ATTACHMENT_05_ MIA _-_Questionnaire.xlsx
XLSX spreadsheet 18 KB Posted
- Attached to
- Family Case Management Services - Miami Federal contract opportunity
- Solicitation number
- HSCEDM-15-R-00011
- Issued by
- Immigration and Customs Enforcement
About this file
ATTACHMENT 05 - Security Controls Questionnaire
View the file
Other files for this federal contract opportunity
Show all 19
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| RFP: HSCEDM-15-R-00011 [MIA] |
| Vendor Name: |
| Security Control Requirements for Protection of SPII and PII |
| Control Name | Control Description | Control Implemented? (Yes or No) | Description of Implementation / Description of Compensating Controls (Describe how this control is implemented including automated solutions, processes, policies and procedures that are currently in place. If the Control is not implemented, describe controls [automated solution, processes, policies, procedures] that are implemented to compensate for the missing control.) |
| AC-3 Access Enforcement | Organizations can control access to PII through access control policies and access enforcement mechanisms (e.g., access control lists). This can be done in many ways. One example is implementing role-based access control and configuring it so that each user can access only the pieces of data necessary for the user‘s role. Another example is only permitting users to access PII through an application that tightly restricts their access to the PII, instead of permitting users to directly access the databases or files containing PII. Encrypting stored information is also an option for implementing access enforcement. OMB M-07-16 specifies that Federal agencies must ―encrypt, using only NIST certified cryptographic modules, all data on mobile computers/devices carrying agency data unless the data is determined not to be sensitive, in writing, by your Deputy Secretary or a senior-level individual he/she may designate in writing‖ | ||
| AC-5 Separation of Duties | Organizations can enforce separation of duties for duties involving access to PII. For example, the users of de-identified PII data would not also be in roles that permit them to access the information needed to re-identify the records. | ||
| AC-6 Least Privilege | Organizations can enforce the most restrictive set of rights/privileges or accesses needed by users (or processes acting on behalf of users) for the performance of specified tasks. Concerning PII, the organization can ensure that users who must access records containing PII only have access to the minimum amount of PII, along with only those privileges (e.g., read, write, execute) that are necessary to perform their job duties. | ||
| AC-17 Remote Access | Organizations can choose to prohibit or strictly limit remote access to PII. If remote access is permitted, the organization should ensure that the communications are encrypted. | ||
| AC-18 Wireless Access | Organizations can choose to prohibit or strictly limit access to PII through wireless networks. If wireless access is permitted, the organization should ensure that usage restrictions are identified in policy, configuration and connection requirements are implemented, and wireless authentication protocols used provide credential protection and mutual authentication. | ||
| AC-21 User-based Collaboration and Information Sharing | Organizations can provide automated mechanisms to assist users in determining whether access authorizations match access restrictions, such as contractually-based restrictions, for PII. | ||
| AC-19 Access Control for Mobile Devices | Organizations can choose to prohibit or strictly limit access to PII from portable and mobile devices, such as laptops, cell phones, and personal digital assistants (PDA), which are generally higher-risk than non-portable devices (e.g., desktop computers at the organization‘s facilities). Some organizations may choose to restrict remote access involving higher-impact instances of PII so that the information will not leave the organization‘s physical boundaries. If access is permitted, the organization can ensure that the devices are properly secured and regularly scan the devices to verify their security status (e.g., anti-malware software enabled and up-to-date, operating system fully patched). | ||
| AU-2 Auditable Events | Organizations can monitor events that affect the confidentiality of PII, such as unauthorized access to PII. | ||
| AU-6 Audit Review and Reporting | Organizations can regularly review and analyze information system audit records for indications of inappropriate or unusual activity affecting PII, investigate suspicious activity or suspected violations, report findings to appropriate officials, and take necessary actions. | ||
| CM-2 Baseline Configuration | Organizations can establish and maintain standard, stringent configuration settings for information components (e.g. operating systems, databases, other software) that limit the ports, protocols and services that may be used, remove unnecessary user/administrator accounts, and limit the privileges of users/administrators who can access the component. Baselines established for systems processing or storing PII can prohibit or limit access to the PII. | ||
| IA-2 Identification and Authentication (Organizational Users) | Users can be uniquely identified and authenticated before accessing PII. The strength requirement for the authentication mechanism depends on the impact level of the PII and the system as a whole. OMB M-07-16 specifies that Federal agencies must ―allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access,‖ and also must ―use a ‗time-out‘ function for remote access and mobile devices requiring user re-authentication after thirty minutes of inactivity.‖ | ||
| IR-4 Incident Handing | Organizations can limit the damage caused by intrusions and data spillage by establishing an incident handling capability that includes detection, analysis, containment, eradication and recovery activities. Effective incident handling capability includes coordination among organizational entities (internal and external) and prompt reporting of events and incidents. | ||
