Attachment_006_-_Incident_Response_Policy.pdf

Federal Retirement Thrift Investment Board Incident Response Policy Office of General Counsel Document Number OGC.160

Incident Response Policy

Federal Retirement Thrift Investment Board Effective Date: July 31, 2017

Federal Retirement Thrift Investment Board Incident Response Policy Office of General Counsel Document Number OGC.160

TABLE OF CONTENTS

1. Overview

2. Policy

3. Composition of the Incident Response Team

4. Discovery of an Incident (Cyber or Non-Cyber)

5. Containment

6. Categorization of Incident and Analysis

7. Reportable Events and Notification

8. Cyber Incident Recovery

9. Breach Remediation

10. Eradication and Prevention

11. Post-Incident Analysis

12. Table-Top Exercises

13. Annual Review

14. Definitions

15. Applicable Procedures

16. Revision History

17. Approval

1. Overview The Federal Employees’ Retirement System Act of 1986 (FERSA) authorized the Federal

Retirement Thrift Investment Board (FRTIB), an independent agency of the U.S. Executive Branch, to administer the Thrift Savings Plan (TSP), one of the three components of the Federal Employees’

Retirement System (FERS). The TSP is a defined contribution plan for U.S. Federal employees

(including those covered by FERS and the Civil Service Retirement System (CSRS)) and members of the uniformed services. FRTIB and TSP are collectively referred to as “the Agency.” The mission of FRTIB is to administer the TSP solely in the interest of the participants and beneficiaries.

For the purpose of this policy, the term “incident” is an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of FRTIB’s information or an FRTIB information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies with respect to

FRTIB’s information or an FRTIB information system.1 Incidents can occur either as cyber- or non-cyber incidents.2 For example, a misdirected mailing of a document containing PII would constitute an incident because the sender has lost control over the PII contained in the document.

The Incident Response Policy provides guidance to FRTIB on the investigation of an incident and establishes the actions that must be taken once members of the Core Incident Response Team are notified of a suspected or actual incident with the objective of protecting sensitive information, including the personally identifiable information (PII) of Plan participants, their beneficiaries, or

FRTIB employees. PII is any information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual, such as information relating to individual TSP participants and their beneficiaries or individual FRTIB employees or contractors.3

1 44 U.S.C. § 3552(b)(2).

2 See Appendix I for the definitions of the terms “cyber incident” and “non-cyber incident” 3 OMB Circular A-130, Managing Information as a Strategic Resource.

This document also sets forth FRTIB’s policy related to addressing suspected or actual incidents and defines the progression of declaring a breach and activation of an Incident Response Team, which shall oversee the evaluation of a suspected or actual incident and determine the course of action for response and mitigation.

2. Policy

FRTIB is committed to protecting the confidentiality, integrity, and availability of its electronic and physical information systems. The Incident Response Team shall act in accordance with this policy upon notification to the Core Members of the Incident Response Team that there is a suspected or actual loss of confidentiality, integrity, or availability to FRTIB’s information or to an FRTIB information system. The confirmed exposure of PII is considered to be both an incident and a breach under this policy, because the exposure results in a loss of control of the information.

3. Composition of the Incident Response Team

a. Core Members of the Incident Response Team

The Core Members of the Incident Response Team (IRT) shall be led by the SAOP and shall include FRTIB’s:

• Deputy Chief Technology Officer (Deputy CTO);

• Chief Information Security Officer (CISO);

• Chief Privacy Officer (CPO); and

• Deputy Chief Risk Officer (Deputy CRO).

The Core Members of the IRT is designed to be a working team that has the flexibility and focus to meet as soon as is practicable after being notified about a potential incident.

b. Members of the Full Incident Response Team

The FRTIB’s Full IRT shall be led by the Core Members of the IRT and shall also include the following permanent members (or their designees):

• Chief Operating Officer (COO);

• Chief Risk Officer;

• Chief Technology Officer;

• General Counsel;

• Director of External Affairs;

• A representative from the office in which the incident occurred; and

• Additional ad hoc members, as necessary.

4. Discovery of an Incident (Cyber or Non-Cyber)

FRTIB employees and contractors are responsible for safeguarding all PII that is in FRTIB’s possession, and must immediately report potential or actual incidents involving PII to the Core

Members of the IRT by emailing IncidentResponse@tsp.gov.

a. Reporting of Potential or Actual Incidents

Discovery of a potential or actual incident is critical to successful compliance with the

Incident Response Policy. All FRTIB employees and contractors shall immediately report any potential or actual incidents by emailing IncidentResponse@tsp.gov as soon as they become aware that an incident may have occurred. FRTIB employees and contractors shall not delay reporting to investigate the cause of the incident or to determine whether an incident actually occurred. This applies to both cyber incidents and non-cyber incidents.

