Census Bureau

IT Security Program Policies

![](media/image1.wmf)

March 14, 2003

Table of Contents

[**1.0** **Introduction 1**](#introduction)

[1.1 Purpose 1](#purpose)

[1.2 Scope 2](#scope)

[2.0 IT Security Responsibilities 5](#it-security-responsibilities)

[2.1 IT Security Roles 5](#it-security-roles)

[2.2 IT Security Responsibilities 6](#it-security-responsibilities-1)

[2.3 IT Security department-wide Coordination
12](#it-security-department-wide-coordination)

[3.0 IT Security Planning 13](#it-security-planning)

[3.1 IT Security Plans 13](#it-security-plans)

[3.2 System Life Cycle Management 15](#system-life-cycle-management)

[3.3 System Certification and Accreditation (C&A)
23](#system-certification-and-accreditation-ca)

[4.0 Management Controls 29](#management-controls)

[4.1 Risk Management and Assessment 29](#risk-management-and-assessment)

[4.2 Review of Security Controls 30](#review-of-security-controls)

[4.3 Audits 36](#audits)

[4.4 Help Desk/User Support 38](#help-deskuser-support)

[5.0 Operational Controls 40](#operational-controls)

[5.1 Personnel Security 40](#personnel-security)

[5.2 Physical and Environmental Security
45](#physical-and-environmental-security)

[5.3 Special Processing Requirements
47](#special-processing-requirements)

[5.4 Contingency Planning 50](#contingency-planning)

[5.5 Software Maintenance Controls 52](#software-maintenance-controls)

[5.6 Hardware Maintenance Controls 57](#hardware-maintenance-controls)

[5.7 Data Integrity 59](#data-integrity)

[5.8 Documentation 62](#documentation)

[5.9 IT Security Awareness, Training, and Education
62](#it-security-awareness-training-and-education)

[5.10 Incident Response Capability 66](#incident-response-capability)

[6.0 Technical Controls 72](#technical-controls)

[6.1 Logical Access Controls 72](#logical-access-controls)

[6.2 Identification and Authentication
79](#identification-and-authentication)

[6.3 Data Communication and Network Security
82](#data-communication-and-network-security)

[7.0 Partnerships with Other Department of Commerce Program Offices
87](#partnerships-with-other-department-of-commerce-program-offices)

[7.1 The Department of Commerce Office of the Chief Information Officer
(CIO)
87](#the-department-of-commerce-office-of-the-chief-information-officer-cio)

[7.2 The Office of Inspector General (OIG)
88](#the-office-of-inspector-general-oig)

[7.3 The Department of Commerce Office of General Counsel (OGC)
88](#the-department-of-commerce-office-of-general-counsel-ogc)

[7.4 The Department of Commerce Office of Security at the Census Bureau
88](#the-department-of-commerce-office-of-security-at-the-census-bureau)

[7.5 The Office of Human Resource Management (HRD)
89](#the-office-of-human-resource-management-hrd)

[7.6 The Office of Acquisition (ACQ) 91](#the-office-of-acquisition-acq)

[7.7 The Information Systems Support and Review Office (ISSRO)
92](#the-information-systems-support-and-review-office-issro)

[Appendix A: IT Security Laws and Federal Regulations
93](#appendix-a-it-security-laws-and-federal-regulations)

[Appendix B: Acronyms and Definitions
100](#appendix-b-acronyms-and-definitions)

[Appendix C: Glossary 101](#appendix-c-glossary)

# Introduction

The mission of the Census Bureau is to be the preeminent collector and
provider of timely, relevant and quality data about the people and
economy of the United States. Because of the nature of this mission,
protecting information and the systems that collect, process, and
maintain this information is of critical importance. Therefore, security
of information resources must include controls and safeguards to offset
possible threats as well as controls to ensure accountability,
availability, integrity, and confidentiality of the data. Information
technology (IT) security encompasses the total infrastructure for the
maintenance and delivery of information, including physical computer
hardware, supporting equipment, communication systems, and logical
processes defined by software, procedures and requirements.

As mentioned above, one of the key roles that IT security plays at the
Census Bureau is assisting in the Bureau's data stewardship
responsibilities which consist of protecting the privacy and
confidentiality of individuals and corporations that provide data
against the requirement to manage the public's level of access to that
data. A critical component of data stewardship includes protecting the
information and systems that collect, process, and, maintain this
information. The appropriate degree of protection depends on the value
of the data processed, stored, or transmitted, as well as the cost of
protecting the data. Security must protect people as well as hardware.
It must provide peace of mind and create a workplace that is safe and
well protected from accidents or violence. It is this added value of
people protection that can make good security even more cost effective.
Thus, security measures should be taken to guard against unauthorized
access to, or alteration, disclosure or destruction of information and
IT systems, and against accidental loss or destruction of information
and IT systems.

Provisions of the Privacy Act and Title 13 of the United States Code
protect much of the data collected by the Census Bureau and make the
release of covered data a criminal act punishable by Federal Law. The
Census Bureau strives to ensure the confidentiality and integrity of
these data consistent with statutory requirements and ethical
considerations, while balancing the need for availability. This document
sets forth the IT security policies and standards consistent with these
objectives.

## Purpose

###  What is the purpose of this policy?

> The Office of Management and Budget Circular No. A-130, Appendix III,
> "Security of Federal Automated Information Systems," requires the head
> of each Federal agency to establish and maintain an active program for
> managing computers and automated information. This policy specifies
> and explains the Census Bureau's Information Technology (IT) security
> program requirements and provides guidance on the implementation of IT
> security programs within the Census Bureau. It incorporates by
> reference the requirements of Public Laws, Federal and Departmental
> regulations, including GISRA and FISMA, in [Appendix A, IT Security
> Laws and Federal Regulations](#_Appendix_A:_). It is also designed to
> be consistent with, and an enabler of, the Census Bureau's Privacy
> Principles and other data stewardship policies.
>
> This policy establishes the foundation of comprehensive rules and
> practices that regulate access to an organization's IT systems and the
> information processed, stored, and transmitted by them. Good policy
> protects not only information and systems, but also individual
> employees and the organization as a whole. As such, this policy
> represents the Census Bureau's strong commitment to IT security.

## Scope

### To whom and to what does this policy apply?

> This policy applies to all Census Bureau divisions and offices and
> their employees (federal and contractor), guest researchers,
> collaborators, and others requiring access to the hardware and
> software components that constitute the Census Bureau's IT automated
> information systems. It also applies to all Census Bureau systems,
> regardless of sensitivity level or classification, used to carry out
> the Census Bureau's mission. Controls must be tailored accordingly so
> that cost-effective controls can be applied commensurate with the risk
> and
> [sensitivity](#what-are-the-different-levels-and-types-of-information-sensitivity)
> of the system. This applies to desktop PC workstations, laptop
> computers, servers, network devices, handheld personal electronic
> devices, and office automation equipment (such as copiers and fax
> machines) used by Census Bureau employees or contractors in the
> conduct of official duties regardless of their location. This policy
> must be explicitly addressed in all IT procurement activities.

### Who must have an IT Security Program and what is its structure?

> All operating units within the Department of Commerce must have a
> documented IT Security Program Policy that conforms to the
> Department's policies and [other applicable
> regulations.](#_Appendix_A:_) The IT security program policy must
> address the following three areas of security controls as defined by
> the National Institute of Standards and Technology (NIST) [Special
> Publication
> 800-26,](http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf)
> [*Security Self-Assessment Guide for Information Technology
> Systems*](http://csrc.nist.gov/publications/nistpubs/800-26/sp800-26.pdf):

-   []{#management_controls .anchor}Management controls, which include:

```{=html}
<!-- -->
```
-   [Risk Management](#risk-management-and-assessment);

-   [Review of Security Controls](#review-of-security-controls);

-   [System Life Cycle Management](#system-life-cycle-management);

-   [Authorize Processing (Certification and
    Accreditation)](#system-certification-and-accreditation-ca);

-   [Security Plan](#security_plan); and

-   [Audits](#audits).

```{=html}
<!-- -->
```
-   []{#operational_controls .anchor}Operational controls, which
    include:

```{=html}
<!-- -->
```
-   [Personnel Security](#personnel_security);

-   [Physical Security](#physical-and-environmental-security) (including
    environmental protection);

-   [Production, Input/Output Controls](#ProdIOControls);

-   [Contingency Planning](#contingency-planning);

-   [Hardware and Systems Software
    Maintenance](#hardware-maintenance-controls);

-   [Data Integrity](#data-integrity);

-   [Documentation](#documentation);

-   [Security Awareness, Training, and
    Education](#it-security-awareness-training-and-education); and

-   [Incident Response Capability](#incident-response-capability).

```{=html}
<!-- -->
```
-   []{#technical_controls .anchor}Technical controls, which include:

```{=html}
<!-- -->
```
-   [Identification and Authentication](#ID_auth_requirement);

-   [Logical Access Controls](#Logical_Access_Controls); and

-   [Data Communication and Network
    Security](#data-communication-and-network-security).

### What is the Census Bureau's IT Security Program management structure?

> The Census Bureau IT security program management structure establishes
> the required framework of security controls that ensure the inclusion
> of security in the daily operation and management of Census Bureau
> resources. The Census Bureau IT security program management structure
> provides a foundation for effectively managing the confidentiality,
> integrity, and availability of the information and the information
> systems supporting the mission of the Census Bureau. See [IT Security
> Roles and Responsibilities](#it-security-roles) for details on the
> roles and responsibilities specified for all Census Bureau employees
> (federal and contractor) included in the program management structure.

### What is the difference between the IT Security Program Policy and issue- or system- specific policy?

> There is only one IT Security Program Policy, whereas there are many
> IT security issue or system-specific policies within the Census
> Bureau. The program-level policy describes the minimum program
> elements required for the Census Bureau IT security program. It
> describes the [program
> structure](#who-must-have-an-it-security-program-and-what-is-its-structure),
> [roles and responsibilities](#it-security-roles), and IT security
> control areas that must be addressed. It also describes administrative
> reporting requirements and record keeping practices that support
> compliance with federal requirements and demonstrates the existence of
> a repeatable management process.
>
> Census Bureau divisions/offices may supplement the minimum
> requirements of this program policy and associated issue-specific
> policies with more stringent requirements based on the need for
> additional controls within the division/office's unique computing
> environment.

### How are the Census Bureau's IT Security Program Policy and Minimum Implementation Standards structured?

> The Census Bureau's IT Security Program Policy and minimum
> implementation standards specifies the Census Bureau's mandatory
> (denoted by the terms "must" and "will") and recommended (denoted by
> the terms "should" and "may") IT security program management
> practices. It also encompasses Department of Commerce policy as well
> as minimum acceptable procedures and recommended guidance by
> incorporating the best practices of the federal government and private
> industry. Where references are provided for additional sources of
> information on these best practices, Census Bureau IT security
> practitioners should place precedence in guidance issued by the
> National Institute of Standards and Technology.

### How do Census Bureau requirements for IT resource security apply for processing performed at contract facilities or at other Government agencies?

> All requirements in this policy apply equally to Census Bureau
> operated resources and resources at contract facilities and other
> government agencies that support Census Bureau requirements. The
> physical location of the resource has no impact on the applicability
> of security requirements. In the case where processing may occur at
> contractor or other Government facilities, systems must be suitably
> certified and accredited by the other agency in accordance with this
> policy.

### What if requirements of the Department of Commerce or Census Bureau IT Security Program Policy cannot be met?

> The Census Bureau Chief Information Officer (CIO) must identify any
> proposed deviations from mandatory practices of the Department of
> Commerce policy and request a waiver in writing from the Department of
> Commerce CIO. Approved waivers must be documented as part of the
> appropriate system [security plan(s)](#security_plan) that cover the
> system(s) applicable to the waiver. Identical systems under the same
> management authority and covered by one system security plan require
> only one waiver request.
>
> If requirements of the Census Bureau IT Security Program Policy cannot
> be met, the system owner must request a waiver from the Census Bureau
> IT Security Officer. Approved waivers must be documented as part of
> the appropriate system [security plan(s)](#security_plan) that cover
> the system(s) applicable to the waiver. System owners may appeal the
> IT Security Officer's waiver decision in writing to the Census Bureau
> CIO.
>
> Requests for an IT Security Program Policy Waiver must:

-   Cite the specific mandatory practice(s) for which the waiver is
    requested;

-   Explain the rationale for the requested waiver; and if applicable

-   Describe compensating controls to be in place during the period of
    the requested waiver, until systems are compliant with this policy,
    and provide an action plan (including target dates) for compliance.

# IT Security Responsibilities

## IT Security Roles 

Every employee and contractor of the Census Bureau plays an important
role, regardless of position or job classification, in safeguarding the
confidentiality, integrity and availability of the systems and data
maintained by the Census Bureau. It is important that every individual
fully understand their role and the associated responsibilities
designated by the Census Bureau IT security program and abide by the
security standards, policies, and procedures set forth by the Census
Bureau. Employees should also become familiar with the policies mandated
by the Department of Commerce's and the Census Bureau's IT security
programs.

  -----------------------------------------------------------------------
  **Role**              **Description**
  --------------------- -------------------------------------------------
  Department of         Overall responsibility for the Department of
  Commerce IT Security  Commerce and operating unit IT Security Programs.
  Program Manager       
  (ITSM)                

  Department of         Head of the Department of Commerce Critical
  Commerce Critical     Infrastructure Protection Program, including the
  Infrastructure        development of policies and procedures for (1)
  Protection Manager    the Computer Incident Response Team and (CIRT)
                        Computer Incident Response Capability (CIRC) as
                        an effective component of an overall IT Security
                        Program, (2) the IT component of Continuity of
                        Operations Planning (COOP), and (3) the Critical
                        Infrastructure Protection Program as required by
                        Presidential Decision Directive 63 and the
                        liaison for Department of Commerce to the
                        National Critical Infrastructure Assurance
                        Office.

  Director, Census      Accountable to the Department of Commerce for the
  Bureau                development and implementation of the Census
                        Bureau's IT Security Program.

  []{#CIO               Reports to the Deputy Director. Responsible for
  .anchor}Associate     implementing and overseeing an IT Security
  Director for          Program for all sensitive but unclassified (SBU)
  Information           IT systems.
  Technology/CIO,       
  Census Bureau         

  []{#ITSO .anchor}IT   The Census Bureau's IT security authority and the
  Security Officer      central point of contact for its IT Security
                        Program for SBU IT systems; has authority for
                        setting the day-to-day direction of the program
                        and its overall goals, objectives and priorities.

  Technical Security    Under the direction of the IT Security Officer,
  and Review and Policy responsible for the technical implementation and
  Staff                 management of the IT Security Program

  System Owner          Business or IT manager (e.g. division/office
                        chief) with budgetary authority over the
                        system(s), responsibility for the basic operation
                        and maintenance of the system(s), compliance with
                        all IT Security program policies and procedures
                        and coordination and implementation of
                        system-level security controls; appoints the
                        Division Security Officer or IT System Security
                        Officer (DSO/ITSSO) for the system(s).

  []{#DSO               Point of contact between the system owner (or
  .anchor}Division      division chief) and the IT Security Office
  Security Officer or   (ITSO); Responsible for the implementation of
  IT System Security    system-level security controls and maintenance of
  Officer (DSO/ITSSO)   system documentation.

  System/Network        Party responsible for certain aspects of system
  Administrators        security, such as adding and deleting user
                        accounts as authorized by the system owner, as
                        well as normal operations of the system in
                        keeping with job requirements (may include
                        security of LAN or application administration).

  End Users             All employees (and contractors) are considered
                        custodians of the information and systems
                        maintained by the Census Bureau and required to
                        uphold all IT Security Program policies. All
                        non-Census Bureau employees, such as contractors,
                        are required to obtain Special Sworn Status prior
                        to accessing any Title 13 or Title 26 data.
                        Non-Census Bureau employees obtain Special Sworn
                        Status by completing Form BC-1759 and taking an
                        Oath of Non-disclosure.
  -----------------------------------------------------------------------

## IT Security Responsibilities

+---------------+------------------------------------------------------+
| **Role**      | **Responsibilities**                                 |
+===============+======================================================+
| []{#ITSM      | -   Develop IT security policy for Department of     |
| .anch         |     Commerce [classified and unclassified            |
| or}Department |     syst                                             |
| of Commerce   | ems](#how-does-sensitive-unclassified-information-di |
| IT Security   | ffer-from-classified-national-security-information), |
| Program       |     to include policies and related guidance to be   |
| Manager       |     followed by all Department of Commerce operating |
| (ITSM)        |     units, and developing standards and practices to |
|               |     establish the Department's IT Security Program   |
|               |     as an integral part of its IT management         |
|               |     program;                                         |
|               |                                                      |
|               | -   Monitor and evaluate the status of the           |
|               |     Department of Commerce IT security posture by    |
|               |     performing annual [compliance                    |
|               |                                                      |
|               | reviews](#department-of-commerce-compliance-reviews) |
|               |     of operating unit IT Security Programs and       |
|               |     system controls (including reviews of [security  |
|               |     plans](#_Hlt15712896)[, risk                     |
|               |     assessments](#what-is-a-risk-a                   |
|               | ssessment-and-how-does-it-help-secure-it-resources), |
|               |     [certification and                               |
|               |     accred                                           |
|               | itation](#system-certification-and-accreditation-ca) |
|               |     processes, and others);                          |
|               |                                                      |
|               | -   Advise the Department of Commerce CIO and Census |
|               |     Bureau's CIO of technological IT security        |
|               |     advances that can be used on a Department-wide   |
|               |     scale and provide reduced costs for IT security  |
|               |     efforts;                                         |
|               |                                                      |
|               | -   Report to the Department of Commerce CIO and     |
|               |     external entities, such as OMB, GAO, and         |
|               |     Congress, on IT Security Program status within   |
|               |     the Department of Commerce;                      |
|               |                                                      |
|               | -   Provide IT security guidance and technical       |
|               |     assistance to all operating units;               |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Track operating unit weaknesses reported under   |
|               |     self-assessments and external reviews and track  |
|               |     implementation of [corrective                    |
|               |     actions](#what                                   |
|               | -information-must-be-in-the-corrective-action-plan); |
|               |                                                      |
|               | -   Maintain a database of operating unit [IT system |
|               |     inventories](#it-system-inventory-management);   |
|               |                                                      |
|               | -   Work cooperatively with the Department of        |
|               |     Commerce [Office of                              |
|               |     Security](#the-department-                       |
|               | of-commerce-office-of-security-at-the-census-bureau) |
|               |     (OSY), the Department of Commerce [Office of     |
|               |     Inspector                                        |
|               |     General](#the-office-of-inspector-general-oig)   |
|               |     (OIG), the Census Bureau, and other entities to  |
|               |     ensure an effective IT Security Program;         |
|               |                                                      |
|               | -   Plan and co-chair regular meetings of the        |
|               |     Department of Commerce [IT Security Coordinating |
|               |     Committee](#section) (ITSCC) as a forum for      |
|               |     exchange and action on Department-wide security  |
|               |     policies, problems, and potential solutions; and |
|               |                                                      |
|               | -   Approve the Census Bureau's security plans.      |
+---------------+------------------------------------------------------+
| Department of | -   Develop the Department of Commerce Critical      |
| Commerce      |     Infrastructure Protection Program, including     |
| Critical      |     policies and procedures for (1) the Computer     |
| I             |     Incident Response Team (CIRT) and Computer       |
| nfrastructure |     Incident Response Capability (CIRC) as an        |
| Protection    |     effective component of an overall IT Security    |
| Manager       |     Program, (2) the IT component of Continuity of   |
|               |     Operations Planning (COOP), and (3) the Critical |
|               |     Infrastructure Protection Program as required by |
|               |     Presidential Decision Directive 63 and guidance  |
|               |     from organizations such as the National Critical |
|               |     Infrastructure Assurance Office;                 |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Act as the Department of Commerce central point  |
|               |     of contact for [incident                         |
|               |     handling](#                                      |
|               | what-incident-handling-processes-comprise-the-circ), |
|               |     in concert with the [Department of               |
|               |     Commerce](#the-department-                       |
|               | of-commerce-office-of-security-at-the-census-bureau) |
|               |     [Office of Security](#OSY) (OSY) and Department  |
|               |     of Commerce [Office of Inspector                 |
|               |     General](#the-office-of-inspector-general-oig)   |
|               |     (OIG), for ensuring the reporting of             |
|               |     [incidents](#what-is-a-reportable-incident) to   |
|               |     the FedCIRC;                                     |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Coordinate with OSY and OIG on the need to       |
|               |     protect critical infrastructure;                 |
|               |                                                      |
|               | -   Promote best practices in critical               |
|               |     infrastructure management;                       |
|               |                                                      |
|               | -   Advise top management officials within the       |
|               |     Department of Commerce on critical               |
|               |     infrastructure protection plans, activities, and |
|               |     issues;                                          |
|               |                                                      |
|               | -   Develop the Department of Commerce's Federated   |
|               |     Computer Incident Response Program and support   |
|               |     the IT component of Continuity of Operations     |
|               |     Planning;                                        |
|               |                                                      |
|               | -   Maintain liaison with central control agencies   |
|               |     and other external organizations on computer and |
|               |     related telecommunications security issues;      |
|               |                                                      |
|               | -   Identify resource requirements, including funds, |
|               |     personnel, and contractors, needed to manage the |
|               |     Critical Infrastructure Protection Program; and  |
|               |                                                      |
|               | -   Plan and co-chair regular meetings of the        |
|               |     Department of Commerce [IT Security Coordinating |
|               |     Committee](#section) (ITSCC) as a forum for      |
|               |     exchange and action on Department-wide security  |
|               |     policies, problems, and potential solutions.     |
+---------------+------------------------------------------------------+
| Director,     | -   Communicate the importance of IT security to the |
| Census Bureau |     Census Bureau's mission to all Census Bureau     |
|               |     employees;                                       |
|               |                                                      |
|               | -   Assign ownership of resources;                   |
|               |                                                      |
|               | -   Ensure that the Census Bureau has an established |
|               |     IT security program to protect its IT systems;   |
|               |     and                                              |
|               |                                                      |
|               | -   Serve as the Designated Approving Authority      |
|               |     (DAA) (accepting operating risk) for IT systems  |
|               |     that support the operating unit's mission, OR    |
|               |     delegate the DAA authority to another senior     |
|               |     management program official, or the system       |
|               |     owner, as appropriate. (This responsibility has  |
|               |     been delegated to the Census Bureau Associate    |
|               |     Director of Information Technology/CIO).         |
+---------------+------------------------------------------------------+
| Census Bureau | -   Oversee and approve the Census Bureau's IT       |
| Associate     |     security program and approve supplements to the  |
| Director for  |     Census Bureau IT Security Program Policy;        |
| Information   |                                                      |
| T             | -   Appoint, in writing, an IT Security Officer to   |
| echnology/CIO |     implement the IT security program within the     |
|               |     Census Bureau;                                   |
|               |                                                      |
|               | -   Ensure an appropriate level of protection for    |
|               |     all Census Bureau information resources; whether |
|               |     retained in-house or under the control of        |
|               |     contractors;                                     |
|               |                                                      |
|               | -   Issue IT security program policy and guidance    |
|               |     that establishes a framework for an IT security  |
|               |     program to be implemented by the Census Bureau;  |
|               |                                                      |
|               | -   Development, implementation and maintenance of a |
|               |     Bureau-wide IT planning and management system;   |
|               |                                                      |
|               | -   Ensure that funding and resources are programmed |
|               |     for staffing, training, and support of the IT    |
|               |     security program and for implementation of       |
|               |     system safeguards as required within the Census  |
|               |     Bureau;                                          |
|               |                                                      |
|               | -   Ensure appropriate procedures are in place for   |
|               |     [certification and                               |
|               |     accred                                           |
|               | itation](#system-certification-and-accreditation-ca) |
|               |     of all SBU IT systems; and monitor, evaluate,    |
|               |     and report to the Director on the status of IT   |
|               |     security within the Census Bureau;               |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Serve as the Census Bureau's [Designated         |
|               |     Approving Authority (DAA)](#daa) (accepting      |
|               |     operating risk);                                 |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Designate the appropriate Associate Director to  |
|               |     serve as the [Designated Approving Authority     |
|               |     (DAA)](#daa) for accrediting each system under   |
|               |     his/her responsibility and for ensuring          |
|               |     compliance with system security requirements;    |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Ensure that persons working on IT security in    |
|               |     the Census Bureau are properly trained, and      |
|               |     supported (with resources);                      |
|               |                                                      |
|               | -   Assist the Department of Commerce in [compliance |
|               |                                                      |
|               | reviews](#department-of-commerce-compliance-reviews) |
|               |     and other reporting requirements;                |
|               |                                                      |
|               | -   Provide feedback to the Department of Commerce   |
|               |     on the status of the program in the Census       |
|               |     Bureau, and suggest improvements or areas of     |
|               |     concern in the Census Bureau's program or any    |
|               |     other Department of Commerce program or          |
|               |     activity; and                                    |
|               |                                                      |
|               | -   Provide a secure processing environment          |
|               |     including redundancy, backup and fault-tolerance |
|               |     services.                                        |
|               |                                                      |
|               | For further information, consult the Department of   |
|               | Commerce's [*Guidance to Operating Units on CIO      |
|               | Roles and                                            |
|               | Responsibiliti                                       |
|               | es*](http://www.doc.gov/cio/itmhweb/CIOGUIDEFIN.htm) |
|               | online.                                              |
+---------------+------------------------------------------------------+
| IT Security   | -   Serve as the Census Bureau's security authority  |
| Officer       |     and central point of contact for its IT security |
|               |     program for all sensitive, but unclassified IT   |
|               |     systems;                                         |
|               |                                                      |
|               | -   Develop and maintain Census Bureau IT security   |
|               |     policy, procedures, standards, and guidance      |
|               |     consistent with Department of Commerce and       |
|               |     Federal requirements;                            |
|               |                                                      |
|               | -   Ensure that all systems have in place effective, |
|               |     quality security documentation, including:       |
|               |                                                      |
|               |     -   A qualitative [risk                          |
|               |         assessment](#what-is-a-risk-a                |
|               | ssessment-and-how-does-it-help-secure-it-resources); |
|               |                                                      |
|               |     -   Current and effective [IT security           |
|               |         plans](#what-is-it-security-planning) that   |
|               |         accurately reflect system status (audit the  |
|               |         systems);                                    |
|               |                                                      |
|               |     -   Annual system                                |
|               |         [self-assessments](#                         |
|               | operating-unit-program-and-system-self-assessments); |
|               |                                                      |
|               |     -   Current and tested [contingency              |
|               |         plans](#contingency-planning): and           |
|               |                                                      |
|               |     -   Current [certification and                   |
|               |         accredi                                      |
|               | tation](#system-certification-and-accreditation-ca). |
|               |                                                      |
|               | -   Conduct                                          |
|               |     [self-assessments](                              |
|               | #operating-unit-program-and-system-self-assessments) |
|               |     of the Census Bureau's IT security program       |
|               |     annually to ensure the effective implementation  |
|               |     of and compliance with established policies and  |
|               |     procedures;                                      |
|               |                                                      |
|               | -   Establish a management control process to assure |
|               |     that appropriate administrative, physical and    |
|               |     technical safeguards are incorporated into all   |
|               |     new computer applications, modified or upgraded  |
|               |     systems and specifications for IT procurement;   |
|               |                                                      |
|               | -   Establish procedures for an IT security          |
|               |     [awareness and training                          |
|               |     pro                                              |
|               | gram](#it-security-awareness-training-and-education) |
|               |     for all Census Bureau personnel, including       |
|               |     specialized training as necessary for systems    |
|               |     administrators, Contracting Officer's Technical  |
|               |     Representatives (COTRs), etc.;                   |
|               |                                                      |
|               | -   Maintain the [IT system                          |
|               |     inventory](#it-system-inventory-management)      |
|               |     tracking and provide updated inventories to the  |
|               |     Department of Commerce IT Security Program       |
|               |     Manager semi-annually;                           |
|               |                                                      |
|               | -   Act as the Census Bureau's central point of      |
|               |     contact for all incidents (and reporting the     |
|               |     same to the [Department of Commerce              |
|               |     CIRT](https://www.cirt.doc.gov/));               |
|               |                                                      |
|               | -   Provide information to systems administrators    |
|               |     and others concerning risks and potential risks  |
|               |     to systems;                                      |
|               |                                                      |
|               | -   Assure that stringent security regulations,      |
|               |     policies, procedures and controls are in place   |
|               |     to protect the confidentiality of Census Bureau  |
|               |     data required by Title 13 and the Privacy Act,   |
|               |                                                      |
|               | -   Participate as a voting member of the            |
|               |     [Department of Commerce IT Security Coordinating |
|               |     Committee](#section) (ITSCC), participate in     |
|               |     special committees under the [ITSCC](#section),  |
|               |     and providing other support for the ITSCC as     |
|               |     appropriate; and                                 |
|               |                                                      |
|               | -   Coordinate with the Department of Commerce [IT   |
|               |     Security Program Manager](#ITSM) as well as OSY  |
|               |     and [OIG](#the-office-of-inspector-general-oig)  |
|               |     as appropriate (concerning incidents, potential  |
|               |     threats, and other concerns).                    |
+---------------+------------------------------------------------------+
| Technical     | -   Oversee the technical implementation and         |
| Security and  |     management of the IT security program;           |
| Review and    |                                                      |
| Policy Staff  | -   Ensure the implementation of proper procedures   |
|               |     and safeguards for protection of IT resources    |
|               |     and the confidentiality of program and           |
|               |     administrative data;                             |
|               |                                                      |
|               | -   Participate in special subcommittees to resolve  |
|               |     Department of Commerce and Census Bureau IT      |
|               |     security issues;                                 |
|               |                                                      |
|               | -   Ensure that a Division Security Officer (DSO)    |
|               |     and alternate is designated for each division;   |
|               |                                                      |
|               | -   Establish and maintain a list of all IT systems  |
|               |     within the Census Bureau and provide an          |
|               |     up-to-date list to the Department of Commerce    |
|               |     [IT Security Program Manager](#ITSM) annually;   |
|               |                                                      |
|               | -   Ensure IT security plans are prepared in the     |
|               |     proper format for all sensitive IT systems owned |
|               |     and administered by each division/office;        |
|               |                                                      |
|               | -   Ascertain that a risk analysis is completed for  |
|               |     all sensitive IT systems;                        |
|               |                                                      |
|               | -   Ascertain that Business Recovery Plans (BRP) are |
|               |     developed and updated for all sensitive systems  |
|               |     of each office/division;                         |
|               |                                                      |
|               | -   Maintain a tracking system for implementing the  |
|               |     required controls and accreditation status for   |
|               |     all divisions/offices' sensitive IT systems;     |
|               |                                                      |
|               | -   Act as the central point of contact for          |
|               |     accreditation of all sensitive systems;          |
|               |                                                      |
|               | -   Ensure IT verification reviews are conducted for |
|               |     all sensitive systems every 3 years, or when     |
|               |     significant changes to a system warrant a        |
|               |     review;                                          |
|               |                                                      |
|               | -   Maintain records and ensure reports are          |
|               |     submitted to the Department of Commerce IT       |
|               |     Security Office;                                 |
|               |                                                      |
|               | -   Manage and disseminate information concerning    |
|               |     potential threats;                               |
|               |                                                      |
|               | -   Ensure that each division/office has procedures  |
|               |     for dealing with malicious software (viruses and |
|               |     other destructive programs), along with the      |
|               |     required virus detection/elimination software to |
|               |     protect against such threats;                    |
|               |                                                      |
|               | -   Ensure that each division/office has established |
|               |     a policy against the illegal duplication of      |
|               |     copyrighted software and that all systems are    |
|               |     audited for illegal software at least annually;  |
|               |                                                      |
|               | -   Ensure inventories of all software on each       |
|               |     individual system are maintained to verify that  |
|               |     only legal copies are being used; and            |
|               |                                                      |
|               | -   Approve changes to firewall systems and monitor  |
|               |     effectiveness of security logs.                  |
+---------------+------------------------------------------------------+
| System Owner  | -   Include security considerations in applications  |
|               |     systems procurement or development,              |
|               |     implementation, operation and maintenance, and   |
|               |     disposal activities (i.e., [life                 |
|               |     cycle](#system-life-cycle-management)            |
|               |     management);                                     |
|               |                                                      |
|               | -   Ensure the security of data and application      |
|               |     software residing on their system(s);            |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Serve as the [Designated Approving Authority     |
|               |     (DAA)](#daa) as assigned by the Associate        |
|               |     Director for Information Technology/CIO with     |
|               |     responsibility for accrediting those systems     |
|               |     under his/her responsibility and for ensuring    |
|               |     compliance with system security requirements;    |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Determine and implement an appropriate level of  |
|               |     security (e.g. safeguards and controls)          |
|               |     commensurate with the                            |
|               |     [level](#what-are-the-di                         |
|               | fferent-levels-and-types-of-information-sensitivity) |
|               |     of sensitivity;                                  |
|               |                                                      |
|               | -   Develop and maintain [security                   |
|               |     plans](#what-are-the-primary-s                   |
|               | teps-in-developing-a-comprehensive-it-security-plan) |
|               |     and [contingency plans](#contingency-planning)   |
|               |     for all [general support                         |
|               |     systems](#c.1-what-is-a-general-support-system)  |
|               |     and [major                                       |
|               |     applications](#c.2-what-is-a-major-application)  |
|               |     under their responsibility, which document the   |
|               |     business associations and dependencies of their  |
|               |     system (examine linked IT resources and flow of  |
|               |     information);                                    |
|               |                                                      |
|               | -   Perform [risk                                    |
|               |     assessments](#what-is-a-risk-                    |
|               | assessment-and-how-does-it-help-secure-it-resources) |
|               |     to periodically re-evaluate sensitivity of the   |
|               |     system, risks, and mitigation strategies;        |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Conduct                                          |
|               |     [self-assessments](                              |
|               | #operating-unit-program-and-system-self-assessments) |
|               |     of system safeguards and program elements and    |
|               |     ensure [certification and                        |
|               |     accred                                           |
|               | itation](#system-certification-and-accreditation-ca) |
|               |     of the system;                                   |
|               |                                                      |
|               | -   Report all incidents to the appropriate          |
|               |     [Computer Incident Response                      |
|               |     Capability](#w                                   |
|               | hat-is-a-computer-incident-response-capability-circ) |
|               |     (CIRC) or [Computer Incident Response            |
|               |     Team](#cirt) (CIRT) in a timely manner;          |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Ensure system users have proper IT [security     |
|               |     trai                                             |
|               | ning](#it-security-awareness-training-and-education) |
|               |     (relevant to the system);                        |
|               |                                                      |
|               | -   Ensure IT contracts pertaining to the system     |
|               |     include provisions for necessary security;       |
|               |                                                      |
|               | -   Ensure that access to sensitive data is limited  |
|               |     to those with a "need to know" or "need to use"; |
|               |     and                                              |
|               |                                                      |
|               | -   Ensure systems' personnel are properly           |
|               |     designated, monitored, and trained, including    |
|               |     appointment of an individual to serve as the     |
|               |     Division Security Officer or IT System Security  |
|               |     Officer (DSO/ITSSO) if appropriate (large,       |
|               |     complex systems may have a greater need for a    |
|               |     DSO/ITSSO than might a small, simple system).    |
+---------------+------------------------------------------------------+
| Division      | -   Implement the system-level controls and maintain |
| Security      |     system documentation;                            |
| Officer or IT |                                                      |
| System        | -   Advise the system owner regarding security       |
| Security      |     considerations in applications systems           |
| Officer       |     procurement or development, implementation,      |
| (DSO/ITSSO)   |     operation and maintenance, and disposal          |
|               |     activities (i.e., [life                          |
|               |     cycle](#system-life-cycle-management)            |
|               |     management);                                     |
|               |                                                      |
|               | -   Certify that security requirements of sensitive  |
|               |     systems are being met;                           |
|               |                                                      |
|               | -   Assist in the determination of an appropriate    |
|               |     level of system and physical security            |
|               |     commensurate with the                            |
|               |     [level](#what-are-the-di                         |
|               | fferent-levels-and-types-of-information-sensitivity) |
|               |     of sensitivity;                                  |
|               |                                                      |
|               | -   Assist in the development and maintenance of     |
|               |     [security                                        |
|               |     plans](#what-are-the-primary-s                   |
|               | teps-in-developing-a-comprehensive-it-security-plan) |
|               |     and [contingency plans](#contingency-planning)   |
|               |     (e.g. Business Recovery Plans) for all [general  |
|               |     support                                          |
|               |     systems](#c.1-what-is-a-general-support-system)  |
|               |     and [major                                       |
|               |     applications](#c.2-what-is-a-major-application)  |
|               |     under their responsibility;                      |
|               |                                                      |
|               | -   Participate in [risk                             |
|               |     assessments](#what-is-a-risk-                    |
|               | assessment-and-how-does-it-help-secure-it-resources) |
|               |     to periodically re-evaluate sensitivity of the   |
|               |     system, risks, and mitigation strategies;        |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Participate in                                   |
|               |     [self-assessments](                              |
|               | #operating-unit-program-and-system-self-assessments) |
|               |     of system safeguards and program elements and in |
|               |     [certification and                               |
|               |     accred                                           |
|               | itation](#system-certification-and-accreditation-ca) |
|               |     of the system;                                   |
|               |                                                      |
|               | -   Report all incidents to the appropriate          |
|               |     [Computer Incident Response                      |
|               |     Capability](#w                                   |
|               | hat-is-a-computer-incident-response-capability-circ) |
|               |     (CIRC) or [Computer Incident Response            |
|               |     Team](#cirt) (CIRT) in a timely manner;          |
|               |                                                      |
|               | -   Attend security awareness training and programs; |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Maintain a cooperative relationship with         |
|               |     business partners or other interconnected        |
|               |     systems;                                         |
|               |                                                      |
|               | -   Provide input into the preparation of reports to |
|               |     the Department of Commerce and other authorities |
|               |     concerning national security;                    |
|               |                                                      |
|               | -   Maintain an inventory of hardware and software   |
|               |     in the office/ division; and                     |
|               |                                                      |
|               | -   Handle and investigate                           |
|               |     [incidents](#what-is-a-reportable-incident) in   |
|               |     cooperation with and under direction of the IT   |
|               |     Security Officer.                                |
+---------------+------------------------------------------------------+
| S             | -   Assist in the development and maintenance of     |
| ystem/Network |     [security plans](#_Hlt15712896) and [contingency |
| A             |     plans](#contingency-planning) for all [general   |
| dministrators |     support                                          |
|               |     systems](#c.1-what-is-a-general-support-system)  |
|               |     and [major                                       |
|               |     applications](#c.2-what-is-a-major-application)  |
|               |     under their responsibility;                      |
|               |                                                      |
|               | -   Participate in [risk                             |
|               |     assessments](#what-is-a-risk-                    |
|               | assessment-and-how-does-it-help-secure-it-resources) |
|               |     to periodically re-evaluate sensitivity of the   |
|               |     system, risks, and mitigation strategies;        |
|               |                                                      |
|               | ```{=html}                                           |
|               | <!-- -->                                             |
|               | ```                                                  |
|               | -   Participate in                                   |
|               |     [self-assessments](                              |
|               | #operating-unit-program-and-system-self-assessments) |
|               |     of system safeguards and program elements and in |
|               |     [certification and                               |
|               |     accred                                           |
|               | itation](#system-certification-and-accreditation-ca) |
|               |     of the system;                                   |
|               |                                                      |
|               | -   Evaluate proposed technical security controls to |
|               |     assure proper integration with other system      |
|               |     operations;                                      |
|               |                                                      |
|               | -   Identify requirements for resources needed to    |
|               |     effectively implement technical security         |
|               |     controls;                                        |
|               |                                                      |
|               | -   Ensure integrity in implementing and operating   |
|               |     technical security controls;                     |
|               |                                                      |
|               | -   Report all incidents to the appropriate          |
|               |     [Computer Incident Response                      |
|               |     Capability](#w                                   |
|               | hat-is-a-computer-incident-response-capability-circ) |
|               |     (CIRC) or [Computer Incident Response            |
|               |     Team](#cirt) (CIRT) in a timely manner;          |
|               |                                                      |
|               | -   Read and understand all applicable [training and |
|               |     aware                                            |
|               | ness](#it-security-awareness-training-and-education) |
|               |     materials;                                       |
|               |                                                      |
|               | -   Read and understand all applicable [use policies |
|               |     or other rules of                                |
|               |     behavior](#what-are-rules-                       |
|               | of-behavior-and-how-does-the-census-bureau-use-them) |
|               |     regarding use or abuse of Census Bureau IT       |
|               |     resources;                                       |
|               |                                                      |
|               | -   Develop system administration and operational    |
|               |     procedures and manuals;                          |
|               |                                                      |
|               | -   Evaluate and develop procedures that assure      |
|               |     proper integration of service continuity with    |
|               |     other system operations;                         |
|               |                                                      |
|               | -   Inventory those systems or parts of systems for  |
|               |     which they are directly responsible (e.g.,       |
|               |     network equipment, servers, LAN, application     |
|               |     administration, etc.);                           |
|               |                                                      |
|               | -   Know the [sensitivity of the                     |
|               |     data](#what-are-the-di                           |
|               | fferent-levels-and-types-of-information-sensitivity) |
|               |     they handle and take appropriate measures to     |
|               |     protect it; and                                  |
|               |                                                      |
|               | -   Know and abide by all applicable Department of   |
|               |     Commerce and Census Bureau policies and          |
|               |     procedures.                                      |
+---------------+------------------------------------------------------+
| End Users     | -   Read and understand all applicable [training and |
|               |     aware                                            |
|               | ness](#it-security-awareness-training-and-education) |
|               |     materials;                                       |
|               |                                                      |
|               | -   Use government systems for official business use |
|               |     only;                                            |
|               |                                                      |
|               | -   Read and understand all applicable [use policies |
|               |     or other rules of                                |
|               |     behavior](#what-are-rules-                       |
|               | of-behavior-and-how-does-the-census-bureau-use-them) |
|               |     regarding use or abuse of Census Bureau IT       |
|               |     resources including authentication and access    |
|               |     control policies (e.g. passwords, user ids);     |
|               |                                                      |
|               | -   Know which systems or parts of systems for which |
|               |     they are directly responsible (printer, desktop, |
|               |     browser, etc.);                                  |
|               |                                                      |
|               | -   Know the [sensitivity of the                     |
|               |     data](#what-are-the-di                           |
|               | fferent-levels-and-types-of-information-sensitivity) |
|               |     they handle and taking appropriate measures to   |
|               |     protect it;                                      |
|               |                                                      |
|               | -   Report all incidents to the appropriate          |
|               |     [Computer Incident Response                      |
|               |     Capability](#w                                   |
|               | hat-is-a-computer-incident-response-capability-circ) |
|               |     (CIRC) or [Computer Incident Response            |
|               |     Team](#cirt) (CIRT) in a timely manner; and      |
|               |                                                      |
|               | -   Know and abide by all applicable Department of   |
|               |     Commerce and Census Bureau policies and          |
|               |     procedures.                                      |
|               |                                                      |
|               | End user's responsibilities center upon being:       |
|               |                                                      |
|               | -   Aware of the                                     |
|               |     [sensitivity](#what-are-the-di                   |
|               | fferent-levels-and-types-of-information-sensitivity) |
|               |     and proper handling method of sensitive          |
|               |     information;                                     |
|               |                                                      |
|               | -   Vigilant in performing necessary security        |
|               |     procedures in order to maintain the integrity of |
|               |     and protect the confidentiality of Title 13,     |
|               |     Privacy Act and other sensitive data. This is    |
|               |     especially true of the [Internet use             |
|               |     policy](#web-servers-and-e-mail-server-security) |
|               |     specifying the end user's responsibility         |
|               |     regarding Internet introduction of viruses,      |
|               |     [spam](#c.3-what-is-spam), and malicious codes,  |
|               |     normally introduced into a system by a voluntary |
|               |     act of an end user (e.g., installation of an     |
|               |     application, FTP of a file, reading mail, etc.); |
|               |     and                                              |
|               |                                                      |
|               | -   Informed by completing all required user         |
|               |     [training and                                    |
|               |     aware                                            |
|               | ness](#it-security-awareness-training-and-education) |
|               |     and understanding and abiding by the [Rules of   |
|               |     Behavior](#what-are-rules-o                      |
|               | f-behavior-and-how-does-the-census-bureau-use-them). |
+---------------+------------------------------------------------------+

