Attachment J.24. - Peace Corps IT Configuration Management Plan.pdf

Information Technology Security Program

Configuration Management (CM) CIO-SEC-PLN-02, v1

This document is approved for distribution. Policies, procedures and standards, herein, are effective at the date of signature until explicitly superseded or rescinded.

Digital Signature Chief Information Security Officer

CIO-SEC-PLN-02 Configuration Management

(This page is intentionally blank.)

VERSION HISTORY/CHANGE RECORD

Date Author Change Reason for Change

4/1/2021 M Terry Initial draft Identifying Peace Corps’ current development and configuration management processes alignment with Federal, NIST, and Peace Corps guidance.

Peace Corps

Table of Contents

1 Introduction

1.1 Purpose

1.2 Scope

1.3 Policy

1.4 References

2 Roles and Responsibilities

2.1 Chief Information Security Officer (CISO)

2.2 Authorizing Official (AO)

2.3 Information System Security Manager (ISSM)

2.4 Information System Security Officer (ISSO)

2.5 System Owners (e.g., System Program Managers/Project Managers)

2.6 Data Owners/Functional Business Line Managers/Custodians

3 Configuration Management Overview

3.1 Configuration Management and Security in the PC Solution Delivery Framework

4 Implementation Guidance for CM Controls

4.1 CM-1 Configuration Management Policy and Procedures

4.2 CM-2 Baseline Configuration

4.3 CM-3 Configuration Change Control

4.4 CM-4 Security Impact Analysis

4.5 CM-5 Access Restrictions for Change

4.6 CM-6 Configuration Settings

4.7 CM-7 Least Functionality

4.8 CM-8 Information System Component Inventory

4.9 CM-9 Configuration Management Plan

4.10 CM-10 Software Usage Restrictions

4.11 CM-11 User-Installed Software

5 Summary Appendix A - Change Request Form Appendix B – Configuration Management Plan Template Appendix C - TRB CHARTER Appendix D - CCB CHARTER Appendix E – CHANGE REQUEST Appendix F - SECURITY IMPACT ANALYSIS (SIA)

Peace Corps 1

1 Introduction

Information systems operate in highly dynamic operating environments with frequent changes to hardware, software, firmware, or supporting networks. Configuration Management (CM) is a structured management and control process applied to the components of a system to manage the inevitable changes that occur during the system’s life cycle. CM provides assurance that the system components are well defined and cannot be changed without proper justification and full knowledge of the consequences, and allows the current configuration state of the information system and its components to be accurately determined at any time.

CM assists in streamlining the change management process and prevents changes that could detrimentally affect the security posture of a system. In its entirety, the CM process reduces the risk that any changes made to a system compromise the system’s confidentiality, integrity, or availability. Effective CM requires system changes be tested prior to implementation to observe the effects of the change, thereby minimizing the risk of adverse results. Without a disciplined process for controlling changes, Authorizing Officials (AOs) cannot be assured that systems under their purview will operate as intended, that defects will be minimized, and that systems maintenance will be performed in a cost-effective or timely manner.

Every Peace Corps information system must follow the CM practices identified in this guide.

Any deviations from the security requirements established in CIO-SEC-REQ-01 “Information Security Program Requirements” must be coordinated by the Information Systems Security Officer (ISSO) through the CISO and authorized by the AO. Any deviations, exceptions, or other conditions not following Peace Corps policies and standards must be submitted using a security deviation request.

The CM principles and practices described in this guide are based on guidance from the National Institute of Standards and Technology (NIST) including NIST Special Publication (SP) 800-53 Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations”. This guide provides an overview of CM, roles and responsibilities, NIST SP 800- 53 audit and accountability requirements per Federal Information Processing Standard (FIPS) 199, “Standards for Security Categorization of Federal Information and Information Systems”, security categorization level, and procedures for implementing these requirements.

Executive Order (EO), EO 13800, “Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure” requires all agencies to use “The Framework for Improving Critical Infrastructure Cybersecurity (the Framework) developed by the National Institute of Standards and Technology (NIST) or any successor document to manage the agency’s cybersecurity risk.” This NIST document is commonly referred to as the Cybersecurity Framework (CSF).

The CSF focuses on using business drivers to guide cybersecurity activities and considering cybersecurity risks as part of the organization’s risk management processes. The core of the CSF consists of five concurrent and continuous Functions—Identify (ID), Protect (PR), Detect http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf https://www.whitehouse.gov/the-press-office/2017/05/11/presidential-executive-order-strengthening-cybersecurity-federal https://www.whitehouse.gov/the-press-office/2017/05/11/presidential-executive-order-strengthening-cybersecurity-federal https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf

Peace Corps 2

(DE), Respond (RS), Recover (RC). The CSF complements, and does not replace, an organization’s risk management process and cybersecurity program. Peace Corps uses NIST’s Risk Management Framework from NIST SP 800-37, Revision 1, “Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach”. Table 1-1, NIST SP 800-53 Control to CSF Mapping, provides how the NIST SP 800-53 controls within this guide are aligned with the CSF Category Unique Identifiers. The following CSF categories are aligned with NIST’s CM controls.

