Attachment_1_-_NIH_Information_Security_Awareness_and_Training_Policy.pdf

NIH Information Security Awareness and Training Policy

Chief Information Officer National Institutes of Health

Department of Health and Human Services

Version 3.0

January 31, 2011

For Official Use Only

(Formatted for double-sided printing)

This page was left blank intentionally

Table of Contents

1. Purpose

2. Background

3. Scope

4. Policy

4.1 Information Security Awareness

4.2 Role-based Security Training

4.3 Security Training Records

5. Roles and Responsibilities

5.1 NIH Chief Information Officer (CIO)

5.2 NIH Chief Information Security Officer (CISO)

5.3 NIH Institutes and Centers Information System Security Officer (IC ISSO)

6. Compliance

7. Applicable Laws and Guidance

8. Information and Assistance

9. Effective Date/Implementation

10. Approved

11. Glossary

12. Appendix A: Links Referenced

NIH IT Security Awareness and Training Policy, February 24, 2011

This page was left blank intentionally.

Record of Changes

Version Number

Release Date Summary of Changes

Section Number/Paragraph

Number

Changes Approved by and Date

1.0 2/1/2006 First Issuance n/a Cheryl Seaman, OCIO/ISAO

2.0 4/23/2008 Modified Background and

Policy sections for clarity and to include more relevant and useful citations. Added HHS updated requirements for role-based training.

Under Compliance Section, included a minimum requirement for Institutes and Centers to disable accounts of individuals who are not in compliance with awareness and training mandates.

2; 4.1; 4.2; 4.4 Cheryl Seaman, OCIO/ISAO

3.0 1/31/11 Updated format, streamlined content and qualified scope to include users with an Active Directory Account.

Changed initial timeframe for taking security awareness to confirm with OPM mandate, i.e., prior to access to NIH IT resources. Added annual requirement for NIH Rules of Behavior for Privileged User Accounts.

Specified that the IC deadline for completion of the annual security awareness training is May 31st

All Cheryl Seaman, OCIO/ISAO

NIH IT Security Awareness and Training Policy, February 24, 2011 5

This page was left blank intentionally.

1. Purpose This policy sets forth awareness and training requirements for all personnel (including contractors and other users of information systems who support the operations and assets of NIH) to ensure the confidentiality, integrity, and availability of agency information and information systems.

2. Background The Federal Information Security Management Act (FISMA) and the Office of Personnel Management (OPM) Regulation 5 Code of Federal Regulations (CFR) 930.01 require federal agencies to:

• Require security awareness prior to a user’s access to information technology (IT) systems and refresher training annually thereafter.

• Identify personnel with significant security responsibilities. Provide security training commensurate with these responsibilities in the form of role-based training in accordance with NIST 800-16, Information Technology Security Training Requirements.

The NIH Information Security Awareness and Training Policy is consistent with, and supplements, the HHS-OCIO Policy for Information Systems Security and Privacy.

3. Scope This policy applies to all users of NIH information systems that have—or will receive—an Active Directory account.

4. Policy

4.1 Information Security Awareness

All users will take the online NIH Information Security Awareness course prior to receiving their Active Directory account and password information. On an annual basis thereafter, users will take an abbreviated awareness course, the “Annual Refresher”, which is located at the same website. Course content will be updated annually to ensure emerging and high priority security issues are addressed. Both courses require users to read and agree to follow the NIH General Information Technology Rules of Behavior.

(Staff may also receive additional rules of behavior relevant to specific systems they access.)

NIH IT Security Awareness and Training Policy, February 24, 2011 7 http://csrc.nist.gov/drivers/documents/FISMA-final.pdf https://www.opm.gov/fedregis/2004/69-061404-32835-a.pdf https://www.opm.gov/fedregis/2004/69-061404-32835-a.pdf http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf http://intranet.hhs.gov/infosec/docs/policies_guides/PISSP/Policy%20for%20Information%20Systems%20Security%20and%20Privacy_toc.html http://irtsectraining.nih.gov/ https://ocio.nih.gov/security/nihitrob.html

In August, 2010, HHS added an annual requirement that privileged users read and agree to follow Rules of Behavior for Privileged User Accounts1. Beginning with the 2011 Annual Refresher, privileged users will receive a modified version of the course that includes an additional systems administrator training module and the new NIH Rules of Behavior for Privileged User Accounts. The module will replace the NIH course, FDCC Systems Administrator Training, which is currently required for users requesting administrator access to their computer. This training module will also be offered as standalone training for newly identified privileged users.

New federal employees will receive an Information Security Orientation brochure during the formal NIH orientation.

