Attachment O - Army Cybersecurity-Risk Management Framework (RMF) Requirements.pdf

Army Cybersecurity/Risk Management Framework (RMF) Requirements FINAL VERSION REV. 07 February 2019

1 | P a g e

A. GENERAL OVERVIEW OF ARMY CYBERSECURITY REQUIREMENTS

1. New Equipment/Product systems, equipment and software under RMF: The vendor shall agree to comply with References listed in Appendix A.

Software patches and updates: Many enterprises within the DoD automate patch updates and software updates for operating systems and DoD standard software applications. For applications such as databases and developed applications, updates are scheduled. Software updates will be analyzed by the Government to determine if reauthorization is required by Department of Defense Instruction (DoDI) 8510.01

Risk Framework (FMF) for DoD Information Technology (IT). Patches normally address bug fixes and cybersecurity issues. Applying patches usually does not trigger reauthorization. Per the DoDI 8500.01 Cybersecurity, Enclosure 3, paragraph 9.b.

(11), “All IA products and IA-enabled products that require use of the product’s IA capabilities will comply with the evaluation and validation requirements of

Committee on National Security Systems Policy 11, National Policy Governing the

Acquisition of Information Assurance (IA) and IA-Enabled Information Technology

Products, June 2013, as amended.”

Vendors shall comply with the National Information Assurance Partnership (NIAP)

Common Criteria Evaluation and Validation Scheme (CCEVS) evaluation

(https://www.niap-ccevs.org) which is published on the NIAP-CCEVS Products

Compliance List. The NIAP-certified products have been assessed from a security perspective, helping to reduce the existence of potential vulnerabilities. Vendors are required to continually maintain their products, mitigating vulnerabilities and distributing fixes to licensed users.

Reauthorization in accordance with DoD RMF requirements: Per DoDI 8510.01, Enclosure 6, para 2.f.(6).(a), “In accordance with Appendix III of OMB Circular A-

130, systems must be reassessed and reauthorized every 3 years or as a result of a system update that negatively affects the security posture (whichever is less).”

Program Offices or appropriate logistics organizations plan for this activity. The results of an annual cybersecurity review or a negative change to the system or environment at any time (i.e., a change increasing the residual risk) may result in a need for reauthorization prior to the regular three-year reauthorization.

The vendor shall maintain all equipment/product versions provided pursuant to this contract, to include the supported operating system, by issuing patches/updates to mitigate vulnerabilities [e.g., Information Assurance Vulnerability Alerts (IAVA) or

Information Assurance Vulnerability Bulletins (IAVB)] and network security configurations [e.g., Defense Information System Agency (DISA) Security Technical

Implementation Guides (STIGs)]. The vendor must adhere to DoD and Army guidance for remediation or mitigation of vulnerabilities associated with the

2 | P a g e equipment/product. Vendors shall be responsible for providing maintenance support until the end of life date of the equipment identified by the vendor. The vendor shall include, in its pricing to the Government the cost of patching their equipment throughout its lifecycle.

Maintenance and upgrades: Vendors shall agree to the Army Cybersecurity requirements as outlined in this document for all systems and medical devices.

B. Army Cybersecurity/Risk Management Framework (RMF) Requirements

1. System Security Requirements

1.1. The vendor shall submit to the Government, included in the offer/quote, all sections of the Medical Device Cybersecurity Assessment (Questionnaire), which is provided by the government. Additionally, a vulnerability assessment/report is required from a NESSUS scanner as this is the DoD standard, and Vendors must provide a NESSUS scan prior to award and throughout performance.

1.2. Vendor agrees to comply with security regulations and guidance listed in

Appendix A: Cybersecurity Regulations and Guidance and all RMF requirements.

1.3. Failure to meet the requirements may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

1.4. The vendor device or system shall pass pre-validation technical screening

(vulnerability scans utilizing NESSUS, and SCAP scans), administered within six

(6) months of contract award that will be conducted by the Government , and must meet the criteria listed below (the pre-validation screening is done by the government as a government review, but the technical scans, etc. are provided by the vendor):

1.4.1. No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System

Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.2. No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities described in the appropriate Defense Information System Agency (DISA)

Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx http://iase.disa.mil/stigs/Pages/index.aspx http://iase.disa.mil/stigs/Pages/index.aspx

3 | P a g e

1.4.3. No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

1.4.4. No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

1.5. .The government will provide templates of all requested technical documentation no later than 20 days from Date of Order. The Vendor shall remit all requested technical documents to the requestor no later than 130 days from the Date of

Order.