• Identify-Governance (ID.GV)

• Identify-Asset Management (ID.AM)

• Protect-Data Security (PR.DS)

• Protect-Information Protection Processes and Procedures (PR.IP)

• Protect-Protective Technology (PR.PT)

• Detect-Anomalies and Events (DE.AE)

• Detect-Security Continuous Monitoring (DE.CM)

Table 1-1: NIST SP 800-53 Control to CSF Mapping

NIST SP 800-53

Controls CSF Category Unique Identifier Codes

CM-1 ID.GV-1, ID.GV-3

CM-2 PR.DS-7, PR.IP-1, DE.AE-1

CM-3 PR.IP-1, PR.IP-3, DE.CM-1, DE.CM-7

CM-4 PR.IP-1, PR.IP-3

CM-5 PR.IP-1

CM-6 PR.IP-1

CM-7 PR.IP-1, PR.PT-3

CM-8 ID.AM-1, ID.AM-2, PR.DS-3, DE.CM-7

CM-9 PR.IP-1

CM-10 DE.CM-3

CM-11 DE.CM-3

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf

Peace Corps 3

1.1 Purpose

The purpose of this guide is to provide guidance for the CM security controls identified in NIST SP 800-53 and CM requirements specified in CIO-SEC-REQ-01. This procedural guide provides Peace Corps Federal employees and contractors with significant security responsibilities (as identified in CIO-SEC-REQ-01), and other IT personnel involved in the CM of IT assets the specific procedures and processes they are to follow for maintaining Peace Corps information systems under their purview.

1.2 Scope

The requirements outlined within this guide apply to and must be followed by all Peace Corps Federal employees and contractors who are involved in the CM of Peace Corps information systems and data.

1.3 Policy

CM is covered in Chapter 4, paragraph 2 of CIO-SEC-REQ-01 as stated in the following paragraph. l. Configuration management.

(1) A system configuration management plan must be developed, implemented, and maintained for every IT system managed by Peace Corps.

(2) All information systems must be securely hardened and patched before being put into operation and while in operation.

(3) Peace Corps information systems, including vendor owned/operated systems on behalf of Peace Corps, must configure their systems in agreement with Peace Corps technical guidelines, NIST guidelines, Center for Internet Security guidelines (Level 1), or industry best practice guidelines, as deemed appropriate. Where a Peace Corps benchmark exists, it must be used. Peace Corps benchmarks may be exceeded but not lowered.

(4) Develop the configuration management plan IAW Peace Corps CIO-SEC-STD-01 Information System Control Catalog.

1.4 References

Federal Laws and Regulations:

• EO 13800, “Presidential Executive Order on Strengthening the Cybersecurity of Federal

Networks and Critical Infrastructure”

Federal Standards and Guidance:

• FIPS PUB 199, “Standards for Security Categorization of Federal Information and

Information Systems”

• NIST SP 800-37, Revision 1, “Guide for Applying the Risk Management Framework to

Federal Information Systems” https://www.whitehouse.gov/the-press-office/2017/05/11/presidential-executive-order-strengthening-cybersecurity-federal https://www.whitehouse.gov/the-press-office/2017/05/11/presidential-executive-order-strengthening-cybersecurity-federal http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf

Peace Corps 4

• NIST SP 800-53, Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations”

• Cybersecurity Framework, “Framework for Improving Critical Infrastructure Cybersecurity”

Peace Corps Directives, Policies, and Procedures:

• Peace Corps Manual Section 542, “Information Security Program”

• CIO-SEC-REQ-01, “Information Security Program Requirements”

• CIO-SEC-PRC-01, “IT Risk Management”

• CIO-SEC-PLN-04 “Information Security Program Plan”

• AppClarity SOP

• CIO Solution Delivery Framework

2 Roles and Responsibilities

There are many roles associated with implementing an effective CM process for IT systems. The roles and responsibilities provided in this section have been extracted or paraphrased from CIO- SEC-REQ-01 Information Security Program Requirements or summarized from Peace Corps and Federal guidance. Throughout this guide, specific processes and procedures for implementing CM with a security focus are described.

2.1 Chief Information Security Officer (CISO)

Responsibilities include the following:

• Implementing and overseeing Peace Corps’ Information Security Program by developing and publishing Information Security Requirements, Procedures and Standards that are consistent with CIO-SEC-REQ-01;

• Establishing and maintaining a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency;

2.2 Authorizing Official (AO)

Responsibilities include the following:

• Ensuring that Peace Corps information systems under their purview have implemented the required CM controls in accordance with Peace Corps and Federal policies and requirements.

