SOL FINAL - Attachment 4 - DOC IT Security Baseline Policy.pdf

UNCLASSIFIED

Department of Commerce

Information Technology Security Baseline Policy

(DOC ITSBP)

Version 1.0

Date June 2019

Revision History

Version Number Date Description of Change/Revision Section/Pages

Affected Changes Made

By

1.0 Version 1.0 released DOC/OCIO/OCRM

Table of Contents

1. INTRODUCTION

1.1. Background

1.2. Purpose

1.3. Scope and Applicability

1.4. Management Commitment, Oversight, and Compliance

1.5. Authority

1.6. Document Organization

2. POLICY

2.1. Effective Date

2.2. Cancellation/Augmentation of Existing Policy

2.3. Scoping and Risk Acceptance

2.3.1. Scoping (Control Tailoring)

2.3.2. Risk Acceptance

2.4. Enforcement

3. ROLES AND RESPONSIBILITIES

3.1. Secretary of Commerce

3.2. Risk Executive (Function)

3.3. Chief Information Officer

3.4. Information Owner/Steward

3.5. DOC Chief Information Security Officer (CISO)

3.6. OU CISO

3.7. DOC Cyber Security Reporting and Analytics (CSRA) Branch Chief

3.8. DOC IT Risk Management Services (IRM) Branch Chief

3.9. DOC Cyber Security Solutions and Services (CS3) Branch Chief

3.10. Authorizing Official

3.11. Authorizing Official Designated Representative

3.12. Common Control Provider

3.13. System Owner

3.14. Information System Security Officer

3.15. Information Security Architect

3.16. Information System Security Engineer

3.17. Security Control Assessor

3.18. Senior Agency Official for Privacy

3.19. DOC Offices and IT Groups

Appendix A: Acronyms

Appendix B: Glossary

Appendix C: DOC Offices and IT Groups

Annex A: ITSBP Requirements Roadmap .................................................................................................. A-1

Annex B-1: Access Control (AC) ITSBP Requirements ............................................................................B-1-1

Annex B-2: Awareness and Training (AT) ITSBP Requirements .............................................................B-2-1

Annex B-3: Audit and Accountability (AU) ITSBP Requirements ...........................................................B-3-1

Annex B-4: Security Assessment and Authorization (CA) ITSBP Requirements .....................................B-4-1

Annex B-5: Configuration Management (CM) ITSBP Requirements ......................................................B-5-1

Annex B-6: Contingency Planning (CP) ITSBP Requirements .................................................................B-6-1

Annex B-7: Identification and Authentication (IA) ITSBP Requirements ...............................................B-7-1

Annex B-8: Incident Response (IR) ITSBP Requirements .......................................................................B-8-1

Annex B-9: Maintenance (MA) ITSBP Requirements .............................................................................B-9-1

Annex B-10: Media Protection (MP) ITSBP Requirements ..................................................................B-10-1

Annex B-11: Physical and Environmental Protection (PE) ITSBP Requirements ..................................B-11-1

Annex B-12: Planning (PL) ITSBP Requirements ..................................................................................B-12-1

Annex B-13: Personnel Security (PS) ITSBP Requirements ..................................................................B-13-1

Annex B-14: Risk Assessment (RA) ITSBP Requirements .....................................................................B-14-1

Annex B-15: System and Services Acquisition (SA) ITSBP Requirements ............................................B-15-1

Annex B-16: System and Communications Protection (SC) ITSBP Requirements ...............................B-16-1

Annex B-17: System and Information Integrity (SI) ITSBP Requirements ............................................B-17-1

Annex B-18: Program Management (PM) ITSBP Requirements ..........................................................B-18-1

Annex B-19: Privacy ITSBP Requirements ............................................................................................B-19-1

Annex C: Supplemental DOC Policies ........................................................................................................ C-1

Annex C-1: Information System Security Training for Significant Roles ................................................ C-1-1

Annex C-2: Remote Access ..................................................................................................................... C-2-1

Annex C-3: Peer-to-Peer Technology ..................................................................................................... C-3-1

Annex C-4: Contingency Plan Testing and Exercise Activities ................................................................ C-4-1

Annex C-5: Risk Management Framework ............................................................................................. C-5-1

Annex C-6: Safeguarding Information While on Foreign Travel ............................................................ C-6-1

Annex C-7: Password Management ....................................................................................................... C-7-1

Annex C-8: Access and Use Policy .......................................................................................................... C-8-1

Annex C-9: Pre-Acquisition Supply Chain Risk Assessment ................................................................... C-9-1

Annex C-10: FedRAMP Applicability .................................................................................................... C-10-1

Annex C-11: Incident Response Policy ................................................................................................. C-11-1

Annex C-12: Privileged Account Management .................................................................................... C-12-1

Annex C-13: Plans of Action and Milestones (POA&M) ....................................................................... C-13-1

Annex C-14: Information System Security Critical Elements (Stand-alone Elements or Collateral Duties) ..