### What are specific guidelines for managing individuals with security responsibilities at the Census Bureau?

> The Following guidelines apply for managing individuals with security
> responsibilities:

-   The head of each division or office, in consultation with their
    servicing [Office of Human Resource
    Management](#the-office-of-human-resource-management-hrd), shall
    ensure that each employee position in their division or office,
    including positions filled by contractors, is designated at the
    appropriate level of position sensitivity and/or risk in accordance
    with the [Department of Commerce Security Manual, Chapter
    10](http://www.osec.doc.gov/osy/SECURITYMANUAL/Chapter10.htm#Chapter 10).
    They must also ensure that this designation is clearly stated in the
    employee's position description so that the Department of Commerce
    Office of Security at the Census Bureau can perform suitable
    background investigations for individuals filling these positions.

```{=html}
<!-- -->
```
-   Where feasible, the appropriate system owner and CIO will separate
    sensitive positions to preclude any one individual from gaining the
    opportunity to adversely affect any system. The IT Security Officer
    will ensure that system owners define procedural checks and balances
    for personnel security in system security plans and enforce these
    controls so accountability is established and security violations
    are detectable.

-   The system owner will grant access privileges based on a legitimate
    need to have system access (e.g. "need to know" or "need to use"),
    and re-evaluate the access privileges annually. The system owner
    will grant individuals the fewest possible privileges necessary for
    job performance and any privileges not specifically granted are
    denied.

-   The system owner will establish appropriate rules of behavior for
    all systems. These rules must apply to all personnel managing,
    administering, or having access to any Census Bureau IT system.

-   The IT Security Officer will establish a process to ensure that all
    users are provided with periodic security awareness briefings,
    copies of Rules of Behavior, and trained to fulfill their IT
    security responsibilities.

```{=html}
<!-- -->
```
-   The IT Security Officer will establish a process to ensure access
    privileges are revoked in a timely manner when the requirement for
    access ceases (e.g., transfer, resignation, retirement, change of
    job description, etc.) \-- immediately for individuals being
    separated for adverse reasons just prior to notifying them of the
    pending action.

-   All of the responsibilities in this policy apply equally to services
    performed by contractor personnel.

### How can I best assign security responsibilities in my organization?

> Responsibilities should be assigned based on "ownership" or stake
> holding by the CIO. In short, the person who pays the bill for
> operation of the IT resource must accept the risk associated with that
> system (e.g., division/office chief). The [certification and
> accreditation](#system-certification-and-accreditation-ca) process
> includes assigning responsibility to those who already bear the
> program responsibility and have budgetary control. Also, ensure to
> provide for [segregation of duties](#separation_of_duties) when
> assigning responsibilities. Finally, examine the interdependencies and
> interconnection of any given IT resource and be sure to provide
> sufficient supervision and management coordination between system
> owners (this is usually best supervised at the highest management
> level).

### Where can I find further guidance on management of personnel with IT security responsibilities?

> The Census Bureau recommends the practices and further guidance that
> can be found in:

-   The *[Department of Commerce Recommended ITS Program
    Structure](http://www.osec.doc.gov/cio/oipr/ITSec/DOC-prog9-28-01.htm),*
    Chapter 3; and

-   *Security Programs,* [DAO
    207-1](http://www.osec.doc.gov/omo/daos/207-1.htm).

## IT Security department-wide Coordination

###  {#section .unnumbered}

### How is IT Security coordinated within the Department of Commerce?

> The Department of Commerce CIO sponsors the [IT Security Coordinating
> Committee](#section). This group serves as a Department-wide forum for
> addressing issues and making recommendations related to IT security
> responsibilities and activities.

[]{#_What_is_a_system_owner%3F .anchor}

# IT Security Planning

## IT Security Plans

### What is IT security planning?

> IT security planning is an important quality control tool for the
> Census Bureau that helps improve the level of protection of IT assets.
> All federal systems have some level of sensitivity and require
> protection as part of good management practices.
>
> The IT security planning process encompasses the following components:

-   Documentation of management, technical and operational controls in a
    security plan for a system;

-   Certification and accreditation of the system; and

-   Security training, awareness, and education.

> When a management official within the Census Bureau authorizes the
> operating of a system, the manager accepts the associated risk due to
> loss of information, misuse of the system, unauthorized access or
> modification to the system, unavailability of the system, and/or
> undetected activities within the system. Good security planning,
> therefore, serves an important risk management function by providing
> the necessary information to determine the type and level of risks and
> to base decisions on acceptance or mitigation of the risk.
>
> Managers must also be assured that all personnel accessing the system,
> from those performing system management functions to general users,
> have received security training at levels commensurate with the duties
> they perform.

### What is included in an IT security plan?

> The [Computer Security Act of 1987](#csa_of_1987) and [OMB Circular
> A-130](#OMBA130) require all [major
> applications](#c.2-what-is-a-major-application) and [general support
> systems](#c.1-what-is-a-general-support-system) to have a security
> plan. An IT security plan provides an overview of the sensitivity
> [levels and
> types](#what-are-the-different-levels-and-types-of-information-sensitivity)
> of data processed or stored in a system and the related security
> requirements to protect the data. It also describes the controls in
> place and planned for meeting those requirements. The system security
> plan provides all of the information necessary to secure an IT system
> throughout the system's [life cycle](#system-life-cycle-management),
> including:

-   An overview of the security requirements of the system and the
    information processed;

-   A delineation of the responsibilities and expected behavior of all
    individuals who access the system (including [Rules of Behavior or
    Acceptable Use
    Policies](#what-are-rules-of-behavior-and-how-does-the-census-bureau-use-them));

-   Information and agreement regarding interconnections with other
    systems; and

-   Other information necessary for the operation and maintenance of the
    system.

### What elements does the Department of Commerce and Census Bureau require (format and content) for an IT security plan?

> National Institute of Standards and Technology Special Publication
> 800-18, [*Guide for Developing Security Plans for Information
> Technology
> Systems*](http://csrc.ncsl.nist.gov/publications/nistpubs/800-18/Planguide.PDF),
> provides the standard in use by the Department of Commerce and the
> Census Bureau. The level of detail in the plan should be commensurate
> with the criticality and value of the system to the organization's
> mission and the sensitivity of the data maintained in the system.
>
> IT Security Officers must insure system owners include, and completely
> address, the following elements in their respective IT security plans:

-   [Management controls](#management_controls) pertaining to the
    system;

-   [Operational controls](#operational_controls) of the system;

-   [Technical controls](#technical_controls) included in the system;

-   Approved
    [waivers](#what-if-requirements-of-the-department-of-commerce-or-census-bureau-it-security-program-policy-cannot-be-met)
    to Department of Commerce policy; and

-   Memoranda of Agreement/Memoranda of Understanding with regard to
    security controls over shared systems;

The [System Security Plan Certification and Accreditation
Package](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package)
that leads to the accreditation of a system must include the system's
approved IT security plan. Templates for completing IT security plans
for Major Applications and General Support Systems are available on the
IT Security Web site under Planning.

### When is an IT security plan required? 

> Security plans must be completed:

-   Upon or prior to authorization of a new system to process
    information or operate;

-   Whenever a significant processing change is made; or,

-   At least every 3 years and more often if a system is considered high
    risk.

### What are the primary steps in developing a comprehensive IT security plan?

![](media/image2.wmf){width="5.986111111111111in"
height="3.5118055555555556in"}

## System Life Cycle Management

The formal process of securing an IT system must begin as soon as a
system owner identifies requirements for an IT system. The system owner,
with guidance and support of the [Information Technology Security
Officer](#ITSO), [Chief Information Officer](#CIO) (CIO), and other
security-focused authorities within the organization, can then begin
developing the system security plan and start integrating security into
all stages of the life cycle of the Census Bureau IT system, which
include:

-   [Initiation](#initiation-stage);

-   [Development/acquisition](#developmentacquisition-stage);

-   [Implementation](#implementation-stage);

-   [Operation and maintenance](#operation-and-maintenance-stage); and

-   [Disposal](#disposal-stage) (retirement or decommission).

### Initiation Stage

### How is security considered in the initiation stage of the life cycle of an IT system?

> The first stage in the system life cycle is IT system identification,
> which includes obtaining a CIO-assigned system identifier (used to
> track the system in the [IT system
> inventory](#it-system-inventory-management) and on [budget
> documentation](#how-is-security-considered-in-the-funding-an-it-system)).
> This stage also involves:

-   [Designing](#how-is-security-considered-in-designing-an-it-system)
    the system and performing a [risk
    assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
    of the design;

-   Determining the [level of sensitivity and
    type](#what-are-the-different-levels-and-types-of-information-sensitivity)
    of data processed by the system during the risk assessment; and

-   Using these data sensitivity determinations to establish the
    criticality of the system to the mission of the Census Bureau.

### How is security considered in designing an IT system?

> Within the Census Bureau, designing a system requires the IT Security
> Officer and the DSO to work with the system owners to determine the
> [sensitivity
> levels](#what-are-the-different-levels-and-types-of-information-sensitivity)
> of the system based upon the requirements for
> [availability](#availability), [integrity](#integrity), and
> [confidentiality](#confidentiality). System owners must then identify
> the security controls that provide adequate, cost-effective
> protection. Moreover, these parties must work to ensure integration of
> the system security configuration into the overall IT architecture of
> the Census Bureau.

The Enterprise Architecture (EA) Team, in the Systems Support Division
(SSD), works closely with the ISSRO and the ITSO offices to support the
integration of security principles and practices into all Census Bureau
IT architectures. The EA team's primary function is to be a strategic
resource that aligns business and technology, leverages-shared assets,
builds partnerships, and optimizes the value of IT services. By serving
as a cross-functional organization, the EA provides a necessary linkage
between the IT Business Plans, Security Standards, and IT Strategic
planning.

> Following Bureau-wide standards facilitates the sharing of information
> internally (e.g., agency-wide e-mail) and reduces the number of
> duplicative information systems. The Census Bureau IT Security Office
> can provide information on standards to guide the design of new
> systems. Office of Management (OMB) and Budget Memorandum [M-97-16,
> Information Technology
> Architectures](http://www.whitehouse.gov/omb/memoranda/m97-16.html)
> and the Federal CIO Council's [Federal Enterprise Architecture
> Framework](http://www.cio.gov/Documents/fedarch1.pdf) describe the
> federal requirements for enterprise architecture design and can also
> be used as a reference for Census Bureau system owners.

### What is "sensitive" information?

> Office of Management and Budget [Circular A-130, Appendix
> III](http://csrc.nist.gov/secplcy/a130app3.txt), *Security of Federal
> Automated Information Resources*, states that there is a "presumption
> that all [general support
> systems](#c.1-what-is-a-general-support-system) contain some sensitive
> information." [The Computer Security Act of
> 1987](http://csrc.nist.gov/secplcy/csa_87.txt) (P.L. 100-235) provides
> the following definition of the term *sensitive* information:
>
> > "...any information, the loss, misuse, or unauthorized access to or
> > modification of which could adversely affect the national interest
> > or the conduct of federal programs, or the privacy to which
> > individuals are entitled under section 552a of title 5, United
> > States Code (the Privacy Act), but which has not been specifically
> > authorized under criteria established by an Executive Order or an
> > Act of Congress to be kept secret in the interest of national
> > defense or foreign policy."
>
> The term *sensitive* refers to either unclassified, private data and
> proprietary information or highly classified national security
> government information. Title 13 and Title 26 data maintained, stored,
> and processed by the Census Bureau are considered "sensitive," but
> unclassified.

### What are the different levels and types of information sensitivity?

> Information sensitivity may vary from low to medium to high and
> applies to classified and unclassified information. Typically, the
> Census Bureau does not maintain, process or transmit data that are
> considered "classified." However, references and explanations of
> classified systems are provided for informational purposes.
>
> During the system [risk
> assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources),
> the system or information owner must determine the sensitivity, or
> value, of the system and the data stored or processed based on the
> system's link to the Census Bureau's mission. This determination,
> along with the likelihood of compromise occurring, establishes the
> level of security adequate to protect the data as required by [OMB
> Circular
> A-130](http://www.whitehouse.gov/omb/circulars/a130/a130.html),
> Appendix III.
>
> When determining the degree of sensitivity of a system, a system owner
> must typically consider the following three factors:

-   Nature of the system and corresponding requirements for
    confidentiality, integrity and availability;

-   Statutory or agency requirements; and

-   Criticality of the system to the mission of the Census Bureau

> The NIST Computer Security Laboratory Bulletin [*Sensitivity of
> Information*](http://csrc.nist.gov/publications/nistbul/csl92-11.txt),
> protecting unclassified *sensitive* information, which includes For
> Official Use Only (FOUO), Sensitive But Unclassified (SBU), and U.S.
> Code or Public Law, provides the following definitions for
> confidentiality, integrity, and availability:

-   []{#confidentiality .anchor}**Confidentiality**: information must be
    protected from unauthorized disclosure. Access is restricted to
    designated parties to ensure privacy of personal information and
    non-publication of sensitive mission data.

```{=html}
<!-- -->
```
-   []{#integrity .anchor}**Integrity**: information must be protected
    from errors and unauthorized or unintentional modification.

```{=html}
<!-- -->
```
-   []{#availability .anchor}**Availability**: information must be
    available on a timely basis to support business functions of the
    Census Bureau (i.e. protected against destruction).

> While all government information may require protection, certain
> statute or agency determinations impose additional security
> requirements, such as:

-   Personal information (protected under the [Privacy
    Act](http://www.doc.gov/cio/oipr/PRIVACY.HTML));

-   Financial information (protected under the [Federal Manager\'s
    Financial Integrity
    Act](http://www.ustreas.gov/tcfoc/mcp/fmfia-legislation.pdf)
    (FMFIA);

-   Taxpayer information ([Title 26 U.S.
    Code](http://www.access.gpo.gov/uscode/title26/title26.html));

-   Individual census data, which includes any information collected,
    processed, or used to support the mission of the Census Bureau
    ([Title 13 U.S. Code, Section 9 -
    Confidentiality](http://www.access.gpo.gov/uscode/title13/title13.html));

-   Personnel data (Title 5 U.S. Code); and

-   Federal records (Federal Records Act, [Title 44 U.S. Code Chapter
    31](http://www.access.gpo.gov/uscode/title44/chapter31_.html) and
    [Title 36 Code of Federal Regulations Volume 3 Chapter XII sections
    1220-1260](http://www.access.gpo.gov/nara/cfr/waisidx_01/36cfrv3_01.html)).

> The mission of the Census Bureau must also be factored into the
> determination of sensitivity. For example, the availability level of
> geography data at the Census Bureau would be rated as "High" due to
> the continual need for the information. As a guide, the following
> ranges are provided to assist in your determination of information
> sensitivity. A determination of medium would apply if the data does
> not fit in either of the low or high categories.

-   **Confidentiality**:

    -   *LOW*: applies to publicly available information; and

    -   *HIGH*: applies to [classified national security
        information](#how-does-sensitive-unclassified-information-differ-from-classified-national-security-information).

-   **Integrity**:

```{=html}
<!-- -->
```
-   *LOW*: applies to data that have no impact on the Census Bureau's
    mission; and

-   *HIGH*: reflects that Public Law or the Census Bureau requires the
    data to be protected.

```{=html}
<!-- -->
```
-   **Availability**:

```{=html}
<!-- -->
```
-   *LOW*: indicates the data could be unavailable for more than 30 days
    without significant mission impairment; and

-   *HIGH*: requires the data to be restored within 72 hours of the loss
    or damage to the system to ensure mission continuity.

The table on the following page provides examples of the application of
the information sensitivity levels.

  ----------------------------------------------------------------------------
  **Data type**     **Confidentiality**   **Integrity**     **Availability**
  ----------------- --------------------- ----------------- ------------------
  Classified        **High**: need to     **High**: need to **High:**
  personnel         prevent access by     preserve          necessary for
  information       individuals without   integrity to      tracking status of
                    appropriate           adhere to federal personnel within
                    clearance; compromise law and preserve  72 hours.
                    could jeopardize      privacy of        
                    national security.    individuals.      

  Sensitive But     **High**: need to     **High**: law     **Medium**: can be
  Unclassified      prevent unauthorized  requires Census   unavailable more
  Title 13 data and access.               Bureau to         than 72 hours, but
  tax data                                maintain accuracy less than 30 days.
                                          of Title 13 data  
                                          and data is vital 
                                          to Bureau's       
                                          mission.          

  Unclassified IT   **Low**: data issued  **High**: need to **Low**: can be
  Investment cost   in form of            ensure accuracy   unavailable for
  data              anticipated IT        of costs to       more than 30 days.
                    investment costs to   obtain funding    
                    OMB and the general   and maintain      
                    public.               confidence of     
                                          public            
  ----------------------------------------------------------------------------

### What is the relationship between information sensitivity levels and system criticality?

> System owners must use the system's confidentiality, integrity, and
> availability [data sensitivity
> levels](#what-are-the-different-levels-and-types-of-information-sensitivity)
> to ascribe the criticality of the system to the mission of the Census
> Bureau. For example, if all three elements are rated "high," the
> criticality would be correspondingly "high." If the level for each of
> the three elements varies, system owners must use their judgment to
> weigh the levels of each element to determine the criticality. Keep in
> mind that system sensitivity should be reassessed at each stage of the
> system lifecycle.

### How does sensitive unclassified information differ from classified national security information?

The confidentiality-based classification system for national security
information pertains only to "classified" information. National security
classifications include "Confidential," "Secret," and "Top Secret."
While this system mandates certain controls for protecting classified
data from unauthorized disclosure, the sensitive, unclassified
information system provides a means for protecting federal unclassified
computer systems from unauthorized modification, destruction or
disclosure. Refer to the Department of Commerce Security Manual,
Chapters 17 and 41 for more guidance on the handling of national
security, FOUO, and SBU information in hard copy form.

### What are some examples of information types and necessary controls?

System owners and data owners should work together to select management,
technical, and operational controls that are commensurate with the risk
and magnitude of harm resulting from loss, misuse, or unauthorized
access to the data. It is ultimately up to the system owner to determine
how an adequate level of protection can be achieved in a cost-effective
manner.

The table on the following page illustrates some examples of information
types as well as some controls necessary to protect the information.

+-----------------------------------+-----------------------------------+
| **Type of Information**           | **Necessary Security Control**    |
+===================================+===================================+
| Contact information such as       | -   Ensure confidentiality of     |
| telephone numbers or e-mail       |     personal information; and     |
| addresses and/or mailing          |                                   |
| addresses                         | -   Safeguard integrity of the    |
|                                   |     information to maintain       |
|                                   |     accuracy.                     |
+-----------------------------------+-----------------------------------+
| Correspondence on topics          | -   Preserve confidentiality of   |
| pertaining to the mission and     |     information by limiting       |
| work of the Census Bureau,        |     access to authorized parties; |
| intra-agency information (e.g.,   |                                   |
| internal announcements in the     | -   Ensure availability of the    |
| form of departmental or operating |     resource that stores federal  |
| unit memoranda), critical         |     records; and                  |
| information used to support the   |                                   |
| mission that is not publicly      | -   Ensure integrity of federal   |
| released, and inter-agency        |     records.                      |
| information exchanged between the |                                   |
| Census Bureau and another agency  |                                   |
+-----------------------------------+-----------------------------------+
| Proprietary information (e.g.,    | -   Preserve confidentiality of   |
| confidential business             |     the information by limiting   |
| information, grant applications,  |     disclosure to authorized      |
| personnel data, and contracting   |     parties;                      |
| data, Title 13 data)              |                                   |
|                                   | -   Ensure integrity of data by   |
|                                   |     controlling access to data    |
|                                   |     and monitoring queries; and   |
|                                   |                                   |
|                                   | -   Provide for availability of   |
|                                   |     the resources that manage the |
|                                   |     information.                  |
+-----------------------------------+-----------------------------------+
| Accounting data and information   | -   Maintain controls required by |
| covered under statutes that       |     the [Federal Manager\'s       |
| govern its use or dissemination   |     Financial Integrity           |
| (e.g., payroll, funds             |     Act](http://www.ustreas.gov   |
| disbursement information, Privacy | /tcfoc/mcp/fmfia-legislation.pdf) |
| Act information, FOIA, Title 23,  |     and prevent disclosure to     |
| Title 26).                        |     unauthorized parties.         |
+-----------------------------------+-----------------------------------+
| Mission data being readied for    | -   Ensure integrity and          |
| public release (e.g., policies,   |     availability of the           |
| charts, maps, economic reports,   |     information for interested    |
| etc.)                             |     parties.                      |
+-----------------------------------+-----------------------------------+
| Planning or configuration         | -   Preserve confidentiality of   |
| information for applications or   |     the information by limiting   |
| other support systems             |     disclosure to authorized      |
|                                   |     parties; and                  |
|                                   |                                   |
|                                   | -   Monitor integrity of the      |
|                                   |     information ensuring it is    |
|                                   |     accurate and up-to-date.      |
+-----------------------------------+-----------------------------------+

> More information, including an [Information Sensitivity Policy
> template](http://www.sans.org/newlook/resources/policies/Information_Sensitivity_Policy.pdf),
> is available on the System Administration, Networking, and Security
> (SANS) Security Policy Project site. Additional information on
> sensitivity classification may be obtained in [Section 3.7 of NIST SP
> 800-18: *Guide for Developing Security Plans for Information
> Technology
> Systems*](http://csrc.nist.gov/publications/nistpubs/800-18/Planguide.PDF).

### Development/Acquisition Stage

### How is security considered in the development/acquisition stage in the life cycle of an IT system?

> The second stage in the system life cycle requires consideration of IT
> security as the system is designed, built in-house, or acquired from a
> vendor. In this stage, the system owner must:

-   Determine the system security requirements (operational and
    technical controls);

-   Update the [system security plan;](#_Hlt15712896)

-   [Fund](#how-is-security-considered-in-the-funding-an-it-system) the
    system;

-   Ensure security is addressed in IT acquisitions;

-   Develop a [contingency plan](#contingency-planning);

-   Develop [vulnerability test plans](#vulnerability_test_plan) and
    test schedules; and

-   Establish [configuration
    management](#what-documentation-must-be-maintained-to-adequately-track-and-record-changes-to-a-system)
    of all system documentation, hardware, and software.