• Accepting the risk of operating Peace Corps information systems under their purview where CM controls have not been fully implemented.

• Ensuring a plan of action and milestones (POA&M) item is established and managed to address CM controls that are not fully implemented.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

Peace Corps 5

2.3 Information System Security Manager (ISSM)

Responsibilities include the following:

• Coordinating with ISSOs to establish and manage processes and procedures supporting CM controls for all systems under their purview.

• Monitoring and supporting the resolution of POA&Ms to mitigate system vulnerabilities regarding CM controls for all systems under their purview.

• Ensures Peace Corps IT security policies and procedures are followed.

2.4 Information System Security Officer (ISSO)

Responsibilities include the following:

• Ensuring necessary CM security controls are in place and operating as intended.

• Developing POA&Ms, when necessary, regarding CM controls for all systems under their purview.

• Assisting system owners in developing and maintaining CM Plans, as necessary.

• Assisting system owners, AOs, and the Configuration Control Board (CCB) in performing or coordinating the performance of security impact analyses of requested changes when necessary.

2.5 System Owners (e.g., System Program Managers/Project Managers)

Responsibilities include the following:

• Ensuring necessary CM controls are in place and operating as intended.

• Developing and implementing a configuration management plan for their respective systems.

• Working with the ISSO and ISSM to develop, implement, and manage POA&Ms for their respective systems.

• Ensuring that for each information system, security is planned, documented, and integrated into the solutions life cycle (SDF) from the information system’s initiation phase to the system’s disposal phase.

• Participating as a leading member on the CCB.

• Assisting with the preparation of the CCB charter and selection of its members.

2.6 Data Owners/Functional Business Line Managers/Custodians

Responsibilities include the following:

• Coordinating with IT security personnel including the ISSM and ISSO and System Owners to ensure implementation of CM control requirements, as necessary.

• Participating in the CM of systems as specified in CM Plans.

Peace Corps 6

3 Configuration Management Overview

CM manages the changes to hardware, software, and documentation of an information system or network throughout its lifecycle. CM assists in streamlining change management processes and prevents changes that could detrimentally affect the security posture of a system. CM is an element of the operational controls of an information system and is interrelated with numerous other security disciplines such as project management, risk management, maintenance, and security assessment and authorization. An effective CM program requires:

• Configuration identification;

• Configuration baseline management;

• Change control processes, including security and/or change impact analyses;

Configuration status accounting; and Configuration auditing.

An effective CM process provides a structured method for applying technical and administrative changes and monitors the results of changes throughout the life cycle. CM provides assurance that the system in operation is the correct version and ensures that all proposed changes are reviewed for security implications prior to implementation. Configuration changes can have security implications as they may introduce or remove vulnerabilities and require updates to system documentation to reflect the changes and modifications to the system. In addition, changes may trigger an update to the risk assessment, and systems that are significantly modified may need to be re-assessed and authorized. Peace Corps follows the guidance in NIST 800-37, Revision 1, Appendix F, Section F.6 when determining what qualifies as a significant change.

3.1 Configuration Management and Security in the PC Solution Delivery Framework

This configuration management plan has been developed to assure the Solutions Delivery Framework (SDF) discipline used is consistent with SDF guiding principles, acquisition planning requirements, and capital planning and investment control requirements. (The term SDF replaces the term Software Development Life Cycle (SDLC) which was used in the past.)

The Peace Corps SDF is divided into five phases. The five phases of the SDF and their relationship to the NIST RMF Steps are listed in Table 3-1. Details of each phase and SDF documentation templates are available on the OCIO Service Strategy & Governance intranet webpage. Security considerations, including configuration management, should be addressed as early as possible and throughout the SDF to cost-effectively implement the security features and controls needed reduce risks during the operation and maintenance of information systems.

Peace Corps 7

Table 3-1. SDF Phase Relationship to RMF Steps

SDF PHASE RMF Steps Phase 1 – Concept Approval Identifies a business need requiring IT as part of the solution.

None.

Phase 2 – Initiation Formally defines and authorizes a project.

Step 1 – Categorize Information System

Phase 3 – Planning Clarifies the project's objectives and plans all of the activities necessary to implement it.

Step 2 – Select Security Controls Step 3 – Implement Security Controls Step 4 – Assess Security Controls

Phase 4 – Execution Deliverables are physically built and presented to the customer for acceptance.

Step 3 – Implement Security Controls Step 4 – Assess Security Controls Step 5 – Authorize Information System Step 6 – Monitor Security Controls

Phase 5 – Project Closeout Consists of the processes to formally end the project and hand-off the operations to the appropriate team.

