Attch J3 LOC CRIMS CMP v1.2.pdf

National Library Service for the Blind and

Physically Handicapped (NLS)

Currency Reader Information Management

System (CRIMS)

CONFIGURATION MANAGEMENT PLAN

Version 1.2 August 25, 2023

CRIMS CO NFIGURATIO N MANAG EMENT PLAN August 25, 2023 ii Security Category: Moderate

Document History

Document Location

Location

Library of Congress - RSA Archer GRC (loc.gov)

NOTE: The latest version of this document is also stored in Archer.

Document Version Control

Version Version Date Summary of Changes Team/Author

1.0 January 6, 2021

Update document with current information on approved template Cynthia Jones

1.1 January 12, 2021 Updated Carter Rawson

Document Approval

Approver Name Role Approval Date

Steve Prine Information System Business Owner August 25, 2023

1.2 August 25, 2023 Update with current information Carter Rawson https://c4vwparc601.lib.loc.gov/apps/ArcherApp/Home.aspx iii Security Category: Moderate

Table of Contents

1 Introduction

1.1 Scope

1.2 Definitions

1.3 System Description

1.3.1 Subsystems

2 Roles and Responsibilities

2.1 Change Requestor

2.2 Change Agent (or Change Implementer)

2.3 Information System Security Officer

2.4 OCIO Change Advisory Board (CAB)

2.5 Documentation Configuration Manager

2.6 System/Application Administrator (SA/AA)

2.7 Information System User

3 Configuration Items

3.1 Hardware and Virtual Machines

3.2 Software

3.3 Cloud Services

3.3.1 Documentation

4 Configuration Management Process

4.1 Change Request/OCIO Change Management Process

4.2 Emergencychanges……………………………………………………………………10

4.3 Baseline Configuration

4.4 Hardening Guides

4.5 Changes to Baseline Configuration

4.6 Deviations from Baseline Configuration

5 CRIMS Documentation Repository…………………………………………………………14

6 Change Control of CRIMS Configuration Plan………………………………………………..14

Table of Figures and Tables

Table 1 – Definitions Table 2 – Subsystems

Table 3 – Hardware and Virtual Machines Table 4 – Software Table 5 – Cloud Services Table 6 – Documentation

Table 7 – Hardening Guides Appendix A………………………………………………………………………………………15

Appendix B…………………………………………………………………………………… .16

4 Security Category: Moderate

1 Introduction

The Currency Reader Information Management System CRIMS Configuration Management Plan (CMP) describes the Configuration Management (CM) activities to be performed in support of CRIMS and defines the practices and procedures required to accomplish CM throughout the life cycle of CRIMS.

This plan reflects the Library of Congress (LOC) Office of the Chief Information Officer (OCIO) Change Management Process (signed, January 21, 2020).

1.1 Scope

This plan should be used as a guideline on the process of how changes should occur for applications, subsystems, and/or devices within the CRIMS authorization boundary.

The CMP covers all changes that are made to the CRIMS system and related documentation.

Additionally, all configuration and certification and accreditation documentation related to these systems is under the control of this CMP. The specific items under control of this CMP are:

Microsoft Windows 2008 R/2 64-bit

Virtual Web

104.46.116.168 CRIMS portal external IP address

https://Crims.nlsbph.org

Open ports in the baseline configuration

Protocols in the baseline configuration

Services in the baseline configuration.

Deploying Patches

1.2 Definitions

Table 1 – Definitions

Term Definition

Baseline Configuration

A set of specifications for a system, or CI within a system, that has been formally reviewed and agreed on at a given point in time, and which can be changed only through change control procedures. The baseline configuration is used as a basis for future builds, releases, and/or changes.

Configuration

The possible conditions, parameters, and specifications with which an information system or system component can be described or arranged.

Change Advisory Board

(CAB)

A group of qualified people with responsibility for the process of regulating and approving changes to hardware, firmware, 5 Security Category: Moderate software, and documentation throughout the development and operational life cycle of an information system.

Configuration

Management (CM)

Comprises a collection of activities focused on establishing and maintaining the integrity of products and systems, through control of the processes for initializing, changing, and monitoring the configurations of those products and systems.

Configuration Item (CI)

An identifiable part of a system (e.g., hardware, software, firmware, documentation, or a combination thereof) that is a discrete target of configuration control processes.

