J.2(o)_ERISM_Baseline_Security_Requirements_(BLSR).pdf

EISRM:

Baseline Security Requirements

Federal Retirement Thrift Investment Board Effective Date: 05/31/2015

Information Assurance Division (IAD) Office of Technology Services (OTS)

Baseline Security Requirements (BLSR) Document Number OTS.100.01

CONTROLLED UNCLASSIFIED INFORMATION – DO NOT DISTRIBUTE

Please note that by providing or disclosing the contents of documents, materials, and information to the GAO, the Department of Labor, or other oversight entities, FRTIB does not, in any manner, waive either its privileges with respect to the information or its duties to protect the information from improper disclosure.

BLSR APR 30 2015 V0.6

TABLE OF CONTENTS

1. OVERVIEW

2. ACCESS CONTROL (AC)

AC-1 Access Control Policy and Procedures

AC-2 Account Management

AC-3 Access Enforcement

AC-4 Information Flow Enforcement

AC-5 Separation of Duties

AC-6 Least Privilege

AC-7 Unsuccessful Logon Attempts

AC-8 System Use Notification

AC-11 Session Lock

AC-12 Session Termination

AC-14 Permitted Actions without Identification or Authentication

AC-17 Remote Access

AC-18 Wireless Access

AC-19 Access Control for Mobile Devices

AC-20 Use of External Communication Systems

AC-21 Information Sharing

AC-22 Publicly Accessible Content

3. SECURITY AWARENESS & TRAINING (AT)

AT-1 Security Awareness and Training Policy and Procedures

AT-2 Security Awareness Training

AT-3 Role-Based Security Training

AT-4 Security Training Records

4. AUDIT AND ACCOUNTABILITY (AU)

AU-1 Audit and Accountability Policy and Procedures

AU-2 Audit Events

AU-3 Content of Audit Records

AU-4 Audit Storage Capacity

AU-5 Response to Audit Processing Failures

AU-6 Audit Review, Analysis, and Reporting

AU-7 Audit Reduction and Report Generation

AU-8 Time Stamps

AU-9 Protection of Audit Information

AU-11 Audit Record Retention

AU-12 Audit Generation

AU-13 Monitoring for Information Disclosure

5. SECURITY ASSESSMENT AND AUTHORIZATION (CA)

CA-1 Security Assessment and Authorization Policy and Procedures

CA-2 Security Assessments

CA-3 System Interconnections

CA-5 Plan of Action and Milestones

CA-6 Security Authorization

CA-7 Continuous Monitoring

CA-9 Internal System Connections

6. CONFIGURATION MANAGEMENT (CM)

CM-1 Configuration Management Policy and Procedures

CM-2 Baseline Configuration

CM-3 Configuration Change Control

CM-4 Security Impact Analysis

CM-5 Access Restrictions for Change

CM-6 Configuration Settings

CM-7 Least Functionality

CM-8 Information System Component Inventory

CM-9 Configuration Management Plan

CM-10 Software Usage Restrictions

CM-11 User-Installed Software

7. CONTINGENCY PLANNING (CP)

CP-1 Contingency Planning Policy and Procedures

CP-2 Contingency Plan

CP-3 Contingency Training

CP-4 Contingency Plan Testing

CP-6 Alternate Storage Site

CP-7 Alternate Processing Site

CP-8 Telecommunications Services

CP-9 Information System Backup

CP-10 Information System Recovery and Reconstitution

8. IDENTIFICATION AND AUTHENTICATION (IA)

IA-1 Identification and Authentication Policy and Procedures

IA-2 Identification and Authentication (Organizational Users)

IA-3 Device Identification and Authentication

IA-4 Identifier Management

IA-5 Authenticator Management

IA-6 Authenticator Feedback

IA-7 Cryptographic Module Authentication (non-organizational users)

IA-8 Identification and Authentication (Non-Organizational Users)

9. INCIDENT RESPONSE (Incident Response)

IR-1 Incident Response Policy and Procedures

IR-2 Incident Response Training

IR-3 Incident Response Testing

IR-4 Incident Handling

IR-5 Incident Monitoring

IR-6 Incident Reporting

IR-7 Incident Response Assistance

IR-8 Incident Response Plan

10. MAINTENANCE (MA)

MA-1 System Maintenance Policy and Procedures

MA-2 Controlled Maintenance

MA-3 Maintenance Tools

MA-4 Nonlocal Maintenance

MA-5 Maintenance Personnel

MA-6 Timely Maintenance

11. MEDIA PROTECTION (MP)

MP-1 Media Protection Policy and Procedures

MP-2 Media Access

MP-3 Media Marking

MP-4 Media Storage

MP-5 Media Transport

MP-6 Media Sanitization

MP-7 Media Use

12. PHYSICAL AND ENVIRONMENTAL PROTECTION (PE)

PE-1 Physical and Environmental Protection Policy and Procedures

PE-2 Physical Access Authorizations

PE-3 Physical Access Control

PE-4 Access Control for Transmission Medium

PE-5 Access Control for Output Devices

PE-6 Monitoring Physical Access

PE-8 Visitor Access Records

PE-9 Power Equipment and Cabling

PE-10 Emergency Shutoff

PE-11 Emergency Power

PE-12 Emergency Lighting

PE-13 Fire Protection

PE-14 Temperature and Humidity Controls

PE-15 Water Damage Protection

PE-16 Delivery and Removal

PE-17 Alternate Work Site

13. PLANNING

PL-1 Security Planning Policy and Procedures

PL-2 System Security Plan (SSP)

PL-4 Rules of Behavior (RoB)

