RFP_2200_GTG3007_ATT_8_v1.xlsx

MOD Impact

Meets Partial Meets w/ Customization

b. Assign account managers;

c. Require least privilege required to complete individual organizational duties for group and role membership;

d. Specify:

1. Authorized users of the system;

2. Group and role membership; and

3. Access authorizations (i.e., privileges) and Identity, Job Information, Contact Information, System-Level Settings for each account;

e. Require approvals by Authorizing Official, System Owner, or Delegate(s) for requests to create accounts;

f. Create, enable, modify, disable, and remove accounts in accordance with Access Control (AC) policy requirements;

g. Monitor the use of accounts;

h. Notify account managers and Authorizing Official, System Owner, or Delegate(s) within:

1. twenty-four (24) hours when accounts are no longer required;

2. eight (8) hours when users are terminated or transferred; and

3. eight (8) hours when system usage or need-to-know changes for an individual;

i. Authorize access to the system based on:

1. A valid access authorization;

2. Intended system usage; and

3. least privilege required to complete individual organizational duties;

j. Review accounts for compliance with account management requirements monthly for privileged accessed, every six (6) months for non-privileged access;

k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and

(a) Have expired;

(b) Are no longer associated with a user or individual;

(c) Are in violation of organizational policy; or

(d) Have been inactive for thirty-five (35) days (See additional requirements and guidance).

AC-2 (3) Requirement: Departments define the time period for non-user accounts (e.g., accounts associated with devices). The time periods are approved and accepted by the Information Security Office (ISO). Where user management is a function of the service, reports of activity of users shall be made available.

1. IT Administration or operation (assuring systems function, to serve the system users)

2. IT Access Management (account creation, modification, removal, etc.)

3. IT Security (assuring adequacy of system controls for availability, integrity, and confidentiality)

4. IT Management (allocating adequate resources for implementation of effective IT Security Programs and system controls); and

(a) all security functions not publicly accessible (deployed in hardware, software, and firmware); and

1. Access the system from external systems; and

2. Process, store, or transmit organization-controlled information using external systems; or

(a) Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or

b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

c. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and

a. What type of event occurred;

b. When the event occurred;

c. Where the event occurred;

d. Source of the event;

e. Outcome of the event; and

b. Allow personnel or roles as defined in applicable security and privacy plans to select the event types that are to be logged by specific components of the system; and

b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;

c. Terminate internal system connections after issuance of an order by the CIO, CISO, or Senior Privacy Officer and when such internal system connections no longer support COA missions or business functions.; and

b. Review and update the baseline configuration of the system:

1. At least annually or when a significant change occurs;

2. When required due to major system changes/upgrades, critical security patches (as defined by the Federal Government, ISO, or vendor), and emergency change (e.g., unscheduled changes, system crashes, replacement of critical hardware components); and

3. When system components are installed or upgraded.

b. Implement the configuration settings;

c. Identify, document, and approve any deviations from established configuration settings for established configuration settings for system components based on explicit operational requirements (defined in the applicable system security and privacy plan); and

d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.

CM-6 (a) Requirement 1: Departments shall use the Center for Internet Security (CIS) Benchmarks or establish their own configuration settings by adopting or tailoring settings based on CIS Benchmarks, United States Government Configuration Baseline (USGCB), or Department of Defense (DoD) Security Technical Implementation Guides (STIGs). Any deviation from the published configuration settings must be approved by the Information Security Office (ISO).

CM-6 (a) Requirement 2: Departments shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).

CM-6 (a) Guidance: More information on CIS Benchmarks (CM-6.a) can be found at https://www.cisecurity.org/cis-benchmarks/

b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: Center for Internet Security (CIS) Benchmarks.

CM-7 (b) Requirement: Departments shall use the Center for Internet Security (CIS) Benchmarks to establish a list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if guidance is not available. Any deviation from the published configuration settings must be approved by the Information Security Office (ISO).

CM-7 (b) Guidance: More information on CIS Benchmarks (CM-6.a) can be found at https://www.cisecurity.org/cis-benchmarks/

To include, but not limited to, the following:

(a) Software must be legally licensed;

(b) Software must be provisioned in approved configurations; and

(b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and

1. Accurately reflects the system;

2. Includes all components within the system;

3. Does not include duplicate accounting of components or components assigned to any other system;

4. Is at the level of granularity deemed necessary for tracking and reporting; and

5. Includes the following information to achieve system component accountability:

- Each component’s unique identifier and/or serial number;

- Information system of which the component is a part;

- Type of information system component (e.g., server, desktop, application);

- Manufacturer/model information;

- Operating system type and version/service pack level;

- Presence of virtual machines;

- Application software version/license information;

- Physical location (e.g., building/room number);

- Logical location (e.g., IP address, position with the information system [IS] architecture);

- Media access control (MAC) address;

- Ownership;

- Operational status;

- Primary and secondary administrators; and

- Primary user; and

a. Addresses roles, responsibilities, and configuration management processes and procedures;

b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;

c. Defines the configuration items for the system and places the configuration items under configuration management;

d. Is reviewed and approved by the System Owner (SO) at least annually; and

b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and

b. Enforce software installation policies through the following methods: automated methods; and

b. Identify and document the users who have access to the system and system components where the information is processed and stored; and

