# Presentation: 411139

## NLRB: Information Security & FISMA

*Daniel Wood, Chief IT Security*

*February 19, 2004*

**Notes:**

Information Security is a key office in the spot light of late. Normally headed by a Chief Information Security Officer, also known as the Senior Agency’s Information Security Officer (SAISO), this office is required to report on the Federal Information Security Management Act (FISMA) a subset of the E-Government Act of 2002 instituted to supersede the Government Information Security Reform Act. FISMA’s purpose is to establish security reporting requirements that are measured and reported on a quarterly and annual basis to OMB. Often agency interpret the legislation as Certification and Accreditation focused due to the significant overlap of deliverables. While in fact, FISMA stresses core management principles from a Information Security perspective previously portrayed under IT legislation, such as Clinger Cohen, GPRA, E-government Act and Computer Act of 1984.  The integrity of an agency’s FISMA reports are now be called into question. The lack of a consistent voice, of a mature EA, and of effective, documented performance measures supports this. How can an agency C&A 100% of systems when OIGs and Department’s can not agree on a system definition much less a single inventory?

Simplified--the theme is performance-based risk management integrated with the agency’s core functions. FISMA attempts to force an agency to manage risk to department information through security processes integrated into established money, people, and technology processes. 

Purpose of this presentation is to provide:
Brief understanding of CIO responsibilities and their relationships
Overview of FISMA (Origin and Purpose)
Understanding of key roles and responsibilities
Discuss at a high-level key security program areas

## CIO Centers of Influence

**CIO Centers of Influence**

***CIO Council***
***Clinger-Cohen ***

***OMB A-130***

***IS Segment***

***OMB A-130***
***Clinger-Cohen***
***FFMIA***
***E-Authentication ***
***FMFIA***
***PDD 63 & 67***
***Hsps-7***

**Replaces security elements of Computer Act of 1987, GPRA  and GISRA*

***OMB A-11***
***NIST***

**FISMA***
**PMA**

**Notes:**
An Integrated Approach: The CIO has 3 main centers of power to manage information within their agency.  OMB is pushing towards CIO success through integration.  This diagram can be applied on several plains.  

From an agency view: 
EA
The EA team coordinates with Security through the IS segment of the EA.  This segment IDs the “as is” architecture, The “to be” architecture and the strategy to get there.  The IS segment provides agency-wide Security coverage (Risk Mgmt) by crossing all layers of the EA (Business, Data, Information, Application and Technical.”  Additionally, the EA provides opportunity for system integration and reduction in redundancies.  It provides the road map for security.

YOU CAN’T SECURE AN ARCHITECTURE, THAT YOU DON’T KNOW. For example, the EA application layer should contain the inventory of systems.  IT is the responsibility of the security program to categorize and identify risk levels to decide on the required rigor.

Info Sec:
Information security can not succeed in a vacuum. It is important to know the business requirements you are supporting, the architecture you are securing and the IT assets and resources you are ensuring. This information is provided through good IT management and a complete EA. An agency’s security and a systems security directly effecting IT funding.  OMB has and will reapportion funds according to agencies security posture.  If agency can not demonstrate through reporting that they practice good cyber security practices ensuring Conf, Avail, and Integ; then OMB will choose not to invest in them with future IT funding.

IT Funding (CPIC- Capital Planning and Investment Controls): 
CPIC plays a key role in developing and presenting businesses cases for IT funding requests that:
Assist and do not deter from objectives outlined in the EA (align with Business Functions and are not redundant)
Practice good Risk Mgmt processes for ID, Mitigation and reporting of risks/vulnerabilities
Have comprehensive security and privacy requirements and costs

Each center MUST integrate and cooperate to succeed!

System View
Each system has requirements throughout it SDLC in each of these centers:
EA: Business Alignment, Portfolio tracking
IT Funding: Business Case to include security and privacy any time money is requested
Security: C&A, annual assessments, POA&Ms

## Big Picture

**Federal Information Security ****Management Act**

**E-Government Act**

**Presidential Management ****Agenda**

- C&A

- CIRT

- SATE

- PM

- Assess-ments

- CIP

- EA (IS)

- Capital Planning

- Patch Mgmt

- System & Program
- POA&Ms

- Asset Inventory

- Security Program

**PMA: **Government should be citizen-centered, results-oriented, and market-based.            1) Strategic management of human capital
-      2) Budget and performance integration
-      3) Competitive sourcing
-      4) Electronic-Government
-      5) Improved financial management
- Effective implementation of E-Government is important in making Government more responsive and cost-effective.

