Directive Publication (TD-P) 85-01, Appendix A, and the BEP Minimum Standard Parameters, is not a comprehensive list of baseline security

The BEP Minimum Standard Parameters document was developed to comply with TD-P 85-01, Appendix A. Therefore, BEP has assigned parameters to each NIST control that was identified as “Bureau Defined.” Controls that have Treasury defined parameters were accepted and left unchanged.

Per Appendix A guidance, BEP also identified Common Controls. These controls are in the Common Controls column (Column 4) and are marked with a “C.” Any control that does not have a “C” in Column 4 should be considered “System Specific,” or in some instances, “Hybrid.”

This document implements Department of the Treasury IT security policies at the Bureau level;

and is consistent with Federals laws, regulations, policies, standards and procedures issued by the Office of Management and Budget (OMB), and the Department of Commerce National Institute of Standards and Technology (NIST).

Togai Andrews

Chief, Office of Critical Infrastructure and IT Security (OCIITS)

Control Parameters and Treasury Control Requirements

This document includes Treasury controls and control parameter values prescribed in TD P 85-

01 Appendix A, and BEP-defined parameters for NIST controls. These controls are to be included in BEP system security plans as appropriate to each system’s Federal Information

Processing Standard (FIPS) 199 security category. The content is presented in table form, including the following columns:

NIST CONTROL # REFERENCE # REQUIREMENT C L M H CIP Bureau HVA

1. NIST Control Number (column 1)

a. Control names and numbers are from NIST SP 800-53 Rev 4.

2. Reference Number (column 2)

a. Part one of the reference number is the NIST control number (e.g. AC-1).

b. Part two is the source of the requirement. i. ‘N’ is for NIST and ii. ‘T’ is for Treasury

c. Part three identifies each discrete requirement of a control.

i. NIST sourced controls are assigned a two-digit value beginning with 00 for each requirement within a control (e.g. AC-2 includes a.-k.; therefore its numeric values are

00-14). The numbers reset to 00 for every NIST control.

ii. Treasury sourced requirements are assigned a three-digit value, beginning at 001, and increment continuously throughout the appendix

3. The Control or Requirement (column 3)

a. Bureaus shall ensure that parameters marked ‘[bureau-defined]’ are established and documented. Bureau-defined parameters provide the capability to tailor security controls and control enhancements based on:

i. security requirements to support organizational missions/business functions and operational needs;

ii. risk assessments and organizational risk tolerance; and

iii. security requirements originating federal laws, Executive Orders, directives, policy (including Treasury Policy), regulation, standards, and/or guidelines

b. Where there was a ‘[Selection:]’ value, BEP has assigned its own value per TD 85-01 Appendix A requirement.

4. BEP Common Control (column 4)

a. Bureaus shall designate each control as common, system-specific, or hybrid controls

5. The Baseline (columns 5, 6, 7, 8)

a. L=Low, M=Moderate, H=High

i. Controls or requirements marked with an ‘X’ in the L, M, or

H columns means they are part of that baseline.

ii. A ‘P’ in the "Baseline" columns means that the control is a program-level control. These controls are:

1. deployed organization-wide;

2. supporting information security programs;

3. not associated with security control baselines; and

4. independent of any system impact level

iii. “X” in the “CIP” column (column 8) means that the control is a Cyber Critical Infrastructure Protection control. These controls are applied to information systems designated as Cyber Critical Infrastructure Assets by the Departmental CIO.

6. BEP Parameters Assignments (column 9)

a. “X” in the Bureau column (column 9) means the control assignment parameter is designated by BEP.

7. High Value Asset (HVA) Overlay (column 10)

a. “X” in the HVA column (column 10) means the control assignment parameter is designated by Treasury via TD Treasury Directive Publication

(TD P) 85-01, Appendix A for the HVA overlay.

8. Security Control Types in (column 4)

a. “H’ means Hybrid Control

b. “S” means System Specific Control

c. “C” means Common Control

Implementation of the Critical Infrastructure System Control Overlay

Information systems designated as Cyber Critical Infrastructure Assets shall implement the security controls designated by an “X” in the “CIP” column:

1) The “Critical Infrastructure Control Overlay” shall be applied to all components within the designated Cyber Critical Infrastructure Asset systems security boundary.

i. GUIDANCE: Information systems normally consist of components (servers, routers, batch processing routines, mainframes, etc.) that when combined allow the overall system to perform its intended function. The intent is to increase the trustworthiness and resiliency of the overall system by applying the control overlay to all the components of the designated system, where applicable. It is understood that security controls are applicable only to information system components that provide or support the capability addressed by the controls. Please document the implementation accordingly.

