Attachment_D_-_Minimum_OpenNet_Extension_Requirements.docx

U.S. Department of State Physical Security Information Management System

Attachment D: Minimum OpenNet Extension Requirements

1. All requests for telecommunication extensions must be coordinated with IRM’s telecommunications group, IRM/OPS/ENM/TWD;

2. The Open Net link between the contractor facility and the DoS must be encrypted by a FIPS 140-2 NIST-certified encryption device. The type and management of the encryption device must be coordinated with IRM/OPS/ENM. The encryption product must be configured in accordance with the NIST security policy provided with the product. All contractor personnel having physical and or logical access to the encryptor must be U.S. Citizens, who have been approved for contractor performance in accordance with paragraphs 8 and 9. Key change must be accomplished on a 24-hour basis;

3. The encryption device must be located in a room or a cabinet secured by a DS approved lock, or in an approved server room. IRM/OPS/ENM must ensure that access to the device’s Administrator functions is limited;

4. OpenNet extensions that require the use of an OpenNet server must house the server in a server room that is constructed and secured in accordance with 12 FAM 624 and 12 FAM 629;

5. The system administrator must ensure that OpenNet workstations with non-removable storage media (i.e., fixed disks) and those with non-volatile memory are located in a room which is secured with DS-approved locks for after-hours access control;

6. All media associated with the Department of State (e.g., removable hard drives, CDs/DVDs, flash drives) must be secured within a locked office or suite, or secured in a locked container during non-duty hours;

7. All media and equipment associated with the Department of State must be labeled at the appropriate classification level, e.g., Unclassified;

8. All contractor personnel with logical access to OpenNet workstations and/or servers at the contractor extension site must possess the personnel security clearance (PCL) requirements stated in Block 13 of the DD Form 254 Contract Security Classification Specifications. . Contractor personnel security clearances must be passed to DS/IS/IND, 571-345-3000. Additionally, contractor personnel must:

a) be given a briefing by the ISSO prior to the employees’ initial OpenNet access to ensure they understand their obligations and requirements to adhere to established DoS security policies concerning the use of Automated Information Systems, and

b) complete the DoS Cyber Security Awareness Course (PS 800 ) upon gaining access to OpenNet, and annually thereafter;

9. All Contractor personnel must have a confirmed ‘need to know’ requirement to access Department data;

10. Co-location of DoS equipment with personnel that do not possess the minimal security clearance or meet the confirmed ‘need to know’ requirements to access Department data is prohibited;

11. Personnel (e.g., contractor staff, cleaning staff, building maintenance staff) that do not meet the requirements in paragraphs 13 and 14, but require physical access to areas where the OpenNet equipment is located, must be escorted at all times by a Contractor employee that has authorized access to OpenNet;

12. All contractor personnel with access to the OpenNet must report any security incident to the Contractor AISSO, who must report to the DS/ST/FSE ISSO and the contractor Facility Security Officer (FSO) in accordance with 12 FAM 553, Reporting of Security Incidents, and 12 FAM 590, Cyber Security Incident Program;

13. Contractor personnel must not perform software development or maintenance on OpenNet;

14. Citizens of specifically designated technical and /or human intelligence threat countries may not develop, modify, or perform maintenance on software used on DoS computer systems, unless there has been specific DS authorization;

15. The system administrator must ensure that individual User IDs and passwords are issued to authorized users. The use of group passwords is prohibited. The passwords must conform to DoS 12 FAM 622.1-3 policy as to length and makeup;

16. All hardware and software used for this extension must be Local or IT CCB approved and configured, and managed in accordance with 12 FAM 620 and Department security configuration guidelines.

17. All media (e.g., hard drives, CDs, flash memory, etc.) used on OpenNet must be returned to DS/ST/FSE when:

a) the media is no longer needed;

b) the media is inoperative;

c) the extension is no longer required by Contractor; or

d) the contract is terminated;

18. The OpenNet extension must have no other network connections;

19. All OpenNet processing areas must be approved for the protection of SBU data (Sensitive But Unclassified) by DS/IS/IND;

20. The contractor must notify the DS/ST/FSE ISSO when users no longer require access to OpenNet;

21. Any changes to the configuration of this extension (e.g., adding additional workstations, relocating existing workstations) or any changes to the physical structure of the OpenNet space must be approved by DS/SI/CS;

22. DS/ST/FSE and the contractor must agree that the OpenNet extension is subject to on-site and remote auditing, scanning, and testing as deemed necessary by DS. This auditing, scanning, and testing will help to assess the compliance of this OpenNet extension with DoS requirements;

23. An acceptable level of risk must be maintained for the site in the iPost Risk Score Advisor report generated for the site, i.e., a grade equal to ‘B’ or higher;

24. This extension will be subject to continuous monitoring by E&V_Scanning;

25. If at any time, DS finds that the above listed security requirements are not being met, the OpenNet extension will be subject to termination.