C-14-1

Annex C-15: National Security Clearance Requirement for CIOs and ITSOs ........................................ C-15-1

Annex C-16: Executive Critical Elements for Information System Security Roles ................................ C-16-1

Annex C-17: IT Investment Security Authorization Responsibilities .................................................... C-17-1

Annex C-18: Reminder of Information System Security Critical Elements for Performance Plans ..... C-18-1

Annex C-19: Continuous Monitoring Software Standard .................................................................... C-19-1

Annex C-20: Use of Personal E-mail for Official Communication Prohibited ...................................... C-20-1

Annex C-21: New Department of Commerce (DOC) Vulnerability Mitigation Requirements ............. C-21-1

Annex C-22: DOC Privileged IT Users Restrictions ............................................................................... C-22-1

Annex C-23: NOAA Internet Protocol Version 6 (IPv6) Transition ....................................................... C-23-1

Annex C-24: Internet Protocol Version 6 (IPv6) Transition .................................................................. C-24-1

Annex C-25: Personal Identification Verification Implementation and Privileged User Restrictions .. C-25-1

Annex C-26: IT Compliance in Acquisition Checklist Requirements .................................................... C-26-1

Annex C-27: Mandatory Implementation of Enterprise Cybersecurity and Operations Tools ............ C-27-1

Annex C-28: ESOC Mandatory Log Collection of Bureau Security Events ............................................ C-28-1

Annex C-29: FAQ II ............................................................................................................................... C-29-1

Annex C-30: DHS Binding Operational Directives ................................................................................ C-30-1

Annex D: Guidance ................................................................................................................................... D-1

Annex D-1: Department of Commerce Guidance for Integrity Checking ............................................. D-1-1

Annex D-2: IT Compliance in Acquisitions Checklist v3.6 ..................................................................... D-2-1

1. INTRODUCTION

The Department of Commerce (DOC) is the steward of the nation’s data that is critical in creating the conditions for economic growth and opportunity.

It is vital that this data is transmitted, processed and stored with the appropriate amount of care and diligence. DOC leaders at all levels recognize that security must be inherent in our business processes and IT systems to support the various missions and service functions of the organizations. Given the significant and growing danger of cyber threats, DOC must systematically recognize and manage information security-related risks and take steps to understand them to achieve more secure information and information systems through the implementation of appropriate risk mitigation strategies. This is important not only to achieve adequate risk management and compliance with public laws, federal regulations, and standards, but also to aid in the DOC mission to foster, promote, and develop the foreign and domestic commerce of the United States. This document sets forth the DOC Information Technology Security Baseline Policy (ITSBP), which specifies enterprise IT security and privacy requirements to meet the minimum legal and federal mandates for information security.

1.1. Background

The DOC mission impacts industry, federal agencies, local, tribal, state, and international governments, and the American people in many ways. The work on behalf of these constituents is either directly or indirectly reliant on the confidentiality, integrity, and availability of DOC information and information systems (see Glossary, page 31 through 48 for definitions). IT security supports the DOC mission by ensuring our information and information systems are protected against risks of loss, misuse, or unauthorized access in accordance with applicable laws.

1.2. Purpose

This document specifies DOC IT security policy minimum standards to be followed when resourcing, architecting, designing, developing, testing, deploying and operating DOC IT assets and handling DOC information. The minimum standards address requirements and guidance set forth by the Federal Information Security Management Act (FISMA)1. DOC Operating Units, programs and projects are strongly encouraged to extend the “minimum standards” by developing stronger and more robust IT security standards commensurate with the criticality of the information to the specific mission needs. This ITSBP also encompasses minimum security controls as required by Federal Information Processing Standard (FIPS) 2002, defined by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-533, Revision 4, and

1 Federal Information Security Management Act of 2002 (44 USC 3541 - 3549), as amended by the Federal

Information Security Modernization Act of 2014.

2 FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006.

3 NIST 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, April 2013.

commensurate with the security categorization defined by FIPS 1994.

1.3. Scope and Applicability

The DOC ITSBP applies to all Operating Units (OUs) and employees (federal and contractor), guest researchers, collaborators, and others requiring access to and use of DOC information systems or information. While a majority of the requirements contained in this policy relate to the operation, maintenance and configuration of IT resources and information by IT staff, the sections and requirements below must be carried out by all individuals who have access to and use DOC information systems or information, hereafter referred to as “users”:

• Security Control Awareness and Training-2 (AT-2) – Requires users to receive basic security awareness training prior to receiving access to DOC systems and at least annually thereafter.

• Security Control Incident Response-6 (IR-6) – Requires users to report suspected security incidents to the organizational incident response capability within one (1) hour.

