Attachment_6_-_Security_Controls_Template.pdf

Attachment 6: Security Controls Template

Control

Family

Control

Control Name

Control Description (REV

3)

Minimum

Requirements

Submit with

Proposal

“GO-LIVE” Checklist

Ongoing

Personnel

Security

PS-3 Personnel

Screening

Control: The organization:

a. Screens individuals prior to authorizing access to the information system; and

b. Rescreens individuals according to

[Assignment:

organization-defined list of conditions requiring rescreening and, where re-screening is so indicated, the frequency of such rescreening].

a. See contract clause PBGC 03-003

- SUITABILITY

DETERMINATION

REQUIREMENTS

(JAN 2012)

b. PBGC requires all contractors to submit to a background investigation every five(5) years.

N/A

PBGC Personnel Security

Officer will verify all BASS contractors have completed background investigation initiation process.

PBGC Personnel Security

Officer will verify all

BASS contractors have completed background investigations.

Physical and

Environmen tal

Protection

PE-8 Monitoring

Physical

Access

Control: The organization:

a. Maintains visitor access records to the facility where the information system resides (except for those areas within the facility officially designated as publicly accessible); and

b. Reviews visitor access records [Assignment:

organization-defined frequency].

a. Maintain

Visitor Log for all non-PBGC and non-BASS visitors.

Visitors will be provided a temporary badge that states

“VISITOR”,

First and Last

Name, Date of

Visit and

Company and

Name of Escort

(BASS or

PBGC

contractor).

b. Visitor Logs will be reviewed at least semiannually

BASS Vendor shall provide a copy of the proposed Visitor

Log and draft of standard operating procedures detailing the

Visitor Sign-In process.

PBGC will verify Visitor

Log is in place at main entry/reception area of

BASS site.

a. PBGC will request Visitor

Log be scanned and emailed for review quarterly.

b. PBGC will review Visitor

Log during annual site security assessment.

Control

Control Name

Control Description (REV

3) for completeness.

Physical and

Environmen

PE-7 (1) Visitor Control (1) The organization escorts visitors and monitors visitor activity, when required.

Maintain Visitor Log for all non-PBGC and non-BASS visitors. Visitors will be provided a temporary badge that states “VISITOR”, First and Last Name, Date of Visit and

Company.

BASS vendor include compliance with this requirement the proposed security plan.

Security plan will include a proposed SOP for Visitor Sign-in and Sign-out and Escort.

BASS vendor include compliance with this requirement in the BASS vendor’s security plan.

Security plan will include a final SOP for Visitor Sign-in and Sign-out and Escort.

a. PBGC will request Visitor

Log be scanned and emailed for review quarterly.

PBGC will observe visitor escort procedures and review Visitor Log during annual site security assessment

Physical and

Environmen

PE-7 Visitor Control Control: The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible.

All Visitors will be required to present government-issued identification to verify identity.

BASS vendor will these requirements in their security plan. Security plan will include

SOP for Visitor

Sign-in and

Sign-out.

BASS vendor include compliance with this requirement in the BASS vendor’s security plan.

Security plan will include a final SOP for Visitor Sign-in and Sign-out and Escort.

BASS Vendor and PBGC will review and audit the automated physical security access control system at least annually to ensure minimum requirements for PE-7 are met.

Physical and

Environmen tal

Protection

PE-6 (1) Monitoring

Physical

Access

(1) The organization monitors real-time physical intrusion alarms and surveillance equipment.

BASS vendor contract with

Security Access

Control System vendor must include a monitoring agreement that includes 24/7/365 monitoring all BASS space access points and intrusion alarm notification.

BASS vendor will include the minimum requirements for

PE-6(1) in their security plan.

BASS Vendor will provide a copy of the Monitoring and Maintenance contract upon award.

BASS Vendor will provide a copy of the renewal of Monitoring and Maintenance contract at least annually.