PL-8 Information Security Architecture

PL-9 Central Management

14. PROGRAM MANAGEMENT (PM)

PM-1 Information Security Program Plan

PM-2 Senior Information Security Officer

PM-3 Information Security Resources

PM-4 Plan of Action and Milestones Process (POA&Ms)

PM-5 Information System Inventory

PM-6 Information Security Measures of Performance

PM-7 Enterprise Architecture

PM-8 Critical Infrastructure Plan

PM-9 Risk Management Strategy

PM-10 Security Authorization Process

PM-11 Mission Business Process Definition

PM-12 Insider Threat Program

PM-13 Information Security Workforce

PM-14 Testing, Training, and Monitoring

PM-15 Contacts with Security Groups and Associations

PM-16 Threat Awareness Program

15. PERSONNEL SECURITY

PS-1 Personnel Security Policy and Procedures

PS-2 Position Risk Designation

PS-3 Personnel Screening

PS-4 Personnel Termination

PS-5 Personnel Transfer

PS-6 Access Agreements

PS-7 Third-Party Personnel Security

PS-8 Personnel Sanctions

16. RISK ASSESSMENT (RA)

RA-1 Risk Assessment Policy and Procedures

RA-2 Security Categorization

RA-3 Risk Assessment

RA-5 Vulnerability Scanning

17. SYSTEM AND SERVICE ACQUISITION (System Administrator)

SA-1 System and Services Acquisition Policy and Procedures

SA-2 Allocation of Resources

SA-3 System Development Life Cycle

SA-4 Acquisition Process

SA-5 Information System Documentation

SA-8 Security Engineering Principles

SA-9 External Information System Services

SA-10 Developer Configuration Management

SA-11 Developer Security Testing and Evaluation

18. SYSTEM AND COMMUNICATIONS PROTECTION (SC)

SC-1 System and Communications Protection Policy and Procedures

SC-2 Application Partitioning

SC-4 Information in Shared Resources

SC-5 Denial of Service Protection

SC-7 Boundary Protection

SC-8 Transmission Confidentiality and Integrity

SC-10 Network Disconnect

SC-12 Cryptographic Key Establishment and Management

SC-13 Cryptographic Protection

SC-15 Collaborative Computing Devices

SC-17 Public Key Infrastructure Certificates

SC-18 Mobile Code

SC-19 Voice Over Internet Protocol

SC-20 Secure Name / Address Resolution Service (Authoritative Source)

SC-21 Secure Name / Address Resolution Service (Recursive or Caching Resolver)

SC-22 Architecture and Provisioning for Name / Address Resolution Service

SC-23 Session Authenticity

SC-28 Protection of Information at Rest

SC-37 Out-of-Band Channels

SC-39 Process Isolation

SC-40 Wireless Link Protection

SC-41 Port and I/O Device Access

19. SYSTEM AND INFORMATION INTEGRITY (SI)

SI-1 System and Integrity Policy and Procedures

SI-2 Flaw Remediation

SI-3 Malicious Code Protection

SI-4 Information System Monitoring

SI-5 Security Alerts, Advisories, and Directives

SI-7 Software, Firmware, and Information Integrity

SI-8 Spam Protection

SI-10 Information Input Validation

SI-11 Error Handling

SI-12 Information Handling and Retention

SI-16 Memory Protection

SI-17 Fail-Safe Procedures

20. Applicable Procedures

21. Acronym List

22. Revision History

23. Approval

1. OVERVIEW

This appendix to the EISRM catalogs the Baseline Security Requirements (BLSR) for all FRTIB resources.

BLSRs are standards that serve as FRTIB policy for all NIST SP 800-53 security control families. BLSRs are derived from legislation, Executive Orders, policies, directives, regulations, standards, and business needs.

The BLSR document is modeled after the NIST SP 800-53 moderate control catalog (current version). The

Information Assurance Division maintains the BLSR, and obtains approval from the Chief Information Security

Officer. NIST SP 800-53 tailoring guidance was used to adjust the BLSRs to fit FRTIB mission requirements and operational environments. This includes determining controls that do not apply, applying scoping guidance, incorporating compensating controls when needed, and specifying organization-defined parameters.

Each standard is recorded using the following format. A specific role (person or team) is assigned responsibility for the required activities of each security control. Responsibilities may be delegated using a delegation letter signed by both the delegator and delegate.

Exhibit 1 - BLSR format

The Chief Information Security Officer prohibits reducing the security baseline in any manner.

Additional security controls or enhancements may be needed to address threats, vulnerabilities, or legal requirements for a specific information system. System Owners may supplement the BLSR with more stringent requirements if needed, as long as those additions are recorded within the System Security Plan for the affected information system(s). All deviations from the BLSR must be formally accepted through the IT Security

Risk Acceptance procedures.

The standards contained within the BLSR are applicable to all FRTIB employees and contractors who interact with or act upon FRTIB information systems or information. Therefore, the BLSR document is disseminated through online publishing so that all FRTIB staff or contractors that access, collect, create, record, process, transmit, store, retrieve, display, print, or otherwise disseminate information owned, or maintained by FRTIB have access to these standards.

The remainder of this document is outlined as follows:

Sections 2-19: Security Control Standards

Section 20: Applicable Procedures

Section 21: Acronym List

Section 22: Revision History

Section 23: Approval

The control families in the BLSR supersede the respective standard, and are replacing those policies as the security baseline. For example, Access Control BLSRs replace the Access Control Standard; Incident Response the BLSR replaces the Incident Response Standard, etc.

