Directive_6500_24_Feb_2021.pdf

Department of Veterans Affairs VA DIRECTIVE 6500 Washington, DC 20420 Transmittal Sheet February 24, 2021

VA CYBERSECURITY PROGRAM

1. REASON FOR ISSUE: Reissues VA Directive 6500 pursuant to the authority to maintain a VA cybersecurity and privacy program to protect and defend VA information and VA Information Technology (IT) that is consistent with the VA’s information privacy and security statutes, 38 United States Code (U.S.C.) §§ 5721- 5728, the Federal Information Security Modernization Act (FISMA), 44 U.S.C. §§ 3551-3558, and Office of Management and Budget (OMB) Circular A-130 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-

53.

2. SUMMARY OF CONTENTS/MAJOR CHANGES:

a. Establishes the Risk Executive Function as a component of the VA’s information security governance structure (Page 7, Section 2.a.(3)(f));

b. Establishes the Information Security Knowledge Service as the VA’s centralized repository to provide cybersecurity and privacy policies, procedures, and guidance (Page 7, Section 2.a.(3)(g));

c. Introduces and describes new Information Security Knowledge Service portal and new supporting Risk Management Framework (RMF) Technical Advisory Group (TAG) roles and responsibilities (Page 4, Section 2);

d. Establishes the Committee on National Security Systems Instruction (CNSSI) No.

1253 as the methodology to categorize VA Information Systems (ISs), select and tailor security and privacy controls, and provide the information security control baseline for all VA Information Systems (Page 4, Section 2).

3. RESPONSIBLE OFFICE: Office of the Assistant Secretary for Information and Technology (OIT) (005) and Office of Information Security (OIS) (005R).

4. RELATED HANDBOOK: VA Handbook 6500, VA Risk Management Framework.

5. RESCISSIONS: VA Directive 6500, Managing Information Security Risk: VA Information Security Program, dated January 23, 2019.

CERTIFIED BY:

/s/ John P. Medve Acting Assistant Secretary for Enterprise Integration

BY DIRECTION OF THE SECRETARY

OF VETERANS AFFAIRS:

/s/ Dominic A. Cussatt Acting Assistant Secretary for Information and Technology/ Chief Information Officer

DISTRIBUTION: Electronic only

VA Directive 6500 February 24, 2021

TABLE OF CONTENTS

1. PURPOSE

2. POLICY

3. RESPONSIBILITIES

4. REFERENCES

5. DEFINITIONS

VA CYBERSECURITY PROGRAM

1. PURPOSE.

The purpose of the VA cybersecurity and privacy program is to set the direction for the protection and informed risk management of VA information and VA Information System (IS).

This directive:

a. Reissues VA Directive 6500 to establish a VA cybersecurity and privacy program to protect and defend VA information and VA IT;

b. Establishes the Risk Executive Function as a component of the VA’s information security governance structure;

c. Establishes the Information Security Program Risk Management Framework (RMF) Technical Advisory Group (TAG), which serves as the governing body for security control management and implementation, to strengthen VA’s ability to rapidly deploy secure systems;

d. Establishes the Information Security Knowledge Service as VA’s centralized repository to provide cybersecurity and privacy policies, procedures, and guidance;

e. Aligns VA’s Information Security Program with the National Institute of Standards and Technology (NIST) Cybersecurity Framework; and

f. Designates Committee on National Security Systems Instructions (CNSSI) No. 1253 as the methodology to categorize VA Information Systems, select and tailor security and privacy controls, and provide the security control baselines for all VA Information Systems.

2. POLICY. VA Cybersecurity Program. VA will use this directive as well as the RMF as defined in NIST Special Publication (SP) 800-37, NIST SP 800-39, NIST SP 800-53 and as implemented by VA Handbook 6500, to manage risks to VA’s information systems. VA will use Control Correlation Identifiers (CCI) level for implementation of the security and privacy controls as defined in NIST SP 800-53 and CNSSI 4009 and will follow the security control baselines in CNSSI No. 1253. This information will be located on the VA Information Security Knowledge Service.

The five core cybersecurity and privacy functions that define the VA cybersecurity and privacy program are based on the NIST Cybersecurity Framework and the Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, issued on May 11, 2017. The core functions are: Identify, Protect, Detect, Respond, and Recover. Collectively, these five core functions enable VA to: provide mission and operational resilience under any cyber situation or condition; act collectively, consistently, and effectively in its own defense; allow VA IT to perform as designed and adequately meet operational requirements; and work securely and seamlessly among mission partners.

https://vaww.vashare.oit.va.gov/sites/ois/KnowledgeService/Pages/Home.aspx

a. Identify Function. The Identify Function defines the foundational policies necessary to apply the Cybersecurity Framework to VA and institutionalizes VA’s understanding and the processes necessary to manage cybersecurity and privacy risk to systems, assets, data, and capabilities, and identify any gaps in VA’s cybersecurity and privacy practices.

