Attachment G - VA ESAF_v1_20210624.docx

OFFICE OF INFORMATION AND TECHNOLOGY

OFFICE OF

INFORMATION

AND TECHNOLOGY

Enterprise Security Architecture Framework (ESAF)

June 24, 2021 | Enterprise Security Architecture Division Version 1

Table of Contents

Table of Figures

Table of Tables

Revisions

· Addressed and ajudicated comments received from ESA

· Updated Figure 3, ESAF Process Flow

· Moved applicable NIST SP 800-53 Revision 4 security controls to document body

· Added additional references and URLs in footnotes

· Addresssed relationship of ESAF capabilities to Executive Order “Improving the Nation’s Cybersecurity” (May 12, 2021)

· Added the ESAF Capability Questionnaire (Appendix B) and VA stakeholder directions for its use during project/product intake

· Added relevant NIST SP 800-53, Revision 5 security controls to ESAF capabilities

· Updated Accronyms and References.

Executive Summary This Department of Veterans Affairs (VA) Enterprise Security Architecture Framework (ESAF) is a foundational document that serves to guide the incorporation of best-practice cybersecurity and privacy capabilities into the security domain of the VA Enterprise Architecture (EA). The VA Office of Information and Technology (OI&T) Enterprise Security Architecture (ESA) organization developed the ESAF to help institutionalize how cybersecurity and privacy are architected and integrated within Information Technology (IT) and Operational/Operations Technology (OT)[footnoteRef:1] systems and solutions and to the VA cybersecurity risk management procedures. The ESAF is consistent with U.S. Government cybersecurity policy, directives, and standards. The ESAF also complements the VA 2018-2024 Strategic Plan, Enterprise Cybersecurity Strategy (ECSS)[footnoteRef:2], ESA Strategy, and VA cybersecurity directives and handbooks with the goal of improving the security posture of the VA enterprise, reducing Federal Information Security Modernization Act (FISMA)[footnoteRef:3] audit findings, and mitigating Department-wide security vulnerabilities. Finally, the ESAF is a key enabler for compliance with White House Executive Order (EO) 14028, Improving the Nation’s Cybersecurity, issued May 12, 2021. [1: Operational/Operations Technology (OT) - sometimes referred to as “non-IT technology”: Programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA) systems, building management systems, fire control systems, and Physical Access Control Systems (PACS). Within the VA, OT includes medical devices/equipment and other Internet of Things (IoT). (Source: SP 800-37, Revision 2)] [2: VA OI&T Enterprise Cybersecurity Strategy, October 6, 2017.] [3: Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3553 (P.L. 113-283-Title III), December 18, 2014.]

The ESAF will assist technology owners, designers, operators, and the various VA stakeholders to integrate appropriate cybersecurity and privacy capabilities within the VA’s IT/OT systems and solutions. These groups include, but are not limited to: VA Business Owners/Business Product Owners/Information System Owners (BO/BPO)/ISO) or system stewards, Project/Product Managers (PM), Product Line Managers (PLM), Information System Security Officers (ISSO), enterprise IT/OT security architects, engineers, developers, and other VA OI&T subject matter experts. The ESAF’s primary goal is to assist the VA to ensure delivery of operationally effective, secure, EA-compliant IT/OT systems/solutions that protect the confidentiality, integrity, and availability of Veteran and VA data from a wide array of vulnerabilities and threats.

The ESAF is derived from the NSA Community Gold Standard (CGS) Framework Version 2.0 and consists of twenty-two (22) cybersecurity capabilities, and their sub-capabilities, each grouped under four security functional areas: Govern, Protect, Detect, and Respond & Recover. The ESAF defines each of these cybersecurity capabilities and sub-capabilities, describes their relevance to enterprise cybersecurity and privacy, and provides guidance for how to address or integrate the capability into the VA enterprise and IT/OT systems/solutions. The VA organizations, processes, procedures, and enterprise security systems/tools that support each capability is described. Both NIST SP 800-53 Revision 4 and NIST SP 800-53 Revision 5 cybersecurity and privacy controls associated with each ESAF cybersecurity and privacy capability are identified to facilitate VA understanding as this transition occurs over time.

The ESAF may be used throughout all phases of the VA System Development Life Cycle (SDLC), including agile Development, Security, and Operations (DevSecOps) methodologies, the Veteran-Focused Integration Process (VIP), and OI&T Unified Intake/VIP Request (VIPR) process to ensure early and consistent ESA and development guidance. It also complements various VA risk management processes including the ESA Risk Assessment and Architecture Review Process (RAARP), ESA Threat Modeling Methodology (TMM), Enterprise Security Risk Assessment Model (ESRAM)[footnoteRef:4], and the VA/U.S. National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) and Assessment and Authorization (A&A) processes. Furthermore, the ESAF helps to optimize the selection and implementation of cybersecurity and privacy capabilities, and to guide security investment planning and funding prioritization. [4: Enterprise Security Risk Assessment Model (ESRAM) provides cybersecurity analytic capabilities using existing authoritative operational data from VASI and eMASS to produce enterprise risk views of VA business operations as a function of implemented IT system security controls.]

