II_1 - RFP Attachment J-10 - AMIS Security Controls.pdf

CyberSecurity

Information Technology

Publication 4812 Contractor Security & Privacy Controls

Handling and Protecting Information or Information Systems

***This Publication Pertains to IT Assets Owned and Managed at Contractor sites***

Highlights of Publication 4812

Publication 4812 identifies security and privacy control requirements for contractors and their subcontractors that have access to or manage Internal Revenue Service (IRS) Sensitive But Unclassified (SBU) data on their own information systems or resources. The level of the required security and privacy controls will vary depending on the duration, size, and complexity of the supported contract.

Publication 4812 defines basic security and privacy control requirements for contractors, subcontractors, contractor employees, and subcontractor employees who will either:

• Have access to, develop, operate, host, or maintain IRS SBU data or information systems for tax administration purposes outside of IRS facilities or outside of the direct control of the Service, and/or

• Have access to, compile, process, transmit or store IRS SBU data on their own information systems or that of a subcontractor or third-party service provider, or that use their own information systems (or that of others) and Electronic Information and Technology (EIT) (as defined in FAR Part 2) to access, compile, process, or store IRS SBU data while working at an IRS owned or controlled facility.

The IRS defines SBU data in IRM 10.5.1.2.2, Sensitive But Unclassified (SBU) Data, as any information which, if lost, stolen, misused, accessed, or altered without proper authorization, may adversely affect the national interest or the conduct of federal programs (including IRS operations), or the privacy to which individuals are entitled under the Privacy Act (5 U.S.C.

552a).

SBU data includes but is not necessarily limited to:

• Federal Tax Information (FTI), Personally Identifiable Information (PII), Protected Health Information (PHI), procurement sensitive information, system vulnerabilities, case selection methodologies, systems information, enforcement procedures, and investigation information. (See Appendix B “Glossary” for definitions).

• Live data, which is defined as production data in use. Live means that when changing the data, it changes in production. The data may be extracted for testing, development, etc., in which case, it is no longer live. Generally, SBU data should not be used for testing or training and non-production systems must maintain the same security and privacy controls which protect live data when SBU data is introduced.

https://www.acquisition.gov/far/part-2

Table of Contents

1.0 Background __________________________________________________________________ 11

2.0 Purpose ______________________________________________________________________ 12

3.0 Scope ________________________________________________________________________ 13

3.1. IRS Security and Privacy Controls Structure _____________________________________ 13

3.1.1 IRM 10.8.1 Applicability __________________________________________________ 13

3.1.2 IRM 10.5.1 Applicability __________________________________________________ 13

3.1.3 Publication 4812 Applicability ______________________________________________ 14

4.0 SBU Data ____________________________________________________________________ 16

4.1 Returns and Return Information ________________________________________________ 16

4.2 Law Enforcement Sensitive (LES) Information ____________________________________ 16

4.3 Employee Information ________________________________________________________ 17

4.4 Personally Identifiable Information (PII) _________________________________________ 17

4.5 Other Protected Information ___________________________________________________ 17

5.0 Information and Information Systems _____________________________________________ 19

6.0 Unauthorized Access (UNAX) and Disclosure of Information _________________________ 20

7.0 Roles and Responsibilities _______________________________________________________ 21

7.1 Government _________________________________________________________________ 21

7.1.1 Contracting Officer (CO) _________________________________________________ 21

7.1.2 Contracting Officer’s Representative (COR) _________________________________ 21

7.1.3 Contractor Security Assessment Team (CSA) _________________________________ 22

7.1.4 Privacy, Governmental Liaison and Disclosure (PGLD) ________________________ 22

7.1.5 Facilities Management and Security Services (FMSS) __________________________ 23

7.1.6 Personnel Security (PS) ___________________________________________________ 23

7.1.7 Project Manager/Task Manager ____________________________________________ 23

7.2 Contractor __________________________________________________________________ 24

7.2.1 Contractor Point of Contact (POC) _________________________________________ 24

7.2.2 Contractor Employees ____________________________________________________ 25

7.3 Contractor Program Requirements _____________________________________________ 25

7.3.1 Contractor Security Policies and Procedures __________________________________ 25

7.3.2 Contractor Investigative Requirements ______________________________________ 26

7.3.3 Contractor Training ______________________________________________________ 26

7.3.4 Contractor Information Protection __________________________________________ 27

7.3.5 Rules of Behavior ________________________________________________________ 27

8.0 Contractor Security Assessments (CSA) ___________________________________________ 28

8.1 Overview ___________________________________________________________________ 28

8.2 Types of Assessments _________________________________________________________ 28

8.3 Notice of Assessments _________________________________________________________ 29

8.4 Security Control Levels ________________________________________________________ 29 Networked Information Technology Infrastructure (NET) __________________________ 30

Software Application Development/Maintenance (SOFT) ___________________________ 30

