Attachment J.21. - Peace Corps IT Plan of Action and Milestones.pdf

Peace Corps

Information Technology Security Program Plan of Action and Milestones (POA&M) CIO-SEC-PRC-10, v1.1

This document is approved for distribution. Policies, procedures and standards, herein, are effective at the date of signature until explicitly superseded or rescinded.

Peace Corps Chief Information Security Officer

CIO-SEC-PRC-10 Plan of Action and Milestones

Peace Corps 1

Revision History

Revision Date

Author Revision Description

5/28/2021 M. Terry Initial draft

6/9/2021 M. Terry In order to mature the POAM process, the WER-CAP template have been updated as mandatory. This will be revisited pending future review.

Peace Corps 2

Peace Corps

Table of Contents 1 Introduction

1.1 Purpose

1.2 Policy

1.3 Quarterly POA&M Reporting Schedule

2 Roles and Responsibilities

2.1 PC Chief Information Officer (CIO)

2.2 PC Chief Information Security Officer (CISO)

2.3 Authorizing Official (AO)

2.4 Office of the Chief Information Security Officer (OCISO) Directors

2.5 Information Systems Security Manager (ISSM)

2.6 Information System Security Officer (ISSO)

2.7 System Owners

3 POA&M Share Drives ......................................................................... Error! Bookmark not defined.

3.1 Access to Share Drive

3.2 Share Drive Directory Structure ..................................................... Error! Bookmark not defined.

3.3 Annual Share Drive Recertification Process ................................... Error! Bookmark not defined.

4 POA&M Types

4.1 Program Level POA&Ms

4.2 System Level POA&Ms

5 POA&M Criteria

5.1 Systems Requiring POA&Ms

5.2 POA&M Weakness Tracking Requirements

5.3 Additional Information Regarding POA&Ms

6 POA&M Template Content and Guidance

6.1 POA&M Sharing

6.1.1 Sharing with Non-Share Drive Members

6.1.2 Sharing with Non-PC Account Holders ............................... Error! Bookmark not defined.

7 POA&M Reviews and Reports

7.1 POA&M Review and Report (ISSO)

7.2 Management Report (ISSM/System Owner)

7.3 Management Report (Director) ..................................................... Error! Bookmark not defined.

7.4 Management Report (CISO/AO’s) .................................................. Error! Bookmark not defined.

8 Definitions

Figure 3-1: Example Share Drive Structure

Note: It may be necessary to copy and paste hyperlinks in this document (Right-Click, Select Copy Hyperlink) directly into a web browser rather than using Ctrl-Click to access them within the document.

Peace Corps 3 i 1 Introduction

The Plan of Action and Milestones (POA&M), also referred to as a corrective action plan, is the authoritative agency management tool for documenting the remediation actions of system risk.

POA&Ms are used to assist in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for security weaknesses found in agency programs and systems. This guide addresses both program and system level POA&Ms. Additional information about program POA&Ms and PC’s enterprise level information security program is available in CIO-SEC-PLN-04, “Information Security Program Plan.”

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Revision 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy” provides Federal guidance on POA&M management, monitoring, and reporting requirements. The Peace Corps (PC) requires POA&M updates to document the progress of the remediation efforts associated with identified weaknesses, including schedule changes. The Office of the Chief Information Officer’s Security & Governance (OCIO/SG) reviews POA&Ms on at least a quarterly basis. (In practice, POA&Ms are subject to review as often as biweekly.)

POA&Ms must:

• Estimate funding required to remediate the action if existing operation and maintenance (O&M) or development, modernization and enhancement (DME) will not be used.

• Include security weaknesses in need of remediation identified during any assessment.

For details on the types of assessments, audits, and categorization of POA&Ms see Section 5 and, CIO-SEC-PRC-01, “Managing IT Risk.” POA&Ms are an authoritative agency-wide management tool used to address findings from all evaluations.

