ePS_RFP_Attach_2_SRS_Attachment_7_Department_of_Navy_(DoN)_Enterprise_IT_Control_Standards.pdf

N00039-17-R-0002 electronic Procurement System

Request for Proposal

Attachment 2: System Requirements Specification

SRS Attachment 7: Department of Navy (DON)

Enterprise IT Control Standards

ACAT 1

Version 1.2

6 March 2017

Distribution Notice D: Authorized to the Department of Defense (DoD) and DoD Contractors only. This document is for administrative or operational use, as of the date of approval for this document. Refer to the Program Manager (PM), PMW 220 Navy Enterprise Business Solutions

(Navy EBS), Program Executive Office Enterprise Information System (PEO EIS), Washington

Navy Yard, 1325 10 th

St. SE, Bldg. 196, Washington, D.C. 20374 for additional document requests.

Handling and Destruction Notice: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document.

ePS System Requirements

Specification

(SRS)

Department of the Navy (DON)

Enterprise IT Standards

Filename:

ePS SRS Attachment 7-Department of Navy (DoN) Enterprise IT Control

Standards.docx

Page:

2/245

Version:

Version 1.2

Date of Creation:

6 Mar 2017

N00032-17-R-0002

1 DON Enterprise IT Control Standards

This attachment to the ePS SRS includes the DON Enterprise IT Control Standards according to the authoritative source(s) identified in Appendix B of the SRS.

Table 1: DON Enterprise IT Control Standards

STANDARD

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

AC.1.1 System Owners shall ensure policy and procedures are documented and cover the following layers:

• Operating System (O/S);

• Database (DB); and

• Application.

The policies and procedures should cover the following control areas (see

Appendix A for an example Access

Control Policy that should be documented):

• Account Management (AC-2) –

Properly administer user and system accounts in conjunction with related controls and policies.

• Access Enforcement (AC-3) – Define and govern user access to information system resources.

• Information Flow Enforcement (AC-

4) – Outline and control the flow of information both internally and externally of the system. Use access controls to regulate information flow.

• Separation of Duties (AC-5) – Define, document and enforce separation o f duties for each type of user.

• Least Privilege (AC-6) – Permit and implement access in the information system that affords only the least functionality to allow a user to fulfill

SM-3 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy

Template).

2. Separation of Duties

Matrix (see

Appendix D in

Access Control

Policy and

Procedures template documented in

Appendix A)).

3. Evidence of communication of distribution of the documents.

Annually

Per Instance as Required

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

3/245

Version:

Version 1.2

STANDARD

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

their responsibilities.

• Unsuccessful Logon Attempts (AC-7)

– Configure the information system to impose a defined limit of allowable logon failures.

• System Use Notification (AC-8) –

Configure the information system to display a notice to the user that they must be in accordance to policies & regulations.

• Previous Logon (Access) Notification

(AC-9) – Configure the information system to notify the user the time of the last successful logon attempt.

• Concurrent Session Control (AC-10)

– Configure the information system to limit the number of coexisting sessions from one user.

• Session Lock (AC-11) – Configure the information system to freeze a session after a defined period of idleness or when prompted by the user.

• Session Termination (AC-12) –

Configure the information system to automatically end the user’s session when defined conditions are activated.

• Permitted Actions Without

Identification or Authentication (AC-

14) – Configure the information system to severely limit defined actions that can be performed without proper authentication and authorization.

• Security Attributes (AC-16) – Impose security attributes on data & system resources that outline the allowable permissions to be performed.

• Remote Access (AC-17) – Design and

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

4/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

monitor off-site connections to the information system in accordance with standards and regulations.

• Wireless Access (AC-18) – Configure over-the-air radio transmissions between information systems that is protected and authorized in consensus with policies and regulations.

• Access Control for Mobile Devices

(AC-19) – Strictly manage and monitor mobile devices to that access information systems & data.

• Use of External Information Systems

(AC-20) – Govern and monitor the use of such systems through a formal agreement that includes security requirements between the organization and the owner of the external system.

Stakeholders and management shall approve all policies and procedures as well as approve all updates and provide their approval via documented signatures. System Owners shall review and update policies and procedures as necessary at all layers on an annual basis to ensure reflection of the current operating environment.

AC.1.2 Evidence of updates or reviews to the

Access Control policies and procedures shall be documented within a version or change history portion of the policies and procedures document and maintained for the entire audit period.

