Attachment J.25. - Peace Corps IT Security and Privacy Acquisition Requirements.pdf

Information Technology Security Program

Security and Privacy Acquisition Requirements CIO-SEC-REQ-02, v1

This document is approved for distribution. Policies, procedures and standards, herein, are effective at the date of signature until explicitly superseded or rescinded.

Digital Signature Chief Information Security Officer

CIO-SEC-REQ-02 Security and Privacy Acquisition Requirements

Peace Corps 2

IMPORTANT!

This guide defines security and privacy requirements for PC IT acquisition contracts involving externally hosted contractor information systems that do not connect to the PC network;

information systems hosted in PC facilities that directly connect to the PC network; cloud information systems; or mobile applications. The security and privacy requirements are appropriately formatted to allow the respective security and privacy contract requirements to be placed in-line within a statement of work for each system type. Alternatively, this entire document can be incorporated into the statement of work or contract.

NOTE: Throughout this guide there are highlighted SELECT statements. The requirements office, in coordination with the contracting officer, will complete the selections prior to their incorporation into a contract or statement of work. See example below for the intended use of the SELECT statements.

The guide text states:

1. At the Moderate impact level and higher, the <SELECT: contractor or Government> is responsible for providing an independent Security Assessment/Risk Assessment in accordance with PC CIO-SEC-PRC-01, “Managing IT Risk.”

The requirements office in coordination with the contracting officer would determine for the specific SOW/contract being prepared whether the contractor or the Government was responsible for the independent assessment and change the statement accordingly. For example, if the contractor is required to provide an independent assessment the statement would state:

1. At the Moderate impact level and higher, the contractor is responsible for providing an independent Security Assessment/Risk Assessment in accordance with PC CIO-SEC-PRC- 01, “Managing IT Risk.”

Peace Corps 3

VERSION HISTORY/CHANGE RECORD

Date Author Change Reason for Change

5/4/2021 M Terry Initial draft N/A

6/3/2021 M Terry Update introduction and Appendix B. Updated to direct consultation with Records Officer and correct typo in NARA records management language.