2. ACCESS CONTROL (AC)

AC security controls provide guidance when managing the privileges associated with each user account. These controls address physical/facilities security in addition to information system security.

AC-1 Access Control Policy and Procedures

The Chief Information Security Officer SHALL: 1.

Develop, document, and disseminate an access control standard that addresses purpose, scope, 1.1.

roles, responsibilities, management commitment, coordination among organizational entities, and compliance

Review the access control standard annually and update as necessary 1.2.

Develop, document, and disseminate procedures to facilitate the implementation of the access 1.3.

control standard for common controls

Review the access control procedures for common controls annually and update as necessary 1.4.

The System Owner SHALL: 2.

Develop, document, and disseminate procedures to facilitate the implementation of the access 2.1.

control standard for system-specific controls

Review the access control procedures for system-specific controls annually and update as 2.2.

necessary

AC-2 Account Management

The Chief Information Security Officer PROHIBITS: 1.

Shared/Group user accounts 1.1.

The System Owner SHALL: 2.

Identify and select the following types of information system accounts to support organizational 2.1.

missions/business functions:

Administrator 2.1.1.

Privileged user 2.1.2.

User 2.1.3.

System/Service 2.1.4.

Assign personnel that performs account management for all account types 2.2.

Establish conditions for group and role membership 2.3.

Specify authorized users of the information system, group and role membership, and access 2.4.

authorizations (i.e., privileges) and other attributes (as required) for each account

Approve creation of new information system accounts and privileged accounts 2.5.

The System Administrator SHALL: 3.

Create, enable, modify, disable, and remove information system accounts in accordance with 3.1.

System Owner approvals and the FRTIB Access Control Procedure

Monitor the use of, information system accounts 3.2.

Set accounts to expire within one year of the last confirmed security training date 3.3.

Create accounts after validation of signed receipt of Non-Disclosure Agreement (NDA) from 3.4.

contractors, Security, Education, Training, and Awareness (SETA) Certificate, FRTIB Rules of

Behavior (RoB), and a favorably adjudicated background investigation commensurate with the level of access required

Disable inactive accounts after 90 days of non-usage 3.5.

Delete inactive accounts after 180 days of non-usage 3.6.

Supervisors, System Administrators, System Owners, Business Owners, Chief Information Security 4.

Officer, Information System Security Officers, and COR SHALL:

Notify account management when: 4.1.

Accounts are no longer required 4.1.1.

Users are terminated or transferred 4.1.2.

Individual information system usage or need-to-know changes 4.1.3.

The System Owner SHALL: 5.

Authorize access to the information system based on: 5.1.

A valid access authorization by the Business Owner 5.1.1.

Intended system usage 5.1.2.

Other attributes as required by the organization or associated missions/business functions 5.1.3.

The Information System Security Officer SHALL: 6.

Review accounts for compliance with account management requirements at least annually 6.1.

The System Owner SHALL: 7.

Change and reissue shared/group passwords within two (2) hours when individuals are removed 7.1.

from the group

AC-2 (1) Automated System Account Management

The System Owner SHALL: 1.

Employ an automated mechanism to support the management of information system accounts 1.1.

AC-2 (2) Removal of Temporary / Emergency Accounts

The System Owner SHALL: 1.

Ensure the information system automatically removes temporary and emergency accounts after the 1.1.

period of time established in the account authorization request

AC-2 (3) Disable Inactive Accounts

The System Owner SHALL: 1.

Ensure the information system automatically disables inactive accounts after a period not to 1.1.

exceed 90 days

AC-2 (4) Automated Audit Actions

The System Owner SHALL: 1.

Ensure their information system(s) automatically audit account creation, modification, enabling, 1.1.

disabling, and removal actions, and notifies the Information System Security Officer and the

System Owner

AC-3 Access Enforcement

The System Owner, with support of the System Administrator and Information System Security Officer, 1.

SHALL:

Provide information system access only with approved authorization from the Business Owner 1.1.

AC-4 Information Flow Enforcement

The System Owner SHALL: 1.

Ensure the information system enforces approved authorizations for controlling the flow of 1.1.

information within the system and between the interconnected systems based on approved

Interconnection System Agreements (ISAs)

AC-5 Separation of Duties

The Information System Security Officer SHALL: 1.

Conduct an annual compliance review of the separation of duties within information systems 1.1.

The Business Owner SHALL: 2.

Define access authorization to support separation of duties for assigned business roles 2.1.

Document the separation of duties within assigned business roles 2.2.

The System Owner SHALL: 3.

Define access authorization to support separation of duties within the information system 3.1.

environment

Document the separation of duties within the information system environment 3.2.

Enforce separation of assigned duties within assigned roles to ensure non-collusion 3.3.

AC-6 Least Privilege

The System Owner SHALL: 1.

Authorize access to the information system only for those processes and services necessary to 1.1.

accomplish assigned tasks and duties in accordance with FRTIB missions/business functions

AC-6 (1) Authorize Access to Security Functions

The System Owner SHALL: 1.

Explicitly authorize access to FRTIB security functions deployed in hardware, software, and 1.1.

firmware; and security relevant information as necessary for individuals to accomplish assigned duties

AC-6 (2) Non-Privileged Access For Non-security Functions

Users SHALL: 1.

Use non-privileged accounts or roles, when accessing functions that do not require privileged 1.1.

access

AC-6 (5) Privileged Accounts

The System Owner SHALL: 1.

Restrict privileged accounts to individuals, roles, and processes requiring those accounts to 1.1.

complete their official duties

The System Administrator SHALL: 2.

Restrict privileged accounts on the information system to roles and personnel authorized by the 2.1.