SM-3 1. Version history section of Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy

Template.

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

5/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

Specifically, see Summary of

Changes section).

2. Evidence of review and updates should include the specific updates to the policy, the date of updates and the person who updated the policy.

AC.2.1 Establishing and Activating User

Access System Owners shall approve users’ access requests based on a standardized access request form to include, at a minimum, the following criteria:

• User identification information;

• Type(s) of access required; and

• Justification for access and completion of information/security awareness (IA) training requirements.

System Owners shall employ the concept of least privilege and ensure that incompatible duties (job responsibilities that if performed together would give an individual or individuals more access that is necessary for them to do their job) are not assigned to a user. The O/S, DB, and Application should enforce this function automatically. If manual, the

System Owner shall compare requested access to a separation of duties matrix

(see Appendix D in Appendix A for an example of Separation of Duties Matrix

Template) prior to provisioning access to

AC-3 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

2. User Access

Approval

Forms for the current fiscal year (See

Appendix B in

Appendix A for an example

SAAR-N

form).

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

6/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

ensure that incompatible duties will not be assigned.

AC.2.2 Reviewing User Access System Owners shall perform the following, at a minimum (for all accounts at the O/S, DB layer and application layers):

1. Annual review of the separation of duties matrix (see Appendix D in

Appendix A for an example of

Separation of Duties Matrix Template);

2. Annual review of the defined business justifications for emergency and temporary accounts;

3. Monthly recertification review for all system accounts;

4. Monthly recertification review for application user and privileged user access at the O/S and DB layers;

5. Quarterly recertification review for application and privileged user access at the Application layer;

6. Quarterly review for unnecessary

Accounts [default, guest, and/or system accounts] user access;

7. Daily review of inactive accounts if performed manually. (Should work towards automated removal after 30 days of inactivity); and

8. Weekly review of both emergency and

AC-3 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

2. Evidence that user accounts have been reviewed in accordance with established frequency

(e.g., emails, reports, and other evidence of these reviews) to include username, roles and date of review within the current

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

7/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

temporary user access if performed manually. (Should work towards automated removal after a predefined period of time has elapsed, rather than at the convenience of the system administrator).

To perform these reviews, System

Owners shall obtain system generated user and system account listings from the source system of record. With this listing, System Owners shall review each account’s access permissions to determine whether the access is still required (i.e. if need-to-know changes) and access rights provisioned match the access and access rights approved.

fiscal year.

AC.2.3 Modifying and Disabling If the individual’s access is required to be changed as a result of the review identified in control AC.2.2, System

Owners shall work with the System

Administrator to modify or disable the user’s access. For access that is expired or is no longer supported by a business justification, System Owners shall coordinate with the System

Administrator(s) to remove the account immediately (within 24 hours).

AC-3 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

2. Screenshot from the system (taken while conducting walkthrough or observation) within the current fiscal year or a timestamp that documents the date that each account (as applicable) is disabled or

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

8/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

modified. (If a screenshot is not available, then an active user listing will need to be generated).

AC.2.4 Procedures for Disabling and

Removing User Access for Terminated

Users HR shall be notified of an individual’s termination immediately (within 24 hours of termination) by System Owners, a supervisor or COR with an associated termination date.

In conjunction with the above procedures, the following activities must be performed and documented on an exit checklist:

• Disable/remove access to all systems supporting the O/S, DB, and Application layers with Security/System

Administrators;

• Terminates/revokes any authenticators/credentials associated with the terminated individual;

• Return sensitive information to the

Federal supervisor or COR for the terminated individual;

• Return all keys, badges, access devices to the Security Officer;

• Return all Government -owned equipment to the Property Administrator;

and

• Conduct an exit interview that includes a discussion of information security topics (e.g., nondisclosure agreement) with the Security Office.

Within 24 hours of the individual’s termination, the Security/System

AC-3 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

2. Screenshots system showing the date that the individual’s access was terminated (i.e.

time stamp on user’s account) within the current fiscal year (If a screenshot is not available, then an active user listing will need to be generated).

3. Exit checklist within the current fiscal year.

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

9/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

Administrators shall disable access to all systems for the individual(s) that has been terminated. Once access has been removed, the Security/System

Administrators should send communication (email) to the System

Owners indicating that access was disabled or removed for the terminated individual. The System Owner shall notify HR that the individual’s access was disabled/removed and HR will document this communication. All communication involved in this process should be documented and retained by each System Owner.