Peace Corps 4

Contents 1 Introduction

1.1 Scope

1.2 Purpose

2 External Information Systems – IT Security and Privacy Requirements

2.1 Required Policies and Regulations for Peace Corps Contracts

2.2 PC Security Compliance Requirements

2.3 Essential Security Controls

2.4 Assessment and Authorization (A&A) Activities

2.5 Reporting and Continuous Monitoring

2.6 PC Privacy Requirements

2.7 Additional Stipulations

3 Internal Information Systems - IT Security and Privacy Requirements

3.1 Required Policies and Regulations for PC Contracts

3.2 PC Security Compliance Requirements

3.3 Essential Security Controls

3.4 Assessment and Authorization (A&A) Activities

3.5 Reporting and Continuous Monitoring

3.6 PC Privacy Requirements

3.7 Additional Stipulations

4 Low Impact Software as a Service (LiSaaS) – IT Security and Privacy Requirements

4.1 Assessment of the System

4.2 Authorization of the System

4.3 Maintenance of ATO and Continuous Monitoring

4.4 Protection of Information

4.5 Data Ownership and Unrestricted Rights to Data

4.6 Personally Identifiable Information

4.7 Data Availability

4.8 Data Release

4.9 Confidentiality and Nondisclosure

4.10 Section 508 Compliance

4.11 Additional Stipulations

Peace Corps 5

4.12 Terms of Service

4.13 References

5 Cloud Information Systems – IT Security and Privacy Requirements

5.1 Assessment and Authorization

5.2 Assessment of the System

5.3 Authorization of the System

5.4 Reporting and Continuous Monitoring

5.5 Personnel Security Requirements

5.6 Sensitive Information Storage

5.7 Protection of Information

5.7.1 Unrestricted Rights to Data

5.7.2 Personally Identifiable Information

5.7.3 Data Availability

5.7.4 Data Release

5.8 Data Ownership

5.9 Confidentiality and Nondisclosure

5.10 PC Non-Disclosure Agreement

5.11 Additional Stipulations

5.12 References

6 Mobile Application - IT Security and Privacy Requirements

6.1 General Mobile Application Guidelines

6.2 Mobile Device Security

6.3 Application Sources

6.4 Terms of Service (ToS)

6.5 PC Privacy Requirements

6.6 PC App Development, Assessment, Authorization and Deployment

6.7 Intellectual Property

6.8 Confidentiality and Nondisclosure

6.9 PC Non-Disclosure Agreement

6.10 Personnel Security Requirements

6.11 Additional Stipulations

7 Nonfederal Systems and Organizations – IT Security and Privacy Requirements

Peace Corps 6

7.1 Required Policies and Regulations for PC Contracts

7.2 PC Security Compliance Requirements

7.3 Security Assessment Activities and Required Documentation

7.4 Reporting and Continuous Monitoring

7.5 Privacy Assessment Activities and Required Documentation

7.6 Additional Stipulations

Appendix A: PC Tailoring of NIST 800-53 Controls

Appendix B: Records Management Clauses

Peace Corps 7

1 Introduction

The Peace Corps (PC) must provide information security for the information systems that support the operations and assets of the agency, including those provided or managed by PC, another agency, contractor, or other source. The Federal Information Security Modernization Act of 2014 (FISMA of 2014) describes Federal agency security and privacy responsibilities as including “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.” This includes services which are either fully or partially provided; including other agency hosted, outsourced, and cloud computing solutions.

Agency information security programs apply to all organizations (sources) which possess or use Federal information – or which operate, use, or have access to Federal information systems (whether automated or manual) – on behalf of a Federal agency, information systems used or operated by an agency or other organization on behalf of an agency.

Office of Management and Budget (OMB) Memorandum M-14-04 asserts that agencies are responsible for ensuring information technology acquisitions comply with the information technology security requirements in FISMA of 2014, OMB’s implementing policies including OMB Circular A-130 and guidance and standards from the National Institute of Standards and Technology (NIST).

1.1 Scope

This guide provides security and privacy requirements for the PC information system types outlined below:

• External Information Systems. External information systems reside in contractor facilities and typically do not connect to the PC network. External information systems may be government owned and contractor operated or contractor owned and operated on behalf of PC or the Federal Government (when PC is the managing agency).

• Internal Information Systems. Internal information systems reside on premise in PC facilities and may connect to the PC network. Internal systems are operated on behalf of PC or the Federal Government (when PC is the managing agency).

• Low Impact Software as a Service (LiSaaS) Systems. LiSaaS systems must adhere to CIO- SEC-PRC-04, “Low Impact Software as a Service (SaaS) Authorization Process.” LiSaaS systems are cloud applications that are implemented for a limited duration, involve low or very low/negligible risk and would cause limited harm to PC, and cost less than $100,000 annually to deploy.

• Cloud Information Systems. Includes Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or SaaS. The service offering must be FedRAMP authorized, in-process, or ready; see Section 5 for additional details.

• Mobile Application. A mobile application, most commonly referred to as an app, is a type of application software designed to run on a mobile device, such as a smartphone or tablet computer.

Peace Corps 8

Non-federal Systems and Organizations. A system or organization: (1) when Controlled Unclassified Information (CUI) is resident in a nonfederal system and organization; (2) not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency1; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or government-wide policy for the CUI category listed in the CUI Registry.

1.2 Purpose

The purpose of this document is to define and establish consistent security, privacy and records management requirements for PC IT acquisition contracts involving externally hosted information systems that do not connect to the PC network; information systems hosted in PC facilities that may connect to the PC network; LiSaaS systems, cloud information systems;

mobile applications; and nonfederal systems with CUI. The security and privacy requirements are appropriately formatted to allow the respective security and privacy contract language to be placed in-line within a statement of work for each system type. The security and privacy requirements identified in this guide will ensure compliance with the appropriate provisions of FISMA of 2014, OMB Circular A-130, and NIST Special Publication (SP) 800-53, Revision 4. The records management requirements are designed to be added to any statement of work without regard to the system type.

1.3 Records Management

The majority of contracts should include language on records management obligations, but each contract should be evaluated individually. If the information system will contain Peace Corps records, the Peace Corps Records Officer must be consulted. Appendix B of this document provides National Archives and Records Administration (NARA) developed language to be included as an agency specific term and condition in Federal contracts for a variety of services and products. This language should be tailored to suit the service or product requested.

This language should not replace specific records management requirements included within Federal information system contracts. Appendix B is intended to be used in addition to those requirements.

