Spreadsheet: 36584e8a-a314-464a-b520-fe0a49cf70e1
Sheet: Ohio SPR

Section # | Publication 1075 Requirement | Agency [NAME] | Additional Information Needed to be Submitted by Agency
 | Reference pages 38-40, Section                                                  7.2 Safeguard Procedures Report |  | Additional information requested in red must be submitted within 30 calendar days, Information in blue must be submitted with next SAR
1. Responsible Officer(s)
1.1 | Provide the name, title, address, email address and telephone number of the agency official, including but limited to: agency director or commissioner authorized to request FTI from the OAG.
1.2 | Provide the name, title, address, email address and telephone number of the agency official responsible for implementing the safeguard procedures, including but not limited to the agency information technology security office or equivalent and the primary OAG contact.
2. Location of the Data
2.1 | Provide an organizational chart or narrative description of the receiving agency, which includes all functions within the agency where FTI will be received, processed, stored and/or maintained.  If the information is to be used or processed by more than one function, then the pertinent information must be included for each function.
 | Attachments:  Organization chart (recommended)
3. Flow of the Data
3.1 | Provide a flow chart or narrative describing:
 | ·     the flow of FTI through the agency from its receipt through its return to the IRS or its destruction
 | ·     how it is used or processed
 | ·     how it is protected along the way
3.2 | Describe whether FTI is commingled with agency data or separated.
 | ·     If FTI is commingled with agency data, please describe how the data is labeled and tracked.
 | ·     If FTI is separated from all other agency data, please describe the steps that have been taken to keep it in isolation.
3.3 | Provide a list of the FTI extracts the agency receives and whether the data is received through electronic or non-electronic methods.
3.4 | Describe the paper or electronic products created from FTI (e.g. letters, agency reports, data transcribed, spreadsheets, electronic database query results).
3.5 | Describe where contractors are involved in the flow of FTI including, but not limited to, data processing, disposal, analysis, modeling, maintenance, etc.
3.6 | Describe the following for each contractor:
 | ·     Name of each Contractor
 | ·     Contractor Work Location (Address)
 | ·     Support contractor provides for the agency
 | ·     [NAME] the FTI the contractor has access to (data files, data elements, systems, applications)
 | ·     State whether or not contractor's employees have completed required disclosure awareness training and signed confidentiality agreements.  If not, explain
 | ·     State whether or not the legal contract between the agency and the contractor includes the Publication 1075, Exhibit 7 language.  If not, explain
 | ·     State whether or not any FTI is provided to contractors or contractor information systems off-shore.  If yes, explain.
 | ·     If IT support is provided by a state run data center, state whether or not there an SLA in place between the agency and the data center operations.  If not, explain
4. System of Records
4.1 | Describe the permanent record(s) (logs) used to document requests for, receipt of, distribution of (if applicable), and disposition (return to IRS or destruction) of the FTI (including tapes or cartridges or other removable media) (e.g. FTI receipt logs, transmission logs, or destruction logs in electronic or paper format.)  Please include a sample of the agency logs.
 | Attachments:  Sample agency logs (recommended)
5. Secure Storage of the Data
5.1 | Describe how the agency meets minimum protection standards (including compliance with two barriers between FTI and someone unauthorized to access FTI). Include a description of how the agency controls physical access to FTI, controls access to computer facilities, offsite storage, and interior work environments.
5.2 | Describe the policies and procedures in place for protecting the facilities or rooms containing or accessing FTI.
 | ·     Describe how the agency maintains key records (e.g. key issuance, how many keys are available)
 | ·     Describe how the agency regularly conducts periodic reconciliation on all key records
5.3 | Describe the policies and procedures in place for meeting minimum protection standards for alternative work sites (e.g. employee’s homes or other non-traditional work sites).
