ATTACHMENT_W_-_GSA_IT_Security_Policy_-_Amendment_2.pdf

GENERAL SERVICES ADMINISTRATION

Washington, DC 20405

CIO 2100.1J CHGE 1

April 28, 2016

GSA ORDER

SUBJECT: GSA Information Technology (IT) Security Policy

1. Purpose. This Order issues GSA’s Information Technology Security Policy.

2. Cancellations.

a. CIO P 2100.1I CHGE 1, GSA Information Technology (IT) Security Policy is cancelled.

b. CIO IL-14-02 Authority-to-Operate (ATO) Extensions/Limited ATO is cancelled.

c. CIO IL-13-01 Mobile Devices and Applications is cancelled.

d. CIO IL-15-02 Updated Policy Statements for Personally Identifiable Information (PII) is cancelled.

3. Revisions. This Order provides updates for consistency with Federal requirements and program instruction implementation. Changes include:

a. Throughout document, changes were made to support CIO consolidation efforts.

b. Addition of Chapter 6: Privacy Controls.

c. Incorporates information from Instructional Letters: CIO IL-14-02 Authority-to- Operate (ATO) Extensions/Limited ATO, CIO IL-15-02 Updated Policy Statements for Personally Identifiable Information (PII) and CIO IL-14-04 Internal Clearance Process for GSA Data Assets into the policy.

d. Includes information from new Directives: CIO 2130.2 Enterprise IT Governance, CIO 2105.1C CHGE 1 GSA Section 508: Managing Information and Communications Technology (ICT) for Individuals with Disabilities, and MV-15-01 Contract Guidance on Information and Information Systems Security.

e. Includes new public law issued November 2014 – Public Law No: 113-187

Section 10 –Presidential & Federal Records Act Amendments.

f. Incorporates requirements from OAS P 1820.1 GSA Records Management

Program.

4. Applicability. This IT Security Policy applies to all individuals or corporate entities that process or handle GSA-owned information, data, all GSA IT systems, or any GSA data processed on IT systems owned and operated by any of the Services or Staff Offices. Contracting Officers must include compliance with this policy in the contract or task order for contractor employees (see Chapter 1 Section 11). This policy applies to the Office of Inspector General (OIG) only to the extent that the OIG determines it is consistent with the OIG’s independent authority under the IG Act and it does not conflict with other OIG policies or the OIG mission.

5. Explanation of change paragraph. Chapter 2, Section 15(f) is amended to add the following highlighted:

“f. Ensuring that adequate protection is maintained on their workstation, including not sharing passwords with any other person and logging out, locking, or enabling a password protected screen saver, and removing PIV card before leaving their workstation.”

6. Signature.

/S/_________________________________

DAVID SHIVE

Chief Information Officer Office of GSA IT i

Table of Contents

CHAPTER 1: THE GSA INFORMATION TECHNOLOGY SECURITY

PROGRAM

1. Introduction

2. Objectives

3. Federal laws and regulation

4. GSA policies

5. Compliance and deviation/waivers

6. Maintenance

7. Definition of information system

8. NIST and GSA guidance documents

9. Privacy Act systems

10. IT security controls

11. Contractor operations

CHAPTER 2: SECURITY ROLES AND RESPONSIBILITIES

1. GSA Administrator

2. GSA Chief Information Officer (CIO)

3. GSA Chief Financial Officer (CFO)

4. GSA Senior Agency Official for Privacy

5. GSA Chief Information Security Officer (CISO)

6. Heads of Services and Staff Offices (HSSOs)

7. Authorizing Official (AO)

8. Office of CISO Division Directors

9. Information Systems Security Manager (ISSM)

10. Information Systems Security Officer (ISSO)

11. System Owners

12. Data Owners

13. Contracting Officers and Contracting Officer’s Representatives

14. Custodians

15. Authorized Users of IT Resources

16. GSA Inspector General (IG)

17. GSA Personnel Security Officer/Office of Human Resources

Management

18. System/Network Administrators

19. Supervisors

CHAPTER 3: POLICY ON MANAGEMENT CONTROLS

1. Management controls from control families

2. Policy on controls for the security management of GSA systems

CHAPTER 4: POLICY ON OPERATIONAL CONTROLS

1. Operational controls from control families

2. Policy on controls for the operational security of the system ii

CHAPTER 5: POLICY ON TECHNICAL CONTROLS

1. Technical controls from control families ………………………………………. 54

2. Policy on controls for identification and authentication, access control, auditing and others

CHAPTER 6: POLICY ON PRIVACY CONTROLS

1. Authority and purpose

2. Accountability, audit, and risk management

3. Data quality and integrity

4. Data minimization and retention

5. Individual participation and redress

6. Use Limitation

CHAPTER 1: THE GSA INFORMATION TECHNOLOGY SECURITY

PROGRAM

1. Introduction. The purpose of this Order is to document and set forth the General Services Administration (GSA) Information Technology (IT) Security Policy. This IT Security Policy establishes controls required to comply with Federal regulations and laws, thus facilitates adequate protection of GSA IT resources.