Introduction The Department of Veterans Affairs (VA) initiated its Enterprise Architecture (EA) program in 2016 to help guide information and technology system development efforts, and be “an authoritative reference for the requisite strategic, business, and technology information used to enable transformation across the department.”[footnoteRef:5] The Enterprise Security Architecture (ESA) organization within the Office of Information Security (OIS) division of the VA Office of Information and Technology (OI&T) was established to help institutionalize cybersecurity across the VA Information Technology (IT) and Operational/Operations Technology (OT) enterprises, its various mission areas and to facilitate cybersecurity integration into the VA EA. It accomplishes this through policy development, guidance, standardized architecture methodologies and design mechanisms, and support of the cybersecurity risk management process. ESA goals and objectives support federal and VA cybersecurity and privacy policies and requirements, lay the foundation to build-in cybersecurity into IT/OT initiatives, support risk-based decision-making, and align technology investment prioritization. [5: VA EA Vision and Strategy; July 8, 2019.]

This VA Enterprise Security Architecture Framework (ESAF) is a foundational document that serves to guide IT/OT stakeholders[footnoteRef:6] to incorporate cybersecurity and privacy capabilities within the ESA – the security domain of the VA Enterprise Architecture (EA). The primary objective of the ESAF is to guide the creation of secure IT architectures, systems, and solutions to protect VA and Veterans data. The ESAF is intended to help guide how cybersecurity and privacy are architected in the VA IT/OT enterprise and integrated by IT/OT solutions (i.e., systems, products, services, etc.) early and throughout the VA System Development Life Cycle (SDLC). The ESAF also enables the VA Cybersecurity Program described in VA Directive 6500, VA Cybersecurity Program[footnoteRef:7], complements VA cybersecurity risk management process, and may be leveraged to develop VA enterprise security reference architectures and IT/OT security solution architectures. [6: VA IT/OT stakeholders include, but are not limited to, Business Owners (BO)/Business Product Owners (BPO)/Information System Owners (ISO), Project/Product Managers (PM), Product Line Managers (PLM), Information System Security Officers (ISSO), IT/OT security architects, engineers, developers, and other VA IT/OT subject matter experts.] [7: VA Directive 6500, VA Cybersecurity Program, February 24, 2021. https://dvagov.sharepoint.com/sites/OITOIS/KnowledgeService/Pages/Information-Security-Policy.aspx

The ESAF also serves as a key enabler for compliance with White House Executive Order (EO) 14028, Improving the Nation’s Cybersecurity, issued May 12, 2021. The ESAF identifies specific cybersecurity and privacy capabilities that when implemented, directly address the following requirements from this Executive Order:

· Removing Barriers to Threat Information Sharing (Section 1.3 - IA Policy and Engagement)

· Modernizing Federal Govern Cybersecurity (Section 2.2 - Network Security)

· Enhancing Software Supply Chain Security (Section 1.5 - Acquisition)

· Standardizing the Federal Government’s Playbook for Responding to Cybersecurity Vulnerabilities and Incidents (Section 4.1- Cyber Incident Response)

· Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Networks (Section 3.3 - Intrusion Detection and Prevention), and

· Improving the Federal Government’s Investigative and Remediation Capabilities (Section 4.1 - Cyber Incident Response).

Scope The ESAF applies to the all VA’s networks, systems, and technology that connect to VA’s entire production enterprise IT/OT infrastructures. The ESAF impacts processes, procedures, services, and technologies encompassing internally-developed systems, solutions, software applications, and networks. It also applies to IT/OT procured by VA from contractors, subcontractors, and third-party service providers (e.g., cloud computing services).

The ESAF is intended to raise awareness of universal cybersecurity and privacy capabilities applicable to any IT/OT initiative, and assist stakeholders with implementing corresponding functionality within the VA enterprise architecture as an integral part of existing VA processes and methodologies (e.g., Veteran-Focused Integration Process (VIP), OI&T Unified Intake/VIP Request (VIPR)[footnoteRef:8], IT/OT acquisition/procurement, Development, Security, and Operations (DevSecOps), Risk Management Framework (RMF), and Assessment and Authorization (A&A)). The cybersecurity and privacy capabilities defined in the ESAF support all phases of the IT/OT SDLC described in VA Handbook 6500.5, Incorporating Security and Privacy into the System Development Life Cycle[footnoteRef:9], including project/product initiation, acquisition, development, implementation, assessment, operations and maintenance, and disposal. [8: VA OI&T Unified Intake/VIPR process is expected to be replaced with the IT Centralized Request Intake (ITCRI) process.] [9: VA Handbook 6500.5, Incorporating Security and Privacy into the System Development Life Cycle, March 22, 2010.]