Outcome categories within the Identify Function are described below:

(1) Asset Management

(a) All assets (e.g., data, personnel, devices, systems, and facilities) consistent with their relative importance to VA business objectives and risk strategy must be identified and managed.

(b) All VA Information Systems must be registered in the VA System Inventory (VASI) in accordance with VA policy and as part of a security authorization in VA’s Governance, Risk and Compliance tool at the Department level.

(c) VA will register all non-IT systems (e.g., physical plant systems and medical device systems) at the Department level.

(d) Information flow control policies must be developed, and approved authorization enforced for controlling the flow of information within the system and between interconnected systems.

(e) VA will meet regulatory requirements for the management of information in electronic format including Health Insurance Portability and Accountability Act (HIPAA) compliance for electronic health information.

(2) Business Environment

(a) Cybersecurity and privacy responsibilities and risk management decisions will be informed utilizing an understanding of VA’s three major business environments (health, benefits, and memorial affairs).

(b) VA mission and business processes, the resulting IT processing needs, and inherent risks associated with processing electronic sensitive VA data, especially Personally Identifiable Information (PII) and electronic Protected Health Information (ePHI) must be defined and the appropriate security controls must be in accordance with FISMA, the Privacy Act, HIPAA, the Health Information

Technology for Economic and Clinical Health Act (HITECH).

(c) A plan for managing financial and supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services must be developed and implemented.

(d) A critical infrastructure and key resources protection plan must be developed, documented and regularly updated to address information security and privacy issues.

(e) Critical system assets supporting essential mission and business functions must be identified to ensure additional safeguards and countermeasures can be employed and to facilitate the prioritization of organizational resources.

(f) A criticality analysis must be performed when an architecture or design is developed including the use of authoritative sources to identify critical system components and functions. Component and function criticality are assessed in terms of the impact of a component or function failure on the organizational missions supported by the system containing those components and functions.

(g) Performance is measured, assessed for effectiveness, and managed relative to contributions to mission outcomes and strategic goals and objectives in accordance with 40 U.S.C 11313 Performance and results-based management.

(h) Cybersecurity and privacy solutions must be implemented consistent with enterprise architecture principles and guidelines within the VA Architecture

Framework and VA cybersecurity and privacy architectures developed or approved by the VA Chief Information Officer (CIO).

(i) Operational resilience must be implemented by requiring three conditions to be met: (i) information resources are trustworthy; (ii) missions are ready for information resources degradation or loss; and (iii) network operations have the means to prevail in the face of adverse events.

(j) Resiliency requirements to support the delivery of critical services during all operating states (e.g., under duress, under attack, during recovery, and normal operations) are defined based on the criticality of the system to enable VA to complete its mission.

(3) Governance

(a) VA will define Governance practices that include the policies, procedures, processes; guidance to manage and monitor VA’s regulatory, legal, risk, environmental, and operational requirements shall be defined and to inform management of cybersecurity and privacy risks.

(b) VA will develop, document, and disseminate cybersecurity and privacy policies, procedures, processes, and guidance that must be developed, documented, disseminated, reviewed and update regularly. Remediation actions for violations of cybersecurity and privacy policies shall be defined and implemented.

(c) An organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements must be developed and disseminated. This shall include the identification and assignment of roles and responsibilities and reflect the coordination among organizational entities responsible for information security.

(d) A comprehensive security governance structure that provides assurance that information security strategies are aligned with and support mission and business objectives must be implemented and consistent with applicable laws and regulations through adherence to policies and internal controls.

(e) Senior Agency Official for Privacy (SAOP) with the authority, mission, accountability, and resources to coordinate, develop, and implement applicable privacy requirements and manage privacy risks in accordance with VA’s privacy program.

(f) Establish a principal governing body for its information security programs via a charter signed by the CIO. The principal governing body governs the management processes for information security and validates the effectiveness of those programs with a goal of continuously improving VA’s security posture.

This governing body serves as the VA Risk Executive Function.

(g) The Information Security Knowledge Service will be established as the approved source for VA cybersecurity and privacy policies, procedures, processes, and guidance. The Information Security Knowledge Service supports RMF practitioners by providing the approved access to VA security control baselines, security control descriptions, security control overlays, implementation guidance, and assessment procedures.

(h) Cybersecurity and privacy policies and capabilities must align with, and be mutually supportive of personnel, physical, and industrial information as well as operations security policies and capabilities.

(4) Risk Assessment

(a) An understanding of the cybersecurity and privacy risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals must be demonstrated.