8.5 Scope of Assessments __________________________________________________________ 30

8.5.1 Collaboration on Contractor Security Assessment _____________________________ 31

8.5.1.1 Before the Assessment _________________________________________________ 31

8.5.1.2 At the Time of, or During the Assessment ________________________________ 31

8.5.1.3 After the Assessment __________________________________________________ 31

8.5.2 Continuous Monitoring of Security and Privacy Controls _______________________ 32

9.0 Privacy and Information Protection ______________________________________________ 33

9.1 Security Categorization ________________________________________________________ 33

10.0 Security and Privacy Control Organization and Structure ___________________________ 34 Table 1: NIST Families of Security and Privacy Controls ___________________________ 34

11.0 Access Control (AC) ___________________________________________________________ 35

11.1 AC-1 Access Control Policy and Procedures _____________________________________ 35

11.2 AC-2 Account Management ___________________________________________________ 35

11.3 AC-3 Access Enforcement ____________________________________________________ 36

11.4 AC-4 Information Flow Enforcement ___________________________________________ 36

11.5 AC-5 Separation of Duties ____________________________________________________ 37

11.6 AC-6 Least Privilege _________________________________________________________ 37

11.7 AC-7 Unsuccessful Login Attempts _____________________________________________ 38

11.8 AC-8 System Use Notification _________________________________________________ 39

11.9 AC-11 Device Lock ___________________________________________________________ 39

11.10 AC-12 Session Termination __________________________________________________ 39

11.11 AC-14 Permitted Actions without Identification or Authentication __________________ 40

11.12 AC-17 Remote Access _______________________________________________________ 40

11.13 AC-18 Wireless Access ______________________________________________________ 40

11.14 AC-19 Access Control for Mobile Devices ______________________________________ 41

11.15 AC-20 Use of External Systems _______________________________________________ 43

11.16 AC-21 Information Sharing __________________________________________________ 44

11.17 AC-22 Publicly Accessible Content ____________________________________________ 44

12.0 Awareness and Training (AT) ___________________________________________________ 45

12.1 AT-1 Awareness and Training Policy and Procedure ______________________________ 45

12.2 AT 2 Literacy Training and Awareness _________________________________________ 45

12.3 AT-3 Role Based Training ____________________________________________________ 46

12.4 AT-4 Training Records _______________________________________________________ 46

13 Audit and Accountability (AU) ___________________________________________________ 47

13.1 AU-1 Audit and Accountability Policy and Procedures ____________________________ 47

13.2 AU-2 Event Logging __________________________________________________________ 47 Table 2: Logging Events _______________________________________________________ 47

