J.25 FAA Order 1370.121B - FAA Information Security and Privacy Policy.pdf

Distribution: Electronic Initiated By: AIS-1

U.S. DEPARTMENT OF TRANSPORTATION

FEDERAL AVIATION ADMINISTRATION

ORDER

1370.121B

National Policy Effective date:

04/25/2022

SUBJ: FAA Information Security and Privacy: Policy

The Federal Aviation Administration (FAA) maintains information and systems that support the

Agency’s mission to provide the safest, most efficient aerospace system in the world. The

Federal Information Security Modernization Act of 2014 (FISMA) and Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource, require that the FAA protect the confidentiality, integrity, and availability of all FAA information and systems. This Order defines the FAA Information Security and Privacy Policy.

This Order updates and supersedes FAA Order 1370.121A, FAA Information Security and

Privacy Program and Policy, signed on November 3, 2020. Through this FAA Order 1370.121B, the FAA establishes the FAA Information Security and Privacy: Policy and authorizes the FAA

Chief Information Security Officer (CISO) to issue supplemental implementing directives containing the requirements necessary to comply with this Order. Such supplemental implementing directives have the full force and effect of this Order.

The FAA CISO, with the concurrence of the FAA Chief Information Officer (CIO), the FAA

Chief Counsel (AGC-1), and the Cybersecurity Steering Committee (CSC), will issue additional information security and privacy policies, guidance, standards, processes, and procedures. This

Order, in conjunction with the supplemental implementing directives, specifies the FAA-wide minimum information security and privacy requirements for all FAA organizations, systems, and users of those systems.

Billy Nolen

Acting Administrator

04/25/2022 1370.121B

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

1. Purpose of this Order

a. The Federal Aviation Administration (FAA) establishes this FAA Order 1370.121B, FAA

Information Security and Privacy: Policy, as the core policy for FAA information security and privacy and authorizes the FAA Chief Information Security Officer (CISO) to issue supplemental implementing directives developed for the unique FAA Information Security and

Privacy Programs in a manner consistent with applicable law and policies, including, but not limited to, the Federal Information Security Modernization Act (FISMA) 2014, Office of

Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource, and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations.

b. This Order establishes and governs the FAA’s information security and privacy policy and assigns organizational, management, and user responsibilities to develop, direct, and facilitate the consistent implementation of tailored FAA information security and privacy programs across all FAA organizations and systems.

c. This Order establishes the FAA’s Information Security and Privacy Programs.

(1) The FAA Information Security Program has oversight responsibility for information security controls for FAA information systems and FAA organizations, as well as for other information systems and organizations to the extent covered by the scope of applicability described in section 2 of this Order, to protect FAA operations and assets, individuals, other organizations, and the United States from threats and risks, including, but not limited to, hostile attacks, human errors, natural disasters, structural failures, and foreign intelligence entities. The

FAA Information Security Program’s mission is to oversee an FAA-wide process to manage risks to systems and information. The FAA information security and privacy controls address unique FAA diverse requirements derived from FAA mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines.

(2) The FAA Privacy Program is responsible for compliance with applicable privacy requirements and for managing the risks to individuals associated with the creation, collection, use, processing, dissemination, storage, maintenance, disclosure, or disposal (collectively referred to as “processing”) of Personally Identifiable Information (PII) under the Privacy Act.

d. The intent of this Order is to comply with the applicable Department of Transportation

(DOT) information security and privacy policy. If FAA policy and applicable DOT policy conflict with respect to matters within the scope of this Order, the FAA policy takes precedence.

The DOT CISO is a member of the Cybersecurity Steering Committee (CSC), and in cases where disagreements between the FAA and DOT policy cannot be resolved, the FAA CISO will take the issue to the FAA CIO and CSC for resolution and will consult with the Chief Counsel

(AGC-1) or AGC-1’s designee.

2. Scope of Applicability

a. This Order applies to the following individuals and entities, either directly through government employment, a contract, other agreement, or other applicable law or policy:

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

(1) All FAA organizations, systems, services, data, information, networks, Federal employees, interns, detailees, and any person accessing FAA systems or information.

(2) System Owners, program managers, and employees and contractors with information technology (IT), information security, and privacy responsibilities for the operation, maintenance, and protection of the FAA’s information and systems or sharing of the FAA’s information.

(3) Contractors, sub-contractors, and grant and sub-grant recipients, to the extent defined in underlying contracts and grants.

