PROTECTED INFORMATION OR SYSTEM PROTECTION IMPLEMENTATION PLAN

This Plan is divided into the following sections.

-   Scope and Purpose

-   Applicable Legislation

-   Related Documents

-   

-   Responsibilities and Roles

-   Nature of Information to Be Protected

-   Risk Assessment

-   Control Measures to Counter Risks

-   Incident Response

-   Signature

SCOPE AND PURPOSE

This Information and Systems Protection Implementation Plan applies to
all protected data stored in computers and transmitted over networks
used by \[organization\] members and its contractors, consultants,
scientific and other collaborators, and visitors as well as essential or
required systems, as defined in the "Nature of Information or System to
Be Protected" section of this document. This plan is intended to
supplement rather than in any way supersede the LBNL Cyber Security
Program Plan (CSPP) or the LBNL Regulations and Procedures Manual (RPM).
The \[organization\] will work closely with the LBNL Computer Protection
Program (CPP) to ensure that all provisions of this plan are in
accordance with direction provided by the CPP.

This plan is effective as of [\[insert]{.underline} date, month and
year---OR immediately\]. It will be reviewed every two years to update
provisions herein and to add new ones as needed.

The primary purpose of this Computer Protection Implementation Plan is
to provide the procedures, processes, and resources to protect the
following:

1.  Confidentiality of proprietary and medical data.

2.  Integrity of data and system files---to prevent unauthorized
    changes.

3.  Availability of data and systems whenever access is needed.

4.  Authorized Use --- use that is consistent with Berkeley Lab needs
    and objectives.

# APPLICABLE LEGISLATION

**California SB 1386**---requires that any business or agency that uses
a computer to store confidential personal information about a California
resident notify whoever may have had personal information (social
security numbers, driver's license numbers, account numbers, and/or
debit or credit card numbers) compromised. See

<http://info.sen.ca.gov/pub/01-02/bill/sen/sb_1351-1400/sb_1386_bill_20020926_chaptered.html>

**Health Insurance Portability and Accountability Act (HIPAA**)---a
complex set of federal regulations requiring that health care companies
and every agency or organization that transmits protected health
information electronically implement a wide set of security controls.
See <http://www.hhs.gov/ocr/hipaa/>

# RELATED DOCUMENTS

Other related documents include:

-   LBNL Regulations and Procedures Manual\
    <http://www.lbl.gov/Workplace/RPM/>

-   LBNL Guidelines for Baseline Security in Operating Systems
    <http://www.lbl.gov/ITSD/Security/systems/>

-   The LBNL Cyber Security Program Plan (CSPP)

-   The LBNL Computer Protection Implementation Plan (CPIP)

-   Department of Energy Cyber Security Management Program, DOE Order
    205.1

> <https://www.directives.doe.gov/pdfs/doe/doetext/restrict/neword/205/o2051.pdf>

-   Information Security Risk Assessment Practices of Leading
    Organizations, General Accounting Office/AIMD-99-139

> <http://www.gao.gov/special.pubs/ai99139.pdf>

-   Guide for Developing Security Plans for Information Technology
    Systems,\
    NIST Special Publication 800-18

> <http://csrc.nist.gov/publications/nistpubs/>

-   Instructions on Complying with President's Memorandum of May 14,
    1998, Privacy and Personal Information in Federal Records, Office of
    Management and Budget, Memorandum 99-05

> <http://www.whitehouse.gov/omb/memoranda/m99-05.html>

-   Security Self-Assessment Guide for Information Technology Systems,
    NIST Special Publication 800-26

> <http://csrc.nist.gov/publications/nistpubs/>

[\[insert]{.underline} names of any other related documents\]

## 

-   
-   
-   

```{=html}
<!-- -->
```
-   
-   
-   
-   
-   
-   

# 

# 

RESPONSIBILITIES AND ROLES

#### Plan Compliance

The person with primary responsibility for determining compliance with
this plan is listed at [\[insert]{.underline} URL\]. The person(s) with
responsibility for assisting in determining whether compliance has been
achieved is/are listed at [\[insert]{.underline} URL\].

#### Document Revision

The person with primary responsibility for revising this document and
keeping it up to date is listed at [\[insert]{.underline} URL\]**.** The
person with responsibility for assisting in revising this document and
keeping it up to date is listed at [\[insert]{.underline} URL\].