2. Objectives. IT Security Policy objectives will enable GSA to meet its mission/business objectives by implementing systems with due consideration of IT-related risks to GSA, its partners, and customers. The security objectives for system resources are to provide assurance of confidentiality, integrity, availability, and accountability, by employing management, operational, and technical security controls as part of risk-based management. An important component of risk-based management is to integrate technical and non-technical security mechanisms into the system to reflect sound risk management practices. All incorporated security mechanisms must be well founded, configured to perform in the most effective manner, and add value to GSA’s IT-related investments. A risk-based management approach will enable the GSA IT Security Program to meet its goals by better securing IT systems, enabling management to justify IT Security expenditures, and by assisting management in authorizing IT systems for processing. GSA IT Security objectives include the following:

a. Confidentiality. Preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information. Private or confidential information is not disclosed to unauthorized individuals while in storage, during processing, or in transit.

b. Integrity. Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity. Safeguards must ensure that information retains its content integrity. Hardware and software resources of the system must operate according to requirements and design documents. Un-authorized personnel must not be able to create, alter, copy, or delete data processed, stored, or handled by the system. System information and application software is considered “official” and accurate as the basis for business decisions.

c. Availability. Ensuring timely and reliable access to and use of information. The system works promptly and service is not denied to authorized users. Systems and data are available for intended use only. The system must be ready for use by authorized users when needed to perform his/her duties.

d. Accountability. Accountability must be to the individual level. Only personnel with proper authorization and need-to-know must be allowed access to data processed, handled, or stored on IT system components.

e. Assurance. Confidence that the other four security objectives have been met.

The security measures, including: technical, managerial, and operational, work as intended to protect the system and the information it processes. This assurance is provided through monitoring and review of controls.

This Order supports GSA's IT Security Program objectives by identifying roles and assigning responsibilities in support of GSA’s IT Security Program. In addition, the Order defines comprehensive and integrated security requirements that are necessary to obtain management authorization to allow GSA IT systems to operate within an acceptable level of security risk. The order also supports GSA’s objective to ensure that all outsourced cloud services are from FedRAMP compliant cloud service providers, and leverage existing ATOs from other agencies to maximize savings. In addition to the security requirements in this Order, systems that contain payment card data or purchase/credit card numbers must implement the additional security controls known as security requirements as defined in Payment Card Industry Data Security Standard (PCI DSS) published by the PCI Security Standards Council as directed by the Financial Management Services of the Department of Treasury.

3. Federal laws and regulations. The primary focus of this policy is to provide guidelines that support the implementation of the following Federal regulations and laws, and the latest versions of the GSA directives in the next section:

· Federal Information Security Management Act (FISMA) of 2002.

· Clinger-Cohen Act of 1996 also known as the Information Technology

Management Reform Act (ITMRA) of 1996.

· Federal Financial Management Improvement Act of 1996 (FFMIA); OMB

Implementation Guidance for the FFMIA.

· Paperwork Reduction Act (PRA) of 1995 (Public Law 104-13).

· Federal Managers Financial Integrity Act (FMFIA) (Public Law 97-255).

· Government Paperwork Elimination Act (GPEA) (Public Law 105-277).

· Privacy Act of 1974 (5 U.S.C. § 552a).

· Homeland Security Presidential Directive (HSPD-20), National Continuity Policy.

· Homeland Security Presidential Directive (HSPD-12), Policy for a Common

Identification Standard for Federal Employees and Contractors.

· Homeland Security Presidential Directive (HSPD-7), Critical Infrastructure

Identification, Prioritization, and Protection.

· Office of Management and Budget (OMB) Circular A-130, Management of

Federal Information Resources, and Appendix III, Security of Federal Automated Information Systems as amended.

· Public Law No: 113-187, Presidential and Federal Records Act Amendments of 2014, Section10, Disclosure requirement for official business conducted using non-official electronic messaging account.

· Open Data Policy -- Managing Information as an Asset OMB Memorandum M- 13-13.

· Payment Card Industry Data Security Standard (PCI DSS)

· Executive Order 13556 Controlled Unclassified Information

4. GSA policies:

· GSA Order ADM 7800.11A, Personal Use of Agency Office Equipment

· GSA Order ADM P 9732.1, Suitability and Personnel Security

· GSA Order CIO 1878.1, GSA Privacy Act Program

· GSA Order CIO 1878.2A, Conducting Privacy Impact Assessments (PIAs) in

GSA

· GSA Order CIO 2100.2B, GSA Wireless Local Area Network (LAN) Security

· GSA Order CIO 2102.1, IT Information Technology (IT) Integration Policy

· GSA Order CIO 2104.1A, GSA Information Technology (IT) General Rules of

Behavior

· GSA Order CIO 2110.2, GSA Enterprise Architecture Policy

· GSA Order CIO 2135.2B, GSA Information Technology (IT) Capital Planning and

Investment Control

· GSA Order CIO 2140.3, Systems Development Life Cycle (SDLC) Policy

· GSA Order CIO 2160.2B, GSA Electronic Messaging and Related Services

· GSA Order CIO 9297.1, GSA Data Release Policy

· GSA Order CIO 9297.2, GSA Information Breach Notification Policy

· GSA Order CIO P 2165.2, GSA Telecommunications Policy

· GSA Order CIO P 2180.1, GSA Rules of Behavior for Handling Personally

Identifiable Information (PII)