Step 4 – Assess Security Controls Step 5 – Authorize Information System Step 6 – Monitor Security Controls

Although the RMF steps in Table 3-1 are portrayed linearly with respect to the phases in the SDF, the actual implementation is iterative. For example, during Step 6 – Monitor Security Controls, new vulnerabilities might be discovered which may require reassessing the original security control selection and additional controls selected to mitigate the new risks. The iterative nature of the RMF would require Steps 3-6 be completed for the additional controls.

4 Implementation Guidance for CM Controls

The Peace Corps-defined parameter settings included in the control requirements are offset by brackets in the control text. As stated in Section 1.2, Scope, the requirements in this guide apply to Peace Corps Federal employees and contractors who are involved in CM of Peace Corps information systems and data. The Peace Corps implementation guidance stated for each control applies to personnel and/or the systems operated on behalf of Peace Corps. Any additional instructions/requirements for contractor systems will be included in the “Additional Contractor System Considerations” portion of each control section. If “None” is listed for “Additional Contractor System Considerations” it means there are no additional requirements, the system still needs to comply with the overall implementation guidance.

CM-1, Configuration Management Policy and Procedures, has been identified as a Common Control for all Peace Corps/internally operated systems by Peace Corps and as a Hybrid Control for contractor systems. The CM-2 to CM-11 controls, when included in a system’s control set, either are provided as a Common Control by Peace Corps’ General Support System (PCGSS), a system specific control by the system, or as a Hybrid Control with shared responsibilities for control implementation. Peace Corps’ CIO-SEC-LN-04, Information Security Program Plan (ISPP), Peace Corps 8 describes the Peace Corps enterprise-wide inheritable common and hybrid controls and outlines the responsible party for implementing each of them.

Note on Significant Changes: Systems that have a significant change as defined in NIST SP 80037, Revision 1, Appendix F, Section F.6, will require reauthorization in accordance with Peace Corps Manual Section 542 “Information Security Program”, CIO-SEC-REQ-01 “Information Security Program Requirements”, and CIO-SEC-PRC-01, “Managing IT Risk”.

4.1 CM-1 Configuration Management Policy and Procedures

Control: The organization:

a. Develops, documents, and disseminates to [Information System Security Officer, System Owners (e.g., Program Managers, Project Managers, System SME's), Acquisitions/Contracting Officers, Contracting Officer Representatives]:

1. A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

2. Procedures to facilitate the implementation of the configuration management policy and associated configuration management controls; and

b. Reviews and updates the current:

1. Configuration management policy [biennially]; and

2. Configuration management procedures [biennially].

Peace Corps Implementation Guidance: Control CM-1 is applicable at all FIPS 199 levels.

Common Control Implementation:

Configuration Management (CM) policies and procedures is a common control provided by the OCIO/SG (ISP). Peace Corps OCISO ISP has defined agency-wide CM procedures in CIO-SEC-PLN- 02, “Configuration Management Plan” (this guide). Peace Corps’ security policy and procedural guides are disseminated via Ignition Resource Center portal under Security Policy. . In addition to this guide, Peace Corps operated information systems are required to develop system-specific CM plans.

Peace Corps offices are encouraged but not required to have separate CM policies and procedures to supplement procedures in the Peace Corps IT Security Policy and the CM guide.

Supplemental procedures may be unique to the division/office, system, data type (Financial, Privacy, etc.) or convey the organizations implementation of common and/or hybrid controls as defined in the most current NIST SP 800-37.

CIO-SEC-REQ-01 and CIO-SEC-PLN-02 are reviewed and updated biennially.

Additional Contractor System Considerations:

https://in.peacecorps.gov/HQ/cio/ignITion/rc/ITRC/Security%20Policies/Forms/ReadView.aspx?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSWebPartPage

Peace Corps 9

Vendors/Contractors may defer to the Peace Corps policy and guide or implement their own CM control policies and procedures which comply with Peace Corps’ requirements with the approval of the AO.

4.2 CM-2 Baseline Configuration

Control: The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

Control Enhancements:

(2) Baseline Configuration | Automation Support for Accuracy / Currency. The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.

(3) Baseline Configuration | Retention of Previous Configurations. The organization retains [previous versions of baseline configurations of the information system] to support rollback.

(7) Baseline Configuration | Configure systems, Components, or Devices for High-Risk Areas. The organization:

(a) Issues [laptops and mobile devices] with [Peace Corps baseline configuration settings] to individuals traveling to locations that the organization deems to be of significant risk; and

(b) Applies [reimaging] to the devices when the individuals return.

Peace Corps Implementation Guidance: Control CM-2 is applicable at all FIPS 199 levels.

Enhancements CM-2 (2), (3) and (7) are applicable at FIPS 199 Moderate and High levels.