(b) Risk assessments must be performed in accordance with NIST SP 800-30, NIST SP 800-53 and as described in the VA Information Security Knowledge Service.

The risk factors described in NIST SP 800-30 and NIST SP 800-53 will be used across VA Administrations and Staff Offices to ensure ease of sharing risk information.

(c) Controls must be tailored and recommended by the risk assessments to accommodate resource constraints and the availability of detailed risk factor information (e.g. threat data). However, any tailoring must be clearly explained in risk assessment reports to ensure that Authorizing Officials (AO) understand to what degree they can rely on the results of the risk assessments.

(d) Systems, including those that operate in cloud environments, and applications must be monitored for new threats and scan the environment on an established schedule with agency-established criteria for performing special scans based on new threats.

(e) Contact groups and associations shall be selected and established within the security and privacy communities to share current security and privacy related information, including threats, vulnerabilities, and incidents; maintain currency with recommended security and privacy practices, techniques, and technologies;

and facilitate ongoing security and privacy education and training for organizational personnel.

(f) Cybersecurity and privacy risks must be managed consistently across VA in a way that reflects organizational risk tolerance. Cybersecurity and privacy risk must be considered along with other organizational risks to ensure mission and business success.

(g) Plans of Action and Milestones (POA&Ms) process must be implemented to ensure that the security and privacy programs and associated organizational systems are developed and maintained. The POA&Ms document the remedial information security and privacy actions to adequately manage risk and implement remediation actions.

(h) VA will respond to findings from security and privacy assessments, monitoring, and audits in a POA&M. VA will manage the risk through strengthening existing controls or implementing new controls, accepting the risk with appropriate justification or rationale, sharing or transferring the risk, or rejecting the risk. If the risk response is to mitigate the risk and the mitigation cannot be completed immediately, a POA&M entry will be generated.

(i) All interconnections of VA IT must be managed to minimize shared risk by ensuring that the security posture of one system is not undermined by vulnerabilities of interconnected systems.

(5) Risk Management

(a) Priorities, constraints, risk tolerances, and assumptions must be established and used to support operational risk decisions.

(b) A multi-tiered cybersecurity and privacy risk management process described in NIST SP 800-39 and CNSS Policy (CNSSP No. 22) must be implemented to protect U.S. interests, VA operational capabilities, VA individuals, organizations, and assets.

(c) A comprehensive risk management strategy that defines how VA will manage security, privacy, and supply chain risk, including the determination of risk tolerance and the development and execution of organization-wide investment strategies for information resources and information security shall be published.

(d) VA will manage risk by identifying assumptions and constraints affecting risk assessments, risk response, and risk monitoring; the organizational risk tolerance; and priorities and trade-offs considered by the organization for managing risk.

(e) Information protection requirements will be satisfied by the selection and implementation of appropriate security and privacy controls in NIST SP 800-53, following the baselines defined in CNSSI No. 1253. Controls are implemented by common control providers, information system owners (ISOs), or program managers, and decisions are granted by AOs based on risk to the Department.

Detailed guidance on system categorization and security control selection is provided in VA Handbook 6500 and on the Information Security Knowledge Service.

(f) Information systems will be designated as national security systems (NSS) or non-NSS systems according to criteria published on the Information Security Knowledge Service. NSS systems will require additional security measures. VA will incorporate risk management tasks throughout the system development life cycle.

(g) The security and privacy state of VA Information Systems and the environments (e.g. cloud environments) in which those systems operate will be managed throughout the authorization process. The authorization process is integrated with continuous monitoring processes to facilitate ongoing understanding and acceptance of security and privacy risks.

(h) Risk management continues during operations and sustainment, which may include the application of new or revised security or privacy controls prior to the integration of new IT services or products into an existing operational system, to maintain the security of the operational system.

b. Protect Function. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity and privacy event by developing and implementing the appropriate safeguards to ensure delivery of critical IT services. Outcome categories within the Protect Function include: Identity Management and Access Control;

Awareness and Training; Data Security; Information Protection Processes and Procedures; Media Sanitization; Maintenance; and Protective Technology; and associated activities, as described below:

(1) Identity Management and Access Control

(a) Access to physical and logical assets and associated facilities to authorized users, processes, and devices, and manage the assets consistent with the assessed risk of unauthorized access.

(b) Only VA-approved identity credentials will be used to authenticate entities requesting access. This requirement extends to all mission partners using VA IT.

(c) Public Key Infrastructure (PKI) solution will be enabled and implemented on VA Information Systems in accordance with current Federal requirements.

(d) A list of individuals with authorized access to VA facilities will be developed, approved, and maintained; authorization credentials will be issued for facility access.