• Be made available or access provided to the Office of Management and Budget (OMB), Department of Homeland Security (DHS), PC Office of Inspector General, and GAO upon request.

• Record and manage the mitigation and remediation of identified weaknesses and deficiencies, not associated with accepted risks, in organizational information systems and environments of operation.

• Record the status of delays (30, 60, 90, and 120 or more days).

• Be a permanent part of the A&A documentation for the life of the IT resource.

1.1 Purpose

This guide provides PC employees and contractors with significant security responsibilities as identified in the latest version of the CIO-SEC-REQ-01, “Information Security Program Requirements,” with the necessary guidance and procedures for developing, maintaining, and reporting POA&Ms for systems and programs under their purview.

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://insite.gsa.gov/topics/information-technology/security-and-privacy/it-security/it-security-procedural-guides https://insite.gsa.gov/directives-library/gsa-information-technology-it-security-policy-21001l-cio-chge-1

Peace Corps 4

The purpose of a POA&M is to monitor progress in correcting weaknesses or deficiencies associated with information systems. The POA&M identifies: (i) the tasks to be accomplished;

(ii) the resources required to accomplish the tasks; (iii) any milestones in meeting the tasks; and

(iv) scheduled completion dates for the milestones.

A risk assessment must be performed and the results leveraged to prioritize the remediation of the entries included within the POA&M. This will help ensure the weaknesses are addressed in a timely manner and receive appropriate resources.

In the event a risk cannot be remediated an Acceptance of Risk (AOR) must be created and properly approved in accordance with CIO-SEC-PRC-01, “Managing IT Risk.”

1.2 Policy

As required by Public Law 113-283, “Federal Information Security Modernization Act of 2014” (FISMA), the PC information security program provides security for information and information systems that support the operations and IT assets of the agency.

The processes presented in this guide reflect requirements defined in the following policy/guidance documents:

• MS 542, “Information Security Program”

• CIO-SEC-REQ-01, “Information Security Program Requirements”

• Public Law 113-283, “Federal Information Security Modernization Act of 2014”

• NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy”

CIO-SEC-REQ-01, Chapter 3, Policy for Identify Function, states:

4. Risk assessment.

h. All information systems must develop and maintain a POA&M in accordance with CIO- SEC-PRC-10. POA&Ms are the authoritative agency management tool for managing system risk and are used in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for security weaknesses found in agency programs and systems.

CIO-SEC-REQ-01, Chapter 4, Policy for Protect Function, states:

4. Information protection processes and procedures.

aa. The CISO will review POA&Ms quarterly and provide system level and management reports in accordance with CIO-SEC-PRC-10, “Plan of Action and Milestones (POAM)”.

https://docs.google.com/document/d/1_lBFA2EOe26pFxfe8o93jBr6UsJv04PfhGDV49CADH0/edit https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Peace Corps 5

1.3 Quarterly POA&M Reporting Schedule

Unless directed otherwise by the CISO, beginning in FY21, review dates performed by OCIO/SG are:

• Q1 –October 15;

• Q2 – January 15;

• Q3 – April 15;

• Q4 – July 15.

The ISSM sends one reminder per quarter to ISSOs regarding upcoming POA&M reviews – this reminder also identifies any POA&M entry or reporting changes required.

2 Roles and Responsibilities

The roles and POA&M responsibilities provided in this section have been extracted from CIO- SEC-REQ-01 or summarized from Federal guidance. Throughout this guide specific processes and procedures for implementing the POA&M Management Program are described.

2.1 Chief Information Officer (CIO)

Responsibilities include the following:

• Developing and maintaining an agency-wide Information Security Program.

• Reporting annually, in coordination with the other senior agency officials, to the Peace

Corps Director on the effectiveness of the agency information security program, including progress of remedial actions.

• Providing guidance or input for periodic assessments of organization security measures and goals to assure implementation of PC policy and procedures.