(4) Any person or entity having a written agreement with the FAA as a service provider or involving access to, use of, management of, or oversight of FAA systems or information.

(5) FAA systems and contractor systems with a written agreement that operate on behalf of the FAA that collect, store, process, send, receive or dispose of FAA information.

(6) Any person or entity having a written agreement with the FAA involving access to, use of, management of, or oversight of FAA systems or information.

(7) National Airspace System (NAS), mission support, administrative, prototype, Research and Development, operational and administrative network systems funded by the FAA or connected to FAA networks.

(8) Cloud Service Providers having a written agreement with the FAA that:

(a) Host FAA systems;

(b) Collect, store, process, send, receive, or dispose of FAA information; or

(c) Provide services or support to the FAA or to other FAA systems.

b. This Order does not apply to members of the public when they access information on

FAA’s public-facing websites.

3. Where Can I Find this Order?

a. This Order is available on the FAA Orders and Notices website. The supplemental implementing directives are located on the FAA Enterprise Cybersecurity Governance

Distribution SharePoint Online site.

b. Address all questions or comments on this Order to 9-AWA-AIT-AIS-Intake@faa.gov.

4. What this Order Cancels

This Order and its supplemental implementing directives cancel and supersede FAA Order

1370.121A, signed on November 3, 2020.

https://employees.faa.gov/tools_resources/orders_notices/ https://usfaa.sharepoint.com/:f:/r/sites/AIT-AISCyberSecurityPolicy/Shared%20Documents/FAA%20Distribution/FAA%20Order%201370.121B%20and%20Implementing%20Dircetives?csf=1&web=1&e=A9hfzR https://usfaa.sharepoint.com/:f:/r/sites/AIT-AISCyberSecurityPolicy/Shared%20Documents/FAA%20Distribution/FAA%20Order%201370.121B%20and%20Implementing%20Dircetives?csf=1&web=1&e=A9hfzR mailto:9-AWA-AIT-AIS-Intake@faa.gov

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

5. Explanation of Policy Changes

a. Due to the ever-changing information security and privacy landscape, it is necessary for the FAA to have the flexibility to respond quickly to cyber threats, risks, and technological, legal, and policy changes and to update the FAA’s Information Security and Privacy Policies easily.

b. This Order restructures and updates, where necessary, the content previously contained in

FAA Order 1370.121A into this Order and several supplemental implementing directives, as defined in Section 8, Policy. This Order delegates to the FAA CISO the authority and responsibility to oversee the implementation of this Order and to develop, issue, and update the associated supplemental implementing directives as necessary.

c. The restructuring of FAA Order 1370.121 allows further efficient and expeditious updating in response to changing cyber threats, risks, technologies, laws, and policies, as well as modular updating of the various supplemental implementing directives.

d. The FAA CISO will incorporate implementing requirements of new Federal law and policies applicable to the FAA that are issued after the signing of this Order, in FAA supplemental implementing directives, as appropriate. The CISO is authorized to release official interim policy memoranda as necessary and in accordance with applicable Federal law and policy until a new or updated supplemental implementing directive is approved.

6. Effective Date

This Order is effective upon signature by the FAA Administrator. The supplemental implementing directives become effective upon the signature of the FAA CISO, with the concurrence of the FAA CIO, the FAA Chief Counsel, and the CSC members.

7. Distribution

The FAA intends to widely distribute this Order to all FAA Lines of Business (LOBs), Staff

Offices (SOs), organizations, and facilities. The FAA will also make this Order and all applicable supplemental implementing directives available to individuals and entities described in section 2.a. of this Order in a manner consistent with FAA Order 1600.75, Protecting

Sensitive Unclassified Information (SUI). This Order and all supplemental implementing directives will be available in electronic form only.

8. Policy

a. The FAA Administrator establishes this Order, FAA Information Security and Privacy:

Policy, as the overarching FAA Information Security and Privacy Policy. It authorizes the FAA

CISO, as delegated by the CIO, to establish and implement FAA Information Security and

Privacy Programs tailored to the FAA’s unique responsibilities and to issue supplemental implementing directives setting forth in more detail the FAA-wide minimum information security and privacy requirements for all FAA organizations, systems, and users of those systems. All supplemental implementing directives have the full force and effect of this Order.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

b. This Order assigns organizational, managerial, and user responsibilities for the FAA

Information Security and Privacy Programs, consistent with applicable Federal law and policies, including but not limited to the references identified in this Order.

c. This Order, FAA Information Security and Privacy: Policy, establishes the core management policies and responsibilities for FAA’s Information Security and Privacy Programs.

