GSA_QMAE-EV-180001-D_IT_Security_Procedural_Guide_06_07_2018.pdf

Office of the Chief Information Security Officer

IT Security Procedural Guide:

Security Reviews for Low Impact

Software as a Service (SaaS) Solutions

CIO-IT Security-16-70

Initial Version

May 19, 2016

CIO-IT Security-16-70 Low Impact SaaS Solutions

U.S. General Services Administration

VERSION HISTORY/CHANGE RECORDS

Initial Version - 05/19/16

Change Number

Person Posting Change

Change Reason for Change Page

Number of Change

Wilson/ Klemens/ Cozart-Amos

Initial Version of Low Impact SaaS Solutions in Procedural Guide format

Converting Document to a Procedural Guide

All

U.S. General Services Administration

Approval

IT Security Procedural Guide: Security Reviews for Low Impact Software as a Service (SaaS) Solutions - CIO-IT Security 16-70 is hereby approved for distribution.

5/19/2016

X Kurt Garbars

Kurt Garbars

GSA Chief Information Security Officer

Signed by: KURT GARBARS

Contact: GSA Office of the Chief Information Security Officer (OCISO), Policy and Compliance Division, at ispcompliance@gsa.gov.

U.S. General Services Administration i

TABLE OF CONTENTS

1 INTRODUCTION

2 PURPOSE

3 POLICY

4 DOCUMENT REFERENCES

5 RESPONSIBILITIES

5.1 GSA Chief Information Officer (CIO)

5.2 Chief Information Security Officer (CISO)

5.3 Authorizing Official (AO)

5.4 Office of the CISO Division Directors

5.5 Information Systems Security Manager (ISSM)

5.6 Information Systems Security Officer (ISSO)

5.7 System Owners

5.8 Contracting Officers [CO]/Contracting Officers Representative [COR])

6 SECURITY REVIEWS FOR LOW IMPACT SOFTWARE AS A SERVICE (SAAS) SOLUTIONS

6.1 Required Review Activities

6.2 Security Authorization and Ongoing Maintenance

U.S. General Services Administration 1

1 Introduction

General Services Administration (GSA) and Federal information security policies including the Office of Management and Budget (OMB) A-130, Management of Information Resources, requires security authorizations for all Federal Information Processing Standards (FIPS) 199 Low, Moderate, and High impact information systems consistent with Federal assessment and authorization (A&A) processes as documented in Chief Information Officer (CIO) Information Technology (IT) Security Procedural Guide: Managing Enterprise Risk – Security Assessment and

Authorization, Planning and Risk Assessment, CIO IT Security 06-30. Agencies are permitted to utilize commercial cloud computing services provided appropriate security controls are implemented, tested, and reviewed as part of the agency’s information security program and protected to the degree required by Federal Information Security Modernization Act (FISMA) of 2014, FISMA implementing standards, and associated guidance. Furthermore, these services are required to be included in annual FISMA security reviews.

Current information security requirements as noted above are not always practical for certain types of private sector cloud computing Software as a Service (SaaS) solutions that are implemented for (1) limited duration and/or one time use; (2) involve data already in the public domain or data that is non-sensitive and could be considered FIPS 199 low impact, (3) GSA would not be harmed regardless of the consequence of an attack or compromise; and, (4) the dollar cost for such deployments do not exceed $100,000 annually.

In such cases, the Office of the Chief Information Security Officer (OCISO) recognizes the need for added flexibility to allow GSA Service/Staff Office Authorizing Officials (AOs) the option to implement such low cost market driven solutions following a more streamlined assessment and authorization approach. AOs must consider Federal and agency information security requirements, its own security needs, evaluation of the data and project scope to assure it meets the conditions noted above, and completion of the review activities noted below and supplemented by available third party audits or certifications detailed below, to assure the security controls and practices of the contractor are adequate before authorizing use and accepting residual risk.

2 Purpose

This IT Security Procedural Guide: Security Reviews for Low Impact Software as a Service (SaaS) Solutions defines the steps necessary to perform security reviews of low impact GSA SaaS solutions.

