Security and Privacy Risk Assessment Template 2023 (PWS Appendix 2).pdf

RFP No. 15JPSS23R00000006

Transcription Services for DOJ/EOIR PWS

Appendix 2

UNCLASSIFIED/FOR OFFICIAL USE ONLY 2

Executive Office for Immigration Review (EOIR)

Security and Privacy Risk Assessment

[DATE]

Version 1.0

UNCLASSIFIED/FOR OFFICIAL USE ONLY

Prepared for:

United States Department of Justice

Executive Office for Immigration Review

Office of Information Technology

5109 Leesburg Pike, Suite 900

Falls Church, VA 22041

[Project Name] Security and Privacy Risk Assessment

UNCLASSIFIED/FOR OFFICIAL USE ONLY 3

This page intentionally left blank

UNCLASSIFIED/FOR OFFICIAL USE ONLY 4

DOCUMENT APPROVALS

This Security and Privacy Risk Assessment (SPRA) serves as an ongoing awareness tool to support the organization’s risk management decisions. The SPRA examines risks that may be introduced into the JCON/eWorld environment. It should also be noted that this is not a full Certification and

Accreditation (C&A). However, the effectiveness of the security controls are examined, and configuration testing and vulnerability scanning is conducted to evaluate threats and risks that may be introduced to the environment and a baseline modification to the existing C&A will be made. By signing this document, the stakeholders acknowledge they are aware of the vulnerabilities and/or risks associated with the [Project Name].

XXXXXXXXXXXXXXXXXX

Chief Information Security Officer

Date

XXXXXXXXXXXXXXXX

Project Sponsor

XXXXXXXXXXXXXXXX

Project Manager

UNCLASSIFIED/FOR OFFICIAL USE ONLY 5

REVISION LOG

Version

No.

Date Revision Description Author

0.1 XX/XX/XXXX Initial Document XXXXXXXXXX

UNCLASSIFIED/FOR OFFICIAL USE ONLY 6

Contents

1 AUTHORITY

2 PURPOSE

3 OBJECTIVE

4 VULNERABILITIES IDENTIFIED

5 SECURITY AND PRIVACY REQUIREMENTS IDENTIFIED

6 EVALUATION OF SECURITY AND PRIVACY CONTROLS

7 RECOMMENDATIONS

8 INITIAL PRIVACY ASSESSMENT

9 VULNERABILITY SCAN RESULTS

FIGURE 1 XXXXXXXX NETWORK DIAGRAM

UNCLASSIFIED/FOR OFFICIAL USE ONLY 7

1 Authority

Federal Information Processing Standards (FIPS) are approved by the Secretary of Commerce and issued by the National Institute of Standards and Technologies (NIST) in accordance with Federal

Information Security Management Act (FISMA). FIPS are compulsory and binding for federal agencies. FISMA requires that federal agencies comply with these standards, and therefore, agencies may not waive their use. Special Publications (SPs) are developed and issued by NIST as recommendations and guidance documents. For other than national security programs and systems, federal agencies must follow those NIST Special Publications mandated in a Federal

Information Processing Standard. FIPS 200 mandates the use of Special Publication 800-53, as amended. In addition, Office of Management and Budget (OMB) policies (including OMB

Reporting Instructions for FISMA and Agency Privacy Management), state that for other than national security programs and systems, federal agencies must follow certain specific NIST

Special Publications. Other security-related publications, including interagency reports (NISTIRs) and ITL Bulletins, provide technical and other information about NIST's activities. These publications are mandatory only when specified by OMB.

In developing standards and guidelines required by FISMA, NIST consults with other federal agencies and offices as well as the private sector to improve information security, avoid unnecessary and costly duplication of effort, and ensure that NIST publications are complementary with the standards and guidelines employed for the protection of national security systems. In addition to its comprehensive public review and vetting process, NIST is collaborating with the

Office of the Director of National Intelligence (ODNI), the Department of Defense (DOD), and the Committee on National Security Systems (CNSS) to establish a common foundation for information security across the federal government. A common foundation for information security will provide the Intelligence, Defense, and Civil sectors of the federal government and their support contractors, more uniform and consistent ways to manage the risk to organizational operations and assets, individuals, other organizations, and the Nation that results from the operation and use of information systems. A common foundation for information security will also provide a strong basis for reciprocal acceptance of security authorization decisions and facilitate information sharing.

