HSTS01-15-R-HRM015_Vendor_Questions_and_TSA_Responses_from_the_Information_Technology_Industry_Day.pdf

RFP HSTS01-15-R-HRM015 Vendor Questions and TSA Responses from the Information Technology Industry Day

Which public cloud providers have been previously vetted? For example, with regard to 5.X and 5.Y?

We believe the question referenced the TS-072 Cloud Computing and Virtualization standard, Control 3X and 3Y.

3X states, "TSA shall vet all cloud provider staff, including subcontractors supporting TSA resources. Each staff member shall undergo periodic background verification depending upon the sensitivity of the data accessed in accordance with MD, DHS Instruction 121-01-007 Suitability Screening Requirements For Contractors." 3Y states, "The cloud provider shall notify TSA of relevant employment terminations and hires. If such termination or hires have privileged account access, an updated privileged access request form shall be submitted to the CISO, in accordance with TSA MD 1400.8 Privileged Access and the OIT Privileged Access SOP."

The complete list of FedRAMP CSP are listed here and TSA could be in contract with one or more of the CSP listed:

http://www.fedramp.gov/marketplace/compliant-systems/

2 How are "low-to-moderate impact" information systems defined?

We believe this question applies to TS-072 Cloud Computing and Virtualization, Control 3.AAA, which states, "The public cloud shall only be used for low- to moderate-impact information systems."

Security objectives (i.e., C, I, A) are assigned a potential impact level of Low, Moderate or High depending on the sensitivity of the information and the impact level assigned for that particular system. Note: The public cloud shall not apply or contain High impact system related information.

Controls listed in TSA Information Assurance Handbook list associated NIST SP 800-53 controls. Are these associated to specific control levels for SP800-53 such as "low", "medium", "high"?

TSA IA Handbook The controls in SP 800-53 include their suggested impact levels. The "Category" column to the right of the policy statement in the TSA IA Handbook lists the appropriate impact levels based on SP 800-53. It could address L, M and/or H.

Provide a definition and clarity around "cloud bursting" described in Statement of Work Section 7.7.1; However, not described in "Cloud Computing and Virtualization"

(TS-072).

A definition of "cloud bursting" could be added to the TS-072 Cloud Computing and Virtualization document at a later date during its document review. TS-072 does address and point to the following NIST 800-144, 800-145 and 800-146 documents where cloud bursting is addressed:

* NIST SP 800-144 Guidelines on Security and Privacy in Public Cloud Computing - December 2011

* NIST SP 800-145 The NIST Definition of Cloud Computing - September 2011

* NIST SP 800-146 Cloud Computing Synopsis and Recommendations - May 2012

Special Publication 800-144

3.3 The Security and Privacy Downside

* System Complexity. A public cloud computing environment is extremely complex compared with that of a traditional data center. Many components make up a public cloud, resulting in a large attack surface. Besides components for general computing, such as deployed applications, virtual machine monitors, guest virtual machines, data storage, and supporting middleware, there are also components that the management backplane comprises, such as those for self-service, resource metering, quota management, data replication and recovery, service level monitoring, workload management, and cloud bursting. Cloud bursting involves the deployment and launching of an application at a cloud and the redirection of requests to it, in the event that computing resources at organization’s data center become saturated.

Special Publication 800-145 Deployment Models:

Hybrid cloud. The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

Special Publication 800-146 Deployment Models:

Hybrid cloud. The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds)."

4.7 The Hybrid Cloud Scenario

For example, "cloud bursting" is an often-discussed concept in which a consumer uses a private cloud for routine workloads, but optionally accesses one or more external clouds during periods of high demand.

RFP HSTS01-15-R-HRM015 Vendor Questions and TSA Responses from the Information Technology Industry Day

In the TSA IA Handbook, Does item 5.2.8 apply to systems at non-TSA sites, i.e. install DHS certificates on testing systems.

TSA 1A Handbook Item 5.2.8 5.2.8 states, "Workstations, laptops, and tablets shall be configured and managed in compliance with TS-008 End User Assets and DHS configuration guidance on the U.S Government Configuration Baseline (USGCB). Configurations shall include installation of the DHS Common Policy Object Identifier (OID), Common Policy Framework Root CA certificate, and the DHS Principal CA certificate."

TSA IA Handbook

2. Scope The policies within TSA MD 1400.3 apply to all TSA employees, contractors, vendors, detailees, others working on behalf of TSA, non-TSA individuals authorized to access TSA information systems, and to all TSA information systems that collect, generate, process, store, display, transmit, or receive TSA data, including prototypes and telecommunications systems, in all phases of the System Engineering Life Cycle (SELC) unless an approved waiver has been granted. The above assets shall be collectively referred to as "IT assets" throughout the document.

Will any controls that assess against NIST 5P 800-53 be tied to specific publication versions? If so, which version?

NIST 5P 800-53 Yes. Security controls shall be IAW current NIST 800-53 document (in this case, Rev 4.)

With regard to TSA's Configuration Management Policy, are there any specific products or tools recommended for use?

Configuration Management Policy TSA does not recommend specific tools for this purpose.

8 What is the frequency for making updates or changes to the configuration management policy?

TSA IA HB, Paragraph 3.5.1 Configuration Management Policy and Procedures, ID 5.1.1 "The CISO shall develop, disseminate, and annually review/update a formal, documented configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among TSA entities, and compliance; and formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls."

It appears the question is directed at configuration management policy in general and not actual configuration changes via the RFC and SCCB process. On average, updates will be on an annual basis or when and where changes are warranted in the policy document. TSA uses Configuration Guidance provided by DHS. These documents are updated on an as needed basis but are generally static for a year or more.

When using Blade server technology, does the separation of physical hardware include the Blade chassis?

Cloud Computing and Virtualization If physical separation is required such as servers in two different zones, two separate chassis would be required and not just two different blades in a chassis.

Sheet2