### How is security considered in the funding an IT system?

The system life cycle requires consideration of IT security in the
budget request. The Census Bureau CIO directs the planning, management,
and utilization of all Census Bureau IT resources in accordance with a
Bureau-wide, systematic, planning and budgeting process. In addition,
the CIO ensures that IT acquisitions comply with the Department of
Commerce's capital asset budget planning process and other GSA and OMB
directives and guidelines governing IT resource acquisition.

> [Office of Management and Budget (OMB) Circular
> A-11](http://www.whitehouse.gov/omb/circulars/a11/02toc.html), as well
> as OMB Memorandum [*M-00-07, Incorporating and Funding Security in
> Information Systems
> Investments*](http://www.whitehouse.gov/omb/memoranda/m00-07.html),
> require that security be built into and funded as part of the system
> architecture. It is the responsibility of the Census Bureau CIO to
> ensure security is considered and addressed in IT investments and
> capital programming. Accordingly, proposed Presidential budget
> justification documentation for new or currently operational systems
> must:

-   Show how the investment is tied to the Census Bureau and Department
    of Commerce IT architecture;

-   Be included in a Census Bureau IT Business Plan;

-   Provide information on how the system owner will manage risk;

-   Describe how privacy and confidentiality will be protected; and

-   Account for departures from NIST guidance.

### How can I ensure IT security is provided for in defining the statement of work for the acquisition process?

> IT Security Officers, system owners, Contracting Officers, Contracting
> Officer's Technical Representatives, and others involved in any aspect
> of system security must ensure that IT security is addressed in the
> acquisition process. This is done by placing language in the
> procurement documents that clearly defines requirements for the
> resource or service. The Department of Commerce Acquisition Manual
> (CAM) section 1337.70, [*Security Processing Requirements for On-Site
> Service
> Contracts*](http://oamweb.osec.doc.gov/app/docs/CAM 1337.70.wpd), and
> related [CAM Notice
> 00-02](http://oamweb.osec.doc.gov/app/docs/CAM Notice 00-02.htm),
> provides facility access criteria and contract language for IT service
> contracts. National Institute of Standards and Technology (NIST)
> Special Publication 800-4, *[Computer Security Considerations in
> Federal Procurements: A Guide for Procurement Initiators, Contracting
> Officers, and Computer Security
> Officials](http://csrc.nist.gov/publications/nistpubs/800-4/800-4.zip),*
> provides additional guidance for security considerations in
> procurements. In addition, the Census Bureau Policies and Procedures
> Manual (PPM) provides specific guidance for Census Bureau employees to
> follow when developing statements of work.

### How can I ensure that contractors comply with the Census Bureau IT Security Program Policies?

> Specific language must be included in all applicable contracts to
> ensure compliance with the IT security policies described in this
> document. For purposes of this document, the term "contract" includes
> other procurement vehicles, such as simplified acquisitions, orders
> placed under multiple-award contract, and government-wide agency
> contracts, task orders, IT services purchased by bankcard, etc.
> Contracts must state that:

-   All contractor personnel performing work under the contract and all
    contractor equipment used to process or store Census Bureau data, or
    to connect to Census Bureau networks must comply with 1) the
    policies contained in this document, 2) the requirements contained
    in the Department of Commerce's *Information Technology Management
    Handbook*, and 3) any supporting IT policies and procedures.

-   All contractor personnel requiring access to Tile 13 or Title 26
    data must obtain Special Sworn Status prior to receiving access to
    the data.

-   If the contractor is required to store or process Census Bureau
    Title 13 data, the system owner must submit a memo to the IT
    Security Office documenting:

    -   The contractor's company name and address;

    -   A point of contact;

    -   A general Description of processing; and

    -   The time frame and duration of processing.

    ```{=html}
    <!-- -->
    ```
    -   Approval from the Data Stewardship Executive Policy (DSEP)
        Committee must be obtained prior to the owner sending Title 13
        data to the contractor (For more information see DESP Policy
        *Controlling Non-employee Access to T13 Policy: Non-Employee
        Access Policy*).

-   The contractor must provide an IT security plan that meets the IT
    security requirements of Federal and Census Bureau policies and
    procedures including, but not limited to:

```{=html}
<!-- -->
```
-   OMB Circular A-130, *Management of Federal Information Resources*,
    Appendix III, *Security of Federal Automated Information Resources*;
    and

-   National Institute of Standards and Technology Special Publication
    800-18, *Guide for Developing Security Plans for Information
    Technology Systems*.

```{=html}
<!-- -->
```
-   If the contractor is required to store or process Census Bureau data
    on contractor-owned systems, the contractor shall submit for Census
    Bureau approval a [System Security Plan Certification and
    Accreditation
    Package](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package),
    including an IT Security Plan and a system certification test plan.
    This plan must be consistent with requirements of Federal and Census
    Bureau policies and procedures.

-   ::: Definition-Term
    If the contractor is required to store or process Census Bureau data
    on contractor-owned systems, the contractor shall disclose new or
    unanticipated threats discovered to the Census Bureau, or if
    existing safeguards have ceased to function, the contractor shall
    immediately bring the situation to the attention of the Census
    Bureau. Safeguards shall be instituted in accordance with the
    changes clause in the contract.
    :::

-   ::: Definition-Term
    Contractor personnel requiring privileged access or limited
    privileged access to systems operated for the Census Bureau or
    interconnected to a Census Bureau network shall be screened at the
    appropriate level in accordance with CAM Notice 00-02, *Security
    Processing Requirements for On-Site Service Contracts*.
    :::

```{=html}
<!-- -->
```
-   Contractor personnel requiring privileged access or limited
    privileged access to systems operated for Census Bureau or
    interconnected to a Census Bureau network shall complete annual IT
    security training in Census Bureau IT Security policies, procedures,
    computer ethics, and best practices in accordance with the
    Department of Commerce's *Information Technology Management
    Handbook* requirements.

    -   Contractors shall sign Nondisclosure Agreements certifying that
        contractor employees will not disclose, publish, divulge,
        release, or make known, in any manner or to any extent, to any
        individual other than an appropriate or authorized Government
        employee, the content of any sensitive information provided
        during the course of employment with the Census Bureau.

    -   The contractor shall afford the Census Bureau, including the
        Office of Inspector General, access to the Contractor's and
        subcontractors' facilities, installations, operations,
        documentation, databases and personnel used in performance of
        the contract. Access shall be provided to the extent required to
        carry out an initial inspection and ongoing program of IT
        inspection, investigation, and audit to safeguard against
        threats and hazards to the integrity, availability and
        confidentiality of Census Bureau data or to the function of
        computer systems operated on behalf of the Census Bureau, and to
        preserve evidence of computer crime.

    -   The contractor shall incorporate all of these IT security
        requirements in all subcontracts.

### Implementation Stage

### How is security considered in the implementation stage in the life cycle of an IT system?

> The third stage requires that system owners follow a continuous [risk
> management](#risk-management-and-assessment) process that ensures the
> system is ready for [certification and
> accreditation](#system-certification-and-accreditation-ca) before it
> is placed into operation. During this stage in the system life cycle,
> security controls should be configured and tested prior to moving to
> an operational environment. Once the controls have been deemed
> sufficient, they should be enabled and thoroughly documented for
> future reviews and updates.

### What are some examples of the types of controls to be considered during the implementation stage?

> System owners should consider the following areas during this stage:

-   Physical facilities controls;

-   Personnel security procedures;

-   Use of commercial or in-house network services and appropriate
    controls; and

-   Contingency planning.

### Operation and Maintenance Stage

### How is security considered in the operation and maintenance stage in the life cycle of an IT system?

> The fourth stage in the system life cycle requires consideration of IT
> security in the daily operation of the system. While in production,
> systems are constantly being modified. System owners must, therefore,
> continually reassess where the system is in the lifecycle process and
> document the appropriate measures. This requires that system owners
> follow a continuous [risk management](#risk-management-and-assessment)
> process that includes:

-   Security operations and administration, including maintenance of the
    [system security plan](#_Hlt15712896) and update and testing of the
    [contingency plan](#contingency-planning);

-   Operational assurance, including [vulnerability
    testing](#vulnerability-testing) of system controls for continued
    effectiveness;

-   [Configuration management](#configuration-management) of system
    documentation, hardware, and software;

-   [Audits](#audits) and [monitoring](#what-is-user-monitoring), which
    are periodic assessments of security controls and ongoing activities
    to examine and log either the system or the user system activity in
    a real-time environment; and

-   [Recertification](#when-are-systems-reviewed-for-certificationrecertification-and-accreditation)
    of systems at least every three years.

### Disposal Stage

### How is security considered in the disposal or retirement stage in the life cycle of an IT system?

> The fifth stage in the system life cycle requires consideration of IT
> security upon disposal or retirement of information, hardware, and
> software. In this stage, the system owner must ensure the:

-   Preservation and archival of federal records (historical record
    [integrity](#integrity) and [availability](#availability));

-   Removal (sanitization) of sensitive information from the system
    drives; and

-   Appropriate [destruction or
    recycling](#how-should-electronic-media-be-recycled-or-destroyed-when-no-longer-needed)
    of the system components.

> System owners should consult with the appropriate office at the Census
> Bureau on the requirements for retaining and archiving federal
> records.

## System Certification and Accreditation (C&A)

### Description of C&A

### What is Certification and Accreditation (C&A)?

> Certification and Accreditation (C&A) refers to the formal test
> (certification) and acceptance procedure (accreditation) of system
> security controls for systems containing or processing sensitive data.
> C&A is a process that recognizes, evaluates, and assigns assumptive
> responsibility for the risk of operating an IT system.
>
> Although certification and accreditation are related, they are
> separate procedures and have different objectives. Certification is a
> short-term activity that is repeated after any significant
> system-related change is completed and is a prerequisite for
> accreditation. Accreditation is a long-term authorization, up to three
> years, that allows a system to operate based on the facts, plans, and
> schedules developed during certification.
>
> In the C&A process, the [Designated Approving
> Authority](#who-can-accredit-a-system) (DAA) evaluates tests of
> security controls performed by the [system
> certifier](#who-can-certify-a-system) and determines:

-   Whether the residual risk to the system (that risk which was not
    eliminated by implementation of countermeasures) is acceptable, and

-   Whether the functioning security controls provide adequate
    protection for the system to operate.

### What systems require certification and accreditation?

> [System owners](#_What_is_a_system_owner?) must ensure all Census
> Bureau IT systems containing or processing sensitive information have
> been certified and accredited. Certification is a prerequisite to
> accreditation.

### What is the process for conducting a C&A of a system?

> The Census Bureau requires system owners, system certifiers, and the
> DAA to follow the C&A methodology in National Security
> Telecommunications and Information Systems Security Instruction
> (NSTISSI) No. 1000, [*National Information Assurance Certification and
> Accreditation Process
> (NIACAP)*](http://www.nstissc.gov/Assets/pdf/nstissi_1000.pdf).
>
> Within the Census Bureau, application of this process is mandatory for
> all systems containing or processing sensitive information. However,
> the format and [documentation
> requirements](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package)
> for the security plans within the certification package vary by the
> system category (Major Application or General Support System). For
> additional information on determining system category and
> documentation requirements, refer to the [*NIST Guide for Developing
> Security Plans for Information Technology
> Systems*](http://cww2.census.gov/it/itso/itso_policy.asp?ID=ITSO-01&category=06)
> located on the IT Security Web site.

### When are systems reviewed for certification/recertification and accreditation?

> [System owners](#c.5-what-is-a-system-owner) must ensure that systems
> are certified/recertified and accredited:

-   Prior to the system processing data in an operational computing
    environment;

-   Upon a major change to the system; and

-   At least every three years.

> [System certifiers](#who-can-certify-a-system) may request interim
> accreditation of a system, but system owners must at the same time
> establish a corrective action plan and set a deadline for final
> accreditation. Interim accreditations must be granted in writing by
> the DAA, must be based on credible system documentation, must not
> exceed one year, and cannot be renewed after expiration.

### Where can I find more information on Certification and Accreditation?

> The National Institute of Standards and Technology (NIST) is updating
> its FIPS (Federal Information Processing Standards) Publication 102,
> [*Guideline for Computer Security Certification and
> Accreditation*](http://csrc.nist.gov/publications/fips/index.html). A
> draft NIST Special Publication 800-37, *[Guidelines for the Security
> Certification and Accreditation of Federal Information Technology
> Systems](http://csrc.nist.gov/sec-cert/SP-800-37-v1.0.pdf),* provides
> additional recommended best practices for C&A of IT systems.

### Certification

### What is certification?

> Certification is the comprehensive testing and technical evaluation
> that tests, analyzes, and documents the security controls of a system
> in its operational (or proposed operational) environment.
> Certification primarily addresses software and hardware security
> safeguards but also considers procedural, physical, and personnel
> security measures employed to enforce Census Bureau security policies.
> A [system security plan certification and accreditation
> package](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package)
> consists of the system's [risk
> assessments](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources),
> [self-assessments](#operating-unit-program-and-system-self-assessments),
> [security plan](#security_plan), and [contingency
> plan](#contingency-planning) developed and approved by the system
> owner. An independent analysis and evaluation of these documents
> determines whether the system meets (or will meet) an established set
> of security requirements.

### Who can certify a system?

> To ensure objectivity in the certification results and confidence in
> the recommendation to the system accrediting official, the Census
> Bureau requires that the system certifier must be at least a Census
> Bureau assistant division/office chief who is independent of the
> system owner. The system certifier **cannot** be the same individual
> who [accredits](#what-is-accreditation) the system.
>
> After the DAA identifies the system certifier, the certifier may
> assemble a team of experts to assist in certifying the system,
> including:

-   An Information System Security Officer (ISSO);

-   A system designer;

-   Program officials and system owners;

-   End users of the system; and

-   Others experienced in assessment of system security controls.

### What does the system certifier do?

> The [system certifier](#who-can-certify-a-system):

-   Prepares a C&A project plan which describes the C&A resources,
    milestone activities, and time frames;

-   Validates that the operational and technical controls documented in
    the system security plan are in place and functioning; and

-   Evaluates the extent to which all controls were satisfied and
    considers the impact to the system for those controls not fully
    satisfied.

> After a [system certifier](#who-can-certify-a-system) completes the
> certification, the [system security plan certification and
> accreditation
> package](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package)
> is eligible for [accreditation](#what-is-accreditation) review by the
> DAA. []{#certifiers_recommendation .anchor}The certifier's
> recommendation to the DAA must be one of the following:

-   **Full accreditation**: all controls were found to be in place and
    functioning, and the certifier recommends that the system may
    operate and no further controls need to be implemented.

-   **Interim accreditation**: some controls were not fully in place or
    functioning but the missing or planned controls do not pose
    significant risk to system operation. The certifier recommends that
    the system may operate for a specified period during which the
    system owner develops and implements a corrective action plan to
    address implementation of controls missing or not fully functioning.

-   **Deny accreditation**: most controls were not in place or
    functioning. The certifier recommends that system operation would
    pose significant risk to the Census Bureau, and therefore should not
    be placed into operation (or should be removed from operation).

### What documentation is required in the System Security Plan Certification and Accreditation Package?

Specific documentation that must be included in the certification
package and submitted to the DAA for accreditation includes:

-   [System Security Plan](#security_plan) including required system
    information including [risk
    assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources),
    [contingency plans](#contingency-planning), information on [security
    training](#it-security-awareness-training-and-education), [security
    roles and responsibilities](#it-security-roles), and [system
    documentation](#documentation);

-   Final Security Test & Evaluation report draft [*NIST Special
    Publication 800-37: Guidelines for the Security and Accreditation of
    Federal Information
    Technology*](http://csrc.nist.gov/sec-cert/SP-800-37-v1.0.pdf)[;
    Section 2.4.2]{.underline}; and

-   [Certification](#certification) documentation (test plan and test
    results) with [certifier's
    recommendation](#certifiers_recommendation).

> When the system security plan and required components and the
> certification documentation are complete, the package is submitted to
> the IT Security Officer who reviews and submits the plan to the CIO
> for accreditation.

### Accreditation

### What is accreditation?

> Accreditation reflects the official management authorization and
> approval granted to an IT system or network to process [sensitive
> data](#what-is-sensitive-information) in an operational environment.
> Successful accreditation provides an official statement that the
> [design](#how-is-security-considered-in-designing-an-it-system),
> [implementation](#implementation-stage), and
> [certification](#certification) testing of the system meet specific
> and adequate requirements for data security.

### Who can accredit a system?

> For [major applications](#c.2-what-is-a-major-application) and
> [general support systems](#c.1-what-is-a-general-support-system), the
> DAA must be a program management official with operational authority
> and budget control over the program using the IT system to be
> accredited. To ensure separation of duties, the DAA **cannot** be the
> system owner or the system certifier. The CIO serves as the Census
> Bureau's DAA and, as such, accredits systems for the Census Bureau.
> The Associate Director(s) of the business area for the system supports
> must also approve and sign the accreditation form.
>
> The DAA reviews and develops an understanding of the risks associated
> with operating a system in a business context. The DAA also signs an
> official accreditation statement that declares the system operating at
> an acceptable level of risk, and/or defines any condition or
> constraints that are required for appropriate system protection.

### C&A of Census Bureau Systems Under Development or Housed at Other Facilities

### What is the Census Bureau certification and accreditation process for systems developed by or operated in another government facility?

> The federal system owner must ensure that all systems are [certified
> and accredited](#system-certification-and-accreditation-ca). If the
> system was developed at a government system development facility, the
> system must obtain certification documentation from the developer for
> the [system security plan certification and accreditation
> package](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package).
> The certification documentation must support certification of the
> system in the development environment. The system owner builds on this
> certification to test the system controls in the operational
> environment. If the system resides at a contractor facility, then the
> contractor must allow Census Bureau personnel to participate in
> certification of the system. Only a Census Bureau official can
> accredit the system following certification. The process for ensuring
> adequate security for [sensitive](#what-is-sensitive-information)
> Census Bureau data at other government facilities requires:

-   Performing a [risk
    assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources),
    and obtaining the Census Bureau IT Security Officer's approval
    before entering into an agreement to process [sensitive
    data](#what-are-the-different-levels-and-types-of-information-sensitivity)
    or applications at another government facility;

-   Performing a [risk
    assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
    at least every three years or whenever significant changes to the
    system occur;

-   Developing a [system security plan](#it-security-plans) (including a
    [contingency plan](#contingency-planning)), and conducting
    [vulnerability testing](#vulnerability-testing); and

-   Obtaining [certification](#certification) and
    [recertification](#when-are-systems-reviewed-for-certificationrecertification-and-accreditation)
    for all Census Bureau sensitive applications operating at other
    government facilities.

### What is the Census Bureau certification and accreditation process for systems operated in non-government facilities?

> The federal system owner must ensure that all systems are [certified
> and accredited](#system-certification-and-accreditation-ca). If the
> system was developed under contract, the system owner must obtain from
> the contractor certification documentation for the [system security
> plan certification and accreditation
> package](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package).
> The certification documentation must support certification of the
> system in the development environment.
>
> If the Census Bureau system resides at a contractor facility, then the
> contractor must allow Census Bureau personnel to participate in the
> certification of the system and a Census Bureau official must accredit
> the system. The process for ensuring adequate security for
> [sensitive](#what-is-sensitive-information) Census Bureau data on
> non-government (contractor) systems or in such facilities must
> requires the following:

-   Performing a [risk
    assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
    and obtaining Census Bureau IT Security Officer approval before
    entering into an agreement to process [sensitive
    data](#what-are-the-different-levels-and-types-of-information-sensitivity)
    or applications at a contractor facility;

-   Performing a [risk
    assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
    at least every three years or whenever significant changes to the
    system occur;

-   Developing a [system security plan](#security_plan) (including a
    [contingency plan](#contingency-planning)), and conducting
    [vulnerability testing](#vulnerability-testing);

-   Obtaining [certification and
    recertification](#system-certification-and-accreditation-ca) for all
    Census Bureau sensitive applications operating at contractor
    facilities;

### What is the process for approving applications or systems maintained by other Government agencies that process sensitive Census Bureau data?

The Census Bureau recommends the use of the following process to ensure
appropriate security measures:

-   The Census Bureau system owner will communicate the sensitivity of
    the data or application to the servicing agency.

-   Any and all servicing agency personnel who will have access to the
    sensitive Census Bureau resources will be screened in accordance
    with the [Department of Commerce Security Manual, Section
    II](http://www.osec.doc.gov/osy/SECURITYMANUAL/section2.htm)
    (Chapters 9 through 16). Servicing agreements will specify that
    personnel will be screened and appropriate clearances granted before
    allowing access to Census Bureau IT resources.

-   The Census Bureau employee empowered to accredit the Census
    Bureau-owned system will request the servicing agency to provide
    documentation necessary for the [system security plan certification
    and accreditation
    package](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package).
    Based on the information provided, the official may choose to
    accredit or not to accredit the system for operation under certain
    specified conditions.

-   The servicing agreement will state clearly that the application or
    system has been certified and that the servicing organization
    achieved, and will maintain, a level of security commensurate with
    the [sensitivity of the
    data](#what-are-the-different-levels-and-types-of-information-sensitivity).

-   The agreement will state that the application or system must be
    recertified every three years or earlier if substantial
    modifications have been made to the application or system. A copy of
    the recertification will be provided to the Census Bureau data or
    application owner.

-   The agreement will specify that the servicing organization will
    develop and maintain a [contingency plan](#contingency-planning)
    that covers [sensitive](#what-is-sensitive-information) Census
    Bureau applications and data.

# Management Controls

## Risk Management and Assessment

### What is risk management?

> Risk management is the continuous process whereby the relative risk of
> harm to a [general support
> system](#c.1-what-is-a-general-support-system) (GSS) or [major
> application](#c.2-what-is-a-major-application) (MA) is evaluated,
> mitigated, and continuously monitored. Properly managing risk requires
> steps to be taken that reduce the level of risk to an acceptable
> level. A team led by the system owner and other interested parties
> first performs a [risk
> assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
> for all new systems and systems undergoing major modification. The
> risk assessment team identifies the controls in place and additional
> controls needed to provide adequate security for the system and reduce
> the level of risk to one acceptable to the system owner. The system
> owner then performs periodic [vulnerability
> testing](#vulnerability-testing) of the controls to monitor the
> continued adequacy of system security.

### What is a risk assessment and how does it help secure IT resources?

> A risk assessment is the methodical identification and measurement
> of 1) the threats to a system or information processed or stored by
> the system, 2) the vulnerability of the system to threats, 3) the
> probability, or risk, that a given threat could exploit the
> vulnerabilities, and 4) the effectiveness of current or proposed
> safeguards/controls. Risk assessments are important for providing
> background information on which information security management
> decisions such as budgets, staffing plans, and project plans can be
> based.
>
> A system owner, in consultation with the IT Security Officer and other
> interested parties must use the results of this evaluation to
> determine countermeasures to prevent or mitigate risk to an acceptable
> level. The [Designated Approving Authority
> (DAA)](#who-can-accredit-a-system) determines risk as outlined in the
> [Certification and Accreditation
> section](#system-certification-and-accreditation-ca) of this policy.
> The IT Security Officer can assist by providing the system owner with
> a risk assessment methodology and by providing assistance in
> interpreting the risk assessment results and suggesting possible
> cost-effective security countermeasure alternatives.

### For what systems are risk assessments performed?

> [Risk
> assessments](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
> must be performed on all general support systems and major
> applications.

### When and how often are risk assessments performed?

> System owners must begin an initial risk assessment during the
> [initiation stage](#initiation-stage) of new systems, or in the design
> of major modifications to existing systems. The risk assessment must
> be completed in the [implementation stage](#implementation-stage) of
> the system life cycle, before the [system security
> plan](#_Hlt15712896) is finalized, to ensure that the security plan
> identifies and addresses residual risk to the system (that risk which
> was not eliminated by implementation of countermeasures). The risk
> assessment is a key consideration in the [certification and
> accreditation](#system-certification-and-accreditation-ca) of systems
> before placing them into operation. In addition, updating the risk
> assessment of systems in the [operation and maintenance
> stage](#operation-and-maintenance-stage) periodically helps ensure an
> acceptable level of risk is maintained throughout the system's life.
> Therefore, the Census Bureau requires that system owners also perform
> risk assessments of operational systems when major changes are made to
> a system as well as at least every three years.

### How are exceptions to the risk management policy addressed?

> When situations arise that require an exception to any Census Bureau
> IT security policies or standards, the decision whether to accept the
> risk of not following established IT security policies or standards
> must be made at the CIO level. Prior to such a decision, risk must be
> assessed in a formal policy exception process. The purpose of such a
> process is to ensure adequate analysis is completed and a conscious
> decision to accept the risk represented by non-compliance with a
> policy is made. The following steps must be taken in accordance with
> the exception policy:

-   A risk assessment must be completed and approved to support any
    decision not to comply with any of the Census Bureau's IT security
    policies and standards.

-   All policy exceptions must be 1) fully documented, 2) approved by
    the CIO, division/office chief, and the IT Security Officer, and 3)
    retained by the Information Technology Security Office (ITSO) as
    long as the policy exception exists.

-   The documentation must be completed by the system owner requiring
    the exception to a policy, and must address:

```{=html}
<!-- -->
```
-   Value and sensitivity of the information asset at risk, including
    the business consequences of its disclosure, destruction,
    modification, delay, or misuse;

-   Policy (or policies) to which the exception applies;

-   Description of the risk and exposure that results from
    non-compliance;

-   Acceptance of the risks identified by the affected data system
    owners;

-   Reason for non-compliance;

-   Compensating controls that will reduce the risk to an acceptable
    level; and

-   Actions that will lead to compliance, and a schedule to implement
    those actions.

### Where can I find information on industry best practices for assessing risk?

> Information on the minimum-security standards required for Census
> Bureau systems are contained in this document. Additional information
> on performing risk assessments can be obtained using the following
> sources as references:

-   [OCTAVE^SM^ (Operationally Critical Threat, Asset, and Vulnerability
    Evaluation)](http://www.cert.org/octave/), offered by the [CERT^®^
    Coordination Center (CERT/CC)](http://www.cert.org/);

-   GAO/AIMD-12.19.6 [*Financial Information Systems Controls Audit
    Manual: Volume 1*](http://www.gao.gov/special.pubs/ai12.19.6.pdf);

-   GAO/AIMD-98-68 [*Executive Guide: Information Security
    Management*](http://www.gao.gov/special.pubs/infosec.guide/);

-   GAO/AIMD-00-33 [*Information Security Risk Assessment: Practices of
    Leading
    Organizations*](http://www.gao.gov/special.pubs/ai00033.pdf); and

-   National Institute of Standards and Technology Special Publication
    800-30, [*Risk Management Guide for Information Technology
    Systems*](http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf).

## Review of Security Controls

### Operating Unit Program and System Self-Assessments

### Why is the Census Bureau required to perform self-assessments?

> OMB [Circular A-130, Appendix
> III](http://csrc.nist.gov/secplcy/a130app3.txt), *Security of Federal
> Automated Information Resources,* requires agencies to develop,
> implement, and review a comprehensive, agency-wide security program.
> This program includes periodic [assessments of security
> risks](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
> to information systems and data. The Census Bureau uses security
> review information for assessing its IT security posture agency-wide,
> while the Department of Commerce and the [Office of Management and
> Budget](http://www.whitehouse.gov/omb/) (OMB) use it in its budget
> considerations. The Department of Commerce also requires the Census
> Bureau to complete annual reviews, or self-assessments, of each
> general support system and major application.

### How does the Census Bureau meet self-assessment requirements?

> The IT Security Officer performs program-level self-assessments and
> system owners complete system-level self-assessments or
> [audits](#audits) using the checklists developed by the National
> Institute of Standards and Technology (NIST) [Special Publication
> 800-26,](http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf)
> [*Security Self-Assessment Guide for Information Technology
> Systems*](http://csrc.nist.gov/publications/nistpubs/800-26/sp800-26.pdf).

[]{#program_level_review .anchor}Program-level reviews:

-   Evaluate the division/office's efforts to develop, implement, and
    maintain a security program that [manages
    risk](#risk-management-and-assessment) and ensures adequate security
    of systems under the division/office's control;

-   Evaluate the division/office's continuity of operations planning in
    support of the Census Bureau's [Critical Infrastructure Protection
    (CIP)](#what-is-critical-infrastructure-protection-cip) efforts;

-   Evaluate the program element's appropriateness and adequacy as
    defined in the Department of Commerce's [IT Security Compliance
    Review
    Metrics](http://www.osec.doc.gov/cio/oipr/ITSec/DOC Compliance Review Metrics MSWord.pdf)
    document; and

-   Identify best practices in use by divisions/offices in order to
    share these practices with other agencies within the Census Bureau
    and the Department of Commerce.

System-level/Subsystem-level reviews:

-   Cover every system including planned and operational systems, major
    system projects as defined in the Department of Commerce's and the
    Census Bureau's capital asset budget planning process, and minor
    systems as defined by National Institute of Standards and Technology
    (NIST) Special Publication (SP) 800-18, [*Guide for Developing
    Security Plans for Information Technology
    Systems*](http://csrc.nist.gov/publications/nistpubs/800-18/Planguide.PDF).

-   Follow the NIST Special Publication 800-26 self-assessment guide and
    [automated questionnaire](http://csrc.nist.gov/asset), which
    provides a common reporting mechanism across the Census Bureau.
    Completed checklist questionnaires initially provide a baseline for
    measuring effective implementation of system security controls.
    Subsequent assessments measure progress in improving security
    controls against this baseline.

### Are there provisions for software audits?

> The IT Security Officer must establish a process to periodically
> review, on a sample basis, the licensing of software within the Census
> Bureau. The IT Security Officer must report any infringements of this
> process to the CIO's office. Compliance with software licensing will
> also be included in Census Bureau [compliance
> reviews](#department-of-commerce-compliance-reviews) of operating
> units.

### What must I do if there are findings from an audit/review?

> When an audit by independent agencies, such as the [General Accounting
> Office](http://www.gao.gov/) (GAO) or the Department of Commerce
> [Office of Inspector General](http://www.oig.doc.gov/) (OIG), or an
> internal
> [self-assessment](#operating-unit-program-and-system-self-assessments)
> or [compliance review](#department-of-commerce-compliance-reviews)
> reveals deficiencies in a Census Bureau IT security program or system,
> a [corrective action
> plan](#what-information-must-be-in-the-corrective-action-plan) (CAP)
> that addresses the findings must be prepared, implemented, and
> reported to the CIO.

### What information must be in the corrective action plan?

> At a minimum, the corrective action plan (CAP) must include:

-   A brief statement of the weakness or deficiency to be
    addressed---this may include restating an audit finding caption or a
    [self-assessment](#operating-unit-program-and-system-self-assessments)
    control category;

-   A list of actions that will be performed to address deficiencies;

-   Milestone dates, including the target completion date,
    management-approved changes to the target date, and the actual
    completion date for all corrective actions; and

-   A brief statement describing all of the actions already completed,
    including descriptions of policies, procedures, and other actions
    completed to address deficiencies.

> The Census Bureau uses the guidance provided in the *[Government
> Information Security Reform Act
> (GISRA)](http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=106_cong_public_laws&docid=f:publ398.106.pdf),*
> referred to by OMB as Plans of Action and Milestones (POA&Ms) in its
> memorandum [M-02-09, Reporting Instructions for the Government
> Information Security Reform Act and Updated Guidance on Security Plans
> of Action and
> Milestones](http://www.whitehouse.gov/omb/memoranda/m02-09.pdf), as
> the basis for reporting CAPs. Census Bureau divisions/offices should
> use this format in preparing CAPs. Both OMB and the Department of
> Commerce have stated that the annual assessments and POA&Ms, formerly
> required under GISRA, are included in the regulations set forth in the
> *[Federal Information Security Reform Act (FISMA), Title III of the
> E-Government Act of
> 2002](http://www.csrc.nist.gov/policies/FISMA-final.pdf).*

### Who prepares and approves the corrective action plan (CAP)?

The IT Security Officer prepares program-level CAPs. The system owner
must develop system-level CAPs for systems under their responsibility if
weaknesses were identified during reviews. The IT Security Officer will
submit the CAPs to the CIO for approval, who will then submit them to
the Department of Commerce IT security program manager. The IT Security
Officer is responsible for tracking the CAPs to completion.

### How are corrective actions tracked?

> The Census Bureau's IT Security Officer tracks the status of CAPs and
> reports the completion status for all CAPs to the Department of
> Commerce on a monthly basis as part of the Department of Commerce's
> compliance monitoring. The monthly updates are due to the Department
> of Commerce IT security program manager no later than close of
> business on the 15^th^ of the month following the month covered by the
> status update (e.g., the status update as of the end of the month of
> October is due by November 15^th^, the status update as of the end of
> November is due by December 15^th^, etc.).