· GSA Order CIO P 2181.1, Homeland Security Presidential Directive-12 (HSPD-

12) Personal Identity Verification and Credentialing

· GSA Order CIO P 2182.2, Mandatory Use of Personal Identity Verification (PIV)

Credentials

· Bring Your Own Device: A Toolkit to Support Federal Agencies Implementing

Bring Your Own Device (BYOD) Programs, August 23, 2012

· MV-15-01, Contract Guidance on Information and Information Systems Security

(GSAM 552.239-71)

· GSA Order CIO IL-15-02, Updated Policy Statements for Personally Identifiable

Information (PII)

· GSA Order OAS P 1820.1, GSA Records Management Program

Note:

· In addition to the principles set forth in GSA Order CIO 2110.2, architecture practices cited in OMB's The Common Approach to Federal Enterprise Architecture must be used during planning of a new system or significant capability enhancement.

· Executive Order 13556 implements the Controlled Unclassified Information (CUI) program. OCISO will provide additional guidance upon implementation of the program at GSA. Please contact the OCISO at itsecurity@gsa.gov or the CUI Program Manager at cui@gsa.gov for additional information.

· Additional policies, procedures and guidance can be found in the GSA IT Security InSite main page: https://insite.staging.gsa.gov/portal/category/534722.

The guides provide more detailed information on how to implement security processes and controls and provide worksheets and forms to meet reporting requirements. The guides are updated as needed to reflect the latest regulations and technologies. A current list of Government-wide security guidance provided by the National Institute of Standards and Technology (NIST) is located at http://csrc.nist.gov/publications/PubsSPs.html.

5. Compliance and deviation/waivers. Compliance is mandatory immediately upon signing. This IT Security Policy requires all GSA Services, Staff Offices, Regions (S/SO/R), Federal employees, contractors and other authorized users of GSA's IT resources, to comply with the security requirements outlined in this policy. This policy must be properly implemented, enforced, and followed to effectively protect GSA's IT resources and data. Appropriate disciplinary actions must be taken in a timely manner in situations where individuals and/or systems are found non-compliant. Violations of this GSA IT Security Policy may result in penalties under criminal and civil statutes.

All deviations/waivers from this Order must be approved by the appropriate Authorizing Official with a copy of the approval forwarded to the GSA Chief Information Security Officer (CISO) in the Office of GSA IT for concurrence.

6. Maintenance. The GSA Office of the Chief Information Security Officer (OCISO) will review this policy at least annually and revise it to:

· Reflect any changes in Federal laws and regulations;

· Satisfy additional business requirements;

· Encompass new technology;

· Adopt new Government IT standards.

7. Definition of information system. The term information system as defined in this document shall include major applications and general support systems as defined in OMB A-130. Major Applications shall include those information systems with an Exhibit 300 (also referred to as Major Programs) and any Exhibit 53 information systems that are not specifically covered in a general support system security plan. In addition, any IT system that stores privacy act data that is not specifically covered in a general support system shall be considered its own information system.

Smaller information systems (minor applications) may be coalesced together as subsystems of a single larger, more comprehensive system for the purposes of security authorization. Subsystems must be under the same management authority, have the same function or mission objective, the same operating characteristics and information security needs, and reside in the same general operating environment(s).

8. National Institute of Standards and Technology (NIST) and GSA guidance documents. All policies shall be implemented using the appropriate special publications from NIST and/or GSA procedural guides to the greatest extent possible. Where there is a conflict between NIST guidance and GSA guidance, contact the GSA Office of the Chief Information Security Officer. Where there are no procedural guides, use industry best practices. Federal Information Processing Standards (FIPS) publication requirements are mandatory for use at GSA.

NIST special publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory. Waivers for compliance to NIST special publications, (refer to 1.6 above for GSA deviations/waivers) must be based on an approved risk based decision that includes a date of resolution to comply.

9. Privacy Act systems. In addition to the security requirements in this Order, systems that contain privacy act data or personally identifiable information must implement the additional security controls as defined in NIST SP 800-53, Appendix J: Privacy Control Catalog, GSA Order CPO 1878.1 Privacy Act Program under “Information Security” and GSA Order CIO 1878.2, CIO P Conducting Privacy Impact Assessments (PIA) in GSA.

10. IT security controls. All IT systems, including those operated by a contractor on behalf of the Government, must implement proper security controls according to the security categorization level in accordance with FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems, FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems, the current version of NIST SP 800-53 R4, Security and Privacy Controls for Federal Information Systems and Organizations.