This Order also includes the following supplemental implementing directives, which have the full force and effect of this Order, as well as any subsequent supplemental implementing directives the FAA CISO issues.

(1) The FAA Information Security and Privacy: Governance supplemental implementing directive defines requirements and operational measures for the FAA Information Security and

Privacy Programs by identifying the roles and responsibilities for carrying out the FAA

Information Security and Privacy Programs and protecting the confidentiality, integrity, and availability of FAA systems and information.

(2) The FAA Information Security and Privacy: FAA Implementation of NIST Controls supplemental implementing directive defines the baseline set of NIST SP 800-53, Revision 5, security and privacy controls for all FAA organizations and systems.

(3) The FAA Information Security and Privacy: FAA Supplemental Security Controls supplemental implementing directive defines supplemental requirements for specific technologies or subjects that are not addressed in NIST 800-53, Revision 5, controls or for which the FAA has determined additional security controls are necessary.

(4) The FAA Information Security and Privacy: User Responsibilities and Obligations supplemental implementing directive defines policies and requirements that apply to users of

FAA systems and information.

(5) The FAA Information Security and Privacy: Protection of Sensitive Unclassified

Information (SUI) on Federal and non-Federal Information Systems and Services by External

Entities supplemental implementing directive defines the information protection requirements for non-Federal entities which receive, use, process, store, or transmit, under a written agreement with the FAA, FAA information that the FAA considers Controlled Unclassified Information

(CUI) or Sensitive Unclassified Information (SUI).

d. The FAA CISO is authorized to develop, issue, and update, as necessary (with the concurrence of the CSC, the FAA CIO, and FAA Chief Counsel), additional FAA Information

Security and Privacy supplemental implementing directives to address the needs of the Agency and to fulfill the FAA’s information security and privacy obligations. If disagreements between the CSC and DOT cannot be resolved within the CSC, the FAA CISO will consult with the FAA

CIO and Chief Counsel (AGC-1) or AGC-1’s designee. However, with respect to matters within the scope of this Order, the FAA position takes precedence.

e. The FAA Office of Information Systems Security (AIS) must review all supplemental implementing directives at least annually, in coordination with affected LOBs/SOs and AGC.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

f. This Order and the supplemental implementing directives delineate the minimum FAA-wide requirements with which all FAA organizations must comply. Organizations and System

Owners may impose more restrictive requirements that do not conflict with this Order to the extent consistent with applicable law and policies.

g. This Order will be reviewed at least every three (3) years and updated as necessary.

Relevant portions of this Order must also be reviewed for corresponding changes or updates when making updates or changes to supplemental implementing directives.

h. When the FAA CISO issues an interim policy memorandum or changes occur to any of the information security and privacy supplemental implementing directives issued under this

Order, the FAA CISO will notify affected individuals and organizations within ten (10) business days of signature of the relevant interim policy memorandum or revised supplemental implementing directive, as applicable.

i. The CSC must develop and document a process to provide all FAA offices having equity in the supplemental implementing directives with an opportunity to participate in the development of, review of, and comment on proposed changes.

j. Authorizing Officials (AOs) may tailor the NIST information security controls in the

FAA Information Security and Privacy: FAA Implementation of NIST Controls supplemental implementing directive to support their mission or business needs, to the extent consistent with applicable law and policies. Tailoring must meet minimum FAA requirements.

k. All FAA employees, contractors, and other users who are authorized to access non-public

FAA systems must initially and annually thereafter:

(1) Complete all mandatory and assigned information security and privacy training within the designated timeframes.

(2) Acknowledge, agree to, and comply with the FAA Rules of Behavior (ROB), contained in the FAA Information Security and Privacy: User Responsibilities and Obligations supplemental implementing directive, regardless of where they are working.

l. All FAA-owned and contracted systems must:

(1) Have a defined security authorization boundary for their systems and all interconnections with other systems.

(2) Maintain all FAA-required information security and privacy documentation.

(3) Have a security and privacy assessment completed within the established authorization schedule.