### Department of Commerce Compliance Reviews

### What are Compliance Reviews?

> Compliance reviews, independent of the
> [self-assessments](#operating-unit-program-and-system-self-assessments)
> of IT systems performed by the system owners, evaluate the
> effectiveness of the Census Bureau IT security program. Whereas the
> [self-assessments](#operating-unit-program-and-system-self-assessments)
> provide a check of IT security controls, compliance reviews provide
> the balance to ensure reporting of reliable program status to senior
> management. The Census Bureau conducts compliance reviews of its IT
> security programs and security controls in accordance with Department
> of Commerce policy in order to assess the effectiveness of the it's
> implementation of IT security requirements.
>
> Compliance reviews cover a review of all program elements and system
> controls defined in the Department of Commerce [IT Security Compliance
> Review
> Metrics](../../../../../../../../sf-cio/IPPR/NDefrancesco/CHM%20Contract/Task%202%20Work%20Plan%20Appx%20B%20DOC%20Compliance%20Review%20Metrics%20Rev%201.0.doc).
> To complete the reviews, the Department of Commerce selects operating
> units (e.g. the Census Bureau) on a rotational basis, ensuring that
> all operating units are reviewed at the [program
> level](#program_level_review) at least once every three years. A
> select sample of systems is also selected over this 3-year period
> using a risk matrix to rank and select systems.

### Why does the Department of Commerce perform Compliance Reviews?

> OMB [Circular A-130, Appendix
> III](http://csrc.nist.gov/secplcy/a130app3.txt), *Security of Federal
> Automated Information Resources,* requires agencies to develop,
> implement, and review a comprehensive, Department-wide security
> program. Within the Department of Commerce, each review provides the
> Department of Commerce CIO and the Census Bureau CIO with an
> independent assessment of the Census Bureau's security posture. In
> addition, they provide support for determining the existence of
> [material weaknesses](#what-is-a-material-weakness) within the
> Department of Commerce's IT security program.

### What is a "material weakness?"

> A material weakness is defined by OMB [Circular A-130, Appendix
> III](http://csrc.nist.gov/secplcy/a130app3.txt), *Security of Federal
> Automated Information Resources,* as a significant deficiency in IT
> security policy, procedures, or practices, such as the absence of
> system security plans or the failure to properly certify and accredit
> systems before operation. Such weaknesses significantly impair the
> Census Bureau's ability to protect its data and IT systems.

### Who identifies a material weakness in IT security?

Only the Secretary of Commerce has the authority to declare an official
material weakness. However, the Census Bureau CIO identifies possible
material weaknesses in IT security through self-assessments and
compliance reviews, and advises the Department of Commerce CIO of these
findings at least annually. The Department of Commerce CIO, in turn,
makes recommendations to the Secretary of Commerce regarding possible
material weaknesses in IT security.

### Who determines whether a particular weakness is "material?"

> The Department of Commerce CIO recommends to the Secretary of Commerce
> that a weakness be defined as "material." To establish whether to
> record that a material weakness exists in IT security, the Department
> of Commerce CIO has the prerogative of using staff, outside
> consultants, or ad hoc groups for advice, but the ultimate decision
> rests with the CIO. [OMB Circular
> A-127](http://www.whitehouse.gov/OMB/circulars/a127/a127.html), and
> [OMB Circular
> A-130](http://www.whitehouse.gov/omb/circulars/a130/a130.html),
> Appendix III, provides guidance on identifying and evaluating material
> weaknesses.

### What happens when a material weakness is identified?

> The Department of Commerce CIO must report any material weaknesses
> discovered in IT security through the CIO\'s annual [Federal Manager's
> Financial Integrity
> Act](http://www.whitehouse.gov/omb/circulars/a123/a123.html) (FMFIA)
> report to the Secretary of Commerce. If the Department of Commerce CIO
> recommends to the Secretary of Commerce that a material weakness in IT
> security exists within the Census Bureau, the Department of Commerce
> CIO will confer with both the Director of the Census Bureau and the
> Census Bureau CIO to reach consensus on the designation. In the event
> the Department of Commerce CIO cannot obtain concurrence from the
> Census Bureau and still believes that a material weakness exists, the
> Department of Commerce CIO can include the disputed security weakness
> in his annual FMFIA report to the Secretary of Commerce. Senior
> management should be involved in all corrective actions taken to
> remedy a material weakness.

### When can a material weakness designation be lifted?

> Only the Secretary of Commerce has the authority to lift an officially
> reported material weakness. The Department of Commerce CIO, in
> consultation with the [OIG](http://www.oig.doc.gov/) and the [Chief
> Financial Officer/Assistant Secretary for
> Administration](http://www.doc.gov/cio/cfo/cfoindex.html), recommends
> to the Secretary of Commerce when a designation of material weakness
> in IT security should be lifted.

### Vulnerability Testing

### What is vulnerability testing?

Vulnerability testing examines a system to evaluate the risk, or
exposure, of the system to certain threats. Through this testing, the IT
Security Officer and system owner identify vulnerabilities that result
from improper use of controls, inherent system vulnerabilities, or
mismanagement. The result is a list of flaws or omissions in controls
that could impact the confidentiality, availability, or integrity of the
system.

Hardware and software tools are used to analyze the current state of the
system by reviewing the system objects and searching for weaknesses in
controls that might indicate vulnerabilities and a potential system
attack. While the majority of the testing focuses on automated
information systems, a vulnerability test could also include an
assessment of physical controls and system security policies and
procedures.

> Examples of such vulnerabilities include:

-   Easily guessed or obtained passwords;

-   Improperly protected system files;

-   Systemic or operational opportunities for planting destructive files
    within the system;

-   Failure to install security-relevant bug fixes; and

-   Misconfiguration of application security controls.

> The Census Bureau IT security program includes vulnerability testing
> in the [risk
> assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
> process for all systems. This helps to evaluate the type and level of
> risk and defines for management areas that should be prioritized for
> funding requests or included in system requirements.

### How often is vulnerability testing performed?

> System [certification](#certification) during the [implementation
> stage](#implementation-stage), or at such times that modifications to
> a system require it, must include vulnerability testing. Vulnerability
> can also be tested when requested by the system owner. The results of
> these tests must be forwarded to the Census Bureau's designated
> Computer Incident Response Team [(CIRT)](#cirt), who will maintain a
> database of the results for management analysis and reporting.

### Who performs vulnerability testing?

> As part of the [certification](#certification) process, the [system
> certifier](#who-can-certify-a-system) identifies a qualified
> individual to conduct testing of the security controls. In addition,
> the system owner must build upon the certifier's security test and
> evaluation plan to develop an ongoing []{#vulnerability_test_plan
> .anchor}vulnerability testing plan for the system, which is included
> as part of the [IT security plan](#it-security-plans) documentation.
> The system owner must conduct, or hire a vendor to conduct, testing on
> a regular basis and at critical milestones, including:

-   [Implementation](#implementation-stage) of a new system;

-   Upgrade of system software; and

-   Major system modification as determined by the DAA.

### What must be included in vulnerability testing?

> Vulnerability tests must include, at a minimum:

-   Well-known operating system vulnerabilities;

-   Well-known platform vulnerabilities;

-   Well-known application vulnerabilities;

-   Review of IT security policies for completeness;

-   Assessment of procedural controls susceptibility to misuse; and

-   Assessment of technical controls susceptibility to misuse.

### Where can I get more information on vulnerability testing?

> The Department of Commerce and the Census Bureau recommend the
> following National Institute of Standards and Technology guidance:

-   [ICAT database](http://icat.nist.gov/icat.cfm) of common
    vulnerabilities and exposures for all operating systems, including a
    [vulnerability and threat
    portal](http://icat.nist.gov/vt_portal.cfm) for US Government attack
    and vulnerability services;

-   National Institute of Standards and Technology (NIST) Special
    Publication Draft 800-42, [*Guideline on Network Security
    Testing*](http://csrc.nist.gov/publications/drafts/security-testing.pdf);
    and

-   NIST Special Publication 800-6, [*Automated Tools for Testing
    Computer Systems
    Vulnerability*](http://csrc.ncsl.nist.gov/publications/nistpubs/800-6/800-6.txt).

### IT System Inventory Management

### What is the function and content of the "IT system inventory?"

The IT system inventory provides a summary of valuable management data
that reflects the status of the Census Bureau's implementation of its IT
security program. The IT system inventory must include, at a minimum,
the following information:

-   System name/title for each IT system (or as an aggregate of smaller
    systems);

-   CIO-assigned system identifier for each IT system;

-   Name and phone of the person assigned security responsibility (e.g.,
    the system owner or the DSO);

-   Name and phone of the system owner;

-   Name and phone of the information owner;

-   Information category (i.e., sensitive-but-unclassified (SBU));

-   System type ([general support
    system](#c.1-what-is-a-general-support-system) (GSS) or [major
    application](#c.2-what-is-a-major-application) (MA));

```{=html}
<!-- -->
```
-   Date of the last system security [risk
    assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources);

```{=html}
<!-- -->
```
-   [Security
    plan](#what-elements-does-the-department-of-commerce-and-census-bureau-require-format-and-content-for-an-it-security-plan)
    approval date;

-   [Contingency plan](#contingency-planning) date;

-   Date of last contingency plan test;

```{=html}
<!-- -->
```
-   Date of the last system [certification](#certification);

-   Date of the last system [accreditation](#what-is-accreditation);

```{=html}
<!-- -->
```
-   Date of last system
    [self-assessments](#operating-unit-program-and-system-self-assessments)
    as described in NIST Special Publication 800-26, [*Security
    Self-Assessment Guide for Information Technology
    Systems*](http://csrc.nist.gov/publications/nistpubs/800-26/sp800-26.pdf);
    and

-   Date of audits performed by external auditors such as the [Office of
    Inspector General](#the-office-of-inspector-general-oig), the
    [General Accounting Office](http://www.gao.gov/), or the Census
    Bureau within the prior 12 months (e.g., 12/10/01 GAO, 03/15/02 OIG,
    etc.).

### How do you track the status of system security implementation?

The Census Bureau must track IT system security by maintaining a
comprehensive inventory of systems. It must implement and maintain a
management system that includes tracking of IT systems as well as
security information for all systems. A copy of this inventory is
submitted to the IT security program manager semi-annually (March 15 and
September 15), to show the status of each Census Bureau system.

### Why does the Department of Commerce require such specific and comprehensive system inventory management?

> System inventory management provides the baseline and means for
> managing the IT security program. Also, the IT system inventory
> supports other IT management functions, including IT investment
> management, IT architecture management, and ensuring that each system
> tracked supports the mission of the Census Bureau and its IT
> architecture as required by [OMB Circular
> A-11](http://www.whitehouse.gov/omb/circulars/a11/02toc.html).

## Audits

### What is the Census Bureau policy for security audits of IT systems? 

> Effective internal controls must be established for the protection of
> Census Bureau information assets. System owners are responsible for
> ensuring that systems are audited for the effectiveness and compliance
> of security controls on a regular basis. The schedule for individual
> application or system audits should be based on the criticality and
> sensitivity of the application or system to the Census Bureau's
> mission. However, audits should be conducted at least every three
> years.
>
> An independent auditor (OIG or third party) must conduct a review of
> the security controls of all general support and major application
> systems. Using an independent entity ensures that the review is
> conducted in an unbiased manner and free from the influence of the
> system manager or owner.
>
> Any problems or deficiencies uncovered during the audit should be
> reported to the system owner and IT Security Officer immediately for
> remedy. In some cases, the deficiency may qualify as a "[material
> weaknesses](#what-is-a-material-weakness)" as defined in [OMB Circular
> No. A-130](#OMBA130) and OMB Circular No. A-123 "Management
> Accountability and Control." In such cases, the material weakness must
> be reported to the Census Bureau CIO and then to the Department of
> Commerce CIO. A corrective action plan must be developed, implemented,
> and tracked. Refer to Section 4.2.2 Compliance Reviews for additional
> information.

### Do these policies apply to all Census Bureau IT systems? 

> These policies apply to all Census Bureau major application and
> general support systems and communication and network connections
> through which Census Bureau information is transmitted, stored, or
> processed. Technology systems, communications, and network connections
> include, but are not limited to, network devices such as routers,
> firewalls, servers, and mainframes.

### What should be included in an audit? 

> A formal management and technical review of all application security
> controls should be included in the audit. This review is separate and
> different from the certification and accreditation process of an IT
> system. Specific areas to be audited may include:

-   Assignment of responsibility and segregation of security duties;

-   Compliance with IT security program policies;

-   Existence of a viable and current security plan;

-   Implementation of technical security controls (e.g. access
    controls);

-   Review of audit logs; and,

-   Correction of previously identified system deficiencies.

### How do audits differ from Department of Commerce compliance reviews? 

> Department of Commerce compliance reviews evaluate the effectiveness
> of the Census Bureau's IT security program against the Department of
> Commerce [IT Security Compliance Review
> Metrics](../../../../../../../../sf-cio/IPPR/NDefrancesco/CHM%20Contract/Task%202%20Work%20Plan%20Appx%20B%20DOC%20Compliance%20Review%20Metrics%20Rev%201.0.doc).
> Audits, on the other hand, serve as an early warning mechanism and are
> conducted under the auspices of the Census Bureau IT security program
> and the Census Bureau CIO to identify potential or existing material
> weaknesses. These audits may be used to support the [Department of
> Commerce compliance
> review](#department-of-commerce-compliance-reviews) process and are
> separate from the annual self-assessments required by the Department
> of Commerce and the OMB.

### How do system audit trails (logs) protect information and how should the logs be protected?

> Audit trails maintain a record of authorized and unauthorized system
> [events](#event) both by system and application processes and by user
> activity of systems and applications. In conjunction with other
> processes and controls, such as [incident handling and response
> capabilities](#incident-response-capability) and user [identification
> and
> authentication](#how-does-user-identification-and-authentication-help-secure-it-resources),
> audit trails can assist in detecting security violations, network
> performance problems, and flaws in applications. System audit trails,
> or event logs, provide a record of events made by a particular
> software package that monitors and enforces the IT system security
> policy. All audit logs are subject to recording and routine review by
> the Census Bureau IT Security Officer and auditors for inappropriate
> or illegal activity.
>
> National Institute of Standards and Technology (NIST) Special
> Publication 800-12, [*An Introduction to Computer Security: The NIST
> Handbook*](http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf),
> Chapter 18, describes an []{#event .anchor}event as any action that
> happens on a computer system, such as logging into a system, executing
> a program, and opening a file. System owners must ensure the
> protection of system event logs with file-level permissions,
> [segregation of duties](#separation_of_duties), and all other
> safeguards commensurate with the highest [level of sensitivity of the
> information](#what-are-the-different-levels-and-types-of-information-sensitivity)
> resident on the system for which the logs record data.

### What does the Census Bureau require for an audit trail?

> The Census Bureau requires that system owners log, monitor, and
> investigate possible security violations from activity involving
> access to and modification of sensitive or critical files.
>
> An audit trail should include sufficient information to establish what
> events occurred and who (or what) caused them. In general, an event
> record should specify:

-   When the event occurred (e.g. access or logoff);

-   User ID associated with the event;

-   Program or command used to initiate the event and the result; and

-   Date and time of the event.

> Audit logs should be retained for five years in accordance with IRS
> policy. System administrators should regularly review audit logs (e.g.
> daily, weekly, biweekly) or as often as necessary based up on the
> level of sensitivity of the system.
>
> A system can maintain several different audit trails concurrently.
> There are typically two kinds of audit records: 1) an event-oriented
> log and 2) a record of every keystroke, often called keystroke
> monitoring. Event-based logs usually contain records describing
> *system* events, *application* events, or *user* events.

### What is keystroke monitoring (user, or usage monitoring)?

> Keystroke monitoring is the process used to view or record both the
> keystrokes entered by a computer user and the computer\'s response
> during an interactive session. Keystroke monitoring is usually
> considered a special case of audit trails. Examples of keystroke
> monitoring would include viewing characters as they are typed by
> users, reading users\' electronic mail, and viewing other recorded
> information typed by users. System owners and system administrators
> must be familiar with the restrictions established by the [Electronic
> Communications Privacy Act of
> 1986](http://thomas.loc.gov/cgi-bin/bdquery/z?d099:HR04952:@@@L|TOM:/bss/d099query.html|)
> (Public Law 99-508), with respect to legal issues surrounding the
> interception of certain communications and other forms of
> surveillance.

## Help Desk/User Support

### What is a Help Desk?

> The Department of Commerce requires that the Census Bureau security
> program include procedures for a user help desk. A help desk is a
> formally designated or informal group, or person, that provides user
> support and offers advice in the proper functioning of [general
> support systems](#c.1-what-is-a-general-support-system) and [major
> applications](#c.2-what-is-a-major-application). A contractor,
> equipment or software vendor, or system developer may provide the
> support.

# Operational Controls

## Personnel Security

Humans are the weakest link in any security chain. Recent studies show
that roughly half of all security breaches are engineered by people with
insider access to systems. Although no security system is airtight, no
computer system can be properly secured without adequately addressing
personnel security issues. Personnel are defined as:

-   Federal and contractor system users;

-   Designers/programmers;

-   Implementers/maintainers; and

-   System administrators and managers.

A broad range of security issues relates to how these individuals
interact with computers and the level of access and authorities they
need to do their job. Within the Census Bureau, the IT Security Officer
along with the Division Security Officers (DSO) must ensure that the [IT
security
program](#who-must-have-an-it-security-program-and-what-is-its-structure)
and [system security plans](#what-is-included-in-an-it-security-plan)
address the following personnel security areas:

-   Determination of position sensitivity in accordance with the
    [Department of Commerce Security Manual, Chapter
    10](http://www.osec.doc.gov/osy/SECURITYMANUAL/Chapter10.htm#Chapter 10);

-   Screening of personnel in accordance with the [Department of
    Commerce Security Manual Chapter
    11](http://www.osec.doc.gov/osy/SECURITYMANUAL/Chapter11.htm#Chapter 11);

-   Assigning the appropriate level of system access based on job
    classification and background check;

-   [Awareness, education, and
    training](#it-security-awareness-training-and-education); and

-   [User administration](#user-administration) including the hiring,
    transfer and termination of personnel (in coordination with HR).

### User Administration

### What is the procedure for notifying Census Bureau personnel (federal employees and contractors) of personnel security policies and procedures? 

> All personnel must be informed of personnel security and IT security
> policies and procedures through security information awareness
> training upon being hired or receiving Special Sworn Status and must
> acknowledge receipt of this information prior to system use.
> Employees, contractors, and other individuals with Special Sworn
> Status will also provide assurance of compliance with IT security
> policies as a condition of continued employment. Copies of the IT
> security personnel security policies may be retrieved at the [Census
> Bureau IT Security Web
> site](http://cww2.census.gov/it/itso/itso_policy.asp?ID=ITSO-01&category=06).

### What is required for effective administration of system users?

> Effective administration of users\' computer access is essential to
> maintaining system security. Administration of system users focuses on
> identification, authentication, and access authorizations. The
> Department of Commerce requires that the Census Bureau have a process
> of [auditing](#audits) and periodically verifying the legitimacy of
> current accounts and access authorizations in IT Security Programs. In
> addition, the Census Bureau must address the timely modification or
> removal of access and associated issues for employees who are
> reassigned, promoted, terminated, or retired. The IT Security Officer
> must also ensure that the following controls are in place:

-   [Account management](#Account_Mgmt);

-   [Rules of
    Behavior](#what-are-rules-of-behavior-and-how-does-the-census-bureau-use-them)
    and [monitoring](#what-is-user-monitoring) to detect improper use;
    and

-   [Personnel (federal and contractor) termination
    procedures](#what-does-the-census-bureau-require-when-employees-both-federal-and-contractor-no-longer-work-for-the-census-bureau).

### What is required for effective administration of contract staff?

> Acquisition professionals (contracting officers and contract
> specialists) provide a valuable service by ensuring that their Census
> Bureau employees work with the Census Bureau IT Security Officer to
> address and consider security in their IT contract requirements in all
> stages of an acquisition (i.e., from the earliest budgeting and
> acquisition planning stages through requirements development,
> solicitation, source evaluation and selection, and contract award and
> administration). The Commerce Acquisition Manual, Part 37, Section 70
> (Security Processing Requirements for On-Site Security Requirements)
> requires employees to work with the IT Security Officer before a
> solicitation is released to designate contract risk levels (for all on
> site contracts, not just IT) and then after award to arrange for
> background investigations on contractor employees. The office under
> which the contract will be issued must provide the Acquisition Office
> with the appropriate risk determination for the contract, in order for
> the appropriate language to be incorporated into the contract.

### Rules of Behavior/Acceptable Use Policies

### What unique responsibilities do Census Bureau personnel (federal employees and contractors) have regarding data collected and protected by provisions of Title 13 and Title 26 of the Unites States Code and other sensitive data?

Any release of data covered by Title 13 and Title 26 is considered a
criminal act punishable by Federal Law. Specifically, employees and
contractors **shall not**:

-   Use information furnished under the provisions of Title 13 or Title
    26 for any purpose other than the purposes for which it is supplied;

-   Make any publication whereby the data furnished by any particular
    establishment or individual under Title 13 or Title 26 can be
    identified;

-   Permit anyone other than sworn officers and employees of the Census
    Bureau to examine the individual reports; and

-   Store sensitive information so that it is commingled with other data
    on floppy diskettes or other removable data storage media (e.g.,
    tapes, disks, hard drives, etc.).

> Employees and contractors shall:

-   Be aware of Census Bureau policies regarding sensitive data,
    particularly Title 13 and Title 26 data (refer to the IT Security
    Awareness training Web site for policies);

-   Properly label all sensitive system-generated outputs, electronic
    and non-electronic, under protection of Title 13 U.S.C. as follows:

> Non-public use documents and materials not available to the public
> that contain information protected by Title 13 U.S.C. should be marked
> in bold type on each page with the phrase "DISCLOSURE PROHIBITED --
> TITLE 13 U.S.C.";

-   Label all sensitive material, including memorandums and reports, in
    accordance with the provisions of that specific title;

```{=html}
<!-- -->
```
-   Follow the appropriate shipping and receiving guidelines for sending
    private, confidential or sensitive information through the mail, by
    messenger, or by courier (refer to Policies and Procedures Temporary
    Memorandum-G9, "Guidelines for 'Census Confidential' Material" at
    <http://www.acsd.census.gov/Publications/Internal/stampman.pdf> for
    more information); and

-   Notify the IT Security Officer, when sensitive data actually are, or
    are suspected of being, lost or disclosed to unauthorized parties.

Census Bureau employees or anyone who requires access to Census Bureau
IT resources or Title 13 or Title 26 data must have a "need to know" for
this information in the course of performing their official duties and
must obtain "Special Sworn Status" by completing Form BC-1759 and taking
the Oath of Non-disclosure prior to obtaining access to the information.

### What are Rules of Behavior and how does the Census Bureau use them?

> Rules of Behavior, also called acceptable use policies or standards,
> instruct system users, both federal and contractor, about acceptable
> ways in which they may and may not use IT systems. These rules
> communicate to every individual his/her role in protecting IT
> resources, and advise them of their obligations. The rules cover
> Internet and [e-mail use](#web-servers-and-e-mail-server-security),
> dial-up use, use of copyrighted software, password use, unofficial use
> of Government resources and sensitive data, assignment and limitation
> of system privileges, incident reporting, and individual
> accountability.

Note that use of non-authorized computer software such as games,
non-approved screensavers and images, and other miscellaneous software
is prohibited and violates acceptable use policies.

### Who formulates and publicizes Rules of Behavior?

> While the Census Bureau has developed Bureau-wide Rules of Behavior
> for all personnel, both federal employees and contractors, it also
> requires system owners to formulate and publicize their own rules of
> behavior for their respective systems. System owners must take the
> unique cultures and information security requirements of the
> division/office into account when developing and implementing these
> rules, and they must communicate the rules to all division/office
> employees (federal and contractor). System owners, through the system
> administrators, must implement a manual or automated mechanism to
> ensure system users have acknowledged the rules before accessing the
> system.

### What is user monitoring?

> User monitoring allows for the Census Bureau to record the system
> [events](#event) that are initiated by all users of Census Bureau IT
> systems. IT Security Officers must ensure that the network [warning
> banner](#warning_banner) clearly communicates that there is no
> expectation of privacy in the authorized or unauthorized use of Census
> Bureau IT systems.

### Can the Census Bureau conduct user monitoring to ensure compliance with Rules of Behavior?

Because the Census Bureau's networks and IT systems do not inherently
provide users a right of privacy, it is permitted to monitor use of
these systems, including hardware and software, in accordance with the
Rules of Behavior. However, system owners must notify users of
monitoring prior to system access to avoid any question about an implied
right to privacy on the system.

### Who should be contacted in the case of violation of the Rules of Behavior?

> The IT Security Officer should contact the CIO as well as the Census
> Bureau Computer Incident Response Team (Census Bureau CIRT) to report
> a violation. The Census Bureau CIRT will communicate the violation to
> [Department of Commerce CIRT](https://www.cirt.doc.gov/).

### Where can I find more information on acceptable use policies?

> The following sources provide more information on acceptable use
> policies:

-   The System Administration and Network Security (SANS) Web site,
    which provides an [acceptable use policy
    template](http://www.sans.org/newlook/resources/policies/Acceptable_Use_Policy.pdf);

-   ["Census Policy on Employee Use of the
    Internet"](http://cww.census.gov/itso/index.html);

-   Department of Commerce [Internet Use
    Policy](http://www.doc.gov/ostm/intpol.htm);

-   National Institute of Standards and Technology's *Internet Security
    Policy: A Technical Guide*, Chapter
    [5.6.2](http://csrc.nist.gov/isptg/html/ISPTG-5.html#Heading62); and

-   The [Census Bureau's Rules of
    Behavior](http://cww2.census.gov/it/itso/CensusRulesOfBehavior.asp).

### Can Census Bureau personnel use Census Bureau IT resources for personal tasks?

> Use of Government computers, communications systems, and data or
> information is for official authorized purposes only. The Census
> Bureau has developed personnel security policies concerning the use of
> Census Bureau resources for personal tasks including the use of the
> [Internet](#web-servers-and-e-mail-server-security) and
> [e-mail.](#web-servers-and-e-mail-server-security) For Internet use,
> the Census Bureau's policies are consistent with the Department of
> Commerce's published [Internet Use
> Policy](http://www.doc.gov/ostm/intpol.htm). These policies are also
> covered under the [Census Bureau's Rules of
> Behavior](#what-are-rules-of-behavior-and-how-does-the-census-bureau-use-them).

### What are the repercussions of not following this policy?

The Census Bureau forbids personal use of Government resources not
explicitly permitted in the above-mentioned policies. Violations of
these policies can result in disciplinary action, including dismissal
and legal action, against the offending employee(s), contractors, or
visitors.

### Can personally owned or contractor owned equipment or software be used in the Census Bureau?

The Census Bureau has the responsibility to supply employees and
contractors with office automation equipment and software for official
business. Use of personally owned software for official business
purposes can result in many vulnerabilities and liabilities such as
computer viruses. As a result, the Census Bureau prohibits bringing
personally owned data processing equipment, software, or data into the
Census Bureau to be used for official business. All software and data
processing equipment for official business use must be acquired through
regular procurement channels.

### What does the Census Bureau require regarding contractors use of specialized hardware or software? 

Contractors who require use of specialized software or hardware must
obtain approval in writing from the division or office chief they are
supporting prior to installation or use. The system owner must also
maintain records of all such authorizations and submit a copy of the
authorization to the IT Security Officer.

Network connections must be coordinated with the LAN administrator and
IT Security Officer prior to connection. All hardware is subject to
inspection by appropriate Census Bureau personnel at any time and must
be inspected prior to removal. Use of such equipment and software must
comply with Census Bureau and Federal Enterprise Architecture
strategies.

### Segregation of Duties

[]{#separation_of_duties .anchor}

### How are security responsibilities assigned at the Census Bureau?

The Census Bureau requires that assignment of security responsibilities
must follow the principle of separation of duties, which essentially
says, "Make sure the fox isn't guarding the henhouse." The following
three categories of "duty" must be kept separate, or have compensating
controls in place to monitor activity closely:

-   IT administration or operation (assuring systems function to serve
    the customer);

-   IT security (assuring systems function safely to protect them from
    risk); and

-   IT management.

If staffing constraints exist, it is acceptable, for example, for a
system administrator to serve as a backup for an IT Security Officer who
is on leave. While serving in a dual role, however, compensating
management controls must be implemented to ensure changes to the
security posture are properly authorized.

### Why is segregation of duties such a good idea and how can I use it?

Segregation of duties provides:

-   A system of checks and balances;

-   Distribution of security responsibilities rather than investing in
    one individual or role;

-   The best compromise between availability and security \-- the
    separation enables each person involved to vigorously pursue his/her
    individual duties, resulting in a reasonable compromise between
    availability and security with many people working to keep the
    balance; and

-   A compensating control over the mere appearance of impropriety by
    those in a position to bypass IT security controls.

This principle must be applied by division or office chiefs to positions
with the ability to circumvent IT security controls, such as those
involved with auditing of systems, network administration, application
programming, computer operations, facility security, and any other
security-related function. Division and office chiefs must examine the
duties of an individual's role, and make sure those duties do not
conflict with one another.

### Personnel Termination and Transfer

### What does the Census Bureau require when employees (both federal and contractor) no longer work for the Census Bureau?

> Termination of a user\'s system access generally can be characterized
> as either friendly or unfriendly. Friendly termination may occur when
> an employee is voluntarily transferred, resigns to accept a better
> position, or retires. Unfriendly termination may include situations
> when the user is being fired for cause, due to a reduction in force
> (RIF), or involuntarily transferred. Within the Census Bureau, the IT
> Security Officer is responsible for ensuring that the IT security
> program addresses the security issues of both situations.
>
> At a minimum, all Census Bureau property must be retrieved from
> employees or contractors upon termination. Property includes: portable
> computers, library books, documentation, building keys, badges, TMIS+
> cards, SecureID cards, magnetic access codes and loaned equipment.
> DSOs and system owners must be informed of an employee or contractor's
> termination and ensure that all computer access privileges have been
> revoked and that all user accounts are terminated.
>
> National Institute of Standards and Technology (NIST) Special
> Publication 800-12, [*An Introduction to Computer Security: The NIST
> Handbook*](http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf),
> Chapter 10, provides recommended practices for managing the
> termination of employee system accounts.

## Physical and Environmental Security

### Who is responsible for physical security at the Census Bureau?

> Physical security refers to the provisions of a safe and secure
> environment for information processing activities. The [Department of
> Commerce Office of Security at the Census Bureau
> (OSY)](#the-department-of-commerce-office-of-security-at-the-census-bureau)
> has primary responsibility for developing and implementing physical
> security policies, controls, and procedures. The Census Bureau
> Information Technology Security Office [(ITSO)](#ITSO) works closely
> with the Department of Commerce OSY to develop policies relevant to IT
> physical security and to educate employees and contractors on the
> importance of understanding and abiding by physical security policies
> at the Census Bureau.

### How do I determine physical and environmental security requirements?

> Physical and environmental security measures should be commensurate
> with the sensitivity of the IT resources being protected and the
> criticality (mission and national security) of the IT resource. The
> results of a [risk
> assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources)
> and/or a Department of Commerce OSY physical security survey help
> determine the security requirements of controlled areas. Please see
> the [Department of Commerce Security Manual, Section
> IV](http://www.osec.doc.gov/osy/SECURITYMANUAL/section4.htm) (Chapters
> 30 through 40), for more information.

### What areas must be considered in security planning to adequately address physical and environmental security? 

> The system owner must address the following measures in the system
> [security plan](#security_plan):

-   **Access Controls**: determine physical access controls to restrict
    entry and exit of personnel by using the principle of granting the
    least privilege necessary to complete a job or function;

-   **Fire Safety Factors**: preventive measures such as assessing the
    risk of a fire, implementing procedures to reduce the risk of a
    fire, and backing up of critical systems and data should all be
    conducted on a regular basis since fires, including smoke, corrosive
    gases and high humidity from a localized fire, represent a
    significant security threat because of the potential to destroy
    critical systems and sensitive data;

-   **Failure of Supporting Utilities**: the Census Bureau should
    coordinate to ensure that utilities, including their many elements,
    are functioning properly as failures of electricity, gas and other
    supporting utilities can have significant impact on the operating
    environment and jeopardize the availability and integrity of
    systems);

-   **Structural Collapse**: contingency plans should address the risk
    of such an occurrence as natural disasters, over capacity of floor
    load and other factors can result in the structural collapse of all
    or part of a building;

-   **Plumbing Leaks**: the Census Bureau should have plans detailing
    the location of plumbing lines that might pose a danger to systems
    and take steps to reduce the risk of a leak or limit the
    consequences of a leak (e.g. shutoff valves, move hardware, relocate
    plumbing lines) because leaks, like fires, can spell disaster for
    systems;

-   **Interception of Data**: the Census Bureau must be aware of the
    three primary routes of interception: direct observation,
    interception of data transmission and electromagnetic interception
    and efforts must be taken to prevent interception by any means; and

-   **Mobile and [Portable
    Systems](#what-is-the-census-bureaus-policy-on-the-use-of-portable-computers)**:
    the Census Bureau should ensure that mobile and portable systems are
    always secured when not in use and that sensitive data files are
    encrypted as a precaution in case of loss or theft.

