Attachment_14_-_System_Security_Control_Baselines.docx

116 KB Posted

Attached to
Order Management System Retail Sales End to End Solution
Solicitation number
USM-HQ-13-0018
Issued by

About this file

From the source

Attachment 14 - System Security Control Baselines

View the file

Other files

File Type Posted
Amendment_009_USM-HQ-13-0018.pdf PDF
Amendment_008_USM-HQ-13-0018.pdf PDF
Amendment_007_USM-HQ-13-0018.pdf PDF
Amendment_006_USM-HQ-13-0018.pdf PDF
Amendment_005_USM-HQ-13-0018.pdf PDF
Public_Laws.Regulations_and_Policies_Attachment.docx DOCX document
USM_Interval_Report_June_2012.xlsx XLSX spreadsheet
Amendment_004_USM-HQ-13-0018.pdf PDF
Amendment_003_USM-HQ-13-0018.pdf PDF
Amendment_002_USM-HQ-13-0018.pdf PDF
Attachment_9_Contractor_Performance_Questionairre.docx DOCX document
Attachment_G-9_IPP_Waiver.docx DOCX document
Appendix_D_USM_Internal_and_External_Systems_Interface_Descriptions.xlsx XLSX spreadsheet
Attachment_9_Contractor_Performance_Questionairre.docx DOCX document
Appendix_C_Go-Live_and_Full_Operational_Capability_(FOC)_Definitions.docx DOCX document
Attachment_5_Operational_Cost_Scenario_Template.xlsx XLSX spreadsheet
Attachment_1__SOO.docx DOCX document
Attachment_2_USM_Historical_Data.docx DOCX document
Attachment_12_Security_Manual_TD_P_15-71.pdf PDF
Attachment_4_Pricing_Template.xls XLS spreadsheet
Attachment_13_-_HSPD-12.docx DOCX document
Attachment_7_Overall_Factor_and_Sub-Factor_Weighting.pptx PPTX presentation
Attachment_C-1_EIT_Accessibility.pdf PDF
Attachment_H-1_Rules_Of_Behavior_for_United_States_Mint_IT_Systems_Users.pdf PDF
Appendix_A_Functional_and_Business_Requirements.xlsx XLSX spreadsheet
Attachment_G-3_Contractor_Travel_Voucher.pdf PDF
Attachment_10_Contract_Release-_Form_7510.doc DOC document
Appendix_B_Deliverables_and_Content_Requirements.docx DOCX document
Attachment_11_Sample_Labor_Categories_and_Descriptions.doc DOC document
Attachment_3_Legacy_Data_Model.docx DOCX document
RFP_USM-HQ-13-0018.docx DOCX document
Attachment_8_Management_and_Technical__Section_L_ _M.pptx PPTX presentation
Show all 32

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

TABLE D-2: SECURITY CONTROL BASELINES

CNTL NO.

CONTROL NAME

PRIORITY

CONTROL BASELINES

LOW
MOD
HIGH
Meets/ Does Not Meet/ Partially Meets
Explanation

Access Control

AC-1
Access Control Policy and Procedures
P1
AC-1
AC-1
AC-1
AC-2
Account Management
P1
AC-2
AC-2 (1) (2) (3) (4)
AC-2 (1) (2) (3) (4)
AC-3
Access Enforcement
P1
AC-3
AC-3
AC-3
AC-4
Information Flow Enforcement
P1
Not Selected
AC-4
AC-4
AC-5
Separation of Duties
P1
Not Selected
AC-5
AC-5
AC-6
Least Privilege
P1
Not Selected
AC-6 (1) (2)
AC-6 (1) (2)
AC-7
Unsuccessful Login Attempts
P2
AC-7
AC-7
AC-7
AC-8
System Use Notification
P1
AC-8
AC-8
AC-8
AC-9
Previous Logon (Access) Notification
P0
Not Selected
Not Selected
Not Selected
AC-10
Concurrent Session Control
P2
Not Selected
Not Selected
AC-10
AC-11
Session Lock
P3
Not Selected
AC-11
AC-11
AC-12
Session Termination (Withdrawn)
---
---
---
---
AC-13
Supervision and Review—Access Control

