J.2(f)_EISRM_Program_Policy.pdf

Information Assurance Division (IAD) EISRM Policy

Office of Enterprise Risk Management (OERM) Document Number FRTIB.370

Enterprise Information Security and Risk Management (EISRM) Program Policy

Federal Retirement Thrift Investment Board Effective Date: October 31, 2014

1 of7

Infonnation Assurance Division (IAD) EISRM Directive

Office of Enterprise Risk Management (OERM) Document Number FRTIB.370

Enterprise Information Security and Risk Management (EISRM) Program Policy

TABLE OF CONTENTS

1. Overview

2. Policy

3. Applicable Procedures

4. Revision History

5. Approval

2 of7 lnfonnation Assurance Division (IAD)

Office of Enterprise Risk Management (OERM) Document Number FRTIB.370

1. OVERVIEW

The Federal Employees' Retirement System Act of 1986 (FERSA) authorized the Federal Retirement Thrift Investment Board (FRTIB), an independent Agency of the U.S. Executive Branch, to administer the Thrift Savings Plan (TSP). The TSP is a defined contribution plan for U.S. Federal civilian employees (including those covered by the older Civil Service Retirement System (CSRS), retirees, members of the uniformed services, and their beneficiaries). The mission of FRTIB is to administer the TSP solely in the interest of the participants and beneficiaries.

This policy is applicable to all FRTIB employees and contractors who interact with or act upon FRTIB information systems or information. This includes all FRTIB staff or contractors that access, collect, create, record, process, transmit, store, retrieve, display, print, or otherwise disseminate information owned or maintained by FRTIB.

The Chief Information Security Officer (CISO) is responsible for the development and maintenance of this policy. There are references in this document to other publications currently under development.

Until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative for planning and transition purposes.

2. POLICY

FRTIB shall comply with the provisions of the Federal Information Security Management Act of 2002 (FISMA) to the maximum extent possible under the law. This policy ensures compliance with FISMA and establishes and authorizes FRTIB's Enterprise Information Security and Risk Management (EISRM) Program. This policy designates responsibilities and authorities for ensuring an acceptable level of risk for the operation of all information resources containing participant, beneficiary, and FRTIB information, while ensuring the confidentiality, integrity, and availability of all information collected, created, processed, transmitted, stored, or disseminated on FRTIB information systems or on any other information systems used on the Agency's behalf.

The EISRM policy directs the Agency to perform the following:

Protect all FR TIB information and information systems in a manner that is commensurate with the sensitivity, value, and criticality of the information.

Ensure the highly networked computing environment of the FRTIB is protected by providing an effective Agency-wide management and oversight of related information security risks, including coordination of information security efforts.

Protect information from unauthorized disclosure, destruction, or modification while the information is being collected, processed, transmitted, stored, or disseminated.

Implement information security through policy, resource allocation, and budget decisions to include obtaining adequate financial and human resources.

Develop a framework for ensuring the effectiveness of security controls over information resources that support FR TIB operations and assets.

Provide for the development and maintenance of minimum security controls required to protect FRTIB information and information systems.

3 of7

2.1 Risk Management Framework.

Office of Enterprise Risk Management (OERM) Document Number FRTIB.370

FRTIB shall develop and apply a Risk Management Framework.

2.2 Measurement

The effectiveness of this policy will be assessed by measurements collected and evaluated by the CISO. The CISO will assess the degree of compliance with assignments of responsibility for information security, establishment of security plans, review of security controls, and documented authorizations to operate.

The CISO will collect and evaluate appropriate metrics to assess trends involving the overall information security posture. These trends include tracking metrics that involve the cost, schedule impact, effect on mission, program, and project performance attributed to the loss, alteration, unavailability, misuse, or unauthorized access to or modification of FRTIB information or IT resources.

2.3 Agency Designations

This section outlines the key roles and responsibilities for developing and implementing the information security program. While information security is the responsibility of all members of the organization, the positions described in this section are key information security stakeholders that shall instill a culture of information security management and awareness across the organization.

2.3.1 Agency Head

The FRTIB Agency Head is the Executive Director. The Executive Director as supported by the Chief Operating Officer has the following responsibilities:

Provides information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of Agency information that is owned or processed by the Agency.

Ensures that information security management processes are integrated with Agency strategic and operational planning processes.

Ensures senior Agency officials provide information security for the information and information systems that support the operations and assets under their control.