Configuration Settings

The set of parameters that can be changed in hardware, software, and/or firmware that affect the security posture and/or functionality of the information system.

Security Impact Analysis

The analysis conducted by an organizational official to determine the extent to which a change to the information system has or may have affected the security posture of the system.

1.3 System Description

CRIMS is a dedicated information Management system for the BEP Currency Reader Distribution

Project which is overseen in conjunction with National Library Services. The program is open to individuals who are blind or visually impaired and are legal residents of the United States, U.S.

territories or who are U.S. citizens living abroad. The currency reader is a battery powered, stand-alone, personal device designed to make U.S. currency accessible to this population. It is primarily available by mail. The individuals shall use the currency reader to determine the denomination of Federal Reserve banknotes only. The currency reader will only designate the value of the note (via audio and vibrate features).

The request fulfillment, inventory management and general distribution of the device is supported by an information management system consisting of two primary pieces that will be critical to the agency’s ability to process requests. The first system is the Patron Information Machine Maintenance System

(PIMMS), which manages NLS patron information and will be used to keep track of patrons requesting currency readers. The second piece is called the Currency Reader Information Management System

(CRIMS), which is a web-interfacing database capable of storing information for non NLS patrons and for managing the fulfillment and shipping of all requests. Information for CRIMS is stored in a Microsoft Azure environment.

Ancillary to manual keystroking of paper-based applications into CRIMS, CurrencyReader.gov is a web portal that allows for digital ingest of patron data into CRIMS via an electronic request forms (a.k.a. application) as an alternative to hardcopy/handwritten paper forms. CurrencyReader.gov is a COTS, Azure software interface for secure, encrypted transmission by an authorized certifier of blind individuals. Electronic application submission through the portal is manually verified by dedicated staff as to patron v. non-patron status prior to entry into

CRIMS.

6 Security Category: Moderate

Table 2 – Subsystems

ID/UID Application Name Office

N/A

2 Roles and Responsibilities

2.1 Change Requestor

The change requestor is defined as any person or group submitting a request to make a modification to any CI under configuration management. CRIMS staff are responsible for documenting and utilizing the standardized change management procedures in this CMP and complying with the OCIO change management process.

2.2 Change Agent (or Change Implementer)

The change agent is any individual, acting on behalf of the change requestor, who is assigned responsibility for implementing a change request that has been approved through the OCIO change management process.

For purposes of CRIMS, the change agent is defined as any person or group submitting a request to make a modification to any element under configuration management via this configuration management plan. This includes configurations and documentation.

The CRIMS Change Control Board (CCB) is commonly responsible for ensuring any element under this CMP is managed and operated in accordance with IT Security directives. The CCB is comprised of the Manager for CRIMS to include the ISBO. The CRIMS Manager may expand the CCB as required or delegate approval of a given Change Request as needed to ensure integrity of subject matter expertise

(eg. system architecture). The CRIMS Manager makes the final approval on any Change Request. The CRIMS Manager can override the ISSO/Configuration Manager, though this must be clearly documented.

2.3 Information System Security Officer

Per the OCIO change management process, “The OCIO IT Security Division (ITSec), through the respective Information System Security Officer (ISSO) or division manager, assesses the compliance of the proposed changes with the Library’s IT security policies.”

As a part of a security impact analysis, the CRIMS ISSO reviews potential information system changes, evaluates and makes recommendations to the CRIMS Change Control Board regarding the potential security risk that a given change would pose to the system.

Additionally, the ISSO is responsible for initiating any update of the Security Assessment & Authorization (SA&A) documentation and notifying the Chief Information Security Officer (CISO) of changes that would materially alter the security posture of the system. Examples of this are adding new servers and implementing new networked applications.

7 Security Category: Moderate

2.4 OCIO Change Advisory Board (CAB)

Leveraging the subject matter expertise of its individual members, the OCIO CAB reviews the technical and business impact of proposed changes, identifies dependencies that may negatively impact the successful implementation of proposed changes, and identifies potential scheduling conflicts. For a complete description of the OCIO CAB responsibilities, please see the OCIO Change Management Process.