1.6. The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and

CAT II vulnerabilities discovered during the RMF Assessment process according to the associated Plan of Action & Milestone (POA&M).

1.7. The vendor shall provide a Point of Contact (POC) responsible for the cybersecurity of the vendor device or system, throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials outlined in the chart in paragraph 2.

1.8. For all equipment requiring a full Independent Verification and Validation (IVV) test, the vendor shall not make any delivery and shall not receive payment for the system until the Program Management Office (PMO) has completed a self-assessment, and the IVV has been scheduled. IVV cannot be scheduled until all documentation requirements, and technical requirements have been completed to the PMO’s satisfaction. Additionally, all identified POA&Ms must have been identified, and been appropriately mitigated to reduce the risk to the Government network and PHI/PII/FOUO data housed within the system. Delivery may take place prior to this milestone (IVV scheduling) only if written permission is provided by the Contracting Officer.

1.9. For all equipment requiring an Assess Only certification, the vendor shall not make any delivery and shall not receive payment for the system until the PMO has completed a self-assessment, and the system has been submitted for an Assess

Only ATO/APL. Submission cannot be scheduled until all documentation requirements, and technical requirements have been completed to the PMO’s satisfaction. Additionally, all identified POAMs must have been identified, and been appropriately mitigated to reduce the risk to the Government network and

PHI/PII/FOUO data housed within the system. Delivery may take place prior to this milestone only if written permission is provided by the Contracting Officer.

1.10. The vendor shall obtain a recommendation of ATO from a Government-appointed third party validator within twelve (12) months of contract award for technologies

4 | P a g e processed through an Assessment & Authorization (A&A). Additionally, the vendor shall obtain an authorization from a Government official to be added to an

APL for systems/devices processed through an RMF Assess Only.

1.11. Pursuant to subsequent warranty period and Service Maintenance Agreements

(SMAs), the vendor shall, after the issuance of an ATO or APL approval, ensure that the vendor’s device or system maintains its ATO or operating system platform and patches/updates for as long as the vendor commercially supports the equipment/product.

The vendor shall maintain an ATO or APL approval on all equipment/product versions owned by the Army and originally purchased through the vendor’s contract. If a vendor cannot support the ATO or APL approval for all Army owned versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the ATO or APL approval, either at no cost to the Government or at a fixed price that is included and evaluated as part of the vendor’s new equipment/product offer. During the period of time the vendor has a product installed on the network, the vendor shall provide all required cybersecurity patches/updates. Maintaining the RMF ATO or APL approval shall be included as part of the vendor’s warranty period. For updates/patches, executable files should be distributed by the manufacturer accordingly, or implemented by the manufacturer’s technical staff, dependent on the Service Agreement processes.

1.12. The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

1.13. The vendor shall notify the PMO and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address any vulnerabilities in question.

1.14. The vendor shall contact the IA/RMF Office Representative, no later than five (5) business days after delivery order issuance or contract award, to start the process.

Failure to do so would be considered a vendor-caused delay.

2. RMF Assessment Timeframes

The following table provides an overview of the entire process to obtain approval under

Army Cybersecurity requirements. Vendor actions must start as cited in the “Number of

Days After Date of Order” column noted below and be completed in the number of days listed below in the “Duration (Days)” column.

5 | P a g e

ID Step Name (Action or

Deliverable

Duration (Days) Number of Days

After

Date of

Order

Responsible

Party

1 1 Categorization 22 Total Days

2 1.1 Vendor RMF

Kickoff Meeting

(Vendor must contact the RMF Office Rep)

1 5 GOVERNMENT

3 1.2 SAFE/EDMS

Paperwork and

Account Creation

(If applicable)

10 5 GOVERNMENT

4 1.3 EDMS Functionality

Briefing (If applicable)

1 5 GOVERNMENT

5 1.4 Documentation

Templates to Vendor

1 5 GOVERNMENT

6 1.5 Hardware/Software

Document Production

5 5 VENDOR

7 1.6 STIG Review 2 10 GOVERNMENT

8 1.7 System

Categorization

2 12 GOVERNMENT

9 1.8 Categorization

Memo Approval

5 17 GOVERNMENT

10 1.9 Security Assessment

Plan Creation*

3 12 GOVERNMENT

11 1.10 SAP Sent to

Vendor*

0 15 GOVERNMENT

12 1.11 Contact 3rd Party

IV&V*

0 15 GOVERNMENT

13 2.Control Selection 6 Total Days

14 2.1 System eMASS

Registration

1 12 GOVERNMENT

15 2.2 eMASS Control

Selection

1 12 GOVERNMENT

16 2.3 Implementation Plan

Completion

5 17 GOVERNMENT

17 3. Implementation 130 Total Days

6 | P a g e

18 3.1 Documentation

Creation and Review

GOVERNMENT

19 3.1.1 Vendor Control and Artifact

Documentation

90 5 VENDOR

20 3.1.2 PMO Control

Documentation

55 40 GOVERNMENT

21 3.1.3 Documentation

100% Complete

(Confirm IV&V*)