(4) Have an Authority to Operate prior to going into production in the FAA environment, and maintain the authority to operate throughout the lifecycle of the system.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

m. All commercial-off-the-shelf software (COTS) must be vetted and approved by the FAA

Enterprise Software Board for use prior to being installed in the FAA production environment.

n. Prior to being placed into service in the FAA production environment, all FAA or contractor-developed software must be:

(1) Thoroughly scanned for vulnerabilities and malicious code;

(2) Have all critical and high vulnerabilities remediated; and,

(3) Receive approval from the applicable AO.

o. For all FAA systems and applications that are considered cloud suitable or will be redesigned to be cloud suitable, the System Owner must fully utilize the FAA Cloud Service

(FCS) environment. All systems and services placed in the FCS environment must continue to maintain the security posture of the system or service, as required by this Order, its supplemental implementing directives, and other applicable law and policies, and continue to maintain an

Authority to Operate. The AO must not approve the use of any non-FCS without prior FAA CIO approval for the use of the non-FCS environment.

p. All commercial cloud-based services [e.g., Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)]:

(1) That:

(a) Host an FAA system, application, database, virtual environment, or other digital component;

(b) Support or provide a service to an FAA system, application, or organization; or

(c) Create, use, process, transmit, or store FAA data;

(2) Must:

(a) Have and maintain a Federal Risk and Authorization Management Program

(FedRAMP) authorization throughout the cloud service lifecycle while in use by the FAA;

(b) Have the customer controls assessed by the using FAA organization;

(c) Have an FAA Authority to Operate signed by the authorizing official of the using organization prior to going into production in the FAA environment, and maintain the FAA

Authority to Operate throughout the lifecycle of the cloud service while in use at the FAA. The

Authority to Operate for enterprise-wide cloud services must be signed by the FAA CIO after determining, based upon an appropriate assessment, that the relevant enterprise-wide cloud service meets all applicable requirements.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

q. The use of production data in a test, development, training, or laboratory environment must:

(1) Be included in the system authorization boundary and be documented in the System

Security Plan for the system.

(2) Provide the same or an equivalent level of protection as the production environment in the test, development, training, and laboratory environments, as applicable.

(3) De-identify all PII so that the information can no longer be traced to an individual.

r. A written agreement is required for network systems funded by the FAA, or connected to

FAA networks but not owned and operated directly by the FAA that sets forth FAA ownership and control of information, as well as other applicable information security and privacy requirements consistent with this Order and applicable implementing directives.

s. While this Order becomes effective immediately, the FAA recognizes that bringing systems into compliance with the policies contained in this Order and the supplemental implementing directives will require time and resources. System Owners are responsible for planning and providing the necessary resources to become compliant with this Order and the supplemental implementing directives. System Owners must implement this Order and the supplemental implementing directives as soon as possible, but not later than two years from the effective date of this Order. New and updated policies will specify their implementation time frame requirements.

t. However, AOs must align their written information security and privacy policies with this Order and applicable supplemental implementing directives within one year of the effective date of this Order.

9. Non-Compliance and Deviations

a. If an organization or system cannot comply with this Order or any of the supplemental implementing directives for valid business or technical reasons within two years of the date of signature of this Order, the relevant supplemental implementing directive, or relevant revision to either of the foregoing, the organization or System Owner must seek a waiver through the established FAA waiver process, as set forth in the FAA Security and Privacy: Governance supplementing implementing directive in Section 8. Non-Compliance and Deviations.

b. All organizations and systems that are granted a waiver must bring the organization or system, as applicable, into compliance with FAA policy prior to the lapse of the waiver. If the waiver lapses without further waiver, the System Owner must continue to mitigate previously-waived information security requirements and bring the organization or system into compliance with the relevant FAA policy.

c. Waiver requests from this Order or the supplemental implementing directives must be first approved by the relevant Authorizing Official prior to submission to the AIS intake process at 9-AWA-AIT-AIS-Intake@faa.gov.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

d. If a system user cannot comply with this Order and the supplemental implementing directives for valid business or technical reasons, in accordance with the FAA Information

Security and Privacy: User Responsibilities and Obligations implementing directive, Appendix

1, the user’s supervisor or manager must seek a waiver by submitting a request to the AIS intake process at 9-AWA-AIT-AIS-Intake@faa.gov.

e. If the system owner does not comply with this Order or the supplemental implementing directives, the FAA CIO, CISO, and AO, in conjunction with the CSC, may take additional steps to resolve the non-compliance up to and including disconnecting the system from the FAA network.