System Owner

The Privileged Account Holder SHALL: 3.

Logon with their non-privileged individual user account and escalate (from that non-privileged 3.1.

account) into privileged access

NEVER access the Internet while logged on with escalated privileges (exceptions must be 3.2.

submitted in accordance with the IT Security Risk Acceptance Procedure)

AC-6 (9) Auditing Use of Privileged Functions

The System Administrator SHALL: 1.

Audit the execution of privileged functions as part of the continuous monitoring program 1.1.

AC-6 (10) Prohibit Non-Privileged Users from Executing Privileged Functions

The Chief Technology Officer PROHIBITS: 1.

Non-privileged users from executing privileged functions under any circumstance 1.1.

Privileged users from executing privileged functions on unassigned systems 1.2.

(ex: If a Database Administrator is not assigned to System ‘X’, they may not execute Database

Administrator functions on System ‘X’)

The System Owner SHALL: 2.

Ensure non-privileged users are not granted access to privileged functions 2.1.

Ensure the information system prevents non-privileged users from executing privileged functions 2.2.

to include disabling, circumventing, or altering implemented security safeguards/countermeasures

AC-7 Unsuccessful Logon Attempts

The System Owner SHALL: 1.

Ensure the information system: 1.1.

Enforces a limit of three (3) consecutive invalid logon attempts by a user during a 15 minute 1.1.1.

period

Automatically locks the account/node when the maximum number of unsuccessful attempts 1.1.2.

is exceeded

AC-8 System Use Notification

The Chief Technology Officer PROHIBITS: 1.

Unauthorized use of any information system 1.1.

The System Owner SHALL: 2.

Ensure the information system displays a system banner before granting access to the system that 2.1.

provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and specifically states:

Users are accessing a U.S. Government information system 2.1.1.

Information system usage may be monitored, recorded, and subject to audit 2.1.2.

Unauthorized use of the information system is prohibited and subject to criminal and civil 2.1.3.

penalties

Use of the information system indicates consent to monitoring and recording 2.1.4.

Ensure the information system retains the notification message or banner on the screen until users 2.2.

acknowledge the usage conditions and take explicit actions to log on to or further access the information system

Ensure the information system provides the following for publicly accessible systems: 2.3.

Display the system use information banner, before granting further access 2.3.1.

References, if any, to monitoring, recording, or auditing that are consistent with privacy 2.3.2.

accommodations for systems that generally prohibit those activities

A description of the authorized uses of the system 2.3.3.

AC-11 Session Lock

The System Owner SHALL: 1.

Ensure the information system prevents further access to the system by initiating a session lock 1.1.

after 5 minutes of inactivity or upon receiving a request from a user

Ensure the information system retains the session lock until the user reestablishes access using 1.2.

established identification and authentication procedures

AC-11 (1) Pattern-Hiding Displays

The System Owner SHALL: 1.

Ensure the information system conceals information previously visible on the display with a 1.1.

publicly viewable image

AC-12 Session Termination

The System Owner SHALL: 1.

Ensure the information system automatically terminates a user session after 15 minutes of 1.1.

inactivity

AC-14 Permitted Actions without Identification or Authentication

The Information System Security Officer SHALL: 1.

Document within the System Security Plan, any user actions that can be performed on the 1.1.

information system without identification or authentication

Document and provide supporting rationale in the security plan for the information system, user 1.2.

actions not requiring identification or authentication

Submit permitted actions without identification or authentication for approval in accordance with 1.3.

the IT Security Risk Acceptance procedures

AC-17 Remote Access

The System Owner SHALL: 1.

Establish and document usage restrictions, configuration/connection requirements, and 1.1.

implementation guidance for each type of remote access allowed

Authorize remote access to the information system prior to allowing remote connections 1.2.

Ensure multi-factor authentication is used for approved remote access 1.3.

AC-17 (1) Automated Monitoring / Control

The System Owner SHALL: 1.

Ensure information system provides automated monitoring and control of remote access methods 1.1.

AC-17 (2) Protection of Confidentiality / Integrity Using Encryption

The System Owner SHALL: 1.

Implement FIPS 140-2 encryption to protect the confidentiality and integrity of remote access 1.1.

sessions

AC-17 (3) Managed Access Control Points

The System Owner SHALL: 1.

Authorize managed access control points for the information system 1.1.

The Information System Security Officer SHALL: 2.

Document managed access control points within the system security plan 2.1.

The System Administrator SHALL: 3.

Ensure the information system routes all remote access through System Owner-approved access 3.1.

control points

AC-17 (4) Privileged Commands / Access

The System Owner SHALL: 1.

Authorize the execution of privileged commands and access to security-relevant information via 1.1.

remote access

The Information System Security Officer SHALL: 2.

Document the rationale for privileged commands / access in the system security plan 2.1.

The System Administrator SHALL: 3.

Execute privileged commands and access to security-relevant information via remote access only 3.1.

for functions or individuals authorized by the System Owner

AC-18 Wireless Access

The Chief Information Security Officer SHALL: 1.

Establish enterprise usage restrictions, configuration/connection requirements, and implementation 1.1.

guidance for wireless access

The System Owner SHALL: 2.

Authorize wireless access to the information system prior to allowing wireless connections in 2.1.

accordance with the enterprise standard

AC-18 (1) Authentication and Encryption

The System Owner SHALL: 1.

Ensure the information system protects wireless access to the system using FIPS 140-2 encryption 1.1.

and authentication of user’s FRTIB issued certificate

AC-19 Access Control for Mobile Devices

The Chief Information Security Officer SHALL: 1.