### What are some practices I should consider when planning for physical security?

> System owners should consider the following measures when planning for
> physical security:

-   Establish controlled areas to protect information and IT resources
    and install appropriate access controls (e.g. key locks, cipher
    locks, magnetic card door locks, biometrics);

-   Apply security clearances or other information protection
    classifications (i.e. U.S. Code Title 13 and Title 26) and require
    employees to wear Department of Commerce or Census Bureau issued
    identification badges;

-   Define physical security requirements and the measures implemented
    to protect an IT resource or area in the applicable security
    plan(s);

```{=html}
<!-- -->
```
-   Keep a list of [system owners](#c.5-what-is-a-system-owner) on hand
    at any collective processing facility, along with points of contact
    and instructions for after-hours verification;

-   Route property passes for any system through the system owner to
    ensure removal of the system from the government facility is
    authorized;

-   Except when absolutely required, keep all servers or other
    networking and processing equipment separate from end-user work
    areas;

-   When necessary for end-user and server areas to be co-mingled, keep
    the servers and networking hardware in locked cabinets;

```{=html}
<!-- -->
```
-   Escort personnel when allowing access to a controlled area by a
    person not usually authorized to be in such an area (in these cases,
    establish procedures to record the visit and escort and obtain
    approval from a level commensurate with the criticality of the area
    being visited);

-   Store all keys to file cabinets, entrance doors, and desks in a
    secure location;

-   Require users to logoff with a screen saver when a workstation is
    unattended; and

-   Report all thefts to the appropriate division or office chief, the
    Department of Commerce OSY at the Census Bureau, or the Federal
    Protective Service.

### What specific environmental safeguards must be considered when planning for protection of IT resources?

> System owners must address the following environmental safeguards in
> [security plans](#_Hlt15712896) when planning for the protection of
> all Census Bureau IT systems:

-   Fire prevention, detection, and suppression;

-   Water hazard prevention, detection, and correction (e.g. plumbing
    leaks);

-   Electric power supply protection;

-   Temperature control;

-   Humidity control;

-   Natural disaster protection from earthquake, lightning, windstorm,
    etc.;

-   Magnetism protection; and

-   Good housekeeping procedures for protection against dust and dirt.

### Where can I find more information on physical and environmental security measures?

> The Census Bureau recommends that staff consult the following sources
> for more information on physical and environmental security controls:

-   The [Department of Commerce Security Manual, Section
    IV](http://www.osec.doc.gov/osy/SECURITYMANUAL/section4.htm)
    (Chapters 30 through 40);

-   The [Critical Infrastructure Protection
    section](#_What_is_a_system_owner%3F) of this document; and

-   [NIST 800-18:]{.underline} [*Guide for Developing Security Plans for
    Information Technology
    Systems*](http://csrc.ncsl.nist.gov/publications/nistpubs/800-18/Planguide.PDF).

## Special Processing Requirements

### Storing, Handling, and Destroying Sensitive But Unclassified (SBU) Information and Media

### What steps must Census Bureau employees take to provide for information protection?

> To provide for adequate handling of
> [unclassified](#how-does-sensitive-unclassified-information-differ-from-classified-national-security-information)
> information, all Census Bureau employees must:

-   Accurately categorize and label all electronic files, hard copy
    printouts, and removable media (diskettes and CD-ROMs) as Sensitive
    But Unclassified (SBU), For Official Use Only (FOUO), U.S. Code or
    Public Law protected data (for more information, see the Department
    of Commerce Security Manual, Chapters 17 and 41 for more guidance);

-   Enable [audit logging](#audits) and protect the logs;

-   Assign [sensitivity
    levels](#what-are-the-different-levels-and-types-of-information-sensitivity)
    commensurate with the information to be protected; and

-   Make appropriate use of the following:

    -   Locked media libraries;

    -   Operator instructions for handling, tampering, or other
        incidents;

    -   Read-only safeguards;

    -   Least-privilege doctrine for information availability; and

    -   Auditing of the safeguards as appropriate.

### Can For Official Use Only (FOUO) and other sensitive information be transmitted electronically?

Electronic transmission of FOUO information is authorized by phone, fax,
or e-mail when necessary for the conduct of official business. A strict
prohibition of such transmittal could seriously restrict the efficient
operation of the Census Bureau without the capability for encryption.
However, FOUO information should be encrypted in transmission because
there is no expectation of protection of information sent over an
unprotected network.

All Census Bureau employees must understand that systems such as the
Internet are un-trusted in that transmissions may be monitored,
intercepted, and modified. Information transmitted using untrusted
systems is at risk because there are no assurances that it will not be
exploited to the disadvantage of the Government. Users should exercise
caution before posting information on the Internet or using the Internet
for official government business.

### What are the policies for transmitting For Official Use Only (FOUO) and other sensitive information electronically?

> Methods of electronic transmission include voice discussions over a
> public telephone line, sending documents to or from a non-secure
> [facsimile (FAX) machine](#facsimile-fax-machines), or data
> transmission using a non-secure computer network (e.g. e-mail). Census
> Bureau employees must follow the following rules for electronic
> transmission of FOUO information:

-   Transmit FOUO information over a non-secure facsimile (FAX) machine
    without encryption is permitted; however, it is incumbent upon the
    sender to verify the fax number to which the material is being sent.
    Verification of the number requires the sender to contact the office
    by telephone and verify the correctness of the fax number. In
    addition, arrangements must be made for an authorized person to
    stand by the fax machine and promptly receive the transmission, thus
    precluding unauthorized disclosure or dissemination.

-   Verify that the originator of the information does not prohibit the
    transfer of the FOUO information through a network. If necessary,
    the sender will consult with the originator of the information to
    determine if it is permissible to transmit the information through
    an unprotected network.

-   Evaluate the risk of sending the information through an unprotected
    network if the loss or compromise of the information reveals
    vulnerabilities that could potentially cause damage to the
    originator, sender, or receiver, and proceed only upon concluding
    that the benefit of transmission exceeds potential loss or
    compromise.

-   Verify the identification of the recipient\'s phone/fax number or
    e-mail/IP address before sending the information or calling the
    individual.

-   Never leave FOUO information in a voice message on a caller's
    answering machine.

### Are there specific policies for electronically transmitting Title 13, 26, 42 and other data covered by Federal or state statute? 

Information collected, processed or disseminated that contains sensitive
data protected under Title 13, 26, 42 and other Federal or state
statutes must be encrypted.

### How should electronic media be recycled or destroyed when no longer needed?

> Electronic media, such as floppy disks or CDs, may be recycled for use
> with information of the same or higher
> [sensitivity](#what-are-the-different-levels-and-types-of-information-sensitivity).
> However, the media owner must erase data from the media by selecting
> deletion of the files and by reformatting the media or overwriting the
> media three times.

Unclassified information stored on electronic media considered excess to
the owner's needs must be completely erased (e.g., overwritten three
times, erased with commercial grade degaussing equipment, or subjected
to a media sanitization software process) or the media rendered
non-functional through shredding or other physical destruction.

### How do I provide software security when disposing of equipment or software?

> [System owners](#c.5-what-is-a-system-owner) or other responsible
> management must take steps to protect against [copyright
> infringement](#copyright), licensing violations, and other improper
> actions covered in this policy when [disposing of or recycling
> software](#how-should-electronic-media-be-recycled-or-destroyed-when-no-longer-needed)
> or equipment. In some cases, software licenses may be non-transferable
> or some other restrictions may exist.

### Processing of Census Bureau Data by Another Agency or Contractor

### What are the Census Bureau IT security requirements for data processing performed at non-Government facilities and how should I document them?

> The security requirements for processing [sensitive
> data](#what-is-sensitive-information) at non-government agencies are
> the same as for government agencies. The location of the processing
> facility does not impact the required security provisions for
> processing sensitive data. Contractors must therefore take the same
> precautions and safeguards to protect the confidentiality of Title 13
> and other sensitive data regardless of the storage media (e.g., paper,
> magnetic, electronic file, etc.) as government personnel. The
> following safeguards must be in place prior to transmitting, storing
> or using Title 13 data at a non-Government facility:

-   The contractor must obtain written approval from the Data
    Stewardship Executive Policy (DSEP) Committee;

-   The Contracting Officer's Technical Representative (COTR) must
    ensure that the contractor's have obtained Special Sworn Status and
    have undergone the appropriate type of suitability and security
    investigation;

-   The IT Security Officer must verify that a system security plan has
    been completed; and

-   The COTR must ensure that specify special processing requirements
    and reference Census Bureau Title 13 and sensitive data policies are
    explicitly stated in an approved contract.

### Processing of Another Agency's Data by the Census Bureau

### What are the Census Bureau IT security requirements for processing non-Census Bureau data at Census Bureau facilities? 

> Many Census Bureau programs require the input of data from other
> Federal Government, state and non-government organizations. Some of
> this data may be protected under the provisions of Federal and State
> laws or is considered proprietary. Regardless, Census Bureau employees
> and contractors are responsible for protecting this data in accordance
> with the Census Bureau's policies for sensitive data (e.g., Title 13
> and Title 26). In addition, they must carefully implement any specific
> controls required by the sponsoring organization. Specifically, the
> Census Bureau must comply with the following policies when processing
> another agency's data:

-   Comply with all confidentiality and legal requirements when
    performing reimbursable work under the Census Bureau's data
    collection authority or when using Census Bureau records;

-   Implement the security controls required for sensitive data as
    contained in the Census Bureau IT Security Program Policy document;

-   Do not commingle data provided by the sponsoring agency with Census
    Bureau or other data, unless specifically authorized to do so; and

-   Conduct regular inspections of procedures to properly handle and
    protect another agency or organization's data.

## Contingency Planning

### What is Contingency Planning?

> Federal agencies must have a plan in place to minimize the risk of
> disruption due to system unavailability. A contingency plan details
> the steps required to successfully restore and operate systems and
> business functions during a significant disruption. Development of
> [contingency
> plans](#what-elements-should-be-included-in-a-contingency-plan) for
> all major application and general support systems is the critical step
> in implementing a comprehensive contingency planning program.
>
> Contingency planning applies to the following common IT processing
> systems:

-   Desktop computers and portable systems (laptop and handheld
    computers);

-   Servers;

-   Web sites;

-   Local area networks (LANs);

-   Wide area networks (WANs);

-   Distributed systems; and

-   Mainframe systems.

### Who has responsibility for contingency planning?

+-----------------+----------------------------------------------------+
| **Role**        | **Responsibility**                                 |
+-----------------+----------------------------------------------------+
| System Owners   | -   Develop contingency plan(s);                   |
|                 |                                                    |
|                 | -   Test contingency plan(s) on an annual basis;   |
|                 |                                                    |
|                 | -   Maintain and update contingency plan(s); and   |
|                 |                                                    |
|                 | -   Implement contingency plan for their system(s) |
|                 |     in the event of a disruption or failure.       |
+-----------------+----------------------------------------------------+
| DSOs            | -   Ensure that viable contingency plans are       |
|                 |     developed for each system under their purview; |
|                 |                                                    |
|                 | -   Review contingency plans on an annual basis;   |
|                 |                                                    |
|                 | -   Coordinate contingency activities between the  |
|                 |     system owner and the IT Security Officer; and  |
|                 |                                                    |
|                 | -   Report status of contingency activities to the |
|                 |     IT Security Officer in the event of a system   |
|                 |     disruption or failure.                         |
+-----------------+----------------------------------------------------+
| IT Security     | -   Provide Guidance to system owners and DSOs on  |
| Officer         |     plan development;                              |
|                 |                                                    |
|                 | -   Ensure the development of plans for all Census |
|                 |     Bureau major application and general support   |
|                 |     systems; and                                   |
|                 |                                                    |
|                 | -   Coordinate all contingency activities in the   |
|                 |     event of a system disruption or failure.       |
+-----------------+----------------------------------------------------+

### What are systems owners required to do to fulfill policy requirements for Contingency Planning?

> The Census Bureau requires that the DSO and system owners:

-   Identify the most critical and sensitive operations and their
    supporting computer resources;

-   Develop, document, and test a comprehensive contingency plan for all
    [general support systems](#c.1-what-is-a-general-support-system) and
    [major applications](#c.2-what-is-a-major-application) at least
    annually;

-   Designate one person to coordinate the development, maintenance, and
    testing of the contingency plan; and

-   Follow the Department of Commerce
    [guidelines](http://www.doc.gov/cio/itmhweb/guideline9.htm) on
    business continuity planning, which provides a framework to assist
    in understanding the different business continuity program
    requirements and their relationships.

### What elements should be included in a contingency plan?

> A comprehensive contingency plan must:

-   Identify contingency planning teams;

-   Assign roles and responsibilities of team members;

-   Address procedures for restoring an IT system following disruption
    and during each phase of restoration and for ensuring the
    confidentiality and integrity of system data;

```{=html}
<!-- -->
```
-   Describe test plans for individual recovery procedures;

-   Detail training procedures for personnel with contingency plan
    responsibilities; and

-   List technical capabilities designed to support contingency
    operations.

> In developing a contingency plan, system owners should prepare for the
> three key phases of a system disruption or outage by identifying
> specific actions for each stage of the plan.
>
> The three phases are:

-   Notification/Activation Phase: initial actions, such as notifying
    recovery teams, assessing system damage and implementing the
    contingency plan, are commenced to prepare for restoration of system
    functions once it is realized that a system is down or about to
    fail;

-   Recovery Phase: certain procedures, such as resorting to temporary
    manual processes, recovering and using an alternate system, or
    relocating to an offsite or alternate location, are executed to
    implement temporary systems or processes to restore business
    functions and make the system operational;

-   Reconstitution Phase: teams are deployed to restore or replace the
    IT system, transfer operations on a semi-permanent basis to a
    temporary site, and/or restore normal operations back at the main
    facility, or in the event that the original facility is not
    available, at a new site until a permanent facility is operational.

### How often should contingency plans be updated?

> Contingency plans are required as part of the certification and
> accreditation process of a new system or whenever significant changes
> are made to an operational system. For existing systems, plans should
> be tested and updated as needed, at least annually, or whenever a
> major change to a system occurs.
>
> Critical systems, or those with a high degree of risk, should have a
> more robust testing cycle. A full test of the critical system's
> contingency plan should be conducted at least annually (and upon
> modification to the system). Specific, essential components of the
> plan (e.g., contact list, data inventory, etc.) should be tested at
> regular intervals throughout the year to ensure their continued
> relevance and effectiveness.

### Where can I find more information on Contingency Planning?

> For more information, the Census Bureau recommends that system owners
> consult the National Institute of Standards and Technology Special
> Publication 800-34, [*Contingency Planning Guide for Information
> Technology
> Systems*](http://csrc.nist.gov/publications/nistpubs/800-34/sp800-34.pdf),
> which describes the best practices for contingency planning.

## Software Maintenance Controls

Software maintenance controls are used to monitor the installation of,
and updates to, software in order to ensure that the system functions as
expected and that a historical record is maintained of changes. Software
maintenance controls are also meant to limit the type of software
installed on the system so as to prevent the installation and use of
unauthorized software on Census Bureau systems. The process of
[configuration
management](#what-documentation-must-be-maintained-to-adequately-track-and-record-changes-to-a-system)
provides for a controlled environment in which changes to software and
hardware are properly authorized, tested, and approved before
implementation.

### Configuration Management

### What does the Census Bureau require for configuration management of system software?

> The Census Bureau requires that system owners establish procedures for
> the configuration management of all [**general support
> systems**](#c.1-what-is-a-general-support-system) and [**major
> applications**](#c.2-what-is-a-major-application). In addition, the
> system security plan must describe how changes to the system or
> application will be authorized, documented, controlled, tested, and
> implemented. For additional information on Census Bureau software
> configuration requirements and a description of the process, refer to
> [**IT Standard 13.0.1 Software Configuration
> Management**](http://cww2.census.gov/it/ssd/itsupp/standards/13_0_1.htm#3.1).
> Note that this standard applies to and is only required for software
> configurations, but may also be used for hardware systems.

### What documentation must be maintained to adequately track and record changes to a system?

> The process of configuration management ensures the systematic
> completion of authorized changes to the configuration, or structure,
> of an item. Documentation shall include:

-   **Configuration Identification**: defines what the item is (e.g.,
    system specifications, system or program documentation, set-up of a
    hardware or software component of a system, etc.), and assigns the
    item a unique identifier such as a number or title and version
    number;

-   **Configuration Control Authorization**: requires that changes to an
    item under configuration management are authorized by a management
    official in writing and tested before implementation;

-   **Configuration Status Accounting**: provides for 1) life cycle
    tracking from the point of management authorization to the point of
    testing of authorized changes, 2) the final acceptance and
    implementation of changed items into the production computing
    environment, and 3) a description of the reason for the change, the
    implementation of the change, and the immediate results of the
    change; and

-   **Configuration Auditing**: provides the documentation and tracing
    of authorized modifications to an existing system or document.

### Operating Systems Software

> The operating system is an organized collection of routines and
> procedures for operating a computer. Functions performed include: 1)
> scheduling, loading, initiating, and supervising the execution of
> programs; 2) allocating storage and other facilities; 3) initiating
> and controlling input/output operations; and 4) handling errors.

### How is security provided in Operating System software?

> In order to provide for security in Operating System (OS) software,
> the [system owner](#c.5-what-is-a-system-owner) or other responsible
> management must select and configure the OS to:

-   Provide authentication and access control for system users, system
    resources, and system applications including the ability to control
    access to objects based on a user's profile;

-   Identify, audit, report, and assign accountability for certain
    functions (as defined by the system owner) performed or attempted by
    a system user;

-   Encrypt software history and audit logs as appropriate;

-   Maintain an audit trail of 1) login attempts, 2) password changes
    (minimum history of 13 passwords), and 3) file creations, changes,
    or deletions sufficient to support security reviews;

-   Prevent unauthorized access by clearing all protected information on
    objects before they are allocated or reallocated out of or into the
    system. Whenever disk media leaves the agency, regardless of
    purpose, any protected information must be destroyed by overwriting
    all data tracks a minimum of three times or using other appropriate
    means to prevent access;

-   Separate resources of one user from the resources of other users and
    the OS;

-   Enable maintenance by the minimum number of authorized persons;

-   Enable copying the OS after each modification and ensure secure
    storage of copies of the modified OS; and

-   Cause the following []{#warning_banner .anchor}warning banner screen
    (or close approximation) to be displayed to system users at login:

> **\*\*WARNING\*\*WARNING\*\*WARNING\*\*WARNING\*\*WARNING\*\***
>
> **This is a Census Bureau computer system. Census Bureau computer
> systems are provided for the processing of official U.S. Government
> information only. All data contained within Census Bureau computer
> systems is owned by the Census Bureau, and may be monitored,
> intercepted, recorded, read, copied, or captured in any manner and
> disclosed in any manner, by authorized personnel. THERE IS NO RIGHT OF
> PRIVACY IN THIS SYSTEM. System personnel may disclose any potential
> evidence of crime found on Census Bureau computer systems to
> appropriate authorities. USE OF THIS SYSTEM BY ANY USER, AUTHORIZED OR
> UNAUTHORIZED, CONSTITUTES CONSENT TO THIS MONITORING, INTERCEPTION,
> RECORDING, READING, COPYING, CAPTURING, and DISCLOSURE OF COMPUTER
> ACTIVITY. Use of this computer without authorization or for
> unauthorized purposes is a violation of federal law and punishable by
> fines or imprisonment (Public Law 99-474).**
>
> **\*\*WARNING\*\*WARNING\*\*WARNING\*\*WARNING\*\*WARNING\*\***

### Where can I find additional information on securing operating system software?

> For additional information regarding secure operating system
> configurations, the Census Bureau recommends that employees consult
> the following sources:

-   [Department of Commerce CIRT](https://www.cirt.doc.gov/), which
    provides information on Department of Commerce's *Security and
    Technology Implementation Guides* (STIGs);

-   National Institute of Standards and Technology draft Special
    Publication 800-43, "[*SA Guidance for
    W2K*](http://cs-www.ncsl.nist.gov/itsec/guidance_W2Kpro.html)";

-   National Security Agency which provides recommended configurations
    for UNIX, WindowsNT, and other operating systems
    ([http://nsa1.www.conxion.com](http://nsa1.www.conxion.com/)); and

-   Center for Internet Security that provides free benchmarking tools
    based on security configuration specifications that represent a
    prudent level of due care and are working together to define
    consensus best-practice security configurations for computers
    connected to the Internet (<http://www.cisecurity.org/>).

### Application Software and Change Controls

### Why are application software change controls important?

Application software used to process sensitive data is the heart of an
organization's computer operations. It is, therefore, essential to have
the proper controls in place to track changes to the application
software to protect it from accidental or intentional corruption or
destruction.

> Software change controls must be implemented because:

-   Software can easily be modified for nefarious purposes;

-   Software can be stolen;

-   Software can be problematic in use and installation; and

-   Software must be accounted for and supported.

### What is required for application software controls?

> [System owners](#c.5-what-is-a-system-owner) must implement the
> following controls:

-   Define security requirements and specifications in the system
    [development/acquisition stage](#developmentacquisition-stage) for
    system confidentiality and availability as well as integrity of data
    input, transaction processing, and data output;

-   Test the application in a development environment, or test bed,
    prior to installing it in an operational environment in order to
    ensure the presence and satisfactory operation of controls (this is
    normally part of the [certification](#certification) process);

-   Test new or substantially modified applications prior to
    implementation to verify that the required physical, administrative,
    and technical safeguards are present and operate adequately;

-   Certify sensitive application software as required by OMB A-130
    prior to placing it in a operational status;

-   Request, document, and approve changes to existing applications in
    accordance with [Standard 13.0.1: Software Configuration
    Management](http://cww2.census.gov/it/ssd/itsupp/standards/13_0_1.htm)
    and recertify and reaccredit as needed;

-   Ensure that security controls fully satisfy all applicable Federal
    information protection policies, regulations, and standards;

-   Monitor security controls for vulnerabilities throughout the
    [operation and maintenance stage](#operation-and-maintenance-stage);

-   Limit access to software programming libraries; and

-   Protect system documentation with the same diligence as the data
    including maintaining copies of critical application software,
    documentation, and databases at a secure off-site location in case
    of emergency.

### How can I safeguard the integrity of major application software?

> The [system owner](#c.5-what-is-a-system-owner) or other responsible
> management assures integrity of [major
> applications](#c.2-what-is-a-major-application) and operating systems
> software by implementing documented, effective, [configuration
> management](#configuration-management) procedures including:

-   Restricting the ability to update, upgrade, install, and uninstall
    software to only those authorized by the system owner;

-   Auditing all changes and maintaining a copy of the audit in a secure
    manner;

-   Maintaining a copy of old and new software changes in a secure
    manner; and

-   Testing all changes on non-live data prior to deploying changes in a
    live environment.

### Where can I find more information on controls for applications software?

> The Census Bureau recommends the following sources for application
> software controls:

-   GAO/AIMD-00-21.2.2, [*Core Financial System
    Checklist*](http://www.gao.gov/special.pubs/ai2122.pdf);

-   GAO/AIMD-00.21.2.3, [*HR and Payroll Systems
    Requirements*](http://www.gao.gov/special.pubs/ai2123.pdf);

-   GAO/AIMD-21.2.8, [*Travel System
    Requirements*](http://www.gao.gov/special.pubs/ai2128.pdf); and

-   GAO-01-911G, *[Grant Financial System
    Requirements](http://www.gao.gov/new.items/d01911g.pdf).*

### Licensing/Inventory Control

### Are there special provisions for copyrighted software?

> []{#copyright .anchor}All Census Bureau employees must use and
> distribute commercial software in accordance with copyright laws and
> licensing agreements. The IT Security Officer will communicate the
> following policies on the use of copyrighted software and licensing of
> software to all Census Bureau employees:

-   Install only commercial software, including shareware, that has been
    purchased through the Government procurement process and authorized
    for installation;

```{=html}
<!-- -->
```
-   Follow all provisions of the licensing agreements issued with the
    software and register organizational ownership;

-   Not make any illegal copies of [copyrighted software](#copyright)
    (normally the license will allow a single copy to be made for
    archival purposes and if the license is for multiple users, do not
    exceed the authorized number of copies);

-   Inventory, at least annually, all software on each individual
    workstation and audit against the organization\'s license agreement
    records to ensure that no illegal copies of commercial software are
    installed on any equipment;

-   Maintain written records of software installed on each system and
    ensure that a license or other proof of ownership is on file for
    each piece of software;

-   Store licenses, software manuals, and procurement documentation in a
    secure location (e.g., closed file cabinet, etc.);

-   [Dispose](#how-should-electronic-media-be-recycled-or-destroyed-when-no-longer-needed)
    of the old version, when upgrades to software are purchased, in
    accordance with the licensing agreement to avoid a potential
    violation (upgraded software is considered a continuation of the
    original license, not an additional license);

-   Only take copies of Government software home for use on personally
    owned computers under specific circumstances, such as performing
    Government work and not personal business, when the license
    specifically states that employees may do so;

-   Delete all illegal copies of software immediately upon detection;
    and

> Employees can and will be held personally liable for any infringements
> of the above policies.

### Mobile Code

### What is mobile code?

The National Institute of Standards and Technology (NIST) defines mobile
code, or agents, as "autonomous software entities that can halt
themselves, ship themselves to another agent-enabled host on the
network, and continue execution, deciding where to go and what to do
along the way." Mobile agents are goal-oriented, can communicate with
other agents, and can continue to operate even after the machine that
launched them has been removed from the network. However, NIST has
identified a number of advantages of using mobile code and mobile agent
computing paradigms, including overcoming network latency, reducing
network load, and having robust and fault-tolerant behavior.

### What is the Census Bureau policy for allowing mobile code?

The Census Bureau does not prohibit the use of mobile code, because
doing so might impair certain business operations. Instead, the Census
Bureau requires each system owner, in coordination with the IT Security
Officer, the DSO and the system administrator, to assess the risk of
harm to IT systems from allowing malicious mobile code, such as JAVA
script, to run on its systems. The mobile code and mobile
agent-computing paradigm pose several privacy and security concerns.
However, industry, government, and academia are currently developing
applications for use in such areas as telecommunications systems,
personal digital assistants, information management, parallel
processing, and computer simulation. Security issues include:
authentication, identification, secure messaging, certification, trusted
third parties, non-repudiation, and resource control.

Mobile agent frameworks must be able to counter new threats as agent
hosts must be protected from malicious agents, agents must be protected
from malicious hosts, and agents must be protected from malicious
agents. The National Institute of Standards and Technology currently has
a project under way to evaluate security countermeasures to attacks from
malicious mobile code. In the meantime, NIST recommends that all federal
organizations become familiar with all of the available security
options, such as augmented firewalls, and use them accordingly to
protect systems.

## Hardware Maintenance Controls 

### What are hardware maintenance controls?

> Hardware maintenance controls are used to monitor the installation,
> update, or modification to system hardware. By implementing certain
> controls, system owners and users are assured that the system will
> continue to function properly and be available to perform the
> specified functions. Hardware controls include:

-   Acquisition of hardware;

-   [Configuration management](#configuration-management) to document
    changes to hardware;

-   Restrictions on the use of personal computers;

-   Policies on the authorized uses of portable computers; and

-   Procedures for emergency repair and maintenance of hardware.

### What is required for the acquisition of system hardware?

> Requests for purchases of system hardware must go through the formal
> acquisition process. Acquisitions will work closely with ISSRO and
> ITSO to ensure that:

-   Proper security reviews are conducted to determine that hardware
    meets Census Bureau security standards; and

-   An IT plan has been submitted and contains adequate security
    controls.

> For additional information on Census Bureau IT acquisition policy,
> refer to: [**www.census.gov/acq**](http://www.census.gov/acq).

### What does the Census Bureau require for the process of configuration management?

> The Census Bureau requires that system owners establish procedures for
> configuration management of all system hardware to support [**general
> support systems**](#c.1-what-is-a-general-support-system) and [**major
> applications**](#c.2-what-is-a-major-application). In addition, the
> system security plan must describe how modifications to system
> hardware are authorized, documented, controlled, tested, and
> implemented. For additional information on Census Bureau software
> configuration requirements and a description of the process, refer to
> [**IT Standard 13.0.1 Software Configuration
> Management**](http://cww2.census.gov/it/ssd/itsupp/standards/13_0_1.htm).
> Note that this standard applies to and is only required for software
> configurations, but may also be used for hardware systems.

### What is the Census Bureau's policy on the use of personal computers? 

> A personal computer (PC) is defined by the Census Bureau as a single
> user computer system used by most employees for office automation,
> project work, and software and system development. Because personal
> computers have a tremendous amount of computing power and are not
> always managed centrally, certain precautions must be taken to
> safeguard these assets and protect them from potential security
> breaches. The Census Bureau requires that all users follow these
> guidelines to protect Census Bureau IT assets:

-   Limit physical and logical access to your PC;

-   Log out and turn off the PC when not in use;

-   Use locking devices to secure hardware when available;

-   Avoid storing sensitive data in the PC;

-   Prevent unauthorized software from being installed on your PC;

-   Scan all incoming and outgoing diskettes for
    [**viruses**](#what-is-a-virus-or-malicious-code-and-how-does-it-operate);

-   Label and store diskettes securely when not in use;

-   Prior to reuse, overwrite all magnetic media containing sensitive
    data a minimum of three times with a commercial disk utility program
    (if unable to overwrite, degauss using a commercial degausser); and

-   User screen savers to protect sensitive information from being
    displayed and to protect sensitive data while your PC is unattended
    for short periods of time.

### What is the Census Bureau's policy on the use of portable computers?

> Portable computers such as laptops and other devices are being used
> increasingly by employees to support survey projects in the field and
> to perform the Census Bureau work while on business travel. Users must
> be keenly aware of the security vulnerabilities and associated
> requirements of portable computers, particularly when storing or
> downloading sensitive data. While portable computers afford a certain
> level of convenience, users must take extra precautions when accessing
> or transmitting data over unprotected communication lines, such as
> from home, a hotel room, a car phone, or an airport payphone.
>
> To determine the appropriate security controls for these systems, a
> risk assessment should be conducted with consideration given to issues
> such as the nature of the environment in which you are working, the
> type and quantity of processing, the sensitivity of the data being
> stored and transmitted and the communication lines over which the data
> is transmitted. Users should follow these guidelines when entrusted
> with a Census Bureau portable computer:

-   Perform a risk assessment to determine appropriate security
    controls;

-   Store the equipment in a locked container or room, such that it is
    out of sight and inaccessible to potential thieves (this might
    include the trunk of car, safe or storage room);

-   Store sensitive data on removable diskettes or CDs and keep them
    locked up when not use;

-   Encrypt [**sensitive**](#what-is-sensitive-information)
    information/data stored on portable computers; and

-   Document the security controls and train portable computer users on
    these controls.

## Data Integrity

###  {#section-1 .unnumbered}

### Explanation of Data Integrity Controls

### What are data integrity controls and how do they pertain to system owners? 

> Data integrity controls protect data from accidental or malicious
> alteration or destruction and provide assurance to the user that the
> information meets expectations about its quality and integrity.
> Safeguards must be in place to detect and minimize inadvertent or
> malicious modification or destruction, or attempts to do so, of
> sensitive application software, operating system software, and
> critical data files. Safeguards should be commensurate with the
> sensitivity of the data processed.
>
> The Census Bureau requires that system owners:

-   Implement, and update, virus detection and elimination software to
    protect data from alteration by malicious code;

-   Implement adequate and cost-effective data validation controls to
    assure users that the information meets expectations about quality
    and integrity; and

-   Notify personnel of their responsibilities for protecting data from
    unauthorized destruction or alteration.

### What types of data integrity controls are recommended?

> Where appropriate and cost-effective for adequate security, the Census
> Bureau recommends system owners consider the following data validation
> controls:

-   Implement reconciliation routines for applications (i.e., checksums,
    hash totals, record counts);

-   Implement integrity verification programs used by applications to
    look for evidence of data tampering, errors, and omissions;

-   Establish procedures to monitor for inappropriate or unusual system
    activity, and report, investigate, and take appropriate actions if
    discovered;

-   Establish procedures to determine compliance with password policies;

-   Install intrusion detection tools on the system, routinely review
    intrusion detection reports, and [handle suspected
    incidents](#what-incident-handling-processes-comprise-the-circ)
    accordingly;

-   Conduct penetration and [vulnerability
    testing](#vulnerability-testing) of the system;

-   Conduct system performance monitoring to analyze system performance
    logs in real time to look for availability problems, including
    active attacks;

-   Use static protection equipment, surge suppressors, or electrical
    power filters on all microcomputers and PCs to protect against the
    risk of power surges and static electricity;

-   Use uninterrupted power supply (UPS) on all servers and individual
    workstations that are used to process sensitive information;

-   Use "write-protect" rings and other similar safeguards on all media
    to prevent inadvertent destruction (e.g. overwriting) of data;

-   Store and control all sensitive data on media such as magnetic tape,
    disk and similar devices in a media library when not required for
    processing (materials should be locked in a safe or cabinet with all
    other controls in place);

-   Backup essential data; and

-   Use message authentication.

### Virus Protection

### What is a virus (or malicious code) and how does it operate? 

The proliferation of Web-based services and the use of the Internet in
daily business operations present an increasingly serious security risk
for computer systems and networks. Malicious code can be easily spread
through software bulletin boards, shareware, and contaminated data files
and by users unknowingly copying and sharing contaminated data files and
software products. Moreover, a virus can mask itself and execute and
replicate behind another program causing massive amounts of damage
without the user's knowledge (e.g., Trojan horses, network worms). The
Slammer virus was a harsh reminder to many government and non-government
organizations of the vulnerability of their computer networks to
viruses.

A virus can rapidly destroy vital data and disable computer programs, if
not entire networks, resulting in lost staff productivity and financial
and computing resources. Thus, sound IT security procedures are critical
to carrying out the mission of the Census Bureau. These procedures must
provide for detection and prevention of computer viruses and
minimization of the impact of any malicious programs.