Physical and

Environmen tal

Protection

PE-6 Monitoring

Physical

Access

Control: The organization:

a. Monitors physical access to the information

a. BASS vendor contract with

BASS vendor will provide proposed

Standard

BASS vendor will provide final Standard Operating

Procedure (SOP) for

Security Access Control

a. Vendor shall provide evidence of monthly audits

Control

Control Name

Control Description (REV

3) system to detect and respond to physical security incidents;

b. Reviews physical access logs [Assignment:

organization-defined frequency]; and

c. Coordinates results of reviews and investigations with the organization’s incident response capability.

Security

Access

Control

System vendor must include a monitoring agreement that includes

24/7/365 monitoring all BASS space access points and intrusion alarm notification.

Access control system must have report generating capabilities and must maintain card activity archives for at least one year.

b. BASS

Vendor will review physical access logs

(reports from security

Operating

Procedure (SOP) for Security

Access Control

Card Activation, Deactivation and

30-Day

Inactivity

Review.

Card Activation, Deactivation and 30-Day

Inactivity Review.

for PBGC review.

b. Vendor and

PBGC shall provide evidence of twice (or more) yearly audits of

IT sensitive areas.

Control

Control Name

Control Description (REV

3) access control system) monthly to ensure

BASS and

PBGC

personnel have appropriate access levels.

c. BASS

Vendor and

PBGC shall conduct security access control audits a minimum of twice per fiscal year

Physical and

Environmen tal

Protection

PE-5 Access

Control for

Output devices

Control: The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.

All PBGC output devices (computers, printers, MFD’s, fax machines, servers and

IT/Communications panels) shall be located within the

BASS space that only authorized personnel via their card keys or via visitors who are escorted at all times.

BASS Vendor shall provide security plan that details the implementation of an automated security access control system to secure all output devices located within the BASS space.

PBGC will inspect BASS space to ensure an automated security access control system has been installed.

a. Vendor shall provide evidence of monthly audits for PBGC review.

b. Vendor and

PBGC shall provide evidence of twice (or more) yearly audits of

IT sensitive areas.

Physical and

Environmen tal

Protection

PE-4 Access

Control for

Transmission

Medium

Control: The organization controls physical access to information system distribution and transmission lines within

All PBGC output devices (computers, printers, MFD’s, fax machines, servers and

BASS Vendor shall provide security plan that details the implementation

PBGC will inspect BASS space to ensure an automated security access control system has been installed.

PBGC will inspect and observe, at least annually, to ensure security plan has been implemented

PE-4.

Control

Control Name

Control Description (REV

3) organizational facilities. IT/Communications panels) shall be located within the

BASS space that only authorized personnel via their card keys or via visitors who are escorted at all times.

of an automated security access control system to secure all output devices located within the BASS space.

tal

Protection

PE-3 Physical

Access

Control

Control: The organization:

a. Enforces physical access authorizations for all physical access points

(including designated entry/exit points) to the facility where the information system resides (excluding those areas within the facility officially designated as publicly accessible);

b. Verifies individual access authorizations before granting access to the facility;

c. Controls entry to the facility containing the information system using physical access devices and/or guards;

d. Controls access to areas officially designated as publicly accessible in accordance with the organization’s assessment of risk;

e. Secures keys, combinations, and other physical access devices;

f. Inventories physical access devices

a. Multifactor access control using proximity for lowest risk, and

BASS

Vendor demonstrate s provisionin g/de-provisionin g of access cards via automated security access control system that is auditable and has reporting functionalit y.

b. Access card systems:

Review quarterly, monitor constantly.

c. Entry/exit

BASS Vendor shall provide proposed security plan and/or SOP that details the implementation of minimum requirements for

PE-3.

PBGC will review final security plan that details the implementation of minimum requirements for

PE-3.

PBGC will inspect and observe to ensure security plan has been implemented for PE-3.

PBGC will inspect and observe, at least annually, to ensure security plan has implemented requirements for PE-3.

