CIO-IT Security 09-48.pdf

Office of the Chief Information Security Officer

Revision 9

January 15, 2025

IT Security Procedural Guide:

Security and Privacy Requirements for IT Acquisition Efforts

CIO-IT Security-09-48

Docusign Envelope ID: E394B876-6C40-47FA-A247-445BD645C13C

CIO-IT Security-09-48, Revision 9 Security and Privacy Requirements for IT Acquisition Efforts

U.S. General Services Administration

IMPORTANT!

This guide defines security and privacy requirements for GSA IT acquisition contracts involving externally hosted contractor information systems that do not connect to the GSA network, information systems hosted in GSA facilities that directly connect to the GSA network, Low Impact Software-as-a-Service systems, cloud information systems; mobile applications, and nonfederal systems and organizations with Controlled Unclassified Information (CUI). The security and privacy requirements are appropriately formatted to allow the respective security and privacy contract requirements to be placed in-line within a statement of work for each system type. Alternatively, this entire document can be incorporated into the statement of work or contract.

The security and privacy requirements are appropriately formatted to allow the respective security and privacy contract requirements to be added within a statement of work based on the type of system within the acquisition. Blanket purchase agreements (BPAs) may leverage this guide as an attachment to the BPA and require the specific contract language per information system type to be directly included in individual Task Orders. Appendix A contains best practices on Cloud SLAs for consideration when preparing acquisitions that include Cloud services.

NOTE: Throughout this guide there are highlighted SELECT statements. The requirements office, in coordination with the contracting officer, will complete the selections prior to their incorporation into a contract or statement of work. See example below for the intended use of the SELECT statements.

The guide text states:

At the Moderate impact level and higher, the <SELECT: contractor or Government> is responsible for providing an independent Security Assessment/Risk Assessment in accordance with GSA IT Security Procedural Guide 06-30: Managing Enterprise Cybersecurity Risk.

The requirements office in coordination with the contracting officer would determine for the specific SOW/contract being prepared whether the contractor or the Government was responsible for the independent assessment and change the statement accordingly. For example, if the contractor is required to provide an independent assessment the statement would state:

At the Moderate impact level and higher, the contractor is responsible for providing an independent Security Assessment/Risk Assessment in accordance with GSA IT Security Procedural Guide 06-30: Managing Enterprise Cybersecurity Risk.

Pre-award solicitations can be submitted to IS Contract Review Intake for review and approval. The review ensures GSA IT contracts have the IT Security language consistent with GSA and Federal policy and will identify any C-SCRM risks to minimize contract modifications and delays.

VERSION HISTORY/CHANGE RECORD

Change Number

Person Posting Change

Change Reason for Change Page

Number of Change

Revision 1 – November 6, 2009

1 Bo Berlas Minor Changes to GSA 800-53 R3 Control Tailoring workbook in Appendix A

GSA 800-53 Control Tailoring Workbook Update

Revision 2 – November 7, 2014

1 John Sitcharing/ Blanche Heard

Minor changes to verbiage regarding Penetration Testing

Update Penetration Testing verbiage

2 John Sitcharing/ Blanche Heard

CISO mandated change in Penetration Testing requirement/ naming conventions based on consolidation efforts

CISO Mandate Entire document

Revision 3 – February 2, 2017

1 Bo Berlas Added Essential Security controls to Section 2

Security Controls Update 9

2 Bo Berlas Added sections 3-5 Updated to Provide Requirements for Internal Systems, Cloud Systems, and Mobile Applications

22-55

Revision 4 – January 25, 2018

1 Feliksa/ Klemens

Incorporated security references from MV 16-01 and additional references.

Added a section on LiSaaS, Privacy controls, and updated Privacy and other sections to align with GSA policy and procedures.

Incorporate MV 16-01 and consolidate GSA Cybersecurity and Privacy Guidance.

Throughout

Revision 5 – August 25, 2020

1 Desai, Klemens, Speidel

Incorporated NDAA/FAR clauses that prohibit the acquisition from covered entities.

Added information on coordinating NDAs with OGC and NDA templates.

Updated to reflect LiSaaS and External Information System Monitoring guides.

Updated guidance regarding a number of controls and deliverables.

Incorporate requirements from the NDAA and FAR, coordination with OGC on NDAs, and updated GSA guidance.

Throughout

2 Berlas, Speidel, Desai, Klemens

Added section on Nonfederal System and Organizations, revised Internal Information Systems definition.

Clarified the provision of deliverables.

Incorporate requirements from NIST SP 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”

Sections 1 and 7

Change Number

Person Posting Change

Change Reason for Change Page

Number of Change

Revision 6 – April 15,2021

1 Dean Revisions include:

Updated to NIST SP 800-53, Revision 5 controls.

Replaced Sensitive But Unclassified with Controlled Unclassified Information

Updated references

Update to NIST SP 800-53, Revision 5.

Throughout

Revision 7 – July 25, 2023

1 Klemens/ Desai

Revisions include:

Added requirements regarding CISA Directives.

Added prohibition of TikTok/ByteDance services and applications.

Added language regarding compliance with the Federal Cybersecurity Coordination, Assessment, and Response Protocol (C-CAR).

Updated references, formatting, and style.

Updated controls, implementation guidance, deliverables, and stipulations in accordance with latest guides/guidance.