1. Identifies essential mission and business functions and associated contingency requirements;

2. Provides recovery objectives, restoration priorities, and metrics;

3. Addresses contingency roles, responsibilities, assigned individuals with contact information;

4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;

5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;

6. Addresses the sharing of contingency information; and

7. Is reviewed and approved by applicable personnel and roles (review) and the Department Director (review and approve);

b. Distribute copies of the contingency plan to the COA Homeland Security Emergency Management (HSEM) and those with roles & responsibilities in Plan implementation;

c. Coordinate contingency planning activities with incident handling activities;

d. Review the contingency plan for the system at least annually and after any significant changes;

e. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

f. Communicate contingency plan changes to System Security Officer (SSO), System Owner (SO), Business Owner (BO), Contingency Plan Coordinator (CPC), and other stakeholders identified within the applicable system's security/privacy/contingency plan;

g. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and

b. Review the contingency plan test results; and

c. Initiate corrective actions, if needed.

b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and

b. Conduct backups of system-level information contained in the system daily incremental; weekly full;

c. Conduct backups of system documentation, including security- and privacy-related documentation daily incremental; weekly full; and

d. Protect the confidentiality, integrity, and availability of backup information.

CP-9 Requirement: Departments shall determine how Information System Backup is going to be verified and appropriate periodicity of the check.

CP-9 (a) Requirement: Departments maintain at least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative.

CP-9 (b) Requirement: Departments maintain at least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative.

a. Receiving authorization from at a minimum, the System Security Officer (SSO), or similar role within the organization, to assign an individual, group, role, service, or device identifier;

b. Selecting an identifier that identifies an individual, group, role, service, or device;

c. Assigning the identifier to the intended individual, group, role, service, or device; and

a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;

b. Establishing initial authenticator content for any authenticators issued by the organization;

c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;

d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;

e. Changing default authenticators prior to first use;

f. Changing or refreshing authenticators at least every 90 days for password based authentication or when authenticators are known or suspected to be compromised (change immediately); default passwords must be changed upon system installation occur;

g. Protecting authenticator content from unauthorized disclosure and modification;

h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and

i. Changing authenticators for group or role accounts when membership to those accounts changes.

(a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;

(b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);

(c) Transmit passwords only over cryptographically-protected channels;

(d) Store passwords using an approved salted key derivation function, preferably using a keyed hash;

(e) Require immediate selection of a new password upon account recovery;

(f) Allow user selection of long passwords and passphrases, including spaces and all printable characters;

(g) Employ automated tools to assist the user in selecting strong password authenticators; and

b. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;

c. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;

d. Maintain records for nonlocal maintenance and diagnostic activities; and

b. Maintain accountability for system media during transport outside of controlled areas;

c. Document activities associated with the transport of system media; and

1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;

2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;

3. Describe how the architectures are integrated into and support the enterprise architecture; and

4. Describe any assumptions about, and dependencies on, external systems and services;

b. Review and update the architectures at least annually or when a significant change occurs to reflect changes in the enterprise architecture; and

c. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.

PL-8 Requirement: System-level security and privacy architecture must be in alignment with the City's Enterprise Security Architecture as maintained by the Information Security Office (ISO).

b. Document the security categorization results, including supporting rationale, in the security plan for the system; and

b. Define and document information security and privacy roles and responsibilities throughout the system development life cycle;

c. Identify individuals having information security and privacy roles and responsibilities; and

a. Security and privacy functional requirements;

b. Strength of mechanism requirements;

c. Security and privacy assurance requirements;

d. Controls needed to satisfy the security and privacy requirements.

e. Security and privacy documentation requirements;

f. Requirements for protecting security and privacy documentation;

g. Description of the system development environment and environment in which the system is intended to operate;

h. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and

a. Perform configuration management during system, component, or service development, implementation, AND operation;

b. Document, manage, and control the integrity of changes to configuration items under configuration management as defined in the security and privacy plans;

c. Implement only organization-approved changes to the system, component, or service;

d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and

a. Develop and implement a plan for ongoing security and privacy assessments;

b. Perform unit, integration, system, regression testing/evaluation whenever there is a significant change to system source code at a depth of coverage as documented in the system security plan;

c. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;

d. Implement a verifiable flaw remediation process; and

1. Explicitly addresses security and privacy requirements;

2. Identifies the standards and tools used in the development process;

3. Documents the specific tool options and tool configurations used in the development process; and

4. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and

b. Implement subnetworks for publicly accessible system components that are at a minimum are logically separated from internal organizational networks; and

(b) Establish a traffic flow policy for each managed interface;

(c) Protect the confidentiality and integrity of the information being transmitted across each interface;

(d) Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;

(e) Review exceptions to the traffic flow policy at least annually for moderate-impact systems and at least every ninety (90) days or whenever there is a change in the threat environment that warrants a review of the exceptions for high-impact systems and remove exceptions that are no longer supported by an explicit mission or business need;

(f) Prevent unauthorized exchange of control plane traffic with external networks;

(g) Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and

b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;

c. Install security-relevant software and firmware updates within thirty (30) days of the release of the updates; and

Privacy (overlay only)

Meets Partial Meets w/ Customization