RFP 21-1793 Attachment A Office of Child Suppot Enforcement Security Agreement.pdf

I. PURPOSE AND EFFECT OF THIS SECURITY AGREEMENT

The purpose of this security agreement is to specify the management, operational, and technical security controls that the state agency administering the Child Support (CS) program shall have in place to ensure the security of Federal Parent Locator Service (FPLS) information and CS program information and the information systems that transmit, store, and process FPLS information and CS program information.

By signing this security agreement, the state CS agency agrees to comply with the security requirements established by the Social Security Act, the Privacy Act of 1974, the Federal Information Security Modernization Act of 2014 (FISMA), 42 United States Code (U.S.C.) § 653(m), 654(26), 42 USC 654a(d)(1)-(5), the U.S. Department of Health and Human Services (HHS), and the federal Office of Child Support Enforcement (OCSE). The state CS agency also agrees to use FPLS information and CS program information solely for the authorized purposes in accordance with the terms in this security agreement between the state CS agency and OCSE.

The state CS agency requests submitted to the FPLS are made solely to locate a parent for the purpose of establishing paternity, securing child support, or where applicable, to locate a parent in a parental kidnapping case, establish or enforce a child custody or visitation order, and for other purposes specified in federal law and regulations. The information exchanged between state CS agencies and all other state program information may only be used for authorized purposes under federal law and regulations (see 45 CFR 303.21) and must be protected against unauthorized access to reduce fraudulent activities and protect the privacy rights of individuals against unauthorized disclosure of confidential information.

In this security agreement (including the addendum), “state CS agency” means the single and separate state agency responsible for carrying out the child support program under title IV-D of the Social Security Act and required to operate child support data systems under 42 U.S.C.

454(3), (24), (26), (27) and (28) as a condition of federal funding, and its agents and designees, including all of the individuals and entities described in this agreement. “Information” and “data” mean all forms of information or data described in this agreement.

In this security agreement (including the addendum), “State IV-D director or Designee” means the individual designated to administer the state CS program.

State Child Support Agency - Security Agreement 2019

Attachment A Request for Proposal Number 210000001793

SECURITY AGREEMENT

U.S. Department of Health and Human Services Administration of Children and Families

Office of Child Support Enforcement and State Agency Administering the Child Support Program

State Child Support Agency - Security Agreement 2019

Attachment A Request for Proposal Number 210000001793

This security agreement is applicable to the personnel, facilities, documentation, data, electronic and physical records and other machine-readable information, and the information systems of the state CS agency, including, but not limited to, state employees and contractors working with FPLS information and CS program information and state CS agency data centers, statewide centralized data centers, contractor data centers, state Health and Human Services’ data centers, and any other individual or entity collecting, storing, transmitting, or processing FPLS information and CS program information.

Information originally transmitted from the FPLS to the state CS agency does not lose its character as FPLS information but remains FPLS information until its destruction; nor do the safeguarding requirements end when the information is transmitted to state CS agencies or other entities.

This security agreement is applicable to all FPLS information, which consists of the National Directory of New Hires (NDNH), Debtor File, and the Federal Case Registry (FCR), and all associated applications and resources. The NDNH, Debtor File, and FCR are components of an automated national information system which locates employment, income, asset and home address information on parents in child support cases for state CS agencies. The NDNH contains new hire (W-4), quarterly wage (QW), and unemployment insurance (UI) information on employees in both the public and private sector. The Debtor File contains personal information in identifiable form, including names, Social Security numbers (SSNs), arrearages, and other private data. The FCR collects and maintains records provided by state CS agency registries, which include abstracts of support orders and information from child support cases with name, SSN, state case identification number, state Federal Information Processing Standard (FIPS) code, county code, case type, sex, date of birth, mother’s maiden name, father’s name, participant type (custodial party, noncustodial parent, alleged father, child), family violence indicator (domestic violence or child abuse), order indicator, locate request type, and requested locate source.

This security agreement is applicable to all locate information obtained from external federal agencies and transmitted through the FPLS. These agencies include the U.S. Department of Defense which provides information on active military members, the Veterans Administration which provides information on beneficiaries, the Federal Bureau of Investigation (FBI) which provides information on employees of the FBI (if the agency can share the information without compromising national security), and the Social Security Administration which provides disability and retirement income, Supplemental Security Income, death information, and prisoner information on 6,500 federal, state, and local facilities.

This security agreement is applicable to all CS program information designated as confidential under federal law or regulation because the information relates to a specified individual or an individual who can be identified by reference to one or more factors specific to him or her, including, but not limited to, the individual’s SSN, residential and mailing addresses, employment information, and financial information. Ref. 45 CFR 303.21(a).