2) The controls in the Cyber Critical Infrastructure Overlay may be tailored per the “Tailoring Baseline Security Controls” policy in the following section.

i. If the Authorizing Official, in coordination with the system and organizational officials, determines that a control in the Overlay shall not be implemented (also referred to as “tailoring-out”) on a designated Cyber Critical Infrastructure Asset, the associated documentation for this risk-based decision not to implement shall be submitted to the Department Cyber CIP Program Manager and the Departmental CISO for review.

This page is intentionally left blank

Control ID

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AC-1

AC-1_N.00

POLICY AND PROCEDURES

C X X X X X

Control:

a. Develop, document, and disseminate to [Bureau employees and contractors]:

1. [BEP] access control policy that:

(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

and

AC-1_N.01

2. Procedures to facilitate the implementation of the access control policy and the associated access controls;

b. Designate an [CISO] to manage the development, documentation, and dissemination of the access control policy and procedures; and

C X X X X

AC-1_N.02

c. Review and update the current access control:

C X X X X

1. Policy [at least annually] and following [significant changes];

AC-1_N.03

2. Procedures [at least annually] and following [significant changes].

C X X X X

AC-2

AC-2_N.00

ACCOUNT MANAGEMENT

H X X X X X

a. Define and document the types of accounts allowed and specifically prohibited for use within the system;

AC-2_N.01 b. Assign account managers; H X X X X

AC-2_N.02

c. Require [prerequisites and criteria as defined in BEP AC procedure] for group and role membership; H X X X X

AC-2_N.03

d. Specify:

1. Authorized users of the system;

2. Group and role membership; and

3. Access authorizations (i.e., privileges) and (attributes as defined in BEP AC procedure as required)] for each account;

H X X X X

AC-2_N.04

e. Require approvals by [Information System Owners or their designee and IT Security] for requests to create accounts;

H X X X X X

AC-2_N.05

f. Create, enable, modify, disable, and remove accounts in accordance with [ BEP AC procedures]; H X X X X X

AC-2_N.06 g. Monitor the use of accounts; H X X X X

AC-2_N.07

h. Notify account managers and [BEP SOC] within:

H X X X X

1. [1 business day] when accounts are no longer required;

AC-2_N.08 2. [24 hours] when users are terminated or transferred; and H X X X X

AC-2_N.09

3. [1 business day] when system usage or need-to-know changes for an individual;

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AC-2_N.10

i. Authorize access to the system based on:

1. A valid access authorization;

AC-2_N.11 2. Intended system usage; and H X X X X

AC-2_N.12

3. [Other attributes as required and defined in BEP Identity and Access Management procedure;] H X X X X

AC-2_N.13

j. Review accounts for compliance with account management requirements [at least quarterly ];

k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and

AC-2_N.14

l. Align account management processes with personnel termination and transfer processes. H X X X X

AC-2(1) AC-2(1)_N.00

ACCOUNT MANAGEMENT | AUTOMATED SYSTEM

ACCOUNT MANAGEMENT

C X X X

Support the management of system accounts using [ BEP Identity and Access Management procedure].

AC-2(2) AC-2(2)_N.00

ACCOUNT MANAGEMENT | AUTOMATED TEMPORARY

AND EMERGENCY ACCOUNT MANAGEMENT

H X X X

Automatically [ remove/disable] temporary and emergency accounts after [the approved period of time in the account approval request]

AC-2(3) AC-2(3)_N.00

ACCOUNT MANAGEMENT | DISABLE ACCOUNTS

Disable accounts within [1 day] when the accounts:

(a) Have expired;

(b) Are no longer associated with a user or individual;

(c) Are in violation of organizational policy; or

(d) Have been inactive for [30 days].

AC-2(4) AC-2(4)_N.00

ACCOUNT MANAGEMENT | AUTOMATED AUDIT

ACTIONS

Automatically audit account creation, modification, enabling, disabling, and removal actions.

AC-2(5) AC-2(5)_N.00

ACCOUNT MANAGEMENT | INACTIVITY LOGOUT

Require that users log out when [they conclude their work shift; when transporting laptops between locations; and as required by BEP IT Operations to apply updates and patches].

AC-2(11) AC-2(11)_N.00

ACCOUNT MANAGEMENT | USAGE CONDITIONS

Enforce [circumstances and/or usage conditions for information system accounts as defined in the Information System Security Plan].

AC-2(12) AC-2(12)_N.00

ACCOUNT MANAGEMENT | ACCOUNT MONITORING

FOR ATYPICAL USAGE C X X X X

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

(a) Monitor system accounts for [abnormal usages – User and Entity Behavior outside of normal usages in terms of authorized access, normal usages period and geo-location]; and

AC-2(12)_N.01

(b) Report atypical usage of system accounts to [BEP Security Operation Center, System Owner and/or System Administrator].