The VA surveyed several IT/OT security frameworks and architecture development methodologies developed by and/or used throughout the U.S. Government and private industry as inspiration for the VA ESAF. These included the National Security Agency (NSA) Community Gold Standard (CGS) Framework[footnoteRef:10], U.S. National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF)[footnoteRef:11], Sherwood Applied Business Security Architecture (SABSA) framework and methodology[footnoteRef:12], Department of Defense (DoD) Architecture Framework (DoDAF)[footnoteRef:13], and The Open Group Architecture Framework (TOGAF) Standard[footnoteRef:14], described in Figure 1: Security Frameworks Related to the VA ESAF.[footnoteRef:15] [10: National Security Agency (NSA) Community Gold Standard (CGS) Framework, Version 2.0, June 26, 2014.] [11: National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), Version 1.1, April 16, 2018.] [12: Sherwood Applied Business Security Architecture (SABSA), https://sabsa.org/] [13: Department of Defense (DoD) Architecture Framework (DoDAF), Version 2.02, August 2010.] [14: The Open Group Architecture Framework (TOGAF) Standard, Version 9.2, April 2018.] [15: Appendix B, Security Frameworks and Architecture Methods provides a synopsis of the various security frameworks that were considered.]

Figure 1: Security Frameworks Related to the VA ESAF Ultimately, the VA ESA organization selected the NSA CGS Framework as the foundation for the VA ESAF because it provides guidance for organizations to plan, implement, operate, and maintain mission-enhancing cybersecurity and privacy capabilities, as well as support an enterprise cybersecurity risk management program. The NSA CGS Framework and The VA ESAF support compliance with U.S. Government cybersecurity and privacy legislative requirements, and are aligned with the NIST CSF and RMF. The VA ESAF is also consistent with VA’s cybersecurity directives, the VA 2018-2024 Strategic Plan, the VA Enterprise Cybersecurity Strategy (ECSS)[footnoteRef:16], and the VA EA Framework. The VA ESAF enables VA 2018-2024 Strategic Plan Goal 4: “transform business operations by modernizing systems and focusing resources more effectively to be competitive and to provide world-class customer service to veterans and its employees.” Additionally, the VA ESAF supports all four VA ESA Strategy[footnoteRef:17] goals: [16: VA OI&T Enterprise Cybersecurity Strategy, October 6, 2017.] [17: VA Enterprise Security Architecture (ESA) Strategy, January 2020.]

· Goal 1: Enable a secure VA business environment

· Goal 2: Enhance VA’s enterprise-wide cybersecurity risk management practices

· Goal 3: Drive VA’s cybersecurity directives (indirect support)

· Goal 4: Innovate VA’s cybersecurity operations Purpose The VA ESAF shall assist VA IT/OT system and solution owners, designers, operators, and various stakeholders to identify, design-in (rather than bolt-on later), and implement appropriate cybersecurity and privacy capabilities in systems/solutions to defend against cyber threats, mitigate risks to Veteran and VA data and information systems, and comply with Federal laws and regulations (e.g., Federal Information Security Modernization Act (FISMA)[footnoteRef:18]), as well as VA cybersecurity policies and directives. The ESAF supports VA security risk assessment and management by enabling identification and remediation of deficiencies in cybersecurity and privacy capabilities and associated security controls as part of the VA RMF and A&A. It also serves to support security investment planning and prioritization, assist with IT/OT acquisition and procurement, and aids portfolio management by ensuring IT/OT initiatives and projects/products address cybersecurity and privacy capabilities at the start and throughout the life cycle. [18: Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3553 (P.L. 113-283-Title III), December 18, 2014.]

The ESAF enables development of holistic IT/OT security solution architectures. It is intended to provide guidance early and throughout the VA SDLC to select and integrate cybersecurity and privacy capabilities, and associated security countermeasures and mechanisms (e.g., security controls), within the VA enterprise and IT/OT systems and solutions as part of an architecture-driven, systems security engineering and design process. The ESAF supports IT/OT security architecture development activities, which are pre-cursors to IT/OT systems security engineering, and helps elicit, analyze, and specify functional cybersecurity and privacy requirements and capabilities to satisfy business needs. Ultimately, the ESAF supports the IT/OT system security architecture and engineering process by ensuring traceability from business needs and security requirements to associated cybersecurity and privacy capabilities, and the security controls implemented in the system design.

