J-13_DHS_Certification_and_Accreditation_Guide.pdf

Certification and Accreditation Guide

October 1, 2008

Version 5.0

Certification and Accreditation Guide i Department of Homeland Security

Document Change History

Version Date Description

1.0 1/30/2006 Internal draft

2.0 5/5/2006 First public release

3.0 7/31/2007 References to FY 2006 C&A Remediation Plan are deleted throughout.

Additional requirements for Chief Financial Officer (CFO)-designated systems are summarized (page 9)

Privacy section updated (Task 4)

POA&M guidance updated (Task 13)

Annual assessment screen shots are updated to include NIST SP 800-53 (pages 66 – 72).

4.0 10/1/2007 Accessibility Compliance Determination requirements added (new Task 5)

5.0 10/1/2008 Complete Revision. Contains a detailed set of processes and tasks for conducting C&A at the Departmental and Component levels.

Certification and Accreditation Guide ii Department of Homeland Security

Table of Contents

1. Introduction

1.1 Purpose

1.2 Background

1.3 Scope

1.4 Objectives

1.5 Audience

1.6 Assumptions and Constraints

1.7 DHS Security Organization

1.8 Certification and Accreditation Overview

1.8.1 DHS Enterprise Tools

1.8.2 Processes and Work Products

1.8.3 Roles & Responsibilities

1.9 C&A Document Repository

1.10 Governance of C&A Documents in the DHS SELC

2. System Identification Process

2.1 System Identification Purpose

2.2 System Identification Decision Making Factors

2.3 System Identification Input

2.4 System Identification Tasks

2.4.1 Define the System Boundary

2.4.2 Process an Inventory Change Request

2.5 System Identification Output

3. Security Characterization Process

3.1 Purpose

3.2 Decision Making Factors

3.3 System Security Characterization Tasks

3.4 FIPS 199 Categorization

3.4.1 FIPS 199 Categorization Input

3.4.2 FIPS 199 Categorization Subtasks

Certification and Accreditation Guide iii Department of Homeland Security

3.4.3 FIPS 199 Categorization Output

3.5 Privacy Threshold Analysis

3.5.1 PTA Input

3.5.2 PTA Subtasks

3.5.3 PTA Output

3.6 E-Authentication Level Determination

3.6.1 E-Authentication Input

3.6.2 E-Authentication Subtasks

3.6.3 E-Authentication Level Determination Output

3.7 CFO Designated Financial Systems Determination

3.7.1 CFO Designated Financial System Input

3.7.2 CFO Designated Financial System Subtasks

3.7.3 CFO Designated Financial Systems Output

3.8 DHS/NIST SP 800-37 Questionnaire in RMS

3.8.1 Questionnaire Input

3.8.2 Questionnaire Subtasks

3.8.3 Questionnaire Output

4. System Security Planning Process

4.1 System Security Planning Purpose

4.2 System Security Planning Decision Making Factors

4.3 Security Planning Input

4.4 System Security Planning Tasks

4.4.1 SSP Template

4.4.2 Security Controls Description

4.4.3 Rules of Behavior

4.4.4 Interconnection Security Agreements

4.5 Security Planning Output

5. Risk Assessment Process

5.1 Risk Assessment Purpose

5.2 Risk Assessment Decision Making Factors

5.3 Risk Assessment Input

5.4 Risk Assessment Tasks

5.4.1 Prepare for Risk Assessment

Certification and Accreditation Guide iv Department of Homeland Security

5.4.2 Threat Identification

5.4.3 Vulnerability Identification

5.4.4 Determine Susceptibility

5.4.5 Risk Definition

5.4.6 Security Control Analysis

5.4.7 Likelihood Determination

5.4.8 Impact Analysis

5.4.9 Risk Level Determination

5.4.10 Security Control Recommendations

5.4.11 Document the Risk Assessment

5.5 Risk Assessment Output

5.6 CFO Designated Financial Systems

6. Contingency Planning Process

6.1 Contingency Plan Purpose

6.2 Contingency Plan Decision Making Factors

6.3 Contingency Plan Input

6.4 Contingency Plan Tasks

6.5 Contingency Plan Output

7. Contingency Plan Testing Process

7.1 Contingency Plan Testing Purpose

7.2 Contingency Plan Test Decision Making Factors

7.3 Contingency Plan Testing Input

7.4 Contingency Plan Testing Tasks

7.4.1 Determine Test Exercise Type

7.4.2 Develop Contingency Plan Test Procedures

7.4.3 Arrange Test Resources

7.4.4 Training

7.4.5 Schedule CPT

7.4.6 Execute CPT

7.4.7 Test Reporting

7.5 Contingency Plan Testing Output

8. Security Test & Evaluation Planning Process

8.1 ST&E Planning Purpose

Certification and Accreditation Guide v Department of Homeland Security

8.2 ST&E Planning Decision Making Factors

8.3 ST&E Planning Process Input

8.4 ST&E Planning Tasks

8.5 ST&E Planning Output

9. ST&E Execution Process

9.1 ST&E Execution Purpose

9.2 ST&E Execution Decision Making Factors

9.3 ST&E Execution Input

9.4 ST&E Execution Tasks

9.5 ST&E Execution Output

9.6 CFO Designated Financial Systems

10. Security Assessment Process

10.1 Purpose

10.2 Decision Making Factors

10.3 Input

10.4 Tasks

10.4.1 Create the Security Assessment Report

10.5 Output

11. Certification Documentation Process

11.1 Certification Documentation Purpose

11.2 Certification Documentation Decision Making Factors

11.3 Certification Documentation Input

11.4 Certification Documentation Tasks

11.5 Certification Documentation Output

11.6 Certification Requirements for CFO Designated Financial Systems

12. Accreditation Process

12.1 Accreditation Purpose

12.2 Accreditation Decision Making Factors

12.3 Input

12.4 Accreditation Tasks

12.4.1 Final Risk Determination and Risk Acceptability

12.4.2 Accreditation Package Transmission

12.4.3 C&A Document Updates

Certification and Accreditation Guide vi Department of Homeland Security

12.5 Accreditation Output

12.6 CFO Designated Financial Systems

13. Continuous Monitoring and Annual Assessment Process

13.1 Purpose

13.2 Decision Making Factors

13.3 Input

13.4 Tasks

13.4.1 Conduct Annual Assessment

13.4.2 Annual ISA Review

