The file's text, extracted by GovTribe without its formatting.
Table 1.0 System Security, Privacy, and Authentication Requirements and Internal Control Reviews Applicable to Service Organizations Performing Outsourced HUD Financial Management Functions
| Requirement |
| Reference |
| Deliverable |
| Frequency |
| Responsibility |
Internal Controls Assessment
| OMB Circular A-123, Management’s Responsibility for Internal Control |
| A-123 Self-Assessment |
| Annually |
| Service Organization Contractor Assists with Information, Documents, and Access to Facilities |
| Review of Business Process Controls |
| Statement on Standards for Attestation Engagements No. 16 (SSAE 16) Reporting on Controls at a Service Organization |
| SSAE 16, SOC 1, Type II independent audit |
| Annually |
| An Independent Auditor Hired by the Service Organization Contractor |
| Financial Management System Assessment |
| OMB Circular A-127, Financial Management Systems |
| A-127 Self-Assessment |
| Annually |
| Service Organization Contractor Assists with Information, Documents, and Access to Facilities |
| Security Assessment |
| Federal Security Standard: NIST Special Publication 800-53 Revision 1, HUD Handbook 2400.25 Information Technology Security Policy |
| Report on Selected Controls |
| Annually |
| Service Organization Contractor |
| System Security Plan |
| Federal Security Standard: NIST Special Publication 800-18 Revision 1, HUD Handbook 2400.25 Information Technology Security Policy |
| System Security Plan |
| Start Up, with Updates at Least Annually, and Whenever Security Processes and Procedures Change |
| Service Organization Contractor |
| System Test and Evaluation (ST&E) |
| Federal Security Standard: NIST Special Publications 800-37, 800-53, 800-53a |
HUD Handbook 2400.25, Information Technology Security Policy, and HUD C&A Methodology Guide.
Independent System Test and Evaluation (ST&E);
Security Controls Assessment Report (SCAR);
Start Up, and at Least Every Three Years Thereafter
An Independent Evaluator Hired by the Service Organization Contractor
| Remedial Plans to Address Deficiencies Identified in the ST&E |
| Federal Security Standard: NIST Special Publications 800-37, 800-53, 800-53a |
HUD Handbook 2400.25, Information Technology Security Policy, and HUD C&A Methodology Guide.
| Plan of Action and Milestones (POA&M) |
| Quarterly |
| Service Organization Contractor |
| Continuity of Operations |
| Federal Security Standard: NIST Special Publication 800-34, HUD Handbook 2400.25 Information Technology Security Policy |
| Contingency Plan; |
Contingency Plan Test
| Start Up, with Updates Annually |
| Service Organization Contractor |
| Security Self-Assessment |
| Federal Security Standard: NIST Special Publication 800-26, 800-53, 800-53a |
HUD Handbook 2400.25 Information Technology Security Policy
| Self-Assessment |
| Annually |
| Service Organization Contractor |
| Memorandums of Understanding and Interconnectivity Security Agreements |
| Federal Security Standard: NIST Special Publication 800-47, HUD Handbook 2400.25 Information Technology Security Policy |
| MOU or Equivalent |
| Start Up, and Whenever Interconnection Processes and Procedures Change |
| Service Organization Contractor Assists with Information and Documentation |
| Penetration Testing |
| Federal Security Standard: NIST Special Publications 800–41, 800-42, 800-44, HUD Handbook 2400.25 Information Technology Security Policy |
| Penetration Test Report |
| Annually |
| Service Organization Contractor |
| IT Security Training services |
| Federal Security Standard: NIST Special Publication 800 – 16, OMB Memorandums M06-15 and M06-16, HUD Handbook 2400.25 Information Technology Security Policies and the Federal Information Security Management Act (FISMA), Public Law 107-347. |
| Training |
| Annually |
| Service Organization Contractor |
| Privacy Act |
| Federal Privacy Standard: The Privacy Act of 1974 |
HUD Handbook 1325.01 REV-01, Privacy Act Handbook
| Records of Release of Information and Procedures for Correction and Data Quality Assurance |
| Continuous Operation |
| Service Organization Contractor |
| Privacy Act |
| Federal Privacy Standard: The Privacy Act of 1974 |
HUD Handbook 1325.01 REV-01, Privacy Act Handbook
| Technical and Procedural Protections |
| Continuous Operation |
| Service Organization Contractor |