2.5 Documentation Configuration Manager

The Documentation Configuration Manager is the individual who ensures that documentation is consistent. The Documentation Configuration Manager is not responsible for creating the document content. The ISSO fulfill this role for the SA&A-related documentation described in the CI section of this plan.

2.6 System/Application Administrator (SA/AA)

The system/application administrator implements agreed-upon secure baseline configurations, incorporates secure configuration settings for CRIMS, and assists with security impact analyses and configuration monitoring activities as needed. In addition, the SA and/or AA may be included in the process for determining the appropriate baseline configuration for each CI and may serve on the CCB.

SA/AAs are also responsible for complying with the OCIO change management process .

2.7 Information System User

The CRIMS user assists with functional testing (as needed) and complies with the OCIO change management process.

3 Configuration Items

Configuration items are the CRIMS items (hardware, software, firmware, and documentation) to be configuration-managed. A CI may be a specific information system component (e.g., server, workstation, router, application), a group of information system components (e.g., group of servers with like operating systems or a suite of applications), a non-component object (e.g., firmware, documentation), or an information system as a whole. Dividing an information system into CIs allows more granularity and control in managing the secure configuration of the system.

As CRIMS continues through the system development life cycle, new configuration items may be identified and some existing configuration items

3.1 Hardware and Virtual Machines

See Section 1.1 Scope. See System Boundary Diagram.

Table 3 – Hardware and Virtual Machines

Location Domain Host Name Type Manufacturer Make / Model

Vendor maintains hardware and virtual machines documentation

8 Security Category: Moderate

3.2 Software

Table 4 – Software

Location Software Name Software Type Software Owner

CRIMS Custom Built Application Capstone

3.3 Cloud Services

Capstone is operating as a IAAS and PAAS within the commercial Azure environment. For services with the LOC has CRIMS operating as a SAAS.

Table 5 – Cloud Services

Service Provider Service Name Service Model Service Owner

Vendor Commercial Azure IAAS and PAAS Capstone Consulting

3.3.1 Documentation

Table 6 – Documentation

Document Name Documentation

Configuration Manager Location

CRIMS Information System Component

Inventory Application Administrator Capstone

CRIMS System Administration Manual Application Administrator Archer

CRIMS System Security Plan ISSO Archer

CRIMS Information Technology Contingency

Plan ISSO Archer

CRIMS System Configuration Management Plan Application Administrator Archer

CRIMS Information Security Continuous

Monitoring Plan (ISCM) ISSO Archer

CRIMS Network/System Diagram Application Administrator Archer

CRIMS Data Flow Diagram Application Administrator Archer

4 Configuration Management All changes to any element covered by this CMP must have a Change Request (CR) associated with any changes. There are two types of CRs.

Change Request

Emergency Change Request

4.1 Change Request/ OCIO Change Management Process

All planned changes must utilize the Change Request process.

9 Security Category: Moderate

4.1.1 Submit Change Request (CR)

Submit the CR using the form provided in Appendix A – . Lab testing results are required for all major system changes. The ISSO or CCB may reject the CR if there was not adequate testing.

For new software and hardware, the CR form is used and the following information is attached:

Implementation Plan (includes rollback)

Hardware/Software maintenance contract

Documentation of changes per the ITS SDLC

4.1.2 Security Review

The ISSO/Configuration Manager will review the CR to determine what, if any impact the proposed change will have on the system and its associated C&A package. The ISSO/Configuration Manager may make a positive or negative recommendation. The reason for a negative recommendation must be documented in the CR. Regardless of the ISSO/Configuration Manager’s recommendation, the CR, with the ISSO/Configuration Manager’s comments is forwarded to the CCB.

4.1.3 CCB Review

The CCB will review the CR to determine what, if any impact the proposed change will have to the system on operations. The CCB may approve or deny the request. The reason for denial must be documented in the

CR. Moreover, the CRIMS Manager may override the recommendation of the ISSO/Configuration Manager.

If the ISSO/Configuration Manager’s recommendation is overridden, the reason must be documented in the

CR.

4.1.4 Perform Update

The CRIMS Manager will assign a responsible party to perform the system update in accordance with

CRIMS Standard Operating Procedures. Note that certain changes do not affect any production system, but are instead changes to documentation covered by this CMP.