11. Contractor operations.

a. GSA system program managers and contracting officers shall ensure that the appropriate security requirements of this Order are included in task orders and contracts for all IT systems designed, developed, implemented, and operated by a contractor on behalf of the Government, including systems operating in a Cloud Computing environment including but not limited to Software as a Service (SaaS) and Platform as a Service (PaaS). In addition, the Government shall ensure that the contract allows the Government or its designated representative (i.e. third party contractor) to review, monitor, test, and evaluate the proper implementation, operation, and maintenance of the security controls. This requirement includes, but is not limited to: documentation review, server configuration review, vulnerability scanning, code review, physical data center reviews, and operational process reviews and monitoring of SSAE 16 reporting control submissions.

b. The security controls implemented as part of contracts and task orders must also include specific language that requires solutions to align with existing Information Security architecture. Additional information may be found in IT Security Procedural Guide: Security Language for IT Acquisition Efforts, OCIO-IT Security-09-48.

CHAPTER 2: SECURITY ROLES AND RESPONSIBILITIES

The roles and responsibilities described in the paragraphs below are assigned to the offices and positions identified to ensure effective implementation and management of GSA’s IT Security Program. The establishment of a security management structure and assigning of security responsibilities is a requirement of the Federal Information Security Management Act (FISMA).

1. GSA Administrator. The Clinger-Cohen Act assigns the responsibility for ensuring “that the information security policies, procedures, and practices of the executive agency are adequate.” FISMA provides the following details on agency head responsibilities for information security:

a. Providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of an agency, and on information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.

b. Ensuring that an information security program is developed, documented, and implemented to provide security for all systems, networks, and data that support the operations of the organization.

c. Ensuring that information security processes are integrated with strategic and operational planning processes to secure the organization’s mission.

d. Ensuring that senior agency officials within the organization are given the necessary authority to secure the operations and assets under their control.

e. Designating a Chief Information Officer (CIO) and delegating authority to that individual to ensure compliance with applicable information security requirements.

f. Ensuring that the agency has trained personnel to support compliance with information security policies, processes, standards, and guidelines.

g. Ensuring that the CIO, in coordination with the other senior agency officials, reports annually to the agency head on the effectiveness of the agency information security program, including the progress of remedial actions.

2. GSA Chief Information Officer (CIO). Mandated by the Clinger-Cohen Act of 1996 and FISMA, the GSA CIO has overall responsibility for the GSA IT Security Program.

Responsibilities include:

a. Developing and maintaining an agency-wide GSA IT Security Program.

b. Ensuring the agency effectively implements and maintains information security policies and guidelines.

c. Providing guidance, advice, and assistance to the Heads of Services and Staff Offices (HSSOs), and Regional Administrators (RAs) on implementing GSA’s IT Security Policy.

d. Providing management processes to enable the Authorizing Official to implement the components of the IT Security Program for which they are responsible.

e. Ensuring information assurance and the protection of GSA's cyber-based critical infrastructure.

f. Designating a Chief Information Security Officer (CISO) to assist in carrying out the GSA CIO’s agency-wide IT security responsibilities.

g. Establishing reporting requirements within GSA to assess GSA’s IT security posture, verifying compliance with Federal requirements and approved policies, and identifying agency-wide IT security needs.

h. Conducting independent activities and compliance reviews including oversight of GSA’s Assessment and Authorization (A&A) process.

i. Coordinating and reporting on HSPD-7 critical assets.

j. Reporting annually, in coordination with the other senior agency officials, to the GSA Administrator on the effectiveness of the agency information security program, including progress of remedial actions.

k. Reviewing Privacy Impact Assessments prepared by GSA organizations for security considerations.

l. Ensuring Privacy Impact Assessments are part of GSA’s System Development Life Cycle Guidance for Information Technology.

m. Providing guidance or input for periodic assessments of S/SO/R security measures and goals to assure implementation of GSA policy and procedures.

3. GSA Chief Financial Officer (CFO). The GSA Chief Financial Officer (CFO) also has major statutory security responsibilities under the CFO Act of 1990 and the Clinger- Cohen Act of 1996. Responsibilities include:

a. Developing and maintaining an integrated agency accounting and financial management system, including financial reporting and internal controls, which comply with FMFIA and FFMIA requirements;

b. Complying with such policies and requirements as may be prescribed by the Director of the Office of Management and Budget (OMB);

c. Complying with applicable accounting principles, standards, and requirements, and internal control standards and any other requirements applicable to such systems;

d. Supporting the GSA IT Capital Planning Process. To achieve satisfactory assurance levels of information security for the financial systems of GSA, close cooperation between the offices of the CFO and the CIO is necessary, including supporting the GSA IT Capital Planning process;

e. Reporting financial management information to OMB as part of the President’s budget;

(1) Complying with legislative and OMB-defined responsibilities as they relate to

IT capital investments; and

(2) Ensuring that the appropriate security requirements of this Order are included in task orders and contracts for all IT systems designed, developed, implemented, and operated by a contractor that hosts GSA financial systems. This includes, but is not limited to: documentation review of operational processes and reviews that monitor SSAE 16 reporting submissions.