The System Owners shall obtain and review an official listing of all terminated users from a system source of record (i.e. HR system) on a weekly basis and perform a comparison to the active listing of accounts for systems on the O/S, DB, and Application layers.

The System Owners shall coordinate with the System Administrator for the immediate (within 24 hours) removal of access for all terminated users identified within the active user listing.

4. System generated listing of terminated individuals

(most likely from a system maintained by

HR).

5. Evidence of weekly review of terminated user listing to include the reviewers name and date of review.

Weekly

AC.3.1 System Owners shall identify the nature and extent of access to each resource

(O/S, DB, Application technology) that is available to each user. On an annual basis, System Owners shall review all access rights assigned for all accounts for appropriateness. Users may be assigned one or more of the following, but not limited to, types of access to specific computer resources:

• Read access—the ability to look at and copy data or a software program;

• Update access—the ability to change data or a software program;

AC-3 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and

Procedure that access rights assigned to accounts has

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

10/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

• Delete access— the ability to erase or remove data or programs;

• Merge access— the ability to combine data from two separate sources; and

• Execute access—the ability to execute a software program.

Access may be permitted at the file, record, or field level. Files are composed of records, typically one for each item or transaction. Individual records are composed of fields that contain specific data elements relating to each record.

been reviewed for appropriateness

(e.g., emails, reports, and other evidence of these reviews) to include roles and date of review within the current fiscal year.

AC.3.2 System Owners shall maintain proper control of information system processes and services to ensure the confidentiality, integrity, and availability of user data. System Owners must perform risk assessments of their environment on an annual basis. For more information regarding Risk

Assessments, see the Risk Assessment

(RA) DON Enterprise IT Control

Standards for additional guidance.

AC-3 1. Most recent risk assessment performed for the current operating environment within the current fiscal year.

Annually

AC.4.1 System Owners shall ensure that networks are appropriately configured to adequately protect access paths between systems and control the external flows of data, and consider the existing technologies at the O/S, DB, and

Application layer. This shall be do ne by implementing information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations

(e.g., networks, individuals, and devices) within information systems and between interconnected systems.

System Owners shall document a

Memorandum of Understanding (MOU) or Interconnection Security Agreements

AC-1 1. MOU or ISA between the source organization or entity and the receiving organization or entity for information flowing outside of the organizational boundaries.

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

11/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

(ISA) between the source organization or entity and the receiving organization or entity for the information/data that is transferred outside of the confines of the organizational operating environment boundary. The MOU or ISA shall contain security roles and responsibilities as well as requirements with managing the data that is being transferred.

AC.5.1 System Owners shall define and document separation of duties ( see

Appendix D in Appendix A for an example of Separation of Duties Matrix

Template) and incompatible functions and implement the following principles:

• Application users should not have access to operating systems or applications software;

• Programmers should not be responsible for moving programs into production or have access to production libraries or data;

• Access to operating system documentation should be restricted to authorized systems programming personnel;

• Access to applications system documentation should be restricted to authorized applications programming personnel;

• Access to production software libraries should be restricted to library management personnel;

• Persons other than computer operators should not set up or operate the production computer;

• Only application users, not system administrator, should be responsible for transaction origination or correction and for initiating changes to application files; and

SD-1 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and

Procedure

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

12/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

• Computer operators should not have access to program libraries or data files.

Organizations with limited resources to separate duties should have compensating controls to mitigate risks of conflicts in separation of duties.

These compensating controls should be documented in the Access Control Policy

(see Appendix A for an example Access

Control Policy Template).

AC.5.2 System Owners shall define and document a separation of duties matrix

(see Appendix D in Appendix A for an example of Separation of Duties Matrix

Template) for default account, guest, and/or system accounts to ensure that the current operating environment is reflected. The matrix shall list all roles and responsibilities that exist and identify any roles and responsibilities that shall not also be granted to a user based on their duty functions and least privilege.

System Owners shall perform an annual review of the separation of duties matrix to ensure that the current operating environment is reflected.

SD-1 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and annual review of separation of duties matrix to include all changes that were made and the time and date of the change and individual that made the change.