4.1.5 Update Documentation

Prepare any documentation updates. Documentation Updates may include an entirely new version of the document or an updated section, table or diagram. In the case of an updated section, table or diagram. In the case of an updated section, table or diagram, ensure that the update contains the proper section/figure/table number/and labeling. Documentation updates are forwarded to the Documentation Configuration Manager.

4.1.6 Update CRIMS Document Repository

The Documentation Configuration Manager will ensure that the documentation is correctly updated and tracked by updating and formatting the particular document and filling out the CRIMS Document Tracking

Sheet.

4.1.7 OCIO Guidelines

Changes to CRIMS fall under the over-arching OCIO Change Management Process. Adherence to OCIO’s change management process helps to ensure that the technical and business impact of proposed

10 Security Category: Moderate changes are properly assessed and that changes are approved and communicated before implementation in order to minimize the operational risks to the Library.

In context of the OCIO’s change management process, a change is defined as the addition, modification or removal of any authorized, planned, or supported service or service component that could have an effort on IT services. This includes the installation or alteration of hardware, software (operating system and application), data, policies or procedures, or environmental facilities. Specifically, this definition applies to the additions to, removals from, and modifications of the configuration of OCIO-managed environments, including the production and staging environments, and, as appropriate, the development and test environments.

OCIO’s change management process addresses the following:

Change type descriptions (e.g., normal, standard, emergency, information only)

Change management process (e.g., submitting CAB requests, CAB approval, maintenance calendar, etc..,)

Post-implementation steps

The complete OCIO Change Management Process can be found on the OCIO Confluence site at https://staff.loc.gov/wikis/display/CCB/OCIO+Change+Management+Process.

4.2. Emergency Changes

Emergency Changes are performed to enable a non-operational system to become operational or to mitigate a newly discovered, high-risk, vulnerability. The following type of changes cannot be designated as Emergency Changes:

Changes that solely apply to documentation

Addition of software or hardware

Removal of software or hardware

4.2.1. Perform Update

Perform the system update in accordance with CRIMS Standard Operating Procedures.

4.2.2. Submit Change Request (CR)

Within 24 hours of performing the change, submit the CR using the form provided in Appendix A – .

Document the reason for using the Emergency Change process.

4.2.3. Security Review

The ISSO/Configuration Manager will review the CR to determine what, if any impact the change has on the system and its associated C&A package. The ISSO/Configuration Manager may make a positive or negative recommendation. The reason for a negative recommendation must be documented in the CR.

Regardless of the ISSO/Configuration Manager’s recommendation, the CR, with the ISSO/Configuration Manager’s comments is forwarded to the CCB.

https://staff.loc.gov/wikis/display/CCB/OCIO+Change+Management+Process

11 Security Category: Moderate

4.2.4. CCB Review

The CCB will review the CR to determine what, if any impact the change to the system has on operations.

The CCB may approve or deny the CR. The reason for denial must be documented in the CR. Moreover, the

CRIMS Manager may override the recommendation of the ISSO/Configuration Manager. If the

ISSO/Configuration Manager’s decision is overridden, the reason must be documented in the CR. If the CCB denies the CR or if the CRIMS Manager does not override a negative ISSO/Configuration Manager recommendation, the changes to the production systems must be rolled back.

4.2.5. Update Documentation

Prepare any documentation updates. Documentation updates may include an entirely new version of the document or an updated section, table or diagram. In the case of an updated section, table or diagram, ensure that the update contains the proper section/figure/table number and labeling. Documentation updates are forwarded to the Documentation

Configuration Manager.

5a. Rollback Changes If the CCB denies the CR of if the CRIMS Manager does not override a negative ISSO/Configuration Manager recommendation, the changes to the production systems must be rolled back in accordance with CRIMS Standard Operating Procedures.

4.2.6. Update CRIMS Document Tracking Sheet

Documentation Configuration Manager will ensure that the documentation is correctly updated and tracked by updating and formatting the particular document and filling out the CRIMS Document

Tracking Sheet. Note that if a decision was made to roll back the emergency changes, Step 5 does not occur.

4.3 Baseline Configuration

The CRIMS ISBO is responsible for ensuring the initial system configuration of CRIMS is documented in detail and controlling all subsequent changes in accordance with the configuration management (CM) process. The initial CRIMS baseline configuration serves as a basis for future builds, releases, and/or changes to CRIMS.