2 Purpose

The overall purpose that the information and/or project are designed to serve and a high-level explanation of how the project achieves that purpose:

Figure 1 Network Diagram

3 Objective

The objective of this SPRA is to identify vulnerabilities, evaluate the security and privacy controls and make recommendations for risk mitigation. It is impossible to be risk free, so doing due diligence in areas of concern is the primary goal. This SPRA is to make all stakeholders aware of the risks. Vulnerability scans were conducted to identify the vulnerabilities and the risks that they present to the IT security posture. Security controls were evaluated using NIST 800-53 to measure

UNCLASSIFIED/FOR OFFICIAL USE ONLY 8

risks based on the minimal standards set forth by this federal regulation. From this SPRA, one can prevent, minimize, mitigate, or accept risk based on the business needs of the organizations.

4 Vulnerabilities Identified

This section identifies the vulnerabilities as a result of the vulnerability scans conducted using

Nessus for scanning the operating system and database and Burp Suite for scanning the public facing web applications. The combination of the three vulnerability scans comprise the penetration testing as required by federal regulations for public facing application to undergo prior to being placed into production. Specifically, the scan results identified the following vulnerabilities, threats and risk ratings:

Example Vulnerability 1: Microsoft Patches (MS15-018, MS15-020, MS15-021, MS15-022)

Paired Threats The most severe of these vulnerabilities could allow remote code execution if a user views a specially crafted webpage in

Internet Explorer. The vulnerabilities could allow a user with limited privileges on an affected system to leverage Task

Scheduler to execute files that they do not have permissions to run. An attacker who successfully exploited this vulnerability could bypass access control list (ACL) checks and run privileged executables.

Overall

Risk Rating High

Example Vulnerability 2: Microsoft Patch (MS15-011)

Threat Remote code execution vulnerability exists in how Group

Policy receives and applies connection data when a domain-joined system connects to a domain controller. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, could view, change, or delete data, or could create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

Overall

Example Vulnerability 3: Permission on registry extended proc: Granted To=public

Threat A hacker may attack and grant the access to the database.

Overall

UNCLASSIFIED/FOR OFFICIAL USE ONLY 9

Example Vulnerability 4: Penetration Test Results

Paired Threats Refer to Section 8, Executive Summary there are 3 alerts.

Overall

Medium

5 Security and Privacy Requirements Identified

This section identifies the Security and Privacy requirements that the [Project Name] application shall satisfy to ensure that the system meets the Department’s minimum Security requirements. The [Project Name].application shall contain Personally Identifiable Information

(PII), which is sensitive information about individuals and should be treated with confidentiality.

The integrity of the PII must be protected in accordance with Federal Laws and Regulations.

Req.

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

Disable Inactive

Accounts

The application shall have the capability to automatically disable inactive accounts after 90 days.

AC-02(3)

2 Access Enforcement

The application shall have the capability to implement role-based access controls and configure access controls so that each user can access only the information necessary for the user’s role or only permit users to access PII through the application that restricts their access to the PII the users require, instead of allowing users direct access to a database or files containing PII.

AC-03

UNCLASSIFIED/FOR OFFICIAL USE ONLY 10

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

3 Least Privilege

The application shall have the capability to ensure that least privileges are adhered to and enforced, as not everyone will need to view sensitive information.

AC-06

Internal System Use Notification

For federal employees, the internal user interface of the application shall deploy the DOJ warning banner with the official language as follows:

WARNING: You are accessing a U.S. Government information system, which includes: (1) this computer, (2) this computer network, (3) all computers connected to this network, and (4) all devices and storage media attached to this network or to a computer on this network. This information system is provided for U.S. Government-authorized use only. Unauthorized or improper use of this system may result in disciplinary action, and civil and criminal penalties. By using this information system, you understand and consent to the following: -You have no reasonable expectation of privacy regarding any communications transmitted through or data stored on this information system. At any time, the government may monitor, intercept, search and/or seize data transiting or stored on this information system. -Any communications transmitted through or data stored on this information system may be disclosed or used for any U.S.