1 Nonfederal organizations that collect or maintain information on behalf of a federal agency or that use or operate a system on behalf of an agency, must comply with the requirements in FISMA of 2014, including the requirements in FIPS 200 and the security controls in NIST SP 800-53. (See [44 USC 3554] (a)(1)(A) and Section 2.1 for referenced documents).

https://www.govinfo.gov/content/pkg/USCODE-2017-title44/html/USCODE-2017-title44-chap35-subchapII-sec3554.htm https://www.govinfo.gov/content/pkg/USCODE-2017-title44/html/USCODE-2017-title44-chap35-subchapII-sec3554.htm

Peace Corps 9

2 External Information Systems – IT Security and Privacy Requirements

2.1 Required Policies and Regulations for Peace Corps Contracts

Federal Laws, Regulations, and Guidance:

The contractor shall comply with all applicable Federal Laws and Regulations.

• 40 U.S.C. 11331, “Responsibilities for Federal Information Systems Standards”

• FISMA of 2014, “The Federal Information Security Modernization Act of 2014”

• HSPD 12, “Homeland Security Presidential Directive 12 – Policy for a Common

Identification Standard for Federal Employees and Contractors”

• OMB Circular A-130, “Managing Information as a Strategic Resource”

• OMB M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure

(Submission of Draft Agency Plans Due by September 5, 2008)”

• OMB M 14-03, “Enhancing the Security of Federal Information and Information Systems”

• OMB M-10-23, “Guidance for Agency Use of Third-Party Websites and Applications”

• OMB M-15-13, “Policy to Require Secure Connections across Federal Websites and Web

Services” OMB M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information”

• Privacy Act of 1974, “5 USC, § 552a”

• OMB Memoranda, location of current fiscal year guidance on Federal Information

Security and Privacy Management Requirements, including FISMA reporting

Federal Standards and Guidance:

The contractor shall comply with all applicable Federal Information Processing Standards (FIPS).

NIST Special Publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

• FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems”

• FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems”

• FIPS PUB 140-2, “Security Requirements for Cryptographic Modules”

• NIST SP 800-18, Revision 1, “Guide for Developing Security Plans for Federal Information

Systems”

• NIST SP 800-30, Revision 1, “Guide for Conducting Risk Assessments”

• NIST SP 800-34, Revision 1, “Contingency Planning Guide for Federal Information

Systems”

• NIST SP 800-37, Revision 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy” https://www.gpo.gov/fdsys/pkg/USCODE-2009-title40/pdf/USCODE-2009-title40-subtitleIII-chap113-subchapIII-sec11331.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2009-title40/pdf/USCODE-2009-title40-subtitleIII-chap113-subchapIII-sec11331.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2008/m08-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2008/m08-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2008/m08-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2008/m08-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2008/m08-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2008/m08-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2014/m-14-03.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2014/m-14-03.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2014/m-14-03.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2014/m-14-03.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2010/m10-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2010/m10-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2010/m10-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2010/m10-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2010/m10-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2010/m10-23.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2015/m-15-13.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2015/m-15-13.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2015/m-15-13.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2015/m-15-13.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2015/m-15-13.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2015/m-15-13.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://www.justice.gov/opcl/privacy-act-1974 https://www.justice.gov/opcl/privacy-act-1974 https://www.whitehouse.gov/omb/information-for-agencies/memoranda https://www.whitehouse.gov/omb/information-for-agencies/memoranda http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Peace Corps 10

• NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems”

• NIST SP 800-53, Revision 4, “Security and Privacy Controls for Federal Information

Systems and Organizations”

• NIST SP 800-53A, Revision 4, “Assessing Security and Privacy Controls in Federal

Information Systems and Organizations: Building Effective Assessment Plans”

• NIST SP 800-63-3, “Digital Identity Guidelines”

• NIST SP 800-122, “Guide to Protecting the Confidentiality of Personally Identifiable

Information (PII)”

• NIST SP 800-137, “Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations”

PC Policies:

The contractor shall comply with the following PC Directives/Policies.

• MS 542, “PC Information Security Program”

• MS 892, “Records Management”

• MS 897, “Privacy Act Administration”

• MS 899, “Breach Notification Response Plan”

The PC policies listed in this paragraph must be followed, if applicable.

• MS 542, “General Rules of Behavior”

PC Procedural Guides:

PC IT Procedural Guides are guidance, unless required by a PC Policy, in which case usage is mandatory.

Note: PC’s Procedural Guides are updated frequently; to make sure you have the most recent version of publicly available procedural guides, visit IT Policies and Procedures If a non-publicly available guide is needed, contact the contracting officer who will coordinate with the PC Office of the Chief Information Security Officer to determine if it can be made available.