Individuals reporting a potential incident should not further compromise PII by including the potentially compromised PII in the notification. The Core Members of the Incident Response

Team shall promptly investigate whether further action must be taken upon notification of a potential incident

b. Notification of a Potential or Actual Incident

Upon notification of a potential or actual incident through IncidentResponse@tsp.gov, or through other means, upon instruction by the SAOP, the Core Members of the IRT shall examine the relevant facts and circumstances of any potential incidents to determine whether there has been an actual loss of confidentiality, integrity, or availability to FRTIB’s mailto:IncidentResponse@tsp.gov mailto:IncidentResponse@tsp.gov mailto:IncidentResponse@tsp.gov information or to an FRTIB information system. This process must be done within a reasonable period of time, and the Core Members of the IRT should be mindful that any delay in reporting (e.g., to the United States Computer Emergency Readiness Team (US-

CERT) in the event of a cyber incident) may result in a high risk to the Agency’s information or information systems. The Core Members of the IRT, for cyber-related events, may be guided by advice from the Security Operations Center (SOC) in making their determination.

Upon the determination that an actual incident has occurred, the Core Members of the IRT must clearly document whether PII has been exposed or compromised as a result of the incident. Any actual incident involving PII is considered to be a breach for the purposes of this policy. The Core Members of the IRT shall notify the Executive Director about High -or Moderate-risk incidents immediately following their determination.4

5. Containment

For cyber incidents, once the CISO determines that an incident has actually occurred, the incident must be promptly contained. The CISO shall lead the coordination efforts to ensure the incident is properly contained. In containing a cyber incident, the CISO shall work with the SOC, or the source of where the potential incident has occurred, to ensure that the incident is contained and that no remaining active exploitation exists. The CISO shall regularly update the Core Members of the IRT about containment efforts, including any difficulties encountered in containing the exploitation and confirmation that the incident and any remaining vulnerabilities have been fully contained.

6. Categorization of Incident and Analysis

Incidents will be classified as Low, Moderate, or High risk. For cyber incidents, in the process of containing an incident (or immediately thereafter), the CISO must assess the risk level the incident presents and categorize it as either Low, Moderate, or High risk based on National Institute for

Standards and Technology (NIST) Special Publication 800-61 Rev. 2, Computer Security Incident

Handling Guide. If a cyber incident involves any PII or otherwise affects privacy, the SAOP will be

4 The terms “high-risk” and “moderate-risk” are defined in Section 6, infra.

given the opportunity to review the relevant facts and circumstances so that he or she can provide additional input on the appropriate risk classification of the incident. The SAOP will determine the privacy risk of an incident based on various factors outlined in the Agency’s Incident Response

Procedures. For non-cyber incidents, the Chief Privacy Officer will categorize the risk level and provide a recommendation to the SAOP for his or her concurrence. The categorization of risk level shall be used to determine the appropriate response to an incident. The categorization (i.e., Low, Moderate, or High) may change as additional facts develop during the incident handling process.

a. High- to Moderate-Risk Incidents – Upon a determination by the Core Members of the

IRT of an actual incident with a High- to Moderate-risk level, the Core Members of the

IRT shall immediately convene the Full IRT, and shall simultaneously notify the Executive

Director. The Executive Director shall consult with the Full IRT to determine the appropriate path for mitigating harm to affected individuals resulting from the High- or

Moderate-risk incident.

b. Low-Risk Incidents – Upon a determination by the Core Members of the IRT of an actual incident with a Low-risk level, the Core Members of the IRT shall determine the extent of the necessary mitigation efforts, taking into consideration the likelihood and degree of harm that affected individuals have incurred as a result of the incident. The Core Members of the IRT may consult with the Full IRT in making such determination.