(Withdrawn)

---
---
---
---
AC-14
Permitted Actions without Identification or

Authentication

P1
AC-14
AC-14 (1)
AC-14 (1)
AC-15
Automated Marking (Withdrawn)
---
---
---
---
AC-16
Security Attributes
P0
Not Selected
Not Selected
Not Selected
AC-17
Remote Access
P1
AC-17
AC-17 (1) (2) (3) (4) (5) (7) (8)
AC-17 (1) (2) (3) (4) (5) (7) (8)
AC-18
Wireless Access
P1
AC-18
AC-18 (1)
AC-18 (1) (2) (4) (5)
AC-19
Access Control for Mobile Devices
P1
AC-19
AC-19 (1) (2) (3)
AC-19 (1) (2) (3)
AC-20
Use of External Information Systems
P1
AC-20
AC-20 (1) (2)
AC-20 (1) (2)
LOW
MOD
HIGH
Meets/ Does Not Meet/ Partially Meets
Explanation

Awareness and Training

AT-1
Security Awareness and Training Policy and

Procedures

P1
AT-1
AT-1
AT-1
AT-2
Security Awareness
P1
AT-2
AT-2
AT-2
AT-3
Security Training
P1
AT-3
AT-3
AT-3
AT-4
Security Training Records
P3
AT-4
AT-4
AT-4
AT-5
Contacts with Security Groups and

Associations

P0
Not Selected
Not Selected
Not Selected

Audit and Accountability

AU-1
Audit and Accountability Policy and

Procedures

P1
AU-1
AU-1
AU-1
AU-2
Auditable Events
P1
AU-2
AU-2 (3) (4)
AU-2 (3) (4)
AU-3
Content of Audit Records
P1
AU-3
AU-3 (1)
AU-3 (1) (2)
AU-4
Audit Storage Capacity
P1
AU-4
AU-4
AU-4
AU-5
Response to Audit Processing Failures
P1
AU-5
AU-5
AU-5 (1) (2)
AU-6
Audit Review, Analysis, and Reporting
P1
AU-6
AU-6
AU-6 (1)
AU-7
Audit Reduction and Report Generation
P2
Not Selected
AU-7 (1)
AU-7 (1)
AU-8
Time Stamps
P1
AU-8
AU-8 (1)
AU-8 (1)
AU-9
Protection of Audit Information
P1
AU-9
AU-9
AU-9
AU-10
Non-repudiation
P1
Not Selected
Not Selected
AU-10
AU-11
Audit Record Retention
P3
AU-11
AU-11
AU-11
AU-12
Audit Generation
P1
AU-12
AU-12
AU-12 (1)
AU-13
Monitoring for Information Disclosure
P0
Not Selected
Not Selected
Not Selected
AU-14
Session Audit
P0
Not Selected
Not Selected
Not Selected

APPENDIX 14: System Security Control Baselines

Special Publication 800-53 Recommended Security Controls for Federal Information Systems and Organizations

LOW

MOD

HIGH

Meets/ Does Not Meet/ Partially Meets

Explanation

Security Assessment

CA-1
Security Assessment and Authorization

Policies and Procedures

P1
CA-1
CA-1
CA-1
CA-1
Security Assessment and Authorization

Policies and Procedures

CA-2
Security Assessments
P2
CA-2
CA-2 (1)
CA-2 (1) (2)
CA-2
Security Assessments
CA-3
Information System Connections
P1
CA-3
CA-3
CA-3
CA-3
Information System Connections
CA-4
Security Certification (Withdrawn)
---
---
---
---
CA-4
Security Certification (Withdrawn)
CA-5
Plan of Action and Milestones
P3
CA-5
CA-5
CA-5
CA-5
Plan of Action and Milestones
CA-6
Security Authorization
P3
CA-6
CA-6
CA-6
CA-6
Security Authorization
CA-7
Continuous Monitoring
P3
CA-7
CA-7
CA-7
CA-7
Continuous Monitoring