6. Restricting Access to the Data
6.1 | Describe the procedures taken to ensure that access to FTI is restricted to those that have a “need to know”.  This includes a description of:
 | ·     How the information will be protected from unauthorized access when in use by the authorized recipient
 | ·     Systemic or procedural barriers
6.2 | Describe any existing agreements created under the authority of IRC 6103 (p) (2) (B), if applicable.  [NAME] the agency to whom your agency is providing the data to and the type of data received. | Under no circumstance shall any Third Party Collections Firm or Special Counsel enter into a redisclosure agreement of FTI under section 6103 of the IRC.
7. Other Safeguards
7.1 | Describe the agency’s process for conducting internal inspections of headquarters, field offices, data center, offsite storage, and contractor sites.
 | Attachments:  Internal Inspections Plan (recommended)
7.2 | Describe the process for detecting and monitoring deficiencies identified during audits and internal inspections and how they are tracked in a Plan of Actions and Milestones (POA&M).
8. Disposal
8.1 | Describe the method(s) of FTI disposal (when not returned to the IRS) and a sample of the destruction log.  For example, burning and shredding are acceptable methods of FTI disposal.  [NAME] the specific
 | If FTI is returned to the IRS, provide a description of the procedures.
 | Attachments:  Destruction Log Template (recommended)
9. Information Technology (IT) Security
9.1.1 | Provide the name and address where the agency’s IT equipment resides (e.g. data center, computer room).
9.1.2 | Describe the following pertaining to data center or computer room operations:
 | ·     [NAME] if the facility is operated by a consolidated state-wide data center, a private contractor, or entirely by the agency
 | ·     Describe other state agencies and/or departments that have access to this facility
 | ·     Describe whether FTI access is granted to other agencies or tribes
9.1.3 | Provide the name, title, address, telephone number, and e-mail address of the IT Security Administrator or other IT contact responsible for administering the equipment.
9.1.4 | Provide a brief description of the electronic flow of FTI within all IT equipment and network devices that process, receive, store, transmit and/or maintain the data.
9.1.5 | Provide an inventory of all IT equipment and network devices that process, receive, store, transmit and/or maintain the data (e.g. routers, switches, firewalls, servers, mainframes, and workstations).
 | For each device, identify the following:
 | ·     [NAME] (e.g. [NAME], Windows, Unix/Linux, [NAME], [NAME], Firewall)
 | o   If mainframe, number of production LPARs with FTI, security software (e.g. RACF, [NAME])
 | o   If not mainframe, number of production servers or workstations that store or access FTI.
 | ·     Operating System (e.g. zOS v1.7, Windows 2008, Solaris 10, IOS)
 | ·     Application Software (Commercial Off The Shelf or custom) used to access FTI
 | ·     Software used to retrieve FTI (e.g. SDT (Tumbleweed), CyberFusion, Connect:Direct)
9.2 | Management Security Controls:  Risk Assessment Control Family
9.2.1 | Describe how the agency develops, documents, disseminates, and updates, as necessary, risk assessment policy and procedures to facilitate implementing risk assessment controls.  Such risk assessment controls include risk assessments and risk assessment updates.
9.2.2 | Describe how agencies conduct assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency regarding the use of FTI. Describe how the agency updates the risk assessment periodically or whenever there are significant changes to the information system, the facilities where the system resides, or other conditions that may impact the security or accreditation status of the system.
9.2.3 | Describe how the agency scans systems containing FTI, at a minimum, quarterly to identify vulnerabilities in the information system. Describe how the agency’s vulnerability scanning tool(s) must be updated with the most current definitions prior to conducting a vulnerability scan.
9.3 | Management Security Controls:  Security Planning Control Family
9.3.1 | Describe how the agency develops, documents, disseminates, and updates, as necessary, security planning policy and procedures to facilitate implementing security planning controls.  Such security planning controls include system security plans, system security plan updates and rules of behavior.
9.3.2 | Describe how the agency develops, documents, and establishes a system security plan (see Publication 1075 Section 7.2, Safeguard Procedures Report) by describing the security requirements, current controls and planned controls, for protecting agency information systems and federal tax information (FTI).   [NAME] how the agency’s system security plan is updated to account for significant changes (see Publication 1075 Section 7.4, Annual Safeguard Activity Report) in the security requirements, current controls and planned controls for protecting agency information systems and FTI.