Establish enterprise usage restrictions, configuration requirements, connection requirements, and 1.1.

implementation guidance for organization-controlled mobile devices

The System Owner SHALL: 2.

Authorize the connection of mobile devices to organizational information systems in accordance 2.1.

with the enterprise standard

AC-19 (5) Full Device / Container-Based Encryption

The System Administrator SHALL: 1.

Employ entire device encryption (EDE) to protect the confidentiality and integrity of information 1.1.

on any device containing organizational information

AC-20 Use of External Communication Systems

The Chief Information Security Officer SHALL: 1.

Establish terms and conditions, consistent with any trust relationships established with other 1.1.

organizations owning, operating, and/or maintaining external information systems allowing authorized individuals to:

Access the information system from external information systems 1.1.1.

Process, store, or transmit organization-controlled information using external information 1.1.2.

systems

Ensure approved interconnections have an Interconnection Security Agreement 1.1.3.

The System Owner SHALL: 2.

Review and approve all information system interconnections to external systems 2.1.

AC-20 (1) Limits on Authorized Use

The System Owner SHALL: 1.

Permit authorized individuals to use an external information system to access the information 1.1.

system or to process, store, or transmit organization-controlled information AFTER:

Verifying the implementation of required security controls on the external system as 1.1.1.

specified in the organization’s information security standard and security plan are commensurate with the FIPS 199 Security Categorization of the system – AND –

Obtaining an approved Interconnection Security Agreement with the organizational entity 1.1.2.

requesting connection to their information system

AC-20 (2) Portable Storage Devices

The Chief Information Security Officer SHALL: 1.

Restrict the use of organization-controlled portable storage devices by authorized individuals on 1.1.

external information systems based on required functions

AC-21 Information Sharing

The System Owner SHALL: 1.

Facilitate information sharing by enabling authorized users to determine whether access 1.1.

authorizations assigned to the sharing partner match the access restrictions on the information for approved connections

The System Administrator SHALL: 2.

Employ automated mechanisms or manual processes to assist users in making information 2.1.

sharing/collaboration decisions

AC-22 Publicly Accessible Content

The System Owner SHALL: 1.

Designate individuals authorized to post information onto a publicly accessible information 1.1.

system

Ensure authorized individuals are trained to ensure that publicly accessible information does not 1.2.

contain nonpublic information

The SETA Program Manager SHALL: 2.

Identify required training for individuals authorized to post publicly accessible content 2.1.

The Business Owner SHALL: 3.

Review the proposed content of information prior to posting onto the publicly accessible 3.1.

information system to ensure that nonpublic information is not included

Review the content on the publicly accessible information system for nonpublic information 3.2.

periodically

The System Administrator SHALL: 4.

Remove inappropriate information, if discovered, as directed by the Business/System Owner 4.1.

3. SECURITY AWARENESS & TRAINING (AT)

AT security controls provide guidance when creating and implementing a security awareness training program.

AT controls address types of training, periodicity of training, parties responsible for the program and implementation, and training record retention requirements.

AT-1 Security Awareness and Training Policy and Procedures

The Chief Information Security Officer SHALL: 1.

Develop, document, and disseminate a security awareness and training standard that addresses 1.1.

purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance

Review the security awareness and training standard annually and update as necessary 1.2.

Develop, document, and disseminate procedures to facilitate the implementation of the security 1.3.

awareness and training standard for common controls

Review the security awareness and training procedures for common controls annually and update 1.4.

as necessary

The SETA Program Manager SHALL: 2.

Develop, document, and disseminate procedures to facilitate the implementation of the security 2.1.

awareness and training standard for system-specific controls

Review the security awareness and training procedures for system-specific controls annually and 2.2.

update as necessary

AT-2 Security Awareness Training

The Chief Information Security Officer SHALL: 1.

Determine the appropriate content of security awareness training materials based on the specific 1.1.

mission requirements of the Agency and the information systems

The SETA Program Manager SHALL: 2.

Develop and maintain a SETA Program 2.1.

Provide basic security awareness training to information system users (including managers, senior 2.2.

executives, and contractors):

As part of initial training for new users 2.2.1.

When required by information system changes 2.2.2.

Annually thereafter 2.2.3.

Notify the System Owner when users have expired training certificates 2.3.

Coordinate briefings in support of National Cyber Security Awareness month (October) 2.4.

Educate users about information security policies, standards, and procedures, and their 2.5.

responsibilities in safeguarding the Agency’s information resources

Ensure security awareness materials are posted or presented in a variety of formats on a regular 2.6.

basis to maintain user awareness of information security issues

Ensure Users are trained to understand the penalties for non-compliance with Agency security 2.7.

policies, standards, and procedures

Ensure Users are made aware of changes to Agency security policies, standards, or procedures 2.8.

relevant to the operation or use of the Information System

Focus security training on various types of threats, including, but not limited to: 2.9.

Social Engineering attacks (e.g., phishing email)

Inappropriate usage (e.g., browsing dangerous websites)

Malicious code attacks (e.g., executing malicious attachments or links embedded in unsolicited email)

“Insider threat”, etc.

The System Owner SHALL: 3.

Ensure all Information System Users complete Security Awareness Training: 3.1.

Prior to being granted Information System access 3.1.1.

Annually thereafter, in order to retain Information System access 3.1.2.

All Information System Users SHALL: 4.

Complete the approved Agency Security Awareness Training and acknowledge acceptance of the 4.1.

Agency Security Policies:

Before being granted access to any Agency information or information systems 4.1.1.

At least annually thereafter in order to Refresh their knowledge and awareness of: 4.1.2.

