20 - IPS Requirement Document 1C CSP

[SYSTEM NAME] [ACRONYM]

System Security Plan [Date]

Identity Protection Services (IPS) IPS Requirements Document 1C in Support of SIN 520-20 dtd November 2017 (PSS Refresh #36)

Document Prepared By Company Representative Responsible for this Plan (Name, Position)

Company Name

Address Line 1

Address Line 2

City, State Zip

E-mail Address

Phone Number

Identity Protection Services (IPS) IPS 520-20 Requirements Document 1C dtd November 2017 (PSS Refresh #34)

Document Revision History

AttachmentsInstruction: Attachments may vary on a system-by-system basis. The following appendices are considered standard SSP attachments. They are not required as part of this submission, but may be required at the task order level.

Attachment 1: Privacy Impact Assessment Attachment 2: FIPS 199 Security Categorization Attachment 3: e-Authentication Assurance Level Attachment 4: Interconnection Security Agreement(s)/Memoranda of Understanding Attachment 5: Control Tailoring Workbook Attachment 6: Control Summary Table (based on FIPS 199 Categorization) Attachment 7: Contingency Plan Attachment 8: Contingency Plan Test Report Attachment 9: Incident Response Plan Attachment 10: Incident response Plan Test Report Attachment 11: Configuration Management Plan Attachment 12: Continuous Monitoring Plan (if applicable) Attachment 13: Rules of Behavior (if applicable) Attachment 14: Code Review Report (if applicable) Other Attachments, as necessary

Table of Contents

Tables and Figures

Page ix

Information System Name This System Security Plan (SSP) provides an overview of the security requirements for the [SYSTEM NAME] [ACRONYM] and describes the controls in place or planned for implementation to provide a level of security appropriate for the information to be transmitted, processed or stored by the system.

The security safeguards implemented for the [ACRONYM] meet the policy and control requirements as set forth in this SSP. All systems are subject to monitoring consistent with applicable laws, regulations, agency policies, procedures and practices.

Table 11. Information System Name and Identifier IT Investment Portfolio Summary ID:

Information System Categorization The overall information system security categorization is noted in the following table.

Note: A FIPS 199 Security Categorization document must be completed and submitted as an Attachment to this SSP.

Table 21. Overall Information System Categorization

Information Types The following tables identify the information types and impact levels that are input, stored, processed, and/or output from the [ACRONYM] environment. The security impact levels for confidentiality, integrity, and availability for each of the information types are expressed as low, moderate, or high. The security impact levels are based on the potential impact definitions for each of the security objectives (i.e., confidentiality, integrity, and availability) discussed in NIST SP 800-60 and FIPS Pub 199 (Note: The information types found in NIST SP 800-60, Volumes I and II, Revision 1 are the same information types found in the Federal Enterprise Architecture (FEA) Consolidated Reference Model).

Table 22. Information System Types

Potential Impacts of Security Objectives Based on the information provided above, the potential impacts for each security objective, per FIPS 199) for the [ACRONYM] environment is summarized in the table below.

Table 23. Security Objective Impacts

E-Authentication Determination (E-Auth) The information system e-Authentication determination is described in the following table.

Instruction: Any information system that has a “No” response to any one of the three questions does not need an E-Authentication risk analysis or assessment. For a system that has a "Yes" response to all of the questions, complete the E-Authentication Plan (a template is available).

Table 24. E-Authentication Determination

The summary E-Authentication Assurance Level is recorded in the following table.

Note: A e-Authentication Assurance Level document must be completed and submitted as an Attachment to this SSP.

Table 25. E-Authentication Assurance Level Summary E-Authentication Assurance Level

Information System Owner The following individual is identified as the System Owner/Program Manager for this system.

Name

Title

Organization

Address

Phone Number

Email Address

Authorizing Official The Authorizing Official (AO) for this information system is identified below.

Name

Title

Organization

Address

Phone Number

Email Address

Other Designated Contacts The individual(s) identified below possess in-depth knowledge of this system and/or its functions and operation.

Name

Title

Organization

Address

Phone Number

Email Address

Name

Title

Organization

Address

Phone Number

Email Address

Assignment of Security Responsibility The Information System Security Officer (ISSO) has been appointed and is identified below.

Name

Title

Organization

Address

Phone Number

Email Address

Information System Operational Status The system is currently in the life-cycle phase noted in the following table.

Table 71. System Operational Status System Status

Information System Type The [ACRONYM] is a [General Support System (GSS)/Major Application (MA)/Subsystem].

Systems Providing Controls to [ACRONYM] The systems identified in the following table provide controls (common or hybrid) to [ACRONYM]. List all systems providing controls, the controls they provide, and identify if it is provided as a Common or Hybrid control.

Table 81. Systems Providing Controls

Systems Receiving Controls from [ACRONYM] [ACRONYM] provides the controls (common or hybrid) listed to the systems identified in the following table. List any controls provided to any systems and identify if it is provided as a Common or Hybrid control.

Table 82. Systems Receiving Controls

General System Description (Provide a general description of the system, including its function and purpose).

Information System Locations Physically, the [ACRONYM] environment resides at the locations identified below.