4. GSA Senior Agency Official for Privacy. GSA has identified the CIO as the Senior Agency Official for Privacy (SAOP) having major statutory responsibilities under the Privacy Act of 1974, GSA Order CIO 1878.1, and the Consolidated Appropriations Act of 2005. Responsibilities include:

a. Establishing and overseeing the Privacy Act Program in GSA.

b. Ensuring GSA’s compliance with privacy laws, regulations and GSA policy.

c. Ensuring GSA’s compliance with NIST SP 800-53, Appendix J: Privacy Control Catalog.

d. Ensuring that GSA data assets go through secure clearance processing prior to public release and that applicable Privacy Policies are followed. The specific policy is detailed in Section 6.7 of this document.

e. Ensuring Privacy Impact Assessments (PIAs) are conducted for electronic information systems and collections and coordinating submission of all GSA Privacy Analysis Worksheets and PIA Summaries to OMB.

f. Developing, implementing, and overseeing personnel security controls for access to personally identifiable information.

g. Encouraging awareness of potential privacy issues and policies.

h. Directing the planning and implementation of the GSA Privacy Program to ensure agency personnel, including contractors, receive appropriate privacy awareness training to include IT Security and Privacy Awareness annual training, Privacy 201 training and Sharing Information in a Collaborative Environment training.

i. Signing GSA Privacy Act notices for publication for public comment in the Federal Register.

j. Reporting to OMB and Congress on the establishment or revision of Privacy Act systems.

k. Reporting periodically to OMB on GSA Privacy Act activities, as required by law and OMB information requests.

l. Policy making role in GSA’s development and evaluation of legislative, regulatory and other policy proposals which implicate information privacy issues.

m. Chairing the GSA Data Integrity Board that reviews and approves GSA's Computer Matching Program.

5. GSA Chief Information Security Officer (CISO) (formerly known as Senior Agency Information Security Officer). The Federal Information Security Management Act (FISMA) establishes the designation of a Senior Agency Information Security Officer.

GSA has assigned that responsibility to the Chief Information Security Officer (CISO).

The CISO is the focal point for all GSA IT security and must ensure that the security requirements described in this Order are implemented agency-wide. The CISO reports directly to the CIO as required by FISMA Responsibilities include:

a. Reporting to the GSA CIO on the implementation and maintenance of the GSA's IT Security Program and Security Policies.

b. Assisting in the oversight of GSA’s IT Security Program and Security Policies.

c. Reporting to the GSA CIO on activities and trends that may affect the security of systems and applications assigned to GSA.

d. Implementing and overseeing GSA's IT Security Program by developing and publishing IT Security Procedural Guides that are consistent with this policy.

e. Ensuring that written agreements assign security-related functions and identify security responsibilities of each S/SO/R or activity when two or more activities use the same IT.

f. Providing guidance and advice to all S/SO/R on IT security issues.

g. Assisting S/SO/R in implementing the IT Security Program and Security Policies when requested.

h. Reporting to agency senior management on policy compliance.

i. Directing the planning and implementation of the GSA IT Security Awareness and Privacy Training Program to ensure agency personnel, including contractors, receive appropriate security and privacy awareness training including “Sharing Information in a Collaborative Environment” training.

j. Managing the CIO Office of the CISO which implements the GSA IT Security and Privacy Programs.

k. Establishing reporting deadlines for IT Security related issues requiring an agency response affecting the GSA IT Security Program.

l. Performing information security duties as the primary duty.

m. Periodically assessing risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency.

n. Periodically testing and evaluating the effectiveness of information security policies, procedures, and practices.

o. Establishing and maintaining a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency.

p. Developing and implementing procedures for detecting, reporting, and responding to security incidents.

q. Ensuring preparation and maintenance of plans and procedures to provide continuity of operations for information systems that support the operations and assets of GSA.

r. Supporting the GSA CIO in annual reporting to the GSA Administrator on the effectiveness of the agency information security program, including progress of remedial actions.

s. Developing and implementing IT security performance metrics to evaluate the effectiveness of technical and nontechnical safeguards used to protect GSA information and information systems.

t. Assessing S/SO/R security measures and goals periodically to assure implementation of GSA policy and procedures.

u. Ensuring the appointment in writing of the ISSM and ISSOs for each system.

v. Administering FISMA requirements and coordinating GSA’s annual FISMA security program review and Plan of Action and Milestones (POA&M) implementations.

w. Ensuring that the ISSMs and ISSOs receive applicable security and privacy awareness training to carry out their duties.

x. Ensuring that IT Acquisitions align with GSA Information Security requirements.

6. Heads of Services and Staff Offices (HSSOs). HSSOs are responsible for authorizing the operation of all systems, networks, and applications for which they have responsibility. They may delegate some of their authority, (i.e., the role of Authorizing Official in writing), to appropriately qualified individuals within their organizations.

a. Ensuring adherence and proper implementation of GSA’s IT Security Policy.

b. Ensuring that the systems of record under their jurisdiction meet the requirements of the Privacy Act and GSA privacy policies and procedures.

c. Ensuring that contractors performing services associated with systems of record (such as system development, maintenance, or operation) are subject to the provisions of the Privacy Act and security requirements.

d. Tracking the measures and goals described in Chapter 3 (i) Performance

Measures of this policy and ensuring that AOs, ISSMs, and ISSOs support these measures.

e. Ensuring System Owners adhere to the GSA Records Management Program.

