RHRP-II Attachment 28 - AI No. 042 - Security of Unclassified Department of Defense Information on Non-TMA Information Systems.pdf

TRICARE Management Activity

ADMINISTRATIVE

INSTRUCTION

NUMBER 042

MARCH 23, 2012

TRICARE Policy and Operations

SUBJECT: Security of Unclassified Department of Defense Information on Non-TRICARE

Management Activity Information Systems

References: (a) Department of Defense (DoD) Directive 5230.09, “Clearance of DoD

Information for Public Release,” August 22, 2008

(b) National Institute of Standards and Technology (NIST) Special Publication

(SP) 800-53A, Revision (Rev.) 1, “Guide for Assessing the Security Controls in Federal Information Systems,” July 25, 2011

(c) TRICARE Management Activity Decision Paper, “Security of Unclassified Department of Defense Information on Non-TRICARE Management Activity Information Systems,” July 18, 2011

(d) Directive-Type Memorandum 08-027, “Security of Unclassified Department of Defense (DoD) Information on Non-DoD Information Systems,” Change 2, September 2, 2011

(e) NIST SP 800-53, Rev. 3, “Recommended Security Controls for Federal Information Systems and Organizations,” August 25, 2011

1. PURPOSE. This Administrative Instruction (AI) provides procedures for TRICARE Management Activity (TMA) personnel to protect unclassified DoD information on non-TMA Information Systems during the period of time before the proposed Defense Federal Acquisition Regulation Supplement rule on this same subject takes effect.

2. APPLICABILITY. This AI applies to all of TMA.

3. DEFINITIONS. See Glossary.

4. POLICY. It is TMA policy that unclassified DoD information, to include PHI and PII, on non-DoD Information Systems will be protected in accordance with Reference (d).

5. RESPONSIBILITIES.

a. Acquisition Management and Support Directorate (AM&S). AM&S shall ensure TMA . contracts include the appropriate TMA-developed special provision language (Enclosure 1) to protect Unclassified DoD Information on non-DoD Information Systems.

b. The Office of the ChiefInformation Officer/Information Assurance CIA). TMA IA shall provide policy, planning, and enterprise governance for TMA Information Systems that satisfy the definition of a "DoD Information System," including those TMA Information Systems accessed by contractors.

c. Purchased Care Systems Integration Branch (PCSIB)/Information Assurance. PCSIB IA manager shall:

(1) Be the technical point of contact for all contract-related IA matters concerning non DoD Information Systems; and

(2) As requested by AM&S, provide technical assistance in the determination of compliance with NIST SP 800-53 "Recommended Security Controls for Federal Information

Systems and Organizations" (Reference (e» security controls identified on contract; and

(3) As requested by AM&S, coordinate with DoD's Cyber Crime Center to provide technical assistance for cyber security incidents.

6. PROCEDURES. See Enclosure 2.

7. INFOMRA TION REQUIREMENTS. See Enclosures 3 and 4.

8. RELEASABILITY. RESTRICTED. This AI is available to HAiTMA employees with Common Access Card access to the TMA intranet.

9. EFFECTIVE DATE. This AI is effective upon issuance.

W. Bryan Gamble, M.D., FACS Brigadier General, US Army Deputy Director

Enclosures

1. TMA's Contract Clauses to Implement DTM 08-027

2. TMA's Requirements for NIST Certification/Recertification

AI 042

3. Checklist and Certification for Minimum Level of Enhanced Safeguarding for Unclassified DoD Information

4. Sample Written Determination Format Glossary

CONTENTS 4

TABLE OF CONTENTS

ENCLOSURE 1: TMA’S CONTRACT CLAUSES TO IMPLEMENT DTM 08-027

ENCLOSURE 2: TMA’S REQUIREMENTS FOR NIST CERTIFICATION/

RECERTIFICATION

ENCLOSURE 3: CHECKLIST AND CERTIFICATION FOR MINIMUM LEVEL OF

ENHANCED SAFEGUARDING FOR UNCLASSIFIED DoD INFORMATION

ENCLOSURE 4: SAMPLE WRITTEN DETERMINATION FORMAT

GLOSSARY

ENCLOSURE 1 5

ENCLOSURE 1

TMA’S CONTRACT CLAUSES TO IMPLEMENT DTM 08-027

H.XX.1. The Contractor shall implement and maintain information security in its project, enterprise, or company-wide unclassified information technology system(s) in accordance with the requirements set forth in DoD Directive-Type Memorandum (DTM) 08-027, “Security of Unclassified Department of Defense (DoD) Information on Non-DoD Information Systems,” July 31, 2009, (incorporating Change 2, September 2, 2011). The Contractor shall, at a minimum, comply with the specified National Institute of Standards and Technology Special Publication 800-53 security controls. If a control is not implemented, the Contractor shall prepare a written determination that explains how either the required security control is not applicable or how an alternative control or protective measure is used to achieve equivalent protection.