Configuration Management

CM-1
Configuration Management Policy and

Procedures

P1
CM-1
CM-1
CM-1
CM-2
Baseline Configuration
P1
CM-2
CM-2 (1) (3) (4)
CM-2 (1) (2) (3) (5) (6)
CM-3
Configuration Change Control
P1
Not Selected
CM-3 (2)
CM-3 (1) (2)
CM-4
Configuration Change Control
P1
Not Selected
CM-3 (2)
CM-3 (1) (2)
CM-5
Configuration Change Control
P1
Not Selected
CM-3 (2)
CM-3 (1) (2)
CM-6
Configuration Settings
P1
CM-6
CM-6 (3)
CM-6 (1) (2) (3)
CM-7
Least Functionality
P1
CM-7
CM-7 (1)
CM-7 (1) (2)
CM-8
Information System Component Inventory
P1
CM-8
CM-8 (1) (5)
CM-8 (1) (2) (3) (4) (5)
CM-9
Configuration Management Plan
P1
Not Selected
CM-9
CM-9

Contingency Planning

CP-1
Contingency Planning Policy and

Procedures

P1
CP-1
CP-1
CP-1
CP-2
Contingency Plan
P1
CP-2
CP-2 (1)
CP-2 (1) (2) (3)
CP-3
Contingency Training
P2
CP-3
CP-3
CP-3 (1)
CP-4
Contingency Plan Testing and Exercises
P2
CP-4
CP-4 (1)
CP-4 (1) (2) (4)
CP-5
Contingency Plan Update (Withdrawn)
---
---
---
---
CP-6
Alternate Storage Site
P1
Not Selected
CP-6 (1) (3)
CP-6 (1) (2) (3)
CP-7
Alternate Processing Site
P1
Not Selected
CP-7 (1) (2) (3) (5)
CP-7 (1) (2) (3) (4) (5)

HIGH

Meets/ Does Not Meet/ Partially Meets

Explanation

CP-8
Telecommunications Services
P1
Not Selected
CP-8 (1) (2)
CP-8 (1) (2) (3) (4)
CP-9
Information System Backup
P1
CP-9
CP-9 (1)
CP-9 (1) (2) (3)
CP-10
Information System Recovery and

Reconstitution

P1
CP-10
CP-10 (2) (3)
CP-10 (2) (3) (4)

Identification and Authentication

IA-1
Identification and Authentication Policy and

Procedures

P1
IA-1
IA-1
IA-1
IA-2
Identification and Authentication

(Organizational Users)

P1
IA-2 (1)
IA-2 (1) (2) (3) (8)
IA-2 (1) (2) (3) (4) (8) (9)
IA-3
Device Identification and Authentication
P1
Not Selected
IA-3
IA-3
IA-4
Identifier Management
P1
IA-4
IA-4
IA-4
IA-5
Authenticator Management
P1
IA-5 (1)
IA-5 (1) (2) (3)
IA-5 (1) (2) (3)
IA-6
Authenticator Feedback
P1
IA-6
IA-6
IA-6
IA-7
Cryptographic Module Authentication
P1
IA-7
IA-7
IA-7
IA-8
Identification and Authentication (Non- Organizational Users)
P1
IA-8
IA-8
IA-8

Incident Response

IR-1
Incident Response Policy and Procedures
P1
IR-1
IR-1
IR-1
IR-2
Incident Response Training
P2
IR-2
IR-2
IR-2 (1) (2)
IR-3
Incident Response Testing and Exercises
P2
Not Selected
IR-3
IR-3 (1)
IR-4
Incident Handling
P1
IR-4
IR-4 (1)
IR-4 (1)
IR-5
Incident Monitoring
P1
IR-5
IR-5
IR-5 (1)
IR-6
Incident Reporting
P1
IR-6
IR-6 (1)
IR-6 (1)
IR-7
Incident Response Assistance
P3
IR-7
IR-7 (1)
IR-7 (1)
IR-8
Incident Response Plan
P1
IR-8
IR-8
IR-8