13.4.3 Document System Changes

13.4.4 Operating System and Network Patch Management

13.4.5 Security Impact Analysis

13.4.6 Security Control Selection

13.4.7 Security Reporting and Documentation

13.5 Output

Appendix A. Information Assurance Compliance System

A.1 TrustedAgent FISMA

A.1.1 TAF Content

A.1.2 Accessing TAF

A.2 Risk Management System

A.2.1 C&A Package

A.2.2 Accessing RMS

A.3 DHS Compliance Help Desk

A.4 Getting TAF and RMS Accounts

Appendix B. Certification and Accreditation Document Quality Reviews

B.1 Component CISO C&A Package Approval

B.2 OIS Document Review Team

B.3 OIS POA&M Review Team

B.4 OIS Deep Dive C&A Reviews

B.5 DHS Privacy Office

Appendix C. List of Attachments

Acronyms

Glossary

Certification and Accreditation Guide vii Department of Homeland Security

References

List of Figures

Figure 1. DHS Office of Information Security Organization

Figure 2. DHS C&A Methodology Process Flow

Figure 3. Major Roles in the C&A Process

Figure 4. TrustedAgent FISMA: C&A Tab

Figure 5. DHS Inventory Change Form

Figure 6. Impact of FIPS 199 Security Categorization Level

Figure 7. Blank (Sample) C&A Package

Figure 8. Sample of Completed C&A Package

Figure 9. The NIST Risk Management Framework

Figure 10. Relationship of ST&E Results and Annual Assessments

Figure 11. IA Compliance System Policy Implementation

Figure 12. System View

Figure 13. DHS C&A Quality Review Process

List of Tables

Table 1. Summary of C&A Processes and Work Products

Table 2. Roles and Responsibilities for Major C&A Documents

Table 3. Roles and Responsibilities for Other C&A Activities

Table 4. Security in the DHS SELC

Table 5. System Identification Input

Table 6. Input for the FIPS 199 Categorization Task

Table 7. Input for the PTA Task

Table 8. Input for E-Authentication Task

Table 9. Input for the DHS/NIST 800-37 Questionnaire Task

Table 10. SRTM Field Definitions

Table 11. Security Planning Process Input

Table 12. Security Control Description Examples

Certification and Accreditation Guide viii Department of Homeland Security

Table 13. Risk Assessment Process Input

Table 14. Threat Source Examples

Table 15. Contingency Plan Process Input

Table 16. Contingency Plan Testing Process Input

Table 17. ST&E Planning Process Input

Table 18. ST&E Execution Process Input

Table 19. ST&E Results Documentation

Table 20. Security Assessment Process Input

Table 21. Certification Documentation Process Input

Table 22. Accreditation Package Process Input

Table 23. Input for the Continuous Monitoring Process

Table 24. TrustedAgent FISMA Tab Descriptions

1. Introduction

Under the authority of the Department of Homeland Security (DHS) Chief Information Officer

(CIO), the Chief Information Security Officer (CISO) bears the primary responsibility to ensure compliance with Federal Information Security Management Act (FISMA), National Institute of

Standards and Technology (NIST), Office of Management and Budget (OMB), and all applicable laws, directives, policies, and directed actions on a continuing basis. The organizational mechanism through which the CISO addresses this obligation is called Certification and

Accreditation (C&A). This document sets forth the overall methodology for C&A of information systems operated within the Department.

1.1 Purpose

The intention of this DHS Certification and Accreditation Guide is to provide a set of enterprise processes used by the Department and its Components to certify and accredit information systems. Understanding these processes is critical to effective estimation and measurement of risk associated with department information systems, and so the Designated Accrediting

Authority (DAA) can fully understand the risk to the enterprise prior to giving formal acceptance by granting an Authorization to Operate (ATO).

1.2 Background

Accurate, reliable, and trustworthy information contributes to every aspect of, and is fundamental to, meeting the strategic objectives of the Department. The successful performance of every DHS member‟s assignment depends upon the availability, correctness, and completeness of information and upon the information system providing that information when and where it is needed. Much of the information essential to the DHS mission also requires confidentiality and privacy protection.

Because of its extended geographic reach, and the large scope of departmental mission areas, DHS assigns the responsibility for assuring the implementation of Information Security and

Privacy policies to the program officials who are directly involved with risk acceptance and mitigation decisions. DHS Headquarters and each Component have appointed a CISO to ensure that information security requirements are properly implemented, managed, and enforced and that Departmental and DHS Component information security programs are mutually supporting.

Additionally, CISOs work in coordination with Departmental and Component Privacy Officials to leverage available information security mechanisms to support the accomplishment of privacy goals.

Departmental and Component CISOs and System Owners appoint an Information System

Security Officer (ISSO) for each system for which the CISO is responsible. Many ISSOs do not report directly to a security organization or to the CISO and their ISSO role may be peripheral to their primary duties. Nevertheless, DHS geographic reach and breadth of mission needs a synergistic environment to operate an effective DHS Information Security Program. The ISSO works in conjunction with the System Owner to ensure that DHS and Component security controls are in place and operating as intended for their respective information systems.

