IT SECURITY HANDBOOK

MANAGEMENT CONTROLS

**IT Security program**

November 2001

(Edited 11.21.01)

TABLE OF CONTENTS

1\. INFORMATION TECHNOLOGIES (IT) SECURITY POLICY
[2](#information-technologies-it-security-policy)

1.1. PURPOSE [2](#purpose)

1.2. BACKGROUND [2](#background)

1.3. POLICY [2](#policy)

1.4. RESPONSIBILITIES [3](#responsibilities)

[2.]{.underline} [IT SECURITY]{.underline} PROGRAM MANAGEMENT
[4](#it-security-program-management)

2.1. PURPOSE [4](#purpose-1)

2.2. BACKGROUND [4](#background-1)

2.3. POLICY [4](#policy-1)

2.4. RESPONSIBILITIES [5](#responsibilities-1)

[3.]{.underline} [SECURITY PLAN]{.underline}S [8](#security-plans)

3.1. PURPOSE [8](#purpose-2)

3.2. BACKGROUND [9](#background-2)

3.3. POLICY [9](#policy-2)

3.4. RESPONSIBILITIES [11](#responsibilities-2)

[4.]{.underline} [RISK MANAGEMENT]{.underline} [13](#risk-management)

4.1. PURPOSE [13](#purpose-3)

4.2. BACKGROUND [13](#background-3)

4.3. POLICY [13](#policy-3)

4.4. RESPONSIBILITIES [14](#responsibilities-3)

[5.]{.underline} [CONTINGENCY PLAN]{.underline}S
[16](#contingency-plans)

5.1. PURPOSE [16](#purpose-4)

5.2. BACKGROUND [16](#background-4)

5.3. POLICY [16](#policy-4)

5.4. PROCEDURES [17](#procedures)

5.5. RESPONSIBILITIES [21](#responsibilities-4)

[6.]{.underline} [CERTIFICATION]{.underline} [24](#certification)

6.1. PURPOSE [24](#purpose-5)

6.2. BACKGROUND [24](#background-5)

6.3. POLICY [24](#policy-5)

6.4. PROCEDURES [27](#procedures-1)

6.5. RESPONSIBILITIES [29](#responsibilities-5)

[7.]{.underline} [ACCREDITATION]{.underline} [31](#accreditation)

7.1. PURPOSE [31](#purpose-6)

7.2. BACKGROUND [31](#background-6)

7.3. POLICY [31](#policy-6)

7.4. PROCEDURES [32](#procedures-2)

7.5. RESPONSIBILITIES [33](#responsibilities-6)

8\. APPENDIX A [35](#appendix-a)

8.1. ACRONYMS [35](#acronyms)

9\. APPENDIX B [36](#appendix-b)

9.1. GLOSSARY [36](#glossary)

10\. APPENDIX C [43](#appendix-c)

10.1. REFERENCES [43](#references)

# INFORMATION TECHNOLOGIES (IT) SECURITY POLICY

## PURPOSE

### This chapter provides policy guidance to the Agency for the implementation of Information Technology (IT) security policies and procedures. Security policies define lines of authority, primary points of contact, range of responsibilities, requirements, procedures and management processes that implement and sustain the framework of a compliant and cost effective security program

## BACKGROUND

### The Agency's goal is to provide ready access to essential, evidential information, including essential information in electronic format. 

### This electronically formatted information is created, collected, processed, stored, communicated and/or controlled in assemblies of computer [hardware](#hardware), [software](#software), and/or firmware known as information [system](#system)s.

### Presidential Decision Directive 63 (PDD 63) requires the Agency to develop a plan to ensure that this information is protected against any intrusion or modification that might endanger its existence or expose sensitive information to unauthorized sources. 

## POLICY

### [The Agency]{.underline} [IT Security Policy](#itsecuritypolicy). The Agency will develop an overall agency-wide IT security policy that will explain:

-   Purpose and scope of the agency IT security policy

-   Assignment of responsibilities for program implementation, as well
    as individual and other related offices' responsibilities (i.e.
    Human Resources)

-   [System](#system) compliance issues

### [Issue-Specific Policy](#issuespecificpolicy)[.]{.underline} Each office will prepare issue-specific and system specific policies, as circumstances require. Issue-specific policies focus on areas of current relevance and concern within an office to include: 

-   Office level contingency planning

-   Office level [risk management](#riskmanagement) program

-   Assignment of roles and responsibilities

-   Appropriate individuals in each organization to contact for further
    information, guidance, and compliance

### The facility policy must be reviewed and updated annually, as appropriate, to reflect current technology and best practices.

### Copies of both the Agency and the office [IT security](#itsecurity) policies must be provided to all the Agency staff and others with a legitimate need.

## RESPONSIBILITIES

### **[Chief Information Officer (CIO)]{.underline}** ensures that the Agency creates and implements an Agency-wide IT security policy.

### **[Information Security Officer (]{.underline}**[ISO](#isoaiso)**[)]{.underline}** develops the Agency IT security policy.

### **[Office Heads, and Regional Facility Directors]{.underline}** ensure the implementation of the IT security policy within their respective offices.

### **[NHP]{.underline}** informs the Office Heads, and Regional Facility Directors of security issues and procedures that may affect IT security.

### **[Managers]{.underline}** ensure that staff and other authorized personnel have access to a copy of the IT security policy and discuss relevant IT security issues with affected individuals.

### **[Staff]{.underline}** reviews and complies with policies and procedures as outlined in the Agency\'s IT security policy.

# IT SECURITY PROGRAM MANAGEMENT

## PURPOSE

### IT security program management provides the elements for establishing and managing an IT security program and the criteria to consider when designating an office Information Security Officer ([ISO](#isoaiso))

## BACKGROUND 

### OMB Circular A-130 Appendix III, which requires all Federal agencies to plan for the security of all automated information systems resources throughout their lifecycles.

### 40 U.S.C. Section 1441, Public Law 100-237 (Computer Security Act of 1987).

### Presidential Decision Directive 63 (Critical Infrastructure Protection).

### Information Technology Management Reform Act (Clinger-Cohen Act-1996).

### Public Law 106-398, Title X, Subtitle G (Government Information Security Reform Act).

## POLICY

### Every office must be represented by an Information Security Officer (ISO). This ISO representation will take the form of one of the following:

-   Part or full-time office ISO

-   Part or full-time ISO at the primary integrated facility with
    part-time ISOs at the remaining integrated sites

-   Each office will appoint an Alternate Information Security Officer
    ([AISO](#isoaiso)). This individual(s) serves as back-up for the ISO
    and assists the ISO in performing the required IT security functions

### All the Agency offices must develop and implement procedures to provide guidance and support for the IT security program. These procedures provide for the enforcement of IT security and for the documentation and transmission of important information and decisions relating to computer security. 

### Information security must be an integral part of the Strategic Planning process. 

### The Agency\'s IT security program is subject to external review for compliance with Federal and Agency requirements. A security review is required to ensure the IT security program actively encompasses each of the key program elements described in the Agency's IT Security Directive and its Handbook. The security review process and the areas to be addressed are contained in handbooks available on the Agency Information Security web site.

-   Security audit documentation, responses, and correspondence related
    to these reviews are considered [sensitive data](#sensitivedata) and
    treated in a manner that ensures the
    [confidentiality](#confidentiality) and integrity of these
    documents.

-   Security audits must be maintained at the Agency facility in a
    secure file and be available for review by the ISO and other
    authorized individuals (e.g., Office of the Inspector General (OIG),
    General Accounting Office (GAO)).

-   OIG or the GAO may also conduct external security audits.

## RESPONSIBILITIES

### **[Agency CIO]{.underline}** will:

-   Fully support and integrate IT Security into the overall the Agency
    structure

-   Ensure that each facility maintains an effective IT Security Program

-   Ensure that appropriate resources are allocated to each IT Security
    Program

-   Ensure the effectiveness of each program by monitoring and
    evaluating on an annual basis

### **[Agency]{.underline}** ISO will:

-   Provide the Agency policy and guidelines required to conduct an
    effective agency-wide IT security program.

-   Audit all administrative and technical aspects of the IT security
    program at least once every three years. These audits are scheduled
    in advance and will be conducted by, or under the auspices of the
    Agency staff.

-   Report deficiencies and corrective actions needed to the affected
    Office Head, or Regional Facility Director, and the Agency CIO for
    review and follow-up.

-   Follow-up with the office ISO until all corrective actions have been
    implemented.

-   Provide support to office IT security programs through IT security
    training, monthly teleconference calls, written and electronic
    communication, videos, brochures and on-site security audits.

### **[Agency Office Heads, and Regional Facility Directors]{.underline}** will:

-   Ensure the office or facility IT Security Program meets all the
    Agency policy requirements for the establishment of such a program.

-   Seek and provide the necessary resources to accomplish the goals and
    objectives of the IT Security Program.

-   Select an ISO and AISO who organizationally report to the Office
    Head or facility director and who have the necessary skills to
    perform this job.

-   Assume the security responsibility for each office IT system by
    signing an [accreditation](#accreditation-1) document authorizing
    its use by, or on behalf of the office.

### **[Designated Office Information Security Officer]{.underline}** coordinates the IT security program for the respective office. An effective ISO must:

-   Understand the overall business operation of the respective the
    Agency office.

-   Grasp the importance of information security (InfoSec) in the
    context of the overall the Agency mission.

-   Understand concepts in administrative security, technical security
    and system management to the extent needed to manage the security
    program.

-   Understand the underlying body of law and policy governing
    information security.

-   Understand trends in the Agency information technology field and
    reconcile these with current conditions in facility security
    environments.

-   Step into roles such as InfoSec investigator or auditor.

-   Establish InfoSec priorities.

### **[Office]{.underline}** ISO develops, implements, and manages a comprehensive IT security program as described in this section. The Alternate ISO assists the ISO and is responsible for all aspects of the security program in the absence of the ISO. Functions of the ISO include, but are not limited to the following:

-   Coordinates, plans, directs, implements, and supports the IT
    security program for the office.

-   Participates with all echelons of management in planning,
    implementing, establishing and monitoring system controls of the
    office IT Security Program.