The baseline configuration of CRIMS may evolve over time depending on the stage of the system development life cycle (SDLC). A baseline configuration represent different information computing environments such as development, test, staging, and production.

When a new baseline configuration is established, the implication is that all of the changes from the last baseline have been approved as a part of the Library’s OCIO Change Management Process. Older versions of approved baseline configurations are maintained and made available for review or rollback as needed.

Per LCD 5-410.1, the baseline configuration information must contain a list of all the applications, including version, IP address of the server where an application resides (and URL if applicable), and related IT systems.

CRIMS components are configured to the LOC Hardening Guides, are maintained under configuration control, and scanned for compliance with approved baseline configuration.

12 Security Category: Moderate

4.4 Hardening Guides

A hardening guide is defined as a series of instructions or procedures for configuring an IT product to a particular operational environment, and used for verifying that the product has been configured properly, and/or for identifying unauthorized changes to the product.

LOC Hardening Guides are tailored by the Library’s IT Security Division (ITSD) to meet its particular security and operational requirements. The LOC hardening guides are reviewed and updated, periodically.

CRIMS follows the LOC Hardening Guide Change Submission Procedure to request changes to a hardening guide.

The LOC hardening guides and LOC Hardening Guide Change Submission Procedure can be found on the ITSD intranet site (http://www.loc.gov/staff/security/hardening-guides.html).

Table 7 – Hardening Guides

LOC Hardening Guide Name Hardening Guide Version

N/A

4.5 Changes to Baseline Configuration

Changes may occur due to:

Updates to the LOC Hardening Guide

New versions of software

Changes to LOC policies

When changes occur, the hardening guides are updated, and the new configuration settings are submitted as a change request. The CAB reviews and updates requests as required for modifications are made (e.g.

new/removed) to the software/hardware components within the CRIMS systems.

4.6 Deviations from Baseline Configuration

Deviations from the baseline configuration may be necessary in cases where the system does not support the approved configuration settings. In these cases, the ISSO works with the ISBO to review the required deviation and submit a Waiver or Risk Acceptance.

http://www.loc.gov/staff/security/hardening-guides.html

13 Security Category: Moderate

7. Appendix B – Change Control Board Charter

CURRENCY READER INFORMATION MANAGEMENT SYSTEM (CRIMS)

Process Description: Configuration Control Board (CCB) Creation date: 5/20/2015. Revised 1/4/21

Revision Version: 1.2

Process Objective: The CRIMS CCB shall oversee the configuration of the CRIMS system at discrete points in its development life cycle for the purposes of controlling changes to the configuration and maintaining its integrity and traceability throughout its development life cycle.

The CRIMS CCB shall evaluate the deliverables at various discrete points (baselines). Each baseline collects CRIMS work products, for example:

documents, software and hardware components. To enable baselines to provide a stable reference for further work, a ‘baselined’ item shall not be changed without formal approval of the CCB.

Process Tasks:

Evaluate and approve or disapprove proposed changes to CRIMS system.

Prioritize the incorporation of approved changes.

Scheduled changes for forthcoming releases.

Verify of the implementation of approved changes.

Configure and maintain tools helping document and manage the CCB process and resulting collaterals.

Hold CCB meetings with regular frequency and expediency

Meetings:

Time and day Frequency

Fridays Twice a month

Process Owner:

Carter Rawson, Digital Project Coordinator, NLS, LOC (process owner)

Process Stakeholders:

Asst Chief, PNE, NLS, Library of Congress (Chairman)

Automation Officer, NLS, Library of Congress (member)

Project Manager, Capstone Consulting (member)

Process Authority:

Decision authority resides solely with the Chairman of the CCB process.

14 Security Category: Moderate

Should there be more than one chairman and a decision arrives to a “tie,” the NLS, Library of Congress Deputy Director will be solely responsible for the final ‘tie- breaking’ decision.

The establishment of a “quorum” resides solely with the Chairman of the CCB process.

Process Participants

Asst. Chief, PNE, NLS, Library of Congress (Chair)

Automation Officer, NLS, Library of Congress Digital Project Coordinator, NLS, LOC

(process owner) Project Manager, Capstone Consulting

(member) Others as approved by the CCB (attendees)