The ESAF may serve many VA stakeholders at different phases of the VA SDLC, in conjunction with existing VA OI&T processes, to:

· Define VA cybersecurity and privacy capability requirements in procurement solicitations and contract language, including references in VA Handbook 6500.6, Contract Security[footnoteRef:19]. [19: VA Handbook 6500.6, Contract Security, March 12, 2010. (Note: Undergoing update as of June 2021.) ]

· Guide specification of cybersecurity and privacy requirements when defining business needs within a Business Epic submitted for a new capability request at the start of the OI&T Unified Intake Process[footnoteRef:20]. Upon receipt of a VIPR Workbook, intake analysts and architects may use the ESAF, and associated questions, during the discovery and analysis phases of the OI&T Intake Process to validate use of cybersecurity and privacy capabilities. [20: The VA OI&T Unified Intake Process is expected to be replaced by the IT Centralized Request Intake (ITCRI).]

· Support the VA RMF process during the “Prepare” step[footnoteRef:21] to ensure organization-wide governance is in place to enable execution of a consistent risk management process toward efficient achievement of a system Authorization to Operate (ATO). [21: See tasks associated with the VA RMF Prepare step for Organization and System Levels. ]

Many ESAF cybersecurity and privacy capabilities, and their associated implementations, are provided by the existing VA enterprise architecture, are inherent to the ESA, and should be considered for integration into developed or acquired IT/OT system/solution architectures. For example, Portfolio Management, Credential Management, Network Enterprise Monitoring, and Cyber Incident Response are common VA enterprise cybersecurity capabilities (associated with VA Common Control Providers (CCP)[footnoteRef:22]) that may be inherited by individual systems/solutions. [22: VA Common Control Providers (CCP) are identified as a System of Record (SOR) and include VA Tier 1 SOR, Infrastructure Operations SOR, and VA Area SOR as described in Appendix D of VA Authorization Requirements Standard Operating Procedures, Version 1.19, January 13, 2021. ]

The content provided in the VA ESAF Cybersecurity & Privacy Capability Catalog (Sections 1-4) is intended to help answer the following questions:

· What are the VA ESAF cybersecurity and privacy capabilities?

· Why should VA ESAF cybersecurity and privacy capabilities be leveraged and/or integrated in IT/OT systems/solutions, including directives and policies driving their implementation?

· Who or which VA organizations are directly involved or support integration/execution of the VA ESAF cybersecurity and privacy capabilities?

· How can VA ESAF cybersecurity and privacy capabilities be integrated/implemented into the Business Owners initiative/solution (i.e., what VA processes, procedures, tools, systems, and the latest version of NIST Special Publication (SP) 800-53 security controls should be leveraged)?

· When during the IT/OT SDLC may VA ESAF cybersecurity and privacy capabilities be integrated/implemented and/or executed?

How to Use the VA ESAF The VA ESAF is intended to be leveraged to support IT/OT security architecture activities throughout the VA SDLC, including implementation of VA DevSecOps practices. The ESAF document and ESAF Capability Questionnaire, provided in Appendix B, will facilitate stakeholder planning, focus, collaboration, and security architecture/engineering activities toward implementing necessary capabilities to satisfy security and privacy requirements.

Figure 2: VA ESAF Process Flow depicts the inputs, process, and outputs associated with the ESA activities that the ESAF enables. Steps 1-10 of the VA ESAF process may serve as a notional ESA Architecture Development Methodology (ADM).

Figure 2: VA ESAF Process Flow The VA ESAF process flow consists of the following steps:

Step 1: The BO/BPO/ISO or system steward identifies business, cybersecurity, and privacy needs to fulfill operational business/mission objectives. Operational security needs are typically discovered through business use case scenarios or an Operational Needs Assessment. This occurs as part of the OI&T Unified Intake Process when Business Epics are submitted by BO/BPO/ISOs.

Step 2: Define operational cybersecurity and privacy requirements early in the architecture-driven Information Systems Security Engineering (ISSE) process. This activity occurs during the contextual/conceptual level of security architecture development (i.e., Steps 1 and 2 of the VA EA ADM, Identify Business Needs and Document Architecture Requirements). Operational cybersecurity visibility requirements should be identified early in coordination with the VA CSOC Cybersecurity Technical Services team (see Section 3.4, Network Enterprise Monitoring).

Step 3: Identify applicable ESAF cybersecurity and privacy capabilities that are needed to satisfy operational cybersecurity and privacy requirements.