(If applicable)

0 95 GOVERNMENT

22 3.2 Scanning 120 16 VENDOR

23 3.2.1 Vendor Initial

Scan

10 16 VENDOR

24 3.2.2 PMO Review of scans and Vulnerability

Report

2 26 GOVERNMENT

25 3.2.3 Vendor Technical

Remediation

110 27 VENDOR

26 3.3 DHA Registration*

(If applicable)

60 77 GOVERNMENT

27 3.3.1 DHA A&A

Request*

(If applicable)

1 77 GOVERNMENT

28 3.3.2 Submit Security

Plan for Approval

10 77 GOVERNMENT

29 3.4 Submission to

IV&V Team/Submit

IV&V Request through

Portal* (If applicable)

0 137 GOVERNMENT

30 4. Assess 65 Total Days

31 4.1 Packet Review by

IV&V Team or PMO

29 138 GOVERNMENT

32 4.2 Coordination

Meeting*

0 165 GOVERNMENT

33 4.3 Onsite

IV&V/Package

Validation Review

5 168 GOVERNMENT

7 | P a g e

34 4.4 SCA-V Packet

Review

30 173 GOVERNMENT

35 4.5 SCA-V SAR

Issuance

0 203 GOVERNMENT

36 5. Packet Authorization 60 Total Days

38 5.1 Vendor Remediation 30 173 VENDOR

5.1.1 SAR

Review/Concurrence

10 203 GOVERNMENT

39 5.2 Submit to SCAR 10 213 GOVERNMENT

40 5.3 Submit to SCA 5 223 GOVERNMENT

41 5.4 Submit to AO (If applicable)

5 228 GOVERNMENT

42 5.5 AO signature (If applicable)

0 233 GOVERNMENT

Note: *RMF workflow task omitted during the Assess Only Process

Note: Not all above actions occur in a sequential manner, as some actions may be worked concurrently.

3. Assessment and Authorization (A&A)

3.1. The vendor shall provide hardware/software lists, architecture drawings, and workflow drawings within 10 business days after contract award. The vendor shall submit all other RMF-required documentation for review and approval, no later than four (4) months after receipt of the templates provided by the

Government.

3.2. The vendor shall obtain approval from the Government for any vendor-developed

RMF policies, plans, and procedures, prior to implementation.

3.3. The vendor shall provide any additional documentation required by the

Government for completion of the A&A process within thirty (30) business days of a request by the Government.

3.4. The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

3.5. The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted or the product is added to the APL.

3.6. The vendor shall ensure that their device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and anti-malware applications that are approved at the time of the ATO or APL issuance.

8 | P a g e

The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the vendor device or system. In cases where the operation of security applications are not technically achievable, the vendor shall provide detailed justification and a POA&M describing steps towards compliance with this requirement.

3.7. The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, and real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

4. Privileged User Training and Certification Requirements

If a vendor requires a Business-To-Business (B2B), access, etc. to government networks to maintain, analyze, etc., their equipment/product, they must adhere to the following requirements:

Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

• Cyber (Information assurance (IA)/information technology (IT)) certification. Per

DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I

(IAT Level I) and be required to meet minimum Professional Baseline certifications at the time of the contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD

8570.01-M will result in the contractor account and access being ‘Disabled’ or

‘Deleted’ until such time as the conditions of this contract are met.

• Background Investigation. NACI or above is required. Vendors should email:

usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process.

9 | P a g e

• Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

• Computer Environment (CE) Certification. The CE certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are required to have a Microsoft 2008 server or 2012 server certification. Contractors working on end-user devices are required to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

• IA Training Requirements. Contractors will meet minimum training requirements within six (6) months of contract award. Contractors will be required to complete

Cyber Security Fundamentals located at URL: https://ia.signal.army.mil/IAF/

• Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The only method for authenticating is the Common Access Card

(CAC).

• Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS.

https://atc.us.army.mil/iastar/regulations.php

• Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the facility Provost Marshall Office in conjunction with the facility Information Management Departmen (for contractors requiring on-site access), or through the Information Assurance/Cyber

Security Branch (for contractors requiring remote access to an Army network).

Remote access must be through a Defense Health Agency (DHA) B2B solution.