9.3.3 | Describe how the agency develops, documents, and establishes a set of rules identifying their responsibilities and expected behavior for information system use for users of the information system.
9.3.4 | For Federal agencies, describe how the agency conducts a privacy impact assessment on the information system in accordance with OMB policy.
 | Note: This control is only required for Federal agencies.
9.3.5 | Describe how the agency plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation), organizational assets, and individuals.
9.4 | Management Security Controls:  System and Services Acquisition Control Family
9.4.1 | Describe how the agency develops, documents, disseminates, and updates, as necessary, system and services acquisition policy and procedures to facilitate implementing system and services acquisition controls.  Such system and services acquisition controls include information system documentation and outsourced information system services.  [NAME] how the agency ensures that there is sufficient information system documentation, such as a Security Features Guide.  Also, describe how the agency ensures third-party providers of information systems, who are used to process, store and transmit FTI, employ security controls consistent with Safeguard computer security requirements.
9.4.2 | Describe how the agency documents, and allocates as part of its capital planning and investment control process, the resources required to adequately protect the information system.
9.4.3 | Describe how the agency manages the information system using a system development life cycle methodology that includes information security considerations, whenever information systems contain FTI.
9.4.4 | Describe how the agency includes security requirements and/or security specifications, either explicitly or by reference, in information system acquisition contracts based on an assessment of risk, whenever information systems contain FTI.  Ensure the description acknowledges that the contract for the acquisition must contain IRS Publication 1075 Exhibit 7 language as appropriate.
9.4.5 | Describe how the agency obtains, protects as required, and makes available to authorized personnel, adequate documentation for the information systems, whenever information systems contain FTI.
9.4.6 | Describe how the agency complies with software usage restrictions, whenever information systems contain FTI.
9.4.7 | Describe how the agency enforces explicit rules governing the installation of software by users, whenever information systems contain FTI.
9.4.8 | Describe how the agency designs and implements the information system using security engineering principles, whenever information systems contain FTI.
9.4.9 | Describe how the agency performs configuration management during information system design, development, implementation, and operation; and manages and controls changes to the information system. Describe how the agency implements only agency-approved changes, documents approved changes to the information system(s) and tracks security flaws and flaw resolution.
9.4.10 | Describe how agency information system developers create a security test and evaluation (ST&E) plan, implement the plan, and document the results.
9.5 | Management Security Controls:  Security Assessment and Authorization Control Family
9.5.1 | Describe how the agency develops and updates a policy that addresses the processes used to test, validate, and authorize the security controls used to protect FTI.  While state and local agencies are not required to conduct a NIST compliant certification & accreditation (C&A), the agency shall accredit in writing that the security controls have been adequately implemented to protect FTI.  [NAME] how the agency institutes a written accreditation process, constituting the agency’s acceptance of the security controls and associated risks.
9.5.2 | Describe how the agency conducts, periodically but at least annually, an assessment of the security controls in the information system to ensure the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. This assessment shall complement the certification process to ensure that periodically the controls are validated as being operational.  The assessment must be documented in writing.
9.5.3 | Describe how the agency authorizes and documents all connections from the information system to other information systems outside of the accreditation boundary through the use of system connection agreements and monitors/controls the system connections on an ongoing basis.  [NAME] how the agency conducts a formal assessment of the security controls in the information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.
9.5.4 | Describe how the agency develops and updates a Plan of Action & Milestones (POA&M) that identifies any deficiencies related to FTI processing.  Describe how the POA&M identifies planned, implemented, and evaluated remedial actions to correct deficiencies noted during internal inspections.  Also, ensure to address the Corrective Actions Plan (CAP) that identifies activities planned or completed to correct deficiencies identified during the on-site safeguard review. Both the POA&M and the CAP shall address implementation of security controls to reduce or eliminate known vulnerabilities in the system.