Update to align with Federal and GSA mandates/requirements.

Throughout

Revision 8 – October 14, 2024

1 Normand, Salamon, Turnau, Brust, Klemens, McCormick

Revisions include:

Revised the instructions to state the specific requirements in the guide per type of system are to be included in a SOW.

Added information regarding the IS Contract Review Intake form.

Added IoT Act and OMB 22-18/ 23-16 requirements.

Updated the Cloud and Mobile Application sections to align with GSA’s requirements.

Updated essential controls and guidance, deliverables sections, C-SCRM requirements, and privacy requirements, as necessary.

Changed Appendix A to Cloud Acquisition SLA Best Practices.

Update to align with Federal and GSA mandates/requirements.

Throughout

Revision 9 – January 15, 2025

1 Klemens Revisions include:

Removed Separation of Duties Document/Matrix from annual deliverables.

Separation of duties already documented in SSPP deliverable and align with GSA guidance.

7, 13, 14, 17, 36, 52

Change Number

Person Posting Change

Change Reason for Change Page

Number of Change

Added Static Code Analysis as a deliverable.

Changed SCRM Plan to biennial requirement.

APPROVAL

IT Security Procedural Guide 09-48: Security and Privacy Requirements for IT Acquisition Efforts, Revision 9, is hereby approved for distribution.

Parimala Rao Acting GSA Chief Information Security Officer

This guide will be available on the IT Security Procedural Guides Webpage and GSA.gov when revised.

U.S. General Services Administration i

Table of Contents

1 Introduction

1.1 Scope

1.2 Purpose

2 External Information Systems – IT Security and Privacy Requirements

2.1 Required Policies and Regulations for GSA Contracts

2.2 GSA Security Compliance Requirements

2.3 Essential Security Controls

2.4 Assessment and Authorization (A&A) Activities

2.5 Reporting and Continuous Monitoring

2.6 GSA Privacy Requirements

2.7 Additional Stipulations

3 Internal Information Systems - IT Security and Privacy Requirements

3.1 Required Policies and Regulations for GSA Contracts

3.2 GSA Security and Privacy Compliance Requirements

3.3 Essential Security Controls

3.4 Assessment and Authorization (A&A) Activities

3.5 Reporting and Continuous Monitoring

3.6 GSA Privacy Requirements

3.7 Additional Stipulations

4 Low Impact Software as a Service (LiSaaS) – IT Security and Privacy Requirements .41

4.1 Assessment of the System

4.2 Authorization of the System

4.3 Inability to Maintain LiSaaS ATO Requirements

4.4 Protection of Information

4.5 Data Ownership and Unrestricted Rights to Data

4.6 Privacy Requirements

4.7 Data Availability

4.8 Data Release

4.9 Confidentiality and Nondisclosure

4.10 Section 508 Compliance

4.11 Additional Stipulations

4.12 Terms of Service

4.13 References

5 Cloud Information Systems – IT Security and Privacy Requirements

5.1 Assessment and Authorization

5.1.1 Assessment of the System

5.1.2 Authorization of the System

5.2 Reporting and Continuous Monitoring

5.3 Personnel Security Requirements

5.4 Sensitive Information Storage

5.5 Protection of Information

5.5.1 Unrestricted Rights to Data

5.5.2 Personally Identifiable Information

5.5.3 Data Availability

5.5.4 Data Release

5.6 Data Ownership

5.7 Confidentiality and Nondisclosure

U.S. General Services Administration ii

5.8 GSA Non-Disclosure Agreement

5.9 Additional Stipulations

5.10 References

6 Mobile Application - IT Security and Privacy Requirements

6.1 General Mobile Application Guidelines

6.2 Mobile Device Security

6.3 Application Sources

6.4 Terms of Service (ToS)

6.5 GSA Privacy Requirements

6.6 GSA App Development, Assessment, Authorization and Deployment

6.7 Intellectual Property

6.8 Confidentiality and Nondisclosure

6.9 GSA Non-Disclosure Agreement

6.10 Personnel Security Requirements

6.11 Additional Stipulations

7 Nonfederal Systems and Organizations – IT Security and Privacy Requirements

7.1 Required Policies and Regulations for GSA Contracts

7.2 GSA Security Compliance Requirements

7.3 Security Assessment Activities and Required Documentation

7.4 Reporting and Continuous Monitoring

7.5 Privacy Assessment Activities and Required Documentation

7.6 Additional Stipulations

Appendix A: Cloud Acquisition Best Practices

U.S. General Services Administration 1

1 Introduction

The U.S. General Services Administration (GSA) must provide information security for the information systems that support the operations and assets of the agency, including those provided or managed by GSA, another agency, contractor, or other source. The Federal Information Security Modernization Act of 2014 (FISMA of 2014) describes Federal agency security and privacy responsibilities as including “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.” This includes services which are either fully or partially provided; including other agency hosted, outsourced, and cloud computing solutions. Agency information security programs apply to all organizations (sources) which possess or use Federal information – or which operate, use, or have access to Federal information systems (whether automated or manual) – on behalf of a Federal agency, information systems used or operated by an agency or other organization on behalf of an agency.

1.1 Scope

This guide provides security and privacy requirements for the GSA information system types outlined below:

External Information Systems. External information systems reside in contractor facilities and typically do not connect to the GSA network. External information systems may be government owned and contractor operated or contractor owned and operated on behalf of GSA or the Federal Government (when GSA is the managing agency).