| MA-2 Controlled Maintenance | Organizations can restrict access to information system components and monitor all maintenance activities performed on site or remotely and whether the equipment is serviced on site or removed to another location. Approval of maintenance personnel, approval of media prior to removal, and sanitization of equipment to remove all information from associated media prior to removal from the site assists with prevention of malware and data leakage. | ||
| MP-2 Media Access | Organizations can restrict access to information system media containing PII, including digital media (e.g., CDs, USB flash drives, backup tapes) and non-digital media (e.g., paper, microfilm). This could also include portable and mobile devices with a storage capability. | ||
| MP-3 Media Marking | Organizations can label information system media and output containing PII to indicate how it should be distributed and handled. The organization could exempt specific types of media or output from labeling so long as it remains within a secure environment. Examples of labeling are cover sheets on printouts and paper labels on digital media. | ||
| MP-4 Media Storage | Organizations can securely store PII, both in paper and digital forms, until the media are destroyed or sanitized using approved equipment, techniques, and procedures. One example is the use of storage encryption technologies to protect PII stored on removable media. | ||
| MP-5 Media Transport | Organizations can protect digital and non-digital media and mobile devices containing PII that is transported outside the organization‘s controlled areas. Examples of protective safeguards are encrypting stored information and locking the media in a container. | ||
| MP-6 Media Sanitization | Organizations can sanitize digital and non-digital media containing PII before it is disposed or released for reuse. An example is degaussing a hard drive—applying a magnetic field to the drive to render it unusable. | ||
| PE-18 Location of Information System Components | Organization can position information system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access to the information and information system. Examples are locating servers inside of an access restricted (locked) room, and locating user workstations such that screens cannot be viewed from office walkways or aisles. | ||
| RA-5 Vulnerability Scanning | Organizations can conduct vulnerability scanning on host (e.g. server)and client (e.g. desktop/laptop) components to identify missing software patches; identify functions, ports, protocols, and services that should not be accessible to users or devices; and identify improperly configured or incorrectly operating information flow control mechanisms. Databases can be scanned for improper configuration settings and excessive user privileges. Applications can be scanned for software logic errors and security flaws. | ||
| SA-12 Supply Chain Protection | Organizations can protect against supply chain threats to Information systems (including system components that compose those systems) throughout the system development life cycle. Use of the acquisition/procurement processes to require supply chain entities to implement necessary security safeguards help to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. Examples of Supply Chain security safeguards include: (i) security controls for development systems, development facilities, and external connections to development systems; (ii) vetting development personnel; and (iii) use of tamper-evident packaging during shipping/warehousing. | ||
| SC-7 Boundary Protection | Organizations can monitor and control communications at the external boundary of the system and at key internal boundaries within the system to monitor inbound and outbound communications traffic, limit and number and type of communications interfaces that are permitted, route information system traffic through dedicated, managed interfaces (e.g. proxy servers), and prevent exfiltration of information across managed interfaces. Safeguards include use of managed interfaces (e..g.gateways, routers, firewalls, network-based malicious code analysis and virtualization systems, or encrypted tunnels) and use of physically or logically separated subnetworks (e.g. DMZs). | ||
| SC-8 Transmission Confidentiality and Integrity | Organizations can protect the confidentiality and integrity of transmitted PII. This is most often accomplished by encrypting the communications or by encrypting the information before it is transmitted and using digital signatures to ensure integrity of the data. | ||
| SC-28 Protection of Data at Rest | Organizations can protect the confidentiality of PII at rest, which refers to information stored on a secondary storage device, such as a hard drive or backup tape. This is usually accomplished by encrypting the stored information. | ||
| SI-2 Flaw Remediation | Organizations can reduce exposure to software-related vulnerabilities by installing security-relevant software and firmware updates within reasonable timeframes following the release of the updates. Security-relevant software updates include, for example, patches, service packs, hot fixes, and anti-virus signatures. | ||
| SI-3 Malicious Code Protection | Organizations can protect information systems against malicious code by implementing malicious code protection mechanisms (e.g. anti-virus, whitelisting) at information system entry and exit points, updating the malicious code protection mechanisms whenever new releases are available, and performing periodic scans of files or real-time scans of files from external sources as the files are downloaded, opened or executed. | ||
| SI-4 Information System Monitoring | Organizations can employ automated tools to monitor PII internally or at network boundaries for unusual or suspicious transfers or events. An example is the use of data loss prevention technologies. |
Sheet2
Sheet3
File details come from the government source that posted it. Updated .