Government-authorized purpose.

For further information see the Department order on Use and Monitoring of Department Computers and Computer Systems.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 11

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

External System Use Notification

EXTERNAL interface for Public user access the warning banner with the official language as follows must be deployed:

WARNING: You are accessing a U.S. Government information system. This information system is to be used by authorized users only.

Your use of this information system may be monitored, recorded, or audited. All access or use of this information system indicates consent to monitoring, recording or auditing such use. Authorized use of this system is currently limited to accessing and making permitted changes to your profile and electronically filing designated forms before the Executive Office for Immigration Review.

Unauthorized or improper use of this system is prohibited and may result in criminal, civil, or administrative penalties.

AC-08

6 Session Lock

The application interface (i.e.

attached computer), shall prevent further access to the system by initiating a session lock after 30 minutes of inactivity or upon receiving a request from a user.

Users must ensure that controls such as locking computer screens are followed to avoid unintentional or intentional shoulder surfing.

AC-11

UNCLASSIFIED/FOR OFFICIAL USE ONLY 12

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

Privacy Impact And Risk

Assessment

The organization:

a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and

b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.

AR-02

8 Audit Information

The application audit information must include the following:

(i) date and time of event;

(ii) the component of the information system where the event occurred (e.g., software or hardware component);

(iii) type of event;

(iv) user/subject identity;

(v) the outcome (success or failure) of the event;

(vi) session, connection, transaction, and activity duration;

(vii) source and destination addresses;

(viii) object or filename involved;

and

(ix) number of bytes received and bytes sent (for client-server transactions) in the audit records for audit events identified by type, location, or subject.

AU-03

UNCLASSIFIED/FOR OFFICIAL USE ONLY 13

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

9 Audit Record Retention

The application shall have the capability to retain audit records for 30 days online and one year offline to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

AU-11

10 Security Assessments

The application shall comply with the Department to measure compliance with Federal Information Security Management Act (FISMA) of 2014 and Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, July 2016.

CA-02

Create Security Risk

Assessment

The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

CM-04

UNCLASSIFIED/FOR OFFICIAL USE ONLY 14

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

Update Contingency

Plan

The organization develops a contingency plan for the information system that: Identifies essential missions and business functions and associated contingency requirements; Provides recovery objectives, restoration priorities, and metrics; Addresses contingency roles, responsibilities, assigned individuals with contact information;

Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;

Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and Is reviewed and approved.

CP-02

Alternate Processing and Storage Site

The application shall have the capability to be configured for an alternate processing and storage site, so that it is ready to be used as the operational site supporting essential mission and business functions.

CP-06

Information System

Backup

The application shall have the capability to implement the Contingency Planning Process for testing the backup information at least annually, with recovery time and recovery point objectives to verify media reliability and information integrity.

CP-09

UNCLASSIFIED/FOR OFFICIAL USE ONLY 15

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

Minimization Of

Personally Identifiable Information

The organization:

a. Identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection;

b. Limits the collection and retention of PII to the minimum elements identified for the purposes described in the notice and for which the individual has provided consent; and

c. Conducts an initial evaluation of PII holdings and establishes and follows a schedule for regularly reviewing those holdings [organization-defined frequency, at least annually] to ensure that only PII identified in the notice is collected and retained, and that the PII continues to be necessary to accomplish the legally authorized purpose..

DM-01

Identification and Authentication

(Organizational Users) - Local Access To

Privileged Accounts

The application shall have the capability to provide multifactor authentication using LOA4 compatible for account access for DOJ internal users.