Internal Information Systems. Internal information systems reside on premise in GSA facilities and may connect to the GSA network. Internal systems are operated on behalf of GSA or the Federal Government (when GSA is the managing agency).

Low Impact Software as a Service (LiSaaS) Systems. LiSaaS systems must adhere to GSA IT Security Procedural Guide 16-75: Low Impact Software as a Service (SaaS) Authorization Process. LiSaaS systems are cloud applications that are implemented for a limited duration, involve low or very low/negligible risk, and would cause limited harm to GSA, and cost less than $100,000 annually to deploy.

Cloud Information Systems. Includes Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or SaaS. The service offering must be FedRAMP authorized, in-process, or ready; see Section 5 for additional details.

Mobile Applications. A mobile application, most commonly referred to as an app, is a type of application software designed to run on a mobile device, such as a smartphone or tablet computer.

Nonfederal Systems and Organizations. A system or organization: (1) when Controlled Unclassified Information (CUI) is resident in a nonfederal system and organization; (2) not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency1; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category listed in the CUI Registry.

1 Nonfederal organizations that collect or maintain information on behalf of a federal agency or that use or operate a system on behalf of an agency, must comply with the requirements in FISMA of 2014, including the requirements in FIPS 200 and the security controls in NIST SP 800-53. (See [44 USC 3554] (a)(1)(A) and Section 2.1 for referenced documents).

U.S. General Services Administration 2

1.2 Purpose

The purpose of this document is to define and establish consistent security and privacy requirements for GSA IT acquisition contracts involving externally hosted information systems that do not connect to the GSA network; information systems hosted in GSA facilities that may connect to the GSA network; LiSaaS systems, cloud information systems; mobile applications;

and nonfederal systems with CUI. The security and privacy requirements are appropriately formatted to allow the respective security and privacy contract language to be placed in-line within a statement of work for each system type. The security and privacy requirements identified in this guide will ensure compliance with the appropriate provisions of FISMA of 2014, OMB Circular A-130, and NIST Special Publication (SP) 800-53, Revision 5.

2 External Information Systems – IT Security and Privacy Requirements

2.1 Required Policies and Regulations for GSA Contracts

Federal Laws, Regulations, and Guidance:

The contractor shall comply with all applicable Federal Laws and Regulations.

40 U.S.C. 11331, “Responsibilities for Federal Information Systems Standards”

Cybersecurity & Infrastructure Security Agency (CISA) Cybersecurity Directives - Listing of Emergency and Binding Operational Directives

Executive Order (EO) 13556, “Controlled Unclassified Information”

FISMA of 2014, “The Federal Information Security Modernization Act of 2014”

HSPD 12, “Homeland Security Presidential Directive 12 – Policy for a Common Identification Standard for Federal Employees and Contractors”

OMB Circular A-130, “Managing Information as a Strategic Resource”

Privacy Act of 1974, “5 USC, § 552a”

Public Law 116-207, “Internet of Things Cybersecurity Improvement Act of 2020”

National Archives and Records Administration (NARA) Controlled Unclassified Information (CUI) Registry

OMB Memoranda, OMB Memoranda are mandatory when their requirements are in scope for a system or components of a system. The following OMB Memos are listed due to their requirements being included in the requirements for External Information Systems – IT Security and Privacy Requirements:

- OMB M-10-23, “Guidance for Agency Use of Third-Party Websites and Applications”

- OMB M-14-03, “Enhancing the Security of Federal Information and Information Systems”

- OMB M-15-13, “Policy to Require Secure Connections across Federal Websites and Web Services”

- OMB M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information”

- OMB M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6)”

- OMB M-21-31, “Improving the Federal Government’s Investigative and

Remediation Capabilities Related to Cybersecurity Incidents”

- OMB M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity

Principles”

- OMB M-22-18, “Enhancing the Security of the Software Supply Chain through

Secure Software Development Practices”

U.S. General Services Administration 3

- OMB M-23-16, “Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices”

Federal Standards and NIST Publications:

The contractor shall comply with all applicable Federal Information Processing Standards (FIPS). NIST Special Publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems”

FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems”

FIPS PUB 140-3, “Security Requirements for Cryptographic Modules”

NIST SP 800-18, Revision 1, “Guide for Developing Security Plans for Federal Information Systems”

NIST SP 800-30, Revision 1, “Guide for Conducting Risk Assessments”

NIST SP 800-34, Revision 1, “Contingency Planning Guide for Federal Information Systems”

NIST SP 800-37, Revision 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy”

NIST SP 800-47, Revision 1, “Managing the Security of Information Exchanges”

NIST Special Publication 800-52, Revision 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

NIST SP 800-53, Revision 5, “Security and Privacy Controls for Information Systems and Organizations”

NIST SP 800-53A, Revision 5, “Assessing Security and Privacy Controls in Information Systems and Organizations”

NIST Special Publication 800-61, Revision 2, Computer Security Incident Handling Guide

NIST SP 800-63-3, “Digital Identity Guidelines”

NIST SP 800-81-2, “Secure Domain Name System (DNS) Deployment Guide”

NIST SP 800-122, “Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)”

NIST SP 800-137, “Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations”

NIST SP 800-161, Revision 1, “Supply Chain Risk Management Practices for Federal Information Systems and Organizations”

NIST SP 800-213, “IoT Device Cybersecurity Guidance for the Federal Government:

Establishing IoT Device Cybersecurity Requirements”

NIST SP 800-218, “Secure Software Development Framework (SSDF) Version 1.1:

Recommendations for Mitigating the Risk of Software Vulnerabilities”

NIST Special Publication 1800-16, “Securing Web Transactions: TLS Server Certificate Management”

GSA Policies:

The contractor shall comply with the following GSA Directives/Policies.