13.3 AU-3 Content of Audit Records ________________________________________________ 48

13.4 AU-4 Audit Log Storage Capacity ______________________________________________ 48

13.5 AU-5 Response to Audit Logging Processing Failures ______________________________ 49

13.6 AU-6 Audit Record Review, Analysis, and Reporting ________________________________ 49

13.7 AU-7 Audit Record Reduction and Report Generation _____________________________ 50

13.8 AU-8 Time Stamps __________________________________________________________ 50

13.9 AU-9 Protection of Audit Information ___________________________________________ 50

13.10 AU-11 Audit Record Retention _______________________________________________ 51

13.11 AU-12 Audit Record Generation _______________________________________________ 51

14.0 Assessment, Authorization, and Monitoring (CA) ____________________________________ 52

14.1 CA-1 Assessment, Authorization, and Monitoring Policies and Procedures ______________ 52

14.2 CA-2 Control Assessments ____________________________________________________ 52

14.3 CA-3 Information Exchange ___________________________________________________ 53

14.4 CA-5 Plan of Action and Milestones ____________________________________________ 53

14.5 CA-6 Authorization __________________________________________________________ 54

14.6 CA-7 Continuous Monitoring __________________________________________________ 54

14.7 CA-8 Penetration Testing _____________________________________________________ 55

14.8 CA-9 Internal System Connections _____________________________________________ 55

15.0 Configuration Management (CM) _______________________________________________ 56

15.1 CM-1 Configuration Management Policy and Procedures __________________________ 56

15.2 CM-2 Baseline Configuration __________________________________________________ 56

15.3 CM-3 Configuration Change Control ___________________________________________ 57

15.4 CM-4 Impact Analysis _______________________________________________________ 57

15.5 CM-5 Access Restrictions for Change ___________________________________________ 58

15.6 CM-6 Configuration Settings __________________________________________________ 58

15.7 CM-7 Least Functionality _____________________________________________________ 59

15.8 CM-8 System Component Inventory ____________________________________________ 60

15.9 CM-9 Configuration Management Plan _________________________________________ 60

15.10 CM-10 Software Usage Restrictions ___________________________________________ 60

15.11 CM-11 User-Installed Software _______________________________________________ 61

15.12 CM-12 Information Location _________________________________________________ 61

16.0 Contingency Planning (CP) _____________________________________________________ 62

16.1 CP-1 Contingency Planning Policy and Procedures ________________________________ 62

16.2 CP-2 Contingency Plan _______________________________________________________ 62

16.3 CP-3 Contingency Training ___________________________________________________ 63

16.4 CP-4 Contingency Plan Testing ________________________________________________ 63

16.5 CP-6 Alternate Storage Site ___________________________________________________ 64

16.6 CP-7 Alternate Processing Site ________________________________________________ 64

16.7 CP-8 Telecommunications Services _____________________________________________ 65

16.8 CP-9 System Backup _________________________________________________________ 65

16.9 CP-10 System Recovery and Reconstitution ______________________________________ 66

17.0 Identification and Authentication (IA) ____________________________________________ 67

17.1 IA-1 Identification and Authentication Policy and Procedures _______________________ 67

17.2 IA-2 Identification and Authentication (Organizational Users) ______________________ 67

17.3 IA-3 Device Identification and Authentication ____________________________________ 67

17.4 IA-4 Identifier Management ___________________________________________________ 68

17.5 IA-5 Authenticator Management _______________________________________________ 68

17.6 IA-6 Authenticator Feedback __________________________________________________ 70

17.7 IA-7 Cryptographic Module Authentication ______________________________________ 70

17.8 IA-8 Identification and Authentication (Non-Organizational Users) __________________ 70

18.0 Incident Response (IR) ________________________________________________________ 71 Table 3: Examples of Security and Privacy Incidents _______________________________ 71

18.1 IR-1 Incident Response Policy and Procedures ___________________________________ 73

18.2 IR-2 Incident Response Training _______________________________________________ 73

18.3 IR-3 Incident Response Testing ________________________________________________ 73

18.4 IR-4 Incident Handling _______________________________________________________ 74

18.5 IR-5 Incident Monitoring _____________________________________________________ 74

18.6 IR-6 Incident Reporting ______________________________________________________ 75

18.7 IR-7 Incident Response Assistance _____________________________________________ 75

18.8 IR-8 Incident Response Plan __________________________________________________ 76

19.0 Maintenance (MA) ____________________________________________________________ 76

19.1 MA-1 Maintenance Policy and Procedures _______________________________________ 76

19.2 MA-2 Controlled Maintenance ________________________________________________ 77

19.3 MA-3 Maintenance Tools _____________________________________________________ 78

19.4 MA-4 Non-Local Maintenance _________________________________________________ 78

19.5 MA-5 Maintenance Personnel _________________________________________________ 79

19.6 MA-6 Timely Maintenance ____________________________________________________ 79

20.0 Media Protection (MP) ________________________________________________________ 80

20.1 MP-1 Media Protection Policy and Procedures ___________________________________ 81

20.1.1 MP-1 Return or sanitization/destruction of hard and softcopy media at the End of Performance, under the Contract. _______________________________________________ 82

