SAR Template - 2016 (attachment for Q & A).docx

APPENDIX A: SAMPLE SECURITY AND PRIVACY ASSESSMENT REPORT (SAR)

Sensitive information—requires special handlingDRAFT

DRAFT

DRAFT

DRAFT

Framework for IA of Security and Privacy Controls Final Error! No text of specified style in document.

<System Name> Security and Privacy Assessment Report

SENSITIVE INFORMATION—REQUIRES SPECIAL HANDLING

< System Name> SAR SAMPLE Report <Date Here> <Date Here>

Centers for Medicare & Medicaid Services Page 10 of vi

Table of Contents

Sensitive information—requires special handlingDRAFT

DRAFT

< System Name> SAR SAMPLE Report <Date Here>

Page i

SENSITIVE INFORMATION—REQUIRES SPECIAL HANDLING

SENSITIVE INFORMATION—REQUIRES SPECIAL HANDLING

1. Executive Summary The <AE> engaged <Assessor> to perform an onsite security and privacy controls assessment (SCA) of the <System Name>. <Assessor> conducted an assessment to determine:

· If the system is compliant with MARS-E

· If the underlying infrastructure supporting the system is secure

· If the system and data are securely maintained

· If proper configuration associated with the database and file structure storing the data are in place

1.1 <System Name> Background Provide a high-level overview of what the system is and what sensitive data it processes. Also briefly summarize the important, relevant facts about the system’s essential business processes.

1.2 Assessment Scope

To determine the potential security and privacy risks to the AE, <Assessor> was tasked with providing a SCA of the <System Name> located at the {YYY Data Center (<Data center abbreviation>) in CITY NAME, STATE}. The application was assessed from <Dates of Assessment>. In accordance with the SCA Test Plan, the <Assessor> performed the following activities:

· Interviewed selected personnel

· Reviewed system baselines

· Reviewed network component (switch/router/firewall) configurations

· Performed application security testing

· Conducted network vulnerability testing

· Reviewed database (DB) configuration settings

· Reviewed supplied security documentation

· Reviewed supplied privacy documentation

· Assessed privacy program compliance The following MARS-E security control families were the focus of the <System Name> assessment:

· Access Control (AC)

· Awareness and Training (AT)

· Audit and Accountability (AU)

· Security Assessment and Authorization (CA)

· Configuration Management (CM)

· Contingency Planning (CP)

· Identification and Authentication (IA)

· Incident Response (IR)

· Maintenance (MA)

· Media Protection (MP)

· Physical and Environmental Protection (PE)

· Planning (PL)

· Program Management (PM)

· Personnel Security (PS)

· Risk Assessment (RA)

· System and Services Acquisition (SA)

· System and Communications Protection (SC)

· System and Information Integrity (SI)

· Authority and Purpose (AP)

· Accountability, Audit, and Risk Management (AR)

· Data Quality and Integrity (DI)

· Data Minimization and Retention (DM)

· Individual Participation and Redress (IP)

· Security (SE)

· Transparency (TR)

· Use Limitation (UL)

1.3 Summary of Findings

SUMMARY OF FINDINGS IS PROVIDED HERE:

Most findings in this document fall into the following areas:

· Access Control:

· Account Management:

· Application Security:

· Auditing and Monitoring:

· Configuration Management:

· Database Management:

· Documentation Updates:

· Identification and Authentication:

· Security Management:

· Software Maintenance:

· System and Information Integrity:

· Authority and Purpose:

· Accountability, Audit, and Risk Management:

· Data Quality and Integrity:

· Data Minimization and Retention:

· Individual Participation and Redress:

· Security:

· Transparency:

· Use Limitation:

1.4 Summary of Recommendations

For each finding, the Assessor has developed detailed recommendations for improvements that address the findings and the business and system risks. While all findings must be addressed, findings representing a high business risk should be mitigated or closed immediately to reduce the risk exposure. Most of the recommendations in this document fall into the following areas: EXAMPLE FOLLOWS:

· Block Unused Ports and Protocols:

· Perform Security and Privacy Monitoring:

· Strengthen Database Access Controls:

· Update Documentation:

Introduction

2.1 System Security and privacy Assessment Summary

The Assessor was tasked with conducting a security and privacy controls assessment (SCA) of the <System Name > to determine the overall business and system risk the system presents to the AE operations or ACA program.

Provide summary information here.

2.2 Assessment Methodology

Provide the purpose of the assessment including the controls tested and summary of the types of testing that was performed. This is obtained from the SCA test plan.

Detailed Finding REporting Provides a descriptive analysis of the vulnerabilities identified through the comprehensive SCA process. Each vulnerability is explained, specific risks to the continued operations of the system are identified, the impact of each risk is analyzed, and suggested corrective actions for closing or reducing the impact of each vulnerability are presented.