Current Agency policies, standards, and procedures

Information security best practices

Current and emerging threats

Confirm continuing acceptance of the conditions for Information System access

AT-2(2) Insider Threat

The SETA Program Manager SHALL: 1.

Provide System Owners with awareness training on recognizing and reporting potential indicators 1.1.

and possible precursors of insider threat including:

Behaviors such as attempts to gain access to information not required for job performance, 1.1.1.

unexplained access to financial resources, and violations of organizational policies, procedures, directives, rules, or practices

How employees and management communicate concerns regarding potential indicators of 1.1.2.

insider threat through appropriate organizational channels in accordance with established organizational policies and procedures

Collaborate behavior related awareness training with the Personnel Security Office 1.2.

AT-3 Role-Based Security Training

The SETA Program Manager SHALL: 1.

Identify the roles requiring role-based security training 1.1.

Facilitate collaboration for conducting role-based security training 1.2.

Document significant roles involving security responsibilities for common controls within the 1.3.

Enterprise Common Control Catalog

Continually develop and maintain a SETA Program designed to build relevant and needed security 1.4.

skills and competencies to facilitate security and risk management related job performance

Provide annual role-based security training to all personnel with significant roles involving 1.5.

information security

The System Owner SHALL: 2.

Identify personnel who have significant security roles and responsibilities 2.1.

Document significant roles involving security responsibilities in the System Security Plan, unless 2.2.

they are identified as a common control within the Enterprise Common Control Catalog

Verify role-based security training has been completed for personnel with assigned security roles 2.3.

and responsibilities:

Before authorizing access to the information system or performing assigned duties 2.3.1.

When required by information system changes 2.3.2.

Annually thereafter 2.3.3.

AT-4 Security Training Records

The SETA Program Manager SHALL: 1.

Collaborate with ORM/HR/TED for documenting, maintaining, and retaining training records 1.1.

Document and maintain individual security training records for a minimum of three years in the 1.2.

enterprise learning management system

The System Administrator SHALL: 2.

Verify security training has been completed prior to account creation or modification 2.1.

Use the security training record as the basis for account expiration, which shall be no later than 2.2.

one year following the last confirmed security training date

The System Owner SHALL: 3.

Ensure users have completed initial or annual security training prior to account creation or 3.1.

modification

Ensure users have completed system-specific training, if needed 3.2.

Retain system-specific training records for a minimum of three years 3.3.

4. AUDIT AND ACCOUNTABILITY (AU)

AU security controls provide guidance when creating and implementing an auditing program to identify and record security relevant system events and ensure accountability for those events. AU controls ensure the details of the event are accurate, protected, reviewed, and retained in accordance with record retention requirements.

AU-1 Audit and Accountability Policy and Procedures

The Chief Information Security Officer SHALL: 1.

Develop, document, and disseminate an audit and accountability standard that addresses purpose, 1.1.

scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance

Review the audit and accountability standard annually and update as necessary 1.2.

Develop, document, and disseminate procedures to facilitate the implementation of the audit and 1.3.

accountability standard for common controls

Review the audit and accountability procedures for common controls annually and update as 1.4.

necessary

The System Owner SHALL: 2.

Develop, document, and disseminate procedures to facilitate the implementation of the audit and 2.1.

accountability standard for system-specific controls

Review the audit and accountability procedures for system-specific controls annually and update 2.2.

as necessary

AU-2 Audit Events

The Chief Information Security Officer SHALL: 1.

Periodically review the list of FRTIB-defined auditable events and update as necessary 1.1.

The System Owner SHALL: 2.

Facilitate Collaboration on Audit Events with the Chief Information Security Officer 2.1.

Ensure the security audit function is coordinated with the network health and status monitoring 2.2.

function for monitored elements

Ensure FRTIB-defined auditable events are audited within the information system 2.3.

The Information System Security Officer SHALL: 3.

Maintain documentation (within the System Security Plan) that details which events are audited 3.1.

within the application, the format of event log entries, auditing frequency, and frequency of log reviews

Ensure System Owners define system-specific auditable events which are adequate to support 3.2.

Incident Response and post-incident investigations

Ensure, through the A&A process, that the following FRTIB-defined auditable events are audited 3.3.

within the information system as part of continuous monitoring auditing:

Exhibit 2- FRTIB-defined Auditable Events

Asset Type Monitored Element

Database / Server

(i) System events, including:

Server startup and shutdown

Loading and unloading of services

Installation and removal of software

(ii) System alerts and error messages, including:

Logins, successful and failed

Remote access attempts, successful and failed

Unauthorized attempts to access sensitive information and systems

Host based Intrusion Detection System (HIDS) alerts

(iii) System administration activities, including

Modifications of access controls

Account changes, including modifications of privileges

Asset Type Monitored Element

Modifications to system files

Application

Modifications to the application

Application alerts and error messages

User sign on and sign off

System administration activities

Accesses to sensitive information (including accesses to PII)

Modifications of privileges and access controls

Significant application-specific actions

Access/Change/Deletion of Participant Account, records (ex:

statements, notices), or transactions

Router, firewall, domain controller, or other major network device

Device startup and shutdown

Administrator logon and logoff

Configuration changes

Account creation, modification, or deletion

Modifications of privileges and access controls

System alerts and error messages

AU-2 (3) Reviews and Updates

The Chief Information Security Officer SHALL: 1.

Approve changes to the list of FRTIB Auditable events as changes are proposed 1.1.

The Information System Security Officer SHALL: 2.

Review the FRTIB List of Auditable events annually and initiate formal change requests to the 2.1.