• Providing direction and coordinating with senior agency staff throughout the year on a comprehensive POA&M process.

• Executing the duties of the Authorizing Official role.

2.2 Chief Information Security Officer (CISO)

Responsibilities include the following:

• Establishing reporting deadlines for Information Security related issues requiring an agency response affecting the PC Information Security Program.

• Establishing and maintaining a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency.

• Supporting the CIO in reporting to the agency Director on the effectiveness of the agency information security program, including progress of remedial actions.

Peace Corps 6

• Developing and implementing information security performance metrics to evaluate the effectiveness of technical and nontechnical safeguards used to protect PC information and information systems.

• Administering FISMA requirements and coordinating PC’s annual FISMA security program review and Plan of Action and Milestones (POA&M) implementations.

• Managing and maintaining the agency POA&M process and tools.

• Providing guidance to the AO, ISSMs, ISSOs, System Owners and others in maintaining their POA&Ms in accordance with PC and Federal policies.

• Establishing the process for POA&Ms to be reviewed and reports to be prepared on a quarterly or ad hoc basis.

2.3 Authorizing Official (AO)

Responsibilities include the following:

• Ensuring a formal POA&M has been developed following an A&A process.

• Ensuring vulnerabilities identified from scans are tracked in the systems’ POA&M as required by the CISO.

• Ensuring POA&Ms are managed and maintained via the agency’s POA&M process using tools identified by the CISO.

• Reviewing POA&M metrics or reports and responding, as appropriate.

2.4 Security & Governance Program Manager

Responsibilities include the following:

• Monitoring adherence and proper implementation of PC’s Information Security Policy and reporting the results to the CISO.

• Providing guidance and support to the ISSMs and ISSOs for the management and maintenance of POA&Ms.

2.5 Information Systems Security Manager (ISSM)

Responsibilities include the following:

• Ensuring adherence and proper implementation of PC’s Information Security Policy.

• Managing POA&Ms for all systems under their purview. This includes ensuring quarterly updates are submitted on time.

• Ensuring ISSOs and System Owners are maintaining POA&Ms for their systems, including taking remediation actions according to the scheduled milestones.

• Reviewing POA&M metrics and reports (see Section 7.2), and responding in a timely manner as appropriate.

• Reviewing/approving ISSO checklists submitted in CSAM with respect to POA&Ms, and coordinating with ISSOs, as necessary, for systems under their purview.

Peace Corps 7

Note: ISSMs should insure the review of POA&Ms that are being updated for quarterly submission; and provide training to ISSO, and System Owners on proper POA&M reporting.

2.6 Information System Security Officer (ISSO)

Responsibilities include the following:

• Ensuring effective implementation of PC’s Information Security Policy.

• Working with the ISSM and System Owners to develop, implement, and manage

POA&Ms for assigned systems.

• Ensuring the POA&M is a permanent part of the A&A package, per PC requirements.

POA&Ms should never be deleted.

• Submitting accurately updated POA&Ms in a timely manner as required.

• Reviewing POA&M metrics and reports (see Section 7.1), and responding in a timely manner, as appropriate.

• Documenting the review/update of system POA&Ms when completing assigned ISSO checklists in CSAM and submitting the checklists when completed.

2.7 System Owners

Responsibilities include the following:

• Ensuring effective implementation of PC’s Information Security Policy.

• Working with the ISSO to develop, implement, and manage POA&Ms for their respective systems as required by PC policy.

• Reviewing POA&M metrics and reports and responding in a timely manner and as appropriate.

• Maintaining awareness of the state of weaknesses identified and POA&Ms developed to mitigate those weaknesses.

• Assuring resources are allocated to POA&Ms with the greatest criticality.

3 CSAM POA&M

OCIO/SG tracks all POA&Ms on CSAM, which serve as the primary tool for the management, storage, and dissemination of PC program and system level POA&Ms.