7. Authorizing Official (AO). The Authorizing Official (AO) is the Federal Government management official with the responsibility to identify the level of acceptable risk for an IT system or application and to determine whether the acceptable level of risk has been obtained. Final authority to operate or not operate the system rests with the AO. An AO must be assigned to every information system. An AO may have responsibility for more than one system, provided there is no conflict. Responsibilities include:

a. Ensuring adherence to GSA’s IT Security Policy.

b. Reviewing and approving security safeguards of information systems and issuing accreditation statements for each information system under their jurisdiction based on the acceptability of the security safeguards of the system (risk-management approach).

c. Ensuring that an Interim Authorization to Operate (IATO) is granted only if the necessary security enhancements to bring the system to the acceptable level of risk have been identified and a formal plan of action and milestones has been developed.

Information systems with an expiring ATO may perform a one-time extension of the current authorization for a period not to exceed one year (365 days) from the date of ATO expiry to allow development of near real-time continuous monitoring capabilities to support ongoing authorization.

d. Ensuring that GSA systems that are planned to be decommissioned may request a one-time ATO extension for a period not to exceed one year (365 days) from the date of the ATO expiry.

e. Ensuring that GSA information systems that are planned to be consolidated into another system or transitioned into a cloud environment may request an ATO extension, for a period not to exceed one year (365 days), to allow the information system to receive an ATO as part of the consolidated information system or its new cloud environment of operation. The scope of consolidation and/or the change in the system environment shall be approved by Office of the Chief Information Security Officer (OCISO) prior to submitting the ATO extension request for the system.

f. Ensuring that GSA information systems that have undergone a full security assessment of all NIST SP 800-53 controls at the appropriate FIPS 199 impact level as part of a three-year re-authorization, and have outstanding high and critical vulnerabilities identified as part of security assessment, may request a limited ATO extension for a period not to exceed 30 days from the date of the ATO expiry to allow mitigation of the high and critical vulnerabilities.

g. Ensure that new GSA information systems pursuing an agile development methodology and residing on infrastructures that have a GSA ATO concurred by the OCISO or a FedRAMP ATO may request a limited ATO for the pilot period of the project not to exceed one year (365 days). The limited ATO will be based on a lightweight security assessment and authorization (A&A) process; however, the period of the limited ATO should be used to conduct a full A&A resulting in a new three-year ATO.

h. Ensuring that under any and all circumstances, in which an ATO is issued for less than three years, the GSA system continues to perform monthly Operating System scans (with Root/Administrative privileges), Database scans (DBA privileges) and Web Application scans (authenticated user privileges). All vulnerabilities identified from the scans shall be resolved; tracked in the systems’ Plan of Action and Milestones (POA&M); and submitted to the GSA OCISO.

i. Providing support to the Information System Security Manager (ISSM), of record appointed by the CISO.

j. Providing support to the Information Systems Security Officer (ISSO) of record, appointed by the CISO for each information system.

k. Ensuring Information Assurance (IA) is included in management planning, programming budgets, and the IT Capital Planning process.

l. Requiring written notification of point(s) of contacts within other Federal agencies or outside organizations that manage GSA systems.

m. Ensuring that IT systems that handle privacy data meet the privacy and security requirements of the Privacy Act and IT information security laws and regulations. This includes GSA Order CIO 1878.1, GSA Order CIO 1878.2 and NIST SP 800-53

n. Reviewing and approving Privacy Impact Assessments (PIAs) for their organizations.

o. Supporting the security measures and goals described in Chapter 3(i) (Performance Measures) of this policy.

p. Ensuring all incidents involving data breaches which could result in identity theft are coordinated through GSA IT’s Office of the Chief Information Security Officer (OCISO) and the GSA Management Incident Response Team (MIRT) using the GSA breach notification plan per OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, IT Security Procedural Guide: Incident Response (IR), CIO-IT Security-01-02 and GSA Order, CIO 9297.2B, GSA Information Breach Notification Policy.

q. Ensuring contingency and continuity of support plans are developed and tested annually in accordance with OMB Circular No. A-130, NIST SP 800-34, Contingency Planning Guide for Information Technology Systems, and IT Security Procedural Guide:

Contingency Planning, OCIO-IT Security-06-29.

r. Implementing detailed separation of duties policies for IT systems based on the specific processes, roles, permissions, and responsibilities of personnel involved in GSA business operations.

s. Establishing physical and logical access controls to enforce separation of duties policy and alignment with organizational and individual job responsibilities.

t. Ensuring access to systems by members of the GSA OIG as described in paragraph 16 of this chapter.

u. Establishing appropriate system/organization unique rules of behavior for systems under their authority.

v. Ensuring that IT systems that handle payment card data meet the security requirements of the in Payment Card Industry Data Security Standard.

8. Office of CISO Division Directors. OCISO Directors are the intermediary to the Authorizing Official for ensuring that security is implemented. The Director is the focal point for all IT system security matters for the IT resources under their responsibility.