4.2 Role-based Security Training

1. Role-based security training is required for personnel with “significant information security responsibilities” to ensure they possess the knowledge and skills needed to protect information and information systems.

a. Security training must be tailored to each individual’s role and responsibilities.

b. Each year, using HHS guidance, Institutes and Centers (ICs) will update their list of staff considered to possess significant information security responsibilities and track compliance.

2. Two HHS memoranda have further qualified the role-based training requirement

(Issued October 3, 2007 and November 7, 2007). Key points include:

• Definition of significant responsibilities: responsibilities associated with a given role or position, which, upon execution, could have the potential to adversely impact the security posture of one or more HHS systems.

• Identification of significant roles: roles are characterized by population—both mandatory and optional—and relevant responsibilities.

• Users with more than one role: must complete role-based training associated with each role.

• New designated staff: must complete appropriate role-based training within three months of their initial start date.

• Frequency of training: minimum of at least once every three years, or more frequently as needed to address technology changes or patterns of vulnerabilities” in information systems.

• Individuals who develop or manage sensitive systems: must receive training relevant to their specific duties and the technologies they use.

1 HHS Rules of Behavior (For Use of HHS Information Technology Resources) dated August 26, 2010

NIH IT Security Awareness and Training Policy, February 24, 2011 8 https://ocio.nih.gov/security/nihitrob_for_Privileged_User_Accounts.html https://ocio.nih.gov/security/nihitrob_for_Privileged_User_Accounts.html https://ocio.nih.gov/security/Sec-Orient-for-New-Users.doc http://intranet.hhs.gov/infosec/docs/policies_guides/RBT/Definition_of_SSR_Security_RBT_Implementation_FINAL_(3).html http://intranet.hhs.gov/infosec/docs/policies_guides/training/Training_of_Individuals_Developing_Managing_Sensitive_Systems_11_07_07.html http://www.hhs.gov/ocio/policy/hhs-ocio-2010-0002.001s_hhs_rules_of_behavior.html

3. What training activities satisfy the role-based training requirement: Users pursue training appropriate to their needs. Within the NIH training system menu, role-based courses include a reference to roles they address.

4.3 Security Training Records

NIH has a tracking system in place for monitoring compliance with this policy. The system also has a function whereby individuals can record additional role-based training documentation.

In addition to the electronic course record, only certificates of completion generated by the NIH Information Security and Privacy Tracking System are considered valid proof of course completion.

If a user takes a course via the Public Access side of the training website, i.e., they do not log in with their NIH ID, they can provide a certificate of completion and credit can be given for the course. Note: these types of certificates will have the words “General Public” in the lower left hand side of the certificate.

If a user provides a course certificate from the NIH Learning Management System (LMS)—but there is no record in the Information Security and Privacy Tracking System— no credit will be given for the course.

5. Roles and Responsibilities The primary individuals listed below may assign a designee to carry out these responsibilities.

5.1 NIH Chief Information Officer (CIO)

The NIH CIO establishes and ensures the implementation of this policy at NIH, consistent with all other Federal, HHS, and NIH rules and regulations.

5.2 NIH Chief Information Security Officer (CISO)

The NIH CISO implements this policy within NIH, ensures compliance, and approves all exceptions.

5.3 NIH Institutes and Centers Information System Security Officer (IC

ISSO)

The IC ISSO coordinates the implementation of this policy within their IC, monitors and ensures compliance, and submits exception requests to the NIH CISO. The NIH IC ISSOs will:

1. Promote awareness of information security issues among IC managers, technical support staff, and users.

2. Disseminate awareness information provided by the NIH CISO.

NIH IT Security Awareness and Training Policy, February 24, 2011 9

3. Coordinate and track staff security training.

4. Annually update their list of IC staff that require role-based training and ensure compliance.

6. Compliance NIH users who do not comply with the prescribed Information Security Awareness and Training Policy are subject to penalties that can be imposed under existing policy and regulations, including: official written reprimands; suspension of system privileges;

temporary suspension from duty; removal from current position; termination of employment;

and even criminal prosecution.

At a minimum, ICs shall disable the active directory accounts of individuals who fail to take their security awareness and required role-based training by the IC and/or NIH deadline. The IC deadline for completion of the annual security awareness training is May 31th. Accounts can only be reactivated after the individual has satisfied their training requirements.

Requests for exceptions to this policy will be evaluated by the NIH CISO. A waiver request must include a business case for the request (how the enforcement of this policy would restrict the mission of NIH) and the specific compensating controls that will be implemented.