20.2 MP-2 Media Access __________________________________________________________ 82

20.3 MP-3 Media Marking ________________________________________________________ 83

20.4 MP-4 Media Storage _________________________________________________________ 83

20.5 MP-5 Media Transport _______________________________________________________ 84

20.6 MP-6 Media Sanitization _____________________________________________________ 84

20.7 MP-7 Media Use ____________________________________________________________ 85

21.0 Physical and Environmental Protection (PE) ______________________________________ 86

21.1 PE-1 Physical and Environmental Protection _____________________________________ 86

21.2 PE-2 Physical Access Authorization ____________________________________________ 87

21.3 PE-3 Physical Access Control __________________________________________________ 87

21.4 PE-4 Access Control for Transmission Medium ___________________________________ 88

21.4.1 Transporting IRS Material _______________________________________________ 88

21.5 PE-5 Access Control for Output Devices _________________________________________ 89

21.6 PE-6 Monitoring Physical Access _______________________________________________ 90

21.6.1 Monitoring Private Collection Agencies (PCA) _______________________________ 90

21.7 PE-8 Visitor Access Records ___________________________________________________ 90

21.8 PE-9 Power Equipment and Cabling ____________________________________________ 91

21.9 PE-10 Emergency Shutoff _____________________________________________________ 91

21.10 PE-11 Emergency Power ____________________________________________________ 91

21.11 PE-12 Emergency Lighting ___________________________________________________ 91

21.12 PE-13 Fire Protection _______________________________________________________ 91

21.13 PE-14 Environmental Controls _______________________________________________ 92

21.14 PE-15 Water Damage Protection ______________________________________________ 92

21.15 PE-16 Delivery and Removal _________________________________________________ 92

21.16 PE-17 Alternate Work Site ___________________________________________________ 92

22.1 PL-1 Planning Policy and Procedures ___________________________________________ 95

22.2 PL-2 System Security and Privacy Plans _________________________________________ 95

22.3 PL-4 Rules of Behavior _______________________________________________________ 96

22.4 PL-8 Security and Privacy Architectures ________________________________________ 97

23.0 Program Management (PM) ____________________________________________________ 98

23.1 PM-5 Inventory of Personally Identifiable Information ____________________________ 98

23.2 PM-25 Minimization of PII Used in Testing, Training, and Research _________________ 98

23.3 PM-26 Complaint Management ________________________________________________ 98

24.0 Personnel Security (PS) ________________________________________________________ 99

24.1 PS-1 Personnel Security Policy and Procedures ___________________________________ 99

24.2 PS-2 Position Risk Designation ________________________________________________ 99

24.3 PS-3 Personnel Screening ____________________________________________________ 100

24.3.1 PS-3 Eligibility ________________________________________________________ 100

24.3.2 PS-3 Suitability ________________________________________________________ 100

24.4 PS-4 Personnel Termination __________________________________________________ 101

24.5 PS-5 Personnel Transfer _____________________________________________________ 101

24.6 PS-6 Access Agreements _____________________________________________________ 102

24.7 PS-7 External Personnel Security _____________________________________________ 102

24.8 PS-8 Personnel Sanctions ____________________________________________________ 102

25.0 PII Processing and Transparency (PT) __________________________________________ 104

25.1 PT-5 Privacy Notice ________________________________________________________ 104

26.0 Risk Assessment (RA) ________________________________________________________ 105

26.1 RA-1 Risk Assessment Policy and Procedures ___________________________________ 105

26.2 RA-2 Security Categorization ________________________________________________ 105

26.3 RA-3 Risk Assessment ______________________________________________________ 105

26.4 RA-5 Vulnerability Monitoring and Scanning ___________________________________ 106

27.0 System and Services Acquisition (SA) ___________________________________________ 109

27.1 SA-1 System and Services Acquisition Policy and Procedures ______________________ 109

27.2 SA-2 Allocation of Resources _________________________________________________ 109

27.3 SA-3 System Development Life Cycle (SDLC) ___________________________________ 110

27.4 SA-4 Acquisition Process ____________________________________________________ 110

27.6 SA-5 System Documentation _________________________________________________ 110

27.7 SA-8 Security and Privacy Engineering Principles ________________________________ 111

27.8 SA-9 External System Services _______________________________________________ 111

27.9 SA-10 Developer Configuration Management ___________________________________ 111

27.10 SA-11 Developer Testing and Evaluation ______________________________________ 112

27.11 SA-15 Development Process, Standards, and Tools ______________________________ 112

27.12 SA-22 Unsupported System Components ______________________________________ 113

28.0 System and Communications Protection (SC) _____________________________________ 114

28.1 SC-1 System and Communications Protection Policy and Procedures _______________ 114

28.2 SC-2 Separation of System and User Functionality _______________________________ 114

28.3 SC-4 Information in Shared System Resources __________________________________ 114

28.4 SC-5 Denial-of-Service Protection (DoS) ________________________________________ 115

28.5 SC-7 Boundary Protection ___________________________________________________ 115

28.6 SC-8 Transmission Confidentiality and Integrity _________________________________ 116

28.7 SC-10 Network Disconnect ___________________________________________________ 117

28.8 SC-12 Cryptographic Key Establishment and Management _______________________ 117

28.9 SC-13 Cryptography Protection _______________________________________________ 118

28.10 SC-15 Collaborative Computing Devices and Applications _______________________ 118

28.11 SC-17 Public Key Infrastructure (PKI) Certificates _____________________________ 118

28.12 SC-18 Mobile Code ________________________________________________________ 119

28.13 SC-19 Voice over Internet Protocol (VoIP) _____________________________________ 119

28.14 SC-20 Secure Name/Address Resolution Services (Authoritative Source) ___________ 120

28.15 SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) ____ 120

28.16 SC-22 Architecture and Provisioning for Name/Address Resolution Service _________ 121

28.17 SC-23 Session Authenticity __________________________________________________ 121

28.18 SC-28 Protection of Information at Rest _______________________________________ 121

28.19 SC-39 Process Isolation _____________________________________________________ 122

29.0 System and Information Integrity (SI) ___________________________________________ 123

29.1 SI-1 System and Information Integrity Policy and Procedures ______________________ 123

29.2 SI-2 Flaw Remediation ______________________________________________________ 123

29.3 SI-3 Malicious Code Protection _______________________________________________ 124

29.3.1 Email Security _________________________________________________________ 125

29.4 SI-4 System Monitoring _____________________________________________________ 126

29.5 SI-5 Security Alerts, Advisories, and Directives __________________________________ 127

29.6 SI-7 Software Firmware, and Information Integrity ______________________________ 127

29.7 SI-8 Spam Protection _______________________________________________________ 128

29.8 SI-10 Information Input Validation ___________________________________________ 128

29.9 SI-11 Error Handling _______________________________________________________ 128

29.10 SI-12 Information Management, Retention, and Information Disposal ______________ 128

29.11 SI-16 Memory Protection ___________________________________________________ 129

30.0 Supply Chain Risk Management (SR) ___________________________________________ 130

30.1 SR-1 Supply Chain Risk Management Policy and Procedures ______________________ 130

30.2 SR-2 Supply Chain Risk Management Plan _____________________________________ 130

30.3 SR-3 Supply Chain Controls and Processes _____________________________________ 131

30.4 SR-5 Acquisition Strategies, Tools, and Methods _________________________________ 131

30.5 SR-6 Supplier Assessments and Reviews _______________________________________ 132

30.6 SR-8 Notification Agreements ________________________________________________ 132

30.7 SR-10 Inspection of Systems or Components ____________________________________ 132

30.8 SR-11 Component Authenticity _______________________________________________ 133

30.9 SR-12 Component Disposal __________________________________________________ 133

31.0 Privacy ____________________________________________________________________ 134

32.0 Termination of Contract ______________________________________________________ 137

32.1 Destruction or Return of SBU data ____________________________________________ 137

33.0 Taxpayer Browsing Protection Act of 1997 and Unauthorized Access and Disclosures ___ 139

Exhibit 1 Legal Requirements _____________________________________________________ 140