• Annex C-1: Information System Security Training for Significant Roles – Provides policy for mandatory training and/or professional certification for Department of Commerce (DOC) individuals with significant information system security responsibilities.

• Annex C-2: Remote Access – Provides requirements for DOC employees, contractors, or other authorized users using any computing device to access DOC's infrastructure or data from non-DOC Internet Protocol (IP) address space for authenticated access.

• Annex C-3: Peer-to-Peer Technology – Provides requirements for Peer-to-Peer (P2P) file sharing technology.

• Annex C-6: Safeguarding Information While on Foreign Travel – Provides requirements for safeguarding DOC information while on foreign travel.

• Annex C-7: Password Management – Provides requirements for password authentication to DOC information systems, including their creation, protection, management, and administration.

• Annex C-8: Access and Use Policy – Provides requirements for access to and use of DOC information and information resources.

The DOC ITSBP also applies to organizations and services to which DOC and/or OUs

4 FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004.

have contracts or legal agreements5. The DOC ITSBP applies to all information systems owned or operated by or on behalf of DOC. The policy requirements apply also to systems which are not owned by DOC but to which DOC interconnects and has legal and/or contractual authority to dictate requirements. The term Information Technology Security encompasses all requirements for information security (i.e., protection of information) as well as the requirements necessary to maintain the confidentiality, integrity, and availability of the Department’s information technology infrastructure. In the event that the scope section of any of the policies in Annex-C conflict with the scope in this section, the scope in the respective policy in Annex-C governs.

All National Security Systems (NSS)6 are within the scope of this policy and must meet all high baseline requirements contained herein. NSS must follow all applicable guidelines and requirements released by the Committee on National Security Systems (CNSS) including, but not limited to CNSSI 12537. If there are conflicts, then CNSS guidelines and requirements govern.

1.4. Management Commitment, Oversight, and Compliance

Management at all levels, including the Chief Information Officer (CIO) and Chief Information Security Officer (CISO), will actively support IT security control requirements with clear guidance, demonstrated commitment, and explicit acknowledgement of control responsibilities. The CIO will provide visible support for security control initiatives. The scope and contents of this document will be reviewed annually and updated as needed.

The management of privacy controls is subject to the coordination and oversight of the Senior Agency Official for Privacy (SAOP). The SAOP conducts privacy control assessments through Privacy Impact Assessment Compliance Review Board meetings to verify the effectiveness of privacy controls selected/implemented across the Department’s risk management tiers to ensure continued compliance with applicable privacy requirements and manage privacy risks. These assessments include a review of the NIST SP 800-53, Rev 4 baseline of security and privacy controls, including Privacy Overlays, and NIST SP 800-1228 security controls.

The DOC Office of the Chief Information Officer (OCIO) will ensure compliance by auditing and/or reviewing the security and privacy control assessments of a sampling of systems based on the DOC ITSBP. These assessments will include a review of the controls baseline for a given system based on the system’s FIPS-199 impact level. The status of each control in the applicable baseline will be categorized as:

5 Note that Grants are outside the scope of this policy.

6 NIST SP 800-59, Guideline for Identifying an Information System as a National Security System, August 2003.

7 CNSSI 1253, Security Categorization and Control Selection for National Security Systems, March 27, 2014.

8 NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), April 2010.

• Implemented and functioning effectively to provide a minimum level of security;

• Implemented but not functioning effectively with a subsequent POA&M detailing actions to facilitate effective functioning or the Authorizing Official’s (AO) documented risk acceptance;

• Not implemented with supporting documentation as required by Section 2.3.1 Control Tailoring (Scoping) or Section 2.3.2 Risk Acceptance; or

• Other, with explanation.

1.5. Authority and Applicable Federal Mandates

Authority Documents

• Clinger-Cohen Act of 1996 (40 U.S.C. 11101(6))

• Cybersecurity Act of 2015, P. L. 114-113, Div. N

• E-Government Act of 2002 (P.L. 107-347)

• Electronic Communications Privacy Act of 1986 (18 USC 2510 et seq., 2701 et seq., 3121 et seq.)

• Federal Information Security Management Act of 2002, as amended by the Federal Information Security Modernization Act of 2014 (44 USC 3541 - 3549)

• Federal Information Technology Acquisition Reform Act (FITARA), P.L. 113-291, Title VIII, Subtitle D (December 2014)

• National Cybersecurity Protection Act of 2014, P.L. 113-282

• OMB Circular No. A-11, Preparation, Submission, and Execution of the Budget, July

• OMB Circular No. A-130, Management of Federal Information Resources, Revised July 2016

• Privacy Act of 1974, as amended (5 USC 552a, as amended)

Applicable Federal Mandates

• Computer Fraud and Abuse Act of 1986 (18 USC 1030 et seq.)