(e) Usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed and authorized on VA Information Systems must be documented prior to allowing such connections.

(f) System access authorizations must be defined to support separation of duties.

(g) The principle of least privilege will be employed, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational mission and business functions.

(h) System components performing different missions or business functions will be isolated or segregated when necessary to limit unauthorized information flows among components and provide the opportunity to deploy greater levels of protection for selected system components.

(i) VA will proof identities and bind them to credentials and use this for assertion in interactions when appropriate, in accordance with current Federal requirements.

(2) Awareness and Training

(a) All authorized users of VA Information Systems will receive an initial Privacy and Information Security Awareness and Rules of Behavior orientation as a condition of access and, thereafter, participate annually in both VA and the Administration’s enterprise cybersecurity and privacy awareness program.

(b) Cybersecurity and privacy awareness education and training shall be provided for organizational and non-organizational users to perform their information security-related duties and responsibilities and will be consistent with VA policies and procedures.

(c) A process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with VA Information

Systems are developed, maintained, and executed in a timely manner must be implemented.

(d) Specialized training and awareness for privileged users, third-party stakeholders, and senior executives must be provided.

(e) Appropriate content for security and privacy training based on the assigned roles and responsibilities of individuals, specific VA security and privacy requirements, and the systems to which personnel have authorized access must be identified.

(3) Data Security

(a) Information, records, and data must be managed throughout the information life cycle consistent with VA’s risk strategy to protect the confidentiality, integrity, and availability of information.

(b) Protect low, moderate and high impact CNSSI information at rest, in use and during transmission; this information shall be protected by encryption unless encrypting such information is technically infeasible or would demonstrably affect the ability of VA to carry out its missions, functions, or operations; and the risk of not encrypting is accepted by the AO and approved by the CIO, in consultation with the SAOP (as appropriate).

(c) A Data Governance Council (DGC) must be established and develop and implement guidelines supporting data modeling, quality, integrity, and de-identification needs of PII/PHI across the information life cycle.

(d) A Data Integrity Council shall be established to oversee organizational Computer Matching Agreements.

(e) VA IT that processes or stores PII or PHI, Payment Card Industry Data Security Standard (PCI-DSS) data, and VA Sensitive information will comply with appropriate VA policy.

(f) Cryptography required to protect VA information will be implemented in accordance with Federal Information Processing Standards (FIPS) 140-3.

(g) VA will protect against data breaches in accordance with NIST SP 800-37, NIST

SP 800-39 and NIST SP 800-53.

(h) VA will employ integrity verification tools to detect unauthorized changes to selected software, firmware, hardware, and information.

(i) VA will protect against covert exfiltration of information.

(4) Information Protection Processes and Procedures

(a) Security policies that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities will be used and maintained to manage protection of information systems and assets.

(b) All VA IT will comply with applicable Security Technical Implementation Guides (STIGs) and security configuration guides, with any exceptions documented and approved by ISO and authorized by the responsible AO.

(c) Automation shall be used whenever possible in support of cybersecurity and privacy objectives, including, but not limited to, secure configuration management, continuous monitoring, active cyber defense, incident reporting, and situational awareness.

(d) Cybersecurity and privacy shall be fully integrated into system life cycles so that it will be a visible element of VA architectures, capability identification and development processes, integrated testing, IT portfolios, acquisition, operational readiness assessments, supply chain risk management, system security engineering (SSE), and operations and maintenance activities.

(e) Security and privacy control implementation, assessment, and sustainment shall be planned and budgeted throughout the system life cycle, including timely and effective configuration and vulnerability management.

(f) SSE principles and concepts will be used to design, develop, implement, modify, test, and evaluate information systems and system architectures as described in

NIST SP 800-160.

(g) Proposed configuration-controlled changes to systems, must be reviewed, approved, or disapproved with explicit consideration for security impact analyses, and the decision must be documented.

(h) VA will conduct backups of user-level information and system-level information contained in VA Information Systems. System documentation will include security-related documentation.

(i) The confidentiality, integrity, and availability of backup information at storage locations must be protected in accordance with all VA policy.

(j) A physical security program must be established to protect VA IT from damage, loss, theft, or unauthorized physical access in accordance with VA policy.

(k) Policies and procedures must be updated to address system and organizational changes, or problems encountered during implementation, execution, or testing of the VA information security program.

(l) A threat awareness program will be implemented that includes a cross-organizational information sharing capability. Threat information sharing may be bilateral (e.g., government/commercial cooperatives) or multilateral (e.g., organizations taking part in threat-sharing consortia). Threat information may be highly sensitive, requiring special agreements and protection, or less sensitive and freely shared.