AC.5.3 System Owners shall define and document how transaction processing is utilized in the operating environment to include:

SD-1 1. Access

Control Policy and Procedures document (see

Appendix A for

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

13/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

• Data entry and verification of data;

• Data entry and its reconciliation to output;

• Input of transactions for incompatible processing functions (for example, input of vendor invoices and purchasing and receiving information); and

• Data entry and supervisory authorization functions (for example, authorizing a rejected transaction to continue processing that exceeds some limit requiring a supervisor’s review and approval).

an example

Access Control

Policy and

Procedure

Template).

AC.5.4 System Owners should ensure that documented job descriptions exist and clearly describe employee duties as well as prohibited activities that could cause separation of duties conflicts within the organization. These should include responsibilities that may be assumed during emergency situations. Resources and training shall be provided to educate employees of their responsibilities to ensure that separation-of-duties principles are established, enforced, and institutionalized within the organization.

Job descriptions should be documented for all roles within the organization.

SD-1 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and

Procedure

Template).

Annually

AC.6.1 System Owners shall identify individuals with access to user accounts and sensitive system resources and the business purpose (i.e. based on the user’s job responsibilities, the access should be commensurate with that role) for this access.

System Owners shall ensure the number of individuals with access to services and processes should be restricted based on the concept of least privilege (the least amount of access necessary for user to perform their job) that is catered to

AC-3 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and

Procedure

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

14/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

their environment. Unnecessary accounts

(default, guest accounts) are removed, disabled or otherwise secured at the O/S, DB, and Application level.

For more information regarding reviewing accounts based on the concept of least privilege. See AC.5.1, AC.5.2, AC.5.3, and AC.5.4 – Separation of

Duties, for additional guidance.

AC.7.1 The information system shall contain security protocols that limit that number of times an invalid password is used to gain access to three (3) consecutive attempts (a succession of failed logons) by a user during a 15 minute time period.

On a quarterly basis, System Owners shall perform the following to ensure that the information systems are functioning as intended:

• Security parameter settings shall be examined for failed-logon attempts;

• Security logs shall be review security logs to determine whether attempts to gain access are logged; and

• If appropriate, repeatedly attempt to logon using invalid passwords to ensure that the limit of three consecutive invalid logon attempts is functioni ng properly.

AC-2 1. Screenshot from the system showing the configuration settings for invalid logon attempts by a user within the current fiscal year. (If a screenshot is not available, then the auditor will need to perform test cases to test cases to test for system functionality).

Quarterly

AC.7.2 When the maximum number of unsuccessful attempts is exceeded, the information systems shall e ither automatically:

• Lock the account/node until released by an administrator;

• Delay next logon prompt for a minimum of 5 seconds; and

• Lock the account/node for a min imum

AC-2 1. Screenshot from the system showing the configuration settings for unsuccessful attempts by a user within the

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

15/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

of 20 minutes. current fiscal year. (If a screenshot is not available, then the auditor will need to perform test cases to test cases to test for system functionality).

AC.8.1 System Owners shall ensure the content of the DTM-08-060, “Policy on Use of

Department of Defense (DoD)

Information Systems – Standard Consent

Banner and User Agreement,” dated

March 2013 is displayed before granting access to the system. A user must acknowledge the usage conditions on the logon screen in order to continue with identification and authentication (IA) process onto the information system.

(See IA DON Enterprise IT Control

Standards for more information regarding IA procedures that should be implemented in a control environment)

System notification messages or banners should only be used for access via logon interfaces that involve human users.

System Owners shall consider the notification message or banner to be displayed in multiple languages based on specific organizational needs and the demographics of information system users.

AC-1 1. Screenshot from the system showing the system consent banner and user agreement within the current fiscal year. (If a screenshot is not available, then the auditor will need to perform test cases to test cases to test for system functionality).

Per Instance as Required

AC.9.1 System Owners shall configure the various layers in the information system to provide previous log-on information

(e.g. timestamp) to a user after

AC-1 1. Screenshot of the system(s) configuration

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

16/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

successful authentication.

For example a user usually logs -on to the operating system (e.g. Windows) to access information resources. The user is also authorized to log-on to a database that performs financial functions. In this case, System Owner shall configure both systems to provide their own previous log-in notifications.

set to provide notification of previous log-in.

AC.10.1 The information systems shall be configured to prohibit all account types and/or accounts from establishing concurrent sessions (a user being connected to the same system or application multiple times).

System Owners shall perform and maintain evidence of a quarterly review of all accounts to ensure that no user can establish a concurrent sessions.