3.1 Access to CSAM

ISSOs, and ISSMs listed on designation or ATO letters will be provided access to POA&Ms for systems under their purview. System Owners identified in the PC System Inventory will be provided comment access to view POA&Ms for the systems under their purview. Any person who is not provided access via a designation or ATO letter must complete a User Access Request Form for approval to appropriate access in CSAM. This access request form is to be requested by the supervisor or alternatively, the ISSO. Authorization still requires approval by the CISO.

Peace Corps 8

3.2 Using CSAM

System POA&Ms and related data are located in CSAM. ISSOs, and others as authorized, will be able to access the CSAM for their systems in order to maintain POA&Ms, and provide additional documents/data as required. Figure 3-1 depicts the primary interface within CSAM used to both create, locate and edit POA&Ms. The instructions on how to properly use CSAM is out of scope for this guide, however, the instructions can be found in the CSAM User Manual.

Figure 3-1: Example Share Drive Structure

3.3 POA&M Development

For illustrative purposes, this process will focus on the weaknesses identified during a security control assessment, however, the process is virtually identical regardless of how or where the weakness was identified.

S&G utilizes the Weakness Evalution Report & Corrective Action Planning (WER-CAP) Worksheet to provide a consolidated view and systematic approach to developing corrective action plans, better known as POA&Ms. The WER-CAP template contains detailed instructions on its use within the worksheet.

1. Weakness Evaluation Report – The purpose of the WER is to perform a risk analysis of system/program level findings, determine root cause and prepare a high level recommendation to fix the problem. Additionally, this worksheet is used to group similar findings that may be best addressed with a single corrective action plan.

2. Corrective Action Plan - After completing the weakness evaluation, the ISSO and SME’s draft the corrective action plans into the CAP details worksheet. The CAP worksheet is intended to standardize draft POA&M development. By developing the CAP worksheet, the ISSO can ensure that due diligence is exercised against all POA&Ms prior to entering into CSAM. As a matter of process, the CAP worksheet must be reviewed by the ISSM or CISO before entry into CSAM.

3. POAM Creation – Once the CAP worksheet has been approved, the POAMs can be entered into CSAM. All activity will be tracked in CSAM from that time forward.

Peace Corps 9

4 POA&M Types

There are two types of POA&Ms used in PC, Program Level and System Level. Unless specified otherwise within this guide, the creation, management, and reporting of Program and System Level POA&Ms is the same.

4.1 Program Level POA&Ms

A Program Level POA&M is created to assist the CISO in documenting program level weaknesses or deficiencies at the program or PC organization level which affect the program’s or organization’s IT security efforts. During FY21 & FY22, the separate programs are being consolidated into a single Information Security Program to act as the common control program for the organization. The remedial actions defined reduce or eliminate identified weaknesses or deficiencies in the operation of programs for an organization.

4.2 System Level POA&Ms

A System Level POA&M assists in documenting planned remedial actions to correct weaknesses or deficiencies identified in relation to the technical, management, or operational aspects of a PC system, IT resource, or controls in NIST SP 800-53, Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations.”

5 POA&M Criteria

5.1 Systems Requiring POA&Ms

All PC FISMA systems in the CSAM information system inventory are required to develop, manage, and maintain a corresponding POA&M. Subsystem POA&Ms will be entered and maintained within the hosting information system’s POA&M. The subsystem must be listed in the hosting information system’s Hosted Subsystems appendix in its SSP, and ATO letter.

5.2 POA&M Weakness Tracking Requirements

Identified system weaknesses must be documented in the POA&M within one quarter of identification. S&G strongly suggests that POA&M updates be entered when the status of an entry changes and not just when quarterly submissions are due for review. All findings based on audits must be completed within twelve months of entry in the POA&M.