IA-02(03)

Authenticator Management - Password-Based Authentication

The application for external shall enforce minimum password complexity of at least 12 characters composed of representatives of at least two of the following character sets:

- Upper-case

- Lower-case

- Numeric

- Special characters (e.g. ~ ! @ # for user accounts and in accordance with the DOJ Strong Authentication Plan.

IA-05(1)

UNCLASSIFIED/FOR OFFICIAL USE ONLY 16

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

18 Incident Response

The application shall implement an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinates incident handling activities with contingency planning activities; and c.

Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.

IR-04

19 Media Protection The application shall restrict access to digital and/or non-digital media to authorized personnel.

MP-02

19 Markings

The application shall be clearly marked with the highest data sensitivity - UNCLASSIFIED/FOR OFFICIAL USE ONLY – in the footer of every display screen presented to the internal government user.

MP-03

UNCLASSIFIED/FOR OFFICIAL USE ONLY 17

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

Media Transport

The application shall:

a. Protect and control types of system media (i.e. flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state and magnetic), compact discs, and digital versatile discs, microfilm and paper) during transport outside of controlled areas using physical and/or procedural controls (i.e. cryptography and locked containers);

b. Maintain accountability for system media during transport outside of controlled areas;

c. Document activities associated with the transport of system media;

and

d. Restrict the activities associated with the transport of system media to authorized personnel.

MP-05

Media Sanitization

The organization shall:

a. Sanitize system media prior to disposal, release out of organizational control, or release for reuse using sanitization techniques and procedures as defined in the DOJ Security Program Operating Manual (SPOM); and

b. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

MP-06

UNCLASSIFIED/FOR OFFICIAL USE ONLY 18

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

Media Use

The organization shall:

a. Restrict the use of unauthorized system media (i.e. restricting or prohibiting the use of flash drives or external hard disk drives) on system components using physical cages on workstations to prohibit access to certain external ports or disabling or removing the ability to insert, read, or write to such devices; and.

b. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

MP-07

UNCLASSIFIED/FOR OFFICIAL USE ONLY 19

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

Physical Access Control

The organization shall:

a. Enforce physical access authorizations at entry and exit points to the facility where the system resides by:

1. Verifying individual access authorizations before granting access to the facility; and

2. Controlling ingress and egress to the facility using physical access control systems or devices, and/or guards;

b. Maintain physical access audit logs for 1 (one) year;

c. Control access to areas within the facility designated as publicly accessible by implementing the following controls: physical access controls;

d. Escort visitors and control visitor activity circumstances requiring visitor escorts and control of visitor activity;

e. Secure keys, combinations, and other physical access devices;

f. Inventory physical access devices every annually; and

g. Change combinations and keys quarterly and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

PE-03

UNCLASSIFIED/FOR OFFICIAL USE ONLY 20

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

Update System Security

Plan

The organization develops a security plan for the information system that is consistent with the organization’s enterprise architecture; explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of missions and business processes;

provides the security categorization of the information system including supporting rationale; describes the operational environment for the information system and relationships with or connections to other information systems; provides an overview of the security requirements for the system;

identifies any relevant overlays, if applicable; describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and is reviewed and approved by the authorizing official or designated representative prior to plan implementation.

PL-02

21 Rules of Behavior Users need to review and sign a rule of behavior.

PL-04

UNCLASSIFIED/FOR OFFICIAL USE ONLY 21

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

22 Vulnerability Scanning

The application shall have the capability to support DOJ IT Security vulnerability scanning and monitoring tools (e.g. Nessus for scanning the Operating System and Databases, Burp Suite for scanning public facing web applications, BIGFix and SCAP monitoring tools) that may run on a different OS such as Linux, and may need a client installed and must be able to operate and function properly at both EOIR’s primary and alternative sites; the appropriate amount of space must be allocated.

RA-05

Unsupported System

Components

The application shall replace information system components when support for the components is no longer available from the developer, vendor, or manufacturer;

and provide justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.

SA-22

24 Implement ReCaptcha

The s application shall provide security safeguards to be employed by the information system to protect against or limit the effects of denial of service attacks.