C X X X X

AC-2(13) AC-2(13)_N.00

ACCOUNT MANAGEMENT | DISABLE ACCOUNTS FOR

HIGH-RISK INDIVIDUALS

Disable accounts of individuals within [one hour] of discovery of [ significant risks].

AC-3 AC-3_N.00

ACCESS ENFORCEMENT

Control: Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

AC-3_T.002

Users having accounts with administrator’s access privileges on Treasury systems may access those accounts only from Treasury government or authorized government contractor systems.

INFORMATIVE: In other words, a key intent is to prohibit personally- owned or public kiosk (e.g., library) systems from being used for remote Administrator access.

INFORMATIVE: If individuals with administrator rights require e-mail or Internet access beyond local boundaries, one alternative would be to issue separate, non-privileged accounts (one per affected individual) for that purpose. For the considerations of this section, administrator accounts/rights are those that allow for the installation or configuration of software on any Treasury asset.

AC-3(14)

ACCESS ENFORCEMENT | INDIVIDUAL ACCESS

Provide [Privacy Act Request Program] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment:

organization-defined elements as determined by BEP Disclosure Officer].

C X X X X

AC-4 AC-4_N.00

INFORMATION FLOW ENFORCEMENT

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [applicable agreement in the form of a MOU/MOA/ISA or as defined in the system SSP. Systems internal to BEP do not require additional approving for information flow].

AC-4(4)

INFORMATION FLOW ENFORCEMENT | FLOW

CONTROL OF ENCRYPTED INFORMATION

C X

Prevent encrypted information from bypassing [Treasury Network filtering mechanisms or BEP approved gateway] by [decrypting the information; blocking the flow of the encrypted information; [Treasury Network filtering mechanisms or BEP approved gateway].

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AC-5 AC-5_N.00

SEPARATION OF DUTIES

a. Identify and document [security and system administration roles] and

b. Define system access authorizations to support separation of duties.

AC-6 AC-6_N.00

LEAST PRIVILEGE

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

AC-6_T.003

Accounts with administrative privileges (including local administrator rights) shall be prohibited from web browsing and other Internet connections outside of the local protected boundary (usually Treasury) unless such risk is accepted in writing by the Bureau CIO.

alternative would be to issue separate, non-privileged accounts (one per affected individual) for that purpose. For the considerations of this section, administrator

AC-6_T.004

Accounts with administrative privileges (including local administrator rights) shall be blocked from access to e-mail unless such risk is accepted in writing by the Bureau CIO.

alternative would be to issue separate, non-privileged accounts (one per affected individual) for that purpose. For the considerations of this section, administrator

AC-6(1) AC-6(1)_N.00

LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY

FUNCTIONS

Authorize access for [privilege and security roles] to:

(a) [BEP systems and applications]; and

(b) [Ensure permissions are assigned on a least privilege basis].

AC-6(2) AC-6(2)_N.00

LEAST PRIVILEGE | NON-PRIVILEGED ACCESS FOR

NONSECURITY FUNCTIONS

Require that users of system accounts or roles, with access to [information systems] use non-privileged accounts or roles, when accessing non-security functions.

AC-6(3) AC-6(3)_N.00

LEAST PRIVILEGE | NETWORK ACCESS TO

PRIVILEGED COMMANDS

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

Authorize network access to [privilege command functions] only for [privilege functions] and document the rationale for such access in the security plan for the system.

AC-6(5) AC-6(5)_N.00

LEAST PRIVILEGE | PRIVILEGED ACCOUNTS

Restrict privileged accounts on the system to [individuals approved by the information system owner].

AC-6(6) AC-6(6)_N.00

LEAST PRIVILEGE | PRIVILEGED ACCESS BY NON-

ORGANIZATIONAL USERS

C X X X X X X

Prohibit privileged access to the system by non-organizational users.

AC-6(7)

LEAST PRIVILEGE | REVIEW OF USER PRIVILEGES

(a) Review [ quarterly] the privileges assigned to [privilege user] to validate the need for such privileges; and

(b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.

AC-6(9)

LEAST PRIVILEGE | LOG USE OF PRIVILEGED

FUNCTIONS S X X X

Log the execution of privileged functions.

AC-6(10)

LEAST PRIVILEGE | PROHIBIT NON-PRIVILEGED USERS

FROM EXECUTING PRIVILEGED FUNCTIONS

S X X X

Prevent non-privileged users from executing privileged functions.

