Attachment_13_-_Security_Reference.pdf

SECURITY REFERENCE

The contractor shall ensure that all SEC data and material (e.g. paper, electronic media, information etc.)

are secure when in their possession (i.e., onsite, in transit, at the contractor’s off-site locations, including backup locations). The contractor shall ensure that the handling and processing of SEC data is in compliance with Federal law and the SEC’s Security and Privacy regulations.

The following SEC regulations, policy and procedures can be found in Section J, Attachments 4 through 23.

X.4.1.1 Safeguarding Non-Public Information, SECR 23-2A, January 21, 2000

X.4.1.4 Records and Information Management Program, SECR 7-1, November 14, 2012

X.4.1.5 Management and Protection of Privacy Act Records and other Personally Identifiable Information, SECR 24-08, 14 April 2010

Reporting Requirements:

The contractor shall ensure timely reporting of information on corporate mergers, acquisitions and/or takeovers; events/incidents having a direct impact on the security of SEC data, material, and information;

and the quality of service to include any business interruptions. The contractor shall ensure adherence to the Reporting Requirements and timeliness as depicted in Section J, Attachment 28.

Policy and Procedure Updates:

The contractor shall document its governance over securing SEC information based on Federal Law, Executive Order, Policy, Standard and Guidance. The contractor shall also adhere to any other documents and standards that are identified by the SEC as being applicable.

FEDERAL REQUIREMENTS, SECURITY AND ACCESSIBILITY:

Information Systems Authorization to Operate. Information systems containing SEC data or operated on behalf of the SEC are required to have an authorization to operate (ATO), based on National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. The security assessment entails a review of minimum security controls, documented in NIST SP 800-53, Revision 4 (and subsequent revisions as finalized by NIST); documentation of a system security plan, based on NIST SP 800-18; and remediation of weaknesses that are documented in a plan of action and milestone (POA&M) document, as required by Office of Management and Budget (OMB) Memorandum 02-01. The ATO will also have to cover any alternate processing facilities or a subcontractor handling SEC information or operating systems on behalf of the SEC. Additional Federal governance includes but is not limited to the following:

• Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) for system accessibility requirements

• Office of Management and Budget (OMB) Circular A-11, Revised, “Preparation, Submission and Execution of the Budget” (July 2003)

• OMB Circular A-130, Revised, “Management of Federal Information Resources” (November 2000)

• OMB Federal Enterprise Architecture Program Management Office (FEAPMO) Reference Models and Circular A-11 Guidance. www.feapmo.gov.

• Privacy Act of 1974, Public Law 93-579 (5 U.S.C. 552a), as amended

• The E-Government Act of 2002, Public Law 107-347

• OMB Memorandum M-15-01, Fiscal Year 2014-2015 Guidance on Improving Federal

Information Security and Privacy Management Practices, October 3, 2014 (and subsequent updates by OMB)

• OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002, September 30, 2003

• OMB Federal Risk and Authorization Management Program (FedRAMP) Policy Memo, December 8, 2011

• Federal Information Processing Standard (FIPS) Publication (PUB) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, March 2006

• FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

• FIPS PUB 197, Advanced Encryption Standard, November 2001

• FIPS PUB 140-2, Security Requirements for Cryptographic Modules

• National Institute for Standards and Technology (NIST), Special Publication (SP) 800-122, Guide for Protecting the Confidentiality of Personally Identifiable Information (PII), April 2010

• NIST SP 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal

Information Systems: A Security Life Cycle Approach, February 2010

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment Sept 2008

• NIST SP 800-100, Information Security Handbook: A Guide for Managers, Oct 2006

• NIST SP 800-95, Guide to Secure Web Services, Aug 2007

• NIST SP 800-92, Guide to Computer Security Log Management, Sep 2006

• NIST SP 800-88, Revision 1, Guidelines for Media Sanitization, December 2014

• NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide, August 2012

• NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and

Organizations, April 2013

• NIST SP 800-53A, Revision 4, Guide for Assessing the Security Controls in Federal Information