3 Policy

Chapter 1, Section 11a, Contractor Operations, of the GSA IT Security Policy CIO 2100.1states:

GSA system program managers and contracting officers shall ensure that the appropriate security requirements of this order are included in task orders and contracts for all IT systems designed, developed, implemented, and operated by a contractor on behalf of the government, including systems operating in a Cloud Computing environment including but not limited to Software as a Service (SaaS) and Platform as a Service (PaaS). In addition, the government shall ensure that the contract allows the https://www.whitehouse.gov/omb/circulars_a130_a130trans4/ https://insite.gsa.gov/portal/getMediaData?mediaId=706674 https://insite.gsa.gov/portal/getMediaData?mediaId=706674 https://insite.gsa.gov/portal/getMediaData?mediaId=706674 https://www.congress.gov/bill/113th-congress/senate-bill/2521/text https://www.congress.gov/bill/113th-congress/senate-bill/2521/text https://insite.gsa.gov/portal/getMediaData?mediaId=513044

U.S. General Services Administration 2 government or their designated representative (i.e. third party contractor) to review, monitor, test, and evaluate the proper implementation, operation, and maintenance of the security controls. This requirement includes, but is not limited to: documentation review, server configuration review, vulnerability scanning, code review, physical data center reviews, and operational process reviews and monitoring of SSAE 16 reporting control submissions.

Chapter 3, Section 2e (7), Authorized Processing, of GSA CIO 2100.1 states:

Private sector cloud computing Software as a Service (SaaS) solutions that are implemented for limited duration and/or one time use; involve data already in the public domain or data that is non-sensitive and could be considered minimal impact; GSA would not be harmed regardless of the consequence of an attack or compromise, and the dollar cost for such a deployment does not exceed $100,000 annually, may follow the streamlined assessment and authorization approach defined in IT Security Procedural Guide: Managing Enterprise Risk, OCIO-IT Security-06-30, for such systems. AOs must consider Federal and agency information security requirements, and the S/SO security needs. An evaluation of the data and project scope must be performed to assure the conditions noted above are met. A review of the security controls and activities for such systems must be performed to assure the security controls and practices of the contractor are adequate before authorizing use and accepting residual risk.

4 Document References

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations

GSA IT Security Policy CIO 2100.1 GSA IT Security Procedural Guide: Managing Enterprise Risk – Security Assessment and

Authorization, Planning and Risk Assessment (CIO IT Security 06-30)

5 Responsibilities

There are many roles associated with implementing an effective security program for Software as a Service (SaaS) Solutions. Roles and responsibilities for agency management officials and others with significant IT Security responsibilities are fully defined in GSA CIO 2100.1. The following sections provide a high level description and summary of the key roles involved in Low Impact SaaS solutions.

5.1 GSA Chief Information Officer (CIO)

The GSA Chief Information Officer (CIO) has overall responsibility for the GSA IT Security Program. Responsibilities include:

Developing and maintaining an agency-wide GSA IT Security Program;

Ensuring the agency effectively implements and maintains information security policies and guidelines.

Conducting independent activities and compliance reviews including oversight of GSA’s Assessment and Authorization (A&A) process.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://insite.gsa.gov/portal/getMediaData?mediaId=513044 https://insite.gsa.gov/portal/getMediaData?mediaId=706674 https://insite.gsa.gov/portal/getMediaData?mediaId=706674

U.S. General Services Administration 3

5.2 Chief Information Security Officer (CISO)

The CISO is the focal point for all GSA IT security and must ensure that the security requirements described in GSA CIO 2100.1 are implemented agency-wide.

Implementing and overseeing GSA's IT Security Program by developing and publishing IT Security Procedural Guides that are consistent with GSA CIO 2100.1.

Assisting S/SO/R in implementing the IT Security Program and Security Policies when requested.

Assisting in the oversight of GSA’s IT Security Program and Security Policies.

Ensuring that IT Acquisitions align with GSA Information Security requirements.

5.3 Authorizing Official (AO)

The Authorizing Official (AO) is the Federal Government management official with the responsibility to identify the level of acceptable risk for an IT system or application and to determine whether the acceptable level of risk has been obtained. Final authority to operate or not operate the system rests with the AO.

Reviewing and approving security safeguards of information systems and issuing accreditation statements for each information system under their jurisdiction based on the acceptability of the security safeguards of the system (risk-management approach).

Ensuring adherence to GSA’s IT Security Policy.

Ensuring that IT systems that handle payment card data meet the security requirements of the in Payment Card Industry Data Security Standard.