AC-2 1. Screenshot system showing the number of concurrent sessions within the current fiscal year. (If a screenshot is not available, then the auditor will need to perform test cases to test cases to test for system functionality).

quarterly review (e.g., Emails, hard copy evidence) within the current fiscal year to include reviewer name and date of review).

Quarterly

AC.11.1 The information systems shall be configured to prevent further access to

AC-1 1. Screenshot from the

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

17/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

the system by initiating a session lock (a system feature that denies a user to access the system) after 15 minutes of inactivity or upon receiving a request from a user.

shall review system configuration settings to determine whether the information system is still configured to automatically initiate a session lock during a 15 minute period of inactivity.

system evidencing the session lockout configuration setting within the current fiscal year. (If a screenshot is not available, then the auditor will need to perform test cases to test cases to test for review (e.g., Emails, hard copy review evidence) to include reviewer name and date of review within fiscal year.

AC.12.1 The information systems shall be configured to automatically terminate a user’s session after 30 minutes of inactivity. User sessions shall be terminated without terminating network sessions (i.e. user sessions can be terminated without having to disable, reset, or shut down the network). To re -establish access to the session, the system shall require the user to re -authenticate to regain access.

AC-1 1. Evidence of the quarterly review over terminated user sessions to include reviewer name and date of review within

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

18/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

shall review configuration settings to ensure that the information systems automatically terminate a user’s session after 30 minutes of inactivity or if organizational defined conditions are triggered.

of user session

Configuration

Settings within the current fiscal year. (If a screenshot is not available, then the auditor will need to perform test cases to test cases to test for system functionality).

AC.13.1 Per NIST 800-53 Rev4 this control is

“Withdrawn: Incorporated into AC -2 and

AU-6”

N/A N/A N/A

AC.14.1 System Owners shall identify and document supporting rationale for user actions that do not require identification and/or authentication consistent with organizational missions/business functions There may be a limited number of allowed user actions that can be performed without identification and authentication. These actions may

• Publically accessible websites or federal information systems;

• Receiving calls on mobile devices; and

• Receiving copies or duplicates.

System Owners shall identify actions that normally require identification and/or authentication but can be circumvented due to emergencies or other circumstances. It is best practice that all users’ actions that can be performed on information system are performed using identification and

AC-2 1. Access

Control Policy and Procedures template (see

Appendix A for an example

Access Control

Policy and

Procedure

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

19/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

authentication.

AC.15.1 Per NIST 800-53 Rev4 this control is

“Withdrawn: Incorporated into MP -3”

N/A N/A N/A

AC.16.1 System Owners shall define the types of attributes (security attributes , a form of metadata, are concepts representing the basic properties/characteristics of active and passive entities with respect to protecting information) needed for selected information systems to support missions/business functions with respect to safeguard ing information and “label” or “mark” information as appropriate.

Examples include classification level

(Top Secret, Secret, and Classified) for objects and clearance (access authorization) level for subjects.

AC-4 1.

Organizational agreement evidencing that all distributed information system components implement security attributes with consistent interpretations in automated access/flow enforcement actions.

AC.17.1 System Owners define and document the types of remote access that are utilized in the organization. Examples include

Virtual Private Networking configured devices and Mobile Key Devices configured to access the DON network.

The usage restriction, configuration requirements for each system, and guidance on how to maintain remote access shall also be documented.

Procedures for authorizing remote access to information systems should be coordinated with the procedures documented in AC.2.1.

AC-1 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and

Procedure

Template).

Annually

AC.17.2 System Owner shall authorize remote access to the information system prior to allowing remote connections. Every user in the organization shall complete a user

AC-1 1. Access

Control Policy and Procedures document (see

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

20/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

agreement form acknowledging the terms and conditions of the organizations access policy agreement before receiving access to remotely connect to the DON network or information system.

The user and the System Owner will be required to sign and acknowled ge the user agreement on an annual basis.

Appendix A for an example

Access Control

Policy and a user agreement to include the signature of a user and

System Owner and dated within the

AC.18.1 System Owners define and document the types of wireless access that are utilized in the organization, if any. The usage restriction, configuration requirements for each system, and guidance on how to maintain wireless access shall also be documented.

System Owners shall authorize wireless access to the information system prior to allowing such connections. Procedures for authorizing the use of wire less access to information systems should be coordinated with the procedures documented in AC.2.1.