10. Executive and Senior-level Roles and Responsibilities

a. Protecting the FAA Mission and securing FAA systems, assets, and information requires input, collaboration, communications, and cooperation across FAA executive and senior-level leadership, as well as operational and system-level roles.

b. The executive and senior-level roles that determine the FAA’s risk tolerance and have responsibility for developing, implementing, overseeing, and managing the FAA’s Information

Security and Privacy Policy and Programs are listed below.

c. Additional responsibilities are further defined in the FAA Information Security and

Privacy: Governance supplemental implementing directive.

10.1. FAA Administrator

a. Under FISMA (44 United States Code (U.S.C.) § 3551 et seq.), OMB Circular A-130, and other Federal laws and policies, the head of the Agency is ultimately responsible for the security of Agency systems, networks, information, personnel, and facilities.

b. The Air Traffic Management System Performance Improvement Act, Title II of the

Federal Aviation Reauthorization Act of 1996, Public Law 104–264 (October 9, 1996), codified at 49 U.S.C. § 106(f)(2)(A)(ii) and (D), grants the FAA Administrator the authority to establish the FAA’s own policies relating to the acquisition and maintenance of Agency property, services, and equipment.

c. The FAA Administrator has the overall responsibility to provide information security and privacy protections commensurate with the risk and magnitude of potential harm to FAA operations, assets, individuals, organizations, and the United States. The FAA Administrator establishes appropriate accountability for information security and privacy, and provides active support and oversight to, and monitoring and improvement of, the FAA Information Security and

Privacy Programs.

d. The FAA Administrator provides executive direction, control, and oversight for:

(1) Integrating information security and privacy management processes with strategic and operational planning processes;

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

(2) Overseeing FAA senior officials’ implementation of information security and privacy for the information and systems that support the operations and assets under their control;

(3) Providing a sufficiently trained information security and privacy workforce to assist the Agency in complying with the information security and privacy requirements in applicable law and policies; and

(4) Providing the necessary resources to accomplish the missions of those programs, subject to the availability of appropriated funds.

10.2. FAA Assistant and Associate Administrators, the Chief Operating Officer of the Air

Traffic Organization, and the Chief Counsel

a. The FAA Assistant and Associate Administrators, the Chief Operating Officer of the Air

Traffic Organization, and the Chief Counsel are responsible for their respective organizations’ compliance with the FAA Information Security and Privacy: Policy and all supplemental implementing directives.

b. The Chief Counsel, or AGC-1’s designee, is the sole organization to provide legal advice to the entirety of the FAA on this Policy or the Policy’s interactions with the FAA’s operational, safety, and regulatory missions.

c. Assistant and Associate Administrators, the Chief Operating Officer of the Air Traffic

Organization, and the Chief Counsel may not grant exceptions to the FAA Information Security and Privacy: Policy or implementing directives. Any requests by Assistant and Associate

Administrators, the Chief Operating Officer of the Air Traffic Organization, or the Chief

Counsel for exceptions to this Order and supplemental implementing directives must be addressed through the CSC, in consultation with the Chief Counsel.

10.3. Cybersecurity Steering Committee (CSC)

a. The CSC fulfills the Risk Executive function for the FAA, as defined in NIST SP-800-37, Revision 2, Risk Management Framework for Information Systems and Organizations. The FAA established the CSC function in the Cybersecurity Steering Committee Charter, dated January 9, 2014. This role is an inherently governmental function, and all members must be Federal

Government employees.

b. The CSC is comprised of executives from the Air Traffic Organization (ATO), Nextgen

(ANG), the Office of Finance and Management (AFN), the Office of Security and Hazardous

Materials Safety (ASH), the Office of Aviation Safety (AVS), and the Office of Airports (ARP).

The DOT CISO also is a member of the CSC. The CSC is chaired by the FAA CISO. The Chief

Counsel, or AGC-1’s executive designee, is a mandatory non-voting member of the CSC who will provide counsel and situational awareness of legal concerns to the CSC.

c. The CSC coordinates with FAA senior leadership (e.g., Administrator’s Management

Board and other appropriate senior executives) to provide executive direction, control, and oversight and seeks to ensure the following areas of focus:

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

(1) Authorization decisions by AOs for their respective systems are viewed from an

FAA-wide perspective regarding the overall strategic goals and objectives of the FAA in carrying out its core missions and business functions, as well as other agencies’ interdependencies with the FAA in carrying out their national security, homeland security, and law enforcement missions.

(2) Information system-related security risk management is consistent across the FAA, reflects FAA risk tolerance, and is considered along with other types of risks to:

(a) Provide a comprehensive, FAA-wide, holistic approach for addressing risk, which provides a greater understanding of the integrated operations of the FAA and the Agency’s overall risk management posture.