5.4 Office of the CISO Division Directors

OCISO Directors are the intermediary to the Authorizing Official for ensuring that security is implemented. The Director is the focal point for all IT system security matters for the IT resources under their responsibility.

Monitoring adherence and proper implementation of GSA’s IT Security Policy and reporting the results to the CISO.

Reviewing and approving system assessments, prior to forwarding them to the Authorizing Official for approval and the CISO for concurrence.

Reviewing and approving assessment and authorization documents to be signed by the appropriate business line representatives and concurred by the appropriate OCISO personnel.

5.5 Information Systems Security Manager (ISSM)

The Information Systems Security Manager (ISSM) is the intermediary to the System Owner and the OCISO Director responsible for ISSO services. The ISSM reports to the OCISO Director for the systems under their authority.

Ensuring assessment and authorization support documentation is developed and maintained.

Ensuring adherence and proper implementation of GSA’s IT Security Policy.

U.S. General Services Administration 4

Managing system assessments (including A&A package requirements PCI DSS Report on

Compliance (for IT systems that handle payment card data)), and forwarding them to the Authorizing Official and OCISO Directors.

Forwarding to the appropriate OCISO Director, copies of assessment and authorization documents to be signed by the appropriate individuals as required in A&A guidance.

5.6 Information Systems Security Officer (ISSO)

The Information Systems Security Officer (ISSO) is the focal point for ensuring implementation of adequate system security in order to prevent, detect, and recover from security breaches.

Responsibilities include:

Ensuring effective implementation of GSA’s IT Security Policy.

Ensuring the system is operated, used, maintained, and disposed of in accordance with internal security policies and procedures. Necessary security controls should be in place and operating as intended.

Advising System Owners of risks to their systems and obtaining assistance from the ISSM, if necessary, in assessing risk.

Assisting the Authorizing Official in the system assessment and authorization (processes) and creating and maintaining authorization documentation. The ISSO will assist the System Owner to develop and update the system security plan, manage and control changes to the system, and assess the security impact of those changes.

Assisting the Authorizing Official in PCI DSS Implementation and certification for IT systems that handle payment card data, to include creating and maintaining PCI DSS documentation, and facilitating the self-assessment.

5.7 System Owners

System Owners (e.g. System Program Managers/Project Managers) are management officials within GSA who bear the responsibility for the acquisition, development, maintenance, implementation, and operation of GSA's IT systems. System Owners represent the interests of the system throughout its lifecycle. Primary responsibility for managing risk and privacy should rest with the System Owners.

Ensuring their systems and the data each system processes have necessary security controls in place and are operating as intended and protected in accordance with GSA regulations and any additional guidelines established by the OCISO.

Obtaining a written Authorization To Operate (ATO) following GSA Assessment and Authorization processes prior to making production systems operational and/or Internet accessible. Developing and maintaining the system security plan and ensuring that the system is deployed and operated according to the agreed-upon security requirements.

Coordinating with IT security personnel including the ISSM and ISSO and Data Owners to ensure implementation of system and data security requirements.

Reviewing the security controls for its Payment Card systems and networks annually as part of the PCI DSS assessment, when significant changes are made to the system and network.

U.S. General Services Administration 5

5.8 Contracting Officers [CO]/Contracting Officers Representative [COR])

The Acquisitions/Contracting function is responsible for managing contracts and overseeing their implementation. For additional information refer to GSAM 539-7002 clauses 552.239[-70] and 552.239-71.

Ensuring that all IT acquisitions include the appropriate security requirements in each contract and task order.

Coordinating with the CISO or other appropriate official as required to ensure that all agency contracts and procurements are compliant with the agency’s information security policy.

6 Security Reviews for Low Impact Software as a Service (SaaS) Solutions

6.1 Required Review Activities

The cloud vendor must be able to meet the requirements below and demonstrate how the requirements are provided and verified.

In the absence of actual deliverable artifacts from the vendor in a package submitted for signature by the GSA, CISO and Authorizing Official, a letter of attestation may be included from a Director within OCISO that any of the above requirements have been met through an in person meeting, or web enabled call; whereby it has been shown that the vendor adequately meets the criteria outlined for any/all of the required review activities. This review may be conducted by said Director or a member of a review team assigned to by the Director such as an ISSO or ISSM.

