PWS Appendix 4_NARA 804 Information Technology (IT) Systems Security.pdf

MENU

Home » NARA Policies » Directives »

NARA Policy Directives - 800 - Information Technology, Web, and Social Media, and Corporate Records Management »

NARA 804, Information Technology (IT) Systems Security

SEARCH

Policies and Guidance

Directives

Interim Guidances

Policy Liaisons

NARA Notices

Information Collection

Directives

100 - Mission and Organization

200 - General Administration

300 - Human Resources

400 - Budget and Accounting

500 - Procurement (Acquisition)

600 - Travel

700 - Transportation

800 - Information Management

900 - Congressional and Legislative

1100 - Legal, Ethics, and Professional Conduct

1200 - Audits and Investigations

1300 - Records Lifecycle (general)

1400 - Front End

NARA 804, Information Technology (IT) Systems Security E�ective Date: April 4, 2007

Transmittal Memo

Date: April 4, 2007

SUBJECT: NARA 804, Information Technology (IT) Systems Security

TO: O�ice Heads, Sta� Directors, ISOO, NHPRC, OIG

Purpose of this transmittal memo. This transmits a revised policy directive, NARA 804, Information Technology (IT) Systems Security. NARA continues to review the supplements to the directive to update and expand this information as necessary to meet NARA's IT systems security needs.

Why has this directive been revised? We have revised NARA 804 to provide links to the Security Architecture and Methodologies, which are a component of the Enterprise Architecture Handbook. The Security Architecture and Methodologies replace the 804 handbooks which are out of date and have been superseded by FIPS 200.

Cancelled directive. NARA 804, dated July 18, 2005.

Whom can I contact if I have questions about this directive? Contact Sandra Paul-Blanc in room 4404, AII; on 301-837-3048; or via e-mail at Sandra.Paul- Blanc@nara.gov.

ALLEN WEINSTEIN

11/8/24, 9:44 AM NARA 804, Information Technology (IT) Systems Security https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 1/12 https://work.nara.gov/ https://work.nara.gov/nara_policies_and_guidance/index.html https://work.nara.gov/nara_policies_and_guidance/directives/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/index.html https://work.nara.gov/nara_policies_and_guidance/index.html https://work.nara.gov/nara_policies_and_guidance/index.html https://work.nara.gov/nara_policies_and_guidance/directives/index.html https://work.nara.gov/nara_policies_and_guidance/directives/intergui.html https://work.nara.gov/nara_policies_and_guidance/policy-liaison-list.html https://work.nara.gov/nara_policies_and_guidance/notices/2024.html https://work.nara.gov/nara_policies_and_guidance/information-collection.html https://work.nara.gov/nara_policies_and_guidance/directives/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0100_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0100_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0200_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0200_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0300_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0400_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0400_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0500_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0500_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0600_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0700_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0900_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/0900_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/1100_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/1100_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/1200_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/1200_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/1300_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/1300_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/1400_series/index.html mailto:Sandra.Paul-Blanc@nara.gov mailto:Sandra.Paul-Blanc@nara.gov https://work.nara.gov/

SEARCH

1500 - Archival

1600 - Access

Interim Guidance

Canceled or Superseded Guidance

SEARCH

Directives Search

Locator Search

Archivist of the United States

Supplements to this directive

Policy

1. Purpose of this directive

2. Authorities

3. What additional documents provide guidance for the security of NARA's IT systems?

4. What are some external directives that a�ect NARA's information technology systems security program?

5. To which systems does this directive apply?

6. To whom does this directive apply?

7. Definitions

8. Responsibilities

9. Why does NARA have an IT Security Program?

10. What are the objectives of the NARA IT Security Program?

11. How is the IT Security Program integrated with the Systems Development Lifecycle (SDLC), NARA 805?

12. How does the IT security program facilitate risk management?

13. How is this directive related to the NARA Enterprise Architecture?

14. Why are the supplements to this directive important?

15. How are records created by this directive maintained under the NARA records schedule?

SUBJECT: Information Technology (IT) Systems Security

804.1 What is the purpose of this directive?

a. This directive establishes policy and guidance for securing all electronic information collected or maintained by or on behalf of the National Archives and Records Administration (NARA) and the electronic information systems used or operated by or on behalf of NARA. This

11/8/24, 9:44 AM NARA 804, Information Technology (IT) Systems Security https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 2/12 https://work.nara.gov/nara_policies_and_guidance/directives/1500_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/1600_series/index.html https://work.nara.gov/nara_policies_and_guidance/directives/intergui.html https://work.nara.gov/nara_policies_and_guidance/directives/intergui_hist.html https://work.nara.gov/nara_policies_and_guidance/directives/intergui_hist.html directive also defines the role of IT security in the context of an overall enterprise architecture.

b. This directive also delineates the security management program structure, assigns responsibilities, and creates the foundation necessary to measure progress and compliance. The specific standards and procedures for implementation of NARA IT security policy are contained in the supplements to this directive.