H.XX.2. In connection with the enhanced safeguarding requirements, the Contractor shall annually provide the completed checklist and certification described in contract provision F., Checklist and Certification for Minimum Level of Enhanced Safeguarding for Unclassified DoD Information, and Contract Data Requirements List A, Checklist and Certification for Minimum Level of Enhanced Safeguarding for Unclassified DoD Information. The Contractor shall use a current, dated copy of the prescribed Checklist and Certification Form, to be provided to the Contractor by the Contracting Officer Representative no later than 30 days prior to the date on which the completed and signed form must be submitted to the Government.

ENCLOSURE 2 6

ENCLOSURE 2

TMA’S REQUIREMENTS FOR NIST CERTIFICATION/RECERTIFICATION

1. PURPOSE. The purpose of this document is to identify the National Institute of Standards and Technology (NIST) 800-53/certification process, as allowed by Directive-Type Memorandum (DTM) 08-027, “Security of Unclassified Department of Defense (DoD) Information on Non-DoD Information Systems” and applicable TRICARE contract clauses;

TRICARE Management Activity (TMA) (i.e., “the Government”) will require its Purchased Care Contractors to comply with and take the measures necessary to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.

2. CERTIFICATION PROCESS. The following steps will apply to the NIST-based Information Assurance (IA) certification process. It should be noted that the Contracting Officer (CO), the Acquisition Management & Support (AM&S) representative, has the overall responsibility for this process.

a. Document Submission. The Contractor shall submit a completed/signed “Checklist and Certification for Minimum Level of Enhanced Safeguarding for Unclassified Department of Defense Information” (a.k.a., “Checklist”) and any applicable written determinations to CO for review and validation.

b. Review of Contractor’s Certification Statements. As needed, the Contracting Officer

Representative (COR) may request assistance from the Purchased Care Systems Integration Branch IA prior to seeking guidance from the Office of the Chief Information Officer’s TMA IA Office in order to address issues or questions arising from the Contractor-submitted certification documents.

c. Contractor Presentation. At the Government’s discretion, the Contractor will provide a

NIST certification briefing at a designated Government location, presenting an overview of its certification efforts. At this venue, the program office/TRICARE Regional Office, and AM&S, with assistance from other TMA Offices as considered necessary by CO, will represent the Government and determine the questions and/or clarifications needed by the Government.

d. Government-only Meetings. The Government may meet privately in order to develop questions and/or discuss issues, including which questions to raise, who will present, and when, where, and in what format the question(s) will be posed.

e. Government Acceptance. Appropriate Government personnel will review the Contractor-submitted documentation and determine if the Contractor is in compliance with the contract requirements. This validation process is no different than any other contract certification requirement. If a discrepancy exists, appropriate action on the part of COR and/or CO will be taken.

ENCLOSURE 2 7

f. Certification Milestones. As part of each contract that participates in the DTM 08-027-related security program, there are three distinct submission milestones that a Contractor must comply with in order to obtain and retain the NIST-based certification.

(1) Initial. The Contractor shall submit a completed signed “Checklist” and any applicable written determinations.

(2) Interim. When the Contractor determines there has been a change in the compliance with any one of the “Checklists” IA controls, the Contractor will resubmit a completed/signed “Checklist,” along with any applicable/supporting written determinations.

(3) Annual. On the anniversary of contract award, the Contractor will submit a completed signed “Checklist” and applicable written determinations, updating the material as necessary.

g. Document Retention. In accordance with the Government’s document filing requirements, CO will maintain a copy of all Contractor-submitted certification statements and written determinations.

h. Inspections. As routinely noted in the Government’s inspections clause (Federal

Acquisition Regulation 52.246-4 Inspection of Services), TMA reserves the right to inspect the Contractor’s IA infrastructure and processes.

3. DOCUMENT DETAILS.

a. Checklist. As part of the contract award materials, CO will provide the Contractor with the most current version of the “Checklist” and written determination format. When document changes occur, CO will notify and provide the Contractor with replacement versions of the documents.

(1) Document Updates. The presentation of a new document version, in and of itself, may or may not lead the Government to require the resubmission of a Contractor certification statement (i.e., “Checklist” plus applicable written determinations).

