Attachment_0003_RMF_Security_Plan_Template.xlsm

NIST Control Info Rev. 3

a. A formal, documented access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance;and

b. Formal, documented procedures to facilitate the implementation of the access control policy and associated access controls. Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the access control family.

The policy and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary.

The access control policy can be included as part of the general information security policy for the organization.

Access control procedures can be developed for the security program in general and for a particular information system, when required.

The organizational risk management strategy is a key factor in the development of the access control policy.

a. Identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary)

b. Establishing conditions for group membership

c. Identifying authorized users of the information system and specifying access privileges

d. Requiring appropriate approvals for requests to establish accounts

e. Establishing, activating, modifying, disabling, and removing accounts

f. Specifically authorizing and monitoring the use of guest/anonymous and temporary accounts

g. Notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes

h. Deactivating:

(i) temporary accounts that are no longer required; and

(ii) accounts of terminated or transferred users

i. Granting access to the system based on:

(i) a valid access authorization;

(ii) intended system usage; and

(iii) other attributes as required by the organization or associated missions/business functions; and

a. Requires that users log out when <strong>[the user's work day has ended/daily]</strong>;

b. Determines normal time-of-day and duration usage for information system accounts;

c. Monitors for atypical usage of information system accounts;and

(a) Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes information system and network privileges into roles; and

attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains) in the information system.

In addition to enforcing authorized access at the information-system level, access enforcement mechanisms are employed at the application level, when necessary, to provide increased information security for the organization.

Consideration is given to the implementation of an audited, explicit override of automated mechanisms in the event of emergencies or other serious events.

If encryption of stored information is employed as an access enforcement mechanism, the cryptography used is FIPS 140-2 (as amended) compliant.

For classified information, the cryptography used is largely dependent on the classification level of the information and the clearances of the individuals having access to the information.

(a) Access control information (i.e., attributes) employed by the policy rule set (e.g., position, nationality, age, project, time of day); and

(a) Allows users to specify and control sharing by named individuals or groups of individuals, or by both;

A few examples of flow control restrictions include: keeping export controlled information from being transmitted in the clear to the Internet, blocking outside traffic that claims to be from within the organization, and not passing any web requests to the Internet that are not from the internal web proxy.

Information flow control policies and enforcement mechanisms are commonly employed by organizations to control the flow of information between designated sources and destinations (e.g., networks, individuals, devices) within information systems and between interconnected systems.

Flow control is based on the characteristics of the information and/or the information path.

Specific examples of flow control enforcement can be found in boundary protection devices (e.g., proxies, gateways, guards, encrypted tunnels, firewalls, and routers) that employ rule sets or establish configuration settings that restrict information system services, provide a packet-filtering capability based on header information, or message-filtering capability based on content (e.g., using key word searches or document characteristics)..

(i) character data fields only contain printable ASCII;

(ii) character data fields only contain alpha-numeric characters;

(iii) character data fields do not contain special characters; or

(i) prohibiting information transfers between interconnected systems (i.e. implementing access only, one way transfer mechanisms);

(ii) employing hardware mechanisms to enforce unitary information flow directions; and

(i) bitmap objects that are inherently non language-based (i.e., image, video, or audio files); and

(a) Uniquely identifies and authenticates source and destination domains for information transfer;

(b) Binds security attributes to information to facilitate information flow policy enforcement; and

a. Separates duties of individuals as necessary, to prevent malevolent activity without collusion &nbsp b. Documents separation of duties; and

c. Implements separation of duties through assigned information system access authorizations. Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Examples of separation of duties include:

(i) mission functions and distinct information system support functions are divided among different individuals/roles;

(ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security);

(iii) security personnel who administer access control functions do not administer audit functions; and

(iv) different administrator accounts for different roles.

a. Enforces a limit of <strong>[Assignment: organization-defined number]</strong> consecutive invalid login attempts by a user during a <strong>[Assignment: organization-defined time period]</strong>; and

b. Automatically <strong>[Selection: locks the account/node for an [Assignment: organization-defined time period]; locks the account/node until released by an administrator; delays next login prompt according to [Assignment: organization-defined delay algorithm]]</strong> when the maximum number of unsuccessful attempts is exceeded.

The control applies regardless of whether the login occurs via a local or network connection. Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Due to the potential for denial of service, automatic lockouts initiated by the information system are usually temporary and automatically release after a predetermined time period established by the organization.

If a delay algorithm is selected, the organization may chose to employ different algorithms for different information system components based on the capabilities of those components.

Response to unsuccessful login attempts may be implemented at both the operating system and the application levels.

a. Displays an approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:

&nbsp(i) users are accessing a U.S. Government information system;

(ii) system usage may be monitored, recorded, and subject to audit;

(iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and

(iv) use of the system indicates consent to monitoring and recording

b. Retains the notification message or banner on the screen until users take explicit actions to log on to or further access the information system; and

c. For publicly accessible systems:

(i) displays the system use information when appropriate, before granting further access;

(ii) displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

a. Prevents further access to the system by initiating a session lock after <strong>[Assignment: organization-defined time period]</strong> of inactivity or upon receiving a request from a user; and

b. Retains the session lock until the user reestablishes access using established identification and authentication procedures. Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.

The session lock is implemented at the point where session activity can be determined.

This is typically at the operating system-level, but may be at the application-level.

a. Identifies specific user actions that can be performed on the information system without identification or authentication; and

b. Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification and authentication. Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y This control is intended for those specific instances where an organization determines that no identification and authentication is required; it is not, however, mandating that such instances exist in given information system.

The organization may allow a limited number of user actions without identification and authentication (e.g., when individuals access public websites or other publicly accessible federal information systems such as http://www.usa.gov).

Organizations also identify any actions that normally require identification or authentication but may under certain circumstances (e.g., emergencies), allow identification or authentication mechanisms to be bypassed.

Such bypass may be, for example, via a software-readable physical switch that commands bypass of the login functionality and is protected from accidental or unmonitored use.

These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy.

a. Documents allowed methods of remote access to the information system

b. Establishes usage restrictions and implementation guidance for each allowed remote access method

c. Monitors for unauthorized remote access to the information system

d. Authorizes remote access to the information system prior to connection; and

e. Enforces requirements for remote connections to the information system. Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y This control requires explicit authorization prior to allowing remote access to an information system without specifying a specific format for that authorization.

For example, while the organization may deem it appropriate to use a system interconnection agreement to authorize a given remote access, such agreements are not required by this control.

Re…