### What does the Census Bureau require of users to prevent the infection by or spread of viruses? 

Although the following policies are the responsibility of the IT
Security Office, all Census Bureau employees must be aware of, and make
every effort to, abide by them:

-   Use updated anti-virus software to ensure the timely detection and
    elimination of viral infections on IT systems;

-   Run an anti-virus software package on all LAN Servers, PCs and other
    workstations;

-   Obtain the necessary authorizations and licensing before purchasing
    and installing software;

-   Contact a system administrator to install authorized software (only
    system administrators are allowed to install software);

-   Train and brief all division personnel during the IT security
    briefing on viral detection and elimination procedures and policies;

-   Scan all new computers, servers, software and media prior to
    installation or introduction to a system including:

```{=html}
<!-- -->
```
-   Removable magnetic or optical recording media (e.g., floppy disks,
    CD-ROM, etc.), regardless of source; and

-   Fixed storage devices (e.g., hard drives, R/W Optical, etc.), on a
    periodic basis;

```{=html}
<!-- -->
```
-   Screen all files downloaded from the Internet with virus detection
    software prior to running; and

-   Implement procedures to ensure that critical data can be recovered
    in the event of a system corruption.

### What should I do if my computer has a virus or I suspect that my computer or software has been infected? 

> All incidents, detected or suspected, must be reported immediately to
> the Census Bureau IT Security Officer and the DSO.

### Where can I find additional guidance on viruses? 

> For additional explanation on viruses and the procedures for
> preventing, detecting and recovering, refer to [Virus
> "101"](http://cww2.census.gov/it/itso/itso_virus101.asp) on the Census
> Bureau IT Web site.

### Patch Management

### What must be included in a security patch management program?

The Census Bureau requires the IT Security Officer to have a process in
place to identify, track, and report on security patch management. The
process must address the following requirements for a patch management
program:

-   Establish a mechanism for ensuring accountability for patch
    management (resources committed to this activity should be
    appropriate to the size and scope of the Census Bureau mission);

-   Centralize patch management leadership to assure that suitable
    attention is given in a timely way to patches for all systems, and
    to minimize duplication of patch management functions across the
    operating unit;

-   Document procedures to identify, track, test (as appropriate), and
    disseminate security-related information concerning patches; and

-   Ensure compliance with these procedures to guide patch management
    throughout the Census Bureau.

System administrators are responsible for ensuring that current patches
are installed on the systems they manage within five working days of
receiving the patch. Once a patch has been installed, system owners must
notify the IT Security Officer. If a patch cannot be installed, the
system owner must obtain approval from the IT Security Officer.

### Where can I find additional information on patch management?

> Policy guidance is available on the Census Bureau's IT Security Web
> site. In addition, the Census Bureau recommends National Institute of
> Standards and Technology Special Publication 800-40, [*Procedures for
> Handling Security
> Patches*](http://csrc.nist.gov/publications/nistpubs/800-40/sp800-40.pdf)
> for additional information on software patch management. FedCIRC
> provides a [patch authentication and dissemination capability
> (PADC)](http://www.fedcirc.gov/patches.pdf) program, a free service
> for Federal civilian agencies, that obtains patches from vendors,
> validates that the patch does what it states that it was created to
> correct, and provides agency notification.

## Documentation

### What comprises system documentation and who maintains it?

> System documentation contains descriptions of the system hardware,
> software, policies, standards, procedures, and approvals related to
> the system [life cycle](#system-life-cycle-management) and formalize
> the system's security controls. The system owner maintains the
> documentation as part of the [System Security Plan Certification and
> Accreditation
> Package](#what-documentation-is-required-in-the-system-security-plan-certification-and-accreditation-package).
> Documentation consists of:

-   Vendor-supplied documentation of purchased software;

-   Vendor-supplied documentation of purchased hardware;

-   Application documentation for in-house applications;

-   Network diagrams and documentation on setups of routers and
    switches;

-   Software and hardware testing procedures and results;

-   Standard operating procedures for all the topic areas covered in
    this document;

-   User manuals;

-   Emergency procedures;

-   Backup procedures;

-   System security plan;

-   Contingency plan;

-   Written agreements regarding how data is shared between
    interconnected systems;

-   Risk assessment reports;

-   Certification and accreditation documents; and

-   Audit logs.

### What are the minimum Census Bureau requirements for system documentation?

> The Census Bureau requires that system owners ensure that:

-   Sufficient documentation exists to explain how software/hardware is
    to be used; and

-   Formal documentation of security and operational procedures and
    standards.

## IT Security Awareness, Training, and Education

### Why is IT Security awareness, training and education policy required?

> According to the [Computer Security Act](#csa_of_1987), all federal
> employees and contractors involved in the management, use or operation
> of federal computer systems are required to completed periodic
> security awareness and training. The Office of Management and Budget
> (OMB) reinforced this requirement in OMB Circular A-130 by stipulating
> the completion of such training prior to granting access to a federal
> system. Users must also clearly understand and acknowledge agreement
> with the acceptable [rules of
> behavior](#what-are-rules-of-behavior-and-how-does-the-census-bureau-use-them)
> prior to being issued access.

### What is the IT Security awareness, training, and education policy?

> The Census Bureau requires that:

-   The IT security program includes an IT security awareness, training,
    and education component that applies to all employees (federal and
    contractor) as well as remote researchers and collaborators working
    on Census Bureau projects, and temporary guests of the Census
    Bureau. The component must include IT security awareness activities,
    IT security formal training activities for general users, and IT
    security formal training activities for specialized users.

-   Participation in IT security training must be tracked.

-   Each user of Census Bureau IT systems must be trained before being
    granted permanent access to any Census Bureau IT system. The Census
    Bureau requires that each user engage in annual refresher training
    to sustain such access. The rigor of the training may vary depending
    on the risk of harm posed by the user. For example, a guest for two
    days may be provided a document of the system rules to sign
    acknowledging their understanding and acceptance, whereas a
    three-month summer intern may be required to complete a Web-based
    training course.

-   Access provided to members of the public must be constrained by
    controls in the applications through which access is allowed, and
    awareness of such controls must be made available to members of the
    public.

### What is IT security awareness?

> IT security awareness consists of subtle reminders that focus the
> user's attention on the concept of IT security in the user's daily
> routine. IT Security awareness provides a general cognizance or
> mindfulness of one's actions, and the consequences of those actions.
> Awareness activities provide the means to highlight when a significant
> change in the IT security program policy or procedures occurs, when an
> incident occurs, or when a weakness in a security control is found. IT
> security awareness includes:

-   Email alerts;

-   Lectures;

-   Network log-in banners;

-   Promotional trinkets with security messages;

-   Posters and flyers;

-   IT security events (such as IT security days, vendor exhibits, user
    conferences); and

-   IT security program Web portals.

### What is IT security training?

> IT security training develops skills and knowledge so computer users
> can perform their jobs more securely and build in-depth knowledge,
> producing relevant and necessary security skills and competencies in
> those who access or manage Census Bureau information and resources.

### What is IT security education?

> IT security education goes a step beyond training to integrate all
> (security skills and competencies) into a common body of knowledge,
> adding a multidisciplinary study of concepts, issues, and principles.
> This policy does not distinguish between training and education at
> this time.

### Who is responsible for development of IT security awareness and training materials?

> The IT Security Officer must ensure that the IT security program
> provides for the development and management of IT security awareness
> and training.

### How should security awareness and training be tracked?

> The ITSO must maintain on file, a record of the various awareness
> activities used within the Program component. Each division and office
> chief must designate a DSO to coordinate training with the division or
> office. The DSO must maintain an auditing, tracking, or reporting
> mechanism that records the training activities and registrants within
> the Program component, and must include:

-   Who receives formal general and specialized training following a
    specific curriculum (not who receives or is exposed to awareness
    materials only, such as pamphlets or posters);

-   What the general or specialized training consisted of; and

-   When persons received general or specialized training.

### Are there exemptions to the user-training requirement?

> The Census Bureau does not allow exceptions to the user-training
> requirement. However, a user may be granted access where orientation
> is provided with granted access, until training can be met. In this
> instance, training must be met within 30 calendar days. Otherwise,
> access must be suspended until training requirements can be met.

### What are the consequences if a user does not engage in general or specialized training?

> The Census Bureau requires that minimally, if a user refuses to engage
> in, or cannot meet the training due to extenuating circumstance,
> access to information and resources must be immediately suspended or
> terminated. This may result in personnel action if access is required
> for fulfillment of position responsibilities.

### What are functions requiring specialized training?

> There may exist a need to provide specialized training to groups
> conducting specialized roles. The roles that may require specialized
> training include, but are not limited to:

-   Those having a specialized service, for example telecommuters (or
    those who remotely access).

-   Those having information technology management authority, for
    example:

```{=html}
<!-- -->
```
-   Designated Approving Authority;

-   Chief Information Officer;

-   Critical Information Protection Program Manager;

-   Information Technology Security Program Manager;

-   Information Technology Security Officer; and

-   System Owners.

```{=html}
<!-- -->
```
-   Those having information technology management supporting roles, for
    example:

```{=html}
<!-- -->
```
-   Administrative Staff;

-   Audit Staff;

-   Information Coordinators;

-   Information System Security Officer/Division Security Officer (DSO);

-   Legal Staff;

-   Public Affairs Personnel;

-   Privacy and FOIA Officials;

-   Property Officials; and

-   Records Management Officials.

```{=html}
<!-- -->
```
-   Those having authority to enter into user agreements or arrangements
    on behalf of the Census Bureau, for example:

```{=html}
<!-- -->
```
-   Managers;

-   Human Resource personnel;

-   Acquisition and Assistance staff;

-   Contracting Officers; and

-   Contracting Officers Technical Representatives (COTRs).

```{=html}
<!-- -->
```
-   Those performing a technical function, for example:

```{=html}
<!-- -->
```
-   Application Developer;

-   Database Administrator;

-   Network Administrator;

-   System Administrator (includes Telephony);

-   Console Operator;

-   System Developers;

-   Programmers;

-   Web Administrators; and

-   Technical Support (Help Desk personnel).

> It is at the discretion of the IT Security Officer to determine which
> roles require additional specialized training.

### Who should I contact if my IT security training needs are not being met?

> If your IT security training needs are not being met, contact the IT
> Security Officer. If your needs continue not to be met, contact the
> Census Bureau CIO.

### Does the Census Bureau require professional security certifications?

> Professional security certifications are not required. It is at the
> discretion of the IT Security Officer and applicable division chief to
> determine whether professional security certifications are required
> for ensuring the minimum knowledge, skill, and ability level of the IT
> security staff. However, all personnel responsible for system security
> within the division or office must be proficient in the initial
> handling of any security problems that are encountered.

### Where can I find further information on awareness and training?

The Census Bureau recommends the following sources for more information
on IT security awareness and training:

-   The Census Bureau's [IT Security Awareness Training Web
    site](http://cww2.census.gov/it/itso/itso_SecurityAwareness.asp?ID=ITSO-04&category=06);

-   SANS' [Institute Training and Global Information Assurance
    Certification (GIAC)](http://www.giac.org/program.php);

-   National Institute of Standards and Technology Special Publication
    800-16*, [Information Technology Security Training Requirements: A
    Role- and Performance-Based
    Model](http://csrc.ncsl.nist.gov/publications/nistpubs/800-16/800-16.pdf)*;
    and

-   The National Institute of Training and Technology Computer Security
    Resource Center's [Awareness, Training, and
    Education](http://csrc.nist.gov/ATE) Web site.

## Incident Response Capability

### What is a reportable incident?

A reportable incident consists of any act that violates an explicit or
implied security policy within the Census Bureau. More specifically, an
incident is any adverse event that threatens the security of information
resources. Incidents may include, but are not limited to:

-   **Compromise of integrity**: when a virus infects a system or
    network;

-   **Denial of service attack**: when an attacker has disabled a system
    or a network worm has used all available network bandwidth;

-   **Loss of accountability/misuse**: when an intruder or insider uses
    an account or a system for unauthorized or illegal purposes;

-   **Damage to any part of the system**: when a virus or disgruntled
    employee destroys data; and

-   **Compromise of confidentiality/intrusion**: when an unauthorized
    outsider gains access to your IT resources.

### What are the types of reportable incidents?

> System users must report occurrences of the following types to their
> designated [computer incident response
> capability](#what-is-a-computer-incident-response-capability-circ)
> (CIRC) or [computer incident response team](#cirt) (Census Bureau
> CIRT). Users should contact their IT Security Officer if they do not
> know whom to contact within their organization.

#### [Unauthorized Access]{.underline}: {#unauthorized-access .unnumbered}

-   Report all unauthorized, successful accesses (if unauthorized access
    is suspected but not yet proven, report it);

-   Report stolen passwords or attempts to steal or crack passwords; and

-   Report all unsuccessful attempts of unauthorized access (CIRCs or
    CIRTs determine if the attempts are considered to be significant or
    unusually persistent, and warrant further investigation).

###### Malicious Code: Report all instances of [**viruses**](#what-is-a-virus-or-malicious-code-and-how-does-it-operate), Trojan horses, or worms that either: {#malicious-code-report-all-instances-of-viruses-trojan-horses-or-worms-that-either .unnumbered}

-   Infect one or more hosts at your site and cause significant impact
    on programmatic mission, and/or

-   Are not recognized and may not be detected by virus software.

> **Do not report malicious code detected and blocked by commercial
> e-mail proxies or similar mechanisms unless they appear to be
> significant or unusually persistent.**
>
> [Denial of Service (DOS)]{.underline}
>
> Report DOS attacks that deny access to all or large portions of a
> Census Bureau network. Include also denial of service attacks that
> affect critical business services, such as:

-   E-mail;

-   Primary Web access;

-   Internet Web access;

-   Routers or switches; and/or

-   Domain Name Services (DNS).

####### Reconnaissance Scans/Probes/Attempted Denial of Service {#reconnaissance-scansprobesattempted-denial-of-service .unnumbered}

> Report all unauthorized network scans/probes/attempted denial of
> service, if the reporting site considers the scans significant or
> unusually persistent. Activities that a site considers anomalous may
> provide precursor information that the CIRT can use in assessing the
> threat.

### To whom do I report an incident?

> The Census Bureau system users, including system and network
> administrators, have a responsibility to report incidents to the IT
> Security Officer, the DSO and/or the [Census Bureau CIRT](#BoC_CIRT).
> These authorities, in turn, must complete an [incident
> report](http://www.cirt.doc.gov/) and forward incident reports to the
> [Department of Commerce CIRT](https://www.cirt.doc.gov/) in a secure
> manner (e.g., encrypted transmission). Preliminary reporting must be
> accomplished as soon as possible but no later than 24 hours after
> discovery. The Census Bureau CIRC must then file a complete and
> detailed report with the Department of Commerce CIRT within five
> working days of the preliminary report. The Department of Commerce
> CIRT reports CIRC incidents to the Federal Computer Incident Response
> Center (FedCIRC). Formally established operating unit CIRTS, such as
> Census Bureau CIRT, must also report incidents to the FedCIRC and send
> an information copy of the report to the Department of Commerce CIRT.

### What is a Computer Incident Response Capability (CIRC)?

> A CIRC provides a set of formal mechanisms and procedures that make it
> possible for an organization to react quickly, consistently, and
> decisively when an incident occurs. When faced with a computer
> incident, all IT system users must respond by protecting the
> organization's information and IT resources and, when possible,
> protecting information of others outside the Bureau, division or
> office who might be affected by the incident. To fulfill these
> requirements, the mechanisms and procedures in use at an organization
> must meet five basic standards:

-   **Authority**: officially sanctioned and publicized as such to all
    appropriate audiences;

-   **Publicity**: well known to all appropriate audiences, included in
    official training where necessary and easily obtained for reference
    when needed;

-   **Readability**: made easy to understand and follow for all
    appropriate audiences;

-   **Regularity**: documented in detail and in use consistently across
    an organization and throughout all lifecycles of a network or
    system; and

-   **Reliability**: effective.

### Who is required to have a Computer Incident Response Capability (CIRC) or a Computer Incident Response Team (CIRT)?

> []{#cirt .anchor}The Department of Commerce mandates all operating
> units to have a CIRC. A CIRC is an established process for incident
> handling. Any personnel may perform CIRC duties on an as-needed basis.
> A CIRT is a formal group of personnel that performs intrusion
> monitoring and incident handling and reporting on a full-time basis.
> The Department of Commerce recently established a CIRT, which actively
> supports all Department of Commerce operating units that have not
> established a formal CIRT. The Census Bureau has established a CIRT,
> called []{#BoC_CIRT .anchor}the Census Bureau CIRT, to manage the CIRC
> duties for the Census Bureau. As stipulated in the procedures above,
> the Census Bureau CIRT interfaces with the [Department of Commerce
> CIRT](https://www.cirt.doc.gov/) to share incident information. This
> interface and exchange of information among CIRTs is called the
> Department of Commerce federated CIRT structure. If an incident
> occurs, the Census Bureau CIRT is charged with reporting incidents to
> the Federal Computer Incident Response Center (FedCIRC) and sending a
> cop of any reports to the Department of Commerce CIRT**.**

### Who is responsible for developing the Computer Security Incident Response Capability (CIRC) at an organization?

> The Census Bureau's IT Security Officer develops standard operating
> procedures and policies for computer incident response. Development of
> these procedures and all supporting documentation must include efforts
> by systems administrators, systems security officers, and even
> end-users. Just as security is everyone's business, incident response
> is also everyone's business, and [training and
> awareness](#it-security-awareness-training-and-education) programs
> should publicize this message.

### Who approves and updates Census Bureau policies and procedures for the CIRC? 

> The CIO approves Census Bureau policies and procedures for the CIRC,
> whereas the IT Security Officer reviews CIRC policies and procedures
> annually to assure use and effectiveness of the most appropriate
> technologies and procedures.

### What information about the CIRC Standard Operating Procedures does the Department of Commerce require?

> The Department of Commerce requires submission of the Census Bureau's
> CIRC standard operating procedures to the CIPM for review and approval
> for integration into procedures for the Department of Commerce
> federated CIRT structure. The Department of Commerce maintains copies
> of the Census Bureau's CIRC procedures and contact information for all
> CIRC-related personnel.

### What are the minimum requirements for a CIRC at an operating unit?

> At a minimum, a CIRC must have a set of procedures detailing how
> incidents are recognized, tracked, and defined (including examples),
> to whom incidents are reported, and in what manner, and which
> individuals are responsible for handling incidents. The operating unit
> IT Security Officer must maintain contact with the [Department of
> Commerce CIRT](https://www.cirt.doc.gov/) for guidance on contacting
> other agencies, reporting incidents, and pursuing legal remedies in
> the case of serious incidents. The Census Bureau CIRT reports
> incidents directly to the FedCIRC and provides an information copy of
> the report to the Department of Commerce CIRT.

###  What incident handling processes comprise the CIRC?

> At the system level, implement a phased approach for responding to
> computer security incidents. The system level CIRC process contains
> six phases:

-   **Preparation**: the first phase of activity involves preparing
    responses through training, developing procedures, and deploying
    tools that facilitate detecting and reporting the presence of
    abnormal or malicious system activities.

-   **Identification**: upon detecting abnormal activity, begin the
    second phase by recognizing the nature of the activity and
    identifying the proper actions to take.

-   **Containment**: in the third phase, take actions to limit the
    spread of malicious or other abnormal activity to other connected
    systems; also take actions to track, confine, and/or discontinue the
    activity; this is known as containment.

-   **Eradication**: once an incident has been identified and contained,
    enter the fourth phase by taking steps to analyze the extent of
    damage (impact) on the affected system(s). After determining the
    scope and causes of the activity, take suitable steps to eliminate
    those causes or mitigate the vulnerabilities in the design of the
    system(s).

-   **Recovery**: the fifth phase begins once identification and
    eradication of the causes of the vulnerability in a system are
    complete. Accurately determine the scope of damage and begin system
    restoration. Recovery steps may include reinstallation of software,
    data, and/or hardware. Recovery can also include reconfiguration of
    other systems to accommodate changes in the system environment. A
    determination of the cause of compromise must be made prior to any
    reconfiguration or reactivation of the compromised system. This
    information can be obtained through the host logs or minimal
    computer forensics and must be contained in the final incident
    report filed with the [Department of Commerce
    CIRT](https://www.cirt.doc.gov/). All compromised systems will be
    [kept out of
    service](#if-the-hard-drive-has-been-removed-from-a-system-due-to-an-incident-how-long-and-under-what-conditions-should-the-drive-be-kept-out-of-service)
    until a final determination is made on whether the system
    information will be required for further action.

-   **Follow-up**: after a response and recovery from any incident, the
    final phase may include subsequent actions, such as law enforcement
    activity, other reporting activity, and/or forensic analysis of
    evidence. Perform an analysis of the response to the incident to
    expose weaknesses in the response procedures and to update best
    practices for all incidents.

> Other procedures and practices that aid in implementing each of these
> phases should augment the CIRC at the system level.

### What must be done to monitor and detect incidents?

> The Census Bureau requires that:

-   All Census Bureau network Internet connections have network-based
    intrusion detection systems in place and functioning;

-   All Internet-accessible Census Bureau Web servers have host-based
    intrusion detection systems in place and functioning;

-   All system owners 1) enable normal logging processes on all host and
    server systems, 2) enable alarm and alert functions, and 3) enable
    [logging](#audits) of any [firewall](#firewalls) and other network
    perimeter security devices and intrusion detection systems;

-   All system owners have additional monitoring tools or install
    appropriate software wrappers on all critical servers (e.g., Domain
    Name Servers, authentication servers, security servers in the UNIX
    environment, domain controllers, and any application server which is
    considered to be mission-critical) as a supplement to the [activity
    logging](#audits) process provided by the operating system; and

-   All system owners perform system integrity checks of the
    [firewall](#firewalls) and other network access control systems on a
    routine basis.

System administrators must also:

-   Review audit logs from the perimeter security intrusion detection
    systems on a daily basis;

-   Review audit logs weekly for medium and high criticality servers and
    hosts on the internal, protected network;

-   Review all trouble reports received by system administration
    personnel for symptoms that might indicate intrusive activity;
    suspicious symptoms should be reported to Network or IT security
    personnel; and

-   Check host-based intrusion detection tools on a routine basis.

    Finally, the CIRT or network security personnel will establish
    relationships with other incident response organizations, such as
    [FedCIRC](http://www.fedcirc.gov/), and share relevant threats,
    vulnerabilities, or incident data. Unless critical systems have been
    compromised, the Census Bureau will first make an attempt to track
    intruders before correcting systems. The IT Security Officer has
    authority to make decisions concerning closing security holes or
    attempting to learn more about the intruder. Therefore, this
    individual must be trained in legal issues surrounding incident
    handling.

###  If the hard drive has been removed from a system due to an incident, how long, and under what conditions, should the drive be kept out of service?

> The Department of Commerce-CIRT, Department of Commerce Security
> Office, OIG [investigators](http://www.oig.doc.gov/), or other law
> enforcement authorities, may direct the IT Security Officer to remove
> a hard drive from a system due to compromise and the need for possible
> forensic examination of evidence for potential prosecution. Upon
> removal, the IT Security Officer must:

-   Establish a chain of custody that documents (in writing) the name,
    title, office, and phone number of each individual having sequential
    possession of the drive and update the chain of custody each time
    the drive changes possession (e.g., from the IT Security Officer to
    the OIG, from the OIG to law enforcement, from law enforcement back
    to the IT Security Officer, etc.);

-   Secure the drive in an unclassified safe to prevent tampering with
    evidence and access by unauthorized individuals;

-   Avoid possible obstruction of justice charges by withholding the
    drive from service until notified by, or coordinated with, proper
    authorities (e.g., OIG or law enforcement) that the drive is no
    longer needed as evidence for pending or ongoing investigations or
    prosecution; and

-   Reformat/wipe the drive, when cleared for release to service, of all
    information before returning it to service or before
    [disposing](#how-should-electronic-media-be-recycled-or-destroyed-when-no-longer-needed)
    of the drive if no longer operable.

###  Where can I find guidance on how to detect intrusions and handle incidents?

> The Census Bureau recommends the following publications for guidance
> on establishing an effective CIRC to detect intrusions as well as
> handle and report computer incidents:

-   The [Census Bureau Computer Incident Response Team (Census Bureau
    CIRT)](http://cww2.census.gov/it/itso/img/index_prototype.html) Web
    site;

```{=html}
<!-- -->
```
-   National Institute of Standards and Technology (NIST) Special
    Publication 800-3, [*Establishing a Computer Security Incident
    Response
    Capability*](http://csrc.nist.gov/publications/nistpubs/800-3/800-3.pdf)
    (describes the elements and activities required to establish and
    organize for computer security incident response at all appropriate
    levels in an organization);

-   NIST Special Publication 800-31, [*Intrusion Detection
    Systems*](http://csrc.nist.gov/publications/nistpubs/800-31/sp800-31.pdf);

-   Carnegie-Mellon [*Handbook for Computer Security Incident Response
    Teams
    (CSIRT)*](http://www.sei.cmu.edu/publications/documents/98.reports/98hb001/98hb001abstract.html)
    (describes the components and some procedures for establishing a
    computer security incident response team, including the types of
    activities and qualifications required of the team members);

-   The [Federal Computer Incident Response
    Center](http://www.fedcirc.gov/) [(FedCIRC) (provides assistance to
    federal agencies in handling incidents, technical queries, as well
    as alerts and advisories, and has a 24-hour incident response center
    at 1-888-282-0870);](http://www.fedcirc.gov./)

-   [*Computer Security Incident Handling, Step by Step*, Version 1.5,
    1998](http://www.sans.org/newlook/publications/index.htm), which can
    be acquired through the SANS Web site; and

-   The [Department of Commerce CIRT](https://www.cirt.doc.gov/) Web
    site (provides information and points of contact for further
    assistance).

# Technical Controls

## Logical Access Controls

### What are logical access controls?

> Logical access controls are the system-based mechanisms used to
> designate who or what will have access to a specific system resource
> and the type of transactions and functions that they are permitted to
> access. They include:

-   Controls to restrict users to authorized transactions and functions;

-   Network access; and

-   Public accesses to the system and the controls implemented to
    protect the integrity of the application and the confidence of the
    public.

### User Account Management

### What is user account management?

User account management is a process whereby the Census Bureau provides
for the life cycle of system accounts. The IT Security Office, in
coordination with the DSOs, must ensure that IT security policies and
practices include the following aspects of account management:

-   Account creation, including procedures for supervisor account
    request and authorization;

-   [Identification,
    authentication](#what-is-identification-and-authentication-and-how-do-they-help-secure-it-resources),
    and [documentation](#documentation) of the user and the appropriate
    access levels/account permissions and term of access for the user;

-   [Account
    termination](#what-does-the-census-bureau-require-when-employees-both-federal-and-contractor-no-longer-work-for-the-census-bureau);
    and

-   Periodic status review of all currently open accounts on all systems
    through [auditing](#audits) of user accounts, which include federal
    employees, contractors, and "guest" accounts.

### What are Census Bureau user account management minimum standards?

At a minimum, system procedures must include:

-   Deactivation of all computer system accounts within 24 hours of
    notification to the system administrator of a change in user status,
    regardless of platform (including PC, network, mainframe, firewall,
    router, telephone, and other miscellaneous utility systems), when
    the account owner/user:

```{=html}
<!-- -->
```
-   [Departs the Census
    Bureau](#what-does-the-census-bureau-require-when-employees-both-federal-and-contractor-no-longer-work-for-the-census-bureau)
    voluntarily or involuntarily;

-   Transfers to another operating unit within the Department of
    Commerce;

-   Is placed on suspension;

-   Goes on long term detail; and/or

-   No longer has a legitimate business need for system access.

> This action must occur in a timely manner consistent with the
> circumstances of the owner/user's change in status, but under no
> condition, longer than the next day.

-   Adherence to the principle of least privilege or "need to know" when
    granting user access privileges. Specifically, users should only be
    given rights to access systems if they have a legitimate business
    purpose and the access must be consistent with a segregation of
    duties.

-   Use of the account naming convention on all Census Bureau computer
    platforms. In addition, system owners must ensure that each user
    account name is unique.

-   Determination of access based on physical or logical location, the
    needs of the users, and the type of system.

-   Granting of access levels consistent with any software licensing
    agreements or similar service based constraints.

-   Authorization of user accounts ONLY to personnel, either Federal
    employees or contractors, with Special Sworn Status.

-   Implementation of security controls that ensure only authorized
    users have access to Census Bureau IT resources.

-   Deactivation of unused or dormant accounts after 45 days of
    inactivity.

### Who creates an account lockout policy and how does it help secure IT resources?

The Department of Commerce sets minimum standards and the Census Bureau
is free to enhance these but not relax them. The Census Bureau IT
Security Officer creates policies and helps to educate system users and
enforce tougher standards for the Census Bureau. Thus, an account policy
secures the Census Bureau network at the first line of defense (and the
one most often breached) and makes the entire network safer from a brute
force attack.

### To what systems do these policies apply?

These policies apply to all IT resources owned or used by the Census
Bureau with capabilities for account lockout (including those that may
require supplementary software to add this capability).

### What does the Census Bureau require as the minimum standards for account lockout?

The Census Bureau requires that:

-   The system locks out accounts when suspicious logon activity, such
    as three invalid logon attempts in a row or suspicious logon
    activity is detected. When suspicious logon activity is detected,
    the system must lock out the account for a pre-set time period of at
    least fifteen minutes after which time the system administrator can
    reset it automatically.

-   Locked accounts with privileged access (i.e., root or administrator
    access) will remain locked until unlocked by a help desk
    representative, a security administrator, the DSO, or other
    authorized account management personnel.

-   In all cases involving locked accounts, reasonable and verifiable
    means of identification must be presented when requesting assistance
    in unlocking the account (if and whenever feasible, users will
    appear in person with verifiable official identification).

-   Accounts are deactivated if unused for more than 45 days.

### Internetworking

### What is "internetworking" and how does it affect logical access controls?

Internetworking provides for logical connections of IT systems to other
systems and data networks, private and public, whether by direct
connection, Internet, intranet, dial-up or dial-out modems, or other
means. It includes all data systems as well as systems that process
voice information, such as private branch exchanges, CENTREX-services,
and voice-over Internet Protocol (IP) applications. Logical access
controls provide assurance that user activity is authorized and that
system confidentiality, integrity, and availability is maintained at an
acceptable level.

### What general consideration should be given to the security of Census Bureau internetworks?

The following considerations should be given to the security of Census
Bureau internetworks:

-   Networks and internetworks must be labeled as [general support
    systems](#c.1-what-is-a-general-support-system) and as such, the
    same policies, procedures, and security practices apply to
    internetworks as with any other Census Bureau IT resource (including
    preparations of risk assessments, security plans, contingency plans,
    certification and accreditation processes, monitoring technologies,
    etc.);

-   Interconnected systems, including networks, must form
    internetworking agreements; and

-   [Security plans](#it-security-planning) and [certification and
    accreditation](#system-certification-and-accreditation-ca)
    documentation must reflect the existence of these internetworking
    agreements.

### What does the Department of Commerce require of the Census Bureau to ensure security for internetworking?

> The Census Bureau is required to create a policy covering logical
> access to internal systems through internetworking. Often, this can be
> a part of a [remote
> access](#what-does-the-census-bureau-require-to-control-remote-access)
> security policy, [teleworking policy](#what-is-teleworking), an
> interconnection agreement policy, or both. At a minimum, this policy
> must require that all access to internal systems through
> internetworking must use a proxy device (e.g., Network Address
> Translation) to hide an "inside" user from external networks. The
> network system owner, in consultation with the Census Bureau CIO and
> IT Security Officer, will approve proxies.

### Where can I find additional information on internetworking security?

> National Institute of Standards and Technology Draft Special
> Publication 800-47, [*Security Guide for Interconnecting Information
> Technology
> Systems*](http://csrc.nist.gov/publications/nistpubs/800-47/sp800-47.pdf),
> provides additional information and best practices for ensuring
> security in internetworked environments.

### Remote Access Security/Teleworking

### What is teleworking?

Remote access refers to the use of any Census Bureau network resources
from a remote location. Teleworking is generally recognized as working
from home or from some other offsite location. Frequently, remote
access/teleworking may require external access to internal resources
(such as printers, networked file storage, intranet services, e-mail
services, and other networked resources) residing at a location
recognized to be under the control of the users' organization. This
access may be provided through the use of direct-dial modems, the
Internet, or wireless technology. An employee's supervisor determines
the employee's need for access to these resources.

### What does the Census Bureau require to control remote access?

> The Census Bureau *Remote Access Security Policy* provides employees,
> both federal and contractor, with the mandatory and recommended
> practices for securing remote access connections to the Census
> Bureau's IT resources. The Census Bureau's minimum remote access
> requirements include:

-   Providing remote access on a temporary basis to employees conducting
    Census Bureau business from an offsite location at an approved
    facility;

```{=html}
<!-- -->
```
-   Adhering to the Census Bureau [Number range CHAPTERPolicy on
    Password Management;](#password-policy)

-   Configuring dial-up connections to disconnect after a period of
    extended inactivity and simultaneous logging out of all associated
    user accounts after 30 minutes of time;

-   Prohibiting listings of dial-up modem numbers on Web sites, bulletin
    boards, or telephone directories, and the placing of numbers on
    business cards or passing to third parties;

-   Scanning direct dial lines at least annually to monitor compliance
    with the remote access policy;

-   Allowing access to Census Bureau computer systems using Government
    furnished equipment only;

```{=html}
<!-- -->
```
-   Ensuring control of all modems connected to the Census Bureau's IT
    systems; and

-   Making employees aware of monitoring procedures for all
    communications conducted remotely.