• Department Administrative Order (DAO) 200-0, Department of Commerce Handbooks and Manuals, July 29, 2014

• Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules, May 2001

• Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

• Federal Information Processing Standards (FIPS) 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

• Federal Information Processing Standards (FIPS) 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, September 2013

• National Security Presidential Directive 54/Homeland Security Presidential Directive 23 (NSPD-54/ HSPD-23), Cybersecurity Policy, January 2008

• OMB Memorandum M-02-01, Guidance for Preparing and Submitting Security Plans of Action and Milestones, October 17, 2001

• OMB Memorandum M-15-14, Management and Oversight of Federal Information Technology, June 10, 2015

• Paper Work Reduction Act of 1995, as amended (44 USC 3501-3519)

1.6. Document Organization

The DOC ITSBP is comprised of three sections, three appendices and four annexes:

• Section 1 – Introduction, which describes the background, purpose, scope and applicability, management commitment, DOC/OCIO/Office of Cyber Security and IT Risk Management (OCRM) oversight, authority, and document organization.

• Section 2 – Policy, which describes the effective date, cancellation/augmentation of existing policy, scoping and risk acceptance, and enforcement.

• Section 3 – IT Security Roles and Responsibilities, which provides an overview of the DOC/ OU roles needed to implement the DOC ITSBP requirements.

• Appendix A – Acronyms

• Appendix B – Glossary

• Appendix C – DOC Offices and IT Groups

• Annex A – ITSBP Requirements Roadmap

• Annex B – NIST 800-53 ITSBP Requirements

• Annex C – Supplemental DOC Security Policies

• Annex D – Guidance

2. POLICY

OUs must select the security controls from the DOC IT security minimum requirements. OUs must use NIST SP 800-53A, Revision 49, as amended, as the basis for assessing information system security controls to determine the extent to which they are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements. OUs must adhere to all steps in NIST SP 800-37, Revision 210, as amended. DOC OUs must use FIPS 199 to categorize information and information systems and determine their appropriate impact levels (Low, Moderate, or High).

2.1. Effective Date

The DOC ITSBP is effective upon issuance and supersedes the 2014 DOC Information Technology Security Program Policy (ITSPP). OUs are required to implement the DOC ITSBP within 120 calendar days of final issuance of this policy. OUs are to implement the ITSBP requirements and update System Security Plans as needed. ITSBP requirements that are not implemented within 120 days must be managed by Plan of Action and Milestones (POA&Ms).

The DOC CISO will review the DOC ITSBP at least annually and incorporate updates as necessary. The revised DOC ITSBP shall be reviewed by the DOC Information Technology Security Coordinating Committee (ITSCC) and CIO Council, as necessary, and approved by the DOC CIO.

2.2. Cancellation/Augmentation of Existing Policy

Annex A provides a summary of the documents that have been incorporated into the DOC ITSBP and those that have been rescinded.

2.3. Scoping and Risk Acceptance

2.3.1. Scoping (Control Tailoring)

DOC OU Authorizing Officials (AOs) have the flexibility to tailor security control baselines in accordance with the terms and conditions set forth in NIST SP 800- 53 Rev. 4. NIST SP 800-53 Rev. 4 provides specific scoping terms and conditions related to the applicability and implementation of NIST SP 800-53 Rev. 4 security controls. In addition, scoping may also be applied to controls and parameters that fall outside of the NIST SP 800-53 Rev. 4 framework (e.g., DOC Criteria).

Implementation details for all controls being employed on the system must be stated in the system’s System Security Plan (SSP). Controls that the AO has elected not to employ in light of the scoping guidance in NIST SP 800-53 Rev. 4, or because the AO has deemed the control technically or operationally infeasible to implement on a specific system must have the following

9 NIST SP 800-53A Revision 4., Assessing Security and Privacy Controls in Federal Information Systems and

Organizations, December 2014.

10 NIST SP 800-37, Revision 2, Guide for Applying the Risk Management Framework for Information Systems and

Organizations, December 2018.

information documented:

1. Explanation of circumstance justifying foregoing the implementation of the control;

2. Description of all compensating controls reducing the risks associated with the inability to implement the control; and

3. Description of any residual risk introduced as a result of not implementing the control (Risk Assessment).

Controls not currently being implemented but that are planned to be implemented must be documented in a POA&M and the POA&M must be referenced in the respective control section in the SSP or Risk Assessment.

2.3.2. Risk Acceptance

The OU CIO, in their capacity as the AO for OU systems, has the authority to grant risk-based acceptances to the required DOC ITSBP baseline controls and policies for their OU except for controls and/or policies that explicitly require an acceptance by the DOC CIO. Additionally, AOs have the authority to grant risk-based acceptances to the required DOC ITSBP baseline controls and policies for the systems for which they serve as AO, except for controls and/or policies that explicitly require a risk acceptance be granted by the DOC CIO.