Vendors must email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements.

• The IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness

Challenge Training is available at the following website:

https://ia.signal.army.mil/DoDIAA/

• Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the

Army Standard Acceptable Use Policy (AUP) prior to being granted an Army https://ia.signal.army.mil/IAF/ https://atc.us.army.mil/iastar/regulations.php https://ia.signal.army.mil/DoDIAA/

10 | P a g e network account. The Army Standard AUP is available at the following website:

https://atc.us.army.mil/iastar/docs/aup.pdf

5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity

Requirements

1. Continuous Risk Management

1.1. Using a laboratory environment, the vendor shall be able to duplicate all fielded equipment/product that falls under the accreditation boundary. The vendor shall ensure that all fielded equipment/product falling under one authorization is tested to maintain the ATO or approved products for as long as the vendor commercially supports the equipment/product. For each version owned by the Army and originally purchased through the vendor’s contract, the vendor will ensure that each component within the authorization boundary is represented in the test group.

1.2. The vendor shall update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system or device.

1.3. The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO or addition to the approved products list. Vendor shall support reauthorizations due to major upgrades.

1.4. The vendor shall ensure the vendor’s device or system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability

Management (IAVM) program upon each deployment.

1.5. The vendor shall ensure any new deployment (including rebuilds) deploys with a fully-patched, accredited version.

1.6. The vendor shall maintain the system or device and update to comply with updated STIGs made available by the Government within three (3) months of notification by the Government.

1.7. The vendor shall provide vulnerability and configuration scan results to the

Government on a monthly basis. The vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

https://atc.us.army.mil/iastar/docs/aup.pdf

11 | P a g e

1.8. The vendor shall close all discovered vulnerabilities within three (3) months of discovery, or provide a POAM describing how they will work to close the vulnerability.

1.9. The vendor shall submit to the Government for approval, all mitigation plans that addresses any open vulnerabilities.

1.10. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to the Government for approval.

1.11. The vendor shall use the Government-approved method for remote access administration (DISA B2B) of the system or device.

12 | P a g e

Appendix A: Cybersecurity Regulations and Guidance

1) Cybersecurity Regulations and Guidance

The vendor shall use and comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

(a) United States Law

(i) The Health Insurance Portability and Accountability Act of 1996

(HIPAA)

(ii) The Federal Information Security Management Act (FISMA)

(iii) The E-Government Act of 2002

(b) Office of Management and Budget (OMB)

The following publications are located at https://www.whitehouse.gov/omb/agency/default

(i) Circular A-130

(ii) Guidance M-05-24, Implementation of Homeland Security Presidential

Directive (HSPD) 12-Policy for a Common Identification Standard for

Federal Employees and Vendors

(c) National Institute of Standards and Technology (NIST)

The following publications are located at http://www.nist.gov/publication-portal.cfm

(i) NIST Special Publication (SP) 800-37 – Guide for Applying the Risk

Management Framework (RMF) to Federal Information Systems

(ii) NIST SP 800-39—Managing Information Security Risk: Organization, Mission and Information System View

(iii) NIST SP 800-53 – Security and Privacy Controls for Federal Information

Systems and Organizations

(iv) NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of

Information and Information Systems to Security Categories

(d) Federal Information Processing Standards (FIPS) https://www.whitehouse.gov/omb/agency/default http://www.nist.gov/publication-portal.cfm http://www.nist.gov/publication-portal.cfm

13 | P a g e

The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

(i) FIPS Publication (FIPS PUB) 140-2, Security Requirements for

Cryptographic Modules

(ii) FIPS PUB 199 – Standards for Security Categorization of Federal

Information and Information Systems

(iii) FIPS PUB 200: Minimum Security Requirements for Federal

Information and Information Systems

(iv) FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

(e) Department of Defense (DoD)

The following publications are located at http://www.dtic.mil/whs/directives/

(i) DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

(ii) DoD Instruction 8500.1, Cybersecurity

(iii) DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public

Key (PK) Enabling

(iv) DoD Instruction 8510.01, Risk Management Framework Process (RMF)

(v) DoD Instruction 8551.1, Ports, Protocols, and Services Management

(PPSM)

(vi) DoD Instruction 8580.02, Security of Individually Identifiable Health

Information in DoD Health Care Programs

(vii) DoD Instruction 6025.18, Privacy of Individually Identifiable Health

Information in DoD Health Care Programs

(viii) DoD Directive 5400.11, DoD Privacy Program http://www.nist.gov/itl/fipscurrent.cfm http://www.dtic.mil/whs/directives/