AC-7 AC-7_N.00

UNSUCCESSFUL LOGON ATTEMPTS

a. Enforce a limit of [Three] consecutive invalid logon attempts by a user during a [5 minute period]; and

AC-7_N.01

b. Automatically [lock the account or node for an [15 minute time period or until released by an administrator (for low and moderate systems)]

C X X X

AC-7_N.01

or [lock the account or node until released by an administrator (for high systems)] when the maximum number of unsuccessful attempts is exceeded.;

AC-8 AC-8_N.00

SYSTEM USE NOTIFICATION

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

a. Display [BEP approved notification message or banner as defined in BEP AC procedure] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:

1. Users are accessing a U.S. Government system;

2. System usage may be monitored, recorded, and subject to audit;

3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and

4. Use of the system indicates consent to monitoring and recording;

b. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and

AC-8_N.05

c. For publicly accessible systems:

1. Display system use information [for any Bureau system that requires a login], before granting further access to the publicly accessible system;

2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

3. Include a description of the authorized uses of the system.

AC-10 AC-10_N.00

CONCURRENT SESSION CONTROL

Limit the number of concurrent sessions for each [Bureau-defined account and/or account type] to [one for non-privileged users and one for privileged users].

AC-11 AC-11_N.00

DEVICE LOCK

C X X

a. Prevent further access to the system by initiating a device lock after [15 minutes or less] of inactivity; and

b. Retain the device lock until the user reestablishes access using established identification and authentication procedures.

AC-11(1)

DEVICE LOCK | PATTERN-HIDING DISPLAYS

S X X

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

AC-12 AC-12_N.00

SESSION TERMINATION

Automatically terminate a user session after [30 minutes of inactivity while accessing web-based services. BEP maintains an always ON BEP Virtual Private Network

(VPN)].

AC-14 AC-14_N.00

PERMITTED ACTIONS WITHOUT IDENTIFICATION OR

AUTHENTICATION

a. Identify [ no user action] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

b. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.

AC-17

AC-17_N.00

REMOTE ACCESS

a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

AC-17_N.01

b. Authorize each type of remote access to the system prior to allowing such connections.

C X X X

AC-17_T.006

Two-factor authentication shall be implemented for all remote access back to a Departmental system.

INFORMATIVE: "Remote access" is defined as LAN-like access to a Treasury system from a location or facility not controlled by a Treasury organization. Access to websites and other systems available to the public, as well as access to non-Treasury or publicly available information, is not considered "remote access."

Examples: If a Treasury employee works at home on a personally- owned computer using public or non-Treasury information that would not entail “remote access.” If a State of Rhode Island employee has been granted access to a Treasury system and that employee accesses the Treasury system from a State of Rhode Island facility, it would be considered “remote access.” A Treasury employee using a Treasury laptop without connectivity back to a Treasury system for an audit at a firm in a commercial office building would not be considered “remote access.”

AC-17(1)

REMOTE ACCESS | MONITORING AND CONTROL

Employ automated mechanisms to monitor and control remote access methods.

AC-17(2) AC-17(2)_N.00

REMOTE ACCESS | PROTECTION OF CONFIDENTIALITY

AND INTEGRITY USING ENCRYPTION

Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

AC-17(2)_T.206

Remote Access Security. Remote access sessions to Treasury IT assets (e.g., networks, systems) shall only be provided through an encryption mechanism such as a virtual private network (VPN) connection that meets FIPS 140 validation requirements. C X X X

INFORMATIVE: This control does not apply to sessions used for the dissemination of non-sensitive information to the public.

AC-17(3) AC-17(3)_N.00

REMOTE ACCESS | MANAGED ACCESS CONTROL

POINTS

Route remote accesses through authorized and managed network access control points.

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AC-17(4) AC-17(4)_N.00

REMOTE ACCESS | PRIVILEGED COMMANDS AND

ACCESS

a. Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [privileged accounts to perform job duties while not located at a BEP facility]; and

b) Document the rationale for remote access in the security plan for the system.

AC-18

AC-18_N.00

WIRELESS ACCESS

a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and

AC-18_N.01

b. Authorize each type of wireless access to the system prior to allowing such connections. H X X X

AC-18_T.246

Treasury bureaus shall coordinate with the Treasury Office of Intelligence and Analysis to establish a wireless program to protect National Security Systems (NSS) when unclassified wireless technologies are used to transmit, receive, process, or store unclassified data in the proximity of Treasury NSS or National Security Information (NSI).

INFORMATIVE: This control also applies to any/all guest wireless networks.

AC-18_T.247

Guest wireless networks operated by or on behalf of Treasury in Treasury facilities shall be completely logically separate from all C X X X

Treasury networks.

AC-18_T.008

Bureaus shall ensure that unapproved wireless networking capabilities of desktops, laptops, printers, copiers, fax machines, SCADA systems, and other devices are disabled (through automated means, where technically possible) and monitored through automated means for unauthorized changes. C X X X

INFORMATIVE: One alternative yet acceptable approach to “monitoring through automated means” is regularly pushing out settings that restrict unapproved wireless connections.

AC-18_T.009

Bureaus shall monitor for unauthorized wireless access to the information system and enforce requirements for wireless connections to the information system.