IRC Section 7213 Unauthorized Disclosure of Information ____________________________ 140 Federal Employees __________________________________________________________ 140 Other Persons ______________________________________________________________ 140 Solicitation _________________________________________________________________ 140

Section 7213A Unauthorized Inspection of Returns or Return Information ______________ 140 Federal Employees and Other Persons __________________________________________ 140

Exhibit 2 Taxpayer Browsing Protection Act _________________________________________ 142

IRC Section 7431 Civil Damages for Unauthorized Inspection or Disclosure of Returns and Return Information. ____________________________________________________________ 142

Inspection or Disclosure by a Person Who is Not an Employee of the United States _____ 142 Damages ___________________________________________________________________ 142 Definitions _________________________________________________________________ 142

Appendix A: Acronyms __________________________________________________________ 143

Appendix B: Glossary ____________________________________________________________ 146

Appendix C: Security Control Levels _______________________________________________ 158

Figure 1 Security Control Level High Water Mark ___________________________________ 159

Table 5: Security Controls Table _________________________________________________ 160

Appendix D: Physical Access Control Guidelines _____________________________________ 166 Table 4: Protection Alternative Chart __________________________________________ 168

Appendix E: New OMB & FAR Privacy Contract Requirements ________________________ 180

OMB M-17-12 _________________________________________________________________ 180

Subpart 24.3 of the Federal Acquisition Regulations require ___________________________ 180

Appendix F: Reference ___________________________________________________________ 182

1.0 Background

The E-Government Act of 2002 (Public Law 107-347) Title III, Federal Information Security Management Act (FISMA) of 2002, as amended by Federal Information Security Modernization Act of 2014 (Public Law 113-283), requires each agency to provide security and privacy protection for “information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source”. FISMA requires federal agencies to develop and implement policies for information security oversight of contractors and other users with access to federal information and information systems.

To ensure FISMA compliance, the National Institute of Standards and Technology (NIST) identifies specific security and privacy controls/criteria in NIST Special Publication (SP) 800- 53 Revision 5, Security and Privacy Controls for Federal Information Systems and Organizations. NIST provides a series of recommended security and privacy controls to be employed by agencies and service providers to ensure the confidentiality, integrity, and availability of federal information and information systems and guidelines for effective security controls that support federal operations and assets.

Because of requirements distinct to IRS mission objectives, as well as specific laws or rulings, such as 26 U.S.C § 6103, the Gramm-Leach Bliley (GLB) Act, the Federal Trade Commission (FTC) Financial Privacy Rule and Safeguards Rule, and the Sarbanes-Oxley Act, IRS contractors, their affiliates, subcontractors, and service providers are subject to additional requirements for protecting information and information systems, when appropriate or applicable.

When entering into a contract with the IRS the contractor agrees to allow the IRS access to their site within 24 hours of notification by the Contracting Officer’s Representative (COR) or Contracting Officer (CO). Failure to allow access is considered a breach of contract terms and conditions, which could result in termination of the contract or assessment of liquidated damages as agreed to within FAR clause 52.211-11 -- Liquidated Damages -- Supplies, Services, or Research and Development (Sept 2000).

In signing a contract, the contractor agrees to provide the COR an updated Plan of Actions & Milestones (POA&M) for any open findings identified during an on-site or virtual assessment conducted by the IRS at a minimum quarterly. Failure to provide a POA&M to demonstrate how the contractor is addressing risks is considered to be a breach of contract terms and conditions, which will result in the COR withholding invoice approval until a POA&M is provided.

Refer to CA-5 (Plan of Actions and Milestones) and RA-5 (Vulnerability Monitoring and Scanning) for additional details on POA&M and Vulnerability Scan reporting requirements.

https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf http://www.gpo.gov/fdsys/pkg/FR-2000-03-01/pdf/00-4881.pdf http://www.gpo.gov/fdsys/pkg/FR-2000-03-01/pdf/00-4881.pdf http://www.gpo.gov/fdsys/pkg/FR-2000-03-01/pdf/00-4881.pdf

2.0 Purpose

This publication defines basic security and privacy controls, requirements and standards that apply to contractors, subcontractors, contractor employees, and subcontractor employees supporting the primary contract. The information in this publication is based on the security and privacy controls framework under NIST SP 800-53 Rev. 5, where those contractor employees have access to develop, operate, or maintain IRS SBU data. While NIST SP 800-53 Rev. 5, is a general guide, the intent of Publication 4812 is to provide IRS privacy and security requirements specific to the IRS contracting environment.

