S000000251 Attachment 10 SSA Security Reminders for State Agencies 04.2023.pdf

SSA Information Security Reminders for State Agencies – April 2023

The Electronic Information Exchange Security Requirements and Procedures for State and Local Agencies Exchanging Electronic Information with the Social Security Administration Technical System Security Requirements (TSSR) ensures that SSA can properly determine an organization’s compliance with SSA security standards, requirements and procedures and the appropriate security controls are in place, operating as intended, and producing the desired results. Attached is the current TSSR.

To assist in maintaining your agency’s compliance with the terms of your Information Exchange Agreement (IEA) with the Social Security Administration (SSA), SSA requires Electronic Information Exchange Partners (EIEPs) to:

Adhere to information security safeguard requirements in SSA’s Technical Systems Security Requirements (TSSR), which are in place to protect SSA-provided information from unauthorized access and improper disclosure. All devices that access SSA data must be encrypted. If they are not, it is a violation of the TSSR, which is included in the Data Exchange agreement. Partners are not allowed to access SSA data from any equipment without all security provisions outlined in the agreement strictly enforced.

Ensure that usage of SSA data is in accordance with your IEA. Any new programs that will use or have access to SSA data must be added to the agreement and go through the disclosure and information security approval process. Please contact your Regional Data Exchange Coordinator (DEC) to begin this process at least six months prior to implementation.

Ensure that SSA information is not accessed, processed, maintained, transmitted, or stored in or by means of data communications channels, electronic devices, computers, or computer networks located in geographic or virtual areas not subject to U.S. law.

Ensure that SSA data is not disclosed to another entity unless the disclosure is covered by the SSA agreement or is specifically authorized by SSA prior to disclosure.

Notify the SSA Regional Office Contact or the SSA Systems Security Contact identified in the agreement if there is a possible or suspected loss of SSA PII. If, for any reason, the responsible State official or delegate is unable to notify the SSA Regional Office or the SSA Systems Security Contact within one hour, the responsible State Agency official or delegate must report the incident by contacting SSA’s National Network Service Center (NNSC) toll free at 1-877-697-4889 (select “Security and PII Reporting” from the options list). As the final option, in the event SSA contacts and NNSC cannot be reached, the Organization is to contact SSA’s Office of Information Security (OIS), Security Operations Center (SOC) toll-free at 1- 866-718-6425.

Provide general and role-based security training and a security awareness program for your employees that include responsibilities for proper use and protection of SSA data and possible sanctions for misuse.

A cyclical assessment is conducted every three years as mandated by the Federal Information Security Management Act (FISMA) and other governing authorities to ensure compliance.

OIS is in the planning stages of transitioning from NIST 800-53 Revision 4 to Revision 5.

The TSSR includes an option for EIEPs to leverage Third Party Assessment results as part of SSA’s Security Assessments. Please refer to section 1.6.4 for additional details.

Notify the SSA Regional Office Contact when there are changes in security personnel that could affect security documents being signed timely.

To assist in maintaining your agency’s compliance with SSA’s requirements, please notify the SSA Regional Office Contact and cc: DX.Compliance.OIS@SSA.GOV if planned changes in your business process or IT infrastructure could affect the security of SSA data, which may require a new assessment. OIS requires at least 120 days to review assessment documents.

A Security Assessment should be conducted when:

1. Planning to make changes to the current eligibility system.

2. Developing a new operating system or platform.

3. Adding a new SSA data set, e.g., Citizenship via SOLQ or SOLQ-I.

4. Considering cloud computing to process or store SSA-provided information.

5. Moving the current location of a data center or adding a new data center location.