Circumstances for such risk acceptances differ from controls baseline tailoring as described in Section 2.3.1 above, in that risk acceptances are to be provided for instances of widespread (affecting multiple OU systems or users) inability to implement certain policy requirements or in situations where policies explicitly require an acceptance for a specific control or requirement. Risk acceptance requests must document, as applicable:

1. Explanation of unique circumstance justifying foregoing the implementation of the requirement/control;

2. Description of compensating controls that provide an equivalent or comparable protective value to that of the requirement/control not being implemented;

3. Description of any residual risk introduced as a result of not implementing the requirement/control;

4. Documented POA&Ms for controls not currently being employed but which are planned; and

5. Decision by the OU CIO, or system AO (or DOC CIO in cases where policy requires DOC CIO approval of risk acceptances).

All risk acceptances must be referenced in relevant system security documentation (e.g., SSP and Risk Assessment) and made available to the DOC

CISO upon request.

2.4. Enforcement

The DOC Information Technology Security Baseline Policy (ITSBP) is issued under the authority of the Department Administrative Order (DAO) 200-0, DOC Handbooks and Manuals as a section of the IT Management Handbook, and thereby has the same force and effect as a DAO.

Violations may result in loss of IT access, disciplinary action, or other consequences consistent with DAO 202-751, Discipline, and/or civil or criminal action against the offending employee(s), associate(s), and/or contractor(s), consistent with applicable law, or contract terms as applicable.

3. ROLES AND RESPONSIBILITIES

This section describes the roles and responsibilities of key participants involved in the DOC’s risk management process. It is organized in accordance with Appendix D of NIST 800-37R111 and includes excerpts from that document along with DOC-specific roles and responsibilities.

The responsibility to protect and secure DOC information and information resources extends to all users and requires collaboration across various offices to coordinate activities associated with DOC’s security posture, technological environment, and overall risk management.

3.1. Secretary of Commerce

The Secretary of Commerce is responsible for ensuring the DOC information and information systems are protected in accordance with directives from the Office of Management and Budget (OMB), Congress, and as set forth in Presidential Directives (PDs). Specific duties include ensuring that the Chief Information Officer has a significant role in:

• The decision processes for all annual and multiyear planning, programming, budgeting, and execution decisions, related reporting requirements, and reports related to information technology; and

• The management, governance, and oversight processes related to information technology12.

3.2. Risk Executive (Function)

The risk executive (function) is an individual or group within an organization that helps to ensure that:

• Risk-related considerations for individual information systems, to include

11 NIST 800-37 Rev. 1, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010. This will be updated to align with 800-37R2 in the next iteration of the ITSBP.

12 Federal Information Technology Acquisition Reform Act (FITARA), December 2014.

authorization decisions, are viewed from an organization-wide perspective with regard to the overall strategic goals and objectives of the organization in carrying out its core missions and business functions; and

• Managing information system-related security risks is consistent across the organization, reflects organizational risk tolerance, and is considered along with other types of risks in order to ensure mission/business success.

This function may be retained by the head of the agency/organization or delegated to another official or group (e.g., an executive leadership council). If there is a risk executive (function) role, the individual or group are to be U.S. government personnel only.

3.3. Chief Information Officer

The responsibilities of the DOC CIO are defined in Departmental Organization Order (DOO) 15-23, Chief Information Officer13. Specific responsibilities of the DOC CIO include:

• Leading the management of information resources throughout the Department, ensuring that the Department’s programs make full and appropriate use of information technology.

• Developing, maintaining, and facilitating the implementation of a Strategic IT Plan and an Enterprise IT Architecture for the Department.

• Ensuring the development and maintenance an DOC-wide information security program.

• Designating a Chief Information Security Officer

• Ensuring the development and maintenance of DOC policies, procedures, control techniques and other guidance for the management and security of information resources throughout the Department, and monitor and enforce compliance with such policies, procedures, control techniques and guidance.

• Monitoring, evaluating, and reporting to the Secretary of Commerce on the status of IT security within the Department at least annually.

• Serving as the Department's Chief Infrastructure Assurance Officer (CIAO) to carry out the critical infrastructure protection policies provided in Presidential Decision Directive 6314, and support implementation of the Department’s Critical Infrastructure Protection Program.

• Carrying out the Secretary's responsibilities under OMB Circular A-130, "Management of Federal Information Resources"15.

13 Departmental Organization Order (DOO) 15-23, Chief Information Officer, July 13, 2017.

14 Presidential Decision Directive 63, Critical Infrastructure Protection, May 22, 1998.

15 OMB Circular No. A-130, Management of Federal Information Resources, Revised July 2016.

• Carrying out responsibilities under the Federal Information Technology Acquisition Reform Act (FITARA).

• Overseeing the implementation of control PS-8, Personnel Sanctions, to ensure all personnel are held accountable for complying with the DOC-wide information security program.

• Overseeing the enforcement of Annex C-8, Access and Use Policy.

• Overseeing the implementation of Section 2.4, Enforcement.