II. SECURITY AND PRIVACY SAFEGUARDING REQUIREMENTS

The state CS agency shall comply with the applicable provisions of the FISMA, the applicable OMB memoranda, and the applicable guidelines of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, updated January 22, 2015, HHS-OCIO Policy for Information Systems Security and Privacy (IS2P) and the Automated Systems for Child Support Enforcement: A Guide for States 2017 (Federal Certification Guide). The following requirements are drawn from these statutes, regulations, and guidelines. The HHS Information Security and Privacy Policy (IS2P) can be shared with a state child support agency upon request.

The security requirements with which the state CS agency shall comply are presented in three categories: management, operational, and technical. The state CS agency shall also comply with additional requirements: Cloud solution (optional for cloud environments), Retention and Disposition Requirements; Breach Reporting and Notification Responsibility; Security Certification; and Audit Requirements.

A. MANAGEMENT SECURITY CONTROLS

1. The state CS agency shall establish and/or maintain ongoing management oversight and quality assurance capabilities to ensure that only authorized personnel have access to FPLS information and CS program information.

Policy/Requirements Traceability: National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 4, Recommended Security Controls for

State Child Support Agency - Security Agreement 2019

Attachment A Request for Proposal Number 210000001793

If the information system that stores, processes, and/or transmits the FPLS information and/or CS program information is not under the direct management of the state CS agency, the state CS agency shall execute the attached security addendum to this security agreement. The organization that provides information system services to the state CS agency shall comply with all management, operational, and technical controls listed in this security agreement.

This security agreement may be updated to address changes in processes or technologies, as well as new or revised federal security requirements and guidelines. In such instances, OCSE shall provide the state CS agency with written notification of such changes and require written assurance by the state CS agency that it shall comply with new or revised security requirements.

If OCSE determines that the security or privacy of FPLS information or any CS program information is at risk, OCSE will work to support the state CS agency’s efforts to develop a Corrective Action Plan (CAP) or a Plan of Action and Milestones (POA&M) to address vulnerabilities and correct deficiencies.

This agreement shall be effective on the later of the dates on which the authorized officials of the agencies sign the security agreement. This security agreement shall remain in effect for a period of four years.

Federal Information Systems and Organizations, PL-4, PS-6, PS-8; 45 CFR 307.13(a) and (b); 45 CFR 95.621(f); 45 CFR 307.10(b)(11); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H2

2. The state child support agency shall advise all authorized personnel who will access FPLS information and confidential child support program information of the confidentiality of the information, the safeguards required to protect the information, and the civil and criminal sanctions for non-compliance contained in the applicable state and federal laws.

Policy/Requirements Traceability: National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 4, Recommended Security Controls for Federal Information Systems and Organizations, PL-4, PS-6, PS-8; section 453(l)(2) of the Social Security Act. 42 U.S.C. § 653(l)(2), 654 (26); 45 CFR 95.621(f); 45 CFR 307.10(b)(11); 45 CFR 307.11(b)(2)(iii); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H2

3. The state CS agency shall prohibit the use of non-state furnished equipment to access FPLS information and CS program information without specific written authorization for use of the equipment from the appropriate state CS agency representatives.

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, AC-20(1)(2), HHS OCIO Policy for IS2P Handbook

4. The state CS agency shall require that personnel accessing FPLS information remotely, for example, telecommuting, adhere to all the security and privacy safeguarding requirements provided in this security agreement. State and non-state furnished equipment shall have appropriate software with the latest updates to protect against attacks, including, at a minimum, current antivirus software and up-to-date system patches and other software patches. Prior to electronic connection to state CS agency systems, the state CS agency shall scan the state and non-state furnished equipment to ensure compliance with a set of standards developed by the state CS agency. All connections shall be through a Network Access Control solution and all data in transit between the remote location and the state CS agency shall be encrypted using Federal Information Processing Standards (FIPS) 140-2 encryption standards.

See Sections II.A.3 and II.C.4 of this security agreement for additional information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook; OMB M-17-12; NIST SP 800-53 Rev 4, AC-17, AC-20; 45 CFR 95.621(f); 45 CFR 307.13;

and Federal Certification Guide, Chapter III, H2

The state CS agency shall require that personnel accessing CS program information remotely, for example telecommuting, adhere to the applicable security and privacy safeguarding requirements provided in this security agreement. State and non-state furnished equipment shall have appropriate software with the latest updates to protect against attacks, including, at a minimum, current antivirus software and up-to-date

State Child Support Agency - Security Agreement 2019

Attachment A Request for Proposal Number 210000001793 system patches and other software patches. Prior to connection to state CS agency resources, the state CS agency shall use appropriate measures to ensure the state and non-state furnished equipment comply with a set of standards developed by the state CS agency. See Sections II.A.3 and II.C.4 of this security agreement for additional information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, OMB M-17-12; NIST SP 800-53 Rev 4, AC-17, AC-20; 45 CFR 95.621(f); 45 CFR 307.13;

and Federal Certification Guide, Chapter III, H2

5. The state CS agency shall implement an effective continuous monitoring strategy and program to ensure the continued effectiveness of security controls by maintaining ongoing awareness of information security, vulnerabilities, and threats to the information system housing FPLS information and CS program information. The continuous monitoring program shall include configuration management, patch management, vulnerability management, and risk assessments before making changes to the system and environment, ongoing security control assessments, and reports to state agency officials as required.