-   Ensures compliance with the requirements for safeguarding personal
    and other [sensitive data](#sensitivedata) pursuant to the Computer
    Security Act of 1987, the Privacy Act of 1974, Freedom of
    Information Act, the Agency IT Security Policy and Guidelines, and
    compliance with other laws and directives that protect the
    facility's electronic information systems from waste, fraud, or
    abuse.

-   Develops and facilitates establishment of office-specific IT
    security policy and procedures as required, to ensure compliance
    with national information and computer security policy.

-   Ensures that all information security policies are accurate,
    reviewed annually, and updated as necessary.

-   Ensures that the Alternate ISO(s) is/are kept current on all
    security policy, procedures and issues.

-   Reviews the effectiveness of the locally established IT procedures
    as implemented.

-   Coordinates the development of policies and procedures to ensure the
    physical security of computer systems, terminal devices, and access
    controls to system software and data.

-   Ensures that proper procedures are developed and followed for the
    storage and disposition of forms or other printed outputs containing
    sensitive data.

-   Develop and monitor procedures for controlling and authorizing
    movement of [peripheral device](#peripheraldevice)s to off-site
    locations.

-   Coordinates system IT [Risk Analyses](#riskanalysis) with the
    [system administrator](#systemadministrator)s on a scheduled basis
    or when changes occur in the office risk environment.

-   Facilitates the development of sensitive system [security
    plan](#securityplan)s for each IT system and reviews these plans at
    least annually, ensuring they are updated as required.

-   Ensures appropriate and timely action to protect electronic
    information assets from damage, destruction, alteration, and
    misappropriation, including fire, safety, and planning for
    contingencies.

-   Coordinates the development of the office IT [contingency
    plan](#contingencyplan) for all systems and reviews these plans at
    least annually, ensuring that they are updated as required.

-   Ensures that at least one copy of the facility contingency plan is
    maintained off-site and the facility's copies are kept in a secure
    on-site area.

-   Ensures that training and assistance is provided to facilitate the
    development and periodic testing of office-level contingency plans.

-   Manages contingency plan tests of IT resources.

-   Reviews and evaluates the results of contingency plan tests and
    reports findings with recommendations to office management.

-   Ensures that workable procedures are developed from these
    contingency plans that include [backup](#backup) and
    restart/recovery information for facility computer systems.

-   Provides all documentation required for the accreditation of each
    facility system to the office head or facility director.

-   Establishes and implements procedures for identifying and reporting
    suspected or actual IT security breaches.

-   Advises Human Resources in establishing appropriate Position
    Sensitivity Level designations for each staff position.

-   Ensures that background investigations (related to IT security) for
    employees occupying sensitive positions are requested in a timely
    manner.

-   Provides guidance to Human Resources in updating of position
    descriptions and performance standards to reflect IT security
    responsibilities.

-   Prepares training material and conducts training sessions involving
    sensitive IT security for office staff.

-   Coordinates the office continuing IT security awareness and training
    program by distributing applicable security training information to
    the staff as it becomes available and works closely with staff to
    facilitate the IT security awareness effort.

-   Conducts IT security orientation during staff entry processing.

-   Establishes procedures to ensure that system administrators, both
    local and remote, are notified of the transfer or termination of any
    employee who has system access privileges; and that all computer
    devices used by that employee are either returned to the dispensing
    official or are otherwise identified.

-   Coordinates secure delivery of [password](#password)s with the
    system administrator.

-   Maintains documentation of all local staff members that are
    authorized users of remote systems. Maintains documentation of
    remote users of local systems.

-   Establishes procedures to ensure surveys of desktop workstations are
    completed to verify that software installation and equipment use
    conform to the Agency 815, New Desktop Software Requests, and the
    Agency 802, Appropriate Use of the Agency Office Equipment.

-   Ensures that access for users who are no longer authorized users of
    the Agency's computer systems is terminated.

-   Conducts routine reviews of the security access request files to
    ensure that the Agency IT user access forms are appropriately signed
    by each new user to establish authorized access.

-   Ensures that procedures are established for control and
    authorization of movement of peripheral devices to off-site
    locations.

-   Serves as the principal resource person for dealing with violations
    of IT security law and policy.

-   Maintains an historical file on IT security-related incidents.

-   Coordinates the secure provision of IT access for
    audit/investigative team members.

-   Investigates information [security incident](#securityincident)s and
    recommends appropriate action to managers.

-   Coordinates security reviews of office systems and operations.

-   Provides advice and guidance to ensure procedures are established
    for identifying and reporting breaches of physical security to
    information systems.

-   Reviews annually all technical security procedures and makes
    recommendations as appropriate.

-   Ensures that procedures are developed and implemented to protect
    data transmission and media storage from unauthorized access.

-   Evaluates security software currently on the market, coordinates
    findings with appropriate staff, and recommends its use where
    suitable.

-   Ensures software security is maintained, including the use and
    selection of software protection devices that prevent unauthorized
    access to system programs or data.

-   Reviews and evaluates the impact of proposed office changes on IT
    security.

-   Reports security incidents to the Agency Office of the Inspector
    General.

# SECURITY PLANS

## PURPOSE

### This chapter provides policy and guidance on completing [security plan](#securityplan)s for the Agency Information Technology (IT) resources. The agency and offices are required to provide adequate levels of security protection for each IT resource from its initial concept phase through the remainder of its life cycle. 

### The system security plan provides details of the security and privacy requirements of the designated system and the system owner's plan for meeting those requirements. The IT security plan is a tool for the system administrator to determine the sensitivity level and protection requirements for the system. It provides the following assistance:

-   Describes the control measures currently in place and any planned
    controls that are intended to meet the protection requirements of
    the system.

-   Assists in determining whether or not current security measures are
    adequate.

-   Determines what additional action and/or resources are required to
    bring the system in line with operational and security requirements.

-   Establishes the actual milestones for completing requirements and
    may serve as an internal management planning and decision-making
    tool.

-   Contains detailed technical information about the system, its
    security requirements and the controls implemented to provide
    protection against any [vulnerability](#vulnerability).

-   Serves as a structured process for planning adequate cost-effective
    security protection for a system.

-   Reflects input from the system administrators, information owners,
    end users, and the ISO.

-   Provides the major component utilized by management in determining
    whether to accredit a system and is the first step in the
    accreditation process.

### The policy and guidance contained in this chapter applies to all unclassified systems and covers all such IT resources maintained in-house or in the interest of the Agency, and applies to all existing Information Technologies and any automated technology acquired in the future. Compliance with this policy and guidance is mandatory for all organizational units, staff, contractors, and others having access to, operating, or acting in behalf of the Agency, on these unclassified resources.

## BACKGROUND

### Office of Management and Budget (OMB) Circular A-130, "Management of Federal Information Resources," Appendix III, "Security of Federal Automated Information Resources," and of Public Law 100-235, "Computer Security Act of 1987" require the completion of system security plans. 

### The Agency's Security Plan Instructions and Template are located on the Agency Information Security web site.

### Additional detailed guidance on completing security plans is available in the National Institute of Standards and Technology's (NIST's) "Guide for Developing IS Security Plans -- Special Publication 800-18, which is available on the Agency Information Security web site.

## POLICY

### OMB Circular A-130, Appendix III divides systems into "General Support Systems" and "Major Application Systems. Due to confusion in separating the systems into these categories, the Agency has elected to combine the elements of both systems into one security planning process and plan. The Agency recommended security-planning process (examples on the Agency Information Security web site) includes the required elements of both the "General Support" and the "Major Application" elements. When completing the plan, if an element does not apply to the particular system in question, it can be annotated as "not applicable."

### As defined by this policy, a system is any device that has the ability to process and store or retrieve electronic data. It is identified by constructing logical boundaries around a set of processes, communications, storage, and related resources. 

### The elements within these boundaries constitute a single system requiring a security plan. Each element of the system must: 

-   Be under the same direct management control;

-   Have the same function or mission objective;

-   Have essentially the same operating characteristics and security
    needs; and

-   Reside in the same general operating environment.

### The Agency offices must identify all Information Technology (IT) systems being used by or on behalf of their office, and any system used on behalf of a facility, whether housed at that facility or in a remote location, must be documented in a security plan, including the following:

-   All [server](#server)s

-   All telecommunication systems.

-   All standalone PCs.

-   All LANs.

-   Any system used to connect a facility's information resources to a
    remote location.

### Grouping systems, when logical, is acceptable and the systems may be covered under one security plan. However, each [operating system](#operatingsystem) must be uniquely identified and controls established and documented for each operating system in the plan. Here we have a situation where, what appears to be a single system, incorporates several servers, each using a different operating system. Obviously, security features, designs, and configurations are going to be different for each one. Let's examine the criteria established for a system:

+---------------------------------------------------------+------+-----+
| ######### Elements for                                  |      |     |
| Consideration {#elements-for-consideration .unnumbered} |      |     |
+---------------------------------------------------------+------+-----+
| > 1\. Are the systems under the same direct management  | > X  |     |
| > control?                                              |      |     |
+---------------------------------------------------------+------+-----+
| > 2\. Do they have the same function or mission         | > X  |     |
| > objective?                                            |      |     |
+---------------------------------------------------------+------+-----+
| > 3\. Do they have essentially the same operating       |      | > X |
| > characteristics and security needs?                   |      |     |
+---------------------------------------------------------+------+-----+
| > 4\. Do they reside in the same general operating      | > X  |     |
| > environment?                                          |      |     |
+---------------------------------------------------------+------+-----+

If, in this case, only three of the four criteria meet the required
elements for a single system plan, then each of the systems should
either have a separate plan, or if not a separate plan, then one that
discusses the unique differences between the two operating systems and
provides separation in terms of the security features, risks,
configuration, and safeguards used.

### All component systems covered by a system security plan need not be physically connected. An example of this scenario is an office that has standalone PCs throughout several sites that are all primarily used for administrative purposes and all have Windows software installed. All standalone PCs in the office fall under the auspices of NHT and a single system administrator controls all software, hardware, and communication devices related to these PCs. As before, let's examine the criteria for establishing security plans for this situation.