Table 91. System Locations Primary Secondary

Secondary (if applicable) Secondary

Information System Components and Boundaries The components of the [ACRONYM] environment can be broken down into the following groups of asset types. The assets are also portrayed in the network diagram in Section 9.4.

The controls described in Section 13 of this document may apply to some or all of these asset types.

Table 92. System Assets

Types of Users Instruction: For an External User, please write “Not Applicable” in the Sensitivity Level Column. Please include systems administrators and database administrators as role types. (Also include web server administrators, network administrators, and firewall administrators if these individuals have the ability to configure a device or host.) Add additional rows if necessary.

All users have their employee status categorized with a sensitivity level in accordance with PS-2. Employees are considered Internal Users. All other users are considered External Users. User privileges (authorization permission after authentication takes place) are described in the table that follows.

Table 93. User Roles and Privileges

Note: User roles typically align with Active Directory, LDAP, Role-based Access Controls (RBAC), NIS and UNIX groups, and/or UNIX netgroups.

Network Architecture Instruction: In the space that follows, provide an architectural diagram which provides a visual depiction of the major hardware components of the information system.

The following architectural diagram provides a visual depiction of the major hardware components of the [ACRONYM].

Figure 91. Network Diagram System Environment Instruction: In the space that follows, provide a general description of the technical system environment. Include information about all system environments that are used, e.g., production environment, test environment, staging or QA environments

Asset Inventory The following table lists the virtual and physical components of the [ACRONYM].

Table 101. Asset Physical and Virtual Components

Software Inventory The following table lists the principle software components for [ACRONYM].

Table 102. Software Components

Data Flow Instruction: In this section describe the flow of data in and out of system boundaries and insert a data flow diagram. If necessary, include multiple data flow diagrams.

Figure 101. Data Flow Diagram Ports, Protocols and Services The table below lists the Ports, Protocols, and Services enabled in this information system. TCP ports are indicated with a T and UDP ports are indicated with a U.

Instruction: In the column labeled “Used By” please indicate the components of the information system that make use of the ports, protocols, and services. In the column labeled “Purpose” indicate the purpose for the service (e.g., system logging, HTTP redirector, load balancing). This table should be consistent with CM-6. Add more rows as needed.

Table 103. Ports, Protocols, and Services

System Interconnections Instruction: List data covering all interconnected systems in the two tables in this section. Add additional rows as needed.

· The first table is modeled after the System Interconnection table in NIST SP 800-18. It primarily covers the A&A status of connected systems where an ISA or MOU is required.

· The second table provides detailed information that is contained in an ISA or MOU. For systems where an ISA or MOU does not exist this data is vital to understanding the nature of the interconnection. For systems with an ISA or MOU this table provides a summary of information about the interconnection. Provide the IP address and interface identifier (ie0, ie1, ie2) for the system that provides the connection. Name the organization and the IP address of the external system. Indicate how the connection is being secured. For Connection Security indicate how the connection is being secured. For Data Direction, indicate which direction the packets are flowing. For Information Being Transmitted, describe what type of data is being transmitted. If a dedicated telecom line is used, indicate the circuit number.

Table 111. System Interconnections

(GSS, MA, Subsystem)

Table 112. Connection Details of Interconnected Systems

Note: Additional information regarding each connection may be found in its associated MOU.

Applicable Laws and Regulations

See Appendix B, References.

Minimum Security Controls Minimum security controls for the [ACRONYM] environment are contained in the following sections.

Note: In the control summary tables the Control Origination section has a selection for Hybrid Controls. Preparers of the SSP may add additional Hybrid Control selections if the system inherits portions of a control from more than one system.

Instruction: In the space that follows for the implementation, provide a description of how the control is implemented. The implementation statement should stand on its own and not be a “parroting” back of the NIST SP 800-53 Rev. 4 security requirements. Additionally, the response should speak to all platforms in use (e.g., web, database, Operating System types [Windows, Linux, etc.]), and network devices.

For all Control Summary Information, if any are considered planned, in the implementation response state when it will be implemented and the steps currently being performed to implement.

For Implementation Status noted as “Not Applicable” a statement must be provided in the implementation response stating why it is considered not applicable.

Access Control AC-1: Access Control Policy and Procedures The organization:

a. Develops, documents, and disseminates to [Information System Security Manager, Information System Security Officer, System Owners (e.g., System Program Managers, System Project Managers), Acquisitions/Contracting Officers, Custodians]:

1. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

2. Procedures to facilitate the implementation of the access control policy and associated access controls; and

b. Reviews and updates the current:

1. Access control policy [biennially]; and

2. Access control procedures [biennially].

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP) |_| System Specific Control

AC-1 Describe how the control is implemented.

Part a

Part b

AC-2: Account Management The organization:

a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [minimum - System Administrator, Network Administrator, Application Administrator, Database Administrator, Identifying account types. Standard and elevated privilege user accounts. (i.e., individual, group, system, application, guest/anonymous, and temporary)];

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e. Requires approvals by [System Owner and Organizational and government personnel with access control responsibilities of the authorization boundary] for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [SCAP Benchmark, NIST Security Configuration Checklist, DISA Security Technical Implementation Guides (STIGs) and/or NSA Guides]

g. Monitors the use of information system accounts;

h. Notifies account managers:

1. When accounts are no longer required;

2. When users are terminated or transferred; and

3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements [annually]; and

k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-2 Describe how the control is implemented.