Certification and Accreditation Guide 2 Department of Homeland Security

Responsibility for information security across DHS is broadly shared within the security community. The ISSO is a security focal point that provides the links among owners, users, and stakeholders of a particular system. The ISSO proactively supports the correct, complete, and continuous implementation of DHS Security and Privacy policies applicable to Departmental and

Component Information Technology (IT) resources and information. The ISSO serves as a liaison and coordinator, with system users and administrators, and numerous stakeholders and supporting personnel. The mission-space of the ISSO is complex and continuously demanding.

To support the continuing success of the DHS Information Security Program, successful ISSOs will be constantly involved in directing and managing their system security policy compliance efforts over the complete system life cycle.

1.3 Scope

This DHS C&A Guide explains the processes and relationships among the major steps in the

DHS C&A methodology from capturing the initial system concepts to a culminating milestone in achieving formal ATO. The various activities along the way include system identification and security characterization, risk assessment, security planning, security control evaluation, and contingency planning. This guide gives the ISSO helpful instructions for producing the various work products required by those activities. Although Continuous Monitoring is an important aspect of C&A, it is only briefly described in this guide. More detailed and practical guidance for conducting Continuous Monitoring is found in the DHS ISSO Guide.

The steady-state maintenance of accredited status is managed by the ISSO.

This guide is not intended to be procedural in nature, but rather a process-based method for performing C&A activities across DHS and its Components. However, process definitions are meant to be at a sufficiently low level to assure uniform execution of the various C&A tasks across the Components. This guide draws extensively from existing best practices contained in

NIST Special Publication (SP) 800-37, and is intended to serve as a practical adjunct to the DHS

Sensitive Systems Policy Directive 4300A and DHS 4300A Sensitive Systems Handbook.

Furthermore, Components may institute and require additional C&A processes that must be followed to address Component-specific security requirements.

1.4 Objectives

The objectives for this guide are to:

Define the elemental processes comprising C&A.

Illustrate the relationships between those processes and other DHS enterprise information resource management functions.

Give the ISSO helpful instruction for producing the work products required for successful

C&A completion.

Provide specific guidelines to help improve consistency of quality across the Components and contractors.

Advance the level of sophistication in the DHS C&A methodology by including enhancements garnered through continuous improvement.

1 The DHS ISSO Guide will be published in the first quarter of Fiscal Year 2009.

Certification and Accreditation Guide 3 Department of Homeland Security

1.5 Audience

This guide is intended to be read by anyone with a need to understand the C&A process at DHS.

The primary audience is the set of managers who have specific C&A duties and support roles detailed in DHS 4300A. Primary audience members include:

Component CISO

DAA

Certifying Official (CO)

ISSO

System Owner

The secondary audience is comprised of DHS staff and others who support the efforts of the primary audience in the C&A of DHS systems such as certification agents, and/or certification teams contracted to conduct security testing. In addition, the secondary audience includes those parties responsible for activities within the DHS Systems Engineering Life Cycle (SELC).

1.6 Assumptions and Constraints

Assumptions

The reader is assumed to have at least a basic level of knowledge in the subject areas of information technology and information security.

Constraints

This guide pertains only to Sensitive But Unclassified (SBU) systems and does not address the special needs for certifying National Security Systems (NSS).

This guide does not address the C&A requirements for pilot or developmental information systems.

Tools are referenced in specific (rather than generic) terms throughout this guide, so as to prevent confusion about which tools are to be used for practical completion of C&A processing.

Individual DHS Components will be referred to only when such clarity is required.

1.7 DHS Security Organization

Responsibilities for management of DHS Information Security policy are assigned to staff reporting to the CISO. The assignments of distributed responsibility are shown in Figure 1.

Certification and Accreditation Guide 4 Department of Homeland Security

Chief Information

Security Officer

Compliance and

Oversight Program

Management Architecture and

Policy

Measurement/Analysis

Quality Assurance

Reporting and Monitoring

Security Architecture

Security Policy

Security Operations

Enterprise Services

IT Acquisition Reviews

Enterprise Architecture Reviews

Budgeting

Administration

Security Awareness

Security Conference

Program

Management

Figure 1. DHS Office of Information Security Organization

1.8 Certification and Accreditation Overview

The DHS C&A Guide includes these distinct processes:

System Identification

System Security Characterization

System Security Planning

Risk Assessment

Contingency Planning

Contingency Plan Testing

Security Test and Evaluation (ST&E) Planning

ST&E Execution

Security Assessment

Certification Documentation

Accreditation

Figure 2 illustrates the flow of the DHS C&A processes.

Certification and Accreditation Guide 5 Department of Homeland Security

Figure 2. DHS C&A Methodology Process Flow

1.8.1 DHS Enterprise Tools

DHS mandates the use of its enterprise tools to develop and manage C&A documents (Section

3.9.1.l, DHS Sensitive Systems Policy Directive 4300A). These tools are TrustedAgent FISMA

(TAF) and Risk Management System (RMS).

At a minimum, the Security Requirements Traceability Matrix (SRTM) must be generated using

RMS and the RMS templates must be used for producing the C&A documents. TAF is used to track C&A documents for FISMA reporting and monthly scorecards developed by the CISO.

Appendix A provides additional information about TAF and RMS.

It is intended that RMS be used for creating, updating, and managing C&A documents. In some cases, it may not be feasible to access the enterprise RMS tool and therefore manual download and subsequent upload of C&A documents may be necessary. However, this manual method is highly discouraged, as it reduces the ability of DHS to accurately reflect departmental adherence to FISMA across the enterprise.