+---------------------------------------------------------+------+-----+
| > **Elements for Consideration**                        |      |     |
+---------------------------------------------------------+------+-----+
| > 1\. Are the systems under the same direct management  | > X  |     |
| > control?                                              |      |     |
+---------------------------------------------------------+------+-----+
| > 2\. Do they have the same function or mission         | > X  |     |
| > objective?                                            |      |     |
+---------------------------------------------------------+------+-----+
| > 3\. Do they have essentially the same operating       | > X  |     |
| > characteristics and security needs?                   |      |     |
+---------------------------------------------------------+------+-----+
| > 4\. Do they reside in the same general operating      | > X  |     |
| > environment?                                          |      |     |
+---------------------------------------------------------+------+-----+

In this case, suppose that all of the four criteria meet the required
elements for a single system plan. Although, the PCs are spread
throughout the office, it is clear they have the same overall general
working and operating environment. To qualify under this general
category, the PC must have no [network](#network) or remote connection
capability.

### Offices will consider what systems they own and how they may logically group or not group the identified systems. The most important consideration is that all office systems are covered under a security plan.

### Security plans will be dated for ease of tracking modifications and approvals. Dating each page of a security plan may be appropriate if updates are to be made through change pages.

### Security plans must be updated annually to reflect changes in technical, operational and management issues.

## RESPONSIBILITIES

### Information Technology Services Division (NHT) 

#### **[Senior NHT Official:]{.underline}** 

-   Assures management is assigned for all IT resources.

-   Assigns security responsibility for each system under her/his
    authority. The Agency Information Technology systems outside the
    authority of NHT will be assigned security responsibility by the
    office responsible for their management.

#### **[Information Security Officer (]{.underline}**ISO**[)/Alternate Information Security Officer]{.underline}** (AISO)**[:]{.underline}** 

-   Serves as the central point of contact for IT security and
    coordinates security plan requirements with NHT and the system
    administrators within the office or facility.

-   Establishes and maintains a list of all IT systems within the
    facility.

-   Ensures that, for each identified system, an individual has been
    assigned responsibility for the security of that system.

-   Ensures preparation of IT security plans, in the approved format,
    for all systems owned and operated by or on behalf of the facility.

-   Reviews all facility IT security plans. Comments on form or content
    will be sent to the originator for corrective action. ISO/AISO
    maintains a copy of the corrected plans.

-   Maintains a tracking system for security plans to ensure plan
    completion, [identification](#identification) and correction of
    action items, and incorporation and documentation of changes to the
    system or environment into the plan.

-   Ensures that system administrators review and update all plans
    annually.

#### [System Administrator**: **]{.underline}

-   Works with all affected areas and the ISO to prepare an IT Security
    Plan in the Agency approved format for each individual system
    identified,

-   Works with the ISO and NHT to complete an action plan that
    identifies system vulnerabilities and establishes dates to complete
    necessary corrections.

-   Ensures that all details of the official security plan are
    communicated to all individuals with a need-to-know.

-   Ensures that both the ISO and NHT have a current copy of the
    official security plan and that all copies are securely stored.

-   Updates the plan annually to incorporate any changes to the system
    status. Roll over any action items not completed from previous plans
    and forward to the ISO and NHT for review.

-   Determines responsibility to define system boundaries and determine
    sensitivity levels.

# RISK MANAGEMENT

## PURPOSE

### This chapter provides the Agency offices with policy and procedures necessary to establish and maintain a [Risk Management](#riskmanagement) Program. The program applies to all IT resources and helps to ensure the balance of [risk](#risk)s, vulnerabilities, [threat](#threat)s and countermeasures to achieve an acceptable risk level based on the sensitivity or criticality of the individual systems.

### The policy include all the Agency IT resources and is mandatory for all organizational units, staff, contractors, and others having access to these resources, or operating on them in behalf of the Agency.

### This policy applies to all existing Information Technologies and any new systems acquired after the effective date of this policy.

## BACKGROUND 

### Risk management is the total process of identifying, controlling, and eliminating or reducing risks that may affect IT resources. It includes:

-   [Risk analysis](#riskanalysis);

-   Determination of the appropriate levels of resources necessary to
    protect the IT;

-   Management decisions to implement selected IT security safeguards
    based on the risk analysis, including accepting residual risk, if
    necessary; and

-   Effectiveness reviews.

### OMB A-130, Appendix III no longer requires the preparation of formal (i.e., quantitative) risk analyses. While formal risk analyses need not be performed, the need to determine adequate security requires that a risk-based approach be used. This risk analysis approach should include a consideration of the major factors in risk management and the effectiveness of current or proposed safeguards.

### the Agency currently provides a Risk Analysis Guideline, located on the Agency Information Security Web Site.

## POLICY

### Each office establishes and maintains programs for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into existing and new installations of Information Technologies.

### Each office conducts two general types of risk analyses, one for the overall office, and another for each IT resource operated by, or on behalf of, the office. 

### The initial risk assessment is a measure of risks before they are corrected. Only residual risks should be considered during certification and accreditation of the system.

### It is recommended that a team concept be utilized in completing risk analyses. Perform risk analyses:

-   Prior to the approval of design specifications for new facilities
    and before the acquisition of new Information Technologies;

-   Whenever there is a significant change to the facility or its
    Information Systems;

-   On each system identified by the office; and

-   Once every three years, at a minimum.

### The results of the individual system risk analysis and the office risk analysis must be documented. 

### The assessment team evaluates the results from these assessments and immediate action will be taken to reduce identified deficiencies. Those deficiencies that cannot be immediately reduced and suggested alternatives must be presented to management. 

### Not all risk can be avoided. Budget constraints, staffing limitations, and cost-benefit considerations (controls can cost more than potential losses) may result in the acceptance of certain existing risks.

### The Office Head must correct, or accept as uncontrolled risk, vulnerabilities found during any analysis (the Agency audits, OIG audits, GAO audits, for example). If the decision is to accept a risk, this decision must be documented as an uncontrolled risk and signed by the Office Head. The system administrator and the ISO maintain this document and the risk analysis report and make them available for review by authorized reviewing organizations upon request (such as the Agency, GAO, OIG). The certification/accreditation package presented to the Office Head for that system also includes a copy. 

### Consider all risk analysis reports sensitive documents, and therefore, label, handle and secure them appropriately.

## RESPONSIBILITIES

### [Agency CIO]{.underline} must ensure that facilities establish and maintain an effective risk management program.

### [Agency Office Heads, and Regional Facility Directors]{.underline}:

-   Ensure that a risk analysis and system risk analyses are performed
    and documented at least every three years; and

-   Ensure that vulnerabilities and risks found during any analysis are
    corrected, reduced to an acceptable level or accepted as
    uncontrolled risks.

### System Administrator[s]{.underline} are responsible for ensuring that risk analyses are performed on all systems for which they have responsibility. 

### [NHT and the Appropriate]{.underline} ISO:

-   Complete an office or unit IT risk analysis.

-   Review the risk analyses for the office IT resources (both the
    office risk assessment and the system risk assessments) for
    completeness and assess the magnitude of the risks to the office or
    unit.

-   Retain a copy of each system risk analysis.

-   Develop a plan for correcting known vulnerabilities and risks
    identified from the system risk analyses.

-   Document and forward recommendations to the Office Head or Facility
    Director. The plans must include specific tasks, target dates for
    completion, and costs to implement, if applicable.

# CONTINGENCY PLANS

## PURPOSE 

### This chapter establishes requirements for business resumption and contingency planning within the Agency. Each Agency office is responsible for the development, periodic testing and updating of a [contingency plan](#contingencyplan) for the office and contingency plans for all IT resources within that office.

## BACKGROUND

### View Contingency Plans from two separate aspects: 

-   From the providers' perspective, individuals responsible for
    providing the resources necessary to conduct the office business
    need; and

-   From the customers' viewpoint, individuals who must consider what to
    do until normal processing is restored.

### Although regional facilities and Presidential Libraries are accessed for processing and storing information through the Agency NET, the Agency\'s [wide area network](#wideareanetwork) (WAN), and the regional facilities also have their own [local area network](#localareanetwork)s (LAN) that link the various personal computers and share various resources. 

### If a catastrophic event occurs that makes it impossible for the Agency staff to use their respective LAN, the re-establishment of information systems and network functions is one part of the resumption plan. To restore both the information technology and the general office environment, consider the following interim processes: 

-   Hot sites (a reserved space already equipped with processing
    capability);

-   Reciprocal agreements and arrangements with other agencies to
    provide restored capacity;

-   [Backup](#backup) copies of critical files (vital records),
    previously processed on Local Area Network servers, required for
    continuing operations during the contingency period.

### Additional information is available on the Agency\'s website: 

## POLICY

### All the Agency IT systems require contingency plans. The contingency plan documents the specific methodology, structure, discipline, and procedures to be used for emergency response, backup operations, and post-disaster recovery. This planning ensures the availability of critical resources and facilitates the continuity of operations in an emergency situation.

### [Office Heads, and Regional Facility Directors]{.underline} are responsible for the development and maintenance of contingency plans for these IT functions. The contingency planning process addresses the following activities:

-   Backup and recovery of data and software;

```{=html}
<!-- -->
```
-   Emergency response actions to be taken to protect life and property
    and minimize the impact of the emergency;

-   Selection of a backup or alternate operation strategy;

-   Actions to be accomplished to initiate an effective recovery of
    business processes including a move to an alternate site, if
    necessary;

-   Resumption of normal operations in the most efficient and cost
    effective manner.

### All offices develop and maintain current contingency plans for IT systems disaster recovery that provide assurance that critical data processing support, based on the results of a thorough risk analysis, can be continued or resumed in a reasonable time frame. These plans include adequate coverage as described below.

-   Emergency procedures in response to natural or manmade disasters
    (fire, flood, civil disorder, natural disaster, bomb threat or any
    other activity which may endanger lives, property or the capability
    to perform essential functions) will be defined in the appropriate
    Emergency Preparedness Plan. Prominently display these emergency
    procedures in the areas to which they apply.