804.2 Authorities

44 U.S.C. 2108; 5 U.S.C. 552, as amended;

5 U.S.C. 552a, as amended;

E.O. 12958; 40 U.S.C. 1401 through 1503, Information Technology Management Reform Act (Clinger-Cohen Act of 1996);

Federal Information Security Management Act (FISMA) of 2002 (PL 107- 347). FISMA reinforces past legislation (the Computer Security Act of 1987, the Clinger-Cohen Act, and the Paperwork Reduction Act) requiring each agency to implement an IT systems security program.

804.3 What additional documents provide guidance for the security of NARA's IT systems?

a. The NARA IT Security Architecture (SA) section of NARA's Enterprise Architecture (EA), available on NARA@work under Information Technology, prescribes a level of security for NARA systems and provides guidance to system owners, Information System Security O�icers (ISSO), and to all those who are responsible for the design, development, implementation, maintenance, and security of an information system. The security architecture also prescribes the technological framework for NARA's security program and identifies the controls that shape security policy.

b. The IT security supplements to this directive provide specific detailed implementation guidance for NARA systems that is to be used by ISSOs, system administrators, and all persons responsible for implementing and administrating NARA standard security settings on information systems.

c. NARA 805, Systems Development Lifecycle (SDLC), provides guidance and requirements, including those related to security, for project teams who are planning and implementing the development, evaluation, and maintenance of NARA's IT systems.

11/8/24, 9:44 AM NARA 804, Information Technology (IT) Systems Security https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 3/12

d. NARA 202, NARA Classified Information Security Program, provides guidance for those persons responsible for the protection and control of classified information. Detailed implementation instructions for E.O. 12958 as amended are contained in NARA 202's supplement, NARA Classified Information Security Program Handbook.

804.4 What are some external directives that a�ect NARA's information technology systems security program?

In addition to the legislation cited in par. 804.2, NARA is subject to Federal security requirements stated in Presidential Directives, mandates of oversight agencies, and standards, including:

a. Presidential Directives

1. Presidential Decision Directive 67 (PDD-67), Enduring Constitutional

Government and Continuity of Government Operations, 1998.

2. Homeland Security Presidential Directive-7, (HSPD-7), Critical Infrastructure Identification, Prioritization, and Protection, 2003.

Requires each agency to develop a plan to protect its critical information infrastructure.

3. HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors, 2004.

b. OMB Issuances

1. OMB A-130 - O�ice of Management and Budget Circular A-130, Appendix III – Security of Federal Automated Information Resources.

Guidance to all Federal agencies about the development and implementation of IT systems security programs.

2. OMB memos - O�ice of Management and Budget Memos, especially M03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, and M05-04, Policies for Federal Agency Public Websites.

c. Standards

1. National Institute of Standards (NIST) Federal Information

Processing Standards (FIPS) - Especially FIPS Publication 199, "Standards for Security Categorization of Federal Information and Information Systems", February 2004; FIPS Publication 200, "Minimum Security Requirements for Federal Information and Information Systems", March 2006; and FIPS Publication 201, "Personal Identity Verification (PIV) of Federal Employees and Contractors", March 2006.

The FIPS publications provide direction to all Federal agencies for https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 4/12 categorizing, securing, and controlling access to Federal information and information systems.

2. NIST SP 800 Series - NIST Special Publications as mandated by FIPS, especially NIST Special Publication 800-18 Rev 1, "Guide for Developing Security Plans for Federal Information Systems", February 2006; NIST Special Publication 800-53, "Recommended Security Controls for Federal Information Systems", February 2005; and, NIST Special Publication 800-37, "Guide for the Security Certification and Accreditation of Federal Information Systems", May 2004. The NIST Special Publications series provides direction to all Federal agencies for planning, developing, and approving security of Federal information systems.

d. Other

1. Committee on National Security Systems (CNSS) Issuances - CNSS issuances detail policy, direction, operational procedures, and guidance for the security of national security systems.

2. DCID 6/3 - Director of Central Intelligence Directive 6/3, Protecting Sensitive Compartmented Information Within Information Systems.

