# CDC Baseline System Information

  ----------------------------------- -----------------------------------
  Document Last Updated:                   

  Document Updated by:                     
  ----------------------------------- -----------------------------------

## System Ownership

+-----------------------+---------------+--------------------+--------+
| System Name and       |               |                    |        |
| Acronym:              |               |                    |        |
+-----------------------+---------------+--------------------+--------+
| System entered into   | Y / N         |                    |        |
| ESC? [^1]             |               |                    |        |
+-----------------------+---------------+--------------------+--------+
| Unique Project        |               |                    |        |
| Identifier (UPI): ^1^ |               |                    |        |
+-----------------------+---------------+--------------------+--------+
| C/I/O Responsible:    |               |                    |        |
+-----------------------+---------------+--------------------+--------+
| C/I/O ISSO:           |               |                    |        |
+-----------------------+---------------+--------------------+--------+
| Has the C/I/O ISSO    |               |                    | Y / N  |
| reviewed and approved |               |                    |        |
| the information       |               |                    |        |
| provided in this      |               |                    |        |
| document?             |               |                    |        |
+-----------------------+---------------+--------------------+--------+
| Has the C/I/O Budget  |               |                    | Y / N  |
| Analyst certified     |               |                    |        |
| funds for IT security |               |                    |        |
| costs?                |               |                    |        |
+-----------------------+---------------+--------------------+--------+
| As the Business       |               |                    | Y / N  |
| Steward, do you agree |               |                    |        |
| with and accept all   |               |                    |        |
| the common controls   |               |                    |        |
| listed in the         |               |                    |        |
| Enterprise Master     |               |                    |        |
| System Security Plan? |               |                    |        |
+-----------------------+---------------+--------------------+--------+
| If no, please         |               |                    |        |
| explain.              |               |                    |        |
+-----------------------+---------------+--------------------+--------+

**Table 1.** System Stewards

+--------+--------------+--------------+--------------+--------------+
|        | **Business   | **Technical  | **Security** | **DAA**      |
|        | Steward**    | Steward**    |              |              |
|        |              |              | **Steward**  |              |
+--------+--------------+--------------+--------------+--------------+
| Name   |              |              |              |              |
+--------+--------------+--------------+--------------+--------------+
| Title  |              |              |              |              |
+--------+--------------+--------------+--------------+--------------+
| A      |              |              |              |              |
| ddress |              |              |              |              |
+--------+--------------+--------------+--------------+--------------+
| Phone  |              |              |              |              |
+--------+--------------+--------------+--------------+--------------+
| E-mail |              |              |              |              |
+--------+--------------+--------------+--------------+--------------+

## Functional Description

Provide a comprehensive description of the system's function. Attach
system concept of operations, vision statements, and/or project
justification documents if available.      

## Data Description / System Information Types & System Security Categorization

Complete Table 2 based on the NIST SP 800-60 *Guide for Mapping Types of
Information and Information Systems to Security Categories, Volume II*.

**Table 2. System Information Types & Impact Levels**[^2]

  --------------------------------------------------------------------------------------------------------
  **Information   **NIST SP     **Confidentiality**   **Integrity**   **Availability**   **Justification
  Type**          800-60                                                                 for Enhanced
                  Reference**                                                            Control**
  --------------- ------------- --------------------- --------------- ------------------ -----------------
                                                                                              

                                                                                              

                                                                                              

  **OVERALL                                                                              
  RATINGS**                                                                              
  --------------------------------------------------------------------------------------------------------

**NOTE: If any impact level is high, the system will require special
management attention due to the potential risk and magnitude of harm
resulting from the loss, misuse, or unauthorized access to (or
modification of) the information in the application (See Question 1.d)
and MUST go through the full C&A process.**

**NOTE: If C/I/A ratings differ from NIST SP 800-60, provide
justification and obtain approval from OCISO.**

## Detailed System Information

## System Status

+----------------------------------------------------------------+-----+
| 1.  Does this system require special management attention      |     |
|     because of its:                                            |     |
+----------------------------------------------------------------+-----+
| a.  Importance to an agency mission, as determined by HHS or   | Y / |
|     CDC?                                                       | N   |
+----------------------------------------------------------------+-----+
| b.  High development, operating or maintenance costs (equal to | Y / |
|     or greater than \$10 million per year)?                    | N   |
+----------------------------------------------------------------+-----+
| c.  Significant role, as determined by HHS or CDC, in the      | Y / |
|     administration of agency programs, finances (especially if | N   |
|     the system is a financial management system and outlays    |     |
|     more than \$500,000 a year), property, or other resources? |     |
+----------------------------------------------------------------+-----+
| d.  Potential risk and magnitude of harm resulting from the    | Y / |
|     loss, misuse, or unauthorized access to (or modification   | N   |
|     of) the information in the application?                    |     |
+----------------------------------------------------------------+-----+

+----------------------------------------------------------------+-----+
| 2.  Will this system be used by a CDC employee or contractor   | Y / |
|     on behalf of the CDC?                                      | N   |
+----------------------------------------------------------------+-----+