9.5.5 | Describe how owners of FTI accredit the security controls used to protect FTI before initiating operations.  This shall be done for any infrastructure associated with FTI.  The authorization shall occur every three (3) years or whenever there is a significant change to the control structure.  A senior agency official shall sign and approve the security authorization.  All information regarding the authorization shall be provided to the Office of Safeguards as part of the Safeguard Activity Report.
9.5.6 | Describe how the agency periodically, at least annually, monitors the security controls within the information system hosting FTI to ensure that the controls are operating, as intended.
9.6 | Operational Security Controls:  Personnel Security Control Family
9.6.1 | Describe how the agency develops, documents, disseminates, and updates as necessary, personnel security policy and procedures to facilitate implementing personnel security controls.  Such personnel security controls include position categorization, personnel screening, personnel termination, personnel transfer, and access agreements.
9.6.2 | Describe how the agency assigns risk designations to all positions and establish screening criteria for individuals filling those positions.
9.6.3 | Describe how individuals are screened before authorizing access to information systems and information.
9.6.4 | Describe how the agency terminates information system access, conduct exit interviews, and ensures return of all information system-related property when employment is terminated.
9.6.5 | Describe how the agency reviews information system access authorizations and initiates appropriate actions when personnel are reassigned or transferred to other positions within the agency.
9.6.6 | Describe how appropriate access agreements are completed before authorizing access to users requiring access to the information system and FTI.
9.6.7 | Describe how personnel security requirements are established for third-party providers and monitored for provider compliance.
9.6.8 | Describe how the agency establishes a formal sanctions process for personnel who fail to comply with established information security policies, as this relates to FTI.
9.7 | Operational Security Controls:  Contingency Planning Control Family
9.7.1 | Describe how the agency develops applicable contingencies for ensuring that FTI is available, based upon their individual risk-based approaches.
 | If FTI is included in contingency planning; policy and procedures must be developed, documented, disseminated, and updated as necessary to facilitate implementing contingency planning security controls.
9.7.2 | For Federal agencies, describe how personnel are trained in their contingency roles and responsibilities with respect to the information system and provide refresher training at least annually.
 | Note: This control is only required for Federal agencies.
9.7.3 | Describe how the agency periodically tests contingency plans to ensure procedures and staff personnel are able to provide recovery capabilities within established timeframes.  Such contingency planning security controls include alternate storage sites, alternate processing sites, telecommunications services, and information system and information backups.
9.7.4 | Describe how the agency identifies alternate storage sites and initiates necessary agreements to permit the secure storage of information system and FTI backups.
9.7.5 | Describe how the agency identifies alternate processing sites and/or telecommunications capabilities, and initiates necessary agreements to facilitate secure resumption of information systems used to process, store and transmit FTI if the primary processing site and/or primary telecommunications capabilities become unavailable.
9.8 | Operational Security Controls:  Configuration Management Control Family
9.8.1 | Describe how the agency develops, documents, disseminates, and updates as needed, configuration management policy and procedures to facilitate implementing configuration management security controls.
9.8.2 | Describe how the agency develops, documents, and maintains a current baseline configuration of the information system.
9.8.3 | Describe how the agency authorizes, documents, and controls changes to the information system.
9.8.4 | Describe how the agency analyzes changes to the information system to determine potential security impacts prior to change implementation.
9.8.5 | Describe how the agency approves individual access privileges and enforces physical and logical access restrictions associated with changes to the information system and generates, retains, and reviews records reflecting all such changes.
9.8.6 | Describe how the agency establishes mandatory configuration settings for information technology products employed within the information system, which (i) configures the security settings of information technology products to the most restrictive mode consistent with operational requirement; (ii) documents the configuration settings; and (iii) enforces the configuration settings in all components of the information system.
 | Note: IRS Office of Safeguards requires mandatory system configuration settings identified in Computer Security Evaluation Matrices (SCSEM).  These tools are available on IRS.gov, keyword “Safeguards Program”.