7. Reportable Events and Notification

Depending on the nature and severity of an incident, notifications to external entities may be appropriate or required. The appropriate response to an incident involving PII (i.e., breach) may also include notifying affected individuals and third parties, depending on the circumstances of the breach and its categorization of risk level.

a. Notifying US-CERT – The CISO or his or her designee shall notify US-CERT no later than one hour after a potential or actual incident is identified by the CISO or his or her designee. See 44 U.S.C. § 3544(b) (7); see also Revised DHS US-CERT Federal

Incident Notification Guidelines. This requirement applies to all potential or actual incidents, regardless of their categorization of risk level. The CISO shall provide confirmation to the Core Members of the IRT that US-CERT has been notified in a timely manner.

i. Cyber Incidents – The term “Cyber Incidents” includes, but is not limited to the following type of incidents, any of which may implicate PII, depending on the circumstances, and any of which may involve an insider threat:

• Actions that could, or have affected the confidentiality, integrity, or availability of FRTIB’s information or information systems, regardless of whether the actions were undertaken maliciously, non-maliciously, or inadvertently.

• Loss, theft, or destruction of FRTIB hardware or assets, including, but not limited to mobile devices; laptops; FRTIB-approved thumb drives; and any other asset upon which information could reasonably be expected to be stored.

ii. Any Other Non-Cyber Incidents – In accordance with OMB M-15-01, Fiscal

Year 2014-2015 Guidance on Improving Federal Information Security and Privacy

Management Practices, the Agency shall not report non-cyber incidents to US-

CERT. However, depending on the relevant facts and circumstances, the Agency may still need to notify affected third parties, particularly if the incident involves

PII.

iii. Major Incidents – Pursuant to the FISMA Modernization Act of 2014, the Agency shall notify Congress within 7 days of the date after which the Agency has a reasonable basis to conclude that a “major incident” has occurred. For the purposes of this policy, the term “major incident” shall have the meaning contained in OMB

Memorandum M-17-05, Fiscal Year 2016-2017 Guidance on Federal Information

Security and Privacy Management Requirements. While OMB’s guidance concerning “major incidents” is instructive, it is ultimately the responsibility of the

FRTIB to determine whether an incident constitutes a “major incident.” The Core

Members of the Incident Response Team shall immediately activate the Full IRT and shall also notify the Executive Director of any “major incidents” as soon as the

Core Members of the IRT suspect that a “major incident” may have occurred.

b. Notifying Affected Individuals – For Moderate- to High-Risk incidents (including both cyber and non-cyber incidents) involving PII, the SAOP will make a recommendation to the Executive Director, who will determine whether to notify affected individuals. For

Low-Risk incidents, the SAOP will make this determination. See generally OMB

Memorandum M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information.

c. Notifying Third Parties – Depending on the nature, scope, and risks posed by an incident, the SAOP, in consultation with the Director of External Affairs, may determine that it is necessary to notify third parties, such as the media, Members of Congress, and other external organizations, that an incident has occurred. If the SAOP determines such a notification is necessary, he or she will make this recommendation to the Executive

Director who will make a final determination.

8. Cyber Incident Recovery

The CISO shall lead and coordinate efforts to recover from a cyber incident, ensuring that systems are restored following a cyber incident. Recovery measures should be used in addition to the Agency’s containment efforts.

9. Breach Remediation

Remediation entails neutralizing a breach and curing the harms caused by it. Remediation methods should be used in addition to the Agency’s containment efforts. The SAOP will determine which actions are necessary to remediate the PII-related consequences of a breach. For High- to Moderate-risk incidents, the Executive Director should consider activating the Agency’s contractor-provided breach response and remediation services.

10. Eradication and Prevention

Ensuring eradication of previous incidents and prevention of new incidents is a critical step in the incident response process—this step requires a macro-level, proactive approach. This step entails making changes to mitigate the risk of recurrence of existing vulnerabilities, and preventing additional vulnerabilities from occurring. Depending on the severity and nature of the incident, the

Deputy CTO, CISO, SAOP, CPO, Deputy CRO, and/or SOC and Full IRT, where necessary, should determine what systemic changes must be made to improve FRTIB’s procedures, process, and security posture to prevent future incidents from occurring.

11. Post-Incident Analysis

After Action reports shall be completed for all Moderate- and High-Risk Incidents. For cyber incidents, the SOC is responsible for completing After Action reports which will be reviewed and modified as necessary by the CISO, with input from the SAOP or CPO when privacy issues are implicated. The SAOP is responsible for completing After Action reports for non-cyber incidents.

After Action reports will document the details of the incident and steps taken to remediate the gaps that caused the incident to occur. Further, this report shall be approved by the Executive Director and retained in a risk events repository, maintained by OERM. The Agency’s Internal Controls

Division (ICD) within OERM shall be provided with a copy of this report and shall be responsible for tracking progress made by the Agency to remediate any gaps noted. The status of all incidents for which remediation efforts are in-process will be presented by the ICD to the Executive

Leadership Council (ELC) on a schedule deemed appropriate by the ED, upon consultation with the

Full IRT, where necessary.