Baseline configurations are documented, reviewed, and agreed-upon sets of specifications for information systems or configuration items within those systems (i.e., what is on the component). Baseline configurations serve as a basis for future builds, releases, and/or changes to information systems. The following bullets present implementation guidance for documenting the system’s configuration baseline:

• Ensure the system’s configuration baseline is based on Peace Corps standards. Consult the OCIO’s Baseline Folder to identify security baselines approved for current production deployment. The standards are consistent with Peace Corps’ enterprise architecture.

• Develop a system baseline configuration that is consistent with Peace Corps’ enterprise architecture. Include how the information system is linked to the Peace Corps mission.

For FIPS 199 Moderate and High levels the following guidance applies.

• For enhancement CM-2(2), Peace Corps leverages existing enterprise security and CDM tools like Tenable to maintain, manage, and verify baseline configurations.

https://in.peacecorps.gov/HQ/OCIO/operations/KnowledgeRepository/Forms/AllItems.aspx?RootFolder=%2FHQ%2FOCIO%2Foperations%2FKnowledgeRepository%2FConfiguation%20Management%2FSecurity%20Baseline%2FSOPs%2FBaseline%20Security%20Setting%20Guidelines&FolderCTID=0x012000380EAC3559EA9D4AA72BB79A37C02E5A&View=%7BBB93A65F%2D40A9%2D421D%2DBE79%2DF4F2FE9B295C%7D

Peace Corps 10

• For enhancement CM-2(3), Peace Corps systems must maintain previous versions of baseline configurations to support rollback capabilities. Currently, baseline configurations are kept for at least 3 years.

• For enhancement CM-2(7), anyone travelling to an area deemed high risk will be issued loaner devices which will be wiped immediately upon return.

Additional Contractor System Considerations:

Contractor systems not utilizing Peace Corps configuration standards must provide their system baseline configuration to Peace Corps for review and approval by the AO. The organization-defined setting for CM-2(3), deferred for a system-specific recommendation by the Peace Corps Contractor, must be approved by the Peace Corps AO before implementation.

4.3 CM-3 Configuration Change Control

Control: The organization:

a. Determines the types of changes to the information system that are configuration controlled;

b. Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;

c. Documents configuration change decisions associated with the information system;

d. Implements approved configuration-controlled changes to the information system;

e. Retains records of configuration-controlled changes to the information system for [as long as deemed necessary by SO or contractor and approved by the AO];

f. Audits and reviews activities associated with configuration-controlled changes to the information system; and

g. Coordinates and provides oversight for configuration change control activities through

[a Configuration Change Board] that convenes [weekly to monitor changes to the information system, changes to configuration settings, emergency changes, and changes to remediate flaws].

Control Enhancements:

(1) Configuration Change Control | Automated Document / Notification / Prohibition of Changes. The organization employs automated mechanisms to:

(a) Document proposed changes to the information system;

(b) Notify [designated Change Request Approvers] of proposed changes to the information system and request change approval;

(c) Highlight proposed changes to the information system that have not been approved or disapproved by [designated Change Request Approvers];

(d) Prohibit changes to the information system until designated approvals are received;

Peace Corps 11

(e) Document all changes to the information system; and

(f) Notify [Change Configuration Manager] when approved changes to the information system are completed.

(2) Configuration Change Control | Test / Validate / Document Changes. The organization tests, validates, and documents changes to the information system before implementing the changes on the operational system.

Peace Corps Implementation Guidance: Control CM-3 and CM-3(2) are applicable at the FIPS 199 Moderate and High levels. Enhancement CM-3(1) is applicable at the FIPS 199 High level.

Configuration change control involves the systematic proposal, justification, implementation, test/evaluation, review, and disposition of changes to the information system, including upgrades and modifications. This control focuses on defining the CM process, controlling the information system configuration according to that process, and ensuring that no configuration changes are made without going through the approved change control process.

• Manage configuration changes to the information system through a chartered Configuration Control Board (CCB) that approves proposed changes to the system. The CCB should monitor the following:

o Changes to the information system, including upgrades, modifications, and maintenance changes o Changes to the configuration settings for information technology products (e.g., operating systems, firewalls, routers).

o Emergency changes o Changes to remediate flaws.

• Authorize, document, and control changes to the information system. Include emergency changes in the configuration change control process.

• Conduct a security impact analysis (per CM-4) to determine the ramifications of the proposed change. Consider changes only after analyzing the results of the security impact analysis.

• Use automated tools/processes to control/manage system changes. If automated tools are not used, a Peace Corps Change Request Form (Appendix A) is provided.

• Document all approved configuration-controlled changes in appropriate documentation.

The current state of the system should be the ‘as-built’ configuration as reflected in the initial baseline with approved changes.

