Attachment O Security_Policy_and_Controls.pdf

Appendix B – Security Policy and Controls

The following controls correlate to NIST 800-53 baseline security controls.

Reference: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/

Access Control Policy

• Access to information systems will only be provided to users based on business requirements, job function, responsibilities, need-to-know and least privilege.

• Requests for access will be formally documented and appropriately approved.

• Application and service accounts must only be used by the components requiring authentication.

Controls and Control Enhancements

• Reference: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: AC-2, AC-2(1), AC-

2(2), AC-2(3), AC-2(4), AC-2(5), AC-2(13), AC-3, AC-4, AC-5, AC-6,

AC-6(1), AC-6(2), AC-6(5), AC-6(7), AC-6(10), AC-7, AC-8, AC-11,

AC-11(1), AC-12, AC-14, AC-17, AC-17(1), AC-17(2), AC-17(3), AC-

17(4), AC-18, AC-18(1), AC-18(3), AC-18(5), AC-19, AC-19(5), AC-

20, AC-20(1), AC-20(2), AC-21, and AC-22.

Awareness Training Policy

• Establish, document, and maintain a security awareness training program that:

o incorporates all applicable regulations, State and Federal laws;

o provides role-based training;

o is performed prior to the authorization of system access;

o is monitored and tracked.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: AT-2, AT-2(2), AT- 2(3), AT-3, and AT-4.

Audit and Logging Policy

• Access to Information Systems and data, as well as significant system events, must be logged by the Information System.

https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/ https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Information System audit logs must be protected from unauthorized access or modification.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: AU-2, AU-3, AU-4, AU-5, AU-6, AU-7, AU-8, AU-10, AU-11, and AU-12.

Security Assessments and Authorizations

Policy

• Develop a security assessment and authorization plan that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.

• Document and maintain the authorization of system interconnections with Interconnection Security Agreements.

• Establish and implement a continuous monitoring program.

• Internal system connections must be authorized and documented.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: CA-2, CA-2(1), CA- 3, CA-5, CA-6, CA-7, CA-7(1), CA-7(4), and CA-9.

Configuration Management

Policy

• A baseline for system configurations must be documented.

• Systems must only be configured with least functionality.

• Procedures shall be created to facilitate the implementation of the change management standard and associated access controls.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: CM-2, CM-2(2), CM-2(3), CM-2(7), CM-3, CM-3(2), CM-3(4), CM-4, CM-4(1), CM-

4(2), CM-5, CM-6, CM-7, CM-7(2), CM-7(5), CM-8, CM-8(1), CM-

8(3), CM-9, CM-10, CM-11, CM-12, and CM-12(1).

Contingency Planning Policy

• Contingency plans must be documented for those Information Systems which are critical.

https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• The plans must provide preventive measures, recovery strategies, and technical considerations in the event of a disruption.

• Contingency plans must include the following:

o procedures for restoring the Information System, including the acquisition and maintenance of resources needed to facilitate the recovery and/or continuity of essential system functions;

o processes for acquiring and maintaining the resources necessary to ensure viability of the restoration procedures;

o training for personnel to execute contingency procedures;

o the assignment of responsibilities to designated staff or positions involved in the execution of the plan; and o readiness and preparedness procedures for the annual review and testing of the plan.

Controls and Control Enhancements

• Reference: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: CP-2, CP-3, CP-4, CP-4(1), CP-6, CP-6(3), CP-7, CP-7(1), CP-7(2), CP-7(3), CP-8, CP-

8(1), CP-8(2), CP-9, CP-9(1), CP-9(8), CP-10, and CP-10(2).

Identification and Authentication

Policy

• Access to information systems will only be provided to users and devices when successfully identified and authenticated.

• Requests for identification will be formally documented and appropriately approved.

• Authentication devices must only be used by the components requiring authentication.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: IA-2, IA-2(1), IA-

2(2), IA-2(8), IA-2(12), IA-3, IA-4, IA-4(4), IA-5, IA-5(1), IA-5(6), IA-

6, IA-7, IA-8, IA-8(1), IA-8(2), IA-8(4), IA-12, IA-12(2), IA-12(3),

and IA-12(5).

• The following password control rules are applicable:

o Minimum password length shall be 8 characters.

o Contain both upper and lower case letters (e.g., a-z, A-Z) o Contain numbers and special characters (e.g., 0-9, !, @, o Password minimum lifetime: 1 day https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate o Privileged and Non-privileged account passwords to be changed at least every 90 days.

o Prohibit password reuse for 24 generations

Incident Response Policy

• All staff must report, to the CISO or designee, any Information Security Incident or event that has the potential to negatively impact the confidentiality, integrity, or availability of any Information System that stores, processes, or transmits State Information.

o Information Security Incident reporting and its timeliness must be determined by risk and regulatory requirements and in accordance with procedures.

o Unsuccessful security incidents are foreseeable and expected, are not required to be reported, but may be reported if any uncertainty exists.

o Unsuccessful security incidents include, but are not limited to, pings on a firewall, unsuccessful attempts to log onto a system with an invalid password or username, unsuccessful attempts to load malware, denial-ofservice attacks that do not result in a server being taken off-line, and other events that do not result in actual impermissible use, disclosure, access, or acquisition of Information Resources or a substantial risk thereof.

• The CISO or designee must direct Information Security Incident responses and investigations in coordination and collaboration with the affected system owners.