Maintenance

HIGH

Meets/ Does Not Meet/ Partially Meets

Explanation

MA-1
System Maintenance Policy and Procedures
P1
MA-1
MA-1
MA-1
MA-2
Controlled Maintenance
P2
MA-2
MA-2 (1)
MA-2 (1) (2)
MA-3
Maintenance Tools
P2
Not Selected
MA-3 (1) (2)
MA-3 (1) (2) (3)
MA-4
Non-Local Maintenance
P1
MA-4
MA-4 (1) (2)
MA-4 (1) (2) (3)
MA-5
Maintenance Personnel
P1
MA-5
MA-5
MA-5
MA-6
Timely Maintenance
P1
Not Selected
MA-6
MA-6

Media Protection

MP-1
Media Protection Policy and Procedures
P1
MP-1
MP-1
MP-1
MP-2
Media Access
P1
MP-2
MP-2 (1)
MP-2 (1)
MP-3
Media Marking
P1
Not Selected
MP-3
MP-3
MP-4
Media Storage
P1
Not Selected
MP-4
MP-4
MP-5
Media Transport
P1
Not Selected
MP-5 (2) (4)
MP-5 (2) (3) (4)
MP-6
Media Sanitization
P1
MP-6
MP-6
MP-6 (1) (2) (3)

Physical and Environmental Protection

PE-1
Physical and Environmental Protection

Policy and Procedures

P1
PE-1
PE-1
PE-1
PE-2
Physical Access Authorizations
P1
PE-2
PE-2
PE-2
PE-3
Physical Access Control
P1
PE-3
PE-3
PE-3 (1)

HIGH

Meets/ Does Not Meet/ Partially Meets

Explanation

PE-4
Access Control for Transmission Medium
P1
Not Selected
PE-4
PE-4
PE-5
Access Control for Output Devices
P1
Not Selected
PE-5
PE-5
PE-6
Monitoring Physical Access
P1
PE-6
PE-6 (1)
PE-6 (1) (2)
PE-7
Visitor Control
P1
PE-7
PE-7 (1)
PE-7 (1)
PE-8
Access Records
P3
PE-8
PE-8
PE-8 (1) (2)
PE-9
Power Equipment and Power Cabling
P1
Not Selected
PE-9
PE-9
PE-10
Emergency Shutoff
P1
Not Selected
PE-10
PE-10
PE-11
Emergency Power
P1
Not Selected
PE-11
PE-11 (1)
PE-12
Emergency Lighting
P1
PE-12
PE-12
PE-12
PE-13
Fire Protection
P1
PE-13
PE-13 (1) (2) (3)
PE-13 (1) (2) (3)
PE-14
Temperature and Humidity Controls
P1
PE-14
PE-14
PE-14
PE-15
Water Damage Protection
P1
PE-15
PE-15
PE-15 (1)
PE-16
Delivery and Removal
P1
PE-16
PE-16
PE-16
PE-17
Alternate Work Site
P1
Not Selected
PE-17
PE-17
PE-18
Location of Information System Components
P2
Not Selected
PE-18
PE-18 (1)
PE-19
Information Leakage
P0
Not Selected
Not Selected
Not Selected

Planning

PL-1
Security Planning Policy and Procedures
P1
PL-1
PL-1
PL-1
PL-2
System Security Plan
P1
PL-2
PL-2
PL-2
PL-3
System Security Plan Update (Withdrawn)
---
---
---
---
PL-4
Rules of Behavior
P1
PL-4
PL-4
PL-4
PL-5
Privacy Impact Assessment
P1
PL-5
PL-5
PL-5
PL-6
Security-Related Activity Planning
P3
Not Selected
PL-6
PL-6