Control

Control Name

Control Description (REV

3)

[Assignment:

organization-defined frequency]; and

g. Changes combinations and keys [Assignment:

organization-defined frequency] and when keys are lost, combinations are compromised, or individuals are transferred or terminated.

logs are recorded electronical ly.

Monthly reviews of access logs and Access control logs kept for 2 years.

d. For all

BASS

buildings, the lease terms include

BASS

access and credentials requirement s in the lease.

e. Keys shall be secured, inventoried

(via key log), and changed when keys are lost, compromis ed or individuals are transferred or terminated

Physical and

Environmen tal

Protection

PE-2 Physical

Access

Authorization

Control: The organization:

a. Develops and keeps current a list of personnel

a. Current list of personnel authorized access to the

BASS Vendor shall provide proposed security plan and

a. PBGC will review final security plan that details the implementation of

a. Vendor shall provide evidence of monthly audits

Control

Control Name

Control Description (REV

3) with authorized access to the facility where the information system resides (except for those areas within the facility officially designated as publicly accessible);

b. Issues authorization credentials;

c. Reviews and approves the access list and authorization credentials

[Assignment:

organization-defined frequency], removing from the access list personnel no longer requiring access.

BASS facility shall be maintained electronically within the automated security access control system.

b. BASS vendor shall issue authorizatio n credentials that may include a

PBGC-

issued ID badge and will include a BASS-issued security access control card.

c. Reviews and approves the access list and authorizatio n credentials removing from the access list personnel no longer requiring access within 24

SOP that details the implementation of minimum requirements for

PE-2.

minimum requirements for

PE-2.

b. PBGC will inspect and observe to ensure security plan has been implemented for

PE-2.

for PBGC review.

b. Vendor and

PBGC shall provide evidence of twice (or more) yearly audits of

IT sensitive areas.

Control

Control Name

Control Description (REV

3) hours of termination notification or termination date.

Physical and

Environmen tal

Protection

PE-18 Location of

Information

System

Components

Control: The organization positions information system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.

a. Information system components will be located within the delineated

BASS-

occupied space.

b. Information

System components will be located in such a manner as to minimize exposures to hazards such as flooding or fire.

a. BASS

Vendor shall provide propose d security plan and

SOP

that details the implem entation of minimu m require ments for PE-

18.

b. BASS

Vendor will submit construc tion plans to verify power specific ations.

a. PBGC will review final security plan that details the implementation of minimum requirements for

PE-18.

b. PBGC will inspect and observe to ensure security plan has been implemented for

PE-18.

PBGC will inspect and observe, at least annually, to ensure security plan has implemented requirements for PE-18.

Physical and

Environmen tal

Protection

PE-17 Alternate

Work Site

Control: The organization:

a. Employs [Assignment:

organization-defined

a. BASS

Vendor shall employ all

BASS Vendor shall provide proposed security plan and

a. PBGC will review final security plan that details the implementation of

PBGC will inspect and observe, at least annually, to ensure security plan

Control

Control Name

Control Description (REV

3) management, operational, and technical information system security controls] at alternate work sites;

b. Assesses as feasible, the effectiveness of security controls at alternate work sites; and

c. Provides a means for employees to communicate with information security personnel in case of security incidents or problems.

appropriate security controls as indicated in the SOW.

b. Effectivene ss of security controls will be assessed by

PBGC

and/or a third party assessor of their choosing.

c. PBGC shall employ a managemen t, operational and technical expert in a permanent position located at the BASS site

SOP that details the implementation of minimum requirements for

PE-17.

minimum requirements for

PE-17.

b. PBGC will inspect and observe to ensure security plan has been implemented for

PE-2.

requirements for PE-17.

Physical and

Environmen

PE-13

(3)

Fire Protection (3) The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis.

Fire suppression and detection devices/systems include, for example, sprinkler systems, handheld fire extinguishers, fixed fire hoses, and smoke detectors.