804.5 To which systems does this directive apply?

This directive applies to all information systems used or operated by, or on behalf of, NARA.

804.6 To whom does this directive apply?

This policy applies to all NARA employees, contractors, Foundation sta� and Foundation-funded employees, interns, volunteers, detailees, and others who have access to NARANET and are authorized to use NARA information systems.

804.7 Definitions

All IT terms used in conjunction with this policy, the IT Security program, or the NARA IT Security Architecture are defined in the NARA Enterprise Architecture Glossary of Terms and Acronyms, available on NARA@work under Information Technology.

804.8 Responsibilities

a. Chief Information O�icer (CIO) is the senior agency o�icial who directs a NARA-wide IT program to carry out the provisions of the Information Technology Management Reform Act of 1996 and the E-Government Act of 2002. The CIO ensures that development and implementation of the NARA IT Security program and NARA IT security architecture conform to all NARA https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 5/12 and other Federal standards, policies, and guidelines. The CIO is the designated authorizing o�icial (sometimes called Designated Accrediting Authority, or DAA) for agency-wide general support systems and is the co-authorizing o�icial with other senior o�icials for selected agency information systems. The CIO designates the senior agency information security o�icer. The Assistant Archivist for Information Services (NH) is NARA's CIO.

b. Chief Information Security O�icer (CISO) is the senior agency information security o�icer responsible for the implementation of this directive and its policies. The CISO directs the NARA IT Security Program with the mission and resources to assist in ensuring agency compliance with FISMA. The CISO is the agency o�icial responsible for carrying out the chief information o�icer responsibilities under FISMA. The Director, IT Security Programs (NHI) serves as NARA's CISO.

c. Chief Technology O�icer (CTO) develops, implements, and manages the NARA IT security architecture as part of the NARA Enterprise Architecture

(EA).

d. IT Security Sta� (NHI) plans and manages the IT Security program in conformance with the IT Security Architecture. The sta� assists in the development of the security architecture, assures the appropriate integration of security controls as part of the systems engineering process, and provides guidance and assistance to systems owners on matters of IT security.

e. System Developers are responsible for developing, documenting, and testing their systems, hardware, firmware, so�ware, and operations in conformance to the IT Security Architecture as directed by the IT Security program.

f. System Administrators are responsible for implementing, operating, and monitoring all NARA systems in conformance to the IT Security Architecture as directed by the IT Security program.

g. O�ice Heads, Presidential Library Directors, and Regional Administrators are responsible for ensuring compliance with this policy within their respective o�ices.

h. System Owners are the o�icials who have primary responsibility for determining that an IT system meets the business requirements of NARA, and who have responsibility for the procurement, development, and operation and maintenance of that system. System owners also evaluate the cost and benefits of system features, including the security costs of https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 6/12 mitigating any vulnerabilities associated with the system. The System Owner may function as the Designated Representative of the designated authorizing o�icial and may join the CIO as co-accreditor for selected agency systems. The System Owner also identifies or designates responsibility for two system functions: Data Owner (sometimes referred to as Information Owner) and the ISSO.

i. Designated Representative is the individual selected by an authorizing o�icial to act on his or her behalf in coordinating and carrying out the necessary activities required to assure that security is integrated into and implemented throughout the life cycle of a system, to include during the security certification and accreditation process. The DAA assigns responsibilities to the DAA Rep.

j. Data Owner (or Information Owner) has statutory or operational authority for information used by a system, and has responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal.

k. Information Systems Security O�icer (ISSO) has the responsibility to ensure that the appropriate operational security posture is maintained for an IT system or program. The ISSO assists in determining the security controls that are appropriate for the system, and provides information necessary to complete regular assessments of the system and the Plan of Action and Milestones (POA&M), which tracks response to internal and external audit findings.

l. Managers and supervisors throughout NARA ensure that their sta� and authorized personnel are aware of and comply with this policy.

m. System Users include all NARA employees, contractors, Foundation Sta� and Foundation-funded employees, interns, volunteers, detailees, and others who have access to NARANET and are authorized to use NARA information systems. Users are responsible for :

1. Adhering to the terms of the NARA acceptable use policy, NARA 802, Appropriate Use of NARA O�ice Equipment;

2. Completing the annual security and awareness training provided by NARA; and

3. Ensuring that passwords and other access credentials are not shared or made available to unauthorized persons.

804.9 Why does NARA have an IT Security Program?

NARA develops, documents, and implements an IT security program to provide https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 7/12 oversight, monitoring, compliance assessments, and program management for the electronic information and information systems that support the operation and assets of NARA, including those provided by or managed by another agency, contractor, or other source. These security activities comply with applicable Federal statutes, and must align with the standards specified in the NARA IT security architecture.