(b) Provide a mechanism for the authorized sharing and exchange of appropriate information security and privacy information that may be relevant to the FAA’s provision of air navigation services or to its safety oversight and regulatory responsibilities.

(c) Develop and implement an organization-wide risk management strategy that provides a strategic view of information security and privacy risks for the FAA and that guides and informs FAA-wide risk management decisions (including how risk is framed, assessed, responded to, and monitored over time).

(d) Facilitate the sharing of information security and privacy risk-related information among AOs and other senior leaders within the FAA.

(e) Provide oversight for all information security and privacy risk management-related activities across the FAA (e.g., proper security categorization of systems and information) to promote consistent and effective risk mitigation and appropriate consideration of the impact on other systems, the entire FAA infrastructure, and to other agencies that have interdependencies with the FAA in carrying out their national security, homeland security, and law enforcement missions in making risk acceptance decisions.

(f) Provide guidance on security authorization decisions for systems, including consideration of all factors necessary for mission and business success.

(g) Provide an FAA-wide forum to consider all sources of risk (including aggregated risk) to organizational operations and assets, individuals, other organizations, and the United

States.

(h) Promote cooperation, communication, and collaboration among AOs, to include authorization actions requiring shared responsibility (e.g., joint authorizations).

(i) Appropriately coordinate shared responsibilities for supporting organizational missions and business functions that use external providers of information and services, or share information outside the FAA so that they receive the required visibility, and elevate matters to the appropriate decision-making authorities, as necessary.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

(j) Identify the FAA’s organizational risk posture based on the aggregated risk to systems and information from the operation and use of the systems for which the FAA is responsible.

(k) Manage threat, vulnerability, and information security and privacy risk (including supply chain risk) for organizational systems and the environments in which the systems operate.

(l) Establish effective mechanisms to share information regarding information security and privacy and serve as a focal point for communicating and sharing risk information among key stakeholders (e.g., authorizing officials and other senior leaders), both internal and external to the FAA (as appropriate).

d. Where overlapping functions exist or disagreements arise with respect to the interpretation or application of this Order and its supplemental implementing directives, the CSC members, in consultation with the Chief Counsel, will convene to assess the risk, make recommendations, and, if necessary, bring issues to AFN-1 for updates to the Administrator’s

Management Board for awareness and the FAA Administrator for final decision.

10.4. Chief Operating Officer (COO)

The FAA Administrator delegates to the ATO COO the primary responsibility for all aspects of the ATO mission-critical and mission-essential systems and services wherever they operate, subject to the requirements of this Order and its supplemental implementing directives and taking into consideration the safe and efficient use of the navigable airspace. The COO assigns these responsibilities to the ATO AO.

10.5. Chief Information Officer (CIO)

a. FISMA permits the head of the Agency to delegate and assign the responsibilities for information technology-related matters to the Agency’s CIO.

b. The FAA Administrator assigns the responsibility for all FAA IT-related matters to the

Deputy Assistant Administrator for the Office of Information and Technology (AIT). This official is the CIO of the FAA. The Director of Information and Technology is the Deputy CIO for the FAA.

c. Per NIST SP 800-37, Revision 2, the role of the CIO is an inherently United States (U.S.)

governmental function and must be assigned to Federal Government employees only.

d. Per OMB M-18-02, the CIO position is designated as a sensitive position, and the incumbent must have an active Top Secret (TS) security clearance with Sensitive

Compartmented Information (SCI) access.

e. The CIO has overall responsibility for all matters related to information technology and its implementation and use at the FAA and carries out their responsibilities with the support of the Deputy CIO, the CSC, the Office of the Chief Counsel, and the CISO. Included among the

CIO’s responsibilities are the coordination, development, implementation, and maintenance of the agency-wide Information Security and Privacy Programs.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

f. Pursuant to 44 U.S.C. § 3554(a)(3)(A), Federal Agency Responsibilities, the CIO may designate a senior agency information security officer. The FAA identifies this position as the

CISO. The FAA CIO assigns organizational and management responsibilities for FAA’s

Information Security and Privacy Programs and policies, including this Order and its supplemental implementing directives, to the Information Security & Privacy Service within the

Office of Information & Technology (AIT).

(1) The Director of the Information Security and Privacy Service is the FAA CISO.

(2) The Deputy Director of Information Security and Privacy Service is the FAA Deputy

CISO.