AC-1 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and

Procedure

Template).

Annually

AC.18.2 Systems Owners shall ensure that the information system is configured to encrypt information to protect the confidentiality of both remote and wireless access sessions.

AC-1 1. Access

Control; Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

21/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

of the encryption method and configurations within the current fiscal year. (If a screenshot is not available, then the auditor will need to perform test cases to test cases to test for

AC.19.1 Information systems shall be configured appropriately to identify and authenticate specific devices (i.e.

laptops, tablets, cellphones, and all other mobile technologies that are connecting to the network) before establishing a connection.

System Owners shall identify restrictions for the different classes/types of such devices. Usage restrictions and specific implementation guidance for mobile devices shall include:

• Configuration management;

• Device identification and authentication;

• Implementation of mandatory protective software (e.g., malicious code detection, firewall);

• Scanning devices for malicious code;

• Updating virus protection software;

• Scanning for critical software updates

AC-1 1. Access

Control Policy and Procedures document (see

Appendix A for an example

Access Control

Policy and identification and authentication configuration setting within the current fiscal year. (If a screenshot is not available, then the

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

22/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

and patches;

• Conducting primary operating system

(and possibly other resident software) integrity checks; and

• Disabling unnecessary hardware (e.g., wireless, infrared).

See AC.18.3 – Wireless Access for additional guidance.

auditor will need to perform test cases to test cases to test for system functionality).

AC.20.1 System Owners shall ensure that the activities performed by users utilizing non-organizational information systems

(e.g. private owned communication devices, and non-government information systems) or personal devices

(e.g. laptop, smart phone, or tablet) is monitored and controlled. Access shall meet requirements documented in a connection/processing agreement covering the following areas:

• Security roles and responsibilities;

• Personal devices, minimum security requirements shall be defined;

• Connectivity agreements;

• Individual accountability;

• Audit access and reporting;

• Security awareness training; and

• Requirements definition.

SM-7 1.

Usage/Connecti on Agreements

(signed by the user and the

System Owner.

Per Instance as Required

AC.21.1 Per Federal Information System Controls

Audit Manual (FISCAM), dated February

2009 referenced in Appendix IV, it has been determined that this NIST Special

Publication 800-53 Revision 4 control does not map to a corresponding

FISCAM control based on the GAO requirements.

N/A N/A N/A

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

23/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

AC.22.1 Per Federal Information System Controls

Audit Manual (FISCAM), dated February

2009 referenced in Appendix IV, it has been determined that this NIST Special

Publication 800-53 Revision 4 control does not map to a corresponding

FISCAM control based on the GAO requirements.

N/A N/A N/A

AC.23.1 Per Federal Information System Controls

Audit Manual (FISCAM), dated February

2009 referenced in Appendix IV, it has been determined that this NIST Special

Publication 800-53 Revision 4 control does not map to a corresponding

FISCAM control based on the GAO requirements.

N/A N/A N/A

AC.24.1 Per Federal Information System Controls

Audit Manual (FISCAM), dated February

2009 referenced in Appendix IV, it has been determined that this NIST Special

Publication 800-53 Revision 4 control does not map to a corresponding

FISCAM control based on the GAO requirements.

N/A N/A N/A

AC.25.1 Per Federal Information System Controls

Audit Manual (FISCAM), dated February

2009 referenced in Appendix IV, it has been determined that this NIST Special

Publication 800-53 Revision 4 control does not map to a corresponding

FISCAM control based on the GAO requirements.

N/A N/A N/A

CM.1.1 System Owners shall ensure policy and procedures are documented and cover the following layers:

• Operating System (O/S),

• Application.

SM-3 1.

Management

Policy (see

Appendix A for an example

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

24/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

The policies and procedures should cover the following control areas (see

Appendix A for an example

Configuration Management Policy and

Procedures which documents the following sections):

• Configuration Baseline (CM -2) -

Establish and maintain configuration baselines for information systems in the organization.

• Change Management Process (CM -3)

– Develop a formal and standardized process of implementing and managing changes to information systems that incorporates appropriate oversight.

• Security Impact Analysis Process

(CM-4) - Consider the potential effects on system security prior to implementing new changes.

• Access Restrictions for Change (CM -

5) - Limit and monitor those on who can implement system changes.

• Configuration Settings (CM-6) -

Categorize and monitor the syste m’s configuration settings.