| Privacy Act |
| Federal Privacy Standard: E-Government Act of 2002, OMB Memorandum 03-22, Privacy Impact Assessment Questionnaire ( See http://www.hud.gov/offices/cio/privacy/pia/pia.cfm |
| Privacy Impact Assessment (PIA) Questionnaire |
| Start Up, with Updates Annually |
| Service Organization Contractor |
| E-Authentication |
| Federal Authentication Standard: OMB Memorandum M-04-4, NIST Special Publication 800-30, HUD Handbook 2400.25 Information Technology Security Policy |
| Identity verification or authentication for public access |
| Continuous Operation |
| Service Organization Contractor |
| Memorandums of Understanding and Interconnectivity Security Agreements |
| Federal Security Standard: NIST Special Publication 800-47, HUD Handbook 2400.25 Information Technology Security Policy |
| MOU or Equivalent |
| Start Up, and Whenever Interconnection Processes and Procedures Change |
| Service Organization Contractor Assists with Information and Documentation |
| Configuration Controls |
| HUD Configuration Control Standard: HUD Handbook 2400.25 Ver-1, ADP/Information Security Program Handbook |
| Configuration Management Plan |
| Start Up, and Whenever Configuration Processes and Procedures Change |
| Service Organization Contractor |
Attachment 1
Table 2.0 System Security, Privacy, and Authentication Requirements and Internal Control Reviews Applicable to HUD Program Offices that Rely Upon Outsourced Financial Management Functions
| Requirement |
| Reference |
| Deliverable |
| Frequency |
| Responsibility |
Internal Controls Assessment
| OMB Circular A-123, Management’s Responsibility for Internal Control |
| A-123 Self-Assessment |
| Annually |
| HUD Program Office, with Assistance from Service Organization Contractor |
| Financial Management System Assessment |
| OMB Circular A-127, Financial Management Systems |
| A-127 Self-Assessment |
| Annually |
| HUD Program Office, with Assistance from Service Organization Contractor |
| Security Categorization |
| Federal Security Standard: NIST Special Publication 800-60, FIPS 199, HUD Handbook 2400.25 Information Technology Security Policy |
| Rating (High, Medium, Low) for Confidentiality, Integrity, and Availability |
| At System Start Up |
| HUD Program Office |
| Business Impact Assessment |
| Federal Security Standard: NIST Special Publication 800-34, HUD Handbook 2400.25 Information Technology Security Policy |
| Business Impact Assessment |
| Start Up, with Updates Annually |
| HUD Program Officer |
| Risk Assessment |
| Federal Security Standard: NIST Special Publication 800-30, HUD Handbook 2400.25 Information Technology Security Policy |
| Risk Assessment and Risk Management Plan |
| Start Up, with Updates Annually |
| HUD Program Office |
| Certification and Accreditation (C&A) |
| Federal Security Standards: NIST Special Publications 800-37, 800-53, 800-53a |
HUD Handbook 2400.25, Information Technology Security Policy, and HUD C&A Methodology Guide
| Memorandum by the Assistant Secretary Accepting the System for Operation |
| Start Up, and at Least Every Three Years Thereafter |
HUD Program Office
| Memorandums of Understanding and Interconnectivity Security Agreements |
| Federal Security Standard: NIST Special Publication 800-47, HUD Handbook 2400.25 Information Technology Security Policy |
| MOU or Equivalent |
| Start Up, and Whenever Interconnection Processes and Procedures Change |
| HUD Program Office, with Assistance from Service Organization Contractor |
| IT Security Training services |
| Federal Security Standard: NIST Special Publication 800 – 16, OMB Memorandums M06-15 and M06-16, HUD Handbook 2400.25 Information Technology Security Policies and the Federal Information Security Management Act (FISMA), Public Law 107-347. |
| Training |
| Annually |
| HUD Program Office |
| Privacy Act |
| Federal Privacy Standard: The Privacy Act of 1974 |
HUD Handbook 1325.01 REV-01, Privacy Act Handbook
| Notice of System of Record |
| Start Up, and Whenever the Use of Personally Identifiable Information Changes |
| HUD Program Office |
| E-Authentication |
| Federal Authentication Standard: OMB Memorandum M-04-4, NIST Special Publication 800-30, HUD Handbook 2400.25 Information Technology Security Policy |
| E-Authentication Risk Assessment Report |
| Start Up, and Annually |
| HUD Program Office |