(m) Appropriate response and recovery plans must be developed, tested, implemented, managed and maintained. At a minimum, VA will manage, and test all plans on a yearly basis or when a significant change occurs, including incident response, business continuity, contingency, incident recovery, and disaster recovery plans.

(n) Cybersecurity and privacy workforce management policies and capabilities must be developed to support identification and qualifications for a professional cybersecurity and privacy workforce.

(o) System flaws will be identified, reported and corrected. Flaw remediation will be incorporated into VA’s configuration management process.

(5) Media Sanitization

(a) Media sanitization on all electronic storage media must comply with NIST SP

800-88.

(b) A program must be maintained to sanitize and properly dispose of media containing VA sensitive information.

(c) Approved techniques or methods to retain VA information will be used consistent with VA retention guidelines and National Archives and Records Administration (NARA) approved records control schedules. This applies to originals as well as copies and archived records, including system logs that may contain PII/PHI PCI- DSS data and VA sensitive information.

(d) VA offices and facilities notified by the Office of General Counsel (OGC) that their IT equipment, electronic storage media, or information residing on either, is subject to retention for possible litigation purposes, must immediately cease the repair, reuse, disposal, destruction, or sanitization of the involved equipment, storage media, or data. These restrictions also apply to non-VA IT equipment (including research equipment and/or grant-owned equipment), electronic storage media, and VA information residing on either.

(e) Office of Information and Technology (OIT) staff will train Information System

Security Officers (ISSOs) on VA data sanitization policies and procedures. They must also provide current copies of any VA policies and documents describing or depicting sanitization methods and procedures to appropriate staff members.

(f) Contracts involving media sanitization, electronic storage media, and IT equipment (e.g., sharing agreements and Memoranda of Understanding (MOU)), maintenance contracts, service contracts, and vendor repair agreements (including third party vendor repair and lease agreements) will comply with VA and Federal policy. These contracts must include the appropriate security language including HIPAA Security Rule requirements for ePHI concerning the protection of VA assets, including appropriate media sanitization for electronic storage media, IT systems and equipment.

(g) Users of non-VA leased or owned IT equipment including, but not limited to, personally-owned equipment (which requires an approved waiver from the VA AO), vendor-owned equipment, or research equipment obtained through a grant used to store, process, or access VA sensitive information are required to protect all VA sensitive information from subsequent disclosure to unauthorized persons during use and when the equipment is no longer used to access VA sensitive information.

(h) Returning leased equipment constitutes a risk. VA employees must sanitize VA sensitive information residing on leased equipment before releasing that equipment from direct VA control, or ensure the contract states the media will not be returned upon termination of the contract. Depending upon the contract, this may include VA licensed software installed on leased equipment. Copyright protected software must be removed from equipment prior to repair, disposal, or reuse unless it: (i) will be reused by an agency component included as a part of the same group license under which the program was initially installed, or (ii) is required to ensure the repair was successful. If installing Commercial Off-the- Shelf (COTS) software, pre-approval is required by OIT and the Contracting Officer. If the COTS software requires a user license limited to that individual, the individual must remove that software from the machine before releasing the machine for another individual’s use.

(i) When non-VA owned IT equipment is no longer used to access or store VA sensitive information, all equipment hard drives and internal memory is to be sanitized in accordance with VA policy. All other electronic storage media used to store, process, or access VA sensitive information must be sanitized in accordance with VA policy when the media are no longer used to access VA sensitive information being disposed of or removed from VA control.

(j) OIT and facility property managers are required to report usable excess IT equipment within VA and redistribute that equipment for use, if appropriate. If the excess IT equipment cannot be used within the agency, then donations of equipment to schools (grades K-12) are encouraged under the auspices of Executive Order 12999 (Computers for Learning Program), signed on April 16, 1996.

(k) OIT and facility property managers are encouraged to use VA’s MOU established with UNICOR for processing scrap IT equipment and for the recycling of scrap electronic equipment in general. Electronic storage media/components will be removed prior to transfer to UNICOR and disposed of per NIST SP 800-88 for the purposes of media sanitization.

(6) Maintenance

(a) Maintenance and repairs of VA IT Information Systems and system components will be performed consistent with VA policies and procedures.

(b) Maintenance, repair, or replacements of system components will be scheduled, documented, managed and records reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements. System maintenance also includes those components not directly associated with information processing and/or data or information retention, such as mobile devices, scanners, copiers, and printers.

(c) Maintenance activities will be approved and monitored whether performed on site or remotely and whether the system or system components are serviced on site or moved to another location, to ensure that VA sensitive information and PII is maintained under VA control.

(7) Protective Technology

(a) Technical security solutions will be managed to ensure the security and resilience of systems and assets are consistent with related policies, procedures, and agreements.