3.1 Tests And Analyses

Provide details of testing and analysis performed.

3.1.1 Technical Testing Tools

Provide a listing of all tools used to perform the technical test.

3.2 Business and system Risk Reporting

For each weakness found, the Business and System Risk Level assessment value must be assigned to each Business and System Risk in order to provide a guideline by which to understand the procedural or technical significance of each finding. Further, an Ease-of-Fix and Estimated Work Effort value must be assigned to each Business Risk to demonstrate how simple or difficult it might be to complete the reasonable and appropriate corrective actions required to close or reduce the impact of each vulnerability.

3.2.1 Business and System Risk Level Assessment

Management, operational, and technical vulnerabilities representing risks to the secure operation of the <System Name> are detailed as findings. Business and System Risks are technical or procedural in nature, and may result directly in unauthorized access. Each Business Risk has been assigned a Business and System Risk Level value of High, Moderate, or Low. The rating is, in actuality, an assessment of the priority with which each Business Risk will be viewed. The definitions in Table 1 apply to risk level assessment values.

Table 1. Business and System Risk Level Definitions

3.2.2 Ease-Of-Fix Assessment

Each Business and System Risk is assigned an Ease-of-Fix value of Easy, Moderately Difficult, Very Difficult, or No Known Fix. The Ease-of-Fix value is an assessment of how difficult or easy it will be to complete reasonable and appropriate corrective actions required to close or reduce the impact of the vulnerability. The definitions in Table 2 apply to the Ease-of-Fix values.

Table 2. Ease-of-Fix Definitions

A vendor patch or major configuration change may be required to close the vulnerability.

An upgrade to software may be required to address the impact severity.

The system may require a reconfiguration to mitigate the threat exposure.

Corrective action may require construction or significant alterations to the manner in which business is undertaken.

An obscure, hard-to-find vendor patch may be required to close the vulnerability.

Significant, time-consuming configuration changes may be required to address the threat exposure or impact severity.

Corrective action requires major construction or redesign of an entire ACA process.

Discontinue use of the software or protocol Isolate the information system within the enterprise, thereby eliminating reliance on the system In some cases, the vulnerability is due to a design-level flaw that cannot be resolved through the application of vendor patches or the reconfiguration of the system. If the system is critical and must be used to support on-going ACA functions, the AE shall conduct, at a minimum, quarterly monitoring, which AE Management shall review, to validate that security incidents have not occurred

3.2.3 Estimated Work Effort Assessment

Each Business and System Risk has been assigned an Estimated Work Effort value of Minimal, Moderate, Substantial, or Unknown. The Estimated Work Effort value is an assessment of the extent of resources required to complete reasonable and appropriate corrective actions. This value provides input for assisting in the calculating of “Resources required” in the Plan of Action & Milestones (POA&M). The definitions in Table 3 apply to the Estimated Work Effort values.

Table 3. Estimated Work Effort Definitions

REPORT FINDINGS

The report findings provide a descriptive analysis of the vulnerabilities identified through the comprehensive SCA process. Each vulnerability is explained, specific risks to the continued operations of the system are identified, the impact of each risk is analyzed, and suggested corrective actions for closing or reducing the impact of each vulnerability are presented. The vulnerabilities are ordered in a format that will enable the business owner to develop an efficient and workable action plan to remediate all risks. The Findings are ordered first by Business Risk Level, from High Risk to Low Risk, and then by Estimated Work Effort, from Substantial to Minimal.

(Table 1. <Report Finding><Short Title> presents a table example to use for each vulnerability found during the SCA.)

Table 1. <Report Finding><Short Title>

Applicable Standards:

Business Risk Level: (High Risk, Moderate Risk, or Low Risk)

<Risk Level>

Ease-of-Fix: (Easy, Moderately Difficult, Very Difficult, or No Known Fix)

<Ease of Fix>

Estimated Work Effort: (Minimal, Moderate, Substantial, or Unknown; or a time estimate based on level of commitment and an adequate skill set)

<Level of Effort>

Weakness Description:

<Paragraph> <Report Date>

Finding

<Description>

Impacted components include: <hardware, software and firmware>

Failed Test Description

<Failed Condition>

Actual Test Results

<Actual Result>

Suggested Corrective Action(s):

<Recommendation>

Weakness Status:

<Status>

DOCUMENTATION LIST

The following table lists the documentation that <Assessor> requested prior to the onsite visit, as well as documentation provided to <Assessor> during and after the visit. The table includes the document element number, document title or information requested, and comments. Comments may include the name of the individual, organization, or agency that sent or delivered the documents and the date <Assessor> received the documents. – This is a sample list, not all inclusive Table 4. Documentation Requested/Reviewed