2.2 PC Security Compliance Requirements

FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems,” is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Information systems supporting PC must meet the minimum security and privacy requirements through the use of security controls in accordance with NIST Special Publication 800-53, Revision 4 (hereafter described as NIST 800-53), “Security and Privacy Controls for Federal Information Systems and Organizations.”

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-47.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-47.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-47.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-47.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf https://intranet.peacecorps.gov/Offices/SPG/Pages/default.aspx

Peace Corps 11

To comply with the Federal standard, PC must determine the security category of the information and information system in accordance with FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems,” and then the contractor shall apply the appropriately tailored set of Low, Moderate, or High impact baseline security controls in NIST 800-53, as determined by PC. NIST 800-53 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with PC specifications.

The Contractor shall use PC technical guidelines, NIST guidelines, Center for Internet Security (CIS) guidelines (Level 1), US Government Configuration Baseline (USGCB), or industry best practice guidelines in hardening their systems.

2.3 Essential Security Controls

All NIST 800-53 controls must be implemented as per the applicable FIPS PUB 199 Low, Moderate, or High baseline. The following table identifies essential security controls from the respective baselines to highlight their importance and ensure they are implemented. The Contractor shall make the proposed system and security architecture of the information system available to the Chief Information Security Officer for review and approval before commencement of system build (architecture, infrastructure, and code).

Control ID Control Title Baseline PC Implementation Guidance (if applicable)

AC-2 Account Management L, M, H

AC-17 (3)

Remote Access | Managed Access Control Points

M, H

All remote accesses from internal users/systems to the external information system must be routed through PC’s managed network access control points, subjecting them to security monitoring.

AU-2 Audit Events L, M, H

Information systems shall implement audit configuration requirements as documented in applicable PC IT Security Technical Hardening Guides (i.e., hardening and technology implementation guides). For technologies where a Technical Guide and Standard does not exist, events from an industry source such as vendor guidance or Center for Internet Security benchmark, recommended by the SO or Contractor to be approved and accepted by the CISO shall be used.

Peace Corps 12

CM-6 Configuration Settings L, M, H

Information systems, including vendor owned/operated systems on behalf of PC, shall configure their systems in agreement with PC technical guidelines, NIST guidelines, CIS guidelines (Level 1), USGCB, or industry best practice guidelines, as reviewed and accepted by the PC AO.

CP-7 Alternative Processing Site M, H

FIPS PUB 199 Moderate and High impact systems must implement processing across geographically-disparate locations to ensure fault tolerance. Cloud Infrastructure as a Service (IaaS) architectures shall implement a multi-region strategy (multiple availability zones in a single region are not sufficient).

CP-8 Telecom Services M, H

FIP PUB 199 Moderate and High impact information systems must implement alternate telecom services to support resumption when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

IA-2 (1)

Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts

L, M, H

All information systems shall implement multi-factor authentication for privileged accounts.

Control ID Control Title Baseline PC Implementation Guidance (if applicable)

IA-2 (2)

Identification and Authentication (Organizational Users) | Network Access to Non- Privileged Accounts

L, M, H

All information systems must implement multi-factor authentication for non-privileged accounts.

IA-7

Cryptographic Module Authentication

L, M, H The information system shall implement FIPS PUB 140-2 compliant encryption modules for authentication functions.

Reference:

Cryptographic Module Validation Program Validated Modules

MP-4 Media Storage M, H

Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives, diskettes, compact disks and digital video disks shall be encrypted using a FIPS PUB 140-2 certified encryption module.

https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules

Peace Corps 13

MP-5 Media Transport M, H

Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives and digital video disks shall be encrypted using a FIPS PUB 140-2 certified encryption module during transport outside of controlled areas.

PL-8

Information Security Architecture

M, H

All information system security architectures must be formally reviewed and approved by the PC Chief Information Security Officer during the system develop/design stages of the SDLC and prior to Security Assessment and Authorization.

RA-5 Vulnerability Scanning L, M, H

All systems must complete the following vulnerability scans:

• Weekly authenticated scans of operating systems

(OS) including databases

• Monthly unauthenticated scans of web applications

• Annual authenticated scans of web applications

The most recent vulnerability scanning results shall be provided to PC together with the quarterly POA&M submission.