(b) System audit data will be collected and kept to support technical analysis relating to misuse, penetration, or other incidents involving IT under their purview, and provide this data to appropriate law enforcement or other investigating agencies as necessary.

(c) Technical and non-technical safeguards must be employed to limit the use of portable media, including digital (e.g., external or removable hard disk drives and flash drives) and non-digital media (e.g., paper and microfilm), and protect the portable media when not in use.

(d) Systems must be configured to provide only essential capabilities, and prohibit or restrict the use of selected functions, ports, protocols, and/or services.

(e) VA will monitor and control communications and networks at external boundaries and at key internal boundaries, and connect to external networks or systems only through managed interfaces.VA will pre-define functional states to achieve availability (e.g., under duress, under attack, during recovery, and normal operations) based on the criticality of the system to enable VA to complete its mission.

c. Detect Function. The Detect Function enables timely discovery of cybersecurity and privacy events by implementing the appropriate activities to identify the occurrence of a cybersecurity and privacy event. Outcome categories within the Detect Function include: Anomalies and Events; Security Continuous Monitoring; Detection Processes;

and associated activities, as described below:

(1) Anomalies and Events

(a) Anomalous activities must be detected in a timely manner, in accordance with implementation guidance to determine the potential impact of the events on VA Information Systems and networks.

(b) Notify mission owners and network operators of the security posture of individual device or software objects to the aggregated systems of systems level.

(c) System security alerts, advisories, and directives from external organizations (e.g., US Computer Emergency Readiness Team (US-CERT)) must be received on an ongoing basis and generate internal security alerts, advisories, and directives as deemed necessary.

(d) Baseline configurations for systems and system components, including communications and connectivity-related aspects of systems will be established.

Baseline configurations of systems reflect the current enterprise architecture and are required for all software approved for use at VA.

(e) Systems will be monitored to detect attacks, indicators of potential attacks, and unauthorized local, network, and remote connections.

(f) VA will track and document cybersecurity and privacy incidents in accordance with VA policy.

(g) Incident handling capability for security and privacy incidents will be implemented and will include preparation, detection and analysis, impact determination, containment, eradication, and recovery.

(h) The rigor, intensity, scope, and results of incident handling activities will ensure comparable and predictable results across the VA Administrations and Staff Offices.

(i) Incident information and individual incident responses will be aggregated to achieve an organization-wide perspective on incident awareness and response.

(j) The VA’s incident response capability will issue an alert when system-generated indications of compromise or potential compromise occurs. Alerts may be generated from a variety of sources, including, for example, audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers.

(2) Continuous Security Monitoring

(a) Information and assets will be monitored at discrete intervals to identify cybersecurity and privacy events and verify the effectiveness of protective measures.

(b) A security and privacy continuous monitoring strategy must be developed. VA will implement a security and privacy continuous monitoring program, in accordance with FISMA and for cloud systems Federal Risk and Authorization Management Program (FedRAMP), that assesses security and privacy controls and associated risks at a frequency sufficient to support risk management decisions. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives VA the capability to make more effective and timely risk management decisions, including ongoing authorization decisions.

(c) A continuous data monitoring capability will be established and maintained as specified in NIST SP 800-137 that provides cohesive collection, transmission, storage, aggregation, information sharing and presentation of data that conveys current operational status to affected VA stakeholders and VA’s Federal and industry partners.

(d) Physical access to the facility where the system resides will be monitored to detect and respond to physical security incidents.

(e) Physical access authorizations will be enforced, and individual access authorizations verified before granting access to the facility to prevent unauthorized personnel from accessing VA facilities and systems.

(f) Personnel activity will be monitored to detect potential cybersecurity and privacy events.

(g) Insider threat controls will be implemented to detect and prevent malicious insider activity through the centralized integration and analysis of both technical and non-technical information to identify potential insider threat concerns in accordance with the VA Insider Threat Program.

(h) Malicious code protection mechanisms will be implemented at system entry and exit points to detect and eradicate malicious code, and automatically update malicious code protection mechanisms whenever new releases are available in accordance with guidance in the VA Information Security Knowledge Service.

(i) Acceptable and unacceptable mobile code and mobile code technologies must be defined. Usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies must be established. VA will also authorize, monitor, and control the use of mobile code within its systems.

(j) Providers of external system services will be required to comply with organizational security and privacy requirements. VA will monitor security and privacy control compliance by external service providers on an ongoing basis as is specified in VA Information Security Knowledge Service.

(k) Policy and procedures will be established to ensure that requirements for the protection of Controlled Unclassified Information (CUI) processed, stored, or transmitted on external systems are implemented in accordance with NIST SP

800-171.