-   Define and document arrangements, procedures and responsibilities to
    ensure that essential (critical) operations can be continued if
    normal processing or data communications are interrupted.

-   Establish and document recovery procedures and responsibilities to
    facilitate the rapid restoration of normal operations at the primary
    site, or if necessary, at an alternate processing site.

-   Identify and prioritize the minimally acceptable level of degraded
    operation of the essential (critical) systems or functions to guide
    implementation of recovery operations.

## PROCEDURES 

### The following procedures outline the steps to be followed in the development and implementation of an effective contingency plan for the Agency as required in the Agency's Handbook to the Agency Directive      , "Information Technologies Security."

#### **[Identify and Coordinate Mission-Critical Functions]{.underline}**. Identify and prioritize mission-critical functions in order of importance. Coordinate plans designed to continue essential missions and functions and appreciate the dependent nature of this process.

#### **[Identify the Resources that Support Critical Functions]{.underline}**. Included in this analysis are the time frames when each resource will be needed, and the effect on the mission if the resource is not available. One method used to identify mission-critical functions and their impact is called Business Impact Analysis. It includes the following reviews: 

-   Site functions to understand the impact if they are not performed. A
    review is done of each function regarding its impact on operations,
    end users, interrelationships with other critical functions, as well
    as workload peaks and valleys;

-   Additional expenses caused by overtime, the need for temporary
    employees, and other miscellaneous costs associated with recovery;
    and

-   Inability to perform the facility's mission-critical functions. This
    needs to be evaluated and considered with regard to the impact
    within the organization.

#### **[Anticipating Potential Disasters]{.underline}**. All resources associated with critical functions should be examined with likely problem scenarios. Form a contingency planning team, and include representatives from three main areas: functional/business groups, facilities management, and technology management. Team members should also include staff from NHT, system administrator, ISO/AISO and other employees from financial management, personnel, and physical security. Assign legal advisors and other specialty groups to the team as needed.

#### **[Selecting Business Resumption and Contingency Planning Strategies]{.underline}.** The primary purpose of this step is to plan how to restore needed resources. Consider alternative strategies and evaluate each for those controls necessary to prevent or minimize the disaster. A contingency planning strategy consists of three parts: 

-   [Emergency response,]{.underline} the initial actions taken to
    protect lives and limit damage;

-   [Recovery,]{.underline} the steps that are taken to continue support
    for critical functions;

-   [Resumption,]{.underline} the return to normal operations. The
    relationship between recovery and resumption is important. The
    longer it takes to resume normal operations, the longer the
    organization will be required to operate in the recovery mode.

#### **[Strategy Selection]{.underline}** Base the selection of a strategy on practical considerations such as feasibility and cost. Risk analysis can be used to help estimate the cost of options to decide on an optimal strategy. The risk analysis should focus on areas where it is not clear which strategy is the best. Ask following questions as part of the risk analysis: 

-   Is it more expensive to purchase and maintain a generator or to move
    processing to an alternate site, considering the likelihood of
    losing electrical power for various lengths of time?

-   Are the consequences of losing computer-related resources
    sufficiently high to warrant the cost of various recovery
    strategies?

-   What categories of resources should each be considered? Some of
    these resources include human resources, processing capability,
    automated applications and data, computer-based systems, physical
    infrastructure, documents and papers.

#### **[Implementation]{.underline}** Contingency planning, preparation, implementation, and procedures depend on the organization\'s configuration (e.g., number of systems) and overall criticality and inter-relationships of systems being analyzed. Three of the most important issues are:

-   How many plans are required. The number of actual plans needed
    depends upon the unique circumstances for each organization;

-   Who prepares each plan. For small or less complex systems, the
    contingency plan may be incorporated into the computer security plan
    for that system. For larger complex systems, the computer security
    plan would contain a brief synopsis of the contingency plan. The
    contingency plan would be a separate document.; and

-   Who executes the plan. At this point, coordination and cooperation
    between resource managers and functional managers is critical for
    success in implementing the plan.

#### Examples of preparations for implementing contingency plans include:

-   Establish procedures for backing up files and applications and
    testing the backups on a regular basis;

-   Establish contracts and agreements if the contingency strategy calls
    for them, re-negotiating existing contracts if necessary to reflect
    any changes;

-   Purchase equipment to support a redundant capability. Maintain and
    periodically replace this equipment when no longer dependable or
    obsolete to an organization\'s architecture;

-   Keep preparations, including documentation, up-to-date.

-   Formally designate people who are responsible for various tasks in
    the event of a contingency. These people are often referred to as
    the contingency response team, which is often composed of members of
    the contingency planning team.

#### **[Documentation]{.underline}**. Document and update the contingency plan regularly. A written plan is essential. It should clearly state, in simple language, the sequence of tasks to be performed in the event of an incident to enable someone with minimal knowledge to begin to execute the plan immediately. Store updated, electronic and printed copies of the contingency plan in several secure locations, such as alternate processing sites and secure off-site storage facilities. Members of the contingency plan response team must have 24-hour access to a copy of the plan.

#### Contingency Plans must include thoroughly documented procedures for restoring resources or for providing alternate processing. Remember that the system administrator may not be available during the disaster. Detailed, documented procedures that are readily available shorten recovery time and conserve resources.

#### **[Training]{.underline}**. All personnel must be trained in, and continually practice and up-date, their contingency-related duties. New personnel must be trained as they join the organization. In an emergency there may be inadequate time to check a manual to determine correct procedures, and continuous training and practice promotes effective employee response during emergencies.

#### **[Testing and Revising]{.underline}** 

-   Test the contingency plan yearly to identify and correct any
    problems in planning or implementation;

-   Assign responsibility for keeping the contingency plan current; and

-   Include reviews, analyses, and simulations of disasters.

-   Use the results of contingency planning to improve the plan and
    detect and correct flaws.

#### **Review** A review can be a simple test to check the accuracy of contingency plan documentation. The review will:

-   Confirm that individuals listed are still in the organization;

-   Confirm that individuals have the responsibilities that caused them
    to be included in the plan;

-   Check home and work telephone numbers, organizational codes, and
    building and room numbers;

-   Determine if files can be restored from backup tapes; and

-   Confirm that employees know emergency procedures.

#### **[Analysis]{.underline}** An analysis may be performed on the entire plan or portions of it, such as emergency response procedures. The individual conducting the analysis should:

-   Be a staff member who did not participate in the development of the
    contingency plan but has a sound knowledge of the critical functions
    and supporting resources;

-   Interview functional managers, resource managers, and their staff to
    uncover missing or unworkable sections of the plan.

#### **[Simulations]{.underline}** Disaster simulations provide information about flaws in the contingency plan and provide practice for a real emergency. These tests provide critical information that can be used to ensure the continuity of important functions. In general, the more critical the functions and the resources addressed in the contingency plan, the more cost-beneficial it is to perform a disaster simulation.

#### **[Interdependencies]{.underline}**. Controls that support and compliment each other can prevent or reduce the effects of a disaster by lessening or eliminating the damage occurring as a result of the destruction, disclosure, or denial of critical resources. These controls include:

1.  Risk analysis:

-   Analyzes vulnerabilities;

-   Weighs the benefits of various contingency-planning options; and

-   Identifies critical resources needed to support the organization and
    the local threats to those resources.

2.  Physical, environmental, and logical access controls:

-   Help prevent the destruction of Information Technologies.

-   Address the most common threats: theft, unauthorized access, fires,
    loss of power, plumbing failures, and natural disasters.

3.  Incident handling, a subset of contingency planning, is the
    emergency response provided by a facility or organization to provide
    immediate assistance against active IT threats. A good incident
    response capability will:

-   Prevent incidents by incorporating preventive measures that guard
    against similar incidents;

-   Educate users about the incident, the circumstances, and the
    corrective action taken or needed. Examples of where incident
    response would be needed include a [virus](#virus) attack and a
    telephone social engineering attack. The first, a virus attack would
    require a technical solution to inoculate systems against the virus
    and the second, a telephone social engineering attack, would depend
    more heavily on employee awareness of the issue.

4.  Support and operations controls include:

-   Periodic backing up of critical files;

-   Prevention and recovery from more common contingencies, such as a
    disk failure or corrupted data files.

5.  Policy creates and documents the organization\'s approach to
    contingency planning and assigns explicit responsibilities.

## RESPONSIBILITIES 

### [**Agency** **CIO**]{.underline} ensures that offices have business resumption and contingency plans for all IT resources.

### **[Office Heads, and Regional Facility Directors]{.underline}**:

-   Ensure the development, periodic testing and updating of contingency
    plans for all IT resources located at that office or facility.

-   Ensure the establishment of a contingency planning team with
    representation from three main areas: functional/business groups,
    facilities management, and technology management.

-   Identify all mission-critical systems and applications utilized by
    the office or facility.

-   Ensure that all sensitive automated information required and
    controlled by the office or facility is adequately backed up and
    stored in a secure and readily available location.

-   Notify the ISO of scheduled contingency tests and forward
    documentation of the results to the ISO after testing.

-   Designate, in writing, an individual(s) to serve as the [Contingency
    Plan Project Coordinator]{.underline} for the system and ensure this
    information is forwarded to the office or unit ISO.

### ISO/AISO designated as the office IT [Contingency Plan Project Leader]{.underline}:

-   Provides guidance and coordination of the office IT contingency
    planning efforts;

-   Defines requirements to develop and test system level contingency
    plans to ensure they align with the overall facility IT security
    policy and contingency plan;

-   Develops plans and schedules for implementing the office IT
    contingency planning policy;

-   Develops a planning methodology to ensure quality, consistency, and
    comprehensiveness of the completed contingency plans.

-   Maintains a current listing of all IT Contingency Plan Project
    Coordinators and system administrators within the office.

-   Provides training and support to the contingency planning team, and
    to the individuals appointed to develop and coordinate contingency
    plans.

-   Monitors the contingency planning process and is prepared to report
    the progress to management as required.

-   Establishes test schedules, monitors the tests, and evaluates the
    results.

-   Reports the results of all IT contingency plan tests and critiques
    of their effectiveness to office management annually.