• Approving the DOC information technology budget request.

• Certifying that information technology investments are adequately implementing incremental development, as defined in capital planning guidance issued by the Office of Management and Budget.

• Developing a plan, in coordination with Chief Information Officers (CIOs), Senior Agency Officials for Records Management (SAORMs), and Senior Agency Officials for Privacy (SAOPs), for information systems and components that cannot be appropriately protected or secured and ensure that such systems are given a high priority for upgrade, replacement, or retirement.

• Assisting senior agency officials concerning their responsibilities to provide information security for the information and information systems that support the operations and assets under their control.

• Ensuring personnel with significant information security responsibilities receive appropriate training.

• Ensuring that information system critical elements continue to be included in employee performance plans on an ongoing basis.

The OU CIO:

• Leading the management of information resources throughout the OU, ensuring that the OU’s programs make full and appropriate use of information technology.

• Developing, maintaining, and facilitating the implementation of a Strategic IT Plan and an Enterprise IT Architecture for the OU.

• Approving and issuing OU policies and other guidance for the management of information resources throughout the OU, and monitor and enforce compliance with such policies and guidance.

• Carrying out responsibilities under the Federal Information Technology Acquisition Reform Act (FITARA).

• Approving the OU information technology budget request.

• Certifying that information technology investments are adequately implementing incremental development, as defined in capital planning guidance issued by the Office of Management and Budget.

• Monitoring, evaluating, and reporting to the OU Director on the status of IT security within the OU at least annually.

• Overseeing the implementation of control PS-8, Personnel Sanctions, to ensure all personnel are held accountable for complying with the OU information security program.

• Ensuring that information system critical elements continue to be included in employee performance plans on an ongoing basis.

• Oversees the management of the OU IT Security Program and approve OU supplements to the DOC ITSBP.

• Appoints, in writing, an OU CISO to implement the IT Security Program.

• Serves as the AO or Co-AO, as necessary, for unclassified systems within the

OU.

OU CIO responsibilities that may be delegated to the OU CISO include:

• Provide overall management of and leadership and direction to the IT Security Program.

• Develop, maintain, and oversee the OU IT Security Policy.

• Ensure the implementation of the IT Security Program complies with FISMA, which includes independent evaluations of the program.

• Ensuring that all IT resources are identified, including complying with the Department’s capital asset budget planning process and following a methodology consistent with NIST SP 800-6516 and ensuring IT security requirements and resource needs are adequately addressed in IT investments and capital programming processes.

3.4. Information Owner/Steward

The information owner/steward is an organizational official with statutory, management, or operational authority for specified information and the responsibility for establishing the policies and procedures governing its generation, collection, processing, dissemination, and disposal. The information owner/steward of the information processed, stored, or transmitted by an information system may or may not be the same as the system owner. A single information system may contain information from multiple information owners/stewards. Information owners/stewards provide input to information system owners regarding the security requirements and security controls for the systems where the information is processed, stored, or transmitted. The information/steward participates in categorizing, storing, protecting, deciding who accesses and their privilege levels for

16 NIST SP 800-65, Integrating IT Security into the Capital Planning and Capital Investment Control Process, January

2005.

the information. Similarly, the information owner/steward should be informed and approve of risk exposures for their data.

3.5. DOC Chief Information Security Officer (CISO)

The DOC CISO is the Senior Agency Information Security Officer (SAISO) who directs the management of the Department’s IT Security Program. Other terms for the CISO include Senior Information Security Officer (SISO) and Information Technology Security Officer (ITSO). In this document the term CISO is used. The DOC CISO coordinates with the DOC CIO, Director of the Office of Cyber Security and IT Risk Management (OCRM), the Cyber Security Reporting and Analytics (CSRA) Branch Chief, OU CISOs, Information Technology Security Coordinating Committee (ITSCC) and OU CIOs to:

• Develop and maintain IT security policies, plans, control techniques and procedures for information systems, to include developing related standards to be followed by the OU, and developing standards, procedures, and practices to establish an IT Security Program as an integral part of the IT Management Program.

• Manage the IT security continuous monitoring process, incident response capability and authorization process.

• Ensure that OU IT Security Programs include plans and procedures to ensure the recovery and continued operations of the DOC’s systems in the event of a disruption.

• Define activities associated with Security Assessment and Authorization (A&A), including configuration management, security assessment, and implementation of enterprise-wide tools.

• Oversee required IT Security reporting activities to external and internal entities.

• Oversee training requirements for information security personnel.

• In coordination with Servicing Human Resources Office (SHRO), Office of Security (OSY), and Office of Acquisition Management (OAM), review and revise position risk designations on a sampling basis at least annually and as position functions change.

• Implement IT and cyber workforce planning and coding.

• Coordinate opportunities for enhancing efficiency and effectiveness with the Office of Performance, Evaluation, and Risk Management (OPERM).