10.6. Chief Information Security Officer (CISO)

a. The FAA CISO has overall responsibility for, and provides executive direction, control, and oversight to implement, the FAA Information Security and Privacy Programs.

b. This Order delegates to the FAA CISO the authority and responsibility to oversee the implementation of this Order and to develop, issue, and update supplemental implementing directives as necessary.

c. Except as otherwise provided in this Order, the CISO will:

(1) Recommend changes to this Order and supplemental implementing directives and other FAA information security and privacy policies, guidance, standards, processes, and procedures.

(2) Coordinate the development of new or revised supplemental implementing directives with applicable stakeholders.

(3) Obtain the concurrence of the FAA Chief Information Officer (CIO), the FAA Chief

Counsel, and the FAA CSC on the documents referenced in paragraph 10.6(c)(1).

d. Per OMB M-18-02, the CISO position is designated as a sensitive position, and the incumbent must have an active TS security clearance with SCI access.

e. Per NIST SP 800-37, Revision 2, the role of the CISO is an inherently U.S. governmental function and must be assigned to Federal Government employees only.

10.7. FAA Chief Privacy Officer (CPO)

a. The FAA CPO role is assigned to the Chief Privacy Officer, who reports to the Director of the Information Security and Privacy Service.

b. The FAA CPO facilitates FAA compliance with Federal privacy laws, policy, and guidance, as well as with FAA and DOT privacy policies and procedures for protecting Privacy

Act-related PII.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

c. The FAA CPO provides expertise and oversight for privacy requirements across the FAA enterprise and coordinates with the DOT Senior Agency Official for Privacy and the DOT CPO on privacy and PII matters, as necessary.

10.8. Authorizing Official (AO)

a. The AO’s responsibility is to authorize FAA systems owned or operated by their respective LOB or SO, and to accept and manage all risks associated with the acquisition, operation, maintenance, and decommissioning of such systems.

b. The FAA Administrator is the AO for the FAA. The FAA Administrator delegates the

AO role to the head of each FAA LOB and SO with respect to information systems owned, operated or managed by their respective organizations.

c. The head of each LOB or SO may further delegate their AO role and responsibilities to a senior executive or senior official with the qualifications established in NIST SP 800-39

Managing Information Security Risk, Appendix D, and with the appropriate authority and resources to assume the responsibilities of the AO.

d. The delegated AO must be a senior official or executive with the authority to assume responsibility for operating an information system at an acceptable level of risk to organizational operations and assets, individuals, other organizations, and the United States, commensurate with understanding and accepting such information system-related security risks. The delegated AO is empowered to:

(1) Authorize a system for operation (i.e., issue an Authority to Operate).

(2) Accept and manage risk(s) associated with operating the system.

(3) Enforce compliance with all applicable FAA information security and privacy policies.

(4) Remove or suspend operations of non-compliant systems within the AO’s scope of authority.

e. The AO role is an inherently U.S. governmental function and must be assigned to Federal

Government employees only.

f. The AO must have an active security clearance, and any necessary special access, for access to classified national security information commensurate with the sensitivity of the systems and information within the AO’s purview. Refer to the position sensitivity and investigation standards specified in the current version of FAA Order 1600.1, Personnel Security

Program.

g. The delegated AO must be appointed in writing by the head of their respective LOB or

SO. The AO delegation of authority must be reviewed at least annually and updated when any changes are necessary. The FAA CIO may designate additional AOs for any FAA organization if they are in a better position to assess the risk than the CIO.

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

10.9. Assistant Administrator, Office of Finance & Management (AFN-1)

The Office of Finance & Management includes the four functional areas of Information and

Technology Services, Acquisition and Business Services, Financial Services, and the Mike

Monroney Aeronautical Center.

a. AFN-1 is empowered and responsible for bringing to the Administrator’s Management

Board and/or the FAA Administrator any necessary updates related to information security and privacy, with the support of the CIO, CISO, and CSC members.

11. Additional Information Security Roles

The following roles are in addition to the executive and senior-level roles defined above. The roles defined below are mission, business, and system-level information security positions.

11.1. Authorizing Official Designated Representative (AODR)

Organizations may optionally designate in writing an AODR who acts on behalf of an AO to coordinate and conduct the required day-to-day activities associated with the security authorization process. The AODR may assume any or all responsibilities of the AO, except assuming responsibility for the acceptance of risk to organizational operations and assets, individuals, other organizations, and the United States.

