Attachment_6_-_Cyber_Security_Guidelines_and_Lessons_Learned.pdf

Vendor Assessment Guidelines for Twenty Critical Security Controls for

Effective Cyber Defense: Consensus Audit Guidelines (CAG)

General. Organizations should compare all 20 control areas against their current status.

The 20 Critical Controls are:

1. Critical Control 1: Inventory of Authorized and Unauthorized Devices

2. Critical Control 2: Inventory of Authorized and Unauthorized Software

3. Critical Control 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

4. Critical Control 4: Continuous Vulnerability Assessment and Remediation

5. Critical Control 5: Malware Defenses

6. Critical Control 6: Application Software Security

7. Critical Control 7: Wireless Device Control

8. Critical Control 8: Data Recovery Capability

9. Critical Control 9: Security Skills Assessment and Appropriate Training to Fill Gaps

10. Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and

Switches

11. Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services

12. Critical Control 12: Controlled Use of Administrative Privileges

13. Critical Control 13: Boundary Defense

14. Critical Control 14: Maintenance, Monitoring, and Analysis of Audit Logs

15. Critical Control 15: Controlled Access Based on the Need to Know

16. Critical Control 16: Account Monitoring and Control

17. Critical Control 17: Data Loss Prevention

18. Critical Control 18: Incident Response and Management

19. Critical Control 19: Secure Network Engineering

20. Critical Control 20: Penetration Tests and Red Team Exercises

The entire text of the 20 Critical Security Controls is available for reference at:

http://www.sans.org/critical-security-controls/

Procedures:

1. Review each control.

2. Determine what procedures and tools exist within your organization to meet this control.

3. Document the result of 1-2 using the suggested template provided.

4. Provide any additional information about your company’s cyber security posture.

HTC711-14-R-W001

Attachment 6 http://www.sans.org/cag/control/1.php http://www.sans.org/cag/control/2.php http://www.sans.org/cag/control/3.php http://www.sans.org/cag/control/3.php http://www.sans.org/cag/control/4.php http://www.sans.org/cag/control/5.php http://www.sans.org/cag/control/6.php http://www.sans.org/cag/control/7.php http://www.sans.org/cag/control/8.php http://www.sans.org/cag/control/9.php http://www.sans.org/cag/control/10.php http://www.sans.org/cag/control/10.php http://www.sans.org/cag/control/11.php http://www.sans.org/cag/control/12.php http://www.sans.org/cag/control/13.php http://www.sans.org/cag/control/14.php http://www.sans.org/cag/control/15.php http://www.sans.org/cag/control/16.php http://www.sans.org/cag/control/17.php http://www.sans.org/cag/control/18.php http://www.sans.org/cag/control/19.php http://www.sans.org/cag/control/20.php http://www.sans.org/critical-security-controls/

Company (Name): Information Assurance Report

Executive Summary: (descriptive self-assessment of the company’s overall information security posture)

A. Assessment of Twenty Critical Security Controls for Effective Cyber Defense:

Consensus Audit Guidelines (CAG)

1. Control 1. Inventory of Authorized and Unauthorized Devices

a. Procedures and Tools supporting this control:

(List the procedures and tools used in your organization for this control)

b. Method to achieve control metric:

2. (Continue for remaining 19 controls).

If a particular control does not exist or is not used within your organization, please state this.

B. Assessment of Additional Security Measures for Effective Cyber Defense

1. Measure. (Title of additional measure/control)

a. Procedures and Tools supporting this measure/control:

(List the procedures and tools used in your organization)

b. Method to achieve measure/control metric:

2. (Continue for remaining measures/controls)

HTC711-14-R-W001

Attachment 6

LESSONS LEARNED/SUBMISSION RECOMMENDATIONS

RELATED TO USTRANSCOM CYBER DEFENSE CONTRACT LANGUAGE

FOR NON-INFORMATION TECHNOLOGY (IT) REQUIREMENTS

Cyber defense contract language for non-IT requirements

• Submission with proposal:

– Assess your security program based on SANS 20 Critical Security Controls for Cyber Defense (http://www.sans.org/critical-security-controls). The latest version is available at this link and descriptions for each control are detailed, along with a description of each control, how to implement the control, procedures and tools for the control, and effectiveness metrics and test examples

– Submit a security plan addressing SANS 20 Critical Security Controls and describing how your environment safeguards DOD information resident on or transiting unclassified information systems from unauthorized access and disclosure.

• After contract award:

– Implement the security plan you submitted with your proposal

– Report incidents in accordance with contract requirements and comply with other aspects in the contract, including reporting of incidents to the USTRANSCOM Cyber Operations Center (CyOC)

General observations in reviewing cyber defense proposal submissions

• Responses not in format specified in solicitation

– Example: the template requires responses to the 20 Critical Security Controls to have two parts for each of the 20 controls:

a. Procedures and tools supporting this control: (List the procedures and tools used in your organization for this control)

b. Method to achieve control metric: (what metrics are in place to measure the effectiveness of the control) A frequent problem is receiving submissions that do not have both Procedures and Tools, and Method to Achieve control Metric. Both are required.

• Responses provided do not address intent of the control

• Responses lack sufficient detail to determine if intent of the control is met

• Response is missing or incomplete for a control

Specific observations in reviewing cyber defense proposal submissions

• Control responses with high percentage of problems:

– A significant number of responses for SANS Control 6 (Application Software Security) responses frequently do not address intent of control

– Responses should consider the description of the control, and measures described for how to implement the control, found at: http://www.sans.org/critical-security-controls/control/6

Frequently Asked Questions:

1. How are contractors’ Information Assurance Reports evaluated?

Answer: Contractor’s responses/assessments to the SANS 20 Critical Controls “Procedures and Tools” and “Methods” are reviewed and rated either ACCEPTABLE or UNACCEPTABLE by Government personnel.

2. How is cyber security requirements monitored?

Answer: The contracting officer may request an updated Information Assurance Report 30 days prior to the exercise of an option period.

HTC711-14-R-W001

Attachment 6 http://www.sans.org/critical-security-controls http://www.sans.org/critical-security-controls/control/6 http://www.sans.org/critical-security-controls/control/6