1.8.2 Processes and Work Products

Table 1 provides a summary of the DHS C&A processes and work products.

Table 1. Summary of C&A Processes and Work Products

Process Work Products

System Identification Certification boundary diagram

System designation as a General Support System (GSS) or Major Application (MA)

Unique System Number in the DHS IT System Inventory

List of interconnecting systems

List of subsystems and minor applications

Certification and Accreditation Guide 6 Department of Homeland Security

Process Work Products

System Security Characterization Determination of the Impact level (high, moderate, low) for the confidentiality, integrity, and availability security objectives for information systems and FIPS 199 Workbook

Determination by Privacy Officer whether the system is a Privacy Sensitive System and PTA

E-Authentication level determination and Workbook

Determination by the Chief Financial Officer (CFO) whether a system is a CFO Designated Financial System

DHS/NIST SP 800-37 Questionnaire in RMS

SRTM

System Security Planning Updated SRTM

System Security Plan (SSP)

Rules of Behavior (ROB)

User Access Request Forms & Procedures

Signed Interconnection Agreements, Memoranda of Understanding (MOU), Memoranda of Agreement (MOA)

Privacy Impact Assessment (PIA), if required

Risk Assessment Risk Assessment (RA)

Contingency Planning System Contingency Plan (CP)

CP Checklist

Plan of Action and Milestones (POA&M) updated for CP weaknesses

Contingency Plan Testing Contingency Plan Test (CPT) Results

Security Test and Evaluation Planning

ST&E Plan

Security Test and Evaluation Execution

ST&E Results

Security Assessment Security Assessment Report (SAR)

Certification Documentation Accreditation Package, including

SSP

SAR

POA&M

Accreditation Decision Letter – DRAFT

Accreditation Accreditation Decision Letter (ATO Letter)

1.8.3 Roles & Responsibilities

Figure 3 illustrates the major roles in the conduct of C&A.

FIGURE UNDER DEVELOPMENT

Figure 3. Major Roles in the C&A Process

These staff members (with potential contractor assistance as certification agents/certification teams) produce the primary C&A documents:

Certification and Accreditation Guide 7 Department of Homeland Security

Risk Assessment (RA)

System Security Plan (SSP)

ST&E Plan

Security Assessment Report (SAR)

Contingency Plan (CP)

Contingency Plan Test (CPT) Results

Plan of Action and Milestones (POA&M)

Accreditation Decision Letter

These staff Create (C), Review (R), Update (U), Approve (A), and/or Approve and Sign (A/S) the documents as illustrated in Table 2.

Table 2. Roles and Responsibilities for Major C&A Documents

ROLE RA SSP

ST&E

Plan

SAR CP

CPT

Results

POA&M*

ATO

Letter

DAA R A/S R R R R R A/S

Component CFO (financial systems only)

R R R R R R R A/S

Component CISO R A/S R R R R R R

ISSO C/U C/U C/U C/U C C C

System Owner R A/S A A A A R R

CO R R A A A A R C/U

Legend: C = Create

R = Review U = Update A = Approve A/S = Approve and Sign

*Component CISO may be required to approve some POA&M items as required by the current Information Security Performance Plan.

In addition to the major C&A documents, there are other tasks needed to complete the DHS

C&A process. The roles and responsibilities for other tasks in the DHS C&A Guide are summarized in Table 3.

Table 3. Roles and Responsibilities for Other C&A Activities

Role System

Boundary

FIPS

E-auth

CFO

System

PTA PIA SORN

DAA R A R R R R R

Inventory Team A

Component CISO R A R A R R R

Component CFO A/S

Privacy Office A A/S A/S C

Component Privacy Officer

R/U R/U R

ISSO C C C C C C R

Certification and Accreditation Guide 8 Department of Homeland Security

Role System

Boundary

FIPS

E-auth

CFO

System

PTA PIA SORN

System Owner A A A R R R R

CO R R R R R

Legend: C = Create

R = Review U = Update A = Approve A/S = Approve and Sign

1.9 C&A Document Repository

Upon completion and approval by the System Owner, CO, and DAA, as appropriate, the ISSO uploads all C&A documents to the C&A Tab in TAF. Figure 4 contains screen shots of the C&A

Tab and the locations where C&A documents are to be uploaded.

In Figure 4, the blue boxes represent security documents related to the DHS C&A process and the green boxes represent documents under the purview of the DHS Privacy Officer.

C&A documents can be uploaded at any time. However, the Office of Information Security

(OIS) Review Team (described in Appendix B) will only review complete C&A packages. The

OIS Document Review Team will begin reviewing C&A security documents when the:

Last C&A Date is updated in the TAF C&A Tab

Component CISO approves all C&A documents in the TAF C&A Tab

Next C&A Date is changed to equal the Current C&A Expiration in the System

Development Life Cycle (SDLC) Status box in the TAF Identification Tab.

Certification and Accreditation Guide 9 Department of Homeland Security

ATO

Letter

Risk

Assessment

CP

CPT

SSP

ST&E

Plan

SAR

PIA

PTA

SORN

FIPS 199

ISSO

Letter

SRTM

E-Auth

Figure 4. TrustedAgent FISMA: C&A Tab

1.10 Governance of C&A Documents in the DHS SELC

Ideally, the C&A documents are produced in the early stages of the DHS SELC. However, if the

C&A documents are not initiated early in the SELC, it is likely that the documents will be more costly to produce. Table 4 shows where and when C&A documents should be created, updated, and finalized throughout the DHS SELC.