Systems, December 2014

• NIST SP 800-44 Version 2, Guidelines on Securing Public Web Servers, Sep 2007

• NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments, September 2012

• NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, May

• NIST SP 800-18, Revision 1, Guide for Developing Security Plans for Federal Information

Systems, February 2006

• NIST SP 800-70, Revision 2, National Checklist Program for IT Products: Guidelines for

Checklist Users and Developers, February 2011

• NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, September 2011 http://www.feapmo.gov/

Any cloud-based components shall be assessed in accordance with FedRAMP and must have already received a provisional authorization from either the Joint Authorization Board or another U.S. Federal Executive Branch Agency. Additional Federal requirements for cloud computing are documented in NIST SPs 800-144, 800-145 and 800-146.

Security Issue Review. The Contractor shall remediate problems identified during any security testing activities. All significant issues (typically those rated as HIGH and often those rated as MEDIUM) should be resolved before the system is allowed to go into production and handle SEC information. The Contractor shall resolve as many security audit-related Plan of Action and Milestones (POA&M) items as possible and within a reasonable timeframe, based on risk guidance from the designated authorizing official. The Contractor shall document the resolution and provide supporting evidence of changes. The Contractor shall schedule a conference meeting with the Contracting Officer’s Representative (COR), OIT Security Group staff, and relevant SEC staff to review the state of the POA&M resolutions. The Contractor shall provide the SEC with the number and description of resolved POA&M items identified in the security review along with supporting evidence. SEC’s OIT Security Group may choose to perform additional technical testing to validate resolution.

Security Assessment. OIT Security Team performs Security Assessment and Authorization (SA&A) for a product to be deployed. This process is designed to allow the SEC to identify any risks associated with the system and either mitigate them or formally accept any residual risk. This requirement is based on the NIST SP 800 series of documents and includes:

1. Enumeration - activity aimed at identifying devices and components and cross-referencing with provided inventory lists;

2. Vulnerability Scanning - performs network-based vulnerability assessment of customer’s servers, workstations, and any other network device or appliance in scope. The assessment will identify vulnerabilities associated with network services, operating systems, and devices that are un-patched or have out-of-date software security patches;

3. Penetration Testing - attempts to exploit weaknesses identified from vulnerability scanning to verify legitimate findings, eliminate false-positives, and determine the extent of the vulnerability and potential remediation steps that may be taken; and

4. Functional Testing - Perform specific tests, examinations, and inspections against NIST SP 800-53 controls not tested by the other activities.

The Contractor shall provide the Security Team with: (1) a system demonstration; (2) test user IDs; (3) Access to the system; and (4) System Security Plan (SSP) (5) additional documents as required under the NIST SP 800 series to support Security Assessment & Authorization activities. The Contractor shall provide ongoing support to update the required SA&documentation. The OIT Security Team provides the test reports. Any cloud-based components will have to be assessed in accordance with FedRAMP and must have already received a provisional authorization from either the Joint Authorization Board or another U.S. Federal Executive Branch Agency. Additional Federal requirements for cloud computing are documented in NIST SPs 800-144, 800-145 and 800-146.

Documentation Updates. The Contractor shall maintain and update system specifications and/or documentation, including system inventory, to reflect changes made during maintenance or update. The Contractor shall maintain system documentation to reflect the configuration of software releases and commercial off-the shelf (COTS) products. The Contractor shall maintain documents and specifications in compliance with standards for formatting and content and produce standardized documentation, i.e., User Guides, Requirements Documents, On-line Help, Standard Operating Procedures (SOP), system specifications, audit documentation practices and procedures, and other documentation. The documentation shall be available to the COR for review and inspections throughout the system development life cycle (SDLC); updates shall be submitted to the COR for review and approval.

System Development Plan (SDP). The Contractor shall develop, maintain, and execute an SDP which shall include the policies, procedures, standards, instructions, forms, and/or checklists needed to analyze, design, implement, test, and deploy the required application systems. In the SDP, the Contractor shall explain how the Contractor’s corporate system development standards and practices will be applied and discuss its development methodology in detail. The SDP shall also describe the development methodology used by the Contractor. The SDP will be benchmarked against NIST SP 800-64, Revision 2, Security Considerations in the System Development Life Cycle, October 2008 and NIST SP 800-160, Systems Security Engineering: An Integrated Approach to Building Trustworthy Resilient Systems (after becoming final).