H X X X

AC-18_T.010

Implementation and use of wireless networks must be approved by the Authorizing Official in accordance with organizational risk tolerance and commensurate with the security categorization of the data to be carries by the system, which may be no higher than the security categorization of the system

C X X X

AC-18_T.012

Bureaus shall scan for rogue wireless access points and other wireless activity that are not in compliance with Departmental policy.

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AC-18(1) AC-18(1)_N.00

WIRELESS ACCESS | AUTHENTICATION AND

ENCRYPTION

Protect wireless access to the system using using authentication of [ devices] and encryption.

AC-18(3)

AC-18(3)_N.00

WIRELESS ACCESS | DISABLE WIRELESS

NETWORKING

Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.

AC-18(3)_T.011

Bureaus shall employ security mechanisms for wireless networks consistent with the sensitivity of the information to be transmitted. For transmissions of FIPS 199 MODERATE or HIGH confidentiality information, FIPS 140-2 validated encryption must be employed.

AC-18(4)

WIRELESS ACCESS | RESTRICT CONFIGURATIONS BY

USERS

Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.

AC-18(5)

WIRELESS ACCESS | ANTENNAS AND TRANSMISSION

POWER LEVELS

Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.

AC-19

AC-19_N.00

ACCESS CONTROL FOR MOBILE DEVICES

a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and

AC-19_N.01

b. Authorize the connection of mobile devices to organizational systems.

C X X X

AC-19_T.016

Bureaus shall ensure that all sensitive and mission critical data on mobile devices is encrypted using FIPS 140 validated (or NIST finalized and published succeeding guidance) validated encryption technology, except when no such encryption technology solutions are available to address a specific device

C X X X

AC-19_T.018

The bureau CISO or designee must give written approval before an individual within the office may take a government-owned laptop computer and/or other mobile devices overseas.

C P P P

AC-19_T.019

Bureau deployment of government-owned mobile devices to process, store, or transmit Treasury information must be approved by the Authorizing Official in accordance with organizational risk tolerance and commensurate with the security categorization of the data to be processed, stored, or transmitted, which may be no higher than the security categorization of the devices.

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AC-19_T.021

This control addresses laptop computers that are temporarily taken overseas. All laptops temporarily taken overseas must be protected by: 1) full disk FIPS validated encryption; 2) disabling any wireless capability; and 3) either disabling all USB ports(s) or use of tamper- evident bags/seals/containers each time the laptop is left unattended (i.e., not under the direct and immediate control of a U.S. Government employee or authorized government contractor). If any laptop is not protected as described above, it may not be reconnected to a Treasury system or network until sanitized.

C X X X

AC-19_T.023

Hard drives or partitions that connect to networks while outside the

U.S. shall not be connected to Treasury networks at any time.

AC-19_T.026

Bureaus shall provide users with procedures to follow during foreign travel when a device is taken out of their possession and view for other than routine airport security scans.

C P P P

AC-19(5) AC-19(5)_N.00

ACCESS CONTROL FOR MOBILE DEVICES | FULL

DEVICE OR CONTAINER-BASED ENCRYPTION

Employ [full-device encryption; container encryption] to protect the confidentiality and integrity of information on [BEP issued laptops, portable media, and mobile devices. For BYOD, container-based encryption is implemented].

AC-20 AC-20_N.00

USE OF EXTERNAL SYSTEMS

a. Establish [Contracts/SLA and or ISA/MOU]; consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:

1. Access the system from external systems; and

2. Process, store, or transmit organization-controlled information using external systems; or

b. Prohibit the use of [any external systems not BEP authorized/ personally owned systems].

AC-20(1)

AC-20(1)_N.00

USE OF EXTERNAL SYSTEMS | LIMITS ON AUTHORIZED

USE

Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after:

(a) Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or

AC-20(1)_N.01

(b) Retention of approved system connection or processing agreements with the organizational entity hosting the external system.

C X X X

AC-20(1)_T.028

USE OF EXTERNAL INFORMATION SYSTEMS | LIMITS

ON AUTHORIZED USE

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

Approval by the bureau CISO and AO is required for use of non-government-furnished IT equipment to store, access, process, or transmit Treasury FIPS 199 Low and Moderate information, with the exception that minor amounts of incidental (and no higher than FIPS 199 LOW confidentiality) information, such as phone numbers or an employee's daily schedule, may be permitted by authorization of the employee's supervisor. (This control does not apply to information made available proactively to the general public by the Treasury).

INFORMATIVE: Government-provided secure virtual environments installed on non-government furnished equipment may be used to access Treasury information, unless prohibited or otherwise restricted by Bureau policy.

INFORMATIVE: Government-provided secure virtual environments installed on non-government furnished equipment are considered to be the same as government-furnished equipment.