9.8.7 | Describe how the agency implements the following least functionality requirements:
 | ·     Describe how the agency restricts access for change, configuration settings, and provides the least functionality necessary.
 | ·     Describe how the agency enforces access restrictions associated with changes to the information system.
 | ·     Describe how the agency configures the security settings of information technology products to the most restrictive mode consistent with information system operational requirements. (For additional guidance see NIST SP 800-70 Security Configuration Checklists Program for IT Products- Guidance for Checklists Users and Developers)
 | ·     Describe how the agency configures the information system to provide only essential capabilities.
 | ·     Describe how the agency identifies and prohibits the use of functions, ports, protocols, and services not required to perform essential capabilities for receiving, processing, storing, or transmitting FTI.
9.8.8 | Describe how the agency develops, documents, and maintains a current inventory of the components of the information system and relevant ownership information.
9.9 | Operational Security Controls:  Maintenance Control Family
9.9.1 | Describe how the agency develops, documents, disseminates, and updates, as necessary, maintenance policy and procedures to facilitate implementing maintenance security controls. Such maintenance security controls include identifying and monitoring a list of maintenance tools and remote maintenance tools.
9.9.1 | Describe how the agency ensures that maintenance is scheduled, performed, and documented. Describe how the agency reviews records of routine preventative and regular maintenance (including repairs) on the components of the information system in accordance with manufacturer or vendor specifications and/or organizational requirements.
9.9.3 | Describe how the agency approves, controls, and routinely monitors the use of information system maintenance tools and remotely-executed maintenance and diagnostic activities.
9.9.4 | Describe how the agency allows only authorized personnel to perform maintenance on the information system.
9.1 | Operational Security Controls:  System and Information Integrity Control Family
9.10.1 | Describe how the agency develops, documents, disseminates and updates, as necessary, system and information integrity policy and procedures to facilitate implementing system and information integrity security controls.  Such system and information integrity security controls include flaw remediation, information system monitoring, information input restrictions, and information output handling and retention.
9.10.2 | Describe how the agency identifies, reports, and corrects information system flaws.
9.10.3 | Describe how the agency’s information systems implement protection against malicious code (e.g., viruses, worms, [NAME] horses) that, to the extent possible, includes a capability for automatic updates.
9.10.4 | Describe how the agency’s intrusion detection tools and techniques are employed to monitor system events, detect attacks, and identify unauthorized use of the information system and FTI.
9.10.5 | Describe how the agency receives and reviews information system security alerts/advisories on a regular basis, issues alerts/advisories to appropriate personnel, and takes appropriate actions in response.
9.10.6 | Describe how the agency restricts information system input to authorized personnel (or processes acting on behalf of such personnel) responsible for receiving, processing, storing, or transmitting FTI.
9.10.7 | Describe how the agency handles and retains output from the information system, as necessary to document that specific actions have been taken.
9.11 | Operational Security Controls:  Incident Response Control Family
9.11.1 | Describe how the agency develops, documents, disseminates, and updates as necessary incident response policy and procedures to facilitate the implementing incident response security controls.  These policies and procedures must cover both physical and information system security relative to the protection of FTI. Such incident response security controls include incident response training and incident reporting and monitoring.
9.11.2 | Describe how the agency trains personnel with access to FTI, including contractors and consolidated data center employees if applicable, in their incident response roles on the information system and FTI.  Incident response training must provide individuals with an understanding of incident handling capabilities for security events, including preparation, detection and analysis, containment, eradication, and recovery.
9.11.3 | Describe how the agency tests and/or exercises the incident response capability for the information system at least annually to determine the incident response effectiveness and document the results.
9.11.4 | Describe how the agency routinely tracks and documents all physical and information system security incidents potentially affecting the confidentiality of FTI.
9.11.5 | Describe the agency’s policy to immediately report incident information any time there is a compromise to FTI to the appropriate Agent-in-Charge, TIGTA and the IRS following the requirements of Publication 1075, Section 10.