-   Participates as a member of the Emergency Preparedness Committee or
    its equivalent.

-   Evaluates all levels of contingency plans, determines the level of
    backup support, and identifies and prioritizes critical applications
    that will be supported. For example, based on these evaluations, it
    may be necessary to suspend non-critical applications until normal
    operations are restored.

-   Maintains current copies of all contingency plans, tests,
    evaluations, and subsequent follow-up actions and makes this
    information available to external audit teams, as required.

### **[Contingency Plan Project Coordinator]{.underline}**:

-   Develops and maintains the contingency plan(s) for the system,
    outlining the procedures for protection and recovery of physical
    files, personnel, and office equipment and manual procedures to be
    used in the event that IT systems are disrupted for an extended
    period of time.

-   Coordinates with the ISO and NHT to ensure the plan is consistent
    with the overall disaster recovery plan.

-   Communicates the plan to all users within the office.

-   Clearly defines and communicates individual personnel,
    responsibilities, and authorities.

-   Schedules and document tests of the system's contingency plan and
    critiques their effectiveness.

-   Coordinate the activation of the system's contingency plan during an
    emergency.

### **[CIO/NHT/System Administrator]{.underline}:**

-   Develop a comprehensive contingency plan to address adverse events
    that could impact Information Technology assets or NHT's ability to
    provide assistance to end users. This plan also addresses incident
    handling procedures. A boilerplate NHT Contingency Plan is available
    on the Agency Information Security web site.

-   Create and securely store copies of systems, utilities/support, and
    applications software, data files, and associated documentation for
    use in facility-wide backup and recovery operations. Store backups
    in an area that is documented and available to all key staff during
    an emergency.

-   Evaluate all contingency plans and determine the level of backup
    support needed, and identify and prioritize those critical
    applications that you support.

-   Evaluate the need to suspend applications or subsets of applications
    that are not Mission critical until normal operations are restored.

-   Develop a strategy for providing adequate alternate processing
    capability based on the prioritization of critical applications
    identified within each. Strategies address support functions
    including transportation, [telecommunications](#telecommunications),
    and recovery operations (for example, cleaning companies
    specializing in electronic equipment, media recovery specialists,
    and equipment and protective device manufacturers).

-   Maintain a list of the personnel involved in the disaster
    planning/recovery process. The roster provides adequate information
    to contact personnel both during scheduled work hours and during
    off-shift hours. It is critical that the roster of personnel be
    updated as personnel, addresses, telephone numbers, and
    responsibilities change.

-   Maintain a current configuration diagram for all systems, networks,
    and telecommunications components.

-   Communicate the plan to all users and units that will be affected by
    the plan(s). Clearly define and communicate individual personnel and
    their responsibilities and authority.

-   Activate and coordinate established contingency plans during an
    emergency.

# CERTIFICATION

## PURPOSE

### This chapter establishes the Agency IT security policy for certification of all sensitive IT resources. Sensitive IT resources include both systems and applications that require some degree of protection for [confidentiality](#confidentiality), integrity or availability. This includes systems and data whose improper use or disclosure could adversely affect the ability of an office or unit to accomplish its Mission, proprietary data, records about individuals requiring protection under the Privacy Act, and data not releasable under the Freedom of Information Act. The policy contained in this chapter covers all the Agency IT resources, whether maintained in-house or in the interest of the Agency*. NOTE: If the* system *or application is required for accomplishment of an agency Mission it is considered sensitive.*

### [Certification](#certification-1) is a requirement for all IT resources. Existing IT, new IT resources and those not fully operational must complete all certification requirements and be accredited prior to full implementation.

## BACKGROUND

### Certification is a requirement of Office of Management and Budget (OMB) Circular Number A-130, Appendix III, the "Computer Security Act of 1987," Public Law 100-235, and the Agency Directives.

### Certification testing requires a thorough technical evaluation that determines if all security requirements are met, including all applicable department and Federal policies, regulations, and standards. The results of tests should demonstrate that the installed security safeguards are adequate and appropriate for the system or application being tested. The certification process is the final step leading to accreditation (authorization for processing). Accreditation policy and procedures are included in a separate chapter of this Handbook.

### Certification of the system/application is based on the documented results of the design reviews, system tests, and the recommendations of the testing teams. All systems/applications must include security controls that reflect the true importance of the information processed and/or the government investment embodied in the components of the IT resource.

## POLICY

### Conduct certification evaluations on all IT resources owned or operated on behalf of the Agency.

### The Agency certifies software before releasing it to the field. Modifications made to the software at the facility level will require re-certification at the site making the modifications.

### Initial Certification. 

-   Prior to accreditation, each IT resource is to undergo appropriate
    technical certification evaluations to ensure that it meets all
    Federal, the Agency policies, regulations and standards.

-   All installed security safeguards are functioning properly and are
    appropriate for the protection requirements of the
    system/application. Certification of the system/application is based
    on the documented results of the design reviews (if available),
    system tests and the recommendations of the testing teams.

-   All systems/applications must include security controls that reflect
    the true importance of the information processed on the system.

### Interim Certification: 

-   The certification process must be flexible enough that it
    accommodates the need for operational efficiency, as well as
    adequate protection of the system.

-   In a situation where the need for a system is sufficiently critical
    that it must be in operation before a full certification is
    possible, the Certifying Official can provisionally certify the
    system/application, documenting necessary restrictions, pending
    specific actions to be completed in a predefined time frame.

-   This interim certification cannot exceed one year.

-   These actions should also be included as milestones in the security
    plan for the system.

### Re-certification. Systems/applications will be re-certified when: 

-   Changes in requirements result in the need to process data of a
    higher sensitivity.

-   After the occurrence of a serious security violation, which raises
    questions about the validity of an earlier certification.

-   No less frequently than three years after the previous
    certification.

-   Substantial changes are made to the system. Examples of major
    changes include:

```{=html}
<!-- -->
```
-   Changes in the system or software applications. These are
    substantial changes that alter the Mission, operating environment or
    basic vulnerabilities of the system. Examples are increases or
    decreases in hardware, application programs, or external users;
    hardware upgrades; addition of telecommunications capability;
    dial-in lines; changes to program logic of application systems; or
    relocation of system to new physical environment or new
    organization.

-   Minor changes such as replacement of similar hardware when capacity
    does not significantly change, addition of two or three workstations
    on a network or small modifications to an application program (e.g.,
    table headings are changed) would not require re-certification.

```{=html}
<!-- -->
```
-   Changes in protection requirements. These are changes in the
    sensitivity level of the data being processed, increase in the
    Mission criticality of the system or changes in Federal or the
    Agency policies.

-   Occurrence of a significant security violation. These are violations
    or incidents that call into question the adequacy of the system
    security controls.

-   Audit or evaluation findings. These are findings from any security
    review that identify significant unprotected risks. Such findings
    could include the system certification review, physical or
    information security inspection, internal control reviews, external
    audits (i.e., the Agency, OIG, and GAO).

-   Certification documentation for sensitive systems will be marked
    "For Official Use Only." Sensitive systems are those in which the
    information included in the certification documentation contains
    details about the system that may identify weaknesses or
    vulnerabilities and requires protection against disclosure to
    persons without the need to know.

### A Certification Review Team, established to conduct the technical evaluation of the system/application, obtains input from all who have been involved with the system/application, including: ISO, System Administrator, software development staff, the computer operations staff, and users. 

### Certification Testing of Security Controls: 

-   The technical certification evaluation results are the basis for the
    system administrator's certification statement in the accreditation
    request. The certification document should state what methods were
    used to perform the certification evaluation.

-   The first step in the certification process is to determine what the
    protection requirements for the IT resource should be which are
    based on the sensitivity or criticality of the individual
    system/application.

-   Once these requirements are defined, select and implement
    cost-effective controls to provide adequate protection to achieve an
    acceptable level of risk.

-   The goal of the technical certification evaluation is to test
    existing controls to determine: (1) if controls function
    properly; (2) if controls satisfy performance criteria and provide
    for availability, survivability and accuracy; and (3) if the
    controls can be easily defeated or circumvented.

### The technical certification evaluation can be accomplished by two or more of the following:

-   Evaluation and Testing. Security controls installed and implemented
    require testing to ensure they meet the defined security
    requirements for the system and they function as expected. System
    administrators should maintain documented results of these tests to
    be used as part of the certification review. In addition to specific
    tests of individual controls, evaluation of the overall system may
    also be performed. These evaluations may take the form of checklists
    or other methods that ensure consideration has been given to all
    security requirements and controls. Copies of evaluation results
    should be included in the certification documentation for the
    accreditation package. The recommended methodology for completing a
    certification review is located on the Agency Information Security
    Web Site.

-   Other Internal Reviews. The results of any security related reviews
    performed by evaluation teams internal to the facility may be used
    as part of the certification evaluation. These reviews may include
    internal control reviews, physical or information security
    inspections, or ISO security reviews. Test and document corrective
    actions. Copies of review findings and corrective actions taken
    should be included in the certification documentation for the
    accreditation package.

-   External Reviews. The results of any audits performed by independent
    external organizations may also be used as part of the certification
    evaluation. The Agency, OIG, GAO, or other audit groups may have
    performed these audits or reviews. Implementation of any corrective
    actions taken as a result of these audit findings should be tested
    and documented. Include copies of audit findings and corrective
    actions taken in the certification documentation for the
    accreditation package.

-   Risk Analysis. Risk analysis can play a dual role in the evaluation
    process. It can be used to help determine important security
    requirements for the IT resource and to evaluate the existing and
    planned controls for cost-effective risk reduction. Since risk
    analysis must be performed throughout the life cycle of the system,
    it provides a method for reassessing the risks against system
    changes and determining additional controls required establishing an
    acceptable level of risk for the system/application.

## PROCEDURES 

### Assemble a team. 

-   Assemble a team to gather the information and documentation needed
    to assess and demonstrate the adequacy of security measures used;

-   Include representatives of IT security, application owners, software
    development staff if necessary, system administrators, computer
    support staff, and users. The IT security staff provides an outside
    viewpoint to ensure that the best IT security practices are used in
    protecting sensitive systems.