Chief Information Security Officer as necessary

Review and update System Security Plans within 90 days based on approved changes of FRTIB 2.2.

Auditable Events

AU-3 Content of Audit Records

The System Owner SHALL: 1.

Ensure the information system generates audit records containing information that establishes 1.1.

what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event

AU-3 (1) Additional Audit Information

The System Owner SHALL: 1.

Ensure the information system generates audit records containing additional information or other 1.1.

security related events required for Incident Response

AU-4 Audit Storage Capacity

The System Owner SHALL: 1.

Ensure the information system allocates and maintains sufficient audit record storage capacity to 1.1.

provide audit retention in accordance with AU-11

Ensure storage capacity is dedicated, such that no other system processes can inadvertently 1.2.

consume the storage capacity

Ensure copies of the audit storage are maintained in a separate physical location from the 1.3.

information system that is being audited

AU-5 Response to Audit Processing Failures

The System Owner SHALL: 1.

Ensure that, in the event of an audit processing failure, the information system sends alerts to 1.1.

required security stakeholders including the:

Security Operations Center (via the enterprise SIEM system) 1.1.1.

System Administrator(s) 1.1.2.

Information System Security Officer 1.1.3.

Ensure that, in the event that the audit storage capacity is exceeded, the information system will: 1.2.

Generate a notification to the appropriate staff 1.2.1.

Overwrite the oldest audit records using a first in first out (FIFO) methodology 1.2.2.

AU-6 Audit Review, Analysis, and Reporting

The Chief Technology Officer, with support by the Chief Information Security Officer, SHALL: 1.

Notify security stakeholders upon indication of increased risk to Agency operations, assets, or 1.1.

individuals based on law enforcement information, intelligence information, or other credible sources

The Information System Security Officer SHALL: 2.

Regularly review/analyze Information System audit records for indications of inappropriate or 2.1.

unusual activity

Investigate suspicious activity or suspected violations 2.2.

Report findings to the System Owner, Chief Information Security Officer, and Security Operations 2.3.

Center if a security incident is detected

Take any other actions necessary to support audit review, analysis, and reporting as directed by the 2.4.

System Owner to ensure the information system is secure

The System Owner SHALL: 3.

Increase the level of audit monitoring and analysis activity within the information system 3.1.

whenever there is an indication of increased risk to Agency operations, Agency assets, or individuals

Upon identification 3.1.1.

Based on notification from the Chief Technology Officer, Chief Information Security 3.1.2.

Officer, or Security Operations Center

Ensure the information system employs automated mechanisms to alert security personnel (i.e., 3.2.

the Information System Security Officer, Security Operations Center, and the Chief Information

Security Officer) of inappropriate or unusual activities with security implications including but not limited to:

Unauthorized privilege escalations 3.2.1.

Unauthorized access 3.2.2.

Inappropriate Usage (See the Incident Response and Limited Personal Use Policies for 3.2.3.

prohibited activities)

Denial of Service attacks 3.2.4.

Malicious code detection 3.2.5.

AU-6 (1) Process Integration

The System Owner SHALL: 1.

Employ automated mechanisms to integrate audit review, analysis, and reporting processes to 1.1.

support organizational processes for investigation and response to suspicious activities

AU-6 (3) Correlate Audit Repositories

The Security Operations Center SHALL: 1.

Analyze and correlate audit records across different repositories to gain organization-wide 1.1.

situational awareness

Initiate corrective actions related to audit monitoring with the Chief Information Security Officer, 1.2.

and the System Owner where appropriate

AU-7 Audit Reduction and Report Generation

The System Owner SHALL: 1.

Ensure the information system provides an audit reduction and report generation capability 1.1.

natively or by feeding logs in to the SIEM system

Ensure audit reduction, review, and reporting tools support after-the-fact investigations of security 1.2.

incidents without altering original audit records

Ensure the information system provides the capability to automatically process audit records for 1.3.

events of interest, based upon selectable event criteria

AU-7 (1) Automatic Processing

The Deputy CTO for Infrastructure and Operations SHALL: 1.

Maintain an enterprise solution with the capability for automatic processing of audit records for 1.1.

events of interest based on required audit items in AU-2

AU-8 Time Stamps

The System Owner SHALL: 1.

Ensure the information system provides time stamps (including date and time) for use in audit 1.1.

record generation that are generated using internal system clocks and can be mapped to

Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT)

AU-8 (1) Synchronization with Authoritative Time Source

The System Administrator SHALL: 1.

Ensure system time is synched to the official US time, maintained by NIST at http://time.nist.gov, 1.1.

or one of the servers listed at: http://tf.nist.gov/tf-cgi/servers.cgi

Information Systems under their care synchronize internal clocks: 1.2.

At least once per day 1.2.1.

To the authoritative time source when the time difference is greater than 30 seconds 1.2.2.

AU-9 Protection of Audit Information

The System Owner SHALL: 1.

Ensure the information system protects audit information and audit tools from unauthorized 1.1.

access, modification, and deletion, including:

Audit records 1.1.1.

Audit settings 1.1.2.

Ensure audit reports, tools, and information are kept in a secure location and backed up daily 1.2.

AU-9 (4) Access by Subset of Privileged Users

The System Owner SHALL: 1.

Authorize access to management of audit functionality to a subset of privileged users, as needed to 1.1.

perform their official duties

AU-11 Audit Record Retention

The System Owner SHALL: 1.

Ensure the information system retains audit records for a minimum of two (2) years to provide 1.1.

support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirement

Ensure the retention and availability of financial and record-keeping audit records until OGC and 1.2.

the appropriate Business Owners determine that they are no longer needed for administrative, legal, audit, or other operational purposes

Ensure the retention and availability of audit records relative to active Freedom of Information Act 1.3.