SC-05(2)

Boundary Protection - Through a Trusted

Internet Connection Access Provider (TICAP)

The application connections to external networks supporting external access and/or remote access to the DOJ shall be obtained through a Trusted Internet Connection Access Provider (TICAP).

SC-07(11)

Transmission

Confidentiality and Integrity

The application shall protect the integrity and confidentiality of transmitted information using encryption.

SC-08

UNCLASSIFIED/FOR OFFICIAL USE ONLY 22

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

27 Flaw Remediation

All appliance firmware for the application shall be maintained at an acceptable level of applicable secure patches.

SI-02

Malicious Code

Protection

The application shall provide antivirus capability to scan real-time malicious code and have the capability to update the signature definitions.

SI-03

Information System Monitoring - Automated Tools for Real-Time Analysis

The application shall employ automated logging to support near real-time analysis of events.

SI-04(2)

Information System Monitoring - System-Generated Alerts

The application shall provide near real-time alerts when the following indications of compromise or potential compromise occur:

compromise indicators identified within the DOJ Computer System Incident Response Plan (Incident Recognition).

SI-04(5)

UNCLASSIFIED/FOR OFFICIAL USE ONLY 23

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

31 Privacy Notice

The organization:

a. Provides effective notice to the public and to individuals regarding:

1. Its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII);

2. Authority for collecting PII;

3. The choices, if any, individuals may have regarding how the organization uses PII and the consequences of exercising or not exercising those choices; and

4. The ability to access and have PII amended or corrected if necessary;

b. Describes:

1. The PII the organization collects and the purpose (s) for which it collects that information;

2. How the organization uses PII internally;

3. Whether the organization shares PII with external entities, the categories of those entities, and the purposes for such sharing;

4. Whether individuals have the ability to consent to specific uses or sharing of PII and how to exercise any such consent;

5. How individuals may obtain access to PII; and

6. How the PII will be protected; and

c. Revises its public notices to reflect changes in practice or policy that affect PII or changes in its activities that impact privacy, before or as soon as practicable after the change.

TR-01

UNCLASSIFIED/FOR OFFICIAL USE ONLY 24

ID

Functional Category Functional Requirement Description Security Control

Reference Comments

System Of Records

Notices And Privacy Act Statements

The organization:

a. Publishes System of Records

Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII);

b. Keeps SORNs current; and

c. Includes Privacy Act

Statements on its forms that collect PII, or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected

TR-02

6 Evaluation of Security and Privacy Controls

The methodology used to evaluate the effectiveness of the security controls in the below table are based on NIST 800-53 Rev4 and are as follows: the security control family identifier and control number are listed under the Control column; the Test Description column provides instructions on how the assessor will test the control, the Expected Results column provides the recommended results based on federal regulations and the Actual Results column is used for the assessor to provide the status of the control whether it was or was not applied and if the control is not applicable (N/A). If a control was not applied and is applicable it will be identified as vulnerability with a risk rating and a recommendation for resolution will be made.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 25

ID

Security Control

Reference

Test Description Expected Result Actual Results

1 AC-02(3) The application shall have the capability to automatically disable inactive accounts after 90 days.

The information system automatically disables inactive accounts after 90 days of inactivity.

2 AC-03 The application shall have the capability to implement role-based access controls and configure access controls so that each user can access only the information necessary for the user’s role or only permit users to access PII through the application that restricts their access to the PII the users require, instead of allowing users direct access to a database or files containing PII.

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 26

ID

Security Control

Reference

Test Description Expected Result Actual Results

3 AC-06 The application shall have the capability to ensure that least privileges are adhered to and enforced, as not everyone will need to view sensitive information.

The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

AC-08

For federal employees, the internal user interface of the application shall deploy the DOJ warning banner with the official language as follows:

The organization defines a system use notification message or banner to be displayed by the information system to users before granting access to the system. WARNING: You are accessing a U.S. Government information system, which includes: (1) this computer, (2) this computer network, (3) all computers connected to this network, and (4) all devices and storage media attached to this network or to a computer on this network. This information system is provided for U.S. Government-authorized use only.