+----------------------------------------------------------------+-----+
| 3.  Will this system be deployed for use on a CDC information  | Y / |
|     system? (NOTE: A CDC information system is any system      | N   |
|     owned by CDC or operated on behalf of CDC.)                |     |
+----------------------------------------------------------------+-----+
| a.  If no, does this system include legal disclaimers          | Y / |
|     releasing CDC from associated liabilities[^3]?             | N   |
+----------------------------------------------------------------+-----+

+-------------------------------+-------------------------------+-----+
| 4.  Will this system:         |                               |     |
+-------------------------------+-------------------------------+-----+
| a.  Require an                |                               | Y / |
|     inbound/outbound          |                               | N   |
|     connection to the         |                               |     |
|     Internet?                 |                               |     |
+-------------------------------+-------------------------------+-----+
| > If yes, please describe and |                               |     |
| > list ports:                 |                               |     |
+-------------------------------+-------------------------------+-----+
| b.  Require or allow remote   |                               | Y / |
|     access to a CDC           |                               | N   |
|     information system?       |                               |     |
+-------------------------------+-------------------------------+-----+

+----------------------------------------------------------------+-----+
| 5.  Will this system send data to a CDC information system     |     |
|     through:                                                   |     |
+----------------------------------------------------------------+-----+
| a.  a web interface?                                           | Y / |
|                                                                | N   |
+----------------------------------------------------------------+-----+
| b.  a virtual private network?                                 | Y / |
|                                                                | N   |
+----------------------------------------------------------------+-----+
| c.  a dial-up connection?                                      | Y / |
|                                                                | N   |
+----------------------------------------------------------------+-----+

+-----------------------------------------------+---------------+-----+
| 6.  Where is the system in the agency System  |               |     |
|     Development Lifecycle (SDLC)?             |               |     |
|     (Initiation, Development/Acquisition,     |               |     |
|     Implementation, Operations/Maintenance,   |               |     |
|     Disposal)                                 |               |     |
+-----------------------------------------------+---------------+-----+
| a.  Are there in-house developed software     |               | Y / |
|     components?                               |               | N   |
+-----------------------------------------------+---------------+-----+
| b.  If yes, was a SDLC followed?              |               | Y / |
|                                               |               | N   |
+-----------------------------------------------+---------------+-----+
| c.  Was testing performed and documented      |               | Y / |
|     through all SDLC phases?                  |               | N   |
+-----------------------------------------------+---------------+-----+

+-----------------------------------------------+---------------+-----+
| 7.  What is the system's target / actual      |               |     |
|     production date?                          |               |     |
+-----------------------------------------------+---------------+-----+
| a\. Is there a migration plan?                |               | Y / |
|                                               |               | N   |
+-----------------------------------------------+---------------+-----+
| 8.  What is the system's expiration           |               |     |
|     date/retirement date?                     |               |     |
+-----------------------------------------------+---------------+-----+

## Technical Description

9.  Provide a comprehensive description of the system platform and
    technologies (OS, COTS, Custom Development, etc.) here. Attach
    current system / network diagrams. Complete the separate Host
    Characterization Worksheet to capture system-level specifics.      

## User Description

10. List the system user categories and privileges here.

+------------+-------------+-------------+-------------+---------------+
| **User     | **Access    | **Number of | **Org       | **Geographic  |
| Category** | Level       | Users       | anization** | Location**    |
|            | (Re         | (E          |             |               |
|            | ad/Write)** | stimated)** |             | **(City,      |
|            |             |             |             | Campus,       |
|            |             |             |             | Bldg.)**      |
+------------+-------------+-------------+-------------+---------------+
|            |             |             |             |               |
+------------+-------------+-------------+-------------+---------------+
|            |             |             |             |               |
+------------+-------------+-------------+-------------+---------------+
|            |             |             |             |               |
+------------+-------------+-------------+-------------+---------------+

## System Security Requirements

+-----------------------------------------------+----------------------+
| 11. What is the maximum amount of time that   |                      |
|     this system can be down before causing    |                      |
|     serious impact to CDC mission performance |                      |
|     (e.g., 48 hours, 1 week)?                 |                      |
+-----------------------------------------------+----------------------+

12. Risk Assessments Dates:

+-----------------------------------------------+----------------------+
| a.  Most recent risk assessment:              |                      |
+-----------------------------------------------+----------------------+
| b.  Initial System C&A:                       |                      |
+-----------------------------------------------+----------------------+
| c.  Most recent Security Self-Assessment:     |                      |
+-----------------------------------------------+----------------------+

13. E-Authentication Assessment[^4]

+-----------------------------------------------+---------------+-----+
| a.  Do any users authenticate remotely?       |               | Y / |
|                                               |               | N   |
+-----------------------------------------------+---------------+-----+
| b.  If yes, what mechanisms are used for      |               |     |
|     remote electronic authentication?         |               |     |
+-----------------------------------------------+---------------+-----+
| c.  Describe the impact of unauthorized       |               |     |
|     authentication and list potential         |               |     |
|     consequences.                             |               |     |
+-----------------------------------------------+---------------+-----+

**NOTE: HHS (CDC) employees and contractors gaining remote access to HHS
(CDC) systems (such as web-based electronic mail or access via VPN
technology) ARE NOT considered external end users. Systems requiring end
users external to the agency to authenticate with a USERID and password
(or similar validation process) ARE considered external end users. End
users from other Federal agencies outside the Department ARE considered
external end users**.