Ensures the Chief Technology Officer reports annually on the effectiveness of implementing the Agency's information security program.

Provides leadership support for the EISRM Program development, implementation, and operation.

Ensures that information security activities have adequate financial and human resources.

Requires information security measurements as a required element of the EIS RM Program.

4of7

Office of Enterprise Risk Management (OERM) Document Number FRTIB.370

Appoints a Chief Technology Officer (CTO) and delegates to the CTO the authority to ensure Agency compliance with the EISRM Program.

Appoints the CTO as the FRTIB Authorizing Official (AO).

2.3.2 Chief Technology Officer (Chief Information Officer)

The CTO has the following responsibilities:

Authorizes the EISRM Policy and respective changes to the EISRM Program, information system Authorities to Operate (ATOs), and the acceptance of IT security risks.

Assists senior Agency officials concerning their responsibility under the EISRM Program.

Appoints the CISO as the Senior Agency Information Security Officer and to perform the duties as outlined in EISRM.

Delegates responsibility of specific EISRM duties to System Owners (SO) and the CISO where appropriate and in writing.

Reports annually to the head of the Agency on the effectiveness of the Agency's information security program.

Allocates adequate financial and human resources to support the EISRM Program.

Reviews and uses information security measures regularly to support policy, resource allocation, budget decisions, and assessment of operational risk.

Develops and maintains policies, procedures, and control techniques to address all applicable EISRM requirements. The CTO can further delegate these responsibilities to the CISO.

Develops and maintains a security incident response capability. The CTO can further delegate this responsibility to the CISO.

Develops, conducts, and maintains a security education and training awareness program to include training personnel with significant responsibilities for information security. The CTO can further delegate this responsibility to the

CISO.

Appoints System Owners (SO) to ensure accountability exists for the security of all information systems and to perform the duties as outlined in EISRM.

2.3.3 Chief Information Security Officer (Senior Agency Information Security Officer)

The CISO has the following responsibilities:

Carries out the CTO's responsibilities under the EISRM Program.

Reviews and approves all programs, policies, procedures, standards, and guidelines to officially develop, and implement the EISRM Program.

5 of7

Office of Enterprise Risk Management (OERM) Document Number FRTIB.370

Develops, approves, and maintains the EISRM appendices including the Enterprise Common Control Registry, Baseline Security Requirements (BLSR), and Roles & Responsibility Matrix.

Reviews and inspects security role delegations for any inconsistencies within the EISRM Program.

Leads the development of the EISRM Program performance measures and integrates information security measurement into all programs, policies, procedures, and guidelines in support of the EISRM Program.

Uses information security measures in support of the CTO's annual reporting to the Agency head on the effectiveness of the Agency's information security program, including progress of remedial actions.

Budgets adequate financial and human resources to support the EISRM Program development, implementation, and operations.

Utilizes information security measures for policy, resource allocation, and budget decisions.

Appoints Information System Security Officers (ISSO) to oversee the IT security of each Agency information system.

Ensures the EISRM Program complies with requirements by the National Institute of Standards and Technology's (NIST) Federal Information Processing Standards and other IT security requirements, Federal statutes and legislation that does not conflict with statutes that govern the operation of the Agency.

Leads and approves the selection of specific technical hardware and software information security solutions to be made by FRTIB from among commercially developed products, ensuring they meet the NIST standards and complies with the EISRM Program.

Integrates Baseline Security Requirements into the Agency's Project Management Framework and system development life cycle.

Deploys a robust security education and awareness program to include specialized role based training for individuals with significant IT security responsibilities.

6 of7

3. APPLICABLE PROCEDURES

Office of Enterprise Risk Management (OERM) Document Number FRTIB.370

FRTIB will adhere to and abide by FISMA and applicable Federal Information Processing Standards (FIPS) as finalized and disseminated by the National Institute of Standards and Technology.

A complete list of applicable procedures is to be determined. Present applicable procedures include:

• IT Security Risk Acceptance

• Media Protection

4. REVISION HISTORY

Date Version FRTIB Author OERM Coordinator Comments

(briefly summarize change)

10/16/2014 1.0 John Ramsey, IAD Karrenthya Simmons Initial Version

5. APPROVAL

Nmne: ~~ DaVi({ Heimann

Date: \O {u / ~ol l( Title: Chief Technology Officer. OTS. Acting

Name:/~~ Mark E. Walther

Date: 1-0 /a!>h i I

Title: Chief Operating Officer. FRTIB

7 of7