SA-22

Unsupported System Components

PC Required All systems must be comprised of software and hardware components that are fully supported in terms of security patching for the anticipated life of the system.

SC-8 /

SC8(1)

Transmission Confidentiality and Integrity / Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection

M, H

Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-2 validated, respectively.

o Digital signature encryption algorithms o Block cypher encryption algorithms o Secure hashing algorithms

For web services connections, implement end to end encryption terminating the connection at the web server;

connections terminated at a load balancer shall employ re-encryption techniques to ensure end to end encryption.

Internet accessible Websites shall implement HTTPS Only with HTTP Strict Transport Security (HSTS), have no weak ciphers, have no weak protocols, and preload .gov domains. (see Binding Operational Directive (BOD) 18-01, Enhance Email and Web Security).

SC-13 Cryptographic Protection L, M, H

Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-2 validated, respectively.

o Digital signature encryption algorithms o Block cypher encryption algorithms https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Validation/Validation-List/DSA https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Validation/Validation-List/DSA https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Block-Ciphers https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Block-Ciphers https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Secure-Hashing https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Secure-Hashing https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Secure-Hashing https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Secure-Hashing https://https.cio.gov/hsts/ https://https.cio.gov/hsts/ https://cyber.dhs.gov/bod/18-01/ https://cyber.dhs.gov/bod/18-01/ https://cyber.dhs.gov/bod/18-01/ https://cyber.dhs.gov/bod/18-01/ https://cyber.dhs.gov/bod/18-01/ https://cyber.dhs.gov/bod/18-01/ https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Validation/Validation-List/DSA https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Validation/Validation-List/DSA https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Validation/Validation-List/DSA https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Validation/Validation-List/DSA https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Block-Ciphers https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Block-Ciphers

Peace Corps 14 o Secure hashing algorithms

SC-17 PKI Certificates M, H Implement appropriate creation, use, and signing of crypto certs in agreement with PC OCIO/IS PCGSS SC-17 SOP and NIST Special Publications 800-32 and 800-63.

SC-18 Mobile Code M, H

SC-22

Architecture and Provisioning for Name / Address Resolution Service

L, M, H

Information systems shall be Domain Name System Security Extensions (DNSSEC) compliant. Reference OMB Memorandum M-08-23, which requires all Federal Government departments and agencies that have registered and are operating second level .gov to be DNSSEC.

SC-28 (1)

Protection of Information at Rest | Cryptographic Protection

L, M, H

**Systems that process Personally Identifiable Information (PII), Payment Card Industry (PCI) data, Authenticators (e.g., passwords, tokens, keys, certificates, hashes, etc.), and other sensitive data as determined by the AO, shall encrypt that data everywhere (i.e., at file level, database level, at rest, and in transit (see SC-8(1)). For databases, encryption of the whole database, table, column, or field levels is acceptable, as appropriate. Other methods including, but not limited to, application encryption or tokenization is also acceptable.

For web services connections, implement end to end encryption terminating the connection at the web server;

connections terminated at a load balancer shall employ re-encryption techniques to ensure end to end encryption.

Encryption algorithms shall be FIPS-approved with FIPS validated encryption modules.

SI-2 Flaw Remediation L, M, H

All projects and systems must be adequately tested for flaws;

all Critical, High, and Moderate risk findings must be remediated prior to go-live. Post go-live, critical/very high vulnerabilities for Internet-accessible IP addresses must be remediated within 15 days, for all other assets critical/very high vulnerabilities must be remediated within 30 days; High vulnerabilities must be remediated within 30 days; Moderate vulnerabilities must be remediated within 90 days.

https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Secure-Hashing

Peace Corps 15

SI-3 Malicious Code Protection L, M, H

SI-4

Information System Monitoring

L, M, H

SI-10 Information Input Validation M, H

All system accepting input from end users must validate the input in accordance to industry best practices and published guidelines, including OWASP Top 10 Web Application Security Vulnerabilities.

AR-2

Privacy Impact and Risk Assessment

See note below

The contractor shall conduct a Privacy Threshold Assessment (PTA) and, if applicable, a Privacy Impact Assessment (PIA) identifying the categories of information and addressing potential risks to PII. The contractor also shall coordinate with the PC Privacy Office concerning these documents.

AR-8 Accounting of Disclosures

See note below

The contractor shall keep an accurate accounting of disclosures of information held in any system of records under its control.