The following sources of weaknesses must be included in POA&Ms:

• Office of Inspector General (OIG) Audits. All findings noted in the final report, including those that may have already been corrected, must be individually identified in the POA&M. (Note: At the time of publication of this document, IG Metric POAMs are tracked outside of CSAM due to the reorganization of the programs into a consolidated common control program entitled Information Security Program (ISP)) http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

Peace Corps 10

• Annual Financial System Audits. All findings noted in the final report, including those that may have already been corrected, must be individually identified in the

POA&M.

• Internal Audits/Third Party Assessments. Findings noted in internal audits, third party assessments, or other reviews, as applicable, must be individually identified in the POA&M.

• Annual FISMA Self-Assessments. Include all weaknesses from an annual FISMA self-assessment, subject to the following criteria. Repeat finding(s) from prior years that are already reflected in the POA&M do not have to be re-entered. Update the Weakness Source column with the existing finding(s) to document the finding with the current year FISMA self-assessment. Update milestone changes, as appropriate.

A prior entry not completed must reflect the status as delayed.

• Assessment and Authorization (A&A). Include vulnerabilities of the information system discovered during the A&A process and/or security continuous monitoring as follows.

- Include any vulnerabilities associated with End-of-Life (EOL) software, regardless of the associated risk level.

- Do not include vulnerabilities identified as Low/Very Low risk in a POA&M, unless they are associated with EOL software or audit findings.

- POA&Ms must be created for Very High (Critical), High, and Moderate risk vulnerabilities in accordance with the following criteria:

• Assessment findings from test cases become individual entries in the

POA&M.

• Findings based on scans are grouped based on the type of scan (i.e., operating system, Web Application).

o Vulnerability Scans. Findings will result in one POA&M entry (per scan type-e.g., OS, Web Application) covering all Very High (Critical)/High and Moderate findings on all assets within the FISMA system boundary.

Vulnerability scan POA&Ms will state):

“Vulnerability scans have identified vulnerabilities for the system.

Critical/Very High vulnerabilities for Internet-accessible IP addresses must be remediated within 15 days, for all other assets Critical/Very High vulnerabilities must be remediated within 30 days; High vulnerabilities must be remediated within 30 days; Moderate vulnerabilities must be remediated within 90 days” o Configuration/Compliance Scans. A POA&M will be created if the composite compliance percentage of all assets with a single operating system is below 85% for over 90 days, a POA&M must be created for the non-compliant operating system. The resultant POA&M will state:

“Configuration/compliance scans indicate at least one operating system

Peace Corps 11 within the FISMA system boundary has been below 85% compliant for over 90 days.”

Note: PC systems not being scanned under PC’s vulnerability scanning program must include all identified weaknesses in their POA&Ms in order to provide CIO\SG visibility into their vulnerabilities. Vulnerabilities can be individually reported or grouped together and presented by risk level with each grouping constituting an explicit entry in the POA&M (e.g., FYXX Q1 High Risk Scan Findings – 2 vulnerabilities, or FYXX Q1 Moderate Risk Scan Findings – 5 vulnerabilities). Supporting scan reports must be provided to the ISSO as part of updating the POA&M via CSAM.

- PC systems undergoing re-authorization must document any new A&A findings into the existing POA&M. The system’s POA&M is a permanent part of the A&A documentation package. Completed entries may be filtered out to reduce the visible size of the document but must not be removed. Certain columns as specified in the POA&M Instructions have been identified that must not be changed.

- Acceptance of Risk (AOR) letters and corresponding POA&M entries associated with them must be completed in accordance with CIO-SEC-PRC-01, “Managing IT Risk”.

• Cybersecurity Directives. All binding operational directives (BODs) and emergency directives published by the Department of Homeland Security (DHS) where a system is not compliant must be identified in the system’s POA&M.