• The CISO or designee must be responsible for coordinating with any required external entities the reporting of Information Security Incidents, such as to regulators, state attorney general, contractual counterparties, affected data owners, or others as determined by the agency.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: IR-2, IR-3, IR-3(2), IR-4, IR-4(1), IR-5, IR-6, IR-6(1), IR-6(2), IR-7, IR-7(1), IR-8, and IR- 9.

System Maintenance Policy

• Schedule, perform, document, and review records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or other requirements.

https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Approve and monitor all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.

• Ensure that system owners and IT approve, control, and monitor information system maintenance tools.

• Approve and monitor non-local maintenance and diagnostic activities.

• Document in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.

• Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: MA-2, MA-3, MA- 3(1), MA-3(2), MA-3(3), MA-4, MA-5, and MA-6.

Media Protection Policy

• Organizational media must be labeled indicating the distribution limitations, handling caveats, and applicable security markings of digital and non-digital information media.

• Media must be protected until it is destroyed or sanitized using approved equipment, techniques, and procedures.

• Limit the transport of information system media to authorized personnel.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: MP-2, MP-3, MP- 4, MP-5, MP-6, and MP-7.

Physical and Environmental

Policy

• The Data Center information assets shall be protected from tampering, damage, theft or unauthorized physical access.

• Environmental controls shall be established, monitored, and maintained to prevent damage or failure.

• Data center utilities services shall be secured, monitored, and maintained to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.

https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: PE-2, PE-3, PE-4, PE-5, PE-6, PE-6(1), PE-8, PE-9, PE-10, PE-12, PE-13, PE-13(1), PE-

14, PE-16, and PE-17.

Systems Planning Policy

• System Security Plans shall be developed for all systems.

• Establish rules of behavior that include responsibilities and expected behavior regarding system usage.

• Develop information security architecture that facilitates a defense-in-depth approach for organizational protection.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: PL-2, PL-4, PL- 4(1), PL-8, PL-10, and PL-11.

Program Management Policy

• Establish, document, and maintain the requirements for the security program.

• Develop procedures as necessary for the implementation of the security program.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: PM-2, PM-3, PM- 4, and PM-5.

Personnel Security Policy

• Ensure personnel screening and rescreening activities reflect applicable state and federal laws, directives, regulations, policies, standards, guidance, and specific criteria established for the risk designations of assigned positions.

• Develop and document access agreements for information systems.

• Ensure that individuals requiring access to information and information systems sign appropriate access agreements prior to being granted access.

https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Require third-party providers to comply with personnel security policies and procedures established.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: PS-2, PS-3, PS-4, PS-5, PS-6, PS-7, PS-8, and PS-9.

Risk Assessment Policy

• Organizational risk must be identified, continuously monitored, and controlled.

• Risk assessments must identify, quantify, and prioritize risk acceptance and objectives relevant to the Information System.

• Applicable security requirements will be monitored for updates and risk reassessed.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: RA-2, RA-3, RA- 3(1), RA-5, RA-5(2), RA-5(5), RA-7, and RA-9.

Systems and Services Acquisition

Policy

• Determine, document, and allocate the resources required to protect the information systems as part of the capital planning and investment control process.

• The system development life cycle must include information security risk management processes.

• Manage information systems using the system development life cycle to ensure incorporation of information security considerations

• The acquisition process must include Security requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service.

• Require that providers of external information system services comply with organizational information security requirements and employ security controls in accordance with data center policies, standards, and procedures.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: SA-2, SA-3, SA-4, SA-4(1), SA-4(2), SA-4(9), SA-5, SA-8, SA-9, SA-9(2), SA-10, SA-15, and SA-22.

System and Communication Protection

Policy

• Organizational communications must be monitored, controlled, and protected (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

• Secure architectural designs, software development techniques, and systems engineering must be used within organizational information systems.

• Subnetworks for publicly accessible system components must be physically or logically separated from internal networks.

• Cryptographic mechanisms must be utilized to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical safeguards.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: SC-2, SC-4, SC-5, SC-7, SC-7(3), SC-7(4), SC-7(5), SC-7(8), SC-8, SC-10, SC-12, SC-

12(1), SC-13, SC-15, SC-17, SC-21, SC-22, SC-23, SC-28, and SC- 28(1).

System and Information Integrity

Policy

• Identify, report, and correct information system flaws

• Employ malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code.

• Monitor the information system to detect attacks, indicators of potential attacks, unauthorized local, network, and remote connections.

• Generate internal security alerts, advisories, and directives as deemed necessary.

• Ensure the integrity of software, firmware, and information.

Controls and Control Enhancements

• Reference: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: SI-2, SI-3, SI-4, SI-

4(2), SI-4(4), SI-4(5), SI-5, SI-7, SI-7(1), SI-8, SI-8(3), SI-10, SI-11,

SI-12, and SI-16.

https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

Supply Chain Risk Management

Policy

• Identify information security requirements for the information system or information system service in mission/business process planning.

• Protect the information system or information system service as part of the capital planning process.

management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate

• Controls specified shall align with Moderate Impact Baseline.

• Included controls and control enhancements: SR-2, SR-2(1), SR- 3, SR-5, SR-6, SR-8, SR-10, SR-11, SR-11(1), SR-11(2), and SR-12.

https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/controls?version=5.1&security_baseline=Moderate