Disaster Recovery. Contractor shall create and implement policies, processes and procedures to address the information system security requirements needed for disaster recovery in the event of a disruption of the information service(s) provided. This includes regular review and test of a disaster recovery plan(s) related to recovering the information service(s) provided. Results of all disaster recovery plan tests, exercises or actual events, including but not limited to after-action reports, lessons learned and plan updates will be made available to SEC for review within ten (10) working days of a request by SEC. Furthermore, SEC will be provided a point of contact for disaster recovery planning and exercise for the information service(s) provided. Contractor shall invite participation from the SEC during tests to ensure SEC is able to access the system(s) and service(s) provided.

Approval of Subcontracts. The Government reserves the right to approve or disapprove any subcontract and any subcontractor selected. Therefore, the Contractor shall obtain the Contracting Officer’s approval of all subcontractors and provide copies of subcontracts for any work required by this contract.

Subcontractors shall be bound by the same information protection requirements, because they handle the SEC’s data. Like the Contractor, the Subcontractor’s environment will have to undergo security assessment and authorization, including a facility only used for disaster recovery or alternate processing.

Common Security Configurations. Common security configurations are published on NIST’s web site http://checklists.nist.gov. NIST’s Computer Security Division website is located at http://csrc.nist.gov. For more information about the security content automation program, see http://nvd.nist.gov/scap.cfm. NIST Special Publication 800-70, Revision 2, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, February 2011, is located at http://csrc.nist.gov/publications/nistpubs/800-70-rev2/SP800-70-rev2.pdf.

Non-public Information and Personally Identifiable Information (PII). The Contractor shall have established policies and procedures in place to safeguard any non-public information, including Personally Identifiable Information (PII) and Information in Identifiable Form (IIF) collected on behalf of the SEC. The policies and procedures shall provide the Contractor’s processes for identifying, assessing and mitigating privacy risks associated with PII and IIF. The policies and procedures shall also cover training of employees on their roles and responsibilities for safeguarding PII and IIF collected on behalf of the SEC and incident management of suspected or confirmed loss of PII and/or IIF collected on behalf of the SEC in accordance with OMB’s Memorandum Recommendations for Identity Theft Related Data Breach Notification, September 20, 2006, and OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007. The Contractor shall provide a copy of its privacy policies to the Contracting Officer for review and comment by SEC’s OIT Security Group. The Contractor shall also provide a copy of the policies and procedures (or otherwise make such policies and procedures available) to all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract. The Contractor shall ensure that those individuals http://checklists.nist.gov/ http://csrc.nist.gov/ http://nvd.nist.gov/scap.cfm http://csrc.nist.gov/publications/nistpubs/800-70-rev2/SP800-70-rev2.pdf adhere to the Contractor’s policies and procedures relating to PII, IIF and to Federal requirements and SEC-prescribed policies and procedures for the safe handling of PII and IIF collected on behalf of the SEC, including privacy and security training requirements and privacy incident management. Data stored on portable media shall be encrypted using technology compliant with Federal Information Processing Standard 140-2, using NIST validated products.

The Contractor’s employees, agents, and subcontractors shall immediately alert the SEC of any event, including the suspected or confirmed loss of non-public information, including PII collected on behalf of the SEC, that could potentially affect the privacy rights of individuals or which violates any federal law, regulation, mandate or requirement as defined in NIST SP 800-122 by contacting the SEC Information Systems Security point of contact and the SEC Incident Response Team at *CSIRC@sec.gov. The Contractor shall act in accordance with its policies and procedures in the event of any suspected loss of SEC PII and shall support the SEC’s investigation and resolution of reported incidents as requested by the SEC. For purposes of this Clause, a “suspected loss of PII” shall be interpreted liberally to mean any situation in which the loss of PII or unapproved access to PII is deemed a reasonable possibility.