TR-2

System of Records Notices and Privacy Act Statements

See note below.

The contractor shall coordinate with the PC Privacy Office to ensure System of Records Notices (SORNs) and Privacy Act notices on forms that collect Personally Identifiable Information (PII) are established and kept current.

UL-1 Internal Use See note below

The contractor shall ensure that PII is shared internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.

UL-2

Information Sharing with Third Parties

See note below

The contractor shall coordinate with the PC Privacy Office to ensure PII is shared in accordance with PC requirements and agreements with third parties.

Note: Privacy controls are not associated with a baseline. Controls are applicable/not applicable based on PII data being collected, stored, or transmitted.

Peace Corps 16

2.4 Assessment and Authorization (A&A) Activities

The implementation of a new Federal Government IT system requires a formal approval process known as Assessment and Authorization (A&A). NIST Special Publication 800-37, Revision 2 (hereafter described as NIST 800-37) and PC CIO-SEC-PRC-01, “Managing IT Risk,” provide guidelines for performing the A&A process. The Contractor system/application must have a valid assessment and authorization, known as an Authority to Operate (ATO) (signed by the Federal government) before going into operation and processing PC information. The failure to obtain and maintain a valid ATO will result in the termination of the contract. The system must have a new A&A conducted (signed by the Federal government) when significant changes are made to the system, and as specified in PC CIO-SEC-PRC-01, “Managing IT Risk,” and the guides for PC’s other A&A processes referenced therein.

Assessing the System

1. The Contractor shall comply with Assessment and Authorization (A&A) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the A&A is based on the System’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. The contractor shall create, maintain and update the following A&A documentation:

• System Security Plan (SSP) completed in agreement with NIST Special Publication 800-18, Revision 1, “Guide for Developing Security Plans for Federal Information Systems” and completed in accordance with Peace Corps’ SSP requirements and templates. The SSP shall include as appendices required policies and procedures across 17 control families mandated per FIPS PUB 200, Rules of Behavior, and Interconnection Security Agreements (in agreement with NIST Special Publication 800-47, “Security Guide for Interconnecting Information Technology Systems”). The SSP shall include; as an appendix, a list of “Vendor/Contractor Defined Values” that differ from the Peace Corps Defined Values that appear in the PC CIO-SEC-STD-01, “Information Security Control Catalog”.

• Contingency Plan completed in agreement with NIST Special Publication 800-34 and PC CIO-SEC-PLN-03, “Contingency Planning.”

• Business Impact Assessment completed in agreement with NIST Special Publication 800-34 and PC CIO-SEC-PLN-03, “Contingency Planning.”

• Contingency Plan Test Report completed in agreement with PC CIO-SEC-PLN-03, “Contingency Planning.”

• Incident Response Plan completed in agreement with NIST Special Publication 800-61, “Computer Security Incident Handling Guide” and PC CIO-SEC-PLN-05, “Incident Response.”

• Incident Response Test Report completed in agreement NIST Special Publication

Peace Corps 17

800-61, “Computer Security Incident Handling Guide” and PC CIO-SEC-PLN-05, “Incident Response.”

• Configuration Management Plan completed in agreement with PC CIO-SEC-PLN- 02, “Configuration Management.”

• Plan of Action & Milestones completed in agreement with PC CIO-SEC-PRC-10, “Plan of Action and Milestones (POA&M).”

• Penetration Test Reports documenting the results of vulnerability analysis and exploitability of identified vulnerabilities. Note: Penetration testing is required for all Internet accessible, all FIPS 199 High, and all High Value Asset (HVA) information systems. These systems are required to complete an independent penetration test and provide an Independent Penetration Test Report documenting the results of the exercise as part of the A&A package. Reference PC CIO-SEC-PRC-01, “Managing IT Risk”.

2. Information systems must be assessed and authorized every three (3) years or whenever there is a significant change to the system's security posture in accordance with NIST Special Publication 800-37, Revision 2, " Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," and CIO-SEC-PRC-01, "Managing IT Risk" or via continuous monitoring based on PC CIO-SEC-PLN-01, "Information Security Continuous Monitoring (ISCM) Strategy & Ongoing Authorization (OA) Program" that is reviewed and accepted by the PC CISO.

3. At the Moderate impact level and higher, the <SELECT: contractor or Government> is responsible for providing an independent Security Assessment/Risk Assessment in accordance with PC CIO-SEC-PRC-01, “Managing IT Risk.”