Certification and Accreditation Guide 10 Department of Homeland Security

Table 4. Security in the DHS SELC

SELC Artifact Governing Authority

P la n n in g

R e q u ir e m e n ts

D fi n it io s ig v e lo p m e t

In te g ra ti o

T e s

Im p le m e n ta ti o

O p e ra ti o s

M a in te n a n c is p o s it io

Privacy Threshold Analysis

(PTA)

DHS Privacy Office

C/F

SRTM DHS CISO

C U F

POA&M DHS CISO

C U

U F

SSP DHS CISO

C U U U F

CP DHS CISO

F

RA DHS CISO

ST&E Plan DHS CISO

C

Interconnection Security Agreement (ISA)

DHS CISO C/F

SAR DHS CISO C/F

Accreditation Package DHS CISO C/F

Accreditation Decision Letter

DHS CISO C/F

C&A Updates (every three years or when major change is made)

DHS CISO U U

Legend: C = Create

U = Update F = Finalize

Certification and Accreditation Guide 11 Department of Homeland Security

2. System Identification Process

System Identification is the first process of the DHS C&A Guide. It establishes a well defined information system boundary and an understanding of the mission and/or business functions of the information system. DHS implements a centralized system inventory process to facilitate consistent and repeatable interpretation of federal guidance related to system boundary definition and system identification. The DHS inventory process is managed by the DHS Inventory

Management Team under the direction of the CISO.

Each DHS organization has an official system inventory that is maintained in TAF. In order to add a system to a Component‟s official inventory, the Inventory Change Management process is implemented. The System Identification Process should occur in the early stages of the system life cycle. However, its completion is mandatory for systems in the Development stage of the system life cycle.

2.1 System Identification Purpose

The purpose of the System Identification Process is to focus security engineering and the C&A process on a specific set of information system assets to ensure that the principles of the DHS

Information Security Program are achieved. These principles are:

Account for all information system assets as part of a General Support System (GSS) or

Major Application (MA).

Account for all interconnections to an information system.

Ensure that all DHS systems are certified and accredited and that a DAA weighs mission requirements against operational risk.

Document life-cycle system security in the SSP and assign responsibility for active management of the SSP to the system‟s ISSO:

– The System Owner must be identified and named.

– An ISSO must be named for every system.

– An ISSO may be a Government employee or contractor.

– An ISSO must report directly to a System Owner and indirectly to a Component

CISO.

– For DHS CFO Designated Financial Systems, ISSO duties shall be assigned to a dedicated ISSO, and no other significant collateral duties shall be assigned to them.

All DHS systems must be associated with a specific IT investment or funding source.

2.2 System Identification Decision Making Factors

Accreditation boundaries that are unnecessarily expansive (i.e., including too many hardware, software, and firmware components) make the security C&A process unwieldy and complex.

Boundaries that are unnecessarily limited (i.e., including too few hardware, software, and firmware components) increase the number of C&As that must be conducted and thus drive up the total cost of security for the Component.

Certification and Accreditation Guide 12 Department of Homeland Security

2.3 System Identification Input

System identification depends on many sources of information as shown in Table 5. Titles of formal documentation are italicized.

Table 5. System Identification Input

Input Source

System Name and Title System design documents

System Description System design documents

Organization Responsible for the System System design documents

Organization providing Funding for the System System design documents

System Points of Contact (e.g., System Owner, ISSO) System design documents

High Level System Design Information System design documents

System Network Diagrams System design documents

Definition of System Users and Administrators (location, access types, clearances)

System design documents

Operational Status of the System System design documents

Hardware/Software List System design documents

OMB 300/53 Unique Project Identifier Code (if applicable)

System design documents

DHS Investment Name (if applicable) System design documents

System Interconnections System design documents

DHS FISMA Inventory Methodology DHSOnline/Components/Management/CIO/CISO

FISMA.inventory@dhs.gov

Inventory Change Request Form FISMA.inventory@dhs.gov

2.4 System Identification Tasks

Identifying system boundaries in an accurate and consistent manner is critical to the integrity of the DHS C&A process. DHS considers a system to be a composite of people, procedures, materials, tools, equipment, hardware, and software operating in a specific environment to achieve a specific mission requirement. The ultimate objective is to group system elements in a consistent manner throughout the Department, while enhancing security, facilitating risk management, and taking into account mission, budgetary and business requirements.

An information system can be defined by its support of Departmental or Component mission objectives, interfaces, networks, security categorization, functional requirements, and operating environment. The system may be simple, very complex with many subsystems, or reside in several locations with similar operating environments. Defining a system boundary should be a

Component-level activity including careful negotiation among all key participants, taking into account the mission/business requirements of the agency, technical considerations with respect to information security, and the programmatic costs to the agency.

The System Identification Process consists of the tasks described below.

Certification and Accreditation Guide 13 Department of Homeland Security

2.4.1 Define the System Boundary

The Inventory Management Team publishes and maintains a methodology document, DHS

FISMA Inventory Methodology which is located on the DHS CISO web site. The methodology outlines the guidelines for identifying systems and system boundaries along with several case studies. The System Owner, CISO, and ISSO work with the DHS Inventory team to define the system boundary. The following characteristics are used to determine the system boundary.

The assets comprising the system:

1. are under the same direct management control;

2. support the same mission function, including the sites at which the assets are deployed;

3. have a common set of operational characteristics and security needs;

4. reside in a common operating environment.

In situations where it is difficult to determine whether system elements have the same management control and function/mission objective, budgetary control will be the deciding factor in determining accreditation boundaries. For an elaboration of this brief summary, refer to the DHS FISMA Inventory Methodology.

2.4.2 Process an Inventory Change Request

The second task is to complete an Inventory Change Request Form, which is found in the DHS

FISMA Inventory Methodology. A copy of the DHS Inventory Change Request Form is provided in Figure 5.