GSA Order CIO 1878.3, “Developing and Maintaining Privacy Threshold Assessments, Privacy Impact Assessments, Privacy Act Notices, and System of Records Notices”

GSA Order CIO 2100.1, “GSA Information Technology (IT) Security Policy”

U.S. General Services Administration 4

GSA Order ADM 2181.1, “Homeland Security Presidential Directive-12 Personal Identity Verification and Credentialing Policy, and Background Investigations for Contractor Employees”

GSA Order CIO 2183.1, “Enterprise Identity, Credential, and Access Management (ICAM) Policy”

GSA Order CIO 2200.1, “GSA Privacy Act Program”

GSA Order CIO 9297.2, “GSA Information Breach Notification Policy”

GSA MV-2023-02, Supplements 1-2, Ensuring Only Approved Software is Acquired and Used at GSA

GSAM 510.002, Pre-Award Procedures

GSAM 511.170, Information Technology Coordination and Standards

GSAM 511.171, Requirements for GSA Information Systems

GSAM 539, Acquisition of Information Technology

The GSA policies listed in this paragraph must be followed, if applicable.

GSA Order CIO 2103.2, “Controlled Unclassified Information (CUI) Policy”

GSA Order CIO 2104.1, “GSA Information Technology (IT) General Rules of Behavior”

GSA Order CIO 2185.1, “Use of Artificial Intelligence at GSA”

GSA Procedural Guides:

GSA IT Security Procedural Guides are guidance, unless required by a GSA Directive/Policy, in which case usage is mandatory.

Note: GSA’s IT Security Procedural Guides are updated frequently; to make sure you have the most recent version of publicly available procedural guides, visit GSA.gov. If a non-publicly available guide is needed, contact the contracting officer who will coordinate with the GSA Office of the Chief Information Security Officer to determine if it can be made available.

2.2 GSA Security Compliance Requirements

FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems,” is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Information systems supporting GSA must meet the minimum security and privacy requirements through the use of security controls in accordance with NIST Special Publication 800-53, Revision 5 (hereafter identified as NIST 800-53), “Security and Privacy Controls for Information Systems and Organizations.”

To comply with the Federal standard, GSA must determine the security category of the information and information system in accordance with FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems,” and then the contractor shall apply the appropriately tailored set of Low, Moderate, or High impact baseline security controls in NIST 800-53, as determined by GSA. NIST 800-53 controls requiring organization-defined parameters (i.e., password settings) shall be consistent with GSA specifications. The GSA-specified control parameters and supplemental guidance defining more specifically the requirements per FIPS PUB 199 impact level are available in the GSA Control Tailoring Workbook.

The Contractor shall use GSA technical guidelines, NIST guidelines, Center for Internet Security (CIS) guidelines (Level 1), or industry best practice guidelines in hardening their systems.

U.S. General Services Administration 5

2.3 Essential Security Controls

All NIST 800-53 controls must be implemented as per the applicable FIPS PUB 199 Low (L), Moderate (M), or High (H) baseline. Controls in the Privacy baseline are applicable if PII data is being collected, stored, or transmitted. The following table identifies essential security controls from the respective baselines to highlight their importance and ensure they are implemented.

The Contractor shall make the proposed system and security architecture of the information system available to the Security Engineering Division, in the Office of the Chief Information Security Officer for review and approval before commencement of system build (architecture, infrastructure, and code).

Control

ID

Control Title

GSA

Baseline GSA Implementation Guidance (if applicable)

AC-02

Account Management

L, M, H

Account management systems must leverage or integrate with existing GSA account management solutions or processes, as applicable and defined in the GSA IT ICAM Roadmap (see GSA Order CIO 2183.1, “Enterprise Identity, Credential, and Access Management (ICAM) Policy.”

AC-17

(03)

Remote Access | Managed Access Control Points

M, H

All remote accesses from internal users/systems to the external information system must be routed through GSA’s managed network access control points, subjecting them to security monitoring.

AU-02 Event Logging L, M, H

Information systems shall implement audit configuration requirements as documented in applicable GSA IT Security Technical Hardening Guides (i.e., hardening and technology implementation guides); for web applications see GSA IT Security Procedural Guide 07-35, Section 2.8.10, What to Log.

For technologies where a Technical Guide and Standard does not exist, events from an industry source such as vendor guidance or Center for Internet Security benchmark, recommended by the GSA S/SO or Contractor to be approved and accepted by the GSA AO shall be used.

AU-06(01)

Audit Record Review, Analysis, and Reporting | Automated Process Integration

M, H

Systems must integrate or deploy automated mechanisms in support of audit record review, analysis, and reporting, in accordance with GSA IT Security Procedural Guide 01-08, Audit and Accountability (AU).