Step 4: Evaluate gaps in cybersecurity and privacy capabilities and ensure alignment of ESAF capabilities with business/mission cybersecurity and privacy needs.

Step 5: Develop ESA views and artifacts that clarify, and show alignment between, business/mission cybersecurity and privacy needs, requirements, ESAF cybersecurity and privacy capabilities, and secure system function at the architecture level.

Step 6: Allocate cybersecurity and privacy requirements to the security architecture and elements of the IT system/solution security design. Traceability between business/mission needs, cybersecurity and privacy requirements, ESAF cybersecurity and privacy capabilities, the security architecture, and the system security design is established.

Step 7: Support the secure design and development activities of the IT system/solution. Cybersecurity and privacy requirements are transformed into system-level functional and technical requirements (i.e., Step 3 of the VA EA ADM, Design Release).

Step 8: Provide guidance to the BO/BPO/ISO and other VA stakeholder organizations for the development and integration of the secure IT system/solution.

Step 9: Perform post-design/development or current state (as-is) security architecture risk assessment of the IT system/solution to compliment risk assessments performed in support of the VA RMF and A&A process.

Step 10: Identify and implement cybersecurity and privacy risk remediation/mitigation measures to reduce residual risk to an acceptable level and achieve an ATO.

Relationship of ESAF Process Flow Activities to VA IT/OT Processes and Methods VA ESAF process flow activities are an integral part of, and complementary to, existing VA IT/OT processes and methods. The VA ESAF process flow steps are associated with different phases of VA OI&T processes and methods as depicted in Figure 3: Relationship of VA ESAF Process Flow Activities to VA IT/OT Processes and Methods. VA ESAF process flow activities align with the following VA processes: SDLC, VIP, OI&T Unified Intake, EA ADM, and VA/NIST RMF.

The ESAF aligns with and supports existing VA OI&T processes that enable cybersecurity and privacy capabilities, including:

· VA SDLC and DevSecOps Methodology

· The ESAF supports the VA SDLC to incorporate security and privacy into the design of IT/OT systems/solutions and products in accordance with VA Handbook 6500.5.

· Cybersecurity and privacy capabilities incorporated early into system architectures and software application designs, promote continuous product quality and productivity improvements.

· Utilizing ESAF guidance can reduce redesign iterations, resources, schedule, and costs.

· VIP and OI&T Unified Intake Process

· The ESAF supports the VIP and complements the VIP security overlay described in the VA Security Guide to VIP[footnoteRef:23]. The VIP is enabled by the OI&T Unified Intake Process, or VIP Request (VIPR) where BO/BPO/ISO IT/OT solutions are analyzed, validated, and prioritized for execution. [23: VA OI&T OIS Cybersecurity Technology & Metrics (CTM) Security Guide to VIP, Version 1.0, April 1, 2021. This guide is produced by the IT Security Engineering-CTM-ISPS-OIS-OI&T organization.]

· The ESAF Capability Questionnaire (see Appendix B) should be used early in the OI&T Unified Intake Process (or future ITCRI process) to assist in evaluating IT/OT projects/products/initiatives for cybersecurity and privacy capability integration.

· VA RMF and A&A process

· The ESAF supports the VA RMF and A&A process, as defined in VA Handbook 6500, Risk Management Framework for VA Information Systems–VA Information Security Program [footnoteRef:24] and documented in VA Authorization Requirements Standard Operating Procedures[footnoteRef:25]. [24: VA Handbook 6500, Risk Management Framework for VA Information Systems-VA Information Security Program, February 24, 2021.] [25: VA OIS Authorization Requirements Standard Operating Procedures, Version 1.19, January 13, 2021. ]

· ESA Metrics Program

· VA cybersecurity and privacy implementations are evaluated by aligning operational performance metrics with ESAF cybersecurity capability functions.

· VA ESA Threat Modeling Methodology (TMM) version 1.1[footnoteRef:26] and threat model analysis process [26: VA ESA-OIS Threat Modeling Methodology, Version 1.1, November 23, 2020.]

· ESAF cybersecurity and privacy capabilities may be used to mitigate identified and evaluated attack vectors.

· VA Enterprise Security Risk Assessment Model (ESRAM)

· A framework that uses VA system-level operational data[footnoteRef:27] to provide strategic enterprise-wide visibility and analysis of business/mission impact of security risks and threats to VA capabilities, services, and functions. [27: Authoritative data sources include VASI and eMASS.]

· VA ESA Risk Assessment and Architecture Review Process (RAARP)[footnoteRef:28] [28: VA OIS Risk Assessment and Architecture Review Process (RAARP), Version 0.6, February 2021.]