Submission of an Inventory Change Request is an important part of the System Identification

Process and the DHS C&A methodology. If the system is not part of the official inventory, unknown risks to the confidentiality, integrity, and availability of DHS information cannot be managed by the system owner and the Component CISO.

NOTE: An Inventory Change Request Form should be submitted whenever there is a change in the system’s SELC status. However, it is crucial to submit a Change Request

Form when the system goes into Operational status (See Table 4).

2.5 System Identification Output

The following are output from the System Identification process:

Accreditation boundary diagram

System designation as a GSS or MA

List of interconnecting systems

List of subsystems and minor applications

A unique System Number in TAF

The System Number also identifies the Component and the system type (Major Application, General Support System, Type Accredited System, Minor Application, and Subsystem). The

System Number includes a System ID, a unique, five digit number which is assigned to a system when it is added to the inventory. The five digit number is never reused, that is, when a system is placed in disposal, the System ID number is retired.

Certification and Accreditation Guide 14 Department of Homeland Security

Certification and Accreditation Guide 15 Department of Homeland Security

Certification and Accreditation Guide 16 Department of Homeland Security

Figure 5. DHS Inventory Change Form

Certification and Accreditation Guide 17 Department of Homeland Security

3. Security Characterization Process

The second process in the DHS C&A methodology is to conduct a thorough analysis of the system mission and the types of information processed, stored, and transmitted by the information system,

3.1 Purpose

The purpose of this process is to characterize the type of information that will be processed, stored, and transmitted by the information system so that the appropriate security controls to be selected, tested, and implemented are identified.

3.2 Decision Making Factors

The categorization steps described in the DHS Sensitive Policy Directive 4300A should be followed. Errors in the initial categorization process can result in either an over-specification or under-specification of the security controls. Over-specification of security controls means that the organization is expending more effort and resources on information security than is actually necessary and potentially taking resources away from other mission/business areas with greater protection needs. Under-specification of security controls means that selected mission/business processes may be at greater risk due to potentially insufficient protection measures allocated for the information systems supporting those processes.

Figure 6 illustrates the impact of the

Federal Information Processing Standards (FIPS) 199 Categorization on the number of NIST SP

800-53 controls and enhancements that need to included in the SSP.

Low Moderate High

N u m b e r o f

C o n tr o ls

/E n h a n c e m e n ts

Enhancements

Controls

Figure 6. Impact of FIPS 199 Security Categorization Level

Ideally, the security categorization results for an individual system should be compared with similar Component systems to gain confidence in their accuracy. The comparison should be

NIST SP 800-39, Managing Risk From Information Systems: An Organizational Perspective, Second Public Draft, April 2008.

Certification and Accreditation Guide 18 Department of Homeland Security completed at the Component-level and conducted by the Component CISO, System Owners, and

DAAs.

3.3 System Security Characterization Tasks

To identify the full spectrum of the characteristics of the information processed by a system, the

DHS security categorization process consists of five tasks. The first four tasks are not sequential and can be completed in any order:

FIPS 199 Categorization

Privacy Threshold Analysis (PTA)

E-Authentication Level Determination

CFO Designated Financial System Determination

DHS/NIST SP 800-37 Questionnaire in RMS

The following sections describe the input, subtasks, and output for each of the System Security

Characterization Process tasks.

3.4 FIPS 199 Categorization

In the FIPS 199 Categorization task, the impact levels (low, moderate, or high) for the information system security objectives (confidentiality, integrity, and availability) are determined. DHS has tailored the FIPS 199 “high water mark” approach to assign, different impact levels to each security objective. This means, for example, that for a system with low impact rating for availability, a high impact rating for integrity, and low impact rating for confidentiality it is not required to implement all high controls across the board. Rather the controls should be implemented according to their respective impact ratings (i.e., implemented at the high level for integrity controls and implemented at the low level for the confidentiality and availability controls).

3.4.1 FIPS 199 Categorization Input

Table 6 summarizes the input for the FIPS 199 Categorization task.

Table 6. Input for the FIPS 199 Categorization Task

Input Source

DHS Information Security Categorization Guide DHSOnline/Components/Management/CIO/CISO dhsinfosechelpdesk@dhs.gov

DHS FIPS 199 Workbook DHSOnline/Components/Management/CIO/CISO dhsinfosechelpdesk@dhs.gov

Data Processed by the System

System Requirements

System/Security Concept of Operations

Definition of System Users and Administrators (location, access types, clearances)

System acquisition planning documents

System design documents

System Owner

Certification and Accreditation Guide 19 Department of Homeland Security

The DHS FIPS 199 Workbook is used to complete this task. The Workbook tailors federal-level guidance to the DHS environment. The recommended impact levels contained in the workbook are extracted from Guide for Mapping Types of Information and Information Systems to Security

Categories, NIST SP 800-60, to correlate with the DHS Business Reference Model (BRM) elements.

3.4.2 FIPS 199 Categorization Subtasks

The subtasks are:

1. Following the instructions in the DHS Information Security Categorization Guide, complete the DHS FIPS 199 Workbook based on the types of information processed by the information system.

2. Obtain consensus on the DHS FIPS 199 Workbook from the System Owner and the DAA to prevent rework.

3.4.3 FIPS 199 Categorization Output

The following are output from the FIPS 199 Categorization task:

Impact levels (high, moderate, low) for the confidentiality, integrity, and availability security objectives for the information system

FIPS 199 document (workbook or summary sheet) uploaded to TAF

3.5 Privacy Threshold Analysis

The PTA determines if an information system involves the collection, maintenance, or dissemination of Personally Identifiable Information (PII). PTA is conducted as part of new information system development or whenever an existing system is significantly modified (DHS

Sensitive Systems Policy 4300A, Section 3.14.2). PII is defined as any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a United States citizen, legal permanent resident, or a visitor to the U.S.