**E-Gov: **To enhance the management and promotion of electronic Government services and processes by establishing a Federal CIO within the OMB, and by establishing a broad framework of measures ... to enhance citizen access to Government information and services....

**FISMA (Title III of E-gov): **
-  A comprehensive framework for ensuring effectiveness of IS controls over information resources
-  Recognize highly networked nature of Federal computing environment
-  Minimum controls required to protect Federal Info Security and Info System Security

**Notes:**
Focusing in on the Information Security center:  It is important to understand where reporting requirements have originated from to fully understand an agency’s response implications.

PMA: 
Outlines Administration Goals at High level
Covers 5 goals and 9 distinct areas
HUD Participates in all 5 and additional in 1 of the nine specific goals “Housing and Urban Development Management and Performance”
Usually follows CFO reporting chain and stops at CIO level
Is sent to OMB
Composed of two areas (Status and Progress)
Status changes once a year after FISMA (Sept)
Progress changes after PMA and CAP quarterly reports

E-gov Act/FISMA:
Federal Information Security Management Act
Guidance: OMB M03-19
Enacted as Title III of the E-government Act of 2002 (Superseding Title X of the Homeland Security Act 2002)
Permanently authorized and strengthened the information security program, evaluation and reporting requirements established by GISRA
Stresses Information Security not just IT Security
Discusses Information Security as a management issue not a technical issue
Applies to Unclassified and National Security Systems 
Covers systems run by contractors for the government (regardless of ownership)
Requires NIST to develop, for systems other than national security systems, minimum information security requirements
Requires each agency to develop, maintain, and annually update an inventory of major information systems (including major national security systems)
Including an identification of the interfaces between each system and all other systems or networks
Specific requirement for agency to test all major systems annually
Requires agency management to annually file FISMA report with OMB
Established March 1st due date for OMB’s report to Congress
Additional reporting requirements (GAO, Congress, Appropriations Committee)

The E-gov section of the PMA scorecard is directly related to Security posture. It is very important that what ever is reported in PMA is known by, if not originated from the SAISO and Security office. Consistency! Variations in reporting are seen as red flags for more scrutiny. 

Legislation not mentioned includes: GPEA-now part of PMA, GPRA – a matter of time before part of PMA, FFMIA/FMFIA – Financial System, CAR

## FISMA Reporting Roles & Responsibilities

- _Head of Agency _

- _CIO _

**FISMA Reporting Roles & Responsibilities**

- _CISO __(Senior Agency Information Security Officer)_

- Ensure integration of security management processes
- Ensure senior officials provide security info for operations & assets
- Ensure personnel are trained in compliance with mandate
- Ensure CIO reports annually on the IS program effectiveness

- Designates Senior Agency Information Security Officer to carry out security responsibilities
- Ensures senior management support
- Reports to Head of Agency on the IS program’s performance

- Heads IS program office with mission and resources to ensure agency compliance with FISMA
- Develops & maintains policy, procedures and techniques to address requirements
- Train & overseas Information Security personnel
- Assist senior agency officials concerning their responsibilities

**Notes:**
FISMA law depicts four levels of responsibility.
Head of Agency
CIO
CISO (SAISO)
Senior agency officials (not pictured but mentioned in CISO responsibilities) Defined by guidance as program managers of major components or bureaus.

## Head of Agency

**Head of Agency**

**Establish goals to improve efficiency & effectiveness of operations through IT**
**Prepare an annual report on the progress in achieving the goals**
**Ensure that IT performance measurements are prescribed for use and how well programs are supported**
**Quantitatively benchmark process performance in terms of cost, speed, productivity, and quality of outputs and outcomes**
**Analyze and revise the mission-related processes before making significant IT investments **
**Ensure that the  info sec policies, procedures, and practices are adequate.**
**Designate of Chief Information Officer**
**In consultation with the CIO and CFO establish policies and procedures that--**
**Ensure the accounting, financial, and asset management systems and other information systems of the executive agency are designed, developed, maintained, and used effectively to provide financial or program performance data for financial statements of the executive agency**
**Ensure that financial and related program performance data are provided on a reliable, consistent, and timely basis to executive agency financial management systems**
**Ensure that financial statements support assessments and revisions of mission-related processes and administrative processes and performance measurements evaluate investments made in information systems**