### Collect existing documents needed for the certification evaluation. These documents include, but are not limited to:

-   System specifications and documentation

-   System security plan

-   Risk analysis

-   Contingency and disaster recovery plans

-   Staff records on personnel and the IT Security Officer
    [identification](#identification), training and position sensitivity
    levels

-   Internal Control Reviews, security reviews, etc., if existing

### Identify and describe the system/application to be certified and describe why it is sensitive. 

-   Create a written description of the purpose of the system;

-   Include the hardware and software environment on which the system is
    operated; and

-   Include a description of the sensitivity of the system, including
    any special applicable laws and regulations. This information is
    readily available in the Sensitive System Security Plan for the
    system being certified.

-   If the certification is for a software application system that will
    be used by others, the hardware description should address the
    hardware needed to operate the system: however

-   Focus the certification on the software application program.

### Identify protection requirements and vulnerabilities. 

-   Review the description of the protection requirements for the system
    under the headings confidentiality, integrity, and availability in
    the Sensitive System Security Plan.

-   Identify vulnerabilities for the system related to these protection
    requirements. Most vulnerabilities will be addressed in the existing
    documents collected in Step 2

-   Ensure that all sensitive systems have a completed risk analysis.
    The risk analysis will identify vulnerabilities and their
    consequences, such as unauthorized disclosure of information, loss
    of data or other resources, denial of service, decisions based on
    erroneous information, etc. System documentation is another source
    of information about the vulnerabilities. The security plan for the
    system being evaluated contains information about specific
    vulnerabilities and control measures addressed.

-   Review any existing Internal Control, Inspector General (IG) or
    security audit reports on the system, for additional information on
    system vulnerabilities.

-   Interview managers in the user organization to ascertain their
    concerns about the sensitivity of the system and the level of
    protection required.

### Identify security features needed. 

-   Review existing documents to identify the controls in place to
    address the vulnerabilities identified above. The risk analysis,
    security plans, and system documentation reviewed for
    vulnerabilities also contain information on controls used to reduce
    those vulnerabilities. System specifications, if they still exist,
    will also provide information on the controls designed into the
    system.

-   Review the contingency and disaster recovery plans for the system.
    Staff training records will show the level of IT security training
    given to application and computer installation staff. Staff records
    should also show the sensitivity designation of staff positions and
    any personnel investigations, required and conducted, for staff in
    the affected positions.

### Test adequacy of controls. 

-   Selectively check the adequacy of the controls once vulnerabilities
    and controls have been identified. Some live tests may be needed to
    ensure that documented controls actually work.

-   Review other controls through other means. Previous system reviews
    and system acceptance tests may contain records of tests previously
    performed. It is not necessary to repeat these tests, if the system
    has not changed since they were done. The review of vulnerabilities
    and controls should identify any areas not adequately addressed.

-   Use a Sensitive System Certification Worksheet to list the tests to
    be performed.

-   Maintain a record of the results of the tests.

### Evaluate the test results. The team will:

-   Prepare a summary of the evaluation of the tests once all tests are
    completed. The team should then prepare recommendations about
    certification.

-   Recommend certification with no further action required if the test
    results indicate that all protection requirements have been met.

### If the Certification Review Team determines from the test results that the protection requirements were not met for the system: 

-   Explain the inadequacy of the controls in place in the evaluation
    discussion of test results.

-   Alternatively certify that the basic protection requirements have
    been met, but recommend additional features be required. This latter
    form of certification is appropriate for certifying a software
    application system that must have certain operating system or
    hardware features in place for approved operation. This may also be
    used in recommending interim accreditation pending installation of
    some additional control not currently available.

### Certification. NHT or the Agency CIO signs the official Certification Document. 

### If the need for a system is such that it must be put into operation before a full certification is possible:

-   The Certifying Official can provisionally certify the system for
    operation, possibly with some restrictions, pending specific actions
    to be completed in a predefined time frame.

-   This interim certification cannot exceed one year.

-   These actions should also be included as milestones in the security
    plan for the system. The certification process must be flexible
    enough that it accommodates the need for operational efficiency as
    well as adequate protection of the system.

### A Certification Guideline with the corresponding worksheets for certifying systems is available on the Agency's Information Security web site.

## RESPONSIBILITIES

### **[Agency CIO]{.underline}** ensures that all systems within the Agency have been certified.

### **[Office Heads, and Regional Facility Directors]{.underline}**: ensure that all systems operated at or on behalf of the office or facility are certified.

### **[CIO/NHT]{.underline}** will:

-   Assemble the certification teams as required.

-   Review the certification team's certification documentation and
    recommendation for each identified system/application.

-   Sign the official certification statement for each system within the
    office.

### **[Certification Team]{.underline}** will:

-   Perform all actions required for the certification review as
    outlined in the Process section of this chapter.

-   Complete and sign the Evaluation and Recommendation certification
    document.

-   Forward the certification document to the Chief NHT/CIO for review
    and final approval.

### **[System Administrators]{.underline}** will:

-   Collect/prepare the necessary documentation required for system
    certification as described in this chapter.

-   Participate in the certification process as a team member, as
    appropriate.

-   Maintain the certification documentation of the system they manage.

-   Include the certification evaluation in the accreditation package
    for the Director.

### ISO/AISO will:

-   Ensure that system administrators are provided with information
    concerning the certification and accreditation of systems.

-   Assist the system administrators in preparing and collecting the
    necessary documentation required for a system certification.

-   Participate as a team member in the certification process.

-   Maintain a copy of the certification documentation of each system.

-   Ensure that the certification evaluation and recommendation document
    is included in the accreditation package for the Director's review.

# ACCREDITATION

## PURPOSE

### This chapter establishes the Agency policy for [accreditation](#accreditation-1) of IT resources. The policy contained in this chapter covers all the Agency IT resources maintained in-house or in the interest of the Agency.

### Accreditation is required for all the Agency IT resources processing sensitive data. New IT resources or those not fully operational must complete all requirements and be accredited prior to full implementation.

## BACKGROUND

### Accreditation is a requirement of Office of Management and Budget (OMB) Circular Number A-130 and the "Computer Security Act of 1987," Public Law 100-235.

### Accreditation or "authorization for processing" is the authorization and approval, granted to an IT resource to process, as an acceptable risk, in an operational environment. The term accreditation describes the process whereby information pertaining to the security of a system is developed, analyzed and submitted for approval to the appropriate senior management official.

### The accreditation documentation includes a copy of the system security plan, risk analysis, contingency plan, security tests and results, and any residual risks known about the system. 

### The accreditation documentation provides the approving official with a clear understanding of a system's operational readiness and plans to correct any deficiencies noted. It should close by making specific recommendations for full, partial or denial of system accreditation. 

## POLICY 

This policy defines the final step in the IT security management process
that ensures protection of the vital IT resources within the Agency.

### **[Initial Accreditation]{.underline}** 

-   All the Agency IT resources processing [sensitive
    data](#sensitivedata) will be accredited.

-   The Office Head (approving official) will review the accreditation
    support documentation and will either concur, thereby declaring that
    a satisfactory level of operational security is present or not
    concur, indicating that the level of risk has not been adequately
    defined or reduced to an acceptable level for operational
    requirements.

-   The approving official must sign a formal accreditation statement
    declaring that the system appears to be operating at an acceptable
    level of risk, or defining any conditions or constraints that are
    required for appropriate system protection. A sample accreditation
    statement is located on the Agency Information Security Web Site.

### [**Interim** **Accreditation **]{.underline} 

-   Interim authority to operate can be granted for a fixed period of
    time not to exceed one year. This authority is based on an approved
    security plan and is contingent on certain conditions being met. The
    interim authority to operate, while continuing the accreditation
    process, permits the IT resource to meet its operational Mission
    requirements while improving its security posture. If the approving
    official is not satisfied that the IT resource is protected at an
    acceptable level of risk, an interim accreditation can be granted to
    allow time for implementation of additional controls.

-   An IT system administrator or the ISO may make a recommendation or
    request for an interim accreditation.

-   Interim authority to operate is not a waiver of the requirement for
    accreditation.

-   The IT resource must meet all requirements and be fully accredited
    by the interim accreditation expiration date.

### **[Re-accreditation]{.underline}**. Systems will be re-accredited when major changes occur to the system or every three years, whichever occurs first. Examples of major changes include:

-   Changes in the system or software applications -- Substantial
    changes that alter the Mission, operating environment or basic
    vulnerabilities of the system. Major changes include an increase or
    decrease in hardware, application programs, external users, hardware
    upgrades, addition of telecommunications capability, dial-in lines,
    changes to program logic of application systems, relocation of
    system to new physical environment or new organization. Minor
    changes such as, replacement of similar hardware when capacity does
    not significantly change, addition of two or three workstations on a
    network or small modifications to an application program (e.g.,
    table headings are changed) would not require re-accreditation.

-   Changes in protection requirements -- Changes in the sensitivity
    level of the data being processed, increase in the
    Mission-criticality of the system or changes in Federal or the
    Agency policies.

-   Occurrence of a significant violation -- A violation or incident
    that questions the adequacy of the system security controls.

-   Audit or evaluation findings -- Findings from any security review
    that identify significant unprotected risks. These could include the
    system security verification review, physical or information
    security inspection, internal control reviews, Office of the
    Inspector General (OIG) audits or General Accounting Office (GAO)
    audits and the Agency Security Audits.

### The information included in the accreditation package contains details about the system. These details may identify weaknesses or vulnerabilities that require protection against disclosure to persons without the need to know. Accreditation documentation for sensitive systems must be secured and marked, "For Official Use Only."

## PROCEDURES

### The following documentation for each IT resource will be prepared and submitted in the accreditation package to the appropriate approving official (Office Head or designee):

-   [Request for Accreditation]{.underline}. A written request that
    includes a certification statement that the IT resource has
    undergone adequate tests to ensure that it meets all Federal and the
    Agency policies, regulations and standards and that all installed
    security safeguards appear to be adequate and appropriate for the
    sensitivity of the system.