### Why control modem connections?

In order to maintain network security, the security staff must monitor
all of the entry points into the network. An unauthorized and,
therefore, unknown and unattended entry point can result in a serious
security breach. Individuals attempting to break security protocols know
that open modems are an easy target as they are accessed using publicly
available telephone services. Using telephone scanners, individuals can
dial a list of telephone numbers, in increasing or random order,
searching for the familiar modem carrier tone. Once the dialer generates
a list of discovered modems, the he can dial those numbers to find an
unprotected login or easily cracked password to a remote-control
program. From there, the individual has nearly unencumbered access to
the Census Bureau's sensitive information.

### What are wireless access and networking?

Wireless access enables access to the Census Bureau's information using
a radio-wave technology that does not require physical plugging in of
equipment to data or phone outlets. The definition of wireless access
includes many different devices, including:

-   Cellular telephones;

-   Personal digital assistants (PDAs), such as Palm Pilots;

-   Personal electronic devices (PEDs), such as messaging and two-way
    pagers; and

-   Computers using wireless LAN protocols.

### What are the security issues with wireless access?

> Wireless access and networking should not be implemented in your
> environment without the approval of the Census Bureau's IT Security
> Officer. When implementing wireless access to Census Bureau systems, a
> key consideration is the [type of
> information](#what-are-the-different-levels-and-types-of-information-sensitivity)
> accessed via a wireless platform (e.g., e-mail, databases, and Web
> sites). When implementing wireless networking for the Census Bureau's
> resources, major concerns include:

-   Security of the wireless networking protocols;

-   Confidentiality;

-   Authentication; and

-   Service provider agreements.

### Where can I find more information on remote access security and telecommuting?

> National Institute of Standards and Technology provides more
> information, in Special Publication 800-46, [*Security for
> Telecommuting and Broadband
> Communications*](http://csrc.nist.gov/publications/nistpubs/800-46/sp800-46.pdf).

### Firewalls

### What is a firewall?

A firewall is an application that manages connections between systems
running specific network protocol services. The firewall can be software
only, a combination of software and a hardware device, or an application
appliance that contains two or more network interfaces. A firewall can
exist in many different configurations allowing varying degrees of
connectivity between hosts on one of its physical connections and
applications running locally or on hosts, and applications on another
connected network. A firewall provides controls that enforce a desired
policy configuration for communications, which governs the firewall's
operation. However, a firewall is not a security panacea. Any
configuration that allows connections to a host via the firewall may
expose vulnerabilities, either of the firewall or of the host
application.

### Why are firewalls used?

Firewalls provide an additional level of protection to, and central
management of, a computer system or network and allow management network
access in a controlled manner. Firewalls allow control over the types
and direction of connections permitted between networks or hosts, and
provide a means to log system communications.

### When or where will a system make use of a firewall?

The Census Bureau requires that all connections from internal Census
Bureau systems/networks to public systems (i.e., the Internet) be
protected by firewall. System owners should make use of firewalls to
segment internal networks where appropriate and cost-effective.

### What policies and procedures must all system owners have to support firewall implementation and operation?

System owners must create firewall policies based on the following
minimum standards for firewall configuration and management:

-   Firewalls must have documented [security plans](#it-security-plans)
    and tested [contingency plans](#contingency-planning) as all other
    IT systems or be included in a larger [general support
    system](#c.1-what-is-a-general-support-system) security plan;

```{=html}
<!-- -->
```
-   All firewall configurations must be documented and stored with the
    appropriate system owner as part of the system security plan
    documentation;

-   All firewalls must be configured initially to "deny-all" traffic
    (i.e., implement firewalls to allow systems to connect in a
    \"minimal privilege\" manner where all connections are denied except
    those explicitly allowed), unless the system owner has obtained
    approved rules in writing that were approved through the IT Change
    Control Request Process;

-   All firewalls must be configured to not allow "any-any" rules even
    for Simple Mail Transport Protocol (SMTP) and File Transfer Protocol
    (FTP) (exceptions should be rare and a waiver documented);

-   All firewall rule changes or additions, including port openings,
    must follow a change management process and be reviewed and approved
    by the IT Security Officer;

```{=html}
<!-- -->
```
-   All firewalls will support and operate with a fail-closed
    configuration (i.e., if a firewall system or its software crashes or
    fails to start, the firewall system must not forward connection
    requests, either locally or to its connected networks, also a
    firewall that fails to start or loses power should continue to
    protect its connected interfaces);

-   All firewalls that support security for configuration via a network
    shall provide logging for 1) all configuration changes, 2) for
    configuration access by network terminals or secure sockets layer
    (SSL), and 3) for Web-based configuration via a network. Firewall
    configuration services will not be accessible via connections
    originating in the Internet. A firewall that allows network access
    for configuration should allow configuration only from a specific
    set of management IP addresses. Access to a firewall system via a
    network, for the purpose of configuration, should be protected
    commensurate with the level of risk (for a firewall that risk is
    always high.);

    -   Firewall configuration access will minimally require a username
        and password;

    -   All firewalls must, at a minimum, log all unsuccessful
        connection attempts and log all configuration changes made to
        the firewall (system owners will ensure that all logs are
        transmitted to the Census Bureau CIRT monthly via an encrypted
        connection over a local or wide area network (LAN or WAN) or, in
        the case of Internet transmissions, a Virtual Private Network
        (VPN)); and

    -   All firewalls will be subjected to periodic full and incremental
        backup so that, in the event of system failure, data and
        configuration files can be recovered (store backup files
        securely, and in a separate location, on a read-only media so
        data in storage is not overwritten).

### What issues arise when configuring and managing multiple parallel firewalls?

> Availability or performance reasons may dictate implementing firewalls
> in parallel. If the system owner determines implementation of parallel
> firewalls to be cost-effective, the configuration of each firewall
> will be identical and under the control of a single firewall
> administration. The Firewall Change Control Board must approve any
> change to any firewall in this type of configuration. The policies for
> single firewall operations also apply to all firewalls in a parallel
> firewall implementation. Where multiple firewalls are implemented, the
> trust between network addresses should be well understood so that
> policy violations can be detected.

### Where can I find more information on multiple firewalls?

> Consult the National Institute of Standards and Technology Special
> Publication 800-41, [*Guidelines on Firewalls and Firewall
> Policy*](http://csrc.nist.gov/publications/nistpubs/800-41/sp800-41.pdf),
> for more information on management of firewalls.

### What is a demilitarized zone (DMZ)?

A DMZ is a network or sub network providing a level of protection
tailored for access by different groups of users who are usually the
public at large and internal users. By use of this technique, and the
firewall and other technologies supporting it, internal users possess
necessary minimal privileges and public users also possess minimal
privileges, though these two sets of privileges do not usually equate.
[Web servers](#web-servers-and-e-mail-server-security) are the most
common and easily understood resident of a DMZ. The public at large
needs some access to the server but does not need access to all other
system ports and services. Users and systems internal to the
organization need this same access plus additional privileges such as
the ability to update the content on the server.

### When or where must the Census Bureau make use of a DMZ?

According to the Department of Commerce's policy, the Census Bureau must
establish a DMZ for systems requiring public access from an
external/public network, such as the Internet, to internal Census Bureau
or Department of Commerce network resources. In configurations where the
same network device or connection (e.g., firewall) supports connection
of public users to the Census Bureau network and servers, a DMZ provides
additional assurance that unauthorized users cannot penetrate the
perimeter of the Census Bureau network.

### How do we configure DMZ boundary firewalls in the operation of DMZs?

The system owner must configure the boundary firewall or interface to
deny all traffic to the DMZ, except that which is explicitly allowed by
policy. The internal firewall or interface of the DMZ must also deny all
traffic originating in the DMZ, except that which is explicitly allowed
by policy. The firewall(s) operating a DMZ's external boundary must deny
protocol traffic from the external network (e.g., the Internet) that is
also allowed to enter the protected network when originating in the DMZ.
All traffic originating in an external/public network must be
authenticated first in the DMZ before being allowed into the private
network.

### Where can I find further information on developing firewall policies and procedures?

Consult the following sources for additional information on developing
firewall policies:

-   National Institute of Standards and Technology (NIST) Special
    Publication: 800-41, [*Guidelines on Firewalls and Firewall
    Policy*](http://csrc.nist.gov/publications/nistpubs/800-41/sp800-41.pdf);

-   NIST Special Publication 800-XX, Internet Security Policy: A
    Technical Guide, Chapter 6, [*Internet Firewall
    Policy*](http://csrc.nist.gov/publications/InternetFirewallPolicy.doc);
    and

-   SANS [*SCORE Firewall
    Checklist*](http://www.sans.org/SCORE/checklists/FirewallChecklist.doc).

## Identification and Authentication

### What is identification and authentication and how do they help secure IT resources?

> Access control usually requires that the system be able to identify
> and differentiate among users. Identification and authentication is a
> technical measure that prevents unauthorized people (or unauthorized
> processes) from entering an IT system. The user identification tells
> the system who the user is. The authentication mechanism provides an
> added level of assurance by proving that the users really are who they
> say they are. Authentication consists of something a user knows (such
> as a password), something the user has (such as a token or smart
> card), or something the user is (such as a fingerprint).
>
> All Census Bureau IT systems must have a means to enforce user
> accountability so that system activity, both authorized and
> unauthorized, can be traced to a specific user. To ensure user
> accountability, the Census Bureau requires that all IT systems
> implement a method of user identification and authentication.

### Authentication Policies

### How does user identification and authentication help secure IT resources?

> User identification and authentication provide for accountability of
> user system activities and enforce [segregation of
> duties](#separation_of_duties) by limiting access.

###  What does the Census Bureau require for effective user identification and authentication?

> System owners must ensure that:

-   All Census Bureau IT systems have a user identification procedure in
    place for issuing and recognizing user IDs that are unique to each
    user or group.

-   All Census Bureau IT systems have a user authentication mechanism to
    authenticate a user prior to primary access to all IT resources. The
    preferred method is the use of a password, but other methods can
    include one-time passwords, biometrics, or public-key infrastructure
    certificates. Regardless, the implementation or technology used
    should provide access security commensurate with the level of
    sensitivity assigned to the resource (i.e. information, devices or
    systems). All Census Bureau IT systems and associated equipment that
    rely on passwords as the means to authenticate users must implement
    effective password management in accordance with the Department of
    Commerce's [*Policy on Password
    Management*.](#what-is-the-census-bureau-policy-on-password-management)

### Where can I find additional information on identification and authentication practices?

> The Census Bureau recommends the National Institute of Standards and
> Technology (NIST) Special Publication 800-12, [*An Introduction to
> Computer Security: The NIST
> Handbook*](http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf),
> Chapter 16, which provides guidance on identification and
> authentication.

### Password Policy

### What is the Census Bureau policy on password management?

> The Census Bureau has adopted the Department of Commerce policy on
> password management, which establishes minimum practices for
> management of passwords to support authentication of users accessing
> Department of Commerce or Census Bureau systems. The policy applies to
> all IT systems operated and used by the Census Bureau's employees and
> contractors. Each Census Bureau system must use passwords as a means
> for user authentication. Biometrics, smart cards and other forms of
> authentication may be used as additional means.

### What are the minimum standards for password management?

The following are the Census Bureau's minimum standards for password
management:

-   Passwords must adhere to the following criteria:

```{=html}
<!-- -->
```
-   Passwords must have at least eight (8) non-blank characters;

-   At least one of the characters must be alphabetical (upper or lower
    case);

-   At least one of the characters must be a numeric (0-9) or a special
    character (e.g. !, %,&,\$);

-   Six of the characters may only occur once in the password (e.g.,
    AAAAAAA! Is not acceptable but ABE15A38 is acceptable.)

-   Passwords can not include any of the following:

    -   Vendor/manufacturer default passwords;

    -   Words found in dictionaries (spelled backwards or forwards);

    -   Addresses or birthdays; and

    -   Common character sequences (e.g. 1234, ABCD).

```{=html}
<!-- -->
```
-   Vendor supplied default passwords such as SYSTEM, PASSWORD, DEFAULT,
    USER, DEMO and TEST must be replaced immediately upon system
    implementation;

```{=html}
<!-- -->
```
-   Systems or applications that have multiple passwords for different
    levels of access or authentication must have unique passwords for
    each level;

-   Passwords must not be shared except in emergency circumstances or
    when absolutely necessary as documented in the system security plan
    (shared passwords must not be used to control access to IT systems
    or other applications on IT systems);

-   Group passwords must not be used without some other authentication
    mechanism;

-   Group passwords must not be shared outside the authorized group of
    users and must be changed when the group is no longer authorized;

-   Group passwords must never be re-used;

-   Passwords must be kept in a safe location where they are not readily
    accessible to others;

-   IT systems and workstations must not display or print passwords as
    they are entered;

-   User applications must not be enabled to retain passwords for
    subsequent re-use or be configured to bypass authentication
    mechanisms (e.g. Internet browsers must not be enabled to save
    passwords for re-use);

-   Passwords must not be distributed through any format or medium such
    as voicemail or e-mail (if passwords, other than single-use
    (one-time passwords), are transmitted across a wide area network or
    the Internet, they must be encrypted);

-   Passwords must be changed at least every 90 days unless compromised
    or non-compliant or at the direction of management (in these latter
    cases, passwords must be changed IMMEDIATELY and if the password is
    not changed, the account must be temporarily suspended);

-   Passwords can not be reused more than eight times within two years
    from the date of last use;

-   Accounts must be temporarily suspended after five failed password
    attempts;

-   Access to password files and databases must be restricted to only
    those who are authorized to manage the IT system; and

-   Passwords for servers, mainframes, telecommunication devices (e.g.
    routers and switches) and devices used for IT security functions
    (e.g. firewalls, intrusion detections, audit logging) must be
    encrypted when stored electronically.

> For additional information on recommend password practices, see the
> [Password Management](http://cww2.census.gov/it//itso/) policy posted
> on the Census Bureau IT security Web site.

###  What is the Census Bureau policy on password verification?

> All employees must provide a verification code whenever a new password
> is requested. Each employee will receive a unique verification code
> that must be presented verbally to the person resetting the password.
> If the verification code check fails, the requester will not receive a
> new password. Because of the importance of the verification code,
> employees must not include it in e-mail messages or electronic service
> requests.

### Who is responsible for implementing the Census Bureau password management policy?

+---------------------+------------------------------------------------+
| Role                | Responsibility                                 |
+=====================+================================================+
| Department of       | -   Maintains and updates the policy;          |
| Commerce IT         |                                                |
| Security Manager    | -   Reviews and approves/denies requests for   |
|                     |     waivers; and                               |
|                     |                                                |
|                     | -   Monitors Department of Commerce and Census |
|                     |     Bureau compliance through annual reviews.  |
+---------------------+------------------------------------------------+
| Director, Census    | -   Implement mandatory practices consistent   |
| Bureau              |     with the policy.                           |
+---------------------+------------------------------------------------+
| CIO, Census Bureau  | -   Implement mandatory practices consistent   |
|                     |     with the policy;                           |
|                     |                                                |
|                     | -   Ensure communication of the policy to      |
|                     |     system users; and                          |
|                     |                                                |
|                     | -   Develop password policies and procedures   |
|                     |     to supplement the Department of Commerce   |
|                     |     policy if the guidance is more stringent   |
|                     |     than existing security requirements and is |
|                     |     consistent with Department of Commerce     |
|                     |     policy.                                    |
+---------------------+------------------------------------------------+
| IT Security Officer | -   Communicate password policy to all users;  |
|                     |                                                |
|                     | -   Ensure that security awareness training    |
|                     |     addresses password management;             |
|                     |                                                |
|                     | -   Include password monitoring in routine     |
|                     |     system self-assessments and evaluations;   |
|                     |     and                                        |
|                     |                                                |
|                     | -   Maintain approved waivers as part of the   |
|                     |     documentation for associated system        |
|                     |     security plan(s).                          |
+---------------------+------------------------------------------------+
| Users               | -   Follow mandatory practices of this policy  |
|                     |     when creating and managing passwords.      |
+---------------------+------------------------------------------------+

### Who approves changes to or deviations from the Census Bureau password policy? 

> All changes to or deviations from the policy must be brought to the
> attention of the Census Bureau CIO, who is also responsible for
> approving any deviations. Changes or deviations require a waiver being
> requested in writing through the Census Bureau CIO to the Department
> of Commerce IT Security Manager and must be documented in the
> appropriate security plan. If several systems are covered under one
> security plan and are under the same management authority, only one
> waiver request needs to be submitted. The Census Bureau CIO may appeal
> waiver decisions made by the Department of Commerce IT Security
> Manager to the Department of Commerce CIO. For additional information
> on the content of the request please refer to the [**Department of
> Commerce password policy**](http://cww2.census.gov/it//itso/) on the
> Census Bureau IT Security Web site.

### Where can I find additional information on password policy and practices?

> The system administration and network security's security policy
> project provides a [password policy
> template](http://www.sans.org/newlook/resources/policies/Password_Policy.pdf)
> to assist in developing password policies. A copy of the complete
> [Department of Commerce password
> policy](http://cww2.census.gov/it//itso/) is available on the Census
> Bureau IT Security Web site.

## Data Communication and Network Security

### Network Boundaries and Perimeter Security

### What is a network boundary and why is it important?

> A network boundary is the point at which your network attaches to
> other networks or devices not under your control or to the Internet.
> Various devices reside near the perimeter of your network, the most
> critical of which are the perimeter security/border devices (border
> routers) and the [firewall](#firewalls) that provide direct external
> connections.

### What special attention do I have to give to boundary devices?

Because boundary connections are so vital and vulnerable, each system
owner must have procedures and definitions in place to describe and
monitor their network perimeter. The IT Security Officer must establish
an optimal, cost-effective, configuration for boundary devices as the
first step toward managing connections with external networks, including
the Internet. Securing these perimeter devices will help mitigate risks
associated with IP address falsification and trust relationships with
external business partners.

### What is IP address falsification?

> Falsifying IP addresses, also known as *Spoofing*, is a common method
> used by attackers to hide their tracks when they attack a victim. This
> very popular attack method uses an overlooked feature of routers to
> send a stream of packets to thousands of machines.

### How can I guard against falsified IP addresses?

Because filtering of incoming and outgoing traffic can help provide a
high level of protection, management and operational controls at the
outer most network boundary have the greatest effect. Each system owner
must give special attention to reviewing, and updating as necessary,
their policy and procedures for maintaining appropriate ingress and
egress policies on these important perimeter security devices.

### How can I determine if my network boundary is vulnerable?

> The Census Bureau [IT Security Officer](#ITSO), [system
> owners](#c.5-what-is-a-system-owner), and [DSOs](#DSO) must establish
> a procedure and schedule for periodic testing of incoming filtering
> protection by sending a spoofed packet to see if the external firewall
> or router blocks it. Not only should this device block the traffic,
> but it should also produce a record in the log showing that the
> spoofed packets have been dropped. Note, however, that this opens up
> the door to a new attack -- flooding the log file. Make sure the
> system's logging system can handle a heavy load, otherwise it could be
> vulnerable to a denial of service attack. Use programs like *nmap* to
> send decoy packets or spoofed packets to test this type of filtering.
> Once filtering is set up, don't assume that it is working effectively.
>
> Specifically, system owners must:

-   Ensure that configurations for perimeter security device management
    (e.g., Telnet, secure shell) allow communication between only those
    IP addresses that are explicitly set in the configuration (the
    recommended configuration is to use local network address and/or a
    directly connected console);

-   Ensure perimeter security devices are configured to maintain a
    separate access password that conforms to the Census Bureau [*Policy
    on Password
    Managemen*](#what-are-the-minimum-standards-for-password-management);
    and

-   Verify that [firewall](#firewalls) configurations allow only
    required traffic and allow only traffic that is specifically
    configured.

### What are examples of perimeter security device filtering rules?

> At a minimum, perimeter security device filtering rules must ensure
> that:

-   Any packet coming into your network must not have a source address
    of your internal network;

-   Any packet coming into your network must have a destination address
    of your internal network;

-   Any packet leaving your network must have a source address of your
    internal network;

-   Any packet leaving your network must not have a destination address
    of your internal network;

-   Any packet coming into your network from the Internet or leaving
    your network to the Internet must not have a source or destination
    address of a private address or an address listed in RFC1918
    reserved space;

-   Any source routed packets or any packets with IP options that are
    not specifically allowed (e.g., multicast, IPsec, etc.) are blocked;
    and

-   Support for directed-broadcasts is deactivated.

### Where can I find more information on best practices for network boundary security?

> The Census Bureau recommends the following sources of additional
> information on network boundary security practices:

-   [*Network Ingress Filtering: Defeating Denial of Service Attacks
    which employ IP Source Address
    Spoofing*](ftp://ftp.isi.edu/in-notes/rfc2267.txt), from the
    Information Sciences Institute;

-   *[Address Allocation for Private
    Internets](http://www.ietf.org/rfc/rfc1918.txt),* from the Internet
    Engineering Task Force (IETF) Network Working Group;

-   [*Cisco SAFE: A Security Blueprint for Enterprise
    Networks*](http://www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/safe_wp.htm);
    and

-   [*Cisco: Security of the MPLS
    Architecture*](http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/mxinf_ds.htm).

### Web Servers and E-Mail Server Security

### What are the Census Bureau's requirements regarding Web server and Web site security?

All Census Bureau personnel must understand that systems such as the
Internet are un-trusted in that transmissions may be monitored,
intercepted, and modified. Users should exercise caution before posting
information on the Internet. The Census Bureau requires that:

-   All Web servers and Web sites must meet the requirements of this
    document, including [risk
    assessment](#what-is-a-risk-assessment-and-how-does-it-help-secure-it-resources),
    [IT security plans](#_Hlt15712896), [contingency
    plans,](#what-elements-should-be-included-in-a-contingency-plan)
    [certification and
    accreditation](#system-certification-and-accreditation-ca);

-   All Internet accessible Census Bureau Web servers must have
    host-based intrusion detection systems (IDS) in place and
    functioning and all intrusion/incident data from the Web servers
    must be transmitted to the [Census Bureau CIRT](#BoC_CIRT) to be
    filed in monthly IDS log reports;

-   All Web servers and Web sites fall under the requirements of the IT
    Security Program Policy in one of three ways:

```{=html}
<!-- -->
```
-   A Web server or group of servers may constitute a general support
    system;

-   A Web site or group of sites may constitute a major application; and

-   A Web server or Web site may be part of a broader general support
    system or major application.

```{=html}
<!-- -->
```
-   All applicable capital asset [OMB Circular
    A-11](http://www.whitehouse.gov/omb/circulars/a11/01toc.html)
    Exhibit 300B business cases must document the Web servers and Web
    sites in the business case and must make specific reference to IT
    security measures that will reduce risks to these servers/sites (the
    system will be identified in the Exhibit 300B by it's IT Security
    Program identifier);

-   Internet access will be granted to employees at the discretion of
    the division and office chiefs based on the specific requirements of
    their job or function;

-   No sensitive data will be transmitted over the Internet unless
    encrypted or protected;

-   All attempts to access restricted sites will be reported to the [IT
    Security Officer](#ITSO) and the [DSO](#DSO);

-   Employees will be trained on the use of the Internet and made aware
    of the Census Bureau's [Employee Use of the
    Internet](../cww2.census.gov/inetPolicy.asp) policies posted on the
    IT security Web site; and

-   The IT Security Officer will approve all special processing
    requirements of [sensitive](#what-is-sensitive-information) data or
    access to sensitive computer networks or data.

### What are the Census Bureau reporting requirements regarding Web servers and Web sites?

The Census Bureau CIO will determine how to identify and group Web
servers and Web sites to ensure that they meet the requirement of this
document. In addition, the CIO must certify annually, by April, to the
Census Bureau's CIO that all Web servers and Web sites at the Census
Bureau comply with the Department of Commerce's Web policies, including
exactly where the Web server is located and who is the system
administration of the Web server.

> If any deficiencies exist, the Census Bureau CIO shall provide a
> [corrective action
> plan](#what-information-must-be-in-the-corrective-action-plan) to
> bring the Web server/site into compliance. The Department of
> Commerce\'s CIO will determine whether the proposed approach is
> acceptable and retains the authority to shut down any server or site
> for non-compliance.

### What does the Census Bureau require for e-mail server security?

> System owners must implement all of the following mandatory
> requirements for securing e-mail servers (these controls help
> safeguard against
> [viruses](#what-is-a-virus-or-malicious-code-and-how-does-it-operate),
> especially in attachments, and [spamers](#c.3-what-is-spam) who are
> trying to use Government systems to relay their mass mailings):

-   Implement virus protection on e-mail servers and single
    computer-based clients;

-   Determine the types of attachments allowed in e-mail content for
    their organization;

-   Encrypt all [sensitive](#what-is-sensitive-information) Census
    Bureau data (e.g. Title 13, Title 26, Privacy Act) in attachments;

-   Configure e-mail servers to only allow relaying of messages from
    authorized hosts and not for anonymous systems; and

-   Perform weekly review of [audit logs](#audits) for e-mail servers on
    the internal, protected network.

### What does the Census Bureau require for users regarding e-mail security?

> The Census Bureau requires employees to abide by the following
> policies:

-   Consider all messages sent over the Census Bureau computer and
    communications systems as Census Bureau property (there should be no
    expectation of privacy associated with information sent through
    Census Bureau systems);

-   Do not send sensitive data of any kind in the text of e-mail (all
    data must be encrypted and sent as an attachment);

-   Lock the terminal, log out of the session, or use a password
    protected screen saver when leaving the computer while still in
    e-mail;

-   Ensure that electronic mail bulletin boards are properly justified,
    implemented, and managed by the appropriate areas;

-   Do not send illegal transmissions (e.g. respect copyright laws);

-   Use virus scanning software to scan e-mail attachments (especially
    attachment types such as .exe, .vbs, .scr, .pif, and .shs);

-   Follow established retention policies; and

-   Consent to monitoring and review activities.

### Where can I find additional guidance on Web server and e-mail server security?

> Consult the following sources for additional information on Web server
> and e-mail server security:

-   National Institute of Standards and Technology (NIST) Special
    Publication 800-44, [*Guidelines on Securing Public Web
    Servers*](http://csrc.nist.gov/publications/nistpubs/800-44/sp800-44.pdf);
    and

-   NIST Special Publication 800-45, [*Guidelines for Electronic Mail
    Security*](http://csrc.nist.gov/publications/nistpubs/800-45/sp800-45.pdf).

### Facsimile (FAX) Machines

### What does the Census Bureau recommend for users regarding the use of facsimile (FAX) machines to communicate and transmit data? 

> The Census Bureau extensively uses facsimile (FAX) machines for
> transmitting and receiving text and graphics. Facsimile devices
> communicate over public telephone circuits and transmit and receive
> data in plain text. However, software and hardware products are
> available for encrypting FAX data. When communicating
> [sensitive](#what-is-sensitive-information) data using a facsimile
> machine, implement the following guidelines to reduce the likelihood
> of disclosing sensitive data:

-   Place the FAX machine in a secured location;

-   Coordinate the use of data encryption equipment or dedicated
    communication lines for the FAX machine with the Telecommunications
    Office;

-   Staff areas that contain FAX machines at all times when the area is
    open;

-   Verify the telephone number of the FAX machine receiving the
    information before transmitting sensitive data;

-   Notify the recipient of the time when sensitive information will be
    transmitted and agree to have that authorized person present at the
    destination FAX machine when the material is sent;

-   Never send sensitive information to an unattended FAX machine;

-   Following appropriate labeling guidelines for FAXing Title 13 or
    Title 26 data. (e.g. banner warnings); and

-   Distribute FAX machine phone numbers only to Census Bureau personnel
    and authorized vendors in order to eliminate the problem of having
    unsolicited documents tying up the FAX machine.

# Partnerships with Other Department of Commerce Program Offices

The Census Bureau IT security program must maintain partnerships with
the following Department of Commerce offices, on matters involving
planning, budgeting, and monitoring:

-   The [Office of the Chief Information
    Officer](http://www.osec.doc.gov/cio/) (OCIO);

-   The [Department of Commerce CIRT](https://www.cirt.doc.gov/)
    coordinator;

-   The [Office of Inspector General](http://www.oig.doc.gov/) (OIG);
    and

-   The [Office of General Counsel](http://www.ogc.doc.gov/) (OGC).

Within the Census Bureau, the IT security program maintains partnerships
with the following division/offices, on matters involving planning,
budgeting, monitoring, coordination and maintenance of system, physical
and personnel security:

-   The [Office of Security](http://www.doc.gov/osy) at the Census
    Bureau (OSY);

-   The [Office of the Chief Financial
    Officer](http://www.doc.gov/cio/cfo/cfoindex.html) (CFO);

```{=html}
<!-- -->
```
-   The [Office of Human Resource Management](http://ohrm.doc.gov/)
    (HRD);

-   The [Office of Acquisition
    Management](http://oamweb.osec.doc.gov/default.htm) (ACQ); and

```{=html}
<!-- -->
```
-   The [Information Systems Support and Review Office
    (ISSRO](http://cww2.census.gov/it/issro/issromission.asp)[)]{.underline}.

## The Department of Commerce Office of the Chief Information Officer (CIO)

### How does the Census Bureau coordinate with the Department of Commerce CIO to protect IT resources?

> The Department of Commerce CIO is responsible for ensuring that the
> Department's programs make full and appropriate use of leading edge
> information technology that enables the Department of Commerce to
> carry out its mission. IT security, in particular, has become a high
> priority of the Department of Commerce because of the importance of
> protecting these systems and maintaining the integrity of data
> maintained by the Department of Commerce and its operating units. Two
> parties within the Department of commerce's CIO office have been
> assigned responsibility for developing, managing, monitoring and
> coordinating IT security between the Department of Commerce and the
> Census Bureau. They are:

-   The [**IT Security Program Manager**](#ITSM); and

-   The [**Department of Commerce CIRT**](https://www.cirt.doc.gov/).

> The Census Bureau's CIO coordinates with the Department of Commerce
> CIO on:

-   The status of security plans;

-   The development of the Census Bureau's IT security program; and

-   Compliance with the Department of Commerce's IT Security
    requirements.

> The Census Bureau's [IT Security Officer](#ITSO) and the Department of
> Commerce IT Security Program Manager coordinate on:

-   The status of corrective action plans and weaknesses;

-   The Census Bureau's IT security program and standards development;

-   Annual compliance reviews;

-   Certification and accreditation of systems;

-   Security plans and risk assessments; and

-   Technology advances and cost-efficiencies

> The [Department of Commerce CIRT](https://www.cirt.doc.gov/) and the
> Census Bureau IT Security Officer coordinate on:

-   Reporting and resolution of security incidents;

-   Sharing of information on security vulnerabilities;

-   Training on proper security configurations; and

-   FedCIRC related issues and best practices.

## The Office of Inspector General (OIG)

### How does the OIG also help protect Department of Commerce IT resources?

> The [OIG](http://www.oig.doc.gov/) provides independent oversight
> through audit and evaluation of the Department of Commerce's IT
> security program, in accordance with the *Inspector General\'s Act of
> 1978* ([Public Law
> 95-452](http://thomas.loc.gov/cgi-bin/bdquery/z?d095:HR08588:@@@D|TOM:/bss/d095query.html|)).
> The OIG also assists the Department of Commerce [Critical
> Infrastructure Program Manager](#CIPM) in the investigation of
> computer [incidents](#what-is-a-reportable-incident) and coordination
> with external law enforcement agencies. Policies relating to these
> areas can be found in appropriate directives, e.g., *Inspector General
> Investigations,* [DAO
> 207-10](http://www.osec.doc.gov/bmi/daos/207-10.htm).

### How does the Census Bureau interface with the OIG?

> The Census Bureau's IT Security Officer or CIO should maintain
> cooperative relationships with the OIG, including specific agreements
> and procedures covering [incident
> response](#incident-response-capability) and forensics investigations
> if applicable. An intermediate entity, e.g., a [Computer Incident
> Response Team](#cirt) (CIRT) or [Computer Incident Response
> Capability](#what-is-a-computer-incident-response-capability-circ)
> (CIRC), can best facilitate communication with the OIG.

## The Department of Commerce Office of General Counsel (OGC)

### How does the OGC help protect Census Bureau IT resources?

> The [OGC](http://www.ogc.doc.gov/) helps protect Census Bureau
> resources by reviewing IT security policies to ensure the policies are
> aligned with current legal requirements. The OGC also reviews the
> legality of IT security contract clauses used by the Acquisition
> Office for Census Bureau contracts. Moreover, the IT Security Officer
> coordinates closely with the Acquisition Office and the OGC, as
> needed, to ensure that security is accounted for.