• Audit activities associated with configuration changes to the information system. Review the approved configuration management process for key auditable activities and then review records of selected activities in the process; for example.

o Who approved the change request;

o Who implemented the change;

o Who completed the security impact assessment;

Peace Corps 12 o Who tested the change; and o How it was tested.

• Ensure that any testing performed does not adversely impact the information system (perform the test on a test platform, not a production platform).

For enhancement CM-3(1), FIPS 199 High systems are required to use automated tools to document proposed changes and notify when changes are approved and implemented. Peace Corps uses Microsoft SCSM. At the time of publication, OCIO does not employ a tool to prevent changes (e.g., Bit9) to systems. The specific tools used must be documented in the system’s security and configuration management plans.

For enhancement CM-3(2), FIPS 199 Moderate and High systems are required to test, validate, and document changes before implementation in the operational environment.

Additional Contractor System Considerations: None.

4.4 CM-4 Security Impact Analysis

Control: The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

Control Enhancement:

(1) Security Impact Analysis | Separate Test Environments. The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.

Peace Corps Implementation Guidance: Control CM-4 is applicable at all FIPS 199 levels.

Enhancement CM-4(1) is applicable at the FIPS 199 High level.

The focus of this control is conducting security impact analyses prior to implementing any change (including patches, upgrades, and modifications) to the information system and checking the security features of the system after changes have been implemented. Below are some general guidelines:

• Employ measures for documenting and monitoring changes to the information system in the System Security Plan (SSP) or CM plan.

• Analyze changes to the information system to determine potential security impacts prior to change implementation and as part of the change approval process.

• Ensure security impact analyses are conducted by personnel with the proper information security responsibilities.

• Ensure individuals conducting security impact analyses have the appropriate skills and technical expertise to analyze the changes to information systems and the associated security ramifications.

Peace Corps 13

• Ensure that the Security Impact Analysis includes activities such as:

- Reviewing information system documentation such as the SSP to understand how specific security controls are implemented within the system and how the changes might affect the controls.

- Assessing risk to understand the impact of the changes and to determine if additional security controls are required.

• Scale the security impact analysis in accordance with the impact level of the information system.

• Ensure information system security features are verified to confirm they are still functioning properly after the system is changed (including upgrades and modifications).

• Before a change request can become a routine change request, a security impact analysis must be performed for the change request. Once accepted as a routine change request, security impact analysis is understood to reference the initial analysis.

For enhancement CM-4(1) FIPS 199 High systems must analyze changes in a separate test environment before implementation in an operational environment.

Additional Contractor System Considerations: None.

4.5 CM-5 Access Restrictions for Change

Control: The organization defines documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.

Control Enhancements:

(1) Access Restrictions for Change | Automated Access Enforcement / Auditing. The information system enforces access restrictions and supports auditing of the enforcement actions.

(2) Access Restrictions for Change | Review System Changes. The organization reviews information system changes [at least every thirty (30) days] and [when indications so warrant] to determine whether unauthorized changes have occurred.

(3) Access Restrictions for Change | Signed Components. The information system prevents the installation of [patches, service packs, and device drivers] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Peace Corps Implementation Guidance: Control CM-5 is applicable at the FIPS 199 Moderate and High levels. Enhancement CM-5(1), (2), and (3) are applicable at the FIPS 199 High level.

The focus of this control is to restrict the ability to make changes to the information system.

Only qualified and authorized individuals should be allowed access for initiating changes, including upgrades and modifications. Examples of access restrictions include physical and

Peace Corps 14 logical access controls (see AC-3 and PE-3), workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover). Ensure there is a process in place to approve and enforce:

• Individual access privileges to systems;

• Physical and logical access restrictions associated with changes to the information system;

• System upgrades; and

• System modifications.

For enhancements CM-5(1), (2), and (3) FIPS 199 High systems must implement automated and manual processes to restrict and audit changes, review changes, and prevent installation of unauthorized components.

Additional Contractor System Considerations: None.

4.6 CM-6 Configuration Settings

Control: The organization:

a. Establishes and documents configuration settings for information technology products employed within the information system using [Peace Corps technical guidelines, NIST guidelines, Center for Internet Security guidelines, United States Government Configuration Baseline (USGCB), or industry best practice guidelines, as deemed appropriate by the Peace Corps AO (implemented checklists must be integrated with Security Content Automation Protocol (SCAP) content)] that reflect the most restrictive mode consistent with operational requirements;

b. Implements the configuration settings;

c. Identifies, documents, and approves any deviations from established configuration settings for [all components] based on [operational requirements]; and

d. Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.

Control Enhancements:

(1) Configuration Settings | Automated Central Management / Application / Verification.

The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [operating systems].