This publication also describes the framework and general processes for conducting security assessments and responsibilities of the Government and the contractor in implementing security controls and safeguards to protect IRS SBU data and information systems.

As described in NIST SP 800-53 Rev. 5, “The ultimate objective is to conduct the day-to-day operations of the organization and to accomplish the organization’s stated missions and business functions with what Office of Management & Budget (OMB) Circular A-130 defines as adequate security, or security commensurate with risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information”.

3.0 Scope

The requirements in this publication and the security and privacy controls contained hereinafter are based on NIST SP 800-53 Rev. 5.

3.1. IRS Security and Privacy Controls Structure

NIST provides Federal agencies the flexibility to apply the privacy and security concepts and principles in NIST SP 800-53 Rev. 5 within the context of, and with due consideration to, each agency’s mission, business functions, and environments of operation.

As part of its information security program, the IRS identifies security and privacy controls for the organization’s information and information systems in the following three key documents:

• Internal Revenue Manual (IRM) 10.8.1 – Information Technology (IT) Security, Policy and Guidance (The public document is redacted.),

• IRM 10.5.1 – Privacy and Information Protection, Privacy Policy (publicly available), and

• Publication 4812 – Contractor Security & Privacy Controls.

While IRM 10.8.1 and Publication 4812 are both based on NIST SP 800-53 Rev. 5, they apply to different operating environments – internal and external to the IRS respectively and vary greatly in the level of direct control the agency has over the host’s, or service provider’s normal business operations.

3.1.1 IRM 10.8.1 Applicability

IRM 10.8.1 provides overall security control guidance for the IRS, and uniform policies and procedures to be used by each office, or business operating division, and functional unit within the IRS that uses IRS information systems. This manual applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, who have access to, and/or use or operate IRS information systems containing IRS information at facilities controlled by IRS. Beyond appropriate references to the manual, IRM 10.8.1 is outside of the scope of Publication 4812. and contractors who need to refer to that document for guidance may access it at (https://www.irs.gov/irm/part10/irm_10-008-001r)

3.1.2 IRM 10.5.1 Applicability

IRM 10.5.1 defines the uniform policies used by IRS personnel and organizations to carry out their responsibilities related to privacy. The IRM establishes the minimum baseline privacy policy and requirements for all IRS SBU data (including PII and FTI). It applies to all offices, business, operating, and functional units within the IRS. It also applies to all IRS personnel, which this IRM defines as including the following categories: individuals and organizations having contractual arrangements with the IRS, including employees, seasonal/temporary employees, interns, detailed individuals, contractors, subcontractors, non-IRS-procured https://www.irs.gov/irm/part10/irm_10-008-001r.html https://www.irs.gov/irm/part10/irm_10-008-001r.html https://www.irs.gov/irm/part10/irm_10-005-001 https://www.irs.gov/pub/irs-pdf/p4812.pdf https://www.irs.gov/irm/part10/irm_10-008-001r contractors, vendors, and outsourcing providers, with any access to SBU data. Contractors who need to refer to that document for guidance may access it at:

(https://www.irs.gov/irm/part10/irm_10-005-001)

3.1.3 Publication 4812 Applicability

Publication 4812 identifies security and privacy controls specific to IRS contractor’s information systems. These controls are based on controls established in NIST SP 800-53 Rev.

5. Publication 4812 contains IRS-specific requirements that meet the standard for NIST SP 800-53 Rev. 5, and the security and privacy controls, requirements, and standards described herein are to be used in lieu of the common, at-large security control standards enumerated in NIST SP 800-53 Rev. 5. Contractors may, at their discretion, refer to NIST SP 800-53 Rev. 5, to gain a better understanding of the common standards, but shall coordinate with the COR for their contract for clarification on Publication 4812 security and privacy controls/standards or guidance/requirements specific to IRS.

Note: ( All NIST Special Publication (800 series) are available at the following web site -https://csrc.nist.gov/publications/sp800.)

Publication 4812 defines basic security and privacy controls, requirements, and standards required of contractors, subcontractors, contractor employees, and subcontractor employees, in which contractors and contractor employees (or subcontractors and subcontractor employees) will either:

• Have information systems for tax administration purposes (or provide related services) outside of IRS facilities or outside of the direct control of the Service; and/or

• Have access to, compile, process, or store IRS SBU data on their own information systems or that of a subcontractor, or third-party service provider, that use their own information systems (or that of others) and EIT (as defined in FAR Part 2) to access, compile, process, or store IRS SBU data while working at an IRS owned or controlled facility.

Publication 4812 is incorporated by contract clause into IRS contracts, agreements, and/or task orders (directly or through flow down provisions to subcontractors). IRS IT Security/FISMA requirements language is also included in any solicitations/contracts or orders (directly or through flow down provisions) for IT acquisitions, which include IT hardware and/or software, telecommunications software or equipment, and maintenance/service (including consulting services) on any hardware and/or software products. The most up-to-date Publication 4812 is applicable to the contractor and is available on the IRS public website.