## The Department of Commerce Office of Security at the Census Bureau

### How does the Department of Commerce Office of Security help protect Department of Commerce IT resources?

> The Department of Commerce Office of Security
> [(OSY)](http://www.doc.gov/osy/) is responsible for:

-   The [physical security](#physical-and-environmental-security) of
    facilities and equipment external to computers or telecommunication
    lines;

-   The protection of national security information;

-   The [personnel security](#personnel-security), including performance
    of background checks and security clearance investigations of
    personnel;

-   Coordinating with the Department of Commerce's [Critical
    Infrastructure Program Manager](#CIPM) on the physical security
    aspect of [critical infrastructure
    protection](#what-is-critical-infrastructure-protection-cip); and

-   Coordinating emergency planning.

> Further information is available in the [Department of Commerce
> Security Manual, Section
> I](http://www.osec.doc.gov/osy/SECURITYMANUAL/section1.htm) (Chapters
> 1 and 2), and appropriate Department of Commerce directives (e.g., the
> [DAO 207- series](http://www.osec.doc.gov/bmi/daot.htm)).

### What is Critical Infrastructure Protection (CIP)?

> Critical Infrastructure Protection (CIP) focuses on providing support
> and redundancy for Department of Commerce physical and IT assets
> critical to national security, economy, public health, or public
> safety. These assets must be made available within 72 hours of system
> or facility loss or damage.

### How is Critical Infrastructure Protection (CIP) determined?

> The Department of Commerce requires the Census Bureau to include CIP
> in the IT security program. Operating units must coordinate with the
> Department of Commerce [Critical Infrastructure Program
> Manager](#CIPM), who in turn coordinates with the [Critical
> Infrastructure Assurance Office](http://www.ciao.gov/) (CIAO) and the
> [OSY](http://www.doc.gov/osy) to identify the CIP status for an IT
> resource. The identification of CIP assets helps to prioritize the
> Department of Commerce's IT security resources.

### What additional protections do Critical Infrastructure Protection (CIP) resources require?

> Managers/owners of systems qualifying as critical infrastructure
> assets must give these systems commensurately higher minimum
> protection and provisions for backup and recovery to ensure
> availability. System managers of CIP systems must:

-   Ensure that all computer networks deemed as critical infrastructure
    under Presidential Decision Directive 63 have security controls
    inclusive of firewalls, intrusion detection systems, redundancy, and
    Continuity of Operations Plans (COOP);

-   Select a rigorous and frequent backup and restore routine because
    the data are just as important, or more important, than the system;

-   Increase the level of protection and decrease the privileged access
    to the system; and

-   Pay particular attention to the interdependencies in the operation
    of the resource.

### Where can I find more information on CIP?

> For more information contact the Census Bureau IT Security Officer,
> the Department of Commerce Security Program Manager, or the Critical
> Infrastructure Assurance Office ([CIAO](http://www.ciao.gov/)).

## The Office of Human Resource Management (HRD)

### How does the HRD participate in protecting Census Bureau IT resources?

> The HRD maintains a database of all Census Bureau employees that
> contains sensitive, personnel information that must be protected and
> be in compliance with requirements set forth by Title 13 and the
> Privacy Act.

### How is the HRD database used to protect Census Bureau IT resources?

> The database contains personnel information that is used to:

-   Perform background checks and other investigative information;

-   Document the status of personnel access to information resources
    (e.g., employment status); and

-   Maintain the status of physical access credentials such as building
    passes and badges for employees and contractors in coordination with
    OSY resources.

### What are the responsibilities of the HRD in implementing personnel security?

> The responsibilities of HRD for the maintenance of security of IT
> resources include:

-   Providing timely and accurate information concerning personnel
    hiring, transfer, and termination to the IT Security Officer;

-   Assisting in the administration of IT security awareness training
    for new employees in accordance with the [Department of Commerce
    Security Manual, Chapter
    3](http://www.osec.doc.gov/osy/SECURITYMANUAL/chapter3.htm);

-   Implementing policies for personnel security in accordance with the
    [Department of Commerce Security Manual, Chapter
    9](http://www.osec.doc.gov/osy/SECURITYMANUAL/Chapter9.htm);

-   Updating and maintaining records concerning personnel security
    violations and other IT security reporting concerning personnel from
    the Census Bureau's division/office managers in accordance with the
    [Department of Commerce Security Manual, Chapter
    11](http://www.osec.doc.gov/osy/SECURITYMANUAL/section2.htm#C11);

-   Reporting statistics on personnel security violations to aid in
    security planning and risk assessment in accordance with the
    [Department of Commerce Security Manual, Chapter
    11](http://www.osec.doc.gov/osy/SECURITYMANUAL/section2.htm#C11);

-   Maintaining position descriptions for all IT related positions;

-   Establishing position sensitivity designations in accordance with
    the [Department of Commerce Security Manual, Chapter
    10](http://www.osec.doc.gov/osy/SECURITYMANUAL/section2.htm#C10);

-   Maintaining on file a copy of federal employee and contractor
    non-disclosure agreements in accordance with the [Department of
    Commerce Security Manual, Chapter
    3](http://www.osec.doc.gov/osy/SECURITYMANUAL/chapter3.htm) and
    [Chapter
    11](http://www.osec.doc.gov/osy/SECURITYMANUAL/section2.htm#C11);

-   Developing and providing guidance on procedures for unfriendly
    terminations; and

-   Maintaining personnel records containing the status of background
    checks, employment renewals and investigations of all personnel in
    accordance with the [Department of Commerce Security Manual, Chapter
    11](http://www.osec.doc.gov/osy/SECURITYMANUAL/section2.htm#C11).

> For additional information see the [HRD and Human
> Resource](http://cww.hrd.census.gov/hrd/) policies.

### What areas of HRD IT security responsibilities are subject to OHRM security responsibilities?

> The HRD's responsibilities cover all personnel in areas of operational
> IT security, or personnel that access Census Bureau IT resources. The
> greatest harm/disruption to a system comes from the actions of
> individuals, both intentional and unintentional. HRD will interface
> with the Department of Commerce Office of Human Resource Management
> (OHRM) to fulfill its responsibilities in managing and maintaining
> personnel records to assure accurate reporting to Department of
> Commerce management on personnel security.

## The Office of Acquisition (ACQ)

### What role does the Office of Acquisition play in protecting Census Bureau IT resources?

> The Office of Acquisition (ACQ) ensures the integrity of procurements
> for the Census Bureau. By ensuring that contract vehicles address
> appropriate security measures, the ACQ plays a critical role in the
> life-cycle management process for [major
> application](#c.2-what-is-a-major-application) and [general support
> systems](#c.1-what-is-a-general-support-system).

### How does the Census Bureau interface with the Department of Commerce Office of Acquisition Management (OAM) when considering IT security? 

> The Census Bureau consults with its Servicing Procurement Office (SPO)
> during the development of IT system security acquisitions. Development
> of acquisition requirements is integral to the life-cycle process. The
> SPO obtains requirements from the Census Bureau in the areas of
> technical features (e.g., access controls); personnel security (e.g.,
> background checks for system developers); and operational practices
> (e.g., awareness and training) in the form of a statement of work
> prepared by the Census Bureau.

### What does the Servicing Procurement Office (SPO) do with the IT security requirements?

> After the Census Bureau has determined security features and
> requirements, and provided the SPO with its statement of work, the SPO
> contracting officer works with the acquisition team to ensure the
> solicitation, and later contract award, include the security
> requirements.

### What are required considerations for acquisition of security-related products?

> System owners should use the guidance provided by [National Institute
> of Standards and Technology (NIST) SP 800-23, Guideline to Federal
> Organizations on Security Assurance and Acquisition/Use of
> Tested/Evaluated
> Products](http://csrc.nist.gov/publications/nistpubs/800-23/sp800-23.pdf),
> which recommends principles that all Federal agencies\' should
> understand. Census Bureau system owners should first consult the
> [National Information Assurance Partnership
> (NIAP)](http://niap.nist.gov/) validated products list for information
> on security-related products, operated by NIST and the National
> Security Agency (NSA), which evaluates commercial-off-the-shelf (COTS)
> and government-off-the-shelf (GOTS) products according to [government
> standards](http://niap.nist.gov/niap/services/standards.html) and the
> [Common Criteria](http://csrc.nist.gov/cc/).

### How does the Office of Acquisition ensure that personnel security is appropriately addressed in IT service acquisitions?

> Office of Acquisition (ACQ) contracting officers and contract
> specialists are required by Department of Commerce policy to work with
> Census Bureau customers, including IT Security Officers, to address
> security in their IT contract requirements in all stages of an
> acquisition (i.e., from the earliest budgeting and acquisition
> planning stages through requirements development, solicitation, source
> evaluation and selection, contract award and administration).
>
> The Department of Commerce's Acquisition Manual, Part 37, Section 70
> (Security Processing Requirements for On-Site Security Requirements)
> requires customers to work with their respective security office
> before a solicitation is released to designate contract risk levels
> (for all on site contracts, not just IT) and then after award to
> arrange for background investigations on contractor employees in
> accordance with OSY's [Security Manual, Chapter
> 2](http://www.osec.doc.gov/osy/SECURITYMANUAL/Chapter2.htm#Chapter 2).
> The division/office chief must provide the ACQ with the appropriate
> risk determination for the contract and submit a completed Form CD 435
> for review. Once the necessary approvals are obtained the
> corresponding appropriate language must be included in the contract.

### What other guidance is available regarding IT security in service acquisitions?

> Consult National Institute of Standards and Technology (NIST) Special
> Publication 800-4, *[Computer Security Considerations in Federal
> Procurements: A Guide for Procurement Initiators, Contracting
> Officers, and Computer Security
> Officials](http://csrc.nist.gov/publications/nistpubs/800-4/800-4.zip),*
> which provides additional guidance for security considerations in
> procurements. See also the Census Bureau's [Acquisition Guidance and
> Policies](http://cww.census.gov/acq/g&p.html) for more information.

## The Information Systems Support and Review Office (ISSRO)

### What role does the ISSRO play in protecting Census Bureau IT resources?

> The ISSRO supports the Census Bureau's IT planning efforts and
> monitors and assists in the acquisition of IT products and services
> throughout the Census Bureau. Through reviews of Form CD 435 and IT
> Business and security Plans, the ISSRO ensures that all procurement
> requests and system security plans contain the appropriate security
> measures and controls to protect the information systems and data
> maintained by the Census Bureau. The ISSRO helps fulfill a critical
> role in the [Development/Acquisition](#developmentacquisition-stage)
> stage and the [Operation and
> Maintenance](#operation-and-maintenance-stage) stage of system
> life-cycle management.

### What are the responsibilities of the ISSRO in implementing system security?

> As a support office, the ISSRO plays an important role in maintaining
> the integrity, confidentiality and availability of information and
> information systems by effectively managing the following security
> aspects:

-   Developing the Strategic Information Technology Plan and the
    Operational Information Technology Plan, of which security is a key
    component;

-   Reviewing and evaluating Information Technology Business Plans to
    ensure that they fully document the need to procure IT goods and
    services, address IT security risks and contain an effective program
    for on-going compliance with privacy and security requirements;

-   Reviewing and approving Information Technology Statements of Work;
    and

-   Coordinating the Information Technology Services (ITS) Contract
    management documentation and provide administrative support and
    assistance to the Census Bureau's ITS Contract task managers.

# Appendix A: IT Security Laws and Federal Regulations {#appendix-a-it-security-laws-and-federal-regulations .unnumbered}

[U.S. Public Laws](#us_laws)\
[Office of Management and Budget (OMB) Regulations](#OMB)\
[Commerce Departmental Orders](#DOC_orders)\
[Other](#other_regs)

U.S. Public Laws

[Title 13 U.S.
Code](http://www.access.gpo.gov/uscode/title13/title13.html)

Information will not be used for any purpose other than the statistical
purposes for which it is supplied. No publications will be made whereby
the data furnished by any particular establishment or individual can be
identified. Only sworn officers and employees of the Census Bureau are
permitted to examine individual reports. Any release of covered data
(microdata) is a criminal act punishable by Federal law.

[Title 26 U.S.
Code](http://www.access.gpo.gov/uscode/title26/title26.html)

Provides for the conditions under which the IRS may disclose Federal Tax
Information (FTI) to other agencies. Title 26 U.S.C. 6103 (j) (1)
provides for the disclosure of FTI to the Census Bureau for statistical
purposes in the structuring of censuses and national economic accounts,
as well as for conducting related statistical activities authorized by
law. Section 6103 stipulates requirements for maintaining the
confidentiality of returns and returns information and establishes
safeguard requirements. IRS Publication 1075 provides detailed
requirements for using and safeguarding Federal Tax Return Data.

[[]{#us_laws .anchor}Privacy Act of
1974](http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=browse_usc&docid=Cite:+5USC552a)\
This Act (Public Law 93-579, as amended, Title 5 U.S. Code section 552a)
prohibits disclosure of information in personal records by any means of
communication to any person, or to another agency, except pursuant to a
written request by, or with the prior written consent of, the individual
to whom the record pertains.

[Federal Managers\' Financial Integrity Act of
1982](http://www.ustreas.gov/tcfoc/mcp/fmfia-legislation.pdf) (FMFIA)

This Act (Public Law 97-255) provides requirements for executive agency
accounting and other financial management reports and plans, including
identification and reporting of material weaknesses (section 2, (d)(4)).

[[]{#csa_of_1987 .anchor}Computer Security Act of
1987](http://www.doc.gov/cio/oipr/ITSec/csa-1987.html) (Summary)\
In this Act (Public Law 100-235), the Congress declares that improving
the security and privacy of sensitive information in Federal computer
systems was in the public interest, and created a means for establishing
minimum acceptable security practices for such systems.

[Chief Financial Officers (CFOs) Act of
1990](http://www.gao.gov/policy/12_19_4.htm)\
The CFO Act (Public Law 101-576) lays a foundation for comprehensive
reform of federal financial management. The Act establishes a leadership
structure, provides for long-range planning, requires audited financial
statements, and strengthens accountability reporting.

[Computer Fraud and Abuse Act of
1992](http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=browse_usc&docid=Cite:+18USC1030)\
This Act (U.S. Code Title 18, section 1030) defines the specific actions
considered to be computer fraud or abuse.

[Electronic Communications Privacy Act of
1986](http://thomas.loc.gov/cgi-bin/bdquery/z?d099:HR04952:@@@L|TOM:/bss/d099query.html|)

This Act (Public Law 99-508) amends Title 18, United States Code, with
respect to the interception of certain communications, other forms of
surveillance, and for other purposes. It also prohibits unauthorized
access to an electronic communications system in order to obtain or
alter information contained in such system and prohibits the
installation or use of a pen register or tracking device without a court
order.

[Government Performance and Results Act of
1993](http://thomas.loc.gov/cgi-bin/query/z?c103:S.20.ENR:) (GPRA)\
This Act (Public Law 103-62) provides for the establishment of strategic
planning and performance measurement in the Federal Government.\

[Government Management Reform Act of
1994](http://thomas.loc.gov/cgi-bin/query/z?c103:S.2170/ENR:)

This Act (Public Law 103-356) provides for improving the efficiency of
executive branch performance such as the elimination or consolidation of
duplicative or obsolete reporting requirements and adjustments to
deadlines to provide for more efficient workload distribution or improve
the quality of reports.

[Paperwork Reduction Act of
1995](http://thomas.loc.gov/cgi-bin/query/D?c104:1:./temp/~c104d8HAt5:e749:)
(PRA)\
This Act (Public Law 104-13) requires that Federal agencies become more
responsible and publicly accountable for reducing the burden of Federal
paperwork on the public.

[Federal Financial Management Improvement Act of
1996](http://thomas.loc.gov/cgi-bin/cpquery/?&dbname=cp104&maxdocs=100&report=hr863.104&sel=TOC_1280625&)
(FFMIA)

This Act (Public Law 104-208, Title VIII) provides for consistency of
accounting by an agency from one fiscal year to the next, and uniform
accounting standards throughout the Federal Government in order to
increase the accountability and credibility of federal financial
management.

[[]{#clinger_cohen_act .anchor}Clinger-Cohen Act (Information Technology
Management Reform Act of 1996)\
](http://thomas.loc.gov/cgi-bin/query/D?c104:1:./temp/~c104EOeLsU:e1594647:)This
Act (Public law 104-106, Division E) defines reforms in information
technology acquisition management within the Federal Government.

[Trade Secrets Act](http://www4.law.cornell.edu/uscode/18/1905.html)\
This Act (U.S. Code Title 18, section 1905) defines the unlawful
disclosure of confidential information and the penalties thereof.

[Government Paperwork Elimination
Act](http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=105_cong_public_laws&docid=f:publ277.105.pdf)
(GPEA, enacted October 21, 1998)\
This Act (Public Law 105-277, Title XVII, scroll to page 750 of 920)
provides that electronic records and their related electronic signatures
are not to be denied legal effect, validity, or enforceability merely
because they are in electronic form, and encourages Federal government
use of a range of electronic signature alternatives.

[Government Information Security Reform
Act](http://www.cio.gov/Documents/gisra_link_to_pdf_file.html) (GISRA,
enacted October 30, 2000)

This Act (Public Law 106-398, Title X, Subtitle G, scroll to page 266 of
513 pages) requires the establishment of government-wide policies for
the management of programs. These policies: (1) support the
cost-effective security of Federal information systems by promoting
security as an integral part of each agency\'s business operations; and
(2) include information technology architectures as defined under the
[Clinger-Cohen Act of 1996](#clinger_cohen_act). The Act also requires
such policies to: (1) be founded on a continuous risk management cycle;
(2) implement controls that adequately assess the risk; (3) promote
continuing awareness of information security risks; (4) continually
monitor and evaluate information security policy; and (5) control
effectiveness of information security practices.

[]{#OMB .anchor}Office of Management and Budget (OMB) Regulations

**OMB Circulars pertaining to IT security and management:**

[Circular A-11](http://www.whitehouse.gov/OMB/circulars/a11/02toc.html),
*Planning, Budgeting, Acquisition of Capital Assets, Strategic Plans,
Performance Plans\
*This Circular provides guidance on the FY 2004 Budget submission. It
also includes instructions on budget execution, integrating agencies'
budget and accounting functions, and improving the quality of financial
information in accordance with the [Government Performance and Results
Act of 1993](http://thomas.loc.gov/cgi-bin/query/z?c103:S.20.ENR:) and
other laws. The Circular describes specific steps that agencies must
take to integrate budget and performance, a key part of the President's
Management Agenda.

[Circular A-76](http://www.whitehouse.gov/OMB/circulars/a076/a076.html),
*Performance of Commercial Activities (Outsourcing)*\
This Circular establishes Federal policy regarding the performance of
commercial activities and sets forth the procedures for determining
whether commercial activities should be performed under contract with
commercial sources or in-house using Government facilities and
personnel.

[Circular A-94](http://www.whitehouse.gov/OMB/circulars/a094/a094.html),
*Guidelines and Discount Rates for Benefit-Cost Analysis of Federal
Programs*\
This Circular provides general guidance for conducting benefit-cost and
cost-effectiveness analyses. It also provides specific guidance on the
discount rates to be used in evaluating Federal programs whose benefits
and costs are distributed over time.

[OMB Circular
A-123](http://www.whitehouse.gov/omb/circulars/a123/a123.html),
*Management Accountability and Control*\
This Circular provides guidance to Federal managers on improving the
accountability and effectiveness of Federal programs and operations by
establishing, assessing, correcting, and reporting on management
controls in accordance with the [FMFIA of
1982](http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=browse_usc&docid=Cite:+31USC3512).

[OMB Circular
A-127](http://www.whitehouse.gov/omb/circulars/a127/a127.html),
*Financial Management Systems*

This Circular prescribes policies and standards for executive
departments and agencies to follow in developing, operating, evaluating,
and reporting on financial management systems in accordance with the
[FMFIA of
1982](http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=browse_usc&docid=Cite:+31USC3512)
and the [Chief Financial Officers (CFOs) Act of
1990](http://www.gao.gov/policy/12_19_4.htm).

[[]{#OMBA130 .anchor}Circular
A-130](http://www.whitehouse.gov/OMB/circulars/a130/a130.html),
*Management of Federal Information Resources*\
This Circular establishes policy for the management of Federal
information resources in accordance with the [Computer Security Act of
1987](http://www.doc.gov/cio/oipr/ITSec/csa-1987.html) .

[Circular A-130, Appendix
III](http://csrc.nist.gov/secplcy/a130app3.txt), *Security of Federal
Automated Information Resources*\
This Appendix establishes a minimum set of controls to be included in
Federal automated information security programs. It also assigns Federal
agency responsibilities for the security of automated information and
incorporates requirements of the Computer Security Act of 1987 and
responsibilities assigned in applicable national security directives.

**OMB Memoranda pertaining to IT security and management:**

[M-95-22, Implementing the Information Dissemination Provisions of the
Paperwork Reduction Act of
1995](http://www.whitehouse.gov/omb/memoranda/m95-22.html) (September
29, 1995)

[M-96-20, Implementation of the Information Technology Management Reform
Act of 1996](http://www.whitehouse.gov/omb/memoranda/m96-20.html) (April
4, 1996)

[M-97-02, Funding Information Systems
Investments](http://www.whitehouse.gov/omb/memoranda/m97-02.html)
(October 25, 1996)

[M-97-16, Information Technology
Architectures](http://www.whitehouse.gov/omb/memoranda/m97-16.html)
(June 18, 1997)

[M-98-04, Annual Performance Plans Required by the Government
Performance and Results Act
(GPRA)](http://www.whitehouse.gov/omb/memoranda/m9804.html) (January 29,
1998)

[M-99-18, Privacy Policies on Federal Web
Sites](http://www.whitehouse.gov/omb/memoranda/m99-18.html) (June 2,
1999)

[M-99-20, Security of Federal Automated Information
Resources](http://www.whitehouse.gov/omb/memoranda/m99-20.html) (June
23, 1999)

[M-00-07, Incorporating and Funding Security in Information Systems
Investments](http://www.whitehouse.gov/omb/memoranda/m00-07.html)
(February 28, 2000)

[M-00-10, OMB Procedures and Guidance on Implementing the Government
Paperwork Elimination
Act](http://www.whitehouse.gov/omb/memoranda/m00-10.html) (April 25,
2000)

[M-00-13, Privacy Policies and Data Collection on Federal Web
Sites](http://www.whitehouse.gov/omb/memoranda/m00-13.html) (June 22,
2000)

[M-00-15, OMB Guidance on Implementing the Electronic Signatures in
Global and National Commerce
Act](http://www.whitehouse.gov/omb/memoranda/m00-15.html) (September 25,
2000)

[M-01-05, Guidance on Inter-Agency Sharing of Personal Data - Protecting
Personal Privacy](http://www.whitehouse.gov/omb/memoranda/m01-05.html)
(December 20, 2000)

[M-01-08, Guidance On Implementing the Government Information Security
Reform Act](http://www.whitehouse.gov/omb/memoranda/m01-08.pdf) (January
16, 2001)

[M-01-26, Component-Level
Audits](http://www.whitehouse.gov/omb/memoranda/m01-26.html) (July 10,
2001)

[M-02-09, Reporting Instructions for the Government Information Security
Reform Act and Updated Guidance on Security Plans of Action and
Milestones](http://www.whitehouse.gov/omb/memoranda/m02-09.pdf) (July 2,
2002)

[M-02-12, Reducing Redundant IT Infrastructure to Homeland
Security](http://www.whitehouse.gov/omb/memoranda/m02-12.pdf) (July 19,
2002)

[]{#DOC_orders .anchor}Commerce Departmental Orders

Department Administrative Order [(DAO)
200-0](http://www.osec.doc.gov/omo/daos/200-0.htm), *Department of
Commerce Handbooks and Manuals*, December 24, 1996

This Order prescribes is a consolidated listing of DAO Handbooks and
Manuals in the Department of Commerce. In this listing are the DAO
number, title, a brief description and the Office of Primary Interest
(OPI). This Order also incorporates guidelines for preparing handbooks
and manuals.

[DAO 207-1](http://www.osec.doc.gov/omo/daos/207-1.htm), *Security
Programs*, June 24, 1991\
This Order consolidates certain major Department of Commerce (Department
of Commerce) security programs in a single directive. It prescribes
programs management responsibilities and requirements for the
preparation, issuance, and maintenance of manuals associated with each
of these security programs.

Department Organization Order [(DOO)
10-5](http://www.osec.doc.gov/omo/10-5.htm), *Chief Financial Officer
and Assistant Secretary for Administration*, July 3, 2000

This Order prescribes the functions and organization of the Chief
Financial Officer and Assistant Secretary for Administration.

[DOO 15-23](http://www.osec.doc.gov/omo/15-23.htm), *Chief Information
Officer*, July 3, 2000\
This Order prescribes the functions and organization of the Office of
the Chief Information Officer (the CIO).

[DOO 20-6](http://www.osec.doc.gov/omo/20-6.htm), *Deputy Assistant
Secretary for Security*, October 29, 1998\
This Order prescribes the functions and responsibilities of the Deputy
Assistant Secretary for Security.

[]{#other_regs .anchor}Other

**[Directives/Policies/Executive Orders]{.underline}**

[The Clinton Administration's Policy on Critical Infrastructure
Protection:](http://www.ciao.gov/resource/paper598.pdf)

[Presidential Decision Directive
63](http://www.ciao.gov/resource/paper598.pdf) (May 22, 1998)\
This Directive established the President\'s Commission on Critical
Infrastructure Protection to ensure the viability of national
infrastructures that are so vital that their incapacity or destruction
would have a debilitating impact on the defense or economic security of
the United States.

[Executive Order 13231 - Critical Infrastructure Protection in the
Information Age](http://www.ciao.gov/resource/eo13231.html) (October 16,
2001)

The purpose of this order is to protect against disruption of the
operation of information systems for critical infrastructure and thereby
help to protect the people, economy, essential human and government
services, and national security of the United States, and to ensure that
any disruptions that occur are infrequent, of minimal duration, and
manageable, and cause the least damage possible.

[Executive Order 13228 - Establishing the Office of Homeland Security
and the Homeland Security
Council](http://www.ciao.gov/resource/eo13228.html) (October 8, 2001)

This Executive Order establishes within the Executive Office of the
President an Office of Homeland Security to be headed by the Assistant
to the President for Homeland Security.

[National Security Directive (NSD)
42](http://www.fas.org/irp/offdocs/nsd/nsd_42.htm), National Policy for
the Security of National Security Telecommunications and Information
Systems\
This Directive establishes initial objectives of policies, and an
organizational structure to guide the conduct of activities to secure
national security systems from exploitation; establishes a mechanism for
policy development and dissemination; and assigns responsibilities for
implementation.

[**Issuances of the National Security Telecommunications and Information
Systems Security Committee (NSTISSC) \[Policies (P), Directives (D), and
Instructions (I)\]:**]{.underline}

[NSTISSP No. 6 - National Policy on Certification and Accreditation of
National Security Telecommunications and Information
Systems](http://www.nstissc.gov/Assets/pdf/NSTISSP _.6.pdf) - 8 April
1994

[NSTISSP No. 7 - National Policy on Secure Electronic Messaging
Services](http://www.nstissc.gov/Assets/pdf/NSTISSP_7.pdf) - 21 February
1995

[NSTISSD 500 - Information Systems Security (INFOSEC) Education and
Training and
Awareness](http://www.nstissc.gov/Assets/pdf/nstissd500.pdf), 25
February 1993

[NSTISSD 501 - National Training for Information Systems Security
(INFOSEC)
Professionals](http://www.nstissc.gov/Assets/pdf/nstissd501.pdf), 16
November 1992

[NSTISSI No. 1000 - National Information Assurance Certification and
Accreditation Process
(NIACAP),](http://www.nstissc.gov/Assets/pdf/nstissi_1000.pdf) April
2000

[NSTISSI No. 4009 - National Information Systems Security (INFOSEC)
Glossary](http://www.nstissc.gov/Assets/pdf/4009.pdf), September 2000

[NSTISSI No. 4011 - National Training Standard for Information Systems
Security (INFOSEC)
Professionals](http://www.nstissc.gov/Assets/pdf/4011.pdf), June 1994

[NSTISSI No. 4012 - National Training Standard for Designated Approving
Authority (DAA),](http://www.nstissc.gov/Assets/pdf/4012.pdf) August
1997

[NSTISSI No. 4013 - National Training Standard for System Administration
in Information Systems
Security](http://www.nstissc.gov/Assets/pdf/4013.pdf), August 1997

[NSTISSI No. 4014 - National Training Standard for Information Systems
Security Officers (ISSO)](http://www.nstissc.gov/Assets/pdf/4014.pdf),
August 1997

[NSTISSI No. 4015 - National Training Standard for Systems
Certifiers](http://www.nstissc.gov/Assets/pdf/nstissi_4015.pdf),
December 2000

# Appendix B: Acronyms and Definitions {#appendix-b-acronyms-and-definitions .unnumbered}

  -----------------------------------------------------------------------
  **Acronym**        **Definition**
  ------------------ ----------------------------------------------------
  Census Bureau CIRT Census Bureau Computer Incident Response Team

  C&A                Certification and Accreditation

  CAP                Corrective action plan

  CIAO               Critical Infrastructure Assurance Office

  CIO                Chief Information Officer

  CIP                Critical Infrastructure Protection

  CIPM               Critical Infrastructure Program Manager

  CIRC               Computer Incident Response Capability

  CIRT               Computer Incident Response Team

  COOP               Continuity of Operations Plan

  COTR               Contracting Officer's Technical Representative

  DAA                Designated Approving Authority

  DSO                Division Security Officer

  FedCIRC            Federal Computer Incident Response Center (FedCIRC)

  FIPS               Federal Information Processing Standards

  FISCAM             Federal Information System Controls Audit Manual

  FMFIA              Federal Managers' Financial Integrity Act

  FOUO               For Official Use Only

  GAO                General Accounting Office

  GISRA              Government Information Security Reform Act

  GSS                General Support System

  IG                 Inspector General

  ISSO               Information System Security Officer

  ISSRO              Information Systems Support and Review Office

  IT                 Information Technology

  ITSCC              IT Security Coordinating Committee

  ITSM               IT Security Program Manager

  ITSO               IT Security Office

  MA                 Major application

  NIST               National Institute of Standards and Technology

  NSA                National Security Agency

  OS                 Operating System

  OAM                Office of Acquisition Management

  OCIO               Office of the Chief Information Officer

  OHRM               Office of Human Resource Management

  OIG                Office of Inspector General

  OMB                Office of Management and Budget

  OPM                Office of Personnel Management

  OS                 Office of the Secretary

  OSY                Office of Security

  OU                 Operating Unit

  PDA                Personal Digital Assistant (such as a PALM Pilot)

  PED                Personal Electronic Device (includes those referred
                     to as PDAs)

  POAM               Plan of Actions and Milestones

  SBU                Sensitive but Unclassified
  -----------------------------------------------------------------------

#   {#section-2 .unnumbered}

# Appendix C: Glossary {#appendix-c-glossary .unnumbered}

### C.1 What is a general support system? {#c.1-what-is-a-general-support-system .unnumbered}

According to National Institute of Standards and Technology Special
Publication 800-18, a ***General Support System*** is an interconnected
information resource under the same direct management control that
shares common functionality. It normally includes hardware, software,
information, data, applications, communications, facilities, and people
and provides support for a variety of users and/or applications.
Typically, the purpose of a general support system is to provide
processing or communications support. Individual applications support
different mission-related functions. Users may be from the same or
different organizations. Such a system can be, for example, a local area
network (LAN) including smart terminals that support a branch office, an
agency-wide backbone, a communications network, a departmental data
processing center including its operating system and utilities, a
tactical radio network, or a shared information processing service
organization (IPSO).

### C.2 What is a major application? {#c.2-what-is-a-major-application .unnumbered}

According to National Institute of Standards and Technology Special
Publication 800-18, a ***Major Application*** is an application that
requires special attention to security due to the risk and magnitude of
the harm resulting from the loss, misuse, or unauthorized access to or
modification of the information in the application. These are systems
that perform clearly defined functions for which there are readily
identifiable security considerations and needs. A breach in a major
application might comprise many individual application programs and
hardware, software, and telecommunications components. Major
applications can be either a major software application or a combination
of hardware/software where the only purpose of the system is to support
a specific mission-related function.

While all Federal applications require some level of protection, certain
applications, because of the information in them, require special
management oversight and should be treated as major. Adequate security
for other applications should be provided by the general support systems
in which they operate.

### C.3 What is spam? {#c.3-what-is-spam .unnumbered}

Spam is unwanted, unsolicited, "junk" e-mail received by an e-mail
account.

### C.4 What is a system? {#c.4-what-is-a-system .unnumbered}

A system is identified by logical boundaries being drawn around the
various processing, communications, storage and related resource
including:

-   Comprised of logically complete or separable functions;

-   Under the same direct management control;

-   Can be determined partially on the basis of physical location(s)
    (e.g. a group of two or more stand-alone personal computers in an
    office may be identified as a single system if they meet the other
    criteria);

-   Can be determined partially on the basis of users;

-   Must be determined considering the information processed or
    transmitted through or by the system;

-   Must be (as a whole) under the same direct management control and
    serve essentially the same whole function; and

-   Is defined officially by the CIO designation and is scoped with
    assistance from the IT Security Officer.

### C.5 What is a system owner? {#c.5-what-is-a-system-owner .unnumbered}

A system owner is a person (or organization) with program and/or
budgetary control over an IT system. This should be the same person or
organization as that having operational control over the system. This
should also be the same person or organization making use of the IT
resource. When a single person or organization does not share these
roles, realignment of responsibilities and roles is needed.