804.10 What are the objectives of the NARA IT Security Program?

The security program is the means by which NARA plans for security, ensures that the appropriate o�icials are assigned security responsibility, provides appropriate training awareness to system users and authorizes system processing before operations and periodically a�erward. The components of NARA's IT Security program:

a. Implement IT security standards that meet the requirements promulgated under 40 U.S.C. 11331.

b. Implement IT security standards and guidelines for NARA IT systems issued in accordance with law and as directed by the President,

c. Ensure that IT security management processes are integrated with agency strategic and operational planning processes, and

d. Ensure that NARA provides for the security of information and IT systems that support the operations and assets under their control.

e. Provide IT security protections commensurate with the risks and magnitude of harm that may result from unauthorized access, use, disclosure, disruption, modification, or destruction of:

1. Electronic information collected or maintained by, or on behalf of, NARA; and

2. Electronic information systems used or operated by, or on behalf of, NARA.

f. Implement the NARA Training and Awareness program.

804.11 How is the IT Security Program integrated with the Systems Development Lifecycle (SDLC), NARA 805?

NARA 805, Systems Development Lifecycle, specifies the creation of a system security plan as an integrated component of system development and acquisition. The NARA IT security program assists system owners in meeting their obligations in identifying, processing, planning, and managing risks that could impact on NARA operations, NARA assets, or individuals through four security processes.

https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 8/12

a. Certification, Accreditation (C&A), and Security Assessments determine the extent to which the security controls in each information system is implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.

The C&A process:

1. Addresses specific existing or planned actions to correct deficiencies in the security controls and to reduce or eliminate known vulnerabilities in the information system; and

2. Determines whether the remaining known vulnerabilities in the information system (a�er the implementation of an agreed-upon set of security controls) pose an acceptable level of risk to agency operations, agency assets, or individuals.

b. Risk Management is the process of identifying risk, assessing risk, and taking steps to reduce risk to an acceptable level. Risk management enables NARA to accomplish its mission by:

1. Better securing the IT systems that store, process, or transmit NARA information;

2. Enabling management to make well-informed risk management decisions to justify the expenditures that are part of an IT budget; and

3. Assisting the CIO in authorizing (or accrediting) the IT systems on the basis of the supporting documentation resulting from the performance of risk assessments.

c. Continuous Monitoring activities involve ongoing assessment of IT security controls on a continual basis. Continuous monitoring is achieved through the use of various tools that include, but are not limited to, intrusion detection systems, vulnerability scanners, log servers, and security information management tools.

d. The NARA Training and Awareness program ensures that all people involved in using and managing IT systems understand their roles and responsibilities related to NARA's mission, understand the NARA's IT security policy, procedures, and practices, and have adequate knowledge of the various management, operational, and technical controls required and available to protect the IT resources for which they are responsible.

804.12 How does the IT security program facilitate risk management?

a. The NARA IT security program ensures that security measures are adequate, or appropriate for the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 9/12 information. The certification and accreditation process is the means by which the security program helps responsible agency o�icials to understand the risks and other factors that could negatively impact their mission goals. It also allows them to make informed judgments and investments that appropriately keep risks at acceptable levels.

b. The assessment of security risk and the development of system security plans are two important activities in NARA's information security program that directly support the security certification and accreditation process, and are required by FISMA and OMB Circular A-130.

1. The risk assessment influences the development of the security controls for particular information systems and generates much of the information needed for the associated system security plans.

2. System security plans provide an overview of the information security requirements and describe the security controls in place or planned for meeting those requirements.

c. Risk management allows System Owners to balance the operational and economic costs of protective measures and increase mission capability by protecting the IT systems and data that support NARA's mission. The principal goal of NARA's risk management process is to protect the organization and its ability to perform its mission, not just its IT assets.