AC-20(1)_T.029

USE OF EXTERNAL INFORMATION SYSTEMS | LIMITS

Bureaus that permit use of non-government furnished IT equipment per control T.028 to process, store, or transmit Treasury information shall establish terms and conditions of each use. The systems and conditions shall address, at a minimum, NIST SP 800-53 Appendix F, Control AC-20 and, when applicable, NIST SP 800-53 Appendix F, Control AC- 20, and AC-20(1).

AC-20(1)_T.030

USE OF EXTERNAL INFORMATION SYSTEMS | LIMITS

Approval by the bureau CISO and AO is required for connection of non-government furnished or contractor-owned IT devices (including USB-connected portable storage and mobile devices) to Treasury systems or networks. (This control does not apply to networks and systems intended for use by the general public)

AC-20(2) AC-20(2)_N.00

USE OF EXTERNAL SYSTEMS | PORTABLE STORAGE

DEVICES — RESTRICTED USE

Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [BEP Acceptable Use Policy for removable device].

AC-21

AC-21_N.00

INFORMATION SHARING

a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [system-specific information not currently addressed by an existing contract/ MOU/ISA]; and

AC-21_N.01

b. Employ [manual review by IT security to include the ISSO] to assist users in making information sharing and collaboration decisions.

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AC-22

AC-22_N.00

PUBLICLY ACCESSIBLE CONTENT

a. Designate individuals authorized to make information publicly accessible;

AC-22_N.01

b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

C X X X

AC-22_N.02

c. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and

C X X X

AC-22_N.03

d. Review the content on the publicly accessible system for nonpublic information [quarterly] and remove such information, if discovered.

C X X X

AT-1

AT-1_N.00

AWARENESS AND TRAINING POLICY AND

PROCEDURES

Develop, document, and disseminate to all Bureau employees and contractors:

1.BEP awareness and training policy that:

(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

(b) Is consistent with applicable laws, executive orders, AT-1_N.01

2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;

b. Designate an [Bureau Employees and contractors] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and

AT-1_N.02

c. Review and update the current awareness and training:

1. Policy [annually] and following [significant changes];

AT-1_N.03

2. Procedures [annually] and following [significant changes].

AT-2 AT-2_N.00

LITERACY TRAINING AND AWARENESS

a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):

1. As part of initial training [within 5 days of access being granted] for new users and [annually] thereafter; and

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AT-2_N.01

2. When required by system changes or following [significant changes];

b. Employ the following techniques to increase the security and privacy awareness of system users [Monthly Phishing Exercise, BEP Newsletter as defined in BEP Security Awareness Training Procedure document];

C X X X

AT-2_N.02

c. Update literacy training and awareness content [annually] and following [significant changes]; and

AT-2_N.03

d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

C X X X

AT-2_T.034

Bureaus shall train users and provide means to ensure workstations are adequately protected from theft --particularly in regard to laptops acting as workstations.

C X X X

AT-2_T.035

At least once per quarter, Bureaus shall distribute security awareness reminders/updates to all users.

C P P P

INFORMATIVE: This is in addition to annual awareness training. Security awareness updates may be sent via e-mail.

Unlike the need to track annual training by individual, Bureaus are not required to track quarterly awareness updates by individual.

AT-2_T.249

At least once per quarter, Bureaus shall conduct phishing email simulation exercises.

C P P P

AT-2_T.250

Bureaus shall notify the Treasury Government Security Operations

C P P P

Center (GSOC) prior to executing any phishing email simulation exercise.

AT-2(2)

AT-2(2)_N.00

LITERACY TRAINING AND AWARENESS | INSIDER

THREAT

Provide literacy training on recognizing and reporting potential indicators of insider threat.

C X X X

AT-2(3) AT-2(3)_N.00

LITERACY TRAINING AND AWARENESS | SOCIAL

ENGINEERING AND MINING

Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.

C X X X

AT-3

AT-3_N.00

ROLE-BASED TRAINING

a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [see 10-08.35 Appendix A for roles that require specialized training]:

1. Before authorizing access to the system, information, or performing assigned duties, and [annually] thereafter; and

AT-3_N.01

2. When required by system changes;

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AT-3_N.02

b. Update role-based training content [annually] and following [significant changes]; and

c. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

C X X X X

AT-3(5)

ROLE-BASED TRAINING | PROCESSING PERSONALLY

IDENTIFIABLE INFORMATION

Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of personally identifiable information processing and transparency controls.

C X X X X

AT-4

AT-4_N.00

TRAINING RECORDS

a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training;

AT-4_N.01 b. Retain individual training records for [at least five years]. C X X X X

AU-1

AU-1_N.00

a. Develop, document, and disseminate to [all Bureau employees and contractors]:

1. [BEP] audit and accountability policy that:

management commitment, coordination among organizational entities, and compliance; and

(b) Is consistent with applicable laws, executive orders, AU-1_N.01

2. Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;

documentation, and dissemination of the audit and accountability policy and procedures; and

AU-1_N.02

c. Review and update the current audit and accountability:

AU-1_N.03

changes].