5.3 Additional Information Regarding POA&Ms

Sensitive descriptions of specific weaknesses are not necessary, but sufficient data is necessary to permit oversight and tracking. To the maximum extent practicable, use the types of descriptions commonly found in reports of the IG. Terms such as "inadequate password controls," "insufficient or inconsistent data integrity controls," "inadequate firewall configuration reviews," "background investigations have not been performed prior to system access," "physical access controls are insufficient," etc. should be used. Where it is necessary to provide more sensitive data, the POA&M should note its special sensitivity. If detailed weakness/milestone information that is actionable cannot be provided due to potentially sensitive vulnerabilities, indicate where the detailed weakness may be located in the supporting audit report. Input this information in the Weakness Source column.

The CISO should have a copy of the audit report. This report should be maintained as a permanent part of the system’s or program’s ATO package.

POA&M Entries must not be removed from CSAM. Although POAMs can be canceled, they cannot be deleted. This assures that actions are auditable and traceable.

Weaknesses transferred from one system POA&M to another must be clearly traceable and justified. Transferred weaknesses should be documented within the POAM. This transfer

Peace Corps 12 should be noted and identified by POAM id within each POAM. Enter the purpose for the transfer, the title of the new POA&M, and the ID number of the new weakness.

Avoid using ‘To Be Determined (TBD)’ or blanks for scheduling completion dates. If the date is unknown, the rationale should be provided within the POAM.

Deviations must be submitted with the POA&M. If the status of a POA&M item is Deviation Requested or Deviation Approved, the Request/Approval must be submitted using a Security Deviation Request.

6 Weakness Eval. Report-Corrective Action Plan (WER-CAP) Template Guidance

Weakness information is gathered and reported using the most current WER-CAP Template.

This template contains five sheets, consisting of:

• WER Details (Tab 1)

• WER SOP (Tab 2)

• CAP Details (Tab 3)

• CAP SOP (Tab 4)

• References (Tab 5)

The WER-CAP Worksheet provides a consolidated view and systematic approach to developing corrective action plans (CAPs). CAPs are the quite literally unapproved POA&Ms. Because the WER-CAP template contains detailed instructions on its use within the worksheet, the text below provides a high level understanding of how the worksheet is intended to be utilized.

1. Weakness Evaluation Report – The purpose of the WER is to perform a risk analysis of system/program level findings, determine root cause and prepare a high level recommendation to fix the problem. Additionally, this worksheet is used to group similar findings that may be best addressed with a single corrective action plan.

2. Corrective Action Plan - After completing the weakness evaluation, the ISSO and SME’s draft the corrective action plans into the CAP details worksheet. The CAP worksheet is intended to standardize draft POA&M development. By developing the CAP worksheet, the ISSO can ensure that due diligence is exercised against all POA&Ms prior to entering into CSAM. As a matter of process, the CAP worksheet must be reviewed by the ISSM or CISO before entry into CSAM. (Although the ISSO has the capability to create the POAM directly into CSAM, this approach is discouraged due to CSAM design features like auto approval, limited access and linear development. In order to ensure there is adequate time for development, CSAM auto-approval has been configured to occur after 90 days.)

3. POAM Creation – Once the CAP worksheet has been approved, the POAMs can be entered into CSAM. All activity will be tracked in CSAM from that time forward.

https://goo.gl/forms/aC8Bt4TTsjnD4C9z2

Peace Corps 13

6.1 POA&M Sharing

6.1.1 Sharing with Non-CSAM users

If there is a requirement to share a system’s POA&Ms with PC account holders who should not have access to CSAM this can be done by individually sharing a POA&M. To do so, take the following steps:

1. Right click on the WER-CAP worksheet and select “Share.”

2. Enter the name/email address of the person you want to have access to the POA&M.

3. On the Pencil icon dropdown select the permissions you want the person to have (edit, comment, or view), and other options as appropriate.

4. Select if you want to notify them, and if so, enter the message you want them to receive.

5. Click on “Done.”

Once you have completed these actions, verify the correct access was provided before sending.

7 POA&M Reviews and Reports

This section describes the processes used to review POA&Ms and report on those reviews.

Note: All Management Reports described in the following sections are only created during the quarterly reviews of POA&Ms.