• Least Functionality (CM-7) - Confine the information system to only provide authorized services and functions.

• Information System Component

Inventory (CM-8) - Develop and maintain an accurate manifest of components (e.g. hardware, software) that make up the system.

well as approves all updates and provides their approval via documented

Management or distribution documents.

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

25/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

signatures. System Owners shall review and update policies and procedures as necessary at all layers on an annual basis to ensure reflection of the current operating environment.

CM.1.2 Evidence of updates or reviews to the

Configuration Management policies and procedures shall be documented within a version or change history portion of the policies and procedures document and maintained for the entire audit period.

SM-3 1.

Configuration

Management

Policy (see

Appendix A for an example

Configuration

Management updates should include the specific updates to the policy, the date of updates and the person who updated the policy.

CM.1.3 System Owner shall ensure that the change documentation includes:

• Request (e.g., Change Request (CR)

Form) and approval for the configuration change(s) from the CCB prior to development;

• Approval(s) of configuration change(s) prior to test;

• Test plans and test results the configuration change(s);

SM-3 1.

Configuration

Management

Change documentation

(evidence supporting that changes were approved and tested prior to being

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

26/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

• Approval(s) of configuration change(s) prior to implementation;

• Evidence indicating program changes are moved into production only by persons independent of the programmer;

and

• Final approval of configuration change(s) indicating it was successfully implemented in the production environment.

Configuration management documentation shall be protected from unauthorized modification and deletion.

All appropriate documentation shall be maintained.

implemented into production).

CM.2.1 System Owners shall develop and maintain, under configuration control, a current baseline configuration of the information system. The current baseline configuration should include:

• Configuration information formally designated at a specific time during a product’s or product component’s life;

• Current and comprehensive baseline inventory of hardware, software, and firmware;

• Backup copies of the inventory; and

• Information system diagrams and documentation on the set up of routers, switches, firewalls, and any other devices facilitating connections with other systems.

System Owner shall ensure the baseline configuration is reviewed and updated:

• At a minimum, on a quarterly basis;

• When there is a major system change or upgrade; or

• As an integral part of information system component installations and

CM-2, CM-6 1.

Configuration

Management baseline of the hardware, software, and firmware components of all systems updated within review of baseline including the date of updates and the person who updated the baseline.

3. Evidence that deviations, if any, from the baseline

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

27/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

upgrades.

System Owners shall ensure that any deviations from the United States

Government Configuration Baseline

(USGCB) configuration settings for information systems are identified and documented. The deviations shall be tracked centrally within a tool or spreadsheet. The deviations will be grouped into high/medium/low risk categories and the System Owner will be responsible for reviewing the deviations to ensure that they are being resolved in a timely manner. System Owners shall review this procedure on a monthly basis. Policy and Procedures configuration is monitored, tracked, and followed-up appropriately to include name of the reviewer and the date of review.

CM.3.2 System Owners shall develop standardized unit, integration, and system test plans, across the O/S, DB, and Application layers, which:

• Are documented and approved;

• Defines responsibilities for each party

(e.g., system analysis, programmers, developers, quality assurance, library control);

• Specifies the goals/objectives and constraints;

• Specifies the testing schedule;

• Includes unit, integration, and system testing applying sufficient ranges of valid and invalid conditions;

• Specifies the testing methods

(automatic, manual, white box, black box, etc.);

• Lists the test cases/scripts/transactions and data to ensure various activities and conditions will be encountered during processing and testing;

• Live data shall not be used in testing unless building a test data file to mimic the production program library; and

CM-4 1.

Configuration

Management

Policy (see

Appendix A for an example

Configuration management

2. Testing plans and test results of every change implemented into the production operating

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

28/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

• Includes appropriate consideration of security (see CM-4 below for more information regarding Security Impact

Analyses).

Test plans are required for all types of changes and shall be retained for the entire life cycle of the system.

CM.3.3 System Owners shall perform appropriate responsive actions based on the unit, integration, and system test results. If testing of the change is not successful, the individuals responsible for testing changes should perform an analysis to determine why the testing procedures were not successful and notify the System Owners. The System

Owners and technical leads shall then hold a joint discussion to determine next steps with how to best proceed with remediating the issue and re -performing testing of the configuration change.

Successful testing must be performed prior to implementing the configuration changed into production.

CM-4 1. Testing plans and test results of every change implemented into the production operating environment.