After Action reports will not be completed for Low Risk incidents. Actions taken to address Low-

Risk cyber incidents will be documented by the Information Assurance Division (IAD). Actions taken to address Low-Risk non-cyber incidents will be documented by the Privacy Office.

12. Table-Top Exercises

The SAOP and CISO shall jointly ensure the Core Members of the IRT and the Full IRT and their designees, where appropriate, undergo an annual table-top exercise. The table-top exercise shall consist of a structured readiness-testing activity that simulates an emergency situation (e.g., a data breach). This exercise is designed to familiarize key stakeholders, decision-makers, and their alternates with the Incident Response Policy and Procedures and to prepare these individuals for an actual emergency situation.

13. Annual Review

OGC with input from the other Core Members of the IRT will review this policy on an annual basis and determine whether changes are needed to maintain its effectiveness. OERM will notify the Full

IRT of the outcome of their annual review, and provide any necessary updates to the policy.

14. Definitions

Availability – Ensuring timely and reliable access to and use of information. 44 U.S.C.

§ 3552(b)(3)(C).

Breach – An incident (either cyber or non-cyber) involving PII. See also OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (defining breach as

“The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.”).

Compromise – See Breach.

Confidentiality – Preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information. 44 U.S.C. § 3552(b)(3)(B).

Confirmed Loss – Exposure that results in an actual disclosure or loss of information to unauthorized persons or entities, either logically or physically.

Cyber Event – Any observable occurrence in an information system and/or network. Cyber Events sometimes provide indication that an incident is occurring.

Cyber Incident – Actions taken through the use of computer networks that result in an actual or potentially adverse effect on an information system and/or the information residing therein. See Incident; see also

CNSSI No. 4009.

Harm – For the purposes of this document, harm means any adverse effects that would be experienced by an individual or organization (e.g., that may be socially, physically, or financially damaging) whose information was compromised, as well as any adverse effects experienced by the organization that maintains the information.

Incident – An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of FRTIB’s information or an FRTIB information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies with respect to FRTIB’s information or an FRTIB information system. 44

U.S.C. § 3552(b)(2).

Integrity – Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity. 44 U.S.C. § 3552(b)(3)(A).

Information System – Pursuant to the E-Government Act of 2002, the term “information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. See 44 U.S.C. § 3502(8).

Information System Security Officer (ISSO) – The official responsible for maintaining the appropriate operational security posture for an information system or program. See National Institute of

Standards and Technology Interagency Report NISTIR-7298 Rev 2, Glossary of Key Information

Security Terms (May 2013).

Information Technology – Any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching interchange, transmission, or reception of data or information, including equipment used by contractors.

See 40 U.S.C. § 11101(6).

Non-Cyber Incident – A paper-based or verbal occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information. 44 U.S.C. §

3552(b)(2); see also OMB Memorandum M-15-01, Fiscal Year 2014-2015 Guidance on Improving

Federal Information Security and Privacy Management Practices.

Personally Identifiable Information (PII) – Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. See OMB Circular A-130, Managing Information as a Strategic Resource.

Potential Loss – Potential disclosure or loss of information to unauthorized persons or entities logically or physically and its perceived impact to the organization.

Reportable Event – Potential or actual cyber incidents must be reported to the United States Computer

Emergency Readiness Team (US-CERT). See Revised DHS US-CERT Federal Incident Notification

Guidelines.

Security Event – For the purposes of this policy, the term “security event” is synonymous with the term

“cyber event.”

Security Incident – For the purposes of this policy, the term “security incident” is synonymous with the term “cyber incident.”

Sensitive PII (SPII) – PII which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. For the purposes of this

Policy, SPII and PII are treated the same.

15. Applicable Procedures

• Incident Response Procedures

16. Revision History

Date Version Author Comments (briefly summarize change)

1/1/2014 0 Jay Ahuja Initial Version

6/4/2015 1 Marla Greenberg Updated to reflect new OMB guidance

7/7/2017 2 Sarah Smith Updated to reflect FRTIB’s Incident Response Procedures

17. Approval

Name: ______________________________________

Megan Grumbine

Title: General Counsel, FRTIB

Name: ______________________________________

Ravindra Deo

Title: Acting Executive Director