Unauthorized or improper use of this system may result in disciplinary action, and civil and criminal penalties. By using this information system, you understand and consent to the following: -You have no reasonable expectation of privacy regarding any communications transmitted through or data stored on this information system. At any time, the government may monitor, intercept, search and/or seize data transiting or stored on this information system. -Any communications transmitted through or data stored on this information system may be disclosed or used for any U.S. Government-authorized purpose. For further information see the Department order on Use and Monitoring of Department Computers and Computer Systems

UNCLASSIFIED/FOR OFFICIAL USE ONLY 27

ID

Security Control

Reference

Test Description Expected Result Actual Results

AC-08

For the s application EXTERNAL interface for Public user access the warning banner with the official language as follows must be deployed:

The organization defines a system use notification message or banner to be displayed by the information system to users before granting access to the system. WARNING: You are accessing a U.S. Government information system. This information system is to be used by authorized users only.

Your use of this information system may be monitored, recorded, or audited. All access or use of this information system indicates consent to monitoring, recording or auditing such use. Authorized use of this system is currently limited to accessing and making permitted changes to your profile and electronically filing designated forms before the Executive Office for Immigration Review. Unauthorized or improper use of this system is prohibited and may result in criminal, civil, or administrative penalties.

AC-11

The application interface (i.e. attached computer), shall prevent further access to the system by initiating a session lock after 30 minutes of inactivity or upon receiving a request from a user. Users must ensure that controls such as locking computer screens are followed to avoid unintentional or intentional shoulder surfing.

The organization defines the time period of user inactivity after which the information system initiates a session lock.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 28

ID

Security Control

Reference

Test Description Expected Result Actual Results

7 AR-02 The application

a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and

b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures..

PRIVACY IMPACT AND RISK ASSESSMENT

Control: The organization:

a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII);

UNCLASSIFIED/FOR OFFICIAL USE ONLY 29

ID

Security Control

Reference

Test Description Expected Result Actual Results

AU-03

The application audit information must include the following:

(i) date and time of event; (ii) the component of the information system where the event occurred (e.g., software or hardware component); (iii) type of event; (iv) user/subject identity; and (v) the outcome (success or failure) of the event; (vi) session, connection, transaction, and activity duration; (vii) source and destination addresses;

(viii) object or filename involved; and (ix) number of bytes received and bytes sent (for client-server transactions) in the audit records for audit events identified by type, location, or subject.

The information system generates audit records containing the following additional information: (i) date and time of event (ii) the component of the information system where the event occurred; (iii) type of event; (IV) user/subject identity; (v) outcome; (vi) session, connections, transaction, and activity duration; (vii) source and destination address; (viii) object or filename; (ix) number of bytes received and bytes sent.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 30

ID

Security Control

Reference

Test Description Expected Result Actual Results

9 AU-11 The application shall have the capability to retain audit records for 30 days online and 90 days offline to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

The organization retains audit records for 30 days online and 1 year offline to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

10 CA-02 The application shall comply with the Department to measure compliance with Federal Information Security Management Act (FISMA) of 2014 and Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, July 2016.

The organization:

a. Develops a security assessment plan that describes the scope of the assessment including:

1. Security controls and control enhancements under assessment;

2. Assessment procedures to be used to determine security control effectiveness; and

3. Assessment environment, assessment team, and assessment roles and responsibilities;

b. Assesses the security controls in the information system and its environment of operation at least annually to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

c. Produces a security assessment report that documents the results of the assessment; and

d. Provides the results of the security control assessment to the Authorizing Official or designee.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 31

ID

Security Control

Reference

Test Description Expected Result Actual Results

11 CM-04 The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 32

ID

Security Control

Reference

Test Description Expected Result Actual Results

CP-02

The organization develops a contingency plan for the information system that: Identifies essential missions and business functions and associated contingency requirements; Provides recovery objectives, restoration priorities, and metrics; Addresses contingency roles, responsibilities, assigned individuals with contact information; Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and Is reviewed and approved.