· Used to assess the maturity level associated with planning, organizing, designing, and building secure IT/OT architectures for integration within the VA IT/OT enterprise.

· VA EA Architecture Development Methodology (Security Domain)

· The ESAF helps ensure ESA integration with the VA EA.

Figure 3: Relationship of VA ESAF Process Flow Activities to VA IT/OT Processes and Methods

VA ESAF Cybersecurity/Privacy Capability Catalog The VA ESAF consists of the following four cybersecurity functions and the associated cybersecurity and privacy capabilities depicted in Figure 4[footnoteRef:29]: ESA Framework Functions and Capability Areas: [29: The graphic depicted in Figure 4 was reused from the National Security Agency (NSA) Community Gold Standard (CGS) Framework, Version 2.0 (June 26, 2014) document.]

1.

2. Govern

3. Protect

4. Detect

5. Respond and Recover

Figure 4: ESA Framework Functions and Capability Areas These four ESAF cybersecurity functions, which are derived directly from the NSA CGS, are closely related to the five functions described in the NIST CSF: Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC). The primary difference is that the ESAF replaces the CSF Identify function with the Govern function, which describes the foundational processes and resources necessary to support the secure development and sustainment of VA IT initiatives. Relationships between each ESAF function, associated cybersecurity and privacy capabilities, NIST CSF Category Unique Identifiers, and applicable NIST SP 800-53 Revision 4[footnoteRef:30] and Revision 5[footnoteRef:31] security controls are identified within the document. The NIST CSF Category Unique Identifiers and 800-53 security control crosswalks support operational correlations and interagency reporting. Both NIST SP 800-53 Revision 4 and Revision 5 security and privacy controls are identified for each ESAF cybersecurity and privacy capability to enable present and future use after VA adoption of Revision 5 (Revision 4 is officially withdrawn on September 23, 2021). The provided cross-walk of ESAF cybersecurity and privacy capabilities to NIST SP 800-53 Revision 4 security controls is derived from NSA CGS Framework Version 2.0, Appendix E Relationship to CNSSI 1253 Security Controls. The cross-walk of ESAF cybersecurity and privacy capabilities to NIST SP 800-53 Revision 5 security controls is the result of independent analysis. [30: NIST SP 800-53, Revision 4 Security and Privacy Controls for Information Systems and Organizations, January 22, 2015. (Note: To be withdrawn on September 23, 2021.)] [31: NIST SP 800-53, Revision 5 Security and Privacy Controls for Information Systems and Organizations, September 23, 2020. ]

The content in the VA ESAF Cybersecurity Capability and Privacy Catalog (Sections 1-4) provides VA stakeholders with guidance on how VA people (organizations), processes, procedures, and technologies may be leveraged to effectively integrate cybersecurity and privacy capabilities/sub-capabilities within VA developed or acquired IT/OT systems and solutions. VA enterprise security tools, systems, services, and solutions that help implement the ESAF cybersecurity and privacy capabilities are also identified (as documented in the VA ESA Data Catalog and VA ESA Enterprise-level Data Architecture).

Govern The VA ESAF Govern function includes cybersecurity and privacy capabilities that provide a foundation for VA enterprise IT/OT system and data protection, resiliency, and risk management activities to help ensure operational business/mission assurance. These capabilities also highlight processes to understand, obtain, and maintain the necessary resources to effectively manage VA enterprise IT/OT security risk.

ESAF cybersecurity and privacy capabilities associated with the Govern function are particularly relevant to the “Prepare” step of the RMF process where comprehensive, enterprise-wide governance helps prepare the VA organization to manage its security and privacy risks and enable compliance with Federal cybersecurity and privacy regulations.

The Govern function enables the VA to achieve Goal 4 of the VA ECSS: A Secure Operational Environment Supports Effective Operations, Objective A: Risk management is integrated with governance across the enterprise.[footnoteRef:32] This requires VA to integrate its cyberspace and security capabilities and outcomes within larger governance, business operation, and technology architecture frameworks.” The Govern function has seven security capability areas depicted in Figure 5: Govern Cybersecurity and Privacy Capabilities. [32: VA Enterprise Cybersecurity Strategy, October 6, 2017.]

Figure 5: Govern Cybersecurity and Privacy Capabilities Understand the Mission The Understand the Mission capability defines the relationship and dependencies between the VA mission and its supporting people, processes, technology, and environment. Understanding the mission(s), goals, objectives, and success criteria are essential to establishing an effective and secure architecture that provides the necessary cybersecurity and privacy capabilities.