9.11.6 | Describe how the agency provides an incident response support resource (e.g. help desk) that offers advice and assistance to users of the FTI and any information system containing FTI for the handling and reporting of security incidents.  Describe how the support resource is an integral part of the agency’s incident response capability.
9.12 | Operational Security Controls:  Security Awareness and Training Control Family
9.12.1 | Describe how the agency develops, documents, disseminates, and updates as necessary, awareness and training policy and procedures to facilitate implementing awareness and training security controls.  Such awareness and training security controls include security awareness and security training.
9.12.2 | Describe how the agency ensures all information system users and managers are knowledgeable of security awareness material before authorizing access to the system.
9.12.3 | Describe how the agency identifies personnel with significant information system security roles and responsibilities, documents those roles and responsibilities, and provides sufficient security training before authorizing access to the information system and FTI.
9.12.4 | Describe how the agency documents and monitors individual information system security training activities including basic security awareness training and specific information system security training.
9.13 | Operational Security Controls:  Media Access Protection Control Family
9.13.1 | Describe how the agency develops, documents, disseminates, and updates as necessary, media access policy and procedures to facilitate implementing media protection policy. Policies shall address the purpose, scope, responsibilities, and management commitment to implement associated controls.
9.13.2 | Describe how the agency restricts access to information system media to authorized individuals, where this media contains FTI.
9.13.3 | Describe how the agency labels removable media (CDs, magnetic tapes, external hard drives, flash/thumb drives, DVDs) and information system output containing FTI (reports, documents, data files, back-up tapes) indicating “FTI”. Notice 129-A and Notice 129-B can be used for this purpose.
9.13.4 | Describe how the agency physically controls and securely stores information system media within controlled areas, where this media contains FTI.
9.13.5 | Describe how the agency protects and controls information system media during transport outside of controlled areas and restricts the activities associated with transport of such media to authorized personnel.
 | Describe the agency’s use of transmittals or equivalent tracking method to ensure FTI reaches its intended destination.
9.13.6 | Describe how the agency sanitizes information system media prior to disposal or release for reuse.
9.14 | Technical Security Controls:  Identification and Authentication Control Family
9.14.1 | Describe how the agency develops, documents, disseminates, and updates, as necessary, identification and authentication policy and procedures to facilitate implementing identification and authentication security controls.
9.14.2 | Describe how the agency’s information system(s) must be configured to uniquely identify users, devices, and processes via the assignment of unique user accounts and validates users (or processes acting on behalf of users) using standard authentication methods such as passwords, tokens, smart cards, or biometrics.
9.14.3 | Describe how the agency manages user accounts assigned to the information system.  Examples of effective user-account management practices include (i) obtaining authorization from appropriate officials to issue user accounts to intended individuals; (ii) disabling user accounts timely; (iii) archiving inactive or terminated user accounts; and (iv) developing and implementing standard operating procedures for validating system users who request reinstatement of user account privileges suspended or revoked by the information system.
9.14.4 | Describe how the agency’s information system(s) obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
9.14.5 | Whenever agencies are employing cryptographic modules, describe how the agency works to ensure these modules are compliant with NIST guidance, including FIPS 140-2 compliance.
9.15 | Technical Security Controls:  Access Control Family
9.15.1 | Describe how the agency develops, documents, disseminates, and updates, as necessary, access control policy and procedures to facilitate implementing access control security controls.  Security controls include account management, access enforcement, limiting access to those with a need-to-know, information-flow enforcement, separation of duties, least privilege, unsuccessful login attempts, system use notification, session locks, session termination, and remote access.
9.15.2 | Describe how the agency manages information system user accounts, including establishing, activating, changing, reviewing, disabling, and removing user accounts.
9.15.3 | Describe how the agency’s information system(s) enforce assigned authorizations for controlling system access and the flow of information within the system and between interconnected systems.