(l) Through VA’s Technical Reference Model (TRM), VA’s Technical Reference Model, VA will continue to identify software programs authorized to execute on the system and employ an appropriate permission policy to maintain the capability for approved software.

(m) Network services that have not been authorized or approved must be detected.

(n) Automated mechanisms must be employed to detect the presence of unauthorized hardware, software, and firmware components within the system and take actions when unauthorized components are detected.

(o) VA will scan for vulnerabilities in the system and hosted applications as specified in the Information Security Knowledge Service, and when new vulnerabilities potentially affecting the system are identified and reported.

(3) Detection Processes

(a) Detection processes and procedures must be maintained and tested to ensure timely and adequate awareness of anomalous events.

http://trm.oit.va.gov/

(b) Personnel are required to report suspected security and privacy incidents to the organizational incident response capability.

(c) An incident response support resource, integral to the organizational incident response capability, which offers advice and assistance to users for the handling and reporting of security and privacy incidents must be provided.

(d) A process will be implemented to ensure that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems are developed, maintained, and continue to be executed in a timely manner.

d. Respond Function. The Respond Function supports the ability to contain the impact of a potential cybersecurity and privacy event and identifies the appropriate actions to take regarding the detected cybersecurity and privacy event. Outcome categories within the Respond Function include: Response Planning; Communications; Response and

Recovery Analysis; Mitigation; Improvements; and associated activities, as described below:

(1) Response Planning

(a) An incident response plan will be developed and implemented that provides the organization with a roadmap for implementing its incident response capability.

For incidents involving PII/PHI and PCI-DSS data, VA will include a process to determine whether notice to oversight organizations or affected individuals is appropriate and provide that notice accordingly.

(b) Response processes and procedures must be executed and maintained to ensure timely response to detected cybersecurity and privacy events.

(2) Communications

(a) VA response activities will be coordinated with internal and external stakeholders as appropriate, to include external support from law enforcement agencies.

(b) Responsibility for incident response in the Incident Response Plan will be explicitly designated.

(c) Personnel are required to report suspected security, privacy, and supply chain incidents.

(d) Internal stakeholders including, for example, mission/business owners, ISOs, AOs, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the Risk Executive

Function, will coordinate to effectively handle incidents.

(e) Personnel on the alert notification list will be contacted when an alert or notification is issued. Personnel on the alert notification list can include, for example, system administrators, mission or business owners, ISOs, ISSOs, or privacy officers.

(f) Incident information and individual incident responses must be correlated to achieve an organization-wide perspective on incident awareness and response.

(g) VA will coordinate with external organizations as defined in the Incident

Response Plan to correlate and share incident information to achieve a cross-organizational perspective on incident awareness and more effective incident responses.

(3) Response and Recovery Analysis

(a) Analysis to ensure adequate response and support recovery activities must be conducted.

(b) Automated tools and mechanisms must be employed to support near real-time analysis of alerts and notifications generated by VA Information Systems.

(c) Incident response capability will be tested for the system to determine the incident response effectiveness and document the results.

(d) The impact of an incident on VA’s mission and business practices must be determined.

(e) An integrated team of forensic and malicious code analysts, tool developers, and real-time operations personnel will be established to handle incidents and facilitate information sharing.

(f) VA will conduct forensic activities as defined in the VA Cybersecurity Incident

Response Plan.

(g) Classes of incidents and the actions to take in response to those classes of incidents to ensure continuation of organizational mission and business functions.

(4) Mitigation

(a) Activities to prevent expansion of an event, mitigate its effects, and eradicate the incident must be performed.

(b) VA will mitigate risk of a security or privacy incident to VA by strengthening existing controls or implementing new controls, accepting the risk with appropriate justification or rationale, sharing or transferring the risk, or rejecting the risk.

(c) VA will accept the risk of newly identified security or privacy incidents. If the risk response is to mitigate the risk and the mitigation cannot be completed immediately, a POA&M will be generated in the authorization boundary where the risk is identified.

(d) Lessons learned from ongoing incident handling activities will be incorporated into incident response procedures, training, and testing; changes will be implemented accordingly.

(5) Improvements

(a) Organizational response activities will be improved by incorporating lessons learned from current and previous detection/response activities.

(b) Qualitative and quantitative data from incident response testing and actual events must be used to determine the effectiveness of incident response processes, continuously improve incident response processes incorporating advanced information security practices and provide incident response measures and metrics that are accurate, consistent, and in a reproducible format.

(c) The Incident Response Plan must be updated to address system and organizational changes, or problems encountered during plan implementation, execution, or testing, and communicate Incident Response Plan changes to incident response personnel and organizations.

e. Recover Function. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity and privacy event. Outcome

Categories within the Recover Function include: Recovery Planning; Improvements; and Communications; and associated activities, as described below:

(1) Recovery Planning

(a) Necessary incident recovery plans will be defined and will be tested in accordance with Federal guidelines.