BO/BPO/ISO, PM/PLM, enterprise IT/OT system and security architects/engineers, developers, and other influential VA stakeholders must understand how data, and IT/OT systems, infrastructure, and services support the VA mission. It is important to understand this early in the SDLC to ensure a focus on achieving strategic goals and effective planning to meet VA operational objectives.

Mission understanding can be established with knowledge of the following:

The vision, goals, and operational objective(s) that support the enterprise mission(s).

Mission priorities, and related functions and capabilities.

Applicable federal laws, directives, and policy pertaining to the VA’s mission and supporting IT/OT initiative(s).

System and data interrelationships (dependencies).

Physical and logical environments that support mission operations and known threats (see Understand the Environment).

Measures of success (e.g., Measures of Effectiveness (MOE), Measures of Performance (MOP), and Measure of Suitability (MOS).[footnoteRef:33] [33: MOS is an item’s ability to be supported in its intended operational environment. It typically relates to readiness and operational availability, hence to: reliability, maintainability, compatibility, interoperability, supportability, even documentation, and training. ]

The Understand the Mission ESAF cybersecurity capability aligns with the following NIST SP 800-53 security controls and CSF Category Unique Identifiers:

Applicable NIST SP 800-53, Revision 4 security controls: PM-11, RA-2, SC-6 Applicable NIST SP 800-53, Revision 5 security controls: All -1 controls from all security control families, AC-4, CA-3, CP-2, CP-11, CA-9, PL-8, PM-1, PM-2, PM-3, PM-7, PM-8, PM-9, PM-10, PM-11, PM-28, PM-29, PS-7, PS-9, RA-1, RA-2, RA-3, RA-9, SA-2, SA-8, SA-17, SA-20, SC-6, SR-1, SR-3, CP-2, CP-11 Table 1: CSF Alignment with ESAF Capability—Understand the Mission

Understand the Mission capability consists of the following sub-capabilities:

1. Mission Identification

2. Mission Sustainment

3. Understand Mission Data and Risks

4. Utilization and Performance Management Mission Identification The VA Functional Organization Manual (FOM)[footnoteRef:34] is the authoritative source that documents the organization structure, missions, functions, and tasks of the VA and its organizations. The VA FOM states that the VA mission is to “serve America’s Veterans and their families with dignity and compassion, and to be their principal advocate in ensuring that they receive medical care, benefits, social support, and lasting memorials promoting the health, welfare, and dignity of all Veterans in recognition of their service to this Nation”. Mission Identification enables every IT/OT project/product or initiative to be aligned with and support the VA mission(s) and/or particular mission areas. The VA Office of Regulatory Policy and Management (ORPM) and VA Office of Congressional and Legislative Affairs (OCLA) also support alignment of the VA mission(s) and with legal requirements and policy directives pertaining to cybersecurity. [34: VA Functional Organization Manual, Version 4.0, Description of Organization Structure, Missions, Functions, Activities, and Authorities, 2017.]

The VA Directive 6500, VA Cybersecurity Program and the VA ECSS enables the VA mission(s) by providing enterprise IT/OT cybersecurity and privacy capabilities that protect Veteran and VA data and information systems. Appendix F, References lists authoritative resources addressing cybersecurity and privacy capabilities for VA mission(s).

Mission Sustainment Mission Sustainment refers to the ability to continually monitor, evaluate, assess, and mitigate security risk to the VA mission(s). VA stakeholders must understand the security risks to the mission, potential level of impact, and continuously monitor and report the effectiveness of managing enterprise IT/OT security risk to support and sustain the mission. IT/OT systems must also be periodically re-evaluated for security implications due to changes in cybersecurity policy, security threats and vulnerabilities, cybersecurity and privacy capabilities, and IT/OT system functions and environment. This may be accomplished by leveraging processes and methods described in Sections 1.1.3, Understand the Mission Data and Risk and 3.1, Security Evaluations. Mission Sustainment is also supported through contingency and continuity management, as described in Section 4.2.

Understand the Mission Data and Risk Understand the Mission Data and Risk involves understanding the data that supports the VA mission(s) and the security risks to the data when executing the mission(s). VA stakeholders must identify the data types associated with the VA mission, its relevance, and value to the VA mission(s), the IT/OT environment where it is processed, transmitted, or stored, and the resulting security risks.

Data characterization and categorization are VA processes that support Understand the Mission Data and Risk. Maintaining information privacy requires identifying the data that is classified Personally Identifiable Information (PII) and/or Protected Health Information (PHI) so that appropriate security and privacy safeguards can be implemented.