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, CA-7; NIST SP 800- 137, Information Security Continuous Monitoring for Federal Information Systems and Organizations; 45 CFR 95.621(f); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H3 and H4

6. The state CS agency system shall meet all requirements set forth in the Federal Certification Guide, Automated Systems for Child Support Enforcement: A Guide for States, Section H, “Security and Privacy”.

Policy/Requirements Traceability: 45 CFR 302.85(a)(1); Federal Certification Guide, 2017 Chapter III, Section H, “Security and Privacy”

7. The state CS agency shall document and report to OCSE’s Division of State and Tribal Systems (DSTS) any significant changes to the state CS agency’s security procedures and provide copies of the appropriate updated security manual, disaster recovery plan, and risk analysis plan upon request.

Policy/Requirements Traceability: 45 CFR 95.621(f); 45 CFR 307.13; OCSE Action Transmittal (AT)-03-03; and Federal Certification Guide, Chapter III, Sections H1, H3, H4, and H5

8. The state CS agency security office shall conduct and/or participate in the biennial system security reviews of installations involved in the administration of the state CS agency program which, at a minimum, includes evaluations of physical and data security operating procedures, and personnel practices, in accordance with 45 CFR Part 95.621(f). The state CS agency shall make biennial system security reviews

State Child Support Agency - Security Agreement 2019 available to DSTS, upon request.

Policy/Requirements Traceability: 45 CFR Part 95.621(f); and, OCSE Action Transmittal (AT)-03-03

B. OPERATIONAL SECURITY CONTROLS

1. The state CS agency shall restrict access to, and disclosure of, the FPLS information to authorized personnel who need the FPLS information to perform their official duties in connection with the authorized purposes specified in the security agreement.

The state CS agency requests submitted to the FPLS are made solely to locate a parent for the purpose of establishing parentage, or establishing, setting the amount of, modifying or enforcing child support obligations, or where applicable, to locate a parent in a parental kidnapping case, establish or enforce a child custody or visitation order, and for other purposes specified in federal law and regulations. The information exchanged between state CS agencies shall be used for authorized purposes and protected against unauthorized access to reduce fraudulent activities and protect the privacy rights of individuals against unauthorized disclosure of confidential information.

Policy/Requirements Traceability: Privacy Act 5 U.S.C. 552a (b)(1); 45 CFR 303.3(b)(6); 45 CFR 303.21; and, 45 CFR 307.13(a) and (b), NIST SP 800-53 Rev 4

AC-6

The state CS agency shall restrict access to, and disclosure of, the CS program information to authorized personnel who need the CS program information to perform their official duties in connection with the authorized purposes specified in the security agreement. The information exchanged between state CS agencies and all other state program information must be used for authorized purposes and protected against unauthorized access to reduce fraudulent activities and protect the privacy rights of individuals against unauthorized disclosure of confidential information.

Policy/Requirements Traceability: 45 CFR 95.621(f)(2); CFR 303.21(a)(1); 45 CFR 307.13(a) and (b); and Federal Certification Guide, Chapter III, H2, NIST SP 800-53 Rev 4 AC-6

2. The state CS agency shall label printed reports containing FPLS information and CS program information to denote the level of sensitivity of the information and limitations on distribution. The state CS agency shall maintain printed reports in a locked container when not in use and never transport FPLS information and CS program information off state CS agency premises unless required for a purpose approved by the state IV-D director or designee. When no longer needed, in accordance with the retention and disposition requirements in section III of this

State Child Support Agency - Security Agreement 2019 security agreement, the state CS agency shall destroy printed reports by shredding or burning.

Policy/Requirements Traceability: HHS-OCIO Policy for Information Systems Security and Privacy (IS2P) Handbook, NIST SP 800-53 Rev 4, MP-3, MP-4, MP-5, MP-6; and 45 CFR 307.13(a) and (b)

3. The state CS agency shall deliver security and privacy awareness training for authorized personnel. The training shall include information about the responsibility of such personnel for proper use and protection of FPLS information and CS program information, recognizing and reporting potential indicators of insider threat, and the possible federal and state sanctions for misuse. All personnel shall receive security and privacy awareness training prior to accessing FPLS information and CS program information and at least annually thereafter. Such training shall address the federal Privacy Act and other federal and state laws governing use and misuse of FPLS information and CS program information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook,; OMB Circular A-130; OMB M-17-12; NIST SP 800-53 Rev 4, AT-2, AT-3; 5 U.S.C. § 552a; 42 U.S.C. 654a(d); 44 U.S.C. § 3551 et seq; 45 CFR 307.13(c) and (d); and Federal Certification Guide, Chapter III, H2