14. Privacy Impact Assessment[^5]

+-----------------------------------------------+---------------+-----+
| a.  Date of most recent PIA submission:       |               |     |
+-----------------------------------------------+---------------+-----+
| b.  Does this system qualify as a Privacy Act |               | Y / |
|     System of Records:                        |               | N   |
+-----------------------------------------------+---------------+-----+

### Comments:      

**System Interconnections/Dependencies**

15. List all systems, data feeds, etc. that this system depends upon.
    List the organization responsible for this dependency, if the
    dependency is critical (can this system function if the dependency
    fails), and indicate if a formal agreement (SLA, SIA, MOU, etc.) is
    in place between this system and the dependency.

+----------------------+---------------------------+---------+--------+
| **System             | **Owner**                 | **Cri   | **SIA  |
| Dependency**         |                           | tical** | /SLA** |
+----------------------+---------------------------+---------+--------+
|                      |                           | Y / N   | Y / N  |
+----------------------+---------------------------+---------+--------+
|                      |                           | Y / N   | Y / N  |
+----------------------+---------------------------+---------+--------+
|                      |                           | Y / N   | Y / N  |
+----------------------+---------------------------+---------+--------+

### Comments:      

16. List all systems supported by this system. List the organization
    responsible for the supported system, if this system is a critical
    dependency of the supported system (can the supported system
    function if this system fails), the maximum allowable downtime for
    this system as required by the supported system before agency
    missions are seriously impacted, and indicate if a formal agreement
    (SLA, SIA, MOU, etc.) is in place between this system and the
    supported system.

+----------------------+-----------------+---------+---------+--------+
| **Supported System** | **Owner**       | **      | **Cri   | **SIA  |
|                      |                 | Maximum | tical** | /SLA** |
|                      |                 | Dow     |         |        |
|                      |                 | ntime** |         |        |
+----------------------+-----------------+---------+---------+--------+
|                      |                 |         | Y / N   | Y / N  |
+----------------------+-----------------+---------+---------+--------+
|                      |                 |         | Y / N   | Y / N  |
+----------------------+-----------------+---------+---------+--------+
|                      |                 |         | Y / N   | Y / N  |
+----------------------+-----------------+---------+---------+--------+

### Comments:      

## System-Specific Laws or Regulations

17. List any laws, authorities, policies (CDC, DHHS), or regulations
    that establish specific requirements for confidentiality, integrity,
    or availability affecting the data or system. Do not include broad
    information system or security requirements that affect all agency
    systems such as FISMA, or the Clinger-Cohen Act. Do include system
    specific requirements such as the Privacy Act, HIPAA, or the
    Bio-Terrorism Preparedness Act. If there are no system-specific
    requirements, please indicate 'none.'      

## Standard Disclaimer

Use of the standard disclaimer below is mandatory for systems deployed
on non-CDC information systems. This standard disclaimer shall be
incorporated into the software in such a way that individuals must read
and accept its conditions before initial use (NOTE: The standard
disclaimer must appear in all capital letters):

> The material embodied in this software is provided to you \"as-is\"
> and without warranty of any kind, express, implied or otherwise,
> including without limitation, any warranty of fitness for a particular
> purpose. In no event shall the Centers for Disease Control and
> Prevention (CDC) or the united states (u.S.) government be liable to
> you or anyone else for any direct, special, incidental, indirect or
> consequential damages of any kind, or any damages whatsoever,
> including without limitation, loss of profit, loss of use, savings or
> revenue, or the claims of third parties, whether or not CDC or the
> u.s. government has been advised of the possibility of such loss,
> however caused and on any theory of liability, arising out of or in
> connection with the possession, use or performance of this software.

[^1]: Contact the CDC Capital Planning and Investment Control (CPIC)
    team if there is no entry for the system in the CDC Enterprise
    Systems Catalog (ESC) at [http://esc.cdc.gov](http://esc.cdc.gov/)
    and to determine if the system has or requires a UPI. Contact
    information for the CDC CPIC team is available at
    <http://intranet.cdc.gov/cpic/CPICContactUs.htm>.

[^2]: If necessary, additional rows may be added to this table, or the
    worksheet provided in *C&A Procedures Using the Enterprise Master
    System Security Plans* may be submitted with this *Baseline System
    Information* document. The value of "not applicable" cannot be
    assigned to any security objective for an information system.

[^3]: Please see instructions regarding the Standard Disclaimer for
    systems deployed on non-CDC information systems at the end of this
    document.

[^4]: Refer to OCISO E-Authentication assessment guidance and
    certification and accreditation worksheets as well as Office of
    Management and Budget Memorandum 04-04
    <http://www.whitehouse.gov/omb/memoranda/fy04/m04-04.pdf>

[^5]: Refer to agency Privacy Impact Assessment guidance and worksheets
    <http://intranet.hhs.gov/infosec/policies_guides.html#pia>