4. If the Government is responsible for providing a Security Assessment/Risk Assessment and Penetration Test, the Contractor shall allow PC employees (or PC designated third party contractors) to conduct A&A activities to include control reviews in accordance with NIST 800-53/NIST 800-53A and PC CIO-SEC-PRC-01, “Managing IT Risk.” Review activities include but are not limited to operating system vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, or security of PC information. This includes the general support system infrastructure.

5. Identified gaps between required NIST 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document completed in accordance with PC CIO-SEC-PRC-10, “Plan of Action and Milestones (POA&M).” Depending on the severity of the gaps, the Government may require them to be remediated before an Authorization to Operate is issued.

6. The Contractor is responsible for mitigating all security risks found during the A&A and continuous monitoring activities. Vulnerabilities must be mitigated as follows:

Peace Corps 18

(1) For Internet-accessible IP addresses

(a) Any Critical (Very High) scan vulnerabilities must be remediated within 15 days.

(b) Any High scan vulnerabilities must be remediated within 30 days.

(c) Any Moderate scan vulnerabilities must be remediated within 90 days.

(2) For all other assets

(a) Any Critical (Very High) and High scan vulnerabilities must be remediated within 30 days.

(b) Any Moderate scan vulnerabilities must be remediated within 90 days.

7. The Government will determine the risk rating of vulnerabilities.

Authorization of the System

1. Upon receipt of the documentation (A&A Package) described in CIO-SEC-PRC-01, “Managing IT Risk” and NIST Special Publication 800-37 as documented above, the PC Authorizing Official (AO) for the system (in coordination with the PC Chief Information Security Officer (CISO), System Owner, and Information System Security Officer (ISSO) will render an authorization decision to:

• Authorize system operation w/out any restrictions or limitations on its operation;

• Authorize system operation w/restriction or limitation on its operation, or;

• Not authorize for operation.

2. The Contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. At its option, the Government may choose to conduct on site surveys. The Contractor shall make appropriate personnel available for interviews and documentation during this review.

2.5 Reporting and Continuous Monitoring

Maintenance of the security authorization to operate will be through continuous monitoring of security controls of the external system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to PC per the schedules below.

The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. They allow PC AOs to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur.

Peace Corps 19

Vendor deliverables as identified below will be reviewed and accepted or rejected by the process described in CIO-SEC-PRC-03, “External Information System Monitoring.”

Deliverables to be provided Quarterly to the PC ISSO, ISSM, and/or COR

1. Vulnerability Scanning Reference: NIST 800-53 control RA-5 Provide the most recent Web Application and Operating System vulnerability scan reports. PC’s control parameter for RA-5, Vulnerability Scanning, specifies the following type and frequency of scans; weekly authenticated scans of operating systems (OS)-including databases, monthly unauthenticated scans of web applications, annual authenticated scans of web applications

2. Plan of Action & Milestones (POA&M) Update Reference: NIST 800-53 control CA-5 Provide POA&M updates in accordance with requirements and the schedule set forth in PC CIO CIO-SEC-PRC-10, “Plan of Action and Milestones (POA&M).”

Deliverables to be provided Annually or when there is a major change to the PC ISSO, ISSM, and/or COR

Note: Deliverables annotated with a “*” below may be attested to via an attestation letter as described in PC CIO-IT Security-19-101, “External Information System Monitoring.”

1. Updated A&A documentation including the System Security Plan, Contingency Plan, and Business Impact Analysis

a. System Security Plan Reference: NIST 800-53 control PL-2 Review and update the System Security Plan annually to ensure the plan is current and accurately describes implemented system controls and reflects changes to the contractor system and its environment of operation. The System Security Plan must be in accordance with NIST 800-18, Revision 1, “Guide for Developing Security Plans.”

b. Contingency Plan Reference: NIST 800-53 control CP-2 Provide an annual update to the contingency plan completed in accordance with NIST 800-34, “Contingency Planning Guide for Federal Information Systems”, and PC CIO-SEC-PLN-03, “Contingency Planning.”

c. Business Impact Analysis Reference: NIST 800-53 control CP-2 Provide an annual update to the business impact analysis completed in accordance with NIST 800-34, “Contingency Planning Guide for Federal Information Systems”, and PC CIO-SEC-PLN-03, “Contingency Planning.”