(1) Assign a unique ID to each person. Users must be individually identified (Reference NIST SP 800-53 control IA2 - Identification and Authentication). When possible, Two Factor Authentication (2FA) should be used for user logons.

(2) Document and implement system and security parameters deferred to customers. Do not use the vendor-supplied defaults for system passwords and other security parameters. GSA security policies and best practices should be used to the greatest extent possible.

(3) All transmissions of authentication credentials must be encrypted (e.g., TLS over HTTPS).

It is strongly recommended that the entire session be encrypted.

(4) Perform web application scanning (e.g., WebInspect, Acunetix, Burp Suite Pro, etc.)

annually. The OCISO can assist with web application scans if vendor(s) do not have an in house web application scanning capability.

(5) Perform operating system vulnerability scanning (e.g., Nessus, Qualys, nCircle, McAfee Vulnerability Manager, etc.). Scans are not necessary for vendors that are Payment Card Industry Data Security Standard (PCI DSS) compliant or that have a McAfee Secure Seal or TrustGuard Quarterly Scanned Seal. Vendors that are PCI DSS Compliant or have the McAfee Secure Seal or TrustGuard Quarterly Scanned Seal must provide the results of their latest scan.

(6) Verify that the vendor has an acceptable flaw remediation process exists. Vendors must be able to identify and remediate information system flaws in a timely manner (i.e., how https://www.acquisition.gov/sites/default/files/current/gsam/html/Part539.html https://www.acquisition.gov/sites/default/files/current/gsam/html/Part539.html

U.S. General Services Administration 6 often scans are completed and how vulnerabilities are remediated). Reference NIST 800-53 control SI2 – Flaw Remediation.

(7) The site must have an acceptable “terms of service” approved by the GSA legal office.

(8) Vendor shall either provide the results of their Service Organization Control

(SOC) 2/Statements on Standards for Attestation Engagements (SSAE) 16 audit report and/or have one of the following vendor certifications SysTrust, WebTrust (American Institute of Certified Public Accountants (AICPA)-sponsored), ISO/IEC 27001, or PCI DSS Compliance. The SSAE/SOC 2 is not a form of security certification but it does provide independent third party attestation of the provider’s general operating environment and supporting processes. Vendors may also provide evidence of PCI security assessments, self-testing, and records from other external audits and assessors to supplement the SSAE/SOC 2 audit report or vendor certifications. Vendors are strongly encouraged to present as much information as possible to allow an adequate understanding of the applications security posture and a determination of risk. Although the minimum requirement is for the SSAE/SOC 2 audit report or one of the vendor certifications; the GSA AO and the CISO will take a holistic view of the application based on all of the documentation presented to determine the overall risk of the application as well as any residual risks that may need to be accepted when considering the application for use. If the documentation presented does not provide an adequate understanding of the systems security posture and/or is deemed insufficient to make a risk determination; additional information will be required.

Information about the PCI Security Standards, the PCI DSS, vendors and solutions is available at the main PCI Security Standards Website.

6.2 Security Authorization and Ongoing Maintenance

The ATO package must include documentation and validation of the requirements identified in Section 6.1. The ATO package will be coordinated by the ISSO with the ISSM and OCISO. The Director, Policy & Compliance Division (ISP) reviews the package with the CISO being the final signature on the ATO letter—no AO signature. The ATO shall only be valid for the period of time the application is licensed or one year, whichever is shorter.

The ATO will be contingent on ongoing validation of the requirements identified in Section 6.1, including:

The latest SSAE/SOC 2 audit report, vendor certification, or PCI DSS compliance

The latest web application vulnerability scan results

The latest operating system vulnerability scan results or proof of compliance with PCI DSS, McAfee Secure Seal, or TrustGuard standards/seals.

If at any time, the vendor is either unwilling or unable to meet any of the requirements, the ATO shall be terminated. It is the responsibility of the assigned ISSO to ensure the requirements continue to be met. Significant changes shall be reported to the ISSM, who retains the ATO package.

http://www.webtrust.org/ http://en.wikipedia.org/wiki/ISO/IEC_27001 https://www.pcisecuritystandards.org/

U.S. General Services Administration 7

A Low Impact SaaS Solution Review Template is under development and will be posted to the GSA InSite IT Security Procedural Guides webpage when available. Until posted contact the OCISO Policy and Compliance Division at ispcompliance@gsa.gov.

https://insite.gsa.gov/portal/content/627230