804.13 How is this directive related to the NARA Enterprise Architecture?

The NARA IT Security Architecture section of NARA's Enterprise Architecture (EA) establishes a framework by which a level of security for all NARA information systems is prescribed through a comprehensive and authoritative set of documentation that is appropriate to the risk and magnitude of the harm resulting from the loss, misuse, unauthorized access to, or modification of the information stored or flowing through these systems. The documentation:

a. Categorizes and describes the major elements that comprise and a�ect NARA's IT operating environment from an IT security perspective;

b. Defines NARA's IT security goals, principles and policies;

c. Defines NARA's IT risk profile;

d. Categorizes the security needs of NARA's information assets;

e. Identifies and specifies NARA's requirements for IT security management, IT security processes and IT security technologies across the agency; and

f. Provides architectural designs and engineering specifications for implementing and integrating IT security mechanisms.

https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 10/12

804.14 Why are the supplements to this directive important?

Specific standards and procedures for implementation of NARA IT security policy are contained in the supplements, in the form of the Security Architecture Section of the Enterprise Architecture. The Security Architecture contains Methodology sections which provide detailed instructions on the implementation for each of the security control families identified in the Security Architecture. The Security Architecture and Methodologies are found on the Enterprise Architecture page. Below is a brief explanation of each Security Architecture component.

a. IT Security Architecture - The Security Architecture supports the IT security program by providing a comprehensive and authoritative set of documents.

b. IT Security Domain Model - This document identifies the major elements (and their relationships) that comprise and impact NARA's IT environment from the perspective of IT security. The fundamental purpose of the model is to provide a comprehensive perspective of IT security that helps identify and clarify NARA's requirements for securing its IT operations, safeguarding its IT assets, and complying with all applicable Federal laws and directives.

c. IT Security Policies - NARA develops and maintains an overall NARA-wide IT security policy that explains: the purpose and scope of NARA IT security policy; assignment of responsibilities for program implementation, as well as individual and other related o�ices' responsibilities; and system compliance issues.

d. IT Security Requirements - The NARA IT Security Architecture documents security requirements that are mandated by FIPS 200, Minimum Security Requirements for Federal Information and Information Systems.

e. IT Security Mechanisms - Security mechanisms are the processes and technologies that must be implemented and applied to NARA's IT operating environment to mitigate risks and protect NARA's information assets. This section identifies and describes the IT security mechanisms that will be selected to address the security controls and associated security requirements.

f. IT Security Specifications - Security Specifications define how the mechanisms are engineered and implemented. They will detail standardized and reusable solutions for addressing NARA's IT security requirements.

11/8/24, 9:44 AM NARA 804, Information Technology (IT) Systems Security https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 11/12 https://work.nara.gov/information-services/enterprise-architecture/index.html

g. IT Security Engineering - Minimum IT security engineering for any information system is based on its categorization level for confidentiality, availability, and integrity needs.

h. IT Security Operations - Security Operations define the standard procedures for NARA processes. These are based on the IT Infrastructure Library (ITIL) standards for service management and have been adopted as the initial baseline for operating processes at NARA.

i. IT Security Assessment - NARA's IT Security Assessment is based on the following NIST publications: NIST SP 800-53a, Guide for Assessing the Security Controls ion Federal Information Systems, and NIST Sp 800-37, Certification and Accreditation of Federal Information Systems.

j. IT Security Program Management - A comprehensive IT security program service can consist of many elements that will depend on the specific needs of NARA and the relative maturity of its IT security program. NARA's program is based on several publications from NIST and DCID.

k. IT Security C&A Methodology - The primary purpose of the security certification and accreditation process is to determine whether the security controls prescribed in NARA's IT Security Architecture are adequately designed, adequately implemented, and whether compliance gaps exist.

These controls are assessed at all levels of the architecture.

804.15 How are records created by this directive maintained under the NARA records schedule?

Records produced or maintained in the fulfillment of this directive are filed in accordance with the disposition instructions in NARA Records Schedule, item 830, Files Related to Maintaining the Security of Systems and Data.

Page last reviewed: May 29, 2019 Notify the website manager if this page contains out-of-date or incorrect information.

HOME NARA@WORK INSTRUCTIONS LOG IN LOG OUT VOTE.GOV ACCESSIBILITY SUPPORT

11/8/24, 9:44 AM NARA 804, Information Technology (IT) Systems Security https://work.nara.gov/nara_policies_and_guidance/directives/0800_series/nara0804.html 12/12 https://work.nara.gov/nara-records-schedule/index.html#naraschedule https://work.nara.gov/nara-records-schedule/index.html#naraschedule https://work.nara.gov/form/content-feedback?url=/nara_policies_and_guidance/directives/0800_series/nara0804.html https://work.nara.gov/form/content-feedback?url=/nara_policies_and_guidance/directives/0800_series/nara0804.html https://work.nara.gov/ https://work.nara.gov/help/index.html https://work.nara.gov/user https://work.nara.gov/user/logout https://vote.gov/ https://work.nara.gov/websites/digital-accessibility.html