(FOIA) requests, subpoenas, and law enforcement actions until OGC determines that they are no longer required

Ensure the retention and availability of audit records related to declared/known security incidents 1.4.

(including those used for legal action) for three (3) years or until OGC determines they are no longer needed for incident response or legal actions, whichever is longer

AU-12 Audit Generation

The System Owner SHALL: 1.

Ensure the information system provides audit record generation capability for the mandatory 1.1.

auditable events defined in AU-2 on servers, applications, routers, domain controllers, databases, firewalls, and other major network devices

Select which auditable events are to be audited by specific components of the information system 1.2.

http://time.nist.gov/ http://tf.nist.gov/tf-cgi/servers.cgi

Ensure the information system generates audit records for the events defined in AU-2 with the 1.3.

content defined in AU-3

AU-13 Monitoring for Information Disclosure

The Security Operations Center SHALL: 1.

Monitor open source information and/or information sites a part of continuous monitoring for 1.1.

evidence of unauthorized disclosure of organizational information bi-weekly

The Anti-Fraud Unit SHALL: 2.

Document requirements to monitor open source information and/or information sites within the 2.1.

Anti-Fraud policy

5. SECURITY ASSESSMENT AND AUTHORIZATION (CA)

CA security controls provide guidance when creating and implementing an assessment and authorization program to ensure information systems comply with agency security controls prior to Authority to Operate and continuously thereafter.

CA-1 Security Assessment and Authorization Policy and Procedures

The Chief Information Security Officer SHALL: 1.

Develop, document, and disseminate a security assessment and authorization standard that 1.1.

addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance

Review the security assessment and authorization standard annually and update as necessary 1.2.

Develop, document, and disseminate procedures to facilitate the implementation of the security 1.3.

assessment and authorization standard for common controls

Review the security assessment and authorization procedures for common controls annually and 1.4.

update as necessary

The System Owner SHALL: 2.

Develop, document, and disseminate procedures to facilitate the implementation of the security 2.1.

assessment and authorization standard for system-specific controls

Review the security assessment and authorization procedures for system-specific controls annually 2.2.

and update as necessary

CA-2 Security Assessments

The Chief Information Security Officer SHALL: 1.

Review and approve Security Control Assessment Plans 1.1.

The Information System Security Officer SHALL: 2.

Develop a security assessment plan that describes the scope of the assessment including: 2.1.

Security controls and control enhancements under assessment 2.1.1.

Assessment procedures to be used to determine security control effectiveness 2.1.2.

Analyses to be completed (i.e., PTA, PIA, e-Authentication Risk Assessment, etc.) 2.1.3.

Assessment environment, assessment team, and assessment roles and responsibilities 2.1.4.

Assessment of common controls (if they are in-scope) 2.1.5.

Ensure the information system is assessed throughout the SDLC: 2.2.

Prior to Authorization to assess the security controls in each Information System to 2.2.1.

determine the extent to which the controls are (i) implemented correctly, (ii) operating as intended, and (iii) producing the desired outcome with respect to meeting the security requirements for the system

As part of Continuous Monitoring to re-assess each Information System’s security posture 2.2.2.

in support of “Ongoing Authorization”

Whenever the information system undergoes significant changes, as determined by the System Owner, the Business Owner, an Independent Verification and Validation

(IV&V) audit, or Chief Information Security Officer

Continuously, for specially designated controls based on the volatility or criticality of the control, as part of a mature O&M monitoring practice

No less than annually, using a partial list of at least 1/3 (one third) of all Baseline Security 2.2.3.

Requirements. All controls MUST be assessed within a three year cycle to support

Information System re-Authorization, which occurs every three years unless this system is approved for ongoing authorization.

Ensure a Security Assessment Report (SAR) is produced and submitted to the System Owner, 2.3.

Chief Information Security Officer, and Authorizing Official

Recommend the system to be approved for ongoing authorization based on the SAR 2.4.

Provide a recommendation to the Authorizing Official to: 2.5.

Grant the initial ATO based on the initial SAR 2.5.1.

Renew / continue an existing ATO based on an Annual Assessment Report or updated SAR 2.5.2.

Deny or withdraw the ATO, based on unacceptable levels of residual risk as determined by 2.5.3.

the initial SAR, an updated SAR, or the Annual Assessment Report

CA-2 (1) Independent Assessors

The Chief Information Security Officer SHALL: 1.

Determine the appropriate level of assessor independence based on these minimum considerations: 1.1.

The Security Categorization of the Information System 1.1.1.

The ultimate risk to organizational operations, assets, and individuals, as determined by an 1.1.2.

initial Risk Assessment or Risk Analysis

Results of a formal Risk Analysis indicating that a given level of independence is sufficient 1.1.3.

to provide confidence that the assessment results produced are sound and can be used to make a credible, risk-based decision

CA-3 System Interconnections

The System Owner SHALL: 1.

Ensure NO interconnections to external networks or information systems are authorized without 1.1.

the use of an approved boundary protection device (e.g., a firewall or access gateway) which mediates and controls the connection in accordance with SC-7 and provides Information Flow enforcement in accordance with AC-4 both into and out of the FRTIB System Boundaries

Ensure connections from the Information System to systems outside of the FRTIB Authorization 1.2.

Boundary are authorized through the use of:

Memorandums of Understanding (MOU) containing 1.2.1.

Supersession information

Authority for MOU

Descriptions of all information systems to be connected

High-level…