IC ISSOs are responsible for submitting exception requests to the NIH CISO using the HHS Policy Waiver form.

7. Applicable Laws and Guidance Federal Information Security Management Act (FISMA)

Office of Personnel Management (OPM) Regulation 5 Code of Federal Regulations (CFR) 930.01

HHS-OCIO Policy for Information Systems Security and Privacy

NIST 800-16, Information Technology Security Training Requirements

8. Information and Assistance Comments, questions, suggestions or requests for further information should be directed to the

NIH/OCIO/ISAO.

9. Effective Date/Implementation The effective date of this policy is the date the policy is approved.

NIH IT Security Awareness and Training Policy, February 24, 2011 10 http://intranet.hhs.gov/infosec/docs/policies_guides/Waiver/PG_Policy_Waiver_20070927_Final_3.doc http://intranet.hhs.gov/infosec/docs/policies_guides/Waiver/PG_Policy_Waiver_20070927_Final_3.doc http://csrc.nist.gov/drivers/documents/FISMA-final.pdf https://www.opm.gov/fedregis/2004/69-061404-32835-a.pdf https://www.opm.gov/fedregis/2004/69-061404-32835-a.pdf http://intranet.hhs.gov/infosec/docs/policies_guides/PISSP/Policy%20for%20Information%20Systems%20Security%20and%20Privacy_toc.html http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf mailto:nihisaopolicy@nih.gov

10. Approved

______/s/______________________ __2/10/11___________________ John F. Jones, Jr., Ph.D Date NIH Chief Information Officer

NIH IT Security Awareness and Training Policy, February 24, 2011 11

11. Glossary NIH Glossary of IT Security Terms

NIH IT Security Awareness and Training Policy, February 24, 2011 12 https://ocio.nih.gov/security/ISSO%20Glossary.doc

12. Appendix A: Links Referenced Federal Information Security Management Act (FISMA)

Office of Personnel Management (OPM) Regulation 5 Code of Federal Regulations (CFR) 930.01 https://www.opm.gov/fedregis/2004/69-061404-32835-a.pdf

NIST 800-16, Information Technology Security Training Requirements http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf

HHS-OCIO Policy for Information Systems Security and Privacy http://ocio.nih.gov/security/20081218_DRAFT_HHS_Information_Security_Privacy_Program_ Policy_v11.doc

HHS Rules of Behavior (For Use of HHS Information Technology Resources) http://www.hhs.gov/ocio/policy/hhs-ocio-2010-0002.001s_hhs_rules_of_behavior.html

NIH Information Security Awareness course http://irtsectraining.nih.gov/

NIH General Information Technology Rules of Behavior http://ocio.nih.gov/security/nihitrob.html

Information Security Orientation http://ocio.nih.gov/security/Sec-Orient-for-New-Users.doc

October 3, 2007; Role-Based Training (RBT) of Personnel with Significant Security Responsibilities http://intranet.hhs.gov/infosec/docs/policies_guides/RBT/Definition_of_SSR_Security_RBT_Im plementation_FINAL_(3).html

November 7, 2007; Training of Individuals Developing and Managing Sensitive Systems http://intranet.hhs.gov/infosec/docs/policies_guides/training/Training_of_Individuals_Developin g_Managing_Sensitive_Systems_11_07_07.html

NIH Master Glossary of IT Security Terms http://ocio.nih.gov/security/ISSO%20Glossary.doc

NIH IT Security Awareness and Training Policy, February 24, 2011 13 https://www.opm.gov/fedregis/2004/69-061404-32835-a.pdf https://www.opm.gov/fedregis/2004/69-061404-32835-a.pdf http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf https://ocio.nih.gov/security/20081218_DRAFT_HHS_Information_Security_Privacy_Program_Policy_v11.doc http://www.hhs.gov/ocio/policy/hhs-ocio-2010-0002.001s_hhs_rules_of_behavior.html http://irtsectraining.nih.gov/ https://ocio.nih.gov/security/nihitrob.html https://ocio.nih.gov/security/Sec-Orient-for-New-Users.doc http://intranet.hhs.gov/infosec/docs/policies_guides/RBT/Definition_of_SSR_Security_RBT_Implementation_FINAL_(3).html http://intranet.hhs.gov/infosec/docs/policies_guides/RBT/Definition_of_SSR_Security_RBT_Implementation_FINAL_(3).html http://intranet.hhs.gov/infosec/docs/policies_guides/training/Training_of_Individuals_Developing_Managing_Sensitive_Systems_11_07_07.html https://ocio.nih.gov/security/ISSO%20Glossary.doc