AU-11

Audit Record Retention

L, M, H

Systems must maintain 12 months of audit logs online and 18 months in cold storage, in accordance with GSA IT Security Procedural Guide 01-08, Audit and Accountability (AU).

CA-08(02)

Penetration Testing | Red Team Exercises

H, HVA

systems

In accordance with CIO Order 2100.1, all FIPs 199 High impact and HVA systems must have Red Team exercises performed as part of their A&A and annually thereafter.

CM-06

Configuration Settings

L, M, H Information systems, including vendor owned/operated systems on behalf of GSA, shall configure their systems in agreement with GSA technical guidelines, NIST

U.S. General Services Administration 6

Control

ID

Control Title

GSA

Baseline GSA Implementation Guidance (if applicable) guidelines, Center for Internet Security guidelines (Level 1), or industry best practice guidelines, as reviewed and accepted by the GSA AO.

CP-07

Alternate Processing Site

M, H

FIPS PUB 199 Moderate and High impact systems must implement processing across geographically disparate locations to ensure fault tolerance. Cloud Infrastructure as a Service (IaaS) architectures shall implement a multi-region strategy (multiple availability zones in a single region are not sufficient).

CP-08

Telecommunications Services

M, H

FIPS PUB 199 Moderate and High impact information systems must implement alternate telecom services to support resumption when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

IA-02(01)

Identification and Authentication (Organizational Users) | Multifactor Authentication to Privileged Accounts

L, M, H

All information systems shall implement multi-factor authentication for privileged accounts.

Information systems shall comply with GSA IT ICAM Roadmap, as applicable, (GSA Order CIO 2183.1, “Enterprise Identity, Credential, and Access Management (ICAM) Policy”).

IA-02(02)

Identification and Authentication (Organizational Users) | Multifactor Authentication to Non-Privileged Accounts

L, M, H

All information systems must implement multi-factor authentication for non-privileged accounts.

Information systems shall comply with GSA IT ICAM Roadmap, as applicable, (GSA Order CIO 2183.1, “Enterprise Identity, Credential, and Access Management (ICAM) Policy”).

IA-07

Cryptographic Module Authentication

L, M, H

The information system shall implement authentication to FIPS PUB 140-3/140-2 compliant encryption modules as specified in the respective standards.

Note: NIST has issued FIPS 140-3 and no longer accepts FIPS 140-2 modules for validation. However, previously validated 140-2 modules will be accepted through September 22, 2026. For additional information see the NIST Cryptographic Module Validation Program Validated Modules.

MP-04 Media Storage M, H

Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives, diskettes, compact disks, and digital video disks shall be encrypted using a FIPS PUB 140-3/140-2 validated encryption module.

MP-05 Media Transport M, H

Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives and digital video disks shall be encrypted using a FIPS PUB 140-3/140-2 validated encryption module during transport outside of controlled areas.

U.S. General Services Administration 7

Control

ID

Control Title

GSA

Baseline GSA Implementation Guidance (if applicable)

PL-08

Security and Privacy Architectures

L, M, H

All information system security architectures must be formally reviewed and approved by the Office of the Chief Information Security Officer, Security Engineering Division during the system develop/design stages of the SDLC and prior to Security Assessment and Authorization.

RA-05

Vulnerability Monitoring and Scanning

L, M, H

All systems must complete the following vulnerability scans:

o Weekly authenticated scans of operating systems (OS)-including databases o Monthly unauthenticated scans of web applications o Annual authenticated scans of web applications

The most recent vulnerability scanning results shall be provided to GSA together with the quarterly POA&M submission.

RA-08

Privacy Impact Assessments

L, M, H

RA-08 is included in all FIPS 199 Baselines to ensure all systems complete a Privacy Threshold Assessment (PTA) to determine if a Privacy Impact Assessment (PIA) is required.

SA-22

Unsupported System Components

L, M, H

All systems must be comprised of software and hardware components that are fully supported in terms of security patching for the anticipated life of the system; software must be on GSA’s Enterprise Architecture IT Standards List.

SC-08

SC-08(01)

Transmission Confidentiality and Integrity

Transmission Confidentiality and Integrity | Cryptographic Protection

M, H

L, M, H

Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-3 validated, respectively**.

o Digital signature encryption algorithms o Block cipher encryption algorithms o Secure hashing algorithms

For web services connections, implement end to end encryption terminating the connection at the web server;

connections terminated at a load balancer, Firewall, and/or WAF shall employ re-encryption techniques to ensure end to end encryption.

ALL associated URLs must have their second-level domain HTTP Strict Transport Security (HSTS) preloaded and have no weak ciphers, have no weak protocols, and preload .gov domains. (see Binding Operational Directive (BOD) 18-01, Enhance Email and Web Security).

SSL/TLS implementations shall align with GSA IT Security Procedural Guide 14-69: SSL/TLS Implementation.

**Federal Policy requires implementation of FIPS PUB 140-3/140-2 validated encryption modules and FIPS-approved ciphers suites. Encryption of GSA sensitive data (e.g., PII, PCI, Authenticators, other business

U.S. General Services Administration 8

Control

ID

Control Title

GSA

Baseline GSA Implementation Guidance (if applicable) sensitive data) at rest and in transit shall be with FIPS validated encryption modules wherever possible;

exceptions require Acceptance of Risk (AOR) to be signed by the GSA CISO and AO.