(2) Configuration Settings | Respond to Unauthorized Changes. The organization employs [configuration management/continuous monitoring/continuous diagnostics and mitigation tool agents (e.g., Nessus, Solarwinds) installed and integrated into Peace

Peace Corps 15

Corps’ Enterprise Logging Platform for internal agency systems, for external vendor/contractor systems, similar tools/agents should be monitored using an ELP or ELP-like tool] to respond to unauthorized changes to [configuration settings as specified in CM-6a].

Peace Corps Implementation Guidance: Control CM-6 is applicable at all FIPS 199 levels.

Enhancement CM-6(1) and CM-6(2) are applicable at the FIPS 199 High level.

Common Control Implementation:

Configure systems in agreement with Peace Corps technical guidelines/benchmarks. Peace Corps benchmarks may be exceeded but not lowered. If no technical guideline/benchmark is available for a particular technology, NIST guidelines, Center for Internet Security guidelines, or industry best practice guidelines may be used, as deemed appropriate by the AO. Configure the security settings to the most restrictive mode consistent with operational requirements in all components of the information system.

Security settings that are not completely implemented because of operational requirements should be documented in the SSP. Any deviations, not following Peace Corps policies and standards must be submitted using a security deviation request form. The system owner must monitor and control changes in accordance with the CM Plan and Peace Corps policies and procedures. The SOC scans for configuration compliance on a regular basis and provides the data to the appropriate system POC for resolution.

For enhancements CM-6(1) and (2), Peace Corps uses automated tools such as Nessus and Solarwinds that are installed and to verify configuration settings and alert personnel to respond to unauthorized changes.

System Specific Expectations:

The System Owner is responsible for implementing the configuration settings as stated for this control and maintaining configuration control and managing changes using a configuration management process and plan. When submitting security deviation requests to Peace Corps hardening guidelines/benchmarks System Owners must observe the following:

• Any baseline hardening deviations must be coordinated by the ISSO.

• Deviations to CIS Level 2 settings can be reviewed and approved by the ISSO with appropriate justification.

• Deviations to CIS Level 1 settings require AO approval.

Additional Contractor System Considerations:

Vendor/Contractor systems not utilizing Peace Corps, NIST, or CIS IT Security Hardening standards must provide their technical security hardening guidelines to Peace Corps for review and approval by the AO.

https://docs.google.com/forms/d/e/1FAIpQLSew38lCEj9FnE7Tmpi6ajMn700NYbe4fZtjo2Ol5MA9Of8eUw/viewform

Peace Corps 16

4.7 CM-7 Least Functionality

Control: The organization:

a. Configures the information system to provide only essential capabilities; and

b. Prohibits or restricts the use of the following functions, ports, protocols, and/or services:

[as specified in Peace Corps technical guidelines, NIST guidelines, Center for Internet Security guidelines, or industry best practice guidelines, as deemed appropriate by the Peace Corps AO].

Control Enhancements:

(1) Least Functionality | Periodic Review. The organization:

(a) Reviews the information system [annually] to identify unnecessary and/or non-secure functions, ports, protocols, and services; and

(b) Disables [Peace Corps S/SO or Contractor recommended functions, ports, protocols, and services within the information system deemed to be unnecessary and/or non-secure as approved by the Peace Corps AO].

(2) Least Functionality | Prevent Program Execution. The information system prevents program execution in accordance with [CIO-SEC-REQ-01 or Contractor recommended list of authorized software programs; a list of unauthorized software programs; and rules authorizing the terms and conditions of software program usage; approved by the Peace Corps EAWG].

(4) Least Functionality | Unauthorized Software/ Blacklisting. The organization:

(a) Identifies [programs not authorized to execute on the information system];

(b) Employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the information system; and

(c) Reviews and updates the list of unauthorized software programs [at least annually].

(5) Least Functionality | Authorized Software/ Whitelisting. The organization:

(a) Identifies [programs authorized to execute on the information system];

(b) Employs an deny-all, allow-by-exception policy to prohibit the execution of authorized software programs on the information system; and

(c) Reviews and updates the list of authorized software programs [at least annually].

Peace Corps Implementation Guidance: Control CM-7 is applicable at all FIPS 199 levels. Per order of the CISO, FIPS 199 Moderate systems Enhancements CM-7(1), (2) and (5) are applicable at the FIPS 199 Moderate level. CM-7(4) should be tailored out. Per NIST 800-53r5, this security baseline is employed for both moderate and high systems, constituting a departure from NIST 800-53r4.

The focus of this control is to reduce the attack surface available to be exploited and to restrict the functions and capabilities available to those that are authorized. The information system and each of its components should provide only the minimum functions required to accomplish

Peace Corps 17 their missions. Where feasible, component functionality should be limited to a single function per device (e.g., database server or web server, not both).