VA Directive 6502, VA Enterprise Privacy Program[footnoteRef:35] defines the requirements and responsibilities for the VA Enterprise Privacy Program. It requires the BO/BPO/ISO, Information System Security Officer (ISSO), and Privacy Officer (PO) to perform and submit a Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) to establish data protection requirements and association with any VA High-Value Asset (HVA) repositories. [35: VA Directive 6502, VA Enterprise Privacy Program, May 5, 2008.]

The PTA/PIA process is governed by:

· VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessments, October 15, 2014

· VA Handbook 6508.1, Procedures for Privacy Threshold Analysis and Privacy Impact Assessments, July 30, 2015 The PTA/PIA templates and processes[footnoteRef:36] are available from the VA Privacy Services Office. [36: https://vaww.oprm.va.gov/privacy/faqs_privacy.aspx]

The ESAF Detect function and Network Enterprise Monitoring/Data Monitoring and Analysis sub-capabilities also support Understand the Mission and Risk by providing automated tools, such as Imperva Database Monitoring, to continuously monitor and analyze data security risk in near real-time, and the VA Data Inventory (VADI)[footnoteRef:37], which provides an authoritative repository of VA data assessed for privacy and security impact considerations. [37: The VA Data Inventory (VADI) is the authoritative data source for data elements throughout VA. ]

The VA RMF and A&A processes also support Understand the Mission Data and Risk. Data security categorization must be performed during the first step of the RMF process to determine the potential security impact resulting from loss of confidentiality, integrity, and availability. The VA Security Guide to VIP, Appendix: RMF Standard Operating Procedures, provides guidance for the ISO and ISSO to perform security categorization and PTA/PIA activities.

Understand the Mission and Risk is also supported by various VA policies, processes, and procedures related to enterprise security risk assessment and management, including:

· VA Handbook 6500, Risk Management Framework for VA Information Systems–VA Information Security Program, February 24, 2021.

· VA Directive 6517, Cloud Computing Services, November 15, 2016.

· VA Handbook 6517, Risk Management Framework for Cloud Computing Services, November 15, 2016.

· VA OIS Authorization Requirements Standard Operating Procedures, Version 1.19, January 13, 2021.

· VA Enterprise Mission Assurance Support System (eMASS) Implementation Guide, Version 1.1, July 22, 2020.

The VA Governance, Risk, and Compliance (GRC) tool, eMASS, supports Understand the Mission Data and Risk by automating much of the RMF workflow and A&A process, recording security vulnerabilities, and prioritizes remediation and/or mitigation. All VA IT/OT systems must be assessed by the VA Information Security Risk Management (ISRM)-Information Security Operations (ISO)-OIS-OI&T Risk Review teams in preparation for authorization.

VA processes, methods, and enablers that support Understand the Mission Data and Risk include:

· VA ESA RAARP, as described in VA ESA-OIS-OI&T Enterprise Security Architecture Risk Assessment and Architecture Review Process (Draft), Version 0.6, February 2021.

· The VA ESA-OIS organization performs security architecture risk assessments to determine if cybersecurity and privacy capabilities are adequately established within IT/OT system/solution architectures by design.

· The ESA TMM is leveraged to assess risk by identifying potential cyber threats and attack vectors and uses the ESAF to assess the degree to which implemented cybersecurity and privacy capabilities mitigate risk.

· VA ESA-OIS Security Architecture Risk Assessment Report (SARAR) Template, Version 0.1, August 2020 is used to guide report generation.

· Enterprise Security Risk Assessment Model (ESRAM)

· A security risk assessment model used is to identify and analyze potential threat actors and patterns that target IT/OT security architectures and evaluate the effectiveness of cybersecurity and privacy capabilities, and controls.

· Risk scoring evaluates the effectiveness of cybersecurity and privacy capabilities and security controls to mitigate risk against identified threats and attack vectors.

Utilization and Performance Management Utilization and Performance Management is a sub-capability that ensures quality-of-service to operational components within the VA enterprise. Information security performance targets are established and performance measures documented for analysis and reporting. The focus is on maintaining enterprise network and system availability and ensuring expected service levels are met. Input in the form of network bandwidth utilization, system resource consumption, and server performance is provided by VA tools such as Unified Infrastructure Management (UIM) Performance Reporting Tool, NetScout nGenius, SolarWinds Orion[footnoteRef:38], Nagios, Applicare, and CA eHealth/Performance Management. These systems/tools are also associated with the ESAF cybersecurity Detect function and Network Enterprise Monitoring capability. Cybersecurity impact on enterprise IT/OT performance is also assessed as part of the ESAF Detect function, by leveraging the Security Evaluations cybersecurity capability. [38: At the time of release of this document, SolarWinds Orion is being removed from VA’s Enterprise tool set, it’s functionality will be replaced by other tools.]

Understand the Environment The…