(2) Contractor-initiated Changes. If the Contractor changes his/her compliance status or vulnerability mitigation plan for any IA control shown on the “Checklist,” then the Government will require the Contractor to submit an updated certification statement.

b. Written Determination Report. If a contractor indicates either “No” or “N/A” for any IA control listed on the Checklist, then he/she will need to submit a written determination report to explain his/her decision rationale and/or mitigating course of action(s). In the process of completing a written determination report, the Contractor should do the following:

ENCLOSURE 2 8

(1) Tracking Number. To support clear communications, the Contractor should list a simple tracking number in the “Activity Description” field of a particular IA control reference and the same tracking number at the top of the associated written determination report.

(2) Vulnerability Reporting.

(a) Single Vulnerability. If an IA control has a single vulnerability, then the Contractor should list the planned mitigation activity and date in the written determination report.

(b) Multiple Vulnerabilities. If an IA control has multiple vulnerabilities with the same mitigation date, then the Contractor should list them all in the same written determination report. If an IA control has multiple vulnerabilities with different mitigation dates, then the Contractor should group them by date and list the groups in separate written determination reports.

(3) Mitigation Dates. When the Contractor resubmits the “Checklist” and associated written determination reports, the Contractor must always list the actual date—rather than the planned date—for when he/she completed mitigation activities for an identified vulnerability.

ENCLOSURE 3 9

ENCLOSURE 3

CHECKLIST AND CERTIFICATION FOR MINIMUM LEVEL OF ENHANCED

SAFEGUARDING FOR UNCLASSIFIED DoD INFORMATION

ENCLOSURE 3 10

ENCLOSURE 4 11

ENCLOSURE 4

SAMPLE WRITTEN DETERMINATION FORMAT

Written Determination <Insert Reference #> in Support of TMA’s DTM 08-027 Checklist

<Insert Date>

Contract Reference # Contactor Name Street Address City, State Zip Code

Information Assurance (IA) Control #:

<Enter the specific IA Control # from the “Checklist”>

IA Control Nomenclature: <Enter the specific IA Control’s Nomenclature>

Compliance Statement: <Restate the Contractor’s compliance with the IA Control>

Issue:

<Provide basic “business” description for why the Contractor cannot/will not meet the requirements of the NIST 800-53/A IA control as listed on TMA’s DTM 08-027 Checklist.> Contractor-identified Solution:

<Provide a business-level description of the Contractor’s alternative plan to satisfy the security requirements associated with the Checklist’s specific IA control.> Mitigation/Remediation Plan:

<As appropriate, provide a business-level description of the Contractor’s plan of action and milestone for implementing the solution listed above.> Risk Acceptance Statement:

<Provide a statement that the Contractor accepts the risk of either implementing a technical solution different from the NIST guidance or contract operations until the NIST control can be implemented.>

GLOSSARY 12

GLOSSARY

PART I: ACRONYMS

AI Administrative Instruction AM&S Acquisition Management and Support Directorate

CO Contracting Officer COR Contracting Officer Representative

IA Information Assurance

NIST National Institute of Standards and Technology

PCSIB Purchased Care System Integration Branch PHI protected health information PII personally identifiable information

TMA TRICARE Management Activity

PART II: DEFINITIONS

DoD-owned Information Systems and DoD-controlled Information Systems. An information system is DoD-controlled or operated on behalf of DoD when a contractual agreement or memorandum of agreement exists between the DoD and the non-DoD entity/contractor for the operation of the information system, and the information system is established, in accordance with a specific contractual requirement to do so, only for DoD purposes and dedicated, as directed by contractual requirement, to processing DoD-owned information only.

Non-DoD entity. Any person who is not a civilian employee or military member of DoD, or any entity or organization that is not a DoD component. This includes any non-DoD Federal agency and its personnel, and any contractor, grantee, awardee, partner, or party to any form of legal agreement or understanding with DoD or another Federal agency.

Non-DoD Information System. Any information system that is not owned, used, or operated by DoD and that is not used or operated by a contractor or other non-DoD entity on behalf of DoD.

DoD Information. Any information that has not been cleared for public release in accordance with DoD Directive 5230.09 (Reference (a)) and that is provided by DoD to a non-DoD entity, or that is collected, developed, received, transmitted, used, or stored by a non-DoD entity in support of an official DoD activity.

Any information that has not been cleared for public release in accordance with DoD Directive 5230.09, “Clearance of DoD Information for Public Release,” August 22, 2008, and that is

GLOSSARY 13

provided by DoD to a non-DoD entity, or that is collected, developed, received, transmitted, used, or stored by a non-DoD entity in support of an official DoD activity. The Protected Health Information (PHI) (defined in Reference (b)) and Personally Identifiable Information (PII) (defined in Reference (c)) of DoD beneficiaries is unclassified DoD information that is not cleared for public release.