SC-13

Cryptographic Protection

L, M, H

Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140- 3/140-2 validated, respectively.

o Digital signature encryption algorithms o Block cipher encryption algorithms o Secure hashing algorithms

SC-17

Public Key Infrastructure Certificates

M, H

Implement appropriate creation, use, and signing of crypto certs in agreement with GSA IT Security Procedural Guide 14-69, “SSL/TLS Implementation,” and NIST Special Publications 800-52, Revision 2 and 1800- 16.

SC-18 Mobile Code M, H

Systems must adhere to GSA's requirements regarding IT Standards and CIO-IT Security-07-35: Web Application Security and CIO-IT Security-17-81: Web Browser Technologies Hardening, as applicable, to ensure only approved code (including mobile code) is used.

SC-22

Architecture and Provisioning for Name / Address Resolution Service

L, M, H

Information systems shall be Domain Name System Security Extensions (DNSSEC) compliant. Reference NIST SP 800-81-2, which provides deployment guidelines for securing DNS within an enterprise.

SC-28(01)

Protection of Information at Rest | Cryptographic Protection

L, M, H

**Systems that process Personally Identifiable Information (PII), Payment Card Industry (PCI) data, Authenticators (e.g., passwords, tokens, keys, certificates, hashes, etc.), and other sensitive data as determined by the AO, shall encrypt that data everywhere (i.e., at file level, database level, at rest, and in transit).

For databases, encryption of the whole database, table, column, or field levels is acceptable, as appropriate.

Other methods including, but not limited to, application encryption or tokenization are also acceptable.

For web services connections, implement end to end encryption terminating the connection at the web server;

connections terminated at a load balancer shall employ re-encryption techniques to ensure end to end encryption.

**Federal Policy requires implementation of FIPS PUB 140-3/140-2 validated encryption modules and FIPS-approved ciphers suites. Encryption of GSA sensitive data (e.g., PII, PCI, Authenticators, other business sensitive data) at rest and in transit shall be with FIPS validated encryption modules wherever possible;

exceptions require Acceptance of Risk (AOR) to be signed by the GSA CISO and AO.

U.S. General Services Administration 9

Control

ID

Control Title

GSA

Baseline GSA Implementation Guidance (if applicable)

SI-02 Flaw Remediation L, M, H

All projects and systems must be adequately tested for flaws; all Critical, High, and Moderate risk findings must be remediated prior to go-live. Post go-live vulnerability remediation timelines are as follows:

14 days for CISA Known Exploited Vulnerabilities

(KEV)

15 days for Critical vulnerabilities for Internet-accessible systems or services

30 days for Critical and High vulnerabilities

90 days for Moderate vulnerabilities

180 days for Low vulnerabilities

SI-03

Malicious Code Protection

L, M, H

SI-04 System Monitoring L, M, H

All information systems must be monitored internally and across ingress/egress points for potentially malicious activity.

SI-10

Information Input Validation

M, H

All systems accepting input from end users must validate the input in accordance with industry best practices and published guidelines, including GSA IT Security Procedural Guide 07-35, “Web Application Security,” and OWASP Top 10 Web Application Security Vulnerabilities.

SR-02

Supply Chain Risk Management Plan

L, M, H Tier 3 (Information System) level plans for each system should be developed consistent with the template in Appendix E of NIST SP 800-161.

SR-06

Supplier Assessment and Reviews

M, H Contractor owned/operated systems must perform their own system-specific Supplier Assessments and Reviews consistent with NIST SP 800-161.

PM-21

Accounting of Disclosures

See note below

Requires accounting of disclosures of PII.

PM-25

Minimization of Personally Identifiable Information Used in Testing, Training, and Research

See note below

Requires implementation of policies and procedures to minimize PII used in testing, training, and research.

PT-05 Privacy Notice See note below

Privacy notices help inform individuals about how their personally identifiable information is being processed by the system or organization

PT-05(02)

Privacy Notice | Privacy Act Statements

See note below

Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records or provide Privacy Act statements on separate forms that can be retained by individuals.

PT-06

System of Records Notice

See note below

Federal agencies must publish a system of records notice in the Federal Register upon the establishment and/or modification of a Privacy Act system of record

PT-07(01)

Specific Categories of Personally

See note below

Federal law and policy establish specific requirements for organizations’ processing of Social Security numbers;

U.S. General Services Administration 10

Control

ID

Control Title

GSA

Baseline GSA Implementation Guidance (if applicable)

Identifiable Information | Social Security Numbers organizations take steps to eliminate unnecessary uses of Social Security numbers and other sensitive information and observe any particular requirements that apply.

SI-12(01)

Information Management and Retention | Limit Personally Identifiable Information Elements

See note below

Limit personally identifiable information being processed in the information life cycle to specified elements.

Note: Privacy controls are not associated with a FIPS PUB 199 baseline. Controls are applicable if PII data is being collected, stored, or transmitted.

2.4 Assessment and Authorization (A&A) Activities

The implementation of a new Federal Government IT system requires a formal approval process known as Assessment and Authorization (A&A). NIST Special Publication 800-37, Revision 2 (hereafter described as NIST 800-37) and GSA IT Security Procedural Guide 06-30:

Managing Enterprise Cybersecurity Risk, provide guidelines for performing the A&A process.