-   [Approved IT Security Plan.]{.underline} The purpose of the system
    security plan is to provide a basic overview of the security and
    privacy requirements of the subject system and the IT resource
    owner's plan for meeting those requirements. The plan may also be
    viewed as documentation of the structured process of planning
    adequate, cost-effective security protection for the system. Details
    about completing these plans are presented in Chapter 3. "Security
    Plans" of this document.

-   [Completed]{.underline} Risk Analysis[.]{.underline} IT resource
    managers are responsible for having a risk analysis conducted for
    each IT resource to ensure that appropriate, cost effective
    safeguards are incorporated into existing and new systems. See
    Chapter 4. "Risk Management" of this Handbook for guidance on
    performing the required risk analysis.

-   [Contingency/Disaster Recovery Plans.]{.underline} Each IT resource
    develops and maintains a contingency and disaster recovery plan
    which provides reasonable assurance that critical data processing
    can be continued, or resumed quickly, if normal operations are
    interrupted. Policy concerning contingency/disaster recovery
    planning is contained in Chapter 5, "Contingency/Disaster Recovery"
    of this Handbook.

-   [Certification Evaluation and Recommendation]{.underline}. Prior to
    accreditation, each IT resource undergoes appropriate technical
    evaluations to ensure that it meets all Federal and the Agency
    policies, regulations and standards and that all installed security
    safeguards are functioning as designed and appropriate for the
    sensitivity of the data stored on the system. Chapter 6.
    "Certification" of this handbook outlines the methodology for
    conducting certification testing.

## RESPONSIBILITIES

### **[Agency CIO]{.underline}** ensures that all systems within the Agency have been accredited.

### **[Office Heads, and Regional Facility Directors]{.underline}**: 

-   Ensure that all IT resources within their office or facility are
    officially accredited.

-   Make the official accreditation decision based on review of the
    accreditation documentation presented to them and the
    recommendations of NHT/CIO and the ISO.

### **[CIO/NHT]{.underline}** will:

-   Review the accreditation package submitted to them by the system
    administrator.

-   Make a recommendation to the Director for or against accreditation
    based on the documentation, the risks, the results of the
    certification, and the advice of the ISO.

-   Submit the accreditation package to the Director.

### **[System Administrators]{.underline}** will:

-   Complete, with the assistance of the ISO, an accreditation package.

-   Take the corrective actions necessary to accredit the system if the
    system receives a partial accreditation or accreditation is
    disapproved.

-   Maintains a copy of the accreditation package and ensures that the
    ISO has a current and complete accreditation package.

-   Takes the necessary actions outlined in this handbook to re-accredit
    the system if major changes are made to the system or at a minimum
    every three years.

### **[ISO]{.underline}:**

-   Acts as the central point of contact for accreditation of IT
    resources within the office or unit.

-   With the assistance of the system manger and the CIO/NHT, ensures
    that the security controls in place meet all applicable Federal and
    the Agency policies, regulations, and standards for the particular
    IT resource.

-   Recommends, as appropriate, to the CIO/NHT regarding accreditation
    of the system based on the accreditation package submitted by the
    system administrator.

-   Maintains a copy of the accreditation packages for all the IT
    resources operated on or on behalf of the facility.

-   Ensures that each IT resource is re-accredited every three years or
    when there is a major change to the system that may affect the
    security of the system.

# APPENDIX A

## ACRONYMS

> **IT** Information Technology
>
> **AISO** Alternate Information Security Officer
>
> **CIO** Chief Information Officer
>
> **FOIA** Freedom of Information Act
>
> **GAO** Government Accounting Office
>
> **GSA** General Services Administration
>
> **ISO** Information Security Officer
>
> **LAN** Local Area Network
>
> **NIST** National Institute of Standards and Technology
>
> **OIG** Office of the Inspector General
>
> **OMB** Office of Management and Budget
>
> **OPM** Office of Personnel Management
>
> **PBX** Private Branch Exchange

# APPENDIX B

## GLOSSARY

  -------------------------------- --------------------------------------------------
  **Access Control**               Security control designed to permit authorized
                                   access to an IT system or application.

  []{#accreditation-1              A formal declaration by the Office Head that the
  .anchor}**Accreditation**        IT is approved to operate in a particular security
                                   mode using a prescribed set of safeguards.
                                   Accreditation is the official management
                                   authorization for operation of IT and is based on
                                   the certification process, as well as other
                                   management considerations. The accreditation
                                   statement affixes security responsibility with the
                                   Office Head and shows that due care has been taken
                                   for security.

  **Authentication**               Verification of the identity of a user, user
                                   device, or other entity, or the integrity of data
                                   stored, transmitted, or otherwise exposed to
                                   unauthorized modification in an IT.

  **Audit Trail**                  A record showing who has accessed a computer
                                   system and what operations he or she has performed
                                   during a given period of time. Audit trails are
                                   useful both for maintaining security and for
                                   recovering lost transactions.

  **Automated Information          An assembly of computer hardware, software and/or
  System(s) (AIS)**                firmware configured to collect, create,
                                   communicate, compute, disseminate, process, store,
                                   and/or control data or information.

  **Availability of Data**         The state when data are in the place needed by the
                                   user, at the time the user needs them, and in the
                                   form needed by the user.

  []{#backup .anchor}**Backup**    A copy of data and/or applications contained in
                                   the IT stored on magnetic media outside of the IT
                                   to be used in the event IT data are lost.

  []{#certification-1              The comprehensive evaluation of the technical and
  .anchor}**Certification**        non-technical security features of an IT and other
                                   safeguards, made in support of the accreditation
                                   process, that establishes the extent to which a
                                   particular design and implementation meet a
                                   specified set of security requirements.

  **Ciphertext**                   Form of cryptography in which the *plaintext* is
                                   made unintelligible to anyone, who intercepts it
                                   by a transformation of the information itself,
                                   based on some key.

  []{#confidentiality              The concept of holding sensitive data in
  .anchor}**Confidentiality**      confidence limited to an appropriate set of
                                   individuals or organizations.

  **Configuration Management**     The process of keeping track of changes to the
                                   system, if needed, approving them.

  []{#contingencyplan              A plan for emergency response, backup operations,
  .anchor}**Contingency Plan**     and post-disaster recovery maintained by an
                                   activity as a part of its security program that
                                   will ensure the availability of critical resources
                                   and facilitate the continuity of operations in an
                                   emergency situation.

  **COTS Software**                Commercial Off The Shelf Software -- software
                                   acquired by government contract through a
                                   commercial vendor. This software is a standard
                                   product, not developed by a vendor for a
                                   particular government project.

  **Data Integrity**               The state that exists when automated data is the
                                   same as that in source documents, or has been
                                   correctly computed from source data, and has not
                                   been exposed to alteration or destruction.

  **Degaussing Media**             Method to magnetically erase data from magnetic
                                   tape.

  **Default**                      A value or setting that a device or program
                                   automatically selects if you do not specify a
                                   substitute.

  **Dial-up**                      The service whereby a computer terminal can use
                                   the telephone to initiate and effect communication
                                   with a computer.

  **Encryption**                   The process of making information indecipherable
                                   to protect it from unauthorized viewing or use,
                                   especially during transmission or storage.
                                   Encryption is based on an algorithm and at least
                                   one key. Even if the algorithm is known, the
                                   information cannot be decrypted without the
                                   key(s).

  **Facsimile**                    A document that has been sent, or is about to be
                                   sent, via a fax machine.

  **Firewall**                     A system or combination of systems that enforces a
                                   boundary between two or more networks.

  **Friendly Termination**         The removal of an employee from the organization
                                   when there is no reason to believe that the
                                   termination is other than mutually acceptable.

  **Gateway**                      A bridge between two networks.

  []{#hardware                     Refers to objects that you can actually touch,
  .anchor}**Hardware**             like disks, disk drives, display screens,
                                   keyboards, printers, boards, and chips.

  []{#identification               The process that enables recognition of a user
  .anchor}**Identification**       described to an IT.

  **Internet**                     A global network connecting millions of computers.
                                   As of 1999, the Internet has more than 200 million
                                   users worldwide, and that number is growing
                                   rapidly.

  **Intranet**                     A network based on TCP/IP protocols (an internet)
                                   belonging to an organization, usually a
                                   corporation, accessible only by the organization's
                                   members, employees, or others with authorization.
                                   An intranet's Web sites look and act just like any
                                   other Web sites, but the firewall surrounding an
                                   intranet fends off unauthorized access.

  **Intrusion Detection**          Pertaining to techniques, which attempt to detect
                                   intrusion into a computer or network by
                                   observation of actions, security logs, or audit
                                   data. Detection of break-ins or attempts either
                                   manually or via software expert systems that
                                   operate on logs or other information available on
                                   the network.

  []{#isoaiso .anchor}**ISO/AISO** The persons responsible to the Office Head or
                                   Facility Director for ensuring that security is
                                   provided for and implemented throughout the life
                                   cycle of an IT from the beginning of the concept
                                   development plan through its design, development,
                                   operation, maintenance, and secure disposal.

  []{#issuespecificpolicy          Policies developed to focus on areas of current
  .anchor}**Issue-specific         relevance and concern to an office or facility.
  Policy**                         Both new technologies and the appearance of new
                                   threats often require the creation of
                                   issue-specific policies (e.g., e-mail, Internet
                                   usage).

  []{#itsecurity .anchor}**IT      Measures and controls that protect an IT against
  Security**                       denial of and unauthorized (accidental or
                                   intentional) disclosure, modification, or
                                   destruction of ITs and data. IT security includes
                                   consideration of all hardware and/or software
                                   functions.

  []{#itsecuritypolicy             The set of laws, rules, and practices that
  .anchor}**IT Security Policy**   regulate how an organization manages, protects,
                                   and distributes sensitive information.

  **IT Systems**                   An assembly of computer hardware, software and/or
                                   firmware configured to collect, create,
                                   communicate, compute, disseminate, process, store,
                                   and/or control data or information.

  **LDAP**                         Short for Lightweight Directory Access Protocol, a
                                   set of protocols for accessing information
                                   directories. LDAP is based on the standards
                                   contained within the X.500 standard, but is
                                   significantly simpler. And unlike X.500, LDAP
                                   supports TCP/IP, which is necessary for any type
                                   of Internet access.