Part a

Part b

Part c

Part d

Part e

Part f

Part g

Part h

Part i

Part j

Part k

AC-2 (1): Account Management | Automated System Account Management The organization employs automated mechanisms to support the management of information system accounts.

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-2 (1) Describe how the control is implemented.

AC-2 (2): Account Management | Removal of Temporary/Emergency Accounts The information system automatically [disables] temporary and emergency accounts after [no more than 90 days].

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-2 (2) Describe how the control is implemented.

AC-2 (3): Account Management | Disable Inactive Accounts The information system automatically disables inactive accounts after [90 Days for User Level Accounts, 35 days for non-user level accounts].

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-2 (3) Describe how the control is implemented.

AC-2 (4): Account Management | Automated Audit Actions The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Administrators (Application, System, Network, etc.), Information System Security Officer, Information System Security Manager, System Program Managers, and System Project Managers].

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-2 (4) What is the solutions and how is it implemented?

AC-3: Access Enforcement The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-3 Describe how the control is implemented.

AC-4: Information Flow Enforcement The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Web Service Security (WS Security), WS-Security Policy, WS Trust, WS Policy Framework, Security Assertion Markup Language (SAML), eXtensible Access Control Markup Language (XACML)].

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-4 Describe how the control is implemented.

AC-5: Separation of Duties

a. Separates [using the roles and responsibilities as a foundation, Data Owners can identify specific types of users that can be authorized to obtain access to each IT resource for functions such as these:

· General user activities (e.g., resource or file access)

· System development (e.g., programmers and database)

· Technical operations and system or network administration];

b. Documents separation of duties of individuals; and

c. Defines information system access authorizations to support separation of duties.

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-5 Describe how the control is implemented.

Part a

Part b

Part c

AC-6: Least Privilege The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Implementation Status:

|_| Implemented |_| Partially implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP)

AC-6 Describe how the control is implemented.

AC-6 (1): Least Privilege | Authorize Access to Security Functions The organization explicitly authorizes access to [Contractor recommendation to be approved and accepted by the AO].

Implementation Status:

|_| Implemented |_| Partially implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP) |_| System Specific Control

AC-6 (1) Describe how the control is implemented.

AC-6 (2): Least Privilege | Non-Privileged Access for Nonsecurity Functions The organization requires that users of information system accounts, or roles, with access to [all Security Functions (examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions)], use non-privileged accounts or roles, when accessing nonsecurity functions.

Implementation Status:

|_| Implemented |_| Partially implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP) |_| System Specific Control

AC-6 (2) Describe how the control is implemented.

AC-6 (5): Least Privilege | Privileged Accounts The organization restricts privileged accounts on the information system to [Employees who have resource administrative access (such as system administrators, database administrators, telecom administrators, developers, etc.)].

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP) |_| System Specific Control

AC-6 (5) Describe how the control is implemented.

AC-6 (9): Least Privilege | Auditing Use of Privileged Functions The information system audits the execution of privileged functions.

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP) |_| System Specific Control

AC-6 (9) Describe how the control is implemented.

AC-6 (10): Least Privilege | Prohibit Non-Privileged Users from Executing Privileged Functions The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP) |_| System Specific Control

AC-6 (10) Describe how the control is implemented.

AC-7: Unsuccessful Login Attempts The information system:

a. Enforces a limit of [not more than ten (10) failed access attempts] consecutive invalid logon attempts by a user during a [30 minute time period]; and

b. Automatically [locks the account/node for [30 minutes]; locks the account/node until released by an administrator; delays next logon prompt for [30 minutes]] when the maximum number of unsuccessful attempts is exceeded.

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP) |_| System Specific Control

AC-7 Describe how the control is implemented.

Part a

Part b

AC-8: System Use Notification

a. Displays to users [a warning banner/system use notification message] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:

1. Users are accessing a U.S. Government information system;

2. Information system usage may be monitored, recorded, and subject to audit;

3. Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and

4. Use of the information system indicates consent to monitoring and recording;

b. Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

c. For publicly accessible systems:

1. Displays system use information [when access via logon interfaces with human users], before granting further access;

2. Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

3. Includes a description of the authorized uses of the system.

Implementation Status:

|_| Implemented |_| Partially Implemented |_| Planned |_| Alternative implementation |_| Not applicable

Control Origination:

|_| Inherited from: [Enter System’s Name] |_| [Source System’s Name] Common Control |_| Hybrid Control (Shared Between [SYSTEM NAME] and [Source System’s Name]; see also [Source System’s Name] SSP) |_| System Specific Control

AC-8 Describe how the control is implemented.

Part a

Part b

Part c

AC-11: Session Lock

a. Prevents further access to the system by initiating a session lock after [15 minutes] of inactivity or upon receiving a request from a user; and

b.…