The Contractor system/application must have a valid assessment and authorization, known as an Authorization to Operate (ATO) (signed by the Federal government), before going into operation and processing GSA information. The failure to obtain and maintain a valid ATO will result in the termination of the contract. The system must have a new A&A conducted (signed by the Federal government) when significant changes are made to the system, and as specified in GSA IT Security Procedural Guide 06-30: Managing Enterprise Cybersecurity Risk, and the guides for GSA’s other A&A processes referenced therein.

Assessing the System

1. The Contractor shall comply with Assessment and Authorization (A&A) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the A&A is based on the System’s FIPS PUB 199 impact level and applicable A&A documentation requirements. The contractor shall create, maintain, and update the following A&A documentation:

System Security and Privacy Plan (SSPP) completed in agreement with NIST Special Publication 800-18, Revision 1, “Guide for Developing Security Plans for Federal Information Systems” and completed in accordance with GSA SSPP requirements and templates. The SSPP template includes specific instructions on documenting control implementations. Each control implementation must address all the control requirements and how they are achieved (i.e., who, what, when, where). Appendices shall be included to support control implementations, when necessary. The SSPP shall include; as an appendix, a completed GSA Control Tailoring Workbook (CTW). The column in the CTW titled “Vendor/Contractor Defined Values” shall be used to document all contractor implemented parameter settings that differ from the GSA Defined Value and the

U.S. General Services Administration 11

Vendor/Contractor defined value when the value is deferred to the Vendor/Contractor. GSA’s approval will be documented in the CTW column titled “GSA Approval of Vendor/Contractor Defined Values.”

Note: A description of how the system will transition to IPv6, as required by OMB M-21-07, must be included as part of the system’s SSPP.

Contingency Plan completed in agreement with NIST Special Publication 800-34 and GSA IT Security Procedural Guide 06-29: Contingency Planning.

Business Impact Assessment completed in agreement with NIST Special Publication 800-34 and GSA IT Security Procedural Guide 06-29: Contingency Planning.

Contingency Plan Test Report completed in agreement with GSA IT Security Procedural Guide 06-29: Contingency Planning.

Incident Response Plan completed in agreement with NIST Special Publication 800-61, “Computer Security Incident Handling Guide” and GSA IT Security Procedural Guide 01-02: Incident Response.

Incident Response Test Report completed in agreement with NIST Special Publication 800-61, “Computer Security Incident Handling Guide” and GSA IT Security Procedural Guide 01-02: Incident Response.

Configuration Management Plan completed in agreement with GSA IT Security Procedural Guide 01-05: Configuration Management.

Plan of Action & Milestones completed in agreement with GSA IT Security Procedural Guide 09-44: Plan of Action and Milestones (POA&M).

Penetration Test Report documenting the results of vulnerability analysis and exploitability of identified vulnerabilities. Note: Penetration testing is required for all Internet accessible, all FIPS 199 High, and all High Value Asset (HVA) information systems. These systems are required to complete an independent penetration test and provide an Independent Penetration Test Report documenting the results of the exercise as part of the A&A package. Reference GSA IT Security Procedural Guide 06-30: Managing Enterprise Cybersecurity Risk and GSA IT Security Procedural Guide 11-51: Conducting Penetration Test Exercises for penetration testing guidance.

Red Team Exercise Report documenting the results of the Red Team exercise in accordance with CIO Order 2100.1. Note: A Red Team exercise is required for FIPS PUB 199 High and HVA systems.

Information Exchange Agreements documented in accordance with GSA IT Security Procedural Guide 24-125: Managing Information Exchange Agreements and NIST Special Publication 800-47, Revision 1, “Managing the Security of Information Exchanges.”

2. Information systems must be assessed and authorized every three (3) years or whenever there is a significant change to the system's security posture in accordance with NIST Special Publication 800-37, Revision 2, " Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," and CIO IT Security 06-30: Managing Enterprise Cybersecurity Risk or via continuous monitoring based on GSA CIO IT Security 12-66: Information Security Continuous Monitoring (ISCM) Strategy & Ongoing Authorization (OA) Program that is reviewed and accepted by the GSA CISO. Systems designated as an HVA must be assessed in accordance with the CISA HVA Program Management Office and GSA guidance per CIO-IT Security-24-131: Managing High Value Assets.

U.S. General Services Administration 12

3. At the Moderate impact level and higher, the <SELECT: contractor or Government> is responsible for providing an independent Security Assessment/Risk Assessment in accordance with GSA IT Security Procedural Guide 06-30: Managing Enterprise Cybersecurity Risk.

4. If the Government is responsible for providing any assessment artifact (e.g., SAR, Penetration Test Report), the Contractor shall allow GSA employees (or GSA designated third party contractors) to conduct A&A activities to include control reviews in accordance with NIST 800-53/NIST 800-53A and GSA IT Security Procedural Guide 06- 30: Managing Enterprise Cybersecurity Risk, and if applicable CIO-IT Security-24-131.

Review activities include but are not limited to operating system vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, or security of GSA information. This includes the general support system infrastructure.

5. Identified gaps between required NIST 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document completed in accordance with GSA IT Security Procedural Guide 09-44: Plan of Action and Milestones (POA&M). Depending on the severity of the gaps, the Government may require them to be remediated before an Authorization to Operate is issued. For systems designated as an HVA a remediation plan shall be prepared based on guidance in CIO- IT Security-24-131.