(b) Recovery processes and procedures will be executed and maintained to ensure timely restoration of systems or assets affected by cybersecurity and privacy events in accordance with disaster recovery plans.

(c) Contingency plans will be developed using guidance found in NIST SP 800-34 that identifies essential mission and business functions and associated contingency requirements, and provides recovery objectives, restoration priorities, and metrics. The contingency plans also address maintaining essential mission and business functions despite a system disruption, compromise, or failure, and the eventual full system restoration without deterioration of the security and privacy controls originally planned and implemented.

(2) Improvements

(a) Recovery planning and processes will be improved by incorporating lessons learned into future activities.

(b) Contingency plans will be updated to address changes to the organization, system, or environment of operation, and problems encountered during contingency plan implementation, execution, or testing, and communicate contingency plan changes to key contingency personnel and organizations.

(3) Communications

(a) Restoration activities will be coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacked systems, victims, other computer security incident response teams, and vendors.

(b) Communication with the public regarding cybersecurity and privacy incidents will be managed through the Office of Public and Intergovernmental Affairs (OPIA).

(c) VA reputation will be managed after an incident has been resolved through

OPIA.

(d) VA will share information internally on recovery activities among organizational stakeholders, including, for example, executive and management teams, mission/business owners, ISOs, AOs, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the Risk Executive Function.

3. RESPONSIBILITIES.

a. Secretary of Veterans Affairs. The Secretary ensures agency compliance with requirements under 38 U.S.C. § 5723 and 44 U.S.C. § 3554.

b. Inspector General of Veterans Affairs. The Inspector General shall

(1) Carry out the responsibilities under 38 U.S.C. § 5723 and 44 U.S.C. § 3554.

(2) Ensure that organizations adhere to OMB, NIST and Federal regulations.

(3) Direct auditors, investigators, inspectors, and support personnel.

(4) Investigate, audit, inspect and evaluate all VA Information Systems.

c. Assistant Secretary for Information and Technology, and Chief Information Officer (A/S OIT / CIO) shall:

(1) Carry out the responsibilities under 38 U.S.C. § 5723 and 44 U.S.C. § 3554.

(2) Charter and co-chair the RMF TAG governing body.

(3) Monitor, evaluate, and provide advice to the Secretary of VA regarding all VA cybersecurity and privacy activities, and oversee implementation of this directive.

(4) Appoint a VA Chief Information Security Officer (CISO) in accordance with 44 U.S.C.

§ 3554.

(5) Direct and work with the OIT Deputy Chief Information Officer (DCIO) for Quality, Performance and Risk (QPR) to ensure that risk management strategies and policies are aligned with overarching VA cybersecurity and privacy strategy and VA business environments.

(6) Direct and work with the OIT DCIO for IT Resource Management (ITRM) to develop cybersecurity and privacy workforce management policies and capabilities to support identification and qualifications for a professional cybersecurity and privacy workforce.

(7) Direct and work with the Office of Human Resources & Administration Office of

Operations, Security, and Preparedness (HR&A/OSP) to ensure that cybersecurity and privacy policies and capabilities are aligned with and mutually supportive of personnel, physical, industrial, information, and operations security policies and capabilities.

(8) Coordinate with the Office of Acquisition, Logistics, and Construction’s (OALC) Executive Director to ensure that cybersecurity and privacy responsibilities are integrated into processes for VA acquisition programs, including research and development.

(9) Direct and coordinate with the Associate Deputy Assistant Secretary (ADAS) for IT Operations and Services (ITOPS) and ADAS for Enterprise Program Management Office (EPMO) to ensure that cybersecurity and privacy responsibilities are integrated into the operational testing and evaluation for VA programs.

(10) Co-chair the DGC that coordinates across VA, facilitates or oversees data quality and management activities, and develops and implements guidelines for data modeling, quality, integrity, designates authoritative data sources and appoints common information data stewards to monitor the linkages, de-identification, and access needs across the information life cycle.

(11) Direct, coordinate, and advocate resources for VA-wide cybersecurity and privacy solutions, including overseeing appropriations allocated to the VA cybersecurity and privacy program.

(12) Direct and coordinate with VA Administrations and Staff Offices to ensure that cybersecurity and privacy responsibilities are addressed for all VA IT.

(13) Integrate cybersecurity and privacy threat information sharing activities internal and external to VA to enhance VA cyber situational awareness.

(14) Develop policy for negotiating, performing, and concluding agreements with partners to engage in cooperative cybersecurity and privacy activities.

(15) Develop and…