C X X X X

AU-2

AU-2_N.00

EVENT LOGGING

a. Identify the types of events that the system is capable of logging in support of the audit function: [as defined in BEP AU procedure];

AU-2_N.01

b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

c. Specify the following event types for logging within the system: [audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.];

C X X X X

AU-2_N.02

d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and

C X X X X

AU-2_N.03

e. Review and update the event types selected for logging [annually].

C X X X X

AU-2_T.038

Bureaus shall develop and implement local procedures and/or technical/operational/ administrative controls to ensure that extracts containing FIPS 199 High or Moderate for confidentiality information are erased within 90 days or that continued use is still required.

AU-3 AU-3

CONTENT OF AUDIT RECORDS

Ensure that audit records contain information that establishes the following:

a. What type of event occurred;

b. When the event occurred;

c. Where the event occurred;

d. Source of the event;

e. Outcome of the event; and

f. Identity of any individuals, subjects, or objects/entities associated with the event.

AU-3(1) AU-3(1)_N.00

CONTENT OF AUDIT RECORDS | ADDITIONAL AUDIT

INFORMATION

Generate audit records containing the following additional information: [details to facilitate the reconstruction of events if unauthorized activity or a malfunction occurs or is suspected].

AU-3(3)

LIMIT PERSONALLY IDENTIFIABLE INFORMATION

ELEMENTS

Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [as defined in BEP AU procedure or Privacy policy].

H X X X X

AU-4 AU-4_N.00

AUDIT LOG STORAGE CAPACITY

Allocate audit log storage capacity to accommodate [ the requirement to keep a minimum of 180 days].

AU-5

AU-5_N.00

RESPONSE TO AUDIT LOGGING PROCESS FAILURES

a. Alert [BEP SOC] within [4 hours] in the event of an audit logging process failure; and

AU-5_N.01

b. Take the following additional actions: [overwrite oldest audit records].

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

AU-5(1) AU-5(1)_N.00

RESPONSE TO AUDIT LOGGING PROCESS FAILURES |

STORAGE CAPACITY WARNING

Provide a warning to [BEP SOC] within [24 hours] when allocated audit log storage volume reaches [90%] of repository maximum audit log storage capacity.

AU-5(2) AU-5(2)_N.00

RESPONSE TO AUDIT LOGGING PROCESS FAILURES |

REAL-TIME ALERTS

Provide an alert within [less than one (1) hour] to

[BEP SOC] when the following audit failure events occur:

[unable to store or transmit audit logs].

AU-6

AU-6_N.00

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING

a. Review and analyze system audit records [in accordance with a risk-based decision as documented in BEP SOC procedure or CONOPS] for indications of [abnormal activities as defined in BEP SOC procedure or CONOPS] and the potential impact of the inappropriate or unusual activity;

AU-6_N.01

b. Report findings to [BEP SOC]; and C X X X X X

c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

C X X X

AU-6(1) AU-6(1)_N.00

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING |

AUTOMATED PROCESS INTEGRATION

Integrate audit record review, analysis, and reporting processes using [BEP SIEM].

AU-6(3) AU-6(3)_N.00

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING |

CORRELATE AUDIT RECORD REPOSITORIES

Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

AU-6(5) AU-6(5)_N.00

INTEGRATED ANALYSIS OF AUDIT RECORDS

Integrate analysis of audit records with analysis of [vulnerability scanning information; threat intelligence and information system monitoring information] to further enhance the ability to identify inappropriate or unusual activity.

AU-6(6)

CORRELATION WITH PHYSICAL MONITORING

Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.

AU-7

AUDIT RECORD REDUCTION AND REPORT

GENERATION

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

Control: Provide and implement an audit record reduction and report generation capability that:

a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and

b. Does not alter the original content or time ordering of audit records.

AU-7(1) AU-7(1)_N.00

AUDIT RECORD REDUCTION AND REPORT

GENERATION | AUTOMATIC PROCESSING

Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [at a minimum user ID, event dates and times, Internet Protocol addresses involved, and event success or failure].

AU-8

AU-8_N.00

TIME STAMPS

a. Use internal system clocks to generate time stamps for audit records; and

AU-8_N.01

b. Record time stamps for audit records that meet [granularity of time measurement within +/- 50 milliseconds for systems capable of using Network Time Protocol (NTP) services.] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.

S X X X X

AU-9 AU-9_N.00

PROTECTION OF AUDIT INFORMATION

a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and

b. Alert [BEP SOC] upon detection of unauthorized access, modification, or deletion of audit information.