Personnel Security

HIGH

Meets/ Does Not Meet/ Partially Meets

Explanation

PS-1
Personnel Security Policy and Procedures
P1
PS-1
PS-1
PS-1
PS-2
Position Categorization
P1
PS-2
PS-2
PS-2
PS-3
Personnel Screening
P1
PS-3
PS-3
PS-3
PS-4
Personnel Termination
P2
PS-4
PS-4
PS-4
PS-5
Personnel Transfer
P2
PS-5
PS-5
PS-5
PS-6
Access Agreements
P3
PS-6
PS-6
PS-6
PS-7
Third-Party Personnel Security
P1
PS-7
PS-7
PS-7
PS-8
Personnel Sanctions
P3
PS-8
PS-8
PS-8

Risk Assessment

RA-1
Risk Assessment Policy and Procedures
P1
RA-1
RA-1
RA-1
RA-2
Security Categorization
P1
RA-2
RA-2
RA-2
RA-3
Risk Assessment
P1
RA-3
RA-3
RA-3
RA-4
Risk Assessment Update (Withdrawn)
---
---
---
---
RA-5
Vulnerability Scanning
P1
RA-5
RA-5 (1)
RA-5 (1) (2) (3) (4) (5) (7)

System and Services Acquisition

SA-1
System and Services Acquisition Policy and

Procedures

P1
SA-1
SA-1
SA-1
SA-2
Allocation of Resources
P1
SA-2
SA-2
SA-2

HIGH

Meets/ Does Not Meet/ Partially Meets
Explanation
SA-3
Life Cycle Support
P1
SA-3
SA-3
SA-3
SA-4
Acquisitions
P1
SA-4
SA-4 (1) (4)
SA-4 (1) (2) (4)
SA-5
Information System Documentation
P2
SA-5
SA-5 (1) (3)
SA-5 (1) (2) (3)
SA-6
Software Usage Restrictions
P1
SA-6
SA-6
SA-6
SA-7
User-Installed Software
P1
SA-7
SA-7
SA-7
SA-8
Security Engineering Principles
P1
Not Selected
SA-8
SA-8
SA-9
External Information System Services
P1
SA-9
SA-9
SA-9
SA-10
Developer Configuration Management
P1
Not Selected
SA-10
SA-10
SA-11
Developer Security Testing
P2
Not Selected
SA-11
SA-11
SA-12
Supply Chain Protection
P1
Not Selected
Not Selected
SA-12
SA-13
Trustworthiness
P1
Not Selected
Not Selected
SA-13
SA-14
Critical Information System Components
P0
Not Selected
Not Selected
Not Selected

System and Communications Protection

SC-1
System and Communications Protection

Policy and Procedures

P1
SC-1
SC-1
SC-1
SC-2
Application Partitioning
P1
Not Selected
SC-2
SC-2
SC-3
Security Function Isolation
P1
Not Selected
Not Selected
SC-3
SC-4
Information in Shared Resources
P1
Not Selected
SC-4
SC-4
SC-5
Denial of Service Protection
P1
SC-5
SC-5
SC-5
SC-6
Resource Priority
P0
Not Selected
Not Selected
Not Selected
SC-7
Boundary Protection
P1
SC-7
SC-7 (1) (2) (3) (4) (5) (7)
SC-7 (1) (2) (3) (4) (5) (6) (7) (8)
SC-8
Transmission Integrity
P1
Not Selected
SC-8 (1)
SC-8 (1)
SC-9
Transmission Confidentiality
P1
Not Selected
SC-9 (1)
SC-9 (1)
SC-10
Network Disconnect
P2
Not Selected
SC-10
SC-10