#### Computer Protection Implementation Liaison

The name of the Computer Protection Implementation Liaison for
[\[insert]{.underline} name of organization\] is located at
<http://www.lbl.gov/ITSD/Security/people/cpic.html>. This person is the
point of contact for all security-related issues within \[insert name of
organization\], including handling security-related incidents.

# [Plan Approval]{.underline}

The person with authority for approving this plan and all changes that
are made to it is listed at [\[insert]{.underline} URL\].

# NATURE OF INFORMATION OR SYSTEM TO BE PROTECTED \[provide a text description in the space that follows\]

# RISK ASSESSMENT \[include all or as many as needed\]

# 

## 

5.  
6.  
7.  
8.  

## 

## 

# The primary risks in connection with the storage and transmission of protected data or running the protected system(s) described in this protection plan include:

**\[ \]** **Unauthorized access to** **data** **or system** **from**
**an external source**. The degree of risk is \[include all or as many
as needed\] because \[insert reason\].

**\[ \]** **Unauthorized access to data** **or system** **from an
internal source**. The degree of risk is \[include all or as many as
needed\] because \[insert reason\].

**\[ \]** **Unauthorized modification of** **data** **or system files**.
The degree of risk is \[include all or as many as needed\] because
\[insert reason\].

**\[ \]** **Disruption of access to** **data** **(including data
erasure)** **or lack of availability of system.** The degree of risk is
\[include all or as many as needed\] because \[insert reason\].

**\[ \]** **Civil lawsuits from individuals whose personal information
has been compromised**. The degree of risk is \[include all or as many
as needed\] because \[insert reason\].

**\[ \]** **Violation of existing state and/or** **federal laws (failure
to adequately protect data or failure to notify when data may be
compromised) and associated consequences**. The degree of risk is
\[include all or as many as needed\] because \[insert reason\].

**\[ \]** **Embarrassment and/or public relations damage to
\[organization\] and/or Berkeley Lab**. The degree of risk is \[include
all or as many as needed\] because \[insert reason\].

**\[ \]** **Other.** (Describe here)

### 

### 

## RISK CONTROL MEASURES 

## 

In addition to baseline operating system control measures listed at
<http://www.lbl.gov/ITSD/Security/systems>, extra control measures will
be implemented to protect confidentiality, integrity, and availability
of protected data and systems. These measures include **\[check as many
as needed\]**:

**[Confidentiality Measures]{.underline}**

**\[ \]** **Setting highly restrictive file permissions**. File
permissions for files and directories that hold these files will be set
so that only specifically authorized users will be able to read, modify,
and/or delete them.

(Describe here.)

**\[ \]** **Using strong identification and
authentication*[.]{.underline}*** Third-party authentication such as
smart card authentication or challenge-response authentication will be
used in addition to normal, password-based authentication for access to
protected systems, and --- system administrators in (insert name of
organization) [\[insert]{.underline} name of organization\] will conform
to DOE Order 205.1, which is described at
<https://www.directives.doe.gov/pdfs/doe/doetext/restrict/neword/205/n2051.pdf>,
in ensuring that prescribed system security administration practices are
followed (e.g., privilege management, unique logins, inactive accounts,
failed login attempts, employee status changes, screen savers).

all access to any files and folders that hold protected information will
require extra identification and authentication, such as entry of a
special password.

(Describe here.)

ll users in (insert name of organization) [\[insert]{.underline} name of
organization\] will choose passwords that conform to the guidance in DOE
Notice 205.3 and will change each password every 180 days or less, in
accordance with the LBNL RPM Section Section 9.02(D)(1)(c)(iii)
(http://www.lbl.gov/Workplace/RPM/R9.02.html#RTFToC40)9.. System
administrators will, whenever possible, enable system settings that
expire passwords in 180 days. Additionally, system administrators will
to the maximum extent possible install password filters in Unix systems
and password complexity in Windows systems to ensure that users cannot
select trivial passwords when they change their passwords.

**\[ \]** **Using encryption.** Files that hold protected data will be
encrypted when they are stored on a hard drive. Any network transmission
(including messages) in which these data are sent from one system to
another will also be encrypted, as described in NIST Special Publication
800-26.