9.15.4 | Describe how the agency ensures that only authorized employees or contractors (if allowed by statute) of the agency receiving the information has access to FTI. For example, human services agencies may not have access to FTI provided to child support enforcement agencies or state revenue agencies.
9.15.5 | Describe how agency information system(s) enforce the most restrictive access capabilities users need (or processes acting on behalf of users) to perform specified tasks.
9.15.6 | Describe how agency information system(s) limit the number of consecutive unsuccessful access attempts allowed in a specified period and automatically perform a specific function (e.g., account lockout, delayed logon) when the maximum number of attempts is exceeded.
9.15.7 | Describe how the agency’s information system(s) display an approved system usage notification or warning banner before granting system access informing potential users that -
 | (i)     The system contains U.S. Government information
 | (ii)    Users actions are monitored and audited
 | (iii)   Unauthorized use of the system is prohibited
 | (iv)   Unauthorized use of the system is subject to criminal and civil sanctions. The warning banner must be applied at the application, database, operating system and network device level for all system types that receive, store, process and transmit FTI. (See Publication 1075, Exhibit 13 for example warning banners).
 | Describe how the policy is enforced so that a workstation and/or application are locked after a pre-defined period. This will ensure that unauthorized staff or staff without a need-to-know cannot access FTI.
 | Attachments:  Sample warning banner in use (required)
9.15.8 | Describe how the agency identifies and documents specific user actions that can be performed on the information system without identification or authentication.
9.15.9 | Describe how the agency authorizes, documents, and monitors all remote access capabilities used on the system, where these systems containing FTI.
9.15.10 | Describe how the agency develops policies for any allowed wireless access, where these systems contain FTI. As part of the wireless access, the agency shall authorize, document, and monitor all wireless access to the information system.
9.15.11 | Describe how the agency develops policies for any allowed portable and mobile devices, where these systems contain FTI. As part of this, the agency shall authorize, document, and monitor all device access to organizational information systems accessing FTI.
9.15.12 | Describe how the agency develops policies for authorized individuals to access the information systems from an external system, such as access allowed from an alternate work site. Describe how the agency’s policy addresses the authorizations allowed to receive, transmit, store, and/or process FTI. As part of this, describe how the agency authorizes, documents, and monitors all access to organizational information systems, where these systems contain FTI.
9.16 | Technical Security Controls:  Audit and Accountability Control Family
9.16.1 | Describe how the agency develops, documents, disseminates, and updates as necessary, audit and accountability policy and procedures to facilitate implementing audit and accountability security controls. Such audit and accountability security controls include auditable events; content of audit records; audit storage capacity; audit processing; audit review, analysis and reporting; time stamps; protecting audit information and audit retention.
9.16.2 | Describe how the agency’s information system(s) generate audit records for all security-relevant events, including all security and system administrator accesses. An example of an audit activity is reviewing the administrator actions whenever security or system controls may be modified to ensure that all actions are authorized.
9.16.3 | Describe how the agency’s identified security-relevant events enable the detection of unauthorized access to FTI data. System and/or security administrator processes will include all authentication processes to access the system, for both operating system and application-level events. Describe how audit logs enable tracking of activities to take place on the system.
9.16.4 | Describe how the agency configures the information system to allocate sufficient audit record storage capacity to record all necessary auditable items.
9.16.5 | Describe how the agency’s information system(s) alert appropriate organizational officials in the event of an audit processing failure and take additional actions.
9.16.6 | Describe how the agency routinely reviews audit records for indications of unusual activities, suspicious activities or suspected violations, and report findings to appropriate officials for prompt resolution.
9.16.7 | Describe how the agency’s information system(s) provide an audit reduction and report generation capability to enable review of audit records.
9.16.8 | Describe how the agency’s information system(s) provide date and time stamps for use in audit record generation.
9.16.9 | Describe how the agency’s information system(s) protect audit information and audit tools from unauthorized access, modification, and deletion.
9.16.10 | Describe how the agency ensures that audit information is archived for six years to enable the recreation of computer-related accesses to both the operating system and to the application wherever FTI is stored.