HIGH

Meets/ Does Not Meet/ Partially Meets

Explanation

SC-12
Cryptographic Key Establishment and

Management

P1
SC-12
SC-12
SC-12 (1)
SC-13
Use of Cryptography
P1
SC-13
SC-13
SC-13
SC-14
Public Access Protections
P1
SC-14
SC-14
SC-14
SC-15
Collaborative Computing Devices
P1
SC-15
SC-15
SC-15
SC-16
Transmission of Security Attributes
P0
Not Selected
Not Selected
Not Selected
SC-17
Public Key Infrastructure Certificates
P1
Not Selected
SC-17
SC-17
SC-18
Mobile Code
P1
Not Selected
SC-18
SC-18
SC-19
Voice Over Internet Protocol
P1
Not Selected
SC-19
SC-19
SC-20
Secure Name /Address Resolution Service

(Authoritative Source)

P1
SC-20 (1)
SC-20 (1)
SC-20 (1)
SC-21
Secure Name /Address Resolution Service

(Recursive or Caching Resolver)

P1
Not Selected
Not Selected
SC-21
SC-22
Architecture and Provisioning for

Name/Address Resolution Service

P1
Not Selected
SC-22
SC-22
SC-23
Session Authenticity
P1
Not Selected
SC-23
SC-23
SC-24
Fail in Known State
P1
Not Selected
Not Selected
SC-24
SC-25
Thin Nodes
P0
Not Selected
Not Selected
Not Selected

CNTL

NO.

HIGH

Meets/ Does Not Meet/ Partially Meets

Explanation

SC-26
Honeypots
P0
Not Selected
Not Selected
Not Selected
SC-27
Operating System-Independent Applications
P0
Not Selected
Not Selected
Not Selected
SC-28
Protection of Information at Rest
P1
Not Selected
SC-28
SC-28
SC-29
Heterogeneity
P0
Not Selected
Not Selected
Not Selected
SC-30
Virtualization Techniques
P0
Not Selected
Not Selected
Not Selected
SC-31
Covert Channel Analysis
P0
Not Selected
Not Selected
Not Selected
SC-32
Information System Partitioning
P1
Not Selected
SC-32
SC-32
SC-33
Transmission Preparation Integrity
P0
Not Selected
Not Selected
Not Selected
SC-34
Non-Modifiable Executable Programs
P0
Not Selected
Not Selected
Not Selected

System and Information Integrity

SI-1
System and Information Integrity Policy and

Procedures

P1
SI-1
SI-1
SI-1
SI-2
Flaw Remediation
P1
SI-2
SI-2 (2)
SI-2 (1) (2)
SI-3
Malicious Code Protection
P1
SI-3
SI-3 (1) (2) (3)
SI-3 (1) (2) (3)
SI-4
Information System Monitoring
P1
Not Selected
SI-4 (2) (4) (5) (6)
SI-4 (2) (4) (5) (6)
SI-5
Security Alerts, Advisories, and Directives
P1
SI-5
SI-5
SI-5 (1)
SI-6
Security Functionality Verification
P1
Not Selected
Not Selected
SI-6
SI-7
Software and Information Integrity
P1
Not Selected
SI-7 (1)
SI-7 (1) (2)
SI-8
Spam Protection
P1
Not Selected
SI-8
SI-8 (1)
SI-9
Information Input Restrictions
P2
Not Selected
SI-9
SI-9
SI-10
Information Input Validation
P1
Not Selected
SI-10
SI-10
SI-11
Error Handling
P2
Not Selected
SI-11
SI-11
SI-12
Information Output Handling and Retention
P2
SI-12
SI-12
SI-12
SI-13
Predictable Failure Prevention
P0
Not Selected
Not Selected
Not Selected

Program Management

PM-1
Information Security Program Plan
P1

Deployed organization-wide Supporting all baselines

PM-2
Senior Information Security Officer
P1
PM-3
Information Security Resources
P1
PM-4
Plan of Action and Milestones Process
P1
PM-5
Information System Inventory
P1
PM-6
Information Security Measures of

Performance P1

PM-7
Enterprise Architecture
P1
PM-8
Critical Infrastructure Plan
P1
PM-9
Risk Management Strategy
P1
PM-10
Security Authorization Process
P1
PM-11
Mission/Business Process Definition
P1

File details come from the government source that posted it. Updated .