The organization:

a. Develops a contingency plan for the information system that:

1. Identifies essential missions and business functions and associated contingency requirements;

2. Provides recovery objectives, restoration priorities, and metrics;

3. Addresses contingency roles, responsibilities, assigned individuals with contact information;

4. Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;

5. Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and

6. Is reviewed and approved by organization-defined personnel or roles;

b. Distributes copies of the contingency plan to organization-defined key contingency personnel (identified by name and/or by role) and organizational elements (b);

c. Coordinates contingency planning activities with incident handling activities;

d. Reviews the contingency plan for the information system;

e. Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

f. Communicates contingency plan changes to organization-defined key contingency personnel (identified by name and/or by role) and organizational elements (f); and

g. Protects the contingency plan from unauthorized disclosure and modification.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 33

ID

Security Control

Reference

Test Description Expected Result Actual Results

13 CP-06 The application shall have the capability to be configured for an alternate processing and storage site, so that it is ready to be used as the operational site supporting essential mission and business functions.

The organization:

a. Establishes an alternate processing and storage site including necessary agreements to permit the storage and retrieval of information system backup information; and

b. Ensures that the alternate processing and storage site provides information security safeguards equivalent to that of the primary site.

14 CP-09 The application must provide the capability for EOIR to implement the Contingency Planning Process for testing the backup information at least annually, with recovery time and recovery point objectives to verify media reliability and information integrity.

The organization:

a. Conducts backups of user-level information contained in the information system at a Component defined frequency consistent with recovery time and recovery point objectives;

b. Conducts backups of system-level information contained in the information system at a Component defined frequency consistent with recovery time and recovery point objectives;

c. Conducts backups of information system documentation including security-related documentation at a Component defined frequency consistent with recovery time and recovery point objectives; and

d. Protects the confidentiality, integrity, and availability of backup information at storage locations.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 34

15 DM-01 The application

a. Identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection;

b. Limits the collection and retention of PII to the minimum elements identified for the purposes described in the notice and for which the individual has provided consent; and

c. Conducts an initial evaluation of PII holdings and establishes and follows a schedule for regularly reviewing those holdings [organization-defined frequency, at least annually] to ensure that only PII identified in the notice is collected and retained, and that the PII continues to be necessary to accomplish the legally authorized purpose.

The organization:

a. Identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection

UNCLASSIFIED/FOR OFFICIAL USE ONLY 35

ID

Security Control

Reference

Test Description Expected Result Actual Results

16 IA-02(03) The application shall have the capability to provide multifactor authentication using LOA4 compatible for account access for DOJ internal users.

The s application shall have the capability to provide multifactor authentication using LOA4 compatible for account access for DOJ internal users.

IA-05(1)

The application for external use shall enforce minimum password complexity of at least 12 characters composed of representatives of at least two of the following character sets:

- Numeric

- Special characters

(e.g. ~ ! @ # $ % ^ & * ( ) for user accounts and in accordance with the DOJ Strong Authentication Plan.

The application for external shall enforce minimum password complexity of at least 12 characters composed of representatives of at least two of the following character sets:

- Numeric

- Special characters (e.g. ~ ! @ # $ % ^ & * ( ) _ + = - ‘ [] / ? > <) for user accounts and in accordance with the DOJ Strong Authentication Plan.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 36

ID

Security Control

Reference

Test Description Expected Result Actual Results

18 IR-04 The application implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinates incident handling activities with contingency planning activities; and c.

Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.

The organization:

a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;

b. Coordinates incident handling activities with contingency planning activities; and

c. Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 37

ID

Security Control

Reference

Test Description Expected Result Actual Results

19 MP-03 The application shall be clearly marked with the highest data sensitivity -

UNCLASSIFIED/FOR

OFFICIAL USE ONLY – in the footer of every display screen presented to the internal government user.