(Describe here.)

[rogram.]{.underline}

**\[ \]** **Enforcement of need-to-know principle.** Access to protected
data or protected system will be given only to those with a
need-to-know.

(Describe here.)

**\[ \]** **developers within** **(insert name of organization)**
**\[insert** **name of organization\]** **Deploying additional physical
security measures.** Physical security measures above the recommended
LBNL baseline measures such as placing computing systems in a locked
area not open to public access and others (per NIST Special Publication
800-26) will be used.

(Describe here.)

**\[ \]** **will be encouraged to develop applications in accordance
with the security guidelines at
http://www.lbl.gov/ITSD/Security/guidelines/applications**
**Increasing** **the** **level of logging.** System administrators
and/or users will enable greater than baseline levels of logging,
especially logging of access to all protected files and directories.

(Describe here.)

**\[ \] Using password quality enforcement measures.** Measures such as
password filtering or password cracking will be used to help ensure that
passwords required for access are not easy-to-guess, per NIST Special
Publication 800-26.

> (Describe here.)

**\[ \]** **Other.** ­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­ (Describe here.)

Users are, according to the RPM, responsible for protecting their own
systems and are responsible for any use of systems through their user
IDs. Users will thus be urged to adopt any additional appropriate
measures needed for proper protection, such as protecting their
passwords from disclosure.

**\[ \] Other.** ­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­ (Describe here.)

**[System and Data Integrity]{.underline}** **[Measures]{.underline}**

**\[ \]** **Using reconciliation routines.** Checksum or hash
calculations will be computed to verify integrity, per NIST Special
Publication 800-26.

> (Describe here.)

**\[ \]** **Using integrity verification programs.** Integrity
verification programs used by applications, as described in NIST Special
Publication 800-26, will be installed and run.

> (Describe here.)

**\[ \] Other.** ­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­ (Describe here.)

**\[ \] Other.** ­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­ (Describe here.)

##### System and Data Availability Measures

**\[ \]** **Using performance monitoring.** Performance monitoring is
used to spot availability problems, as described in NIST Special
Publication 800-26.

> (Describe here.)

**\[ \]** **Using intrusion detection tools.** Intrusion detection tools
will be installed on the system, as described in NIST Special
Publication 800-26.

> (Describe here.)

**\[ \]** **Inspecting intrusion detection tool output.** Intrusion
detection tool output will be regularly inspected, as described in NIST
Special Publication 800-26..

> (Describe here.)

**\[ \] Other.** ­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­ (Describe here.)

**\[ \] Other.** ­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­ (Describe here.)

### INCIDENT RESPONSE

If anyone observes an event that provides reasonable indication that
security in one or more protected systems has been breached, or that
protected data have been compromised, I understand that I must:

-   Promptly (within 24 hours of the onset of the event) contact the
    Computer Protection Program Manager and the LBNL Security Manager by
    sending email to <cppm@lbl.gov> and <dwbell@lbl.gov>, or calling
    486-7770 in case of an emergency .

-   Contact people capable of quickly diagnosing and closing the
    incident. Incidents in protected systems or protected data are
    compromise must be given top priority. Recovery strategies will vary
    according to the severity of each incident. If a system has been
    infected by a worm or virus, that system shall at a minimum be
    disconnected from the network until recovery steps are taken. If
    unauthorized superuser access to a system has occurred, the
    compromised system must be rebuilt and all passwords on that system
    must be changed.

-   If data of the nature described in California SB 1386 are
    compromised, notify each individual whose personal data have been
    compromised by no more than 72 hours from the time the incident was
    detected.

-   In the case of misuse by an LBNL employee or contractor, contact the
    Computer Protection Program Manager by sending email to
    <cppm@lbl.gov> or calling 486-7770 in case of an emergency .

-   

Note that in no case may anyone contact the media or otherwise spread
information about the incident to outside entities other than CIAC and
possibly also to the Office of the Inspector General (if LBNL management
so directs) without the explicit, advance consent of the office of the
LBNL CIO.

## SIGNATURE

I, the owner of the information or system in question, agree to abide by
the terms of this Protected Information or System Protection
Implementation Plan.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

(Signature) (Date)

# 

# 

# 

-   

#