11.2. Security Architect

The Security Architect is responsible for ensuring that the information security requirements necessary to protect the organizational mission and business functions are adequately documented in all aspects of enterprise architecture, including reference models, segment and solution architectures, and the resulting systems supporting those missions and business processes.

11.3. System Security Officer (SSO)

The SSO is assigned to a system and works collaboratively with the System Owner to maintain the appropriate operational security posture for the system and related information. SSOs may be responsible for multiple systems. For organizations that do not have assigned SSOs, the System

Owner fulfills this role or assigns the functions to employees with appropriate security functions and expertise or arranges for appropriate contract support.

11.4. Systems Security Engineer (SSE)

The SSE is responsible for working in close collaboration with the System Owner and SSO to implement proper security posture for the system. SSEs conduct information system security engineering activities (e.g., capturing and refining information security requirements and ensuring that the requirements are effectively integrated into information technology component products and information systems through purposeful security architecting, design, development, and configuration).

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552

11.5. Security Control Assessor (SCA)

The SCA carries out the security authorization process. The SCA must be independent and cannot hold any system-level position for the system being assessed.

11.6. Information Owner

The Information Owner is the FAA executive authorized to, and held accountable for, properly allocating resources required to maintain the security posture of specific information. Information

Owners are responsible for establishing, consistent with applicable law and policies, the controls for the generation, collection, processing, review, dissemination, and disposal of specific information under their purview. The Information Owner role is an inherently U.S. governmental function and must be assigned to executive-level Federal Government employees.

11.7. Information Steward (IS)

The IS is designated by the organization where the information originates to be accountable for the quality and timeliness of the information under their purview, and its appropriate protection, in accordance with written agreements made with the appropriate System Owners and

Information Owners. The IS is responsible for the accuracy of the metadata about the data and information under their purview in order to facilitate appropriate sharing and consumption of the data. The IS role is an inherently U.S. governmental function and must be assigned to Federal

Government employees.

11.8. System Owner

All FAA systems in production must have a System Owner who is designated in writing by the

AO and does not hold any conflicting responsibilities for the system (e.g., authorize, assess, audit, etc.). A System Owner may be responsible for multiple systems. The System Owner must be an active participant in the overall security of the system and is responsible for properly allocating resources required to maintain the security posture of the system, including all required information security and privacy documentation. The System Owner role is an inherently U.S. governmental function and must be assigned by management-level Federal

Government employees.

11.9. Executive Sponsor

All FAA systems in planning and development must have an assigned Executive Sponsor. The

Executive Sponsor is responsible for ensuring information security and privacy is incorporated in the system’s design, procurement, development, integration, modification, operations, and maintenance until a System Owner is designated, and these responsibilities are assumed by the designated System Owner. The Executive Sponsor role is an inherently U.S. governmental function and must be assigned to executive-level Federal Government employees.

11.10. Cloud Service Program Manager

All cloud-based services (IaaS, PaaS, and SaaS) that support FAA systems or host FAA data must have an assigned Cloud Service Program Manager. The Cloud Service Program Manager is

FOR OFFICIAL USE ONLY

Public availability to be determined under 5 U.S.C. § 552 responsible for verifying that the cloud service offering is authorized to operate in the FAA environment and provides a secure environment that protects FAA information in accordance with the requirements of applicable law and policies. The Cloud Service Program Manager is responsible for all customer controls provided by the cloud service offering (e.g., account management, configuration, modifying default settings, security controls, etc.), as applicable.

12. References

Public Law 113-283, 44 U.S.C., Chapter 35, (a.k.a. Federal Information Security Modernization

Act of 2014)

Air Traffic Management System Performance Improvement Act, Title II of the Federal Aviation

Reauthorization Act of 1996, Public Law No. 104-264, codified at 49 U.S.C. §106(f)(2)

OMB Circular Number A-130, Managing Information as a Strategic Resource, July 28, 2016

NIST SP 800-53, Revision 5, Security and Privacy Controls for Information Systems and

Organizations, June 2020

OMB Memorandum M-18-02, Fiscal Year 2017-2018 Guidance on Federal Information

Security and Privacy Management Requirements, October 16, 2017

NIST SP 800-37, Revision 2, Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information

Systems View, March 2011

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1, April 2018

FAA Order 1600.1, Personnel Security Program

Department of Transportation and Related Agencies Appropriations Act, Section 348 (FAA

Acquisition Management System), Public Law 104-50, (codified at 49 U.S.C. § 40110(d))