3.5.1 PTA Input

Table 7 identifies the required input for the PTA task.

Table 7. Input for the PTA Task

Input Source

PTA Template www.dhs.gov/privacy pia@dhs.gov

Type of Project System design documents

Description of Project and Purpose System design documents

If the project is related to infrastructure, description of the communications log communication logs maintained

System design documents

Type of information collected about individuals System design documents

Whether the system can be remotely accessed System design documents

Whether PII can be physically transported outside System design documents http://www.dhs.gov/privacy mailto:pia@dhs.gov

Certification and Accreditation Guide 20 Department of Homeland Security

Input Source the Department‟s physical perimeter

3.5.2 PTA Subtasks

The DHS Privacy Office owns the overall privacy determination and assessment process. The

DHS Privacy Office is responsible for designating Privacy Sensitive Systems. The Privacy

Office uses the PTA Template to determine if a system processes PII and if a Privacy Impact

Assessment (PIA) is required. The subtasks are:

1. ISSO completes the PTA template with the assistance of the Component Privacy

Point of Contact (PPOC).

2. System Owner reviews and approves the PTA.

3. PTA is uploaded into TAF.

4. DHS Privacy Office (www.dhs.gov/privacy or pia@dhs.gov) determines whether a system is a Privacy Sensitive System.

5. DHS Privacy Office uploads approved PTA into TAF.

3.5.3 PTA Output

The following are output from the PTA task:

Determination by the DHS Privacy Office that a system is a Privacy Sensitive

System.

PTA uploaded by the DHS Privacy Officer to TAF.

If the DHS Privacy Office determines the system processes PII:

The confidentiality security objective for the system must be assigned an impact level of at least moderate (DHS Sensitive Systems Policy 4300A, Section 3.14).

Additional security controls are automatically generated for the SSP by RMS.

(These controls are identified in DHS 4300A Sensitive Systems Handbook, Attachment S, Compliance Framework NIST SP 800-53 Controls for Privacy

Systems.

A PIA must be completed and approved by the Privacy Office.

3.6 E-Authentication Level Determination

E-Authentication Level Determination provides secure on-line transactions, eliminating the need for separate processes for the verification of identity and electronic signatures. Understanding the

E-Authentication requirements provides information for the Risk Assessment process and assists with the identification of certain security controls for the system.

3.6.1 E-Authentication Input

Table 8 identifies the input for the E-Authentication task.

../../../Documents%20and%20Settings/bheath/Local%20Settings/Temporary%20Internet%20Files/Content.Outlook/VY4JTJKA/www.dhs.gov/privacy ../../../Documents%20and%20Settings/bheath/Local%20Settings/Temporary%20Internet%20Files/Content.Outlook/VY4JTJKA/pia@dhs.gov

Certification and Accreditation Guide 21 Department of Homeland Security

Table 8. Input for E-Authentication Task

E-Authentication Workbook DHSOnline/Components/Management/CIO/CISO dhsinfosechelpdesk@dhs.gov

DHS Information Security Categorization Guide DHSOnline/Components/Management/CIO/CISO dhsinfosechelpdesk@dhs.gov

System Description

System Purpose

Data processed by the information system

System Owner

System design documents

3.6.2 E-Authentication Subtasks

The subtasks are:

1. Following the guidance in the DHS Information Security Categorization Guide, complete the E-Authentication Workbook.

2. Forward the E-Authentication Workbook to the System Owner for approval.

3. As part or reauthorization, the e-authentication status must be reviewed and updated.

3.6.3 E-Authentication Level Determination Output

The following are output from the E-authentication Level Determination:

Completed E-Authentication Workbook is uploaded to TAF.

The correct authentication level is updated in TAF.

The technologies supporting the e-authentication level must be concisely described in the NIST SP 800-53 IA-2 control, User Identification and Authentication, in the SSP.

Technical requirements described in NIST SP 800-63, Electronic Authentication

Guideline, are implemented at the appropriate assurance level for those systems for which e-authentication requirements apply.

3.7 CFO Designated Financial Systems Determination

DHS systems designated by the CFO as Financial Systems must comply with the Office of

Management and Budget (OMB) Circular A-123, Management‟s Responsibility for Internal

Control, Appendix A.

3.7.1 CFO Designated Financial System Input

The DHS CFO makes the final determination as to whether a system is a financial system using the following criteria from OMB Circular A-123, Appendix A:

A financial system is an information system, comprised of one or more applications, that is used for any of the following:

– Collecting, processing, maintaining, transmitting, and reporting data about financial events

– Supporting financial planning or budgeting activities

Certification and Accreditation Guide 22 Department of Homeland Security

– Accumulating and reporting cost information

– Supporting the preparation of financial statements, A mixed financial system is a system that supports both financial and non-financial functions of an organization.

3.7.2 CFO Designated Financial System Subtasks

The subtasks are:

1. The Component ISSO identifies systems as financial systems or mixed financial systems using the criteria identified in Section 3.7.1.

2. The Component CISO approves the systems categorization as financial of mixed financial systems.

3. The Component CISO submits the list of financial systems and mixed financial systems to the CFO.

4. The CFO reviews the Component submittals.

5. The CFO publishes the list of CFO Designated Financial Systems during the fourth quarter of every fiscal year.

6. The CFO provides the list of CFO Designated Financial Systems to the Component

CISOs and the Inventory Team.

3.7.3 CFO Designated Financial Systems Output

If the CFO designates a system as a financial system, the ISSO must ensure that:

All categorization controls for the system are designated as at least “moderate”. If warranted by a risk based assessment, all security objectives should be elevated to

“high.”

Requirements specified in DHS Sensitive Systems Policy Directive 4300A, Section 3.5, are implemented.