BASS Vendor shall provide proposed security plan and

SOP that details the implementation of minimum requirements for

PE-13(3).

a. PBGC will review final security plan that details the implementation of minimum requirements for

PE-13(3).

b. PBGC will inspect and observe to ensure security plan has been implemented for

PBGC will inspect and observe, at least annually, to ensure security plan has implemented requirements for PE-

13(3).

Control

Control Name

Control Description (REV

3)

PE-13(3).

(2)

Fire Protection (2) The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders.

Fire suppression devices/systems shall be monitored remotely by either the security access control system vendor or a fire panel monitoring vendor and notify

PBGC, the BASS vendor and emergency responders in the event of a fire.

BASS Vendor shall provide proposed security plan and

SOP that details the implementation of minimum requirements for

PE-13(2).

a. PBGC will review final security plan that details the implementation of minimum requirements for

PE-13(2).

b. PBGC will inspect and observe to ensure security plan has been implemented for

PE-13(2).

observe, at least annually, to ensure security plan has implemented requirements for PE-

13(2).

Physical and

Environmen

(1)

Fire Protection (1) The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire.

Fire detection devices/systems shall be monitored remotely by either the security access control system vendor or a fire panel monitoring vendor and notify

PBGC, the BASS vendor and emergency responders in the event of a fire.

BASS Vendor shall provide proposed security plan and

SOP that details the implementation of minimum requirements for

PE-13(1).

a. PBGC will review final security plan that details the implementation of minimum requirements for

PE-13(1).

b. PBGC will inspect and observe to ensure security plan has been

PE-13(1).

to ensure security plan has implemented requirements for PE-

13(1).

Physical and

Environmen tal

Protection

PE-13 Fire Protection Control: The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source.

Fire suppression and detection devices/systems for the information system that are supported by an independent energy source, as indicated by local fire and life safety code.

BASS Vendor shall provide proposed security plan and

SOP that details the implementation of minimum requirements for

PE-13.

PBGC will review and retain a copy of Certificates of Occupancies for the

BASS site.

to ensure security plan has implemented requirements for PE-13.

Physical and

Environmen

PE-12 Emergency

Lighting

Control: The organization employs and maintains

Automatic emergency lighting

BASS Vendor shall provide

PBGC will review and retain a copy of the BASS

PBGC will review and retain a copy of the

Control

Control Name

Control Description (REV

3)

Protection automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.

for the information system and that covers emergency exits and evacuation routes within the facility shall comply with local fire and life-safety code.

proposed security plan and

SOP that details the implementation of minimum requirements for

PE-12.

site’s Fire and Life Safety system inspection, to be conducted by local Fire

Marshal or appropriate official.

BASS site’s annual Fire and Life Safety system inspection, to be conducted by local Fire

Marshal or appropriate official

Physical and

Environmen tal

Protection

PE-11 Emergency

Power

Control: The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power source loss.

tal

Protection

PE-10 emergency

Shutoff

Control: The organization:

a. Provides the capability of shutting off power to the information system or individual system components in emergency situations;

b. Places emergency shutoff switches or devices in [Assignment:

organization-defined location by information system or system component] to facilitate safe and easy access for personnel; and

c. Protects emergency power shutoff capability from unauthorized activation.

Emergency

Shutoff:

The organization:

a. Provides the capability of shutting off power to the information system or individual system components in emergency situations;

b. Places emergency shutoff switches or devices in information technology resource areas to facilitate safe and easy access for personnel; and

c. Protects emergency power shutoff capability from unauthorized activation.

BASS Vendor shall provide proposed security plan and

SOP that details the implementation of minimum requirements for

PE-10.

a. PBGC will review final security plan that details the implementation of minimum requirements for

PE-10.

b. PBGC will inspect and observe to ensure security plan has been

PE-10.

to ensure security plan requirements for PE-10.