Per Instance as Required

CM.3.4 System Owners shall define, document and implement a process to ensure that program changes are moved into production only when approved by management and by persons independent of the programmer.

Evidence of the independence and final approval that the configuration change was implemented into production shall be maintained.

CM-4 1. All change request forms and supporting documentation for all changes implemented in the control environment.

Per Instance as Required

CM.3.5 Each detailed specifications for a system and application software change shall be prepared by the programmer and reviewed by a programming supervisor.

The detailed specifications should be

CM-3 1. Programmer detailed specifications for every change

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

29/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

contained within the change request documentation (described above in

CM.3.2) and shall be retained for the entire life cycle of the system.

implemented in the control environment.

CM.3.6 Configuration/Software changes need to be defined and documented to ensure that they can be traced from authorization to the final approval code and facilitate a “trace -back” of code to design specification and functional requirements by system testers. The detailed specifications should be contained within each change request and shall be retained for the entire life cycle of the system.

To appropriately perform “trace -back” procedures management needs to clearly document within system documentation for the specific location within the system where the change was made as well as maintain the following:

• Initial approved version;

• Status of requested changes; and

• Implementation status of approved changes.

CM-3 1. All change request forms for all changes implemented in the control environment.

Per Instance as Required

CM.4.1 As part of the Configuration

Management change documentation associated with every change implemented in the operating environment, System Owners shall document and perform a security impact analysis of each change. The security impact analysis shall consider the security risks for implementing the change and must be performed by an individual with the necessary skills and expertise to perform such a review prior to implementation of the change. If negative security impacts (e.g., security flaws, weaknesses, incompatibility, or intentional malice) are discovered, the

CM-4 1. All change request forms for all changes implemented in the control environment.

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

30/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

System Owner shall perform risk assessments to better understand the impact of the changes and to determine if additional security controls are required.

CM.5.1 Only qualified and authorized individuals are permitted to access information systems for purposes of initiating changes, including upgrades and modifications, System Owners shall ensure that one or more of the following access control restrictions associated with changes to the information system are implemented:

• Physical Access Control (e.g., badge with appropriate security level/qualifications to enter a room);

• Logical Access Controls (e.g., technical means of controlling what information a user can utilize, the programs the user can run, and the modifications the user can make);

• Workflow Automation;

• Media Libraries;

• Abstract Layers (changes implemented into third-party interfaces rather than directly into information systems); and

• Change windows (changes occur only during specified times, making unauthorized changes easy to discover).

CM-4 1.

Configuration

Management

Policy (see

Appendix A for an example

Configuration

Management

2. List of individuals who are authorized to make changes to information systems to include privileges to change information system components.

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

31/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

CM.6.1 System Owners shall establish and document information system configuration settings that are:

• In alignment with applicable standards and guidelines (e.g. DISA STIG);

• Employing most restrictive system settings (CM.7.1); and

• Supporting missions and operational

System Owners shall review configuration settings to ensure the system is configured in compliance with aforementioned policy on an annual basis.

Settings that are in deviation to established system configuration requirements shall be documented and accompanied with a justification and approved by appropriate management prior to implementing the deviated configuration setting into the production

CM-2 1. Policy and procedures for configuration settings (see

Appendix A for an example of

Configuration

Management

2. Security and configuration settings that show how the system is configured to ensure compliance with the policy.

3. Evidence of approval of system configuration setting deviations.

CM.7.1 System Owners shall ensure that the information system is configured to provide only approved capabilities and shall restrict any functions, ports, protocols, and/or services stated within the IGVP validation procedures.

Although DoD Instruction 8551.01 outlines the specific functions/services that shall be restricted, monthly reviews shall be performed of the information system to determine which services may be a candidate for elimination (e.g., Voice Over Internet Protocol, universal serial bus (USB) drive, Instant

AC-3 1. Evidence of review of systems with least functionality including the date of reviews and the person who performed the review.

(SRS)

Navy (DoN) Enterprise IT Control

Standards.docx

Page:

32/245

Version:

Version 1.2

NUMBER

DON ENTERPRISE IT CONTROL

STANDARDS

FISCAM

CONTROL

OBJECTIVE

EVIDENCE

EVIDENCE

FREQUENCY

Messaging).

CM.8.1 System Owners shall maintain an accurate, descriptive and verifiable inventory listing all components that constitute the information system(s) (e.g.

hardware, software).

A precise inventory is…