OCISO Directors report to the CISO. Responsibilities include:

a. Monitoring adherence and proper implementation of GSA’s IT Security Policy and reporting the results to the CISO.

b. Reviewing and approving system assessments, prior to forwarding them to the Authorizing Official for approval and the CISO for concurrence.

c. Reviewing and approving assessment and authorization documents to be signed by the appropriate business line representatives and concurred by the appropriate OCISO personnel.

d. Ensuring the security measures and goals described in Chapter 3(i) Performance Measures of this policy are met by the organizations under their responsibility.

e. Ensuring GSA security and privacy awareness training requirements for individuals under their responsibility are complied with.

f. Creating security policies that achieve compliance to appropriately address new security requirements.

g. Advises individuals with IT Security responsibility on proper system security, security “Best Practices” and applicable laws and regulations.

9. Information Systems Security Manager (ISSM). The Information Systems Security Manager (ISSM) is the intermediary to the System Owner and the OCISO Director responsible for ISSO services. There is at least one ISSM per Authorizing Official. The ISSM reports to the OCISO Director for the systems under their authority. An individual appointed as ISSM for a system cannot also be assigned as the ISSO for the same system. Current listings of FISMA Contacts are located on InSite. Responsibilities include:

a. Ensuring adherence and proper implementation of GSA’s IT Security Policy.

b. Providing guidance to the ISSOs.

c. Verifying annually the list of ISSOs and providing an updated designation letter to the Director for submission to the CISO when changes occur or designations expire.

d. Ensuring assessment and authorization support documentation is developed and maintained.

e. Reviewing and coordinating reporting of Security Advisory Alerts (SAA), compliance reviews, security and privacy awareness training, incident reports, contingency plan testing, and other IT security program elements.

f. Managing system assessments (including A&A package requirements PCI DSS

Report on Compliance (for IT systems that handle payment card data)),and forwarding them to the Authorizing Official and OCISO Directors.

g. Forwarding to the appropriate OCISO Director, copies of assessment and authorization documents to be signed by the appropriate individuals as required in A&A guidance.

h. Supporting the security measures and goals described in Chapter 3(i) Performance Measures of this policy.

i. Complying with GSA security and privacy awareness training requirements for individuals with significant security responsibilities.

10. Information Systems Security Officer (ISSO). The Information Systems Security Officer (ISSO) is the focal point for ensuring implementation of adequate system security in order to prevent, detect, and recover from security breaches. An ISSO must be assigned for every information system. An ISSO may have responsibility for more than one system, provided there is no conflict. An individual assigned as the ISSO cannot also be the ISSM for the same system. The ISSO must be knowledgeable of the information and processes supported by the system. The ISSO shall maintain accurate system inventories for information systems for which they have responsibility. A current list of ISSOs is located on InSite at: https://ea.gsa.gov/EAWEB/#!/FISMA_POC.

Regional ISSOs (RISSOs) have the same responsibilities as designated ISSOs.

a. Ensuring effective implementation of GSA’s IT Security Policy.

b. Ensuring the system is operated, used, maintained, and disposed of in accordance with documented security policies and procedures. Necessary security controls should be in place and operating as intended.

c. Advising System Owners of risks to their systems and obtaining assistance from the ISSM, if necessary, in assessing risk.

d. Assisting System Owners in completing and maintaining the appropriate security documentation including the system security plan.

e. Assisting the Authorizing Official in the system assessment and authorization (processes) and creating and maintaining authorization documentation. The ISSO will assist the System Owner to develop and update the system security plan, manage and control changes to the system, and assess the security impact of those changes.

f. Assisting the Authorizing Official, Data Owner and Contracting Officer / Contracting Officer Technical Representative in ensuring users have the required background investigations, the required authorization and need-to-know, and are familiar with internal security practices before access is granted to the system.

g. Promoting information security awareness.

h. Identifying, reporting and responding to security incidents.

i. Reviewing and responding as appropriate to Security Advisory Alerts on vulnerabilities.

j. Ensuring the user identification and authentication scheme used in the system is administered as intended.

k. Ensuring media handling procedures are followed.

l. Reviewing system security audit trails and system security documentation to ensure security measures are implemented effectively.

m. Evaluating known vulnerabilities to ascertain if additional safeguards are needed; ensuring systems are patched, and security hardened.

n. Beginning protective or corrective measures if a security breach occurs.

o. Assisting in the development and maintenance of contingency plan and contingency plan test report documentation.

p. Supporting the security measures and goals described in Chapter 3(i)

q. Complying with GSA security and privacy awareness training requirements for

r. Ensuring Privacy Impact Assessments (PIAs) are completed for IT systems that are new, under development, or undergoing major modifications which impact Privacy Act data.

s. Working with the ISSM and System Owners to develop, implement, and manage POA&Ms for assigned systems IAW IT Security Procedural Guide: Plan of Action and Milestones (POA&M), OCIO-IT Security-09-44.

t. Reviewing system role assignments to validate compliance with principles of least privilege.

u. Assisting the Authorizing Official in PCI DSS Implementation and certification for IT systems that handle payment card data, to include creating and maintaining PCI DSS documentation, and facilitating the self-assessment.