3.6. OU CISO

The OU CISO is responsible for ensuring that the appropriate operational security posture is maintained for information systems and programs under their OU’s control.

The OU CISO collaborates with the DOC CISO through the OU CIO and the ITSCC.

Additionally, the OU CISO must:

• Develop and maintain the OU IT Security Policy, procedures, standards, and guidance consistent with Departmental and Federal requirements.

• Ensure the development and maintenance of the OU Disaster Recovery Plan

(DRP).

• Conduct continuous monitoring of the OU’s IT Security Program annually to ensure effective implementation of, and compliance with, established policies and procedures.

• Implement IT and cyber workforce planning and coding.

3.7. DOC Cyber Security Reporting and Analytics (CSRA) Branch Chief

The DOC CSRA Branch Chief coordinates with the DOC CIO, CISO, Director of OCRM, and OU CIOs to:

• Monitor and evaluate the status of the DOC IT security posture by performing annual compliance reviews of OU IT Security Programs;

• Advise the DOC CIO and OU CIOs of technological IT security advances that can be used on a Department-wide scale and provide reduced costs for IT security efforts;

and

• Report to the DOC CIO and external entities, such as OMB, Government Accountability Office (GAO), and Congress, on IT Security Program status within the Department.

3.8. DOC IT Risk Management Services (IRM) Branch Chief

The Branch Chief of the IT Risk Management Services (IRM) coordinates with the DOC CIO, CISO, Director of OCRM, and OU CIOs to:

• Advise the DOC CIO and OU CIOs of supply chain risk-related considerations for individual information systems;

• Advise system owners on appropriate implementation of security controls to ensure the operations security posture is maintained for an information system;

and

• Establish the identification DOC High Value Assets (HVA) to ensure the cybersecurity posture of DOC’s most critical information systems is effectively managed.

3.9. DOC Cyber Security Solutions and Services (CS3) Branch Chief

The DOC CS3 Branch Chief coordinates with the DOC CIO, CISO, Director of OCRM, and OU CIOs to deliver and operate centrally-managed, Department-wide, common cyber security technical controls. These technical controls include Continuous Diagnostics and Mitigation (CDM), Enterprise Cybersecurity Monitoring and Operations (ECMO) and Enterprise Security Operations Center (ESOC).

3.10. Authorizing Official

The AO or Co-AO is a senior official or executive with the authority to assume responsibility for operating an information system at an acceptable level of risk to operations, assets, or individuals by granting an Authorization to Operate (ATO) or Deny Authorization to Operate (DATO) as defined in NIST SP 800-37. The responsibilities of the Co-AO are no different from those of the AO. The AO has the responsibility and authority to accept residual risk(s) to enterprise systems and networks. This duty and ultimate decision cannot be delegated (or shared). The role of Co-AO is the OU CIO for their respective OU. AOs/Co-AOs must have the authority to oversee the budget and business operations of the information system within the DOC. The AO approves system security requirements, System Security Plans (SSPs), Interconnection Security Agreements (ISAs), and Memorandums of Agreements (MOAs) and/or Memorandums of Understanding (MOUs). The Authorizing Official role has inherent U.S. Government authority and is assigned to government personnel only.

3.11. Authorizing Official Designated Representative

The Authorizing Official Designated Representative (AODR) is an organizational official that acts on behalf of an authorizing official to coordinate and conduct the required day-to-day activities associated with the security authorization process. The AODR exists only when designated in a signed AO memo which explicitly lists approved actions and delegating signature authority. AODRs can be empowered by authorizing officials to make certain decisions regarding the planning and resourcing of the security authorization process, approval of the security plan, approval and monitoring the implementation of plans of action and milestones, and the assessment and/or determination of risk. The only activity that cannot be delegated to the designated representative by the authorizing official is the authorization decision and signing of the associated authorization decision document (i.e., the acceptance of risk to organizational operations and assets, individuals, other organizations, and the Nation).

3.12. Common Control Provider

The common control provider is an individual, group, or organization responsible for the development, implementation, assessment, operation, and monitoring of common controls (i.e., security controls inherited by information systems. Security plans, security assessment reports, and plans of action and milestones for common controls (or a summary of such information) is made available to information system owners inheriting those controls after the information is reviewed and approved by the senior official or executive with oversight responsibility for those controls.

3.13. System Owner

The SO is responsible for the development and maintenance of the SSP and ensures the system is deployed and operated according to the agreed-upon security requirements. The SO monitors the system and manages the end of sale and end of life hardware and software and funding for replacements. The SO is also responsible for deciding who has access to the information system (and with what types of privileges or access rights) and ensures that system users and support personnel receive the requisite security training. The SO informs key agency officials of the need to conduct a security A&A of the information system, ensures that appropriate resources are available for the effort, and provides the necessary system-related documentation to the Security Control Assessor (SCA). The SO manages risk by taking appropriate steps to reduce or eliminate vulnerabilities and ensures the AO or AODR are provided with enough information to make risk-based decisions prior to adjudication.