As used in this publication, the term “contract” unless specified otherwise, includes contracts, task/delivery/purchase orders, blanket purchase agreements, and interagency agreements in which IRS is the servicing agency and contractor services and resources, equipment, and systems are being used to support the contract, order, or agreement. This publication may also be used and incorporated into interagency agreements in which IRS is the requesting agency and the servicing agency does not have guidelines (or security controls consistent with NIST SP 800-53 Rev. 5 in place comparable to Publication 4812).

https://www.irs.gov/irm/part10/irm_10-005-001 https://csrc.nist.gov/publications/sp800

As described in greater detail in subsequent sections, there are two baseline levels of security controls, networked environments, and software development. The specific security and privacy controls associated with each control level can be found in Publication 4812, Section 8.4, and Appendix C. The use of baseline levels of security and privacy controls notwithstanding, IRS always reserves the right to add other controls to any given contract, order, or agreement to protect its assets based on the work being performed, the environment in which the work is being performed, perceived risks (threats and vulnerabilities), the suitability and effectiveness of existing controls, and other factors, as appropriate, in the best interest of the Government.

Publication 4812 also describes the framework and general processes for conducting contractor security assessments to monitor compliance and assess the effectiveness of security and privacy controls applicable to any given contracting action subject to Publication 4812.

4.0 SBU Data

The IRS defines Sensitive But Unclassified Information (SBU) Data in IRM 10.5.1.2 as; “any information which, if lost, stolen, misused, accessed or altered without proper authorization, may adversely affect the national interest or the conduct of federal programs (including IRS operations), or the privacy which individuals are entitled under the Privacy Act” (5 U.S.C.

552a).

SBU data includes but is not necessarily limited to:

• Federal Tax Information (FTI), Personally Identifiable Information (PII), Protected Health Information (PHI), procurement sensitive information, system vulnerabilities, case selection methodologies, systems information, enforcement procedures, investigation information.

• Live data, which is defined as production data in use. Live means that when changing the data, it changes in production. The data may be extracted for testing, development, etc., in which case, it is no longer live. Live data often contains SBU data.

Access to SBU data shall be provided on a “need to know” basis. SBU data shall never be indiscriminately disseminated, and no person shall be given access to (or allowed to retain) more SBU data than is needed for performance of their duties, and for which that individual has been authorized to receive as a result of having been successfully investigated, adjudicated, and trained to receive, and what is strictly necessary to accomplish the intended business purpose and mission.

SBU data shall only be released or accessible via access to information systems to those individuals who have been approved for interim/final staff-like access by IRS Personnel Security (see definition of staff-like access in Appendix B). Additionally, they should have a "need to know" to perform the work required under the contract.

SBU shall be categorized in one or more of the following groups:

• Federal Tax Information (FTI)

• Law Enforcement Sensitive (LES) Information,

• Employee information,

• PII, and

• Other protected information.

4.1 Returns and Return Information

Returns and return information includes all information covered by § 6103 of the IRC, 26 U.S.C. § 6103. This includes tax returns and return information as defined by IRC, 26 U.S.C.

§ 6103(b).

4.2 Law Enforcement Sensitive (LES) Information

Law enforcement data is often sensitive in nature. This data falls under the data category called Law Enforcement, which includes grand jury, informant, and undercover operations information and procedural guidance.

4.3 Employee Information

All employee information covered by the Section 552a of Title 5, United States Code (USC) (5 U.S.C. 552A). Examples include personnel, payroll, job applications, disciplinary actions, performance appraisals, drug tests, health exams, and evaluation data.

4.4 Personally Identifiable Information (PII)

As defined in OMB Circular A-130: “Personally Identifiable Information” is information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.

Since there are many different types of information that can be used to distinguish or trace an individual’s identity, the term PII is necessarily broad. To determine whether information is PII, the agency shall perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available – in any medium and from any source – that would make it possible to identify an individual.

4.5 Other Protected Information

Other protected information includes any knowledge or facts received or created by the IRS in support of IRS work. This includes all information covered by the Trade Secrets Act, the Procurement Integrity Act, and similar statutes. Examples include, but are not limited to:

• Records about individuals requiring protection under the Privacy Act;

• Information that is not releasable under the Freedom of Information Act (FOIA);

• Proprietary data;

• Procurement sensitive data, such as vendor contract proposals;

• Information, which if modified, destroyed, or disclosed in an unauthorized manner could cause: loss of life, loss of property, or funds by unlawful means, violation of personal privacy or civil rights, gaining of an unfair procurement advantage by contractors bidding on government contracts, or disclosure of proprietary information entrusted to the Government;

• Information related to the design and development of application source code;

• For contracting organizations providing IT support to the IRS, this includes specific IT configurations, where the information system security configurations could identify the state of security of that information system; Internet Protocol (IP) addresses that allow the workstations and servers to be potentially targeted and exploited; and source code http://www.justice.gov/opcl/privacy-act-1974 http://www.justice.gov/opcl/privacy-act-1974 that reveals IRS processes that could be exploited to harm IRS programs, employees or taxpayers;

• Security information containing details of serious weaknesses and vulnerabilities associated with specific information systems and/or facilities;

• Any information, which if improperly used or disclosed could adversely affect the ability of the agency to accomplish its mission; and

• Information that would disclose techniques or procedures within the IRS not necessarily known to the public.