Peace Corps 20

2. User Certification/Authorization Review Documents Reference: NIST 800-53 control AC-2 Provide the results of the annual review and validation of system users’ accounts to ensure the continued need for system access. The user certification and authorization documents will illustrate the organization establishes, activates, modifies, reviews, disables, and removes information system accounts in accordance with documented account management procedures.

3. *Separation of Duties Document/Matrix Reference: NIST 800-53 control AC-5 Develop and furnish a separation of duties matrix reflecting proper segregation of duties for IT system maintenance, management, and development processes. The separation of duties matrix will be updated or reviewed on an annual basis.

4. *Information Security Awareness and Training Records Reference: NIST 800-53 control AT-4 Provide the results of security awareness (AT-2) and role-based information security technical training (AT-3). AT-2 requires basic security awareness training for employees and contractors that support the operation of the contractor system. AT-3 requires information security technical training to information system security roles. Training shall be consistent with the requirements contained in C.F.R. Part 5 Subpart C (5 C.F.R 930.301) and conducted at least annually.

5. Annual FISMA Self-Assessment Reference: NIST 800-53 control CA-2 Deliver the results of the annual FISMA self-assessment conducted Based on the controls selected for self-assessment, the CISO will provide the appropriate test cases for completion.

6. *System(s) Baseline Configuration Standard Document Reference: NIST 800-53 control CM-2/CM-2(1) Provide a well-defined, documented, and up-to-date specification to which the information system is built.

7. System Configuration Settings Verification Reference: NIST 800-53 control CM-6/CM- 6(1) Establish and document mandatory configuration settings for information technology products employed within the information system that reflect the most restrictive mode consistent with operational requirements. Configuration settings are the configurable security-related parameters of information technology products that compose the information system. Systems should be configured in agreement with PC technical guidelines, NIST guidelines, Center for Internet Security guidelines (Level 1), USGCB, or industry best practice guidelines in hardening systems, as reviewed and accepted by the

PC AO.

Peace Corps 21

Provide the most recent operating system Configuration Settings Compliance scan report.

8. Configuration Management Plan Reference: NIST 800-53 control CM-9 Provide an annual update to the Configuration Management Plan for the information system.

9. Contingency Plan Test Report Reference: NIST 800-53 control CP-4 Provide a contingency plan test report completed in accordance with PC CIO-SEC-PLN- 03, “Contingency Planning.” A continuity test shall be conducted annually prior to mid- July of each year. The continuity test can be a table top test while the system is at the FIPS PUB 199 Low Impact level. The table top test must include Federal and hosting Contractor representatives. Functional exercises must be completed once every three years for FIPS PUB 199 Moderate impact systems and annually for FIPS PUB 199 High impact systems.

10. Incident Response Test Report Reference: NIST 800-53 control IR-3 Provide an incident response plan test report documenting results of incident reporting process per PC CIO-SEC-PLN-05, “Incident Response.”

11. Information System Interconnection Security Agreements (if applicable) Reference: NIST 800-53 control CA-3 Provide Interconnection Security Agreements (ISA) and supporting Memoranda of Agreement/Understanding (MOA/U), completed in accordance with NIST 800-47, “Security Guide for Connecting Information Technology Systems,” if there are existing or new interconnections. Per NIST 800-47, an interconnection is the direct connection of two or more IT systems for the purpose of sharing data and other information resources through a pipe, such as ISDN, T1, T3, DS3, VPN, etc. ISAs shall be submitted as appendices as part of the annual System Security Plan submission. ISAs shall include, if applicable, any changes since the last submission; updated ISAs are required at least every three years.

12. *Rules of Behavior Reference: NIST 800-53 control PL-4 Define and establish Rules of Behavior for information system users. Rules of Behavior shall be submitted as an appendix to the System Security Plan.

13. Penetration Testing Report Reference: NIST 800-53 control CA-8 All Internet accessible systems, and all FIPS PUB 199 High impact systems are required to complete an independent penetration test and provide a Penetration Test Report documenting the results of the exercise as part of their A&A package. Annual penetration tests are required for these same systems.

14. *Personnel Screening and Security Reference: NIST 800-53 control PS-3, NIST 800-53 control PS-7

Peace Corps 22

Furnish documentation reflecting favorable adjudication of background investigations for all personnel (including subcontractors) supporting the system. Contractors shall comply with MS 542 "Information Security Program” and MS 403 “Personnel Security Program” policies.

If final adjudication of a background investigation is unfavorable, PC network and IT…