3.14. Information System Security Officer

The responsibility of the Information System Security Officer (ISSO) is to ensure the appropriate operational security posture is maintained for an information system or program. The ISSO is responsible for ensuring that the system security authorization is developed and maintained and the system security controls are implemented and monitored. The ISSO serves as the principal advisor to the OU CIO, OU CISO, and SO on all security matters for the information system. In close coordination with the SO, the ISSO often plays an active role in developing and updating the SSP as well as in managing and controlling changes to the system and assessing the security impact of those changes.

3.15. Information Security Architect

The information security architect is an individual, group, or organization responsible for ensuring that the information security requirements necessary to protect the organization’s core missions and business processes are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and the resulting information systems supporting those missions and business processes. The information security architect serves as the liaison between the enterprise architect and the information system security engineer and coordinates with information system owners, common control providers, and information system security officers on the allocation of security controls as system-specific, hybrid, or common controls.

3.16. Information System Security Engineer

The information system security engineer is an individual, group, or organization responsible for conducting information system security engineering activities. System security engineers coordinate their security-related activities with information security architects, senior information security officers, information system owners, common control providers, and information system security officers.

3.17. Security Control Assessor

The security control assessor (SCA) is an individual, group, or organization responsible for conducting a comprehensive assessment of the management, operational, and technical security controls and control enhancements employed within or inherited by an information system to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). Security control assessors also provide an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities.

The required level of assessor independence is determined by the specific conditions of the security control assessment.

3.18. Senior Agency Official for Privacy

The Senior Agency Official for Privacy (SAOP) is designated by the head of the agency.

The SAOP has agency-wide responsibility and accountability for developing, implementing, and maintaining an agency-wide privacy program to ensure compliance with all applicable statues, regulations, and policies regarding the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of personally identifiable information (PII) by programs and information systems, developing and evaluating privacy policy, and managing privacy risks at the agency. The SAOP’s responsibilities include, but are not limited to:

• Develops and maintains a DOC Privacy Program Plan (located at www.commerce.gov/privacy) that provides an overview of an agency’s privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the SAOP and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks;

• Develops and maintains a privacy continuous monitoring (PCM) strategy and PCM program to maintain ongoing awareness of privacy risks and assess privacy controls at a frequency sufficient to ensure compliance with applicable privacy requirements and manage privacy risks;

• Conducts and documents the results of privacy control assessments to verify the continued effectiveness of all privacy controls selected and implemented at the agency across all agency risk management tiers to ensure continued compliance http://www.commerce.gov/privacy with applicable privacy requirements and manage privacy risks;

• Identifies assessment methodologies and metrics to determine whether privacy controls are implemented correctly, operating as intended, and sufficient to ensure compliance with applicable privacy requirements and manage privacy risks;

• Designates which privacy controls will be treated as program management, common, information system-specific, and hybrid privacy controls at the agency;

• Reviews IT capital investment plans and budgetary requests to ensure that privacy requirements (and associated privacy controls), as well as any associated costs, are explicitly identified and included, with respect to any IT resources that will be used to create, collect, use, process, store, maintain, disseminate, disclose, or dispose of PII;

• Reviews and approves, in accordance with NIST FIPS Publication 199 and NIST SP 800-60, the categorization of information systems that create, collect, use, process, store, maintain, disseminate, disclose, or dispose of PII;

• Reviews and approves the privacy plans for agency information systems prior to authorization, reauthorization, or ongoing authorization;

• Reviews authorization packages for information systems that create, collect, use, process, store, maintain, disseminate, disclose, or dispose of PII to ensure compliance with applicable privacy requirements and manage privacy risks, prior to authorizing officials making risk determination and acceptance decisions17;

• Ensures the appropriate training and education regarding privacy laws, regulations, policies and procedures concerning the handling of personal information are afforded to employees and contractors;

• Facilitates and negotiates agreements with senior management, and establishes relationships with partners in private industry and other federal agencies to foster the development and sharing of privacy-related best practices; and partners with the OCIO to ensure all aspects of the Privacy Program are incorporated into the Department’s enterprise infrastructure, IT, and IT security program; and

• Coordinates with the CIO, the senior agency information security officer, and other agency officials in implementation of these requirements.

The SAOP also serves as the Chief Privacy Officer (CPO) for the Department.

Responsibilities include, but are not limited to:

• Serves as the Department’s senior policy authority on matters relating to the public disclosure of information, and advises on privacy issues related to informed

17 OMB Circular A-130, Managing Information as a Strategic Resource, Appendix I – 9.

consent, disclosure risks, and data sharing;

• Develops and oversees implementation of Department-wide policies and procedures relating to the Privacy Act, and assures that…