6. The Contractor is responsible for mitigating all security risks found during the A&A and continuous monitoring activities. Vulnerabilities must be mitigated as follows:

14 days for CISA Known Exploited Vulnerabilities (KEV)

15 days for Critical vulnerabilities for Internet-accessible systems or services

30 days for Critical and High vulnerabilities

90 days for Moderate vulnerabilities

180 days for Low vulnerabilities

7. The Government will determine the risk rating of vulnerabilities.

Authorization of the System

1. Upon receipt of the documentation (A&A Package) described in GSA IT Security Procedural Guide 06-30: Managing Enterprise Cybersecurity Risk and NIST Special Publication 800-37 as documented above, the GSA Authorizing Official (AO) for the system (in coordination with the GSA Chief Information Security Officer (CISO), System Owner, Information System Security Manager (ISSM), and Information System Security Officer (ISSO) will render an authorization decision to:

Authorize system operation w/out any restrictions or limitations on its operation;

Authorize system operation w/restriction or limitation on its operation, or;

Not authorize for operation.

2. The Contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. At its option, the Government may choose to conduct on site surveys. The Contractor shall make appropriate personnel available for interviews and documentation during this review.

U.S. General Services Administration 13

2.5 Reporting and Continuous Monitoring

Maintenance of the security authorization to operate will be through continuous monitoring of security controls of the external system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to GSA per the schedules below. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. They allow GSA AOs to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur.

Vendor deliverables as identified below will be reviewed and accepted or rejected by the process described in GSA CIO IT Security Procedural Guide 19-101: External Information System Monitoring. In addition to the deliverable requirements specified, systems designated as an HVA shall comply with reporting, monitoring, and re-assessment requirements as identified by the CISA HVA Program Management Office and in GSA CIO-IT Security-24-131.

Deliverables to be provided Quarterly to the GSA ISSO, ISSM, and/or COR (Reference:

CIO-IT Security-08-39).

1. Vulnerability Monitoring and Scanning (Due NLT 25th of the third month each quarter) Reference: NIST 800-53 control RA-05 Provide the most recent Web Application and Operating System vulnerability scan reports. GSA’s control parameter for RA-05, Vulnerability Monitoring and Scanning, specifies the following type and frequency of scans; weekly authenticated scans of operating systems (OS)-including databases, monthly unauthenticated scans of web applications, annual authenticated scans of web applications.

2. Plan of Action & Milestones (POA&M) Update (Due NLT the 1st day of the third month of each quarter) Reference: NIST 800-53 control CA-05 Provide POA&M updates in accordance with requirements and the schedule set forth in GSA CIO IT Security Procedural Guide 09-44: Plan of Action and Milestones (POA&M).

3. Static Code Analysis – required prior to code base changes being placed into production (Due NLT 25th of the third month each quarter) Reference: NIST 800-53 control SA-11(01) Provide the most recent static code analysis report, as applicable (i.e., if code base changes were placed into production in the quarter).

4. FISMA Quarterly Metrics data, as necessary (i.e., when a FISMA quarterly data call is issued that is applicable to the system). (Due per data call request deadline)

Deliverables to be provided Annually (or when there is a major change) to the GSA ISSO, ISSM, and/or COR (Due dates for annual deliverables are as indicated in the following lists.)

Note: Deliverables annotated with a “*” below may be attested to via an attestation letter as described in GSA CIO-IT Security-19-101, “External Information System Monitoring.”

Annual Deliverables due NLT February 25th (Reference: CIO-IT Security-19-101).

U.S. General Services Administration 14

1. Annual FISMA Self-Assessment Reference: NIST 800-53 control CA-02 Deliver the results of the annual FISMA self-assessment conducted per GSA IT Security Procedural Guide 04-26: Federal Information Security Modernization Act (FISMA) Implementation. Based on the controls selected for self-assessment, the GSA OCISO will provide the appropriate test cases for completion.

2. Updated A&A documentation including the SSPP, Contingency Plan, and Business Impact Analysis

a. SSPP Reference: NIST 800-53 control PL-02 Review and update the SSPP annually to ensure the plan is current and accurately describes implemented system controls and reflects changes to the contractor system and its environment of operation. The SSPP must be in accordance with NIST 800-18, Revision 1, “Guide for Developing Security Plans for Federal Information Systems.”

b. Contingency Plan Reference: NIST 800-53 control CP-02 Provide an annual update to the contingency plan completed in accordance with NIST 800-34, “Contingency Planning Guide for Federal Information Systems,” and GSA IT Security Procedural Guide 06-29: Contingency Planning (CP).

c. Business Impact Analysis (as an appendix or attachment to the Contingency Plan) Reference: NIST 800-53 control CP-02 Provide an annual update to the business impact analysis completed in accordance with NIST 800-34, “Contingency Planning Guide for Federal Information Systems”, and GSA IT Security Procedural Guide 06-29:

Contingency Planning (CP).

3. Contingency Plan Test Report Reference: NIST 800-53 control CP-04 Provide a contingency plan test report completed in accordance with GSA IT Security Procedural Guide 06-29: Contingency Planning (CP). A continuity test shall be conducted annually prior to mid-July of each year. The continuity test can be a tabletop test while the system is at the FIPS PUB 199 Low Impact level. The tabletop test must include Federal and hosting Contractor representatives.