7.1 POA&M Review Report (ISSO)

Unless otherwise indicated CIO/SG will review POA&Ms upon initial A&A of a PC system (i.e., when an ATO Letter is received) and quarterly thereafter. The review of POAMs will be conducted by the CISO, ISSM and Cybersecurity Program Manager. The ISSO and SO will be notified when the review report has been completed. Comments must be responded to within one (1) week of the report date.

Note: POA&M reviews will be conducted using the system documents in CSAM. The documents and information in CSAM should be current at all times.

7.2 Management Report (ISSM)

Approximately one week after receiving responses from the quarterly ISSO POA&M Review Report, the ISSM will have approximately one week consolidate the ISSO reports into a single report of overall POAM health, adjusted for data gathered from ISSO responses. This report will be made available to the CISO and AO. This report reflects the final status of the quarterly report, including a summarization of pertinent POA&M metrics. The report should be in a format ready to be shared with the PC Director by the AO.

Peace Corps 14

8 Definitions

Definitions marked with an * have been extracted from National Institute of Standards and Technology Interagency or Internal Report (NISTIR) 7298, Revision 2, Glossary of Key Information Security Terms.

Assessment/Security Control Assessment* The testing and/or evaluation of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system and/or enterprise.

Authorization (to operate/use)* The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls.

Contractor System An information system processing or containing PC or Federal data where the infrastructure and applications are wholly operated, administered, managed, and maintained by a Contractor in non-PC facilities.

Deviation A departure from a security configuration setting required within a PC hardening guide or from a requirement established by PC’s policies or procedural guides.

General Support System or System* (see Major Information System) An interconnected set of information resources under the same direct management control which shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people.

Federal Information Security Modernization Act of 2014 The FISMA of 2014 provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets. FISMA recognizes the highly networked nature of the Federal computing environment and is intended to provide effective government wide management and oversight of information security risks. The federal regulation requires an annual report regarding major incidents to OMB, DHS, Congress, and the Comptroller General (GAO). Requiring Agency reports to include: (1) a description of each major security incident/sets of incidents; (2) total number of information security incidents; (3) a description of each major information security incident involving the breach of personally identifiable information; (4) any other information specified in annual reporting requirements.

Federal System

Peace Corps 15

An information system processing or containing PC or Federal data where the infrastructure and/or applications are NOT wholly operated, administered, managed, and maintained by a Contractor

Note: Any Major Information System having a mix of Federal and Contractor subsystems will be considered a Federal system.

Information Security* The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.

Information System* A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Information Technology* Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. For purposes of the preceding sentence, equipment is used by an executive agency if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency which— 1) requires the use of such equipment; or 2) requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product. The term information technology includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources.

Major Application* (see Major Information System) An application that requires special attention to security due to the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application.

Note: All Federal applications require some level of protection. Certain applications, because of the information in them, require special management oversight and should be treated as major. Adequate security for other applications should be provided by the security of the systems in which they operate.

Major Information System (this term replaces General Support System and Major Application) A system that is part of an investment that requires special management attention as defined in OMB guidance and agency policies, a “major automated information system” as defined in 10 U.S.C. § 2445, or a system that is part of a major acquisition as defined in Supplement to Part 7 of OMB Circular A-11, Capital Programming Guide.

Plan of Action and Milestones* A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones.

https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/capital_programming_guide.pdf

Peace Corps 16

Security Controls* The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.

Subsystem A subsystem is a system/application (other than Dynamics CRM applications) categorized with a FIPS 199 security impact level of Low or Moderate, dependent upon the resources provided by its underlying GSS or MA, with the underlying GSS or MA providing the majority of the subsystem’s security controls. The supporting GSS or MA must be shown to provide a foundational level of protection for the subsystem; the subsystem may have a FIPS 199 level equal to or below the level of the host GSS or MA.

8 Definitions