9.17 | Technical Security Controls:  System and Communications Protection Control Family
9.17.1 | Describe how the agency develops, documents, disseminates and updates as necessary, system and communications policy and procedures to facilitate implementing effective system and communications.
9.17.2 | Describe how the agency’s information system(s) separate front end interfaces from the back end processing and data storage.
9.17.3 | Describe how the agency’s information system(s) prevent unauthorized and unintended information transfer via shared system resources.
9.17.4 | Describe how the agency’s information system(s) are configured to monitor and control communications at the external boundary of the information system and at key internal boundaries within the system.
9.17.5 | Describe how the agency’s information system(s) protect the confidentiality of FTI during electronic transmission.
9.17.6 | Whenever there is a network connection, describe how the agency’s information system(s) terminate network connections at the end of a session or after no more than fifteen minutes of inactivity.
9.17.7 | Whenever Public Key Infrastructure (PKI) is used, describe how the agency establishes and manages cryptographic keys using automated mechanisms with supporting procedures or manual procedures.
9.17.8 | Whenever cryptography (encryption) is employed, describe how the agency’s information system(s) perform all cryptographic operations using Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules with approved modes of operation. Cryptographic data transmissions are ciphered and consequently unreadable until deciphered by the recipient.
9.17.9 | Describe how the agency’s information system(s) prohibit remote activation of collaborative computing mechanisms without explicit indication of use to the local users. Collaborative mechanisms include cameras and microphones that may be attached to the information system. Users must be notified if there are collaborative devices connected to the system.
9.17.10 | Whenever Public Key Infrastructure (PKI) is used, describe how the agency establishes PKI policies and practices.
9.17.11 | Describe how the agency establishes usage restrictions and implementation guidance for mobile code technologies based on the potential to cause damage to the information system if used maliciously. All mobile code must be authorized by the agency official.
9.17.12 | Describe how the agency establishes, documents, and controls usage restrictions and implementation guidance for Voice over Internet Protocol ([NAME]) technologies.
9.17.13 | Describe how the agency’s information system(s) provide mechanisms to protect the authenticity of communications sessions.
9.17.14 | For Federal agencies, describe how information system components reside in separate physical domains (or environments) as deemed necessary.
 | Note: This control is only required for Federal agencies.
9.18 | Additional Information Technology Controls – Data Warehouse Environment
9.18.1 | Describe how the agency implements a risk management program to ensure each aspect of the data warehouse is assessed for risk.  [NAME] how the agency’s risk documents identify and document all vulnerabilities, associated with the data warehousing environment.
9.18.2 | Planning is crucial to the development of a new environment.  Describe the agency’s implementation of a security plan to address organizational policies, security testing, rules of behavior, contingency plans, architecture/network diagrams, and requirements for security reviews. While the plan will provide planning guidelines, this will not replace requirements documents, which contain specific details and procedures for security operations.
 | Policies and procedures are required to define how activities and day-to-day procedures will occur. This will contain the specific policies, relevant for all of the security disciplines covered in this document. As this relates to data warehousing, any data warehousing documents can be integrated into overall security procedures. A section shall be dedicated to data warehouses to define the controls specific to that environment.
 | Describe how the agency implements policies and procedures to document all existing business processes. The agency must ensure that roles are identified for the organization and develop responsibilities for the roles.
 | Within the security planning and policies, the purpose or function of the warehouse shall be defined. The business process shall include a detailed definition of configurations and the functions of the hardware and software involved.  In general, the planning shall define any unique issues related to data warehousing.
 | The agency must define how “legacy system data” will be brought into the data warehouse and how the legacy data that is FTI will be cleansed for the ETL transformation process.
 | The policy shall ensure that FTI will not be subject to public disclosure.  Only authorized users with a demonstrated “need to know” can query FTI data within the data warehouse.
9.18.3 | Acquisition security needs to be explored. As FTI is used within data warehousing environments, describe how services and acquisitions have adequate security in place, including blocking information to contractors