Prohibited or restricted functions, ports, protocols, and/or services should be specifically defined in the system’s SSP. Technical security configurations are documented in Peace Corps, NIST, USGCB and CIS guidelines, or industry best practice guidelines as deemed appropriate by the CISO.

For enhancements CM-7(1) and (2) FIPS 199 Moderate and High level systems must:

• Conduct an annual review of the functions, ports, protocols, and services provided and disable any the CISO/AO does not approve as necessary.

• Prevents programs from executing that are listed as unauthorized, not listed as authorized, or are not allowed based on the rules, terms, and conditions approved by the

EAWG.

On Peace Corps hosted and operated information systems, whitelisting capabilities are employed to identify unauthorized software and flag it for removal. Current toolset does not deny execution. Therefore, enhancement CM-7(4) should be tailored out and enhancement CM-7(5) tailored into SSPs. Peace Corps uses automated tools to identify unauthorized software.

Additional Contractor System Considerations: None.

4.8 CM-8 Information System Component Inventory

Control: The organization:

a. Develops, documents, and maintains an inventory of information system components that:

1. Accurately reflects the current information system;

2. Includes all components within the authorization boundary of the information system;

3. Is at the level of granularity deemed necessary for tracking and reporting; and

4. Includes [SO recommended information deemed necessary to ensure property accountability as approved by the AO. List may include hardware inventory specifications (manufacturer, type, model, serial number, physical location), software license information, information system/component owner, and for a networked component/device, the machine name and network address]; and

b. Reviews and updates the information system component inventory [at least annually].

Control Enhancements:

(1) Information System Component Inventory | Updates During Installations / Removals.

The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.

Peace Corps 18

(2) Information System Component Inventory | Automated Maintenance. The organization employs automated mechanisms to help maintain an up-to-date, complete, accurate, and readily available inventory of information system components.

(3) Information System Component Inventory | Automated Unauthorized Component Detection. The organization:

(a) Employs automated mechanisms [at least quarterly] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and

(b) Takes the following actions when unauthorized components are detected:

[isolates the components and notifies the Information System Security Officer, System Owners (e.g., System Program Managers, System Administrators), and Custodians].

(4) Information System Component Inventory | Accountability Information. The organization includes in the information system component inventory information, a means for identifying by [position and role], individuals responsible/accountable for administering those components.

(5) Information System Component Inventory | No Duplicate Accounting of Components.

The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories.

(6) Information System Component Inventory | Assessed Configurations / Approved Deviations. The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.

Peace Corps Implementation Guidance: Control CM-8 is applicable at all FIPS 199 levels.

Enhancements CM-8(1), (3), (5) are applicable at the FIPS 199 Moderate levels. Enhancement CM-8(2) and CM-8(4) are also applicable at the FIPS 199 High Level.

The focus of this control is maintaining control of the components in the information system.

The first step is to identify all components of the information system within the authorization boundary and its relevant ownership information. Include any information determined to be necessary to achieve effective accountability. Determine the appropriate level of granularity for the inventory items, the granularity and type of information will often be different for physical versus virtual components. However, inventory information may include:

• IP address

• Host name

• OS version

• Application version

• Hardware specifications, including:

Manufacturer Type

Peace Corps 19

Model Serial number Physical location

• Software license information

• Information system/component owner

• Machine name and network address (if a network device).

The information system component inventory is defined in the system’s SSP. Information systems must maintain an up-to-date component inventory.

Peace Corps uses automated tools (e.g., Microsoft SCCM, Tenable Security Center, LANSweeper) to assist in maintaining system inventories. The inventory must provide coverage for all assets in the system inventory including physical servers and virtual servers or virtual machines, workstations, mobile devices, and network devices (as applicable). Any information determined to be necessary to achieve effective accountability should be included.

Peace Corps requires inventories to be reviewed and updated at least quarterly. As Peace Corps implements its Continuous Diagnostics and Mitigation (CDM) tools they will be key in having up to date inventories.

For systems at the FIPS 199 High levels must:

• Update the inventory during installations, removals, and system updates (i.e., not just quarterly).

• Use the Peace Corps automated tools identified in the main control implementation details to maintain the inventory.

• Use the same Peace Corps automated tools or other automated tools to detect unauthorized components at least on a quarterly basis, and if found isolate the components and notify the appropriate personnel (i.e., ISSO, System Owner, Custodians).

• Use the same Peace Corps automated tools to ensure that components are not duplicated across system inventories.

For enhancement CM-8 (4) systems at the FIPS 199 High level must include in the inventory the position and role of the administrator of the component.

Additional Contractor System Considerations: None.

4.9 CM-9 Configuration Management Plan

Control: The organization develops, documents, and implements a configuration management plan for the information system that:

a. Addresses roles, responsibilities, and configuration management processes and procedures;

b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;

Peac…