Mark, in accordance with organizational policies and procedures, removable information system media and information system output indicating the distribution limitations, handling caveats, and applicable security markings of the information.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 38

PL-02

The organization develops a security plan for the information system that is consistent with the organization’s enterprise architecture;

explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of missions and business processes; provides the security categorization of the information system including supporting rationale; describes the operational environment for the information system and relationships with or connections to other information systems; provides an overview of the security requirements for the system; identifies any relevant overlays, if applicable; describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions;

The organization:

a. Develops a security plan for the information system that:

1. Is consistent with the organization’s enterprise architecture;

2. Explicitly defines the authorization boundary for the system;

3. Describes the operational context of the information system in terms of missions and business processes;

4. Provides the security categorization of the information system including supporting rationale;

5. Describes the operational environment for the information system and relationships with or connections to other information systems;

6. Provides an overview of the security requirements for the system;

7. Identifies any relevant overlays, if applicable;

8. Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and

9. Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

b. Distributes copies of the security plan and communicates subsequent changes to the plan to all personnel with

c. Reviews the security plan for the information system at least annually;

d. Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and

e. Protects the security plan from unauthorized disclosure and modification.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 39

ID

Security Control

Reference

Test Description Expected Result Actual Results and is reviewed and approved by the authorizing official or designated representative prior to plan implementation.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 40

ID

Security Control

Reference

Test Description Expected Result Actual Results

PL-04

Users need to review and sign the rules of behavior.0

The organization:

a. Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;

b. Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;

c. Reviews and updates the rules of behavior [organization-defined frequency]; and

d. Requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 41

ID

Security Control

Reference

Test Description Expected Result Actual Results

22 RA-05 The application must have the capability to support DOJ IT Security vulnerability scanning and monitoring tools (e.g. Nessus for scanning the Operating System and databases, Burp Suite for scanning public facing web applications, BIGFix and SCAP monitoring tools) that may run on a different OS such as Linux, and may need a client installed and must be able to operate and function properly at both EOIR’s primary and alternative sites; the appropriate amount of space must be allocated.

The organization:

a. Scans for vulnerabilities in the information system and hosted applications in accordance with the DOJ Vulnerability Management Plan and when new vulnerabilities potentially affecting the system/applications are identified and reported;

b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:

1. Enumerating platforms, software flaws, and improper configurations;

2. Formatting checklists and test procedures; and

3. Measuring vulnerability impact;

c. Analyzes vulnerability scan reports and results from security control assessments;

d. Remediates legitimate vulnerabilities within the response times defined in the DOJ Vulnerability Management Plan in accordance with an organizational assessment of risk; and

e. Shares information obtained from the vulnerability scanning process and security control assessments with Component defined personnel or roles to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

UNCLASSIFIED/FOR OFFICIAL USE ONLY 42

ID

Security Control

Reference

Test Description Expected Result Actual Results

23 SA-22 The application shall replace information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and provide justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.

The organization:

a. Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and

b. Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.

24 SC-05 The application shall provide security safeguards to be employed by the information system to protect against or limit the effects of denial of service attacks.

The information system protects against or limits the effects of denial of service attacks by employing security safeguards.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 43

ID

Security Control

Reference

Test Description Expected Result Actual Results

25 SC-07(11) The application architectures’ connections to external networks supporting external access and/or remote access to the DOJ shall be obtained through a Trusted Internet Connection Access Provider (TICAP).

The organization employs boundary protection mechanisms to separate [organization-defined information system components] supporting [organization-defined missions and/or business functions].

26 SC-08 The application architectures shall protect the integrity and confidentiality of transmitted information.

The information system protects the confidentiality and integrity of transmitted information.

SI-02

All appliance firmware will be maintained at an acceptable level of applicable secure patches.

The organization identifies information system flaws.

UNCLASSIFIED/FOR OFFICIAL USE ONLY 44

ID

Security Control

Reference

Test Description Expected Result Actual Results

28 SI-03 The application shall provide antivirus capability to scan real-time malicious code and have the capability to update the signature definitions.

The organization:

a. Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code;

b. Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures;

c. Configures malicious code protection mechanisms to:

1. Perform periodic scans of the information system and real-time scans of files from external sources at endpoint; network entry/exit points as the files are downloaded, opened, or executed…