4. The state CS agency personnel with authorized access to the FPLS information and CS program information shall sign (either in handwritten or electronic form) non-disclosure agreements, rules of behavior, or equivalent documents. The non-disclosure agreement, rules of behavior, or equivalent documents shall outline the authorized purposes for which the FPLS information and CS program information may be used by the state CS agency and the federal and state civil and criminal penalties for unauthorized use.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, OMB Circular A130, Appendix I; OMB M-17-12; NIST SP 800-53 Rev 4, PS-6; 42 U.S.C.

654a(d); 45 CFR 307.13(d); and Federal Certification Guide, Chapter III, H2

5. The state CS agency shall maintain records of authorized personnel with access to the FPLS information and CS program information. The records shall contain a copy of each individual’s signed non-disclosure agreement, rules of behavior, or equivalent document and proof of the individual’s participation in security and privacy awareness training. The state CS agency shall make such records available to OCSE within two working days of a request for such records.

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, AT-4

6. The state CS agency shall have appropriate procedures in place to report confirmed and suspected security or privacy incidents (unauthorized disclosure or use involving personally identifiable information), or suspected incidents involving FPLS

State Child Support Agency - Security Agreement 2019 information. Immediately upon discovery, but in no case later than one hour after discovery of the incident, the state IV-D director or designee shall notify the FPLS Director designated on this security agreement of suspected or confirmed incidents.

The requirement for the state IV-D director or designee to report suspected or confirmed incidents involving FPLS information to OCSE exists in addition to, not in lieu of, any state CS agency requirements to report to any other reporting agencies.

The state IV-D director or designee is responsible for ensuring appropriate measures are in place at the data center storing, transmitting, or processing FPLS information and to report suspected or confirmed incidents of such information to the state IV-D director or designee, and the United States Computer Emergency Readiness Team

(US-CERT).

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, IR;

OMB Circular A130, Appendix I; OMB M-17-12; NIST SP 800-53 Rev 4, IR-6; the US CERT; NIST PUB 800-61, Rev 2, and Federal Certification Guide, Chapter III, H2

The state CS agency shall have appropriate procedures in place to report security or privacy incidents (unauthorized disclosure or use involving personal information), or suspected incidents involving CS program information. Immediately upon discovery, but in no case later than one hour after discovery of the incident, the state IV-D director or designee shall notify the FPLS Director designated on this security agreement of suspected or confirmed incidents involving 1) an unauthorized individual who obtains access, either physical or virtual, to the information systems of the state CS agency, or 2) the unauthorized disclosure or use of personal information pertaining to multiple individuals. For privacy incidents arising out of the ordinary course of business involving the unauthorized disclosure or use of CS program information pertaining to one individual, the state IV-D director or designee must ensure prompt and adequate investigation and mitigation of the incident. The requirement for the state IV-D director or designee to report suspected or confirmed incidents involving CS program information to OCSE exists in addition to, and not in lieu of, any state CS agency requirements to report to any other reporting agencies.

The state IV-D director or designee is responsible for ensuring appropriate measures are in place at the data center storing, transmitting, or processing CS program information and to report suspected or confirmed incidents of such information to the state IV-D director or designee.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, IR;

OMB Circular A130, Appendix I; OMB M-17-12; NIST SP 800-53 Rev 4, IR-6; US CERT; NIST PUB 800-61 and Federal Certification Guide, Chapter III, H2

7. The state CS agency shall maintain a list of personnel authorized to access facilities and systems processing sensitive data, including FPLS information and CS program information. The state CS agency shall control access to facilities and systems wherever sensitive information is processed. Designated officials shall review and

State Child Support Agency - Security Agreement 2019 approve the access list and authorization credentials initially, and periodically thereafter, but no less often than annually.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, PE;

NIST SP 800-53 Rev 4, AC-2, PE-2; 45 CFR 95.621(f); 45 CFR 307.13(b); and Federal Certification Guide, Chapter III, H2

8. The state CS agency shall ensure that the organization responsible for the data processing facility storing, transmitting, or processing FPLS information and CS program information complies with the security requirements established in this security agreement. The “data processing facility” includes the personnel, facilities, documentation, data, electronic and physical records and other machine-readable information, and the information systems of the state CS agency including, but not limited to, employees and contractors working with the data processing facility, statewide centralized data centers, contractor data centers, and any other individual or entity collecting, storing, transmitting, or processing FPLS information and CS program information.