H X X x

AU-9(2) AU-9(2)_N.00

PROTECTION OF AUDIT INFORMATION | STORE ON

SEPARATE PHYSICAL SYSTEMS OR COMPONENTS C X X X X X X

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

Store audit records [ at least once per month] in a repository that is part of a physically different system or system component than the system or component being audited.

AU-9(3) AU-9(3)_N.00

PROTECTION OF AUDIT INFORMATION |

CRYPTOGRAPHIC PROTECTION

Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.

AU-9(4) AU-9(4)_N.00

PROTECTION OF AUDIT INFORMATION | ACCESS BY

SUBSET OF PRIVILEGED USERS

Authorize access to management of audit logging functionality to only [BEP SOC].

AU-10 AU-10_N.00

NON-REPUDIATION

Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [privileged functions, approving access requests, and, if applicable, activity that can compromise compliance or have a financial impact to the organization.].

AU-11 AU-11_N.00

AUDIT RECORD RETENTION

Retain audit records for [according to Records Management TD 80-05 and General Counsel] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention

AU-12

AU-12_N.00

AUDIT RECORD GENERATION

a. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Operating System and, when possible, application level];

AU-12_N.01

b. Allow [BEP SOC] to select the event types that are to be logged by specific components of the system; and

c. Generate audit records for the event types defined in AU- 2c that include the audit record content defined in AU-3.

AU-12(1) AU-12(1)_N.00

AUDIT RECORD GENERATION | SYSTEM-WIDE AND

TIME-CORRELATED AUDIT TRAIL

Compile audit records from [Operating Systems and where applicable applications] into a system-wide (logical or physical) audit trail that is time-correlated to within [1 minute of Coordinated Universal Time (UTC) as based upon a recognized time authority (e.g. NIST). Audit records should be stored in UTC format for consistency].

AU-12(3) AU-12(3)_N.00

AUDIT RECORD GENERATION | CHANGES BY

AUTHORIZED INDIVIDUALS

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

Provide and implement the capability for [ BEP SOC] to change the logging to be performed on [Operating System and where applicable, applications] based on [ an identified threat or malicious activity, within 24 hours.]

CA-1

CA-1_N.00

ASSESSMENT, AUTHORIZATION, AND MONITORING

a. Develop, document, and disseminate to all Bureau employees and contractors:

1. The Bureau assessment, authorization, and monitoring policy that:

(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

(b) Is consistent with applicable laws, executive orders, CA-1_N.01 assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;

b. Designate an [BEP CISO] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and

C X X X X

CA-1_N.02

c. Review and update the current assessment, authorization, and monitoring: C X X X X

1. Policy [annually or if there is a significant change]; and

CA-1_N.03

2. Procedures [annually or if there is a significant change].

CA-2

CA-2_N.00

CONTROL ASSESSMENTS

a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;

b. Develop a control assessment plan that describes the scope of the assessment including:

1. Controls and control enhancements under assessment;

CA-2_N.01

2. Assessment procedures to be used to determine control effectiveness; and H X X X X X

CA-2_N.02

3. Assessment environment, assessment team, and assessment roles and responsibilities; H X X X X X

CA-2_N.03

c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;

REFERENCE # REV 5 REQUIREMENT C L M H CIP Bureau HVA Privacy

CA-2_N.04

d. Assess the controls in the system and its environment of operation [at least annually] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;

H X X X X X

CA-2_N.05

e. Produce a control assessment report that document the results of the assessment; and

H X X X X X

CA-2_N.06

f. Provide the results of the control assessment to [AO, CISO, and respective System Owner]. H X X X X X X

CA-2_T.041

Priority for selection of controls to be tested should be: 1) those POA&M items completed within the applicable timeframe and 2) high- volatility security controls

INFORMATIVE: There is no set number of controls to be tested annually; however, the number of controls should take into account the FIPS 199 security categorization level of the system. Controls selected for testing should not be limited to technical controls, but also include operational and management controls.

INFORMATIVE: With regard to volatility, by their nature, operational controls require that correct actions be taken by individuals. Due to potential for personnel turnover, degradation in infrequently used skills, and other factors, many operational controls are volatile, which should be taken into account when selecting controls for testing.

Additionally, this volatility with regard to individuals also affects access controls, particularly keeping access control lists and permissions (both for general support systems and applications) up to date. Bureaus should also consider the importance of specific controls to the security of a system.

Controls that are crucial to the protection of a system should be considered for selection as part of the testing requirement.

These are not necessarily the same as highly volatile controls and may or may not be POA&M items.

CA-2_T.042

For new SA&A and re-certifications, the testing accomplished in the SA&A would meet the annual FISMA testing requirement.

C X X X X X

CA-2_T.054

When testing of a security control reveals that the control is not functioning as expected, and corrective action…