Security Requirements for Transmitting Non-public Information, Including PII. Contractors, subcontractors, and SEC inter/intra agency partners handling electronic non-public information, including personally identifiable information (PII) or information in identifiable form (IIF) on behalf of the SEC will be required to meet the following defined Federal requirements when transmitting such data across public networks (i.e., the Internet), storing such data on portable media or transporting data for backup & recovery purposes.

Contractors shall ensure that all processes, procedures and equipment associated with non-public information, including PII or IIF, collected on behalf of the SEC comply with all laws, regulations, and security mandates as defined by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 2 as well as U.S. government and SEC policies developed to safeguard the confidentially, integrity and availability of data collected on behalf of the SEC that may contain non-public information, including PII or IIF. In support of these requirements, the Contractor shall have:

• policies, procedures, and mechanisms designed to restrict access to SEC data on Contractor, subcontractor, or SEC inter/intra agency partner systems exclusively to authorized personnel;

• policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized party;

• policies, procedures, and mechanisms that ensure SEC data on portable devices are encrypted using methods compliant with Federal Information Processing Standard 140-2 (validated); and

• Policies, procedures, and mechanisms that ensure SEC data transmitted between the Contractor and the SEC are protected using encryption compliant with Federal Information Processing Standard 140-2 (validated).

The Contractor shall provide quarterly assessments to the SEC demonstrating that these policies, procedures, and mechanisms continue to be functional, that the Contractor is compliant with these requirements, and that these requirements are effective. SEC reserves the right to verify stated compliance.

The Contractor shall fully cooperate with any risk analysis or other evaluation of the Program conducted by the SEC or its representatives, including any evaluation of the Program under the SEC’s SA&A Program. Such cooperation shall include, but is not limited to, undergoing an independent audit or risk analysis by the SEC or by a third-party organization approved by the SEC, with such audits to occur not less than once every three (3) years or when there is a significant change to the system. Such evaluations, mailto:*CSIRC@sec.gov risk analyses, or audits shall include security tests on the Contractor’s devices and the review of the Contractor’s own policies, procedures, security scans, tests, or reviews, which the Contractor agrees to provide to the SEC or its representatives upon request. The Contractor will make good faith efforts to remediate any vulnerabilities, issues, or negative findings as a result of any such audit, review, or risk analysis.

Non-digitized data (such as paper documents) containing SEC data must be transported and stored in a manner designed to prevent the unauthorized loss of a document or disclosure of the information in a document. At a minimum this will require written procedures and policies, evidence that these procedures and policies are being followed, records that contractors are being trained on those policies and procedures, along with a physical assessment by the SEC’s Office of Information Technology Security of any area where the documents are stored or used.

Any person who is to have access to SEC data in any form must first receive a favorable suitability determination as prescribed in the supporting policies for Homeland Security Presidential Directive 12 (HSPD12) which requires all persons who have access to an agency’s data or facilities to receive, at a minimum, a background investigation at the level of NACI.

Any individual who is to have access to SEC data in any form must complete mandatory data security training within 30 days after being granted access to that data, and annually thereafter.

Devices that may contain digitized copies of SEC data – such as photocopy machines, scanners, and faxes

– must be protected against unauthorized access both physical or via computer network or wireless connection and the devices may not be returned, sold, or otherwise disposed of until they have first been scrubbed of SEC data in a manner approved by SEC’s Office of Information Technology Security or physically destroyed. Duplication of SEC data that is not directly related to SEC assignments through the use of photocopies, scanning, photography, or Web-cameras, is prohibited.

Material or devices containing SEC data can only be destroyed using an SEC-approved process, which may require the provision of certificates of destruction to the SEC.

System Patching and Maintenance. Any information system components must be kept up to date with vendor versions, patches and security updates. No end-of-life or unsupported components may be used on systems that process or store SEC data, regardless of their location.

System Authentication. Any information system that utilizes authentication for access must conform to SEC policies on system access. For systems categorized as FIPS MODERATE, this includes supporting multi-factor authentication using PIV credentials.