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, SA-9(2)

9. The state CS agency shall use locks and other protective measures at all physical access points (including designated entry/exit points) to prevent unauthorized access to computer and support areas containing FPLS information and CS program information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, PE;

NIST SP 800-53 Rev 4, PE-3; 45 CFR 95.621(f); and Federal Certification Guide, Chapter III, H2

10. The state CS agency shall store all FPLS information and CS program information provided pursuant to this security agreement in an area that is physically safe from access by unauthorized persons during duty hours as well as non-duty hours or when not in use.

Policy/Requirements Traceability: HHS-OCIO Policy for IS2P Handbook, PE;

NIST SP 800-53 Rev 4, PE-2, PE-3; 45 CFR 95.621(f); and Federal Certification Guide, Chapter III, H2

11. The state CS agency shall transfer and store FPLS information information only on state child support-agency-owned portable digital media and mobile computing and communications devices that are encrypted at the disk or device level, using a FIPS 140-2 compliant product. See Sections II.A.3 and II.C.4 of this security agreement for additional information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook; OMB M-17-12; FIPS 140-2, Security Requirements for Cryptographic Modules; 45 CFR

State Child Support Agency - Security Agreement 2019

95.621(f); and Federal Certification Guide, Chapter III, H2

The state CS agency shall ensure that appropriate measures developed by the state CS agency are in place to protect CS program information that is copied to, and stored on, state child support agency-owned portable digital media and mobile computing and communications devices, such as laptops, smartphones, tablets, notebook computers, PDAs, cellular telephones, digital cameras, and audio devices that meet the security and privacy safeguards detailed in this agreement.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook; OMB M-17-12; FIPS 140-2, Security Requirements for Cryptographic Modules; 45 CFR 95.621(f); and Federal Certification Guide, Chapter III, H2

C. TECHNICAL SECURITY CONTROLS

1. The state CS agency shall limit and control logical and physical access to FPLS information and CS program information to only those personnel who are authorized for such access based on their official duties and identified in the records maintained by the state CS agency pursuant to Section II.B.5.and II.B.7 of this security agreement.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, AC;

NIST SP 800-53 Rev 4, AC-2; U.S.C. 654a(d); 45 CFR 95.621(f); 45 CFR 307.13;

and Federal Certification Guide, Chapter III, H2

2. The state CS agency shall prevent browsing with technical controls that limit access to FPLS information and CS program information to assigned cases and areas of responsibility, or equivalent compensatory controls approved in writing by OCSE.

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, AC-3; 45 CFR 95.621(f); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H2

3. The state CS agency shall transmit and store all FPLS information provided pursuant to this security agreement in a manner that safeguards the information and prohibits unauthorized access. The state CS agency and OCSE shall exchange CS program information via a mutually approved and secure data transfer method which utilizes FIPS 140-2 encryption standards.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, MP;

OMB M-17-12; FIPS 140-2; NIST SP 800-53 Rev 4, MP-4, SC-8, SC-9, SC-33; 45 CFR 95.621(f); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H2

The state CS agency shall transmit and store all CS program information pursuant to this security agreement in a manner that safeguards the information and prohibits unauthorized access. The state CS agency shall use appropriate measures developed

State Child Support Agency - Security Agreement 2019 by the state CS agency when exchanging CS program information among other state CS agencies.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, MP;

OMB M-17-12; FIPS 140-2; NIST SP 800-53 Rev 4, MP-4, SC-8, SC-9, SC-33; 45 CFR 95.621(f); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H2

4. Except as described in Sections II.A.4 and II.C.10 or elsewhere in this agreement, the state CS agency shall prohibit the use of digital media and computing and communications devices residing in commercial or public facilities such as hotels, convention centers, and airports, from accessing, transmitting, and/or storing FPLS information and CS program information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, POES;

NIST SP 800-53 Rev 4, AC-19, CM-8; 45 CFR 95.621(f); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H2

5. The state CS agency shall prohibit remote access to FPLS information, except through the use of a secure and encrypted (FIPS 140-2 compliant) transmission link and using two-factor authentication. The state CS agency shall control remote access through a limited number of managed access control points. If the state CS agency cannot provide two-factor authentication, the state CS agency shall submit to OCSE a written description of compensating controls, subject to written approval by OCSE prior to allowing remote access.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, RMT, IA; OMB M-17-12; FIPS 140-2; NIST SP 800-53 Rev 4, AC-17, IA-2, SC-8, SC-9

The state CS agency shall prohibit remote access to CS program information, except through the use of appropriate measures developed by the state CS agency. The state CS agency shall control remote access through a limited number of managed access control points.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, RMT, IA; OMB M-17-12; FIPS 140-2; NIST SP 800-53 Rev 4, AC-17, IA-2, SC-8, SC-9;

45 CFR 95.621(f); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H2

6. The state CS agency shall utilize a time-out function for remote access and authorized mobile devices that require a user to re-authenticate after no more than 30 minutes of inactivity. See Sections II.A.3, II.A.4, and II.C.4 of this security agreement for additional information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, RMT;