  **Least Privilege**              The process of granting users only those accesses
                                   they need to perform their official duties.

  []{#localareanetwork             A short-haul data communications systems that
  .anchor}**Local Area Network**   connects IT devices in a building or group of
                                   buildings within a few square miles, including
                                   (but not limited to) workstations, front end
                                   processors, controllers, switches, and gateways.

  **Management Controls**          Security methods that focus on the management of
                                   the computer security system and the management of
                                   risk for a system.

  **Modem**                        An electronic device that allows a microcomputer
                                   or a computer terminal to be connected to another
                                   computer via a telephone line.

  []{#network .anchor}**Network**  Two or more systems connected by a communications
                                   medium; a network is composed of a communications
                                   medium and all components attached to that medium
                                   whose responsibility is the transference of
                                   information.

  []{#operatingsystem              The most important program that runs on a
  .anchor}**Operating System**     computer. Every general-purpose computer must have
                                   an operating system to run other programs.
                                   Operating systems perform basic tasks, such as
                                   recognizing input from the keyboard, sending
                                   output to the display screen, keeping track of
                                   files and directories on the disk, and controlling
                                   peripheral devices such as disk drives and
                                   printers.

  **Operation Controls**           Security methods that focus on mechanisms that
                                   primarily are implemented and executed by people
                                   (as opposed to systems).

  **Overwriting media**            Method for clearing data from magnetic media.
                                   Overwriting uses a program to write (1s, Os, or a
                                   combination) onto the media. Overwriting should
                                   not be confused with merely deleting the pointer
                                   to a file (which typically happens when a "delete"
                                   command is used).

  []{#password                     Protected/private character string used to
  .anchor}**Password**             authenticate an identity or to authorize access to
                                   data.

  **Parity**                       The quality of being either odd or even. The fact
                                   that all numbers have parity is commonly used in
                                   data communication to ensure the validity of data.
                                   This is called parity checking.

  **PBX**                          Short for private branch exchange, a private
                                   telephone network used within an enterprise. Users
                                   of the PBX share a certain number of outside lines
                                   for making telephone calls external to the PBX.

  []{#peripheraldevice             Any external device attached to a computer.
  .anchor}**Peripheral Device**    Examples of peripherals include printers, disk
                                   drives, display monitors, keyboards, and mice.

  **Port**                         An interface on a computer to which you can
                                   connect a device.

  **Port Protection Device**       A device that authorizes access to the port
                                   itself, often based on a separate authentication
                                   independent of the computer's own access control
                                   functions.

  **RADIUS**                       Short for Remote Authentication Dial-In User
                                   Service, an authentication and accounting system
                                   used by many Internet Service Providers (ISPs).
                                   When you dial in to the ISP you must enter your
                                   username and password. This information is passed
                                   to a RADIUS server, which checks that the
                                   information is correct, and then authorizes access
                                   to the ISP system.

  **Real Time**                    Occurring immediately. Real time can refer to
                                   events simulated by a computer at the same speed
                                   that they would occur in real life.

  **Remote Access**                The hookup of a remote computing device via
                                   communication lines such as ordinary phone lines
                                   or wide area networks to access network
                                   applications and information

  []{#risk .anchor}**Risk**        The probability that a particular threat will
                                   exploit a particular vulnerability of the system.

  []{#riskanalysis .anchor}**Risk  The process of identifying security risks,
  Analysis**                       determining their magnitude, and identifying areas
                                   needing safeguards. Risk analysis is a part of
                                   risk management.

  []{#riskmanagement               Process of identifying, controlling, and
  .anchor}**Risk Management**      eliminating or reducing risks that may affect IT
                                   resources.

  **Router**                       An interconnection device that is similar to a
                                   bridge but serves packets or frames containing
                                   certain protocols. Routers link LANs at the
                                   network layer.

  **Rules of Behavior**            Rules established and implemented concerning use
                                   of, security in, and acceptable level of risk for
                                   the system. Rules will clearly delineate
                                   responsibilities and expected behavior of all
                                   individuals with access to the system. Rules
                                   should cover such matters as work at home, dial-in
                                   access, connection to the Internet, use of
                                   copyrighted works, unofficial use of Federal
                                   Government equipment, the assignment and
                                   limitation of system privileges, and individual
                                   accountability.

  []{#securityincident             An adverse event in a computer system or the
  .anchor}**Security Incident**    threat of such an event occurring.

  []{#securityplan                 Document that details the security controls
  .anchor}**Security Plan**        established and planned for a particular system.

  **Security Specifications**      A detailed description of the safeguards required
                                   to protect a system.

  []{#sensitivedata                Any information, the loss, misuse, modification
  .anchor}**Sensitive Data**       of, or unauthorized access to, could affect the
                                   national interest or the conduct of Federal
                                   programs, or the privacy to which individuals are
                                   entitled under Section 552a of Title 5, U.S. Code,
                                   but has not been specifically authorized under
                                   criteria established by an Executive order or an
                                   act of Congress to be kept classified in the
                                   interest of national defense or foreign policy.

  **Separation of Duties**         A process that divides roles and responsibilities
                                   so that a single individual cannot subvert a
                                   critical process.

  []{#server .anchor}**Server**    The control computer on a local area network that
                                   controls software access to workstations,
                                   printers, and other parts of the network.

  **Smart Card**                   A credit-card-sized device with embedded
                                   microelectronics circuitry for storing information
                                   about an individual. This is not a key or token,
                                   as used in the remote access authentication
                                   process.

  []{#software                     Computer instructions or data. Anything that can
  .anchor}**Software**             be stored electronically is software.

  **Software Copyright**           The right of the copyright owner to prohibit
                                   copying and/or issue permission for a customer to
                                   employ a particular computer program.

  **SPAM**                         To crash a program by overrunning a fixed-site
                                   buffer with excessively large input data. Also, to
                                   cause a person or newsgroup to be flooded with
                                   irrelevant or inappropriate messages.

  []{#system .anchor}**System**    Set of processes, communications, storage, and
                                   related resources that are under the same direct
                                   management control, have the same function or
                                   Mission objective, have essentially the same
                                   operating characteristics and security needs, and
                                   reside in the same general operating environment.

  **System Availability**          The state that exists when required automated
                                   information s can be performed within an
                                   acceptable time period even under adverse
                                   circumstances.

  **System Integrity**             The quality that a system has when it performs its
                                   intended function in an unimpaired manner, free
                                   from deliberate or inadvertent unauthorized
                                   manipulation of the system.

  []{#systemadministrator          The individual responsible for defining the
  .anchor}**System Administrator** system's operating parameters, authorized
                                   functions, and security requirements. This
                                   individual is usually the person who maintains the
                                   system on a day-to-day basis.

  **System Owner**                 The individual who is ultimately responsible for
                                   the function and security of the system.

  **TCP/IP**                       Transmission Control Protocol/Internet Protocol.
                                   The Internet Protocol is based on this suite of
                                   protocols.

  **Technical Controls**           Security methods consisting of hardware and
                                   software controls used to provide automated
                                   protection to the system or applications.
                                   Technical controls operate within the technical
                                   system and applications.

  **Technical Security Policy**    Specific protection conditions and/or protection
                                   philosophy that express the boundaries and
                                   responsibilities of the IT product in supporting
                                   the information protection policy control
                                   objectives and countering expected threats.

  []{#telecommunications           Any transmission, emission, or reception of
  .anchor}**Telecommunications**   signals, writing, images, sound or other data by
                                   cable, telephone lines, radio, visual or any
                                   electromagnetic system.

  []{#threat .anchor}**Threat**    Any circumstance or event with the potential to
                                   cause harm to a system in the form of destruction,
                                   disclosure, modification of data, and/or denial
                                   thereof.

  **Trojan Horse**                 Any program designed to do things that the user of
                                   the program did not intend to do, or that disguise
                                   its harmful intent. A program that installs itself
                                   while the user is making an authorized entry; and,
                                   then is used to break-in and exploits the system.

  **Unfriendly Termination**       The removal of an employee under involuntary or
                                   adverse conditions. This may include termination
                                   for cause, RIF, involuntary transfer, resignation
                                   for "personality conflicts," and situations with
                                   pending grievances.

  **User**                         Any person who is granted access privileges to a
                                   given IT.

  **User Interface**               The part of an application that the user works
                                   with. User interfaces can be text-driven, such as
                                   DOS, or graphical, such as Windows.

  []{#virus .anchor}**Virus**      A self-propagating Trojan horse (a program that
                                   surreptitiously exploits the security/integrity of
                                   a program), composed of a mission component, a
                                   trigger component, and a self-propagating
                                   component.

  []{#vulnerability                A weakness in automated system security
  .anchor}**Vulnerability**        procedures, technical controls, environmental
                                   controls, administrative controls, internal
                                   controls, etc., that could be used as an entry
                                   point to gain unauthorized access to information
                                   or disrupt critical processing.

  []{#wideareanetwork              A physical or logical network that provides
  .anchor}**Wide Area Network**    capabilities for a number of independent devices
                                   to communicate with each other over a common
                                   transmission-interconnected topology in geographic
                                   areas larger than those served by local area
                                   networks.
  -------------------------------- --------------------------------------------------

#  APPENDIX C

## REFERENCES

> Computer Security Act of 1987 (PL 100-235)
>
> OMB Circular A-123, Internal Control Systems
>
> OMB Circular A-130, Management of Federal Information Resources,
> Appendix III, "Security of Federal Information Technologies"
>
> Privacy Act of 1974 (PL-93-579) and Amendments
>
> NIST SP 800-12, An Introduction to Computer Security; The NIST
> Handbook
>
> NIST SP 800-14, Generally Accepted Principals and Practices for
> Securing Information Technology Systems
>
> NIST SP 800-18, Guide for Developing Security Plans for Information
> Technology Systems.
>
> Federal Information Processing Standards (FIPS) Publication 102,
> Guideline for Computer Security Certification and Accreditation
>
> Agency Directive XXX, Information Technology Systems Security
>
> Agency Handbooks for IT Security Management and Control