Requirements specified DHS 4300A Sensitive System Handbook, Attachment R, Compliance Framework for CFO Designated Financial Systems, are implemented.

3.8 DHS/NIST SP 800-37 Questionnaire in RMS

Once the system boundary is defined and the other Security Categorization Process tasks are completed, RMS must be accessed to run the DHS/NIST 800-37 Questionnaire: Phase 1.

3.8.1 Questionnaire Input

Table 9 identifies the input for the DHS/NIST SP 800-37 Questionnaire task.

Table 9. Input for the DHS/NIST 800-37 Questionnaire Task

Input Source

RMS Account Component CISO must request accounts through dhsinfosechelpdesk@dhs.gov

RMS Users Guide RMS Log-In Page

Certification and Accreditation Guide 23 Department of Homeland Security

Inventory Information System Inventory Change Request Form

Security Categorization Results DHS FIPS 199 Workbook

DHS Chief Privacy Officer (CPO) Privacy System designation

E-Authentication Workbook

CFO Financial System Designation

Technology included in System Boundary (e.g., PBX switch, Voice Over Data Network, Voice Over IP Facsimile equipment, Video Teleconferencing equipment, Wireless, PEDs, workstations, laptops, PKI, RFID)

System Owner

System design documents

Network security issues (i.e., remote access, network monitoring, external connections, boundary protection, Internet usage, e-mail, vulnerability scanning)

System Owner

System design documents

DHS Security Configuration Guides requirements (Windows 2000 Windows Vista, HP-UX, Windows 2003/XP, Linux, Solaris, SQL)

System Owner

Contractors and/or Outsourced Operations System Owner

3.8.2 Questionnaire Subtasks

Following the guidance in the RMS Users Guide, the questionnaire should be completed and the

C&A Package for the system generated. (Guidance for filling out the templates is contained in the appendices to this document).

1. Create folder. A blank C&A Package is illustrated in Figure 7.

Figure 7. Blank (Sample) C&A Package

DHS Security Configuration Guides are located at DHSOnline/Components/Management/CIO/CISO

Certification and Accreditation Guide 24 Department of Homeland Security

2. Run the Questionnaire.

3. Complete questionnaire using the information specified in the Questionnaire Input table above.

Select NIST SP 800-37 all documents (Phase I-IV).

A pop-up stating “Finish Questionnaire Run Options” appears.

Choose “Save and Generate C&A Package Documents.”

Figure 8 illustrates the contents of a completed C&A Package in RMS.

Figure 8. Sample of Completed C&A Package

3.8.3 Questionnaire Output

The C&A Package will contain the following documents:

Set of blank DHS templates for completing key C&A documents. These documents are also included as attachments to this guide:

Risk Assessment (RA)

System Security Plan (SSP)

ST&E Plan

Contingency Plan (CP)

Contingency Plan Test (CPT) Results

Certification and Accreditation Guide 25 Department of Homeland Security

Security Assessment Report (SAR)

Accreditation Decision Letter

SRTM with applicable DHS policy, security requirements, and test requirements

Table 10 shows the field definitions for fields in the SRTM.

Table 10. SRTM Field Definitions

SRTM Field Field Definition

Requirement Type Identifies Security Requirement Control Type:

Management, Operational, or Technical

Requirement Sub Type NIST or DHS Family Security Requirement Sub-class

Type: Access Control, Audit & Accountability, Awareness & Training, C&A and Assessment, Configuration Management (CM), Contingency

Planning, Emissions Security, Identification &

Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical &

Environmental Protection, Planning, Risk Assessment, Systems & Communications Protection, Systems &

Information Integrity, Systems & Services Acquisition

Document Name Source Document containing security requirement information: DHS SSP

Section Section of document containing security requirement information

Reference Source Reference for security requirement: DHS

4300A (version) System Security Handbook (SSH), NIST SP 800-53 (Rev 1)

Reference Date Reference Date for security requirement

Requirement Name Name of Security Requirement: example – AC-01

Control H (High) - Access Control Policy and

Procedures

Requirement Description Description of Security Requirement

Assessment Name Provides more detail of security requirement & class type/sub-type: example – AC-01.1 H, AC-02 p1 CFO

(relating to CFO data)

Methods

Interview

Examine

Test

Specifies type(s) of evaluation method: Interview, Examine, Test

Objective Test Objective to evaluate security requirement adherence: example - Determine if: (i) the organization manages IS accounts, including establishing, activating, modifying, reviewing, disabling, and removing accounts; (ii) the organization defines the frequency of

Information System (IS) account reviews; (iii) the organization reviews IS accounts at least annually; and

(iv) the organization initiates required actions on IS accounts based on the review. Examine:(DEPTH:

Certification and Accreditation Guide 26 Department of Homeland Security

SRTM Field Field Definition

Detailed, COVERAGE: Comprehensive): Access control policy; procedures addressing account management; IS security plan; list of active system accounts along with the name of the individual associated with each account; lists of recently transferred, separated, or terminated employees; list of recently disabled IS accounts along with the name of the individual associated with each account; system-generated records with user IDs and last login date;

other relevant documents or records.

Preparation Provides detail associated with Test Preparation activities/requirements

Procedures Test Procedures to evaluate security requirement adherence: example - 1. Examine organizational records or documents to determine if the organization establishes, activates, modifies, reviews, disables, and removes IS accounts in accordance with documented account management procedures. 2. Examine organizational records or documents to determine if the organization conducts IS account reviews annually and any required actions as a result of the reviews have occurred in accordance with established procedures. 3.

Examine selected active user accounts to determine if the organization followed procedures to establish and activate the user accounts and completed any organization-required documentation. 4.