OMB M-17-12; and Federal Certification Guide, Chapter III, H2

State Child Support Agency - Security Agreement 2019

7. The state CS agency shall maintain a fully automated audit trail system with audit records for FPLS information that, at a minimum, collect data associated with each query transaction to its initiator, and capture the date and time of system events and types of events. The audit trail system shall protect data and the audit tool from addition, modification, and/or deletion and should be regularly reviewed/analyzed for indications of inappropriate or unusual activity, biweekly, monthly, or quarterly, as part of CS agencies’ continuous monitoring requirements. The audit records can be kept for five years.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, AU;

NIST SP 800-53 Rev 4, AU-2, AU-3, AU-6, AU-8, AU-9, AU-11; and Federal Certification Guide, Chapter III, Sections H2 and H3

The state CS agency shall maintain a fully automated audit trail system with audit records for CS program information reviewed/analyzed for indications of inappropriate or unusual activity, biweekly, monthly, or quarterly, as part of CS agencies’ continuous monitoring requirement, and ensure compliance with provisions of the Federal Certification Guide, Automated Systems for Child Support Enforcement: A Guide for States, 2017.

Policy/Requirements Traceability: 42 U.S.C. 654a(d)(3); 45 CFR 95.621(f); 45 CFR 307.13(b); and Federal Certification Guide, Chapter III, Sections H2, H3 and H4

8. The state CS agency shall log each computer readable data extract (secondary store or file with duplicate CS program information) from any databases holding FPLS information and verify that each extract has been erased within 90 days after completing required use. If use of the extract is still required to accomplish a purpose authorized pursuant to this security agreement and complies with the retention and disposition requirements in Section III of this security agreement, the state CS agency shall request permission, in writing, to keep the extract for a defined period of time, subject to OCSE’s written approval. The state CS agency shall comply with the retention and disposition requirements in this agreement.

Policy/Requirements Traceability: OMB M-17-12

The state CS agency shall use appropriate measures developed by the state CS agency to log each computer readable data extract (secondary store or file with duplicate CS program information) from any databases holding CS program information and verify that each extract has been erased after completing required use.

Policy/Requirements Traceability: OMB M-17-12; 45 CFR 95.621(f); 45 CFR 307.13; and Federal Certification Guide, Chapter III, Sections H2, H3 and H4

9. The state CS agency shall erase electronic records after completing authorized use in accordance with the retention and disposition requirements in section III of this security agreement.

State Child Support Agency - Security Agreement 2019

Policy/Requirements Traceability: Privacy Act 5 U.S.C. 552a; 45 CFR 95.621(f);

45 CFR 307.13; and Federal Certification Guide, Chapter III, Sections H2, H3 and H4

10. The state CS agency shall implement a Network Access Control (NAC) (also known as Network Admission Control) solution in conjunction with a virtual private network (VPN) option to enforce security policy compliance on all state and non-state devices that attempt to gain access to, or use, FPLS information. The state CS agency shall use a NAC solution to authenticate, authorize, evaluate, and remediate wired, wireless, and remote users before they can access the network. The NAC solution chosen or employed shall be capable of evaluating whether remote machines are compliant with security policies through host(s) integrity tests against predefined templates, such as patch level, service packs, antivirus, and personal firewall status, as well as custom created checks tailored for the state enterprise environment. In addition, functionality that allows automatic execution of code shall be disabled. The solution shall enforce security policies by blocking, isolating, or quarantining non-compliant devices from accessing the state network and resources while maintaining an audit record/report on users’ access and presence on the state network. See Sections II.A.3 and II.C.4 of this security agreement for additional information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, S- RMT.1; NIST SP 800-53 Rev 4, AC-17, AC-20, IA-2, IA-3; and Federal Certification Guide, Chapter III, Sections H2, H3 and H4

The state CS agency shall implement appropriate measures developed by the state CS agency to enforce security policy compliance (such as patch level, service packs, antivirus, and personal firewall status, as well as custom created checks tailored for the state enterprise environment) on all state and non-state devices that attempt to gain remote access to, or use, CS program information. In addition, functionality that allows automatic execution of code shall be disabled. The solution shall enforce security policies by blocking, isolating, or quarantining non-compliant devices from accessing the state network and resources while maintaining an audit record/report on users’ access and presence on the state network. See Section II.A.3 and II.C.4 of this security agreement for additional information.

Policy/Requirements Traceability: HHS OCIO Policy for IS2P Handbook, S- RMT.1; NIST SP 800-53 Rev 4, AC-17, AC-20, IA-2, IA-3; 45 CFR 95.621(f); 45 CFR 307.13; and Federal Certification Guide, Chapter III, H2

11. The state CS agency shall maintain an asset inventory of all software and hardware components within the boundary of the information system housing FPLS information. The inventory shall be detailed enough for the state CS agency to track and report.