** Clinger-Cohen*

**Notes:**
Lots of detail direct from Clinger-Cohen

## Chief Information Officer

**Chief Information Officer**

**Provide advice and other assistance to Head of the Agency and other senior management personnel to ensure that ****IT is acquired and information resources are managed in compliance with policies and procedures and agency’s priorities**
**Develop, maintain, and facilitate the implementation of a sound and ****integrated IT architecture**
**Promote the effective and efficient design and operation of all major IRM processes, including improvements to work processes**
**Have IRM duties as that official's primary duty**
**Monitor the performance of IT programs of the agency, ****evaluate**** the ****performance**** of those programs on the basis of performance measurements, and advise the head of agency regarding whether to continue, modify, or terminate a program or project**
**Annually, as part of the strategic planning and performance evaluation process **
**Assess requirements regarding IRM knowledge and skill and the adequacy of such requirements for achieving IRM performance goals**
**Assess the extent to which the positions and personnel meet requirements**
**Develop strategies and specific plans for hiring, training, and professional development**
**Report to head of the agency on progress made in improving IRM capability**
**Designating a senior agency information security officer **

** Clinger-Cohen*

**Notes:**
As seen here in Clinger-Cohen, OMB and congress assume IT has been implemented a performance-based IT program.  This assumption would mean security could easily be integrated. 

## SAISO (aka, Chief of Info Security)

**SAISO (aka, Chief of Info Security)**

**Designated senior agency information security officer shall--**
**Carry out the CIO’s security responsibilities**
**Possess information security professional qualifications, including training and experience**
**Have information security duties as that official's primary duty**
**Head an office with the mission and resources to ensure FISMA compliance**
**Develop and maintain an agency-wide information security program**
**Develop and maintain IS policies, procedures, and controls to address all rqmts**
**Train and oversee personnel with significant IS responsibilities **
**Assist senior agency officials concerning their responsibilities**

** FISMA – E-gov Act 2002*

**Notes:**
In order for the SAISO to succeed they must be entrusted with the appropriate amount of responsibility, authority, and resources to accomplish the agency’s goals. 

## Organizing Roles

**Organizing Roles**

**Notes:**
Examples of how to organize. This is each agencies prerogative. 

## Comprehensive Security ProgramThrough Performance-based Risk Management

**Hardware & Software**

**Patch Management***

**Change Control Board**

**Standards, Baselines & Config***

**Security within System Integration**

**Security within System Lifecycle Management***

**Program, System &**

**Contractor Assessments***

**Privacy Impact Analysis**

**C&A Process Management***

**Risk Management***

**Document Management***

**Policy Management & Integration***

**Security Roles & Responsibilities***

**Congressional Reporting***

**Performance Measurements***

**Sec within CPIC (Funding)***

**ISSO Management***

**Contractor Compliance***

**Computer Incident Response Capability***

**Sec Awareness, Training, & Education***

**Critical Infrastructure Protection***

**Security Response (COOP)***

**Network Security**

**Physical Security (IT)***

**Audit Controls**

**Comprehensive Security Program***Through Performance-based Risk Management*

**IS Program**
**Management****(Strategic)**

**Information Security Operations**

**Policy & Compliance Mgmt**

**System Integration, Configuration, & Lifecycle Mgmt**

**Vulnerability, Certification & Accreditation Mgmt**

**IS Program Mgmt: **Risk Mgmt Strategy, Program Mgmt Plan, Sec Architecture

**** Annotates FISMA Areas***

**Notes:**
A comprehensive Security Program is composed of at least these four areas.  These areas group a program’s functionality at a high level. Each agency may interpret, organize or customize these areas as they see fit. 

Policy & Compliance Mgmt: Documented and enforced! CIO needs the ability to enforce through strict rules and consequences
(example: systems not applying patches as specified receive X# of warnings and then are unplugged from network; programs not performing as required are not funded.)

C&A Mgmt: A living process that is integrated into the agency’s SDLC and on-going monitoring – Not just a paper drill! Vulnerability management is included here because it is a part of C&A. However, vulnerability management also includes weaknesses derived from programs, personnel and hard copy materials—not just systems.

Conf, & LC Mgmt: Strong configuration management with triggers and performance measures/milestones integrated into a SDLC.  Vulnerability Identification and mitigation through LC and watched with CM.

Information Security Operations: These operations are security services provide to the agency. 

Program Management: Security needs to be integrated into the agency wide activities, Sec Programs need a 5 year plan approved, distributed, and used, and Performance Measures need to be tracked across the agency from the head to the user with awareness at all levels of management. 

An integrated, comprehensive Security Program impacts the agency’s ability to perform, fund and report its mission.