11. System Owners. System Owners (e.g. System Program Managers/Project Managers) are management officials within GSA who bear the responsibility for the acquisition, development, maintenance, implementation, and operation of GSA's IT systems. System Owners represent the interests of the system throughout its lifecycle.

Primary responsibility for managing risk and privacy should rest with the System Owners. Responsibilities include:

a. Ensuring effective implementation of GSA’s IT Security Policy.

b. Ensuring their systems and the data each system processes have necessary security controls in place and are operating as intended and protected IAW GSA regulations and any additional guidelines established by the OCISO and relayed by the ISSO or ISSM.

c. Obtaining the security resources for their respective systems.

d. Developing and implementing a configuration management plan for their respective systems.

e. Using the advice of the ISSM and ISSO along with the approval of the Authorizing Official, selecting the mix of controls, technologies, and procedures that best fit the risk profile of the system.

f. Participating in activities related to the assessment and authorization of the system to include security planning, risk assessments, security and incident response testing, and contingency planning and testing.

g. Defining and scheduling software patches.

h. Ensuring IT security and privacy requirements are included in IT contracts or contracts including IT.

i. Ensuring implementation of privacy requirements for their system of record.

j. Conducting PIAs on all systems to ascertain whether the system collects information on individuals or when new systems are developed, acquired, or purchased.

k. Developing, implementing and maintaining an approved IT Contingency Plan which includes an acceptable Business Impact Analysis (BIA).

l. Ensuring that information and system categorization has been established for their systems and data IAW FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems.

m. Conducting annual reviews and validations of system users’ accounts to ensure the continued need for access to a system and verify users’ authorizations (rights/privileges).

n. Ensuring that for each information system, security is planned, documented, and integrated into the system development life cycle (SDLC) from the information system’s initiation phase to the system’s disposal phase.

o. Reviewing the security controls for their systems and networks annually as part of the FISMA review, when significant changes are made to the system and network and at least every three years or via continuous monitoring based on continuous monitoring plans reviewed and accepted by the GSA CISO.

p. Defining, implementing, and enforcing detailed separation of duties by ensuring that single individuals do not have control of the entirety of a critical process, roles, permissions, and/or responsibilities.

q. Ensuring that physical or environmental security requirements are implemented for facilities and equipment used for processing, transmitting, or storing sensitive information based on the level of risk.

r. Obtaining a written Authorization To Operate (ATO) following GSA Assessment and Authorization processes prior to making production systems operational and/or Internet accessible. Developing and maintaining the system security plan and ensuring that the system is deployed and operated according to the agreed-upon security requirements.

t. Ensuring that system users and support personnel receive the requisite security and privacy awareness training (e.g., instruction in rules of behavior) and assisting in the identification, implementation, and assessment of the common security controls.

u. Supporting the security measures and goals described in Chapter 3(i)

v. Complying with GSA security and privacy awareness training requirements for

w. Integrating and explicitly identifying security funding for information systems and programs into IT investment and budgeting plans.

x. Working with program officials and the system developer on the system’s privacy issues, preparing a PIA report, obtaining the Program Manager’s approval of the PIA report, and submitting the PIA report to the GSA Personnel Security Officer and GSA IT officials for review and approval.

y. Coordinating with IT security personnel including the ISSM and ISSO and Data Owners to ensure implementation of system and data security requirements.

z. Working with the ISSO and ISSM to develop, implement, and manage POA&Ms for their respective systems IAW IT Security Procedural Guide: Plan of Action and Milestones (POA&M), OCIO-IT Security-09-44.

aa. Ensuring proper separation of duties for GSA IT system maintenance, management, and development processes.

bb. Conducting annual assessments to review the effectiveness of control techniques, with an emphasis on activities that cannot be controlled through logical, physical, or compensating controls.

cc. Working with the Data Owner, granting access to the information system based on a valid need-to-know/need-to-share that is determined during the account authorization process and the intended system usage.

dd. Working with Data Owners with assistance from the ISSO, will ensure system access is restricted to authorized users that have completed required background investigations, are familiar with internal security practices, and have completed requisite security and privacy awareness training programs, such as the annual IT Security & Privacy Act training curriculum.

ee. Working with Data Owners to ensure the appropriate level of auditing and logging data is enabled and generated to support monitoring activities.

ff. Working with Data Owners to ensure that log data is archived for a period of not less than 180 days.

gg. Working with Data Owners to audit user activity for indications of fraud, misconduct, or other irregularities.

hh. Working with Data Owners to document all phases of monitoring activity including monitoring procedures, response processes, and steps performed when reviewing user activity.

ii. Working with the GSA Senior Agency Official for Privacy and Privacy Officer and legal counsel to determine the authority of any program or activity to collect PII.

jj. Reviewing the security controls for its Payment Card systems and networks annually as part of the PCI DSS assessment, when significant changes are made to the system and network.

kk. Working with the Office of the Chief Information Security Officer and Data Owners to respond to any information security incidents that impact the system or the data stored within the system.

ll.