State Child Support Agency - Security Agreement 2019

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, CM-2(1)(3)(7), CM-

7(1)(2)(4), CM-8(1)(3)(5), CM-11, IA-3, SA-4(1)(2)(9)(10), SC-17, SC-18, SI-

4(2)(4)(5), PM-5

12. The state CS agency shall maintain a baseline configuration of the system housing FPLS information. The baseline configuration shall include information on system components (for example, standard software packages installed on workstations, notebook computers, servers, network components, or mobile devices; current version numbers and patch information on operating systems and applications; and configuration settings/parameters), network topology, and the logical placement of those components within the system architecture.

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, CA-7, CA-9, CM-

2(1)(3)(7), CM-3(2), CM-5, CM-6, CM-7(1)(2)(4), CM-8(1)(3)(5), CM-11, SI-

4(2)(4)(5)

13. The state CS agency shall maintain a plan of action and milestones (POA&M) or a corrective action plan for the information system housing FPLS information to document plans to correct weaknesses identified during security control assessments and to reduce or eliminate known vulnerabilities in the system. The state CS agency shall update the corrective action plan as necessary based on the findings from security control assessments, security impact analyses, and continuous monitoring activities.

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, CA-5; NIST SP 800-18 Rev 1

14. The state child support agency shall maintain a system security plan describing the security requirements for the system housing FPLS information, and the security controls in place or planned for meeting those requirements. The system security plan shall describe the responsibilities and expected behavior of all individuals who access the system.

Policy/Requirements Traceability: NIST SP 800-53 Rev 4, PL-2(3); NIST SP 800- 18 Rev 1, Guide for Developing Security Plans for Federal Information Systems

III. CLOUD SOLUTION (OPTIONAL)

The state child support agency may choose to use cloud computing to distribute services over broader architectures. The cloud service provider must be Federal Risk and Authorization Management Program (FedRAMP) certified in order to meet federal security requirements for cloud-based computing or data storage solutions. Cloud implementations are defined by the service model and deployment model used. Software as a Service, Platform as a Service and Infrastructure as a Service are examples of cloud service models for cloud implementation. The

State Child Support Agency - Security Agreement 2019 deployment models may include private cloud, community cloud, public cloud, and hybrid cloud. Data security requirements as defined below still must be met regardless of the type of cloud implementation chosen.

1. The cloud-based solution must reside on a FedRAMP compliant system. FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

2. Use of a cloud solution must be approved in advance by OCSE before connectivity to FPLS information and confidential child support program information can be established. States that have already established a cloud solution housing FPLS information need to send official notification of this major change to OCSE.

3. The state child support agency and the cloud service provider must comply with all requirements in this agreement, including the security addendum of the agreement and data retention policies agreed upon by the state child support agency and OCSE to ensure that all required statutory requirements are met. The state child support agency must ensure such compliance by the cloud service provider.

4. The data stored by the cloud service provider should ONLY be used for the authorized purpose of the matching program.

5. It is the obligation of the matching partner to ensure that the cloud housing the FPLS information and confidential child support program information is stored domestically and is specified in the contract or Service Level Agreement between the matching partner and the cloud service provider.

IV. RETENTION AND DISPOSITION REQUIREMENTS

The state CS agency shall erase FPLS information and CS program information when data is no longer required for authorized purposes. FPLS information and CS program information in an individual’s case file should be safeguarded per the security requirements of this security agreement. FPLS information and CS program information that is made part of an individual’s case file may be retained in the individual’s case file based on state CS agency’s rules and procedures for case file retention.

V. BREACH REPORTING AND NOTIFICATION RESPONSIBILITY

Upon disclosure of FPLS information from OCSE or disclosure of CS program information from another state or tribe to the state CS agency, the state CS agency is the responsible party in the event of a breach or suspected breach of the information.

Except as otherwise provided in Section II.B.6, if the state CS agency knows or suspects FPLS or CS program information has been breached, in either electronic or physical form, the state CS agency:

State Child Support Agency - Security Agreement 2019

1. Alerts the FPLS Director designated on this security agreement immediately upon discovery, but in no case later than one hour after discovery of the incident

2. Follows the state CS agency procedures for responding to a data breach

3. Reports the results of the investigation, mitigation, and resolution to the FPLS

Director

The state IV-D director or designee is responsible for all reporting, notification, and mitigation activities as well as the associated costs. Reporting, notification, and mitigation activities include but are not limited to: investigating the incident; communicating with required state government breach response officials; notifying individuals whose information is breached;

communicating with any third parties, including the media, as necessary; notifying any other public and private sector agencies involved; responding to inquiries about the breach; resolving all issues surrounding the breach of FPLS information and CS program information; performing any necessary follow-up activities to correct the vulnerability that allowed the breach;

and any other activity, as required by OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and other federal law and guidance.