5.0 Information and Information Systems

Information requires protection whether or not it resides on an information system.

Per OMB Circular A-130 (Section 6, Paragraph j), the definition of Information is as follows:

The term "information" means any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual forms.

Information System, as defined by OMB Circular A-130, means “a discrete set of information resources organized for the collection, processing, maintenance, transmission, and dissemination of information, in accordance with defined procedures, whether automated or manual.”

In all instances, security and privacy controls apply to both information and information systems.

6.0 Unauthorized Access (UNAX) and Disclosure of Information

IRC Section 26 U.S.C. § 7213A makes the unauthorized inspection of returns and return information a misdemeanor punishable by fines, imprisonment, or both. IRC Section 26 U.S.C. § 7431 allows for civil damages for unauthorized inspection or disclosure of returns and return information, and upon conviction, the notification to the taxpayer that an unauthorized inspection or disclosure has occurred.

Disclosure of returns and return information is generally prohibited unless authorized by statute. Returns and return information are defined by IRC, 26 U.S.C. § 6103(b). The IRC makes the confidential relationship between the taxpayer and the IRS quite clear, and stresses the importance of this relationship by making it a crime to violate this confidence. Designed to protect the privacy of taxpayers, IRC Section 26 U.S.C. § 7213 prescribes criminal penalties for contractors and their employees who make unauthorized disclosures of returns and return information. The sanctions of the IRC are designed to protect the privacy of taxpayers.

IRC Section 26 U.S.C. § 6103 (n) gives the contractor the authority to disclose returns and return information to its employees whose duties or responsibilities require the returns and return information for a purpose described in paragraph (a) of the section. Prior to releasing any returns and return information to a subcontractor, the contractor must have written authorization from the IRS.

Contractors and subcontractors shall have adequate programs in place to protect the information received from unauthorized use, access, and disclosure. The contractor’s programs for protecting information received must include documented notification to employees and subcontractors (at any tier) regarding, the importance of protecting returns and return information. The documented notification must also include the disclosure restrictions that apply and the criminal or civil sanctions, penalties or punishments that may be imposed for unauthorized disclosure or inspection. Disclosure practices and the safeguards used to protect the confidentiality of information entrusted to the Government, as provided under the IRC are subject to continual assessment and oversight to ensure their adequacy and efficacy.

http://www.gpo.gov/fdsys/pkg/USCODE-2011-title26/html/USCODE-2011-title26-subtitleF-chap75-subchapA-partI-sec7213A.htm https://www.gpo.gov/fdsys/granule/USCODE-2010-title26/USCODE-2010-title26-subtitleF-chap76-subchapB-sec7431 https://www.gpo.gov/fdsys/granule/USCODE-2010-title26/USCODE-2010-title26-subtitleF-chap76-subchapB-sec7431 http://www.gpo.gov/fdsys/pkg/USCODE-2010-title26/html/USCODE-2010-title26-subtitleF-chap75-subchapA-partI-sec7213.htm http://www.gpo.gov/fdsys/pkg/USCODE-2010-title26/html/USCODE-2010-title26-subtitleF-chap75-subchapA-partI-sec7213.htm http://www.gpo.gov/fdsys/pkg/USCODE-2010-title26/html/USCODE-2010-title26-subtitleF-chap75-subchapA-partI-sec7213.htm http://www.gpo.gov/fdsys/pkg/USCODE-2011-title26/html/USCODE-2011-title26-subtitleF-chap61-subchapB-sec6103.htm

7.0 Roles and Responsibilities

The following sections define roles and responsibilities in the contractor assessment process.

7.1 Government

7.1.1 Contracting Officer (CO)

• Enforces the Government’s rights and remedies for all contractual matters.

• Ensures compliance with the terms and conditions of the contract.

• Ensures appropriate privacy and security-related clauses and language are included in applicable contracts with assistance from requiring activity and CSA.

• Ensures the contractor affords the Government access to the contractor’s facilities, installations, operations, documentation, records, IT systems, and databases to carry out a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, and availability of government data. The Government shall perform inspections and tests in a manner that shall not unduly delay the work.

• Employs all rights and remedies available to the Government to ensure contractors correct or mitigate identified security vulnerabilities.

• Modifies the contract, when risk level requires modification, based upon Cybersecurity recommendations.

• Assists with reporting and mitigation of incidents as appropriate. (See section 18.6 IR-6 Incident Reporting.)

7.1.2 Contracting Officer’s Representative (COR)

• Facilitates CSAs and serves as the liaison between the CSA Team and the contractor when scheduling CSAs and by being the primary IRS focal point for the contractor.

• Escalates key information to the CO related to contractor risk.

• Provides at a minimum quarterly status of all related the Plan of Actions…