The state IV-D director or designee is responsible for ensuring appropriate measures are in place at the data center storing, transmitting, or processing FPLS information and CS program information to report confirmed or suspected incidents of such information to the state IV-D director or designee.

Policy/Requirements Traceability: US-CERT Federal Incident Notification Guidelines (April 1, 2017); OMB Circular A-130 Appendix I; OMB M-17-12; NIST SP 800-53 Rev 4, IR-6

VI. ANNUAL SECURITY CERTIFICATION

A. Annual Certification Statement

The state CS agency shall certify annually that it continues to comply with the terms and requirements in this security agreement by submitting a Certification Statement to OCSE each year by July 22.

B. Independent Security Assessment

Every three years, the state CS agency shall arrange for an independent security assessment to be conducted on the business processes involving FPLS information and CS program information and the computer systems storing and processing FPLS information and CS program information. The independent security assessment must have been conducted by an unbiased, outside entity and must include information on the management, operational, and technical security controls defined within this security agreement. The independent security assessment must also include detailed findings (if any) and recommendations to improve the state CS agency’s plans, procedures, and

State Child Support Agency - Security Agreement 2019 practices. The state CS agency shall make such a report available to OCSE upon request.

The following assessments are acceptable:

Internal Revenue Service Safeguard Review Report Social Security Administration Independent Validation and Verification A review conducted by an independent state auditing agency such as the State Office of the Inspector General A review conducted by an independent auditing firm hired by the state agency

The results of these independent security assessments must be incorporated into the state CS agency’s respective reporting in the state’s Biennial Security Review Report as required by federal regulations at 45 CFR 95.621. If major organizational, system framework, hardware, and operating software changes have taken place since the previous independent security assessment, a new independent security assessment must be conducted within six months of the change. The state CS agency shall make such reports available to OCSE, upon request.

Policy/Requirements Traceability: OMB M-11-33; OMB Circular No. A130, Appendix I; 45 CFR 95.621(f)(3) and (6); and 45 CFR 305.60

VII. AUDIT REQUIREMENTS

OCSE’s Divisions of Federal Systems and State and Tribal Systems and Office of Audit reserve the right to audit the state CS agency or make other provisions to ensure that the state CS agency is maintaining adequate safeguards to protect the FPLS information and CS program information. Audits ensure that the security policies, practices, and procedures required by OCSE are in place and to assess the completeness, authenticity, reliability, accuracy, and security of information and the systems used to process the data within the state CS agency.

Policy/Requirements Traceability: OMB M-11-33; OMB Circular No. A130, Appendix I; 45 CFR 95.621(a)(b) and (c); and, 45 CFR 305.60.

State Child Support Agency - Security Agreement 2019

VIII. PERSONS TO CONTACT

A. The U.S. Department of Health and Human Services, Administration for Children and Families, Office of Child Support Enforcement security contact is:

Linda Boyer Director Division of Federal Systems Office of Child Support Enforcement Administration for Children and Families Mary E. Switzer Building 330 C Street SW, 5th Floor Washington, DC 20201 Phone: 202-401-5410 Fax: 202-401-5553 Email: linda.boyer@acf.hhs.gov

B. The state CS agency program contact is:

Tamara Marques Security Policy Analyst Michigan Department of Health and Human Services Office of Child Support 201 North Washington Square Lansing, Michigan 48933 Phone: 517-241-5017 Fax: 517-241-7800 Email: marquest@michigan.gov

C. The state CS agency systems contact is:

Steve Wensko State Administrative Manager Department of Technology, Management, and Budget Agency Services 111 South Capitol Avenue Lansing, Michigan 48933 Phone: 810-210-2356 Fax: 517-241-9607 Email: WenskoS@michgian.gov

D. The state CS agency security contact is:

Tamara Marques Security Policy Analyst Michigan Department of Health and Human Services Office of Child Support 201 North Washington Square Lansing, Michigan 48933 Phone: 517-241-5017 Fax: 517-241-7800 Email: marquest@michigan.gov

E. The state CS agency data center contact is:

Steve Wensko State Administrative Manager Department of Technology, Management, and Budget Agency Services 111 South Capitol Avenue Lansing, Michigan 48933 Phone: 810-210-2356 Fax: 517-241-9607 Email: WenskoS@michgian.gov

F. The state designated Automated Data Processing (ADP) security officer, per 45 CFR 95.621, is:

Steve Wensko State Administrative Manager Department of Technology, Management, and Budget Agency Services 111 South Capitol Avenue Lansing, Michigan 48933 Phone: 810-210-2356 Fax: 517-241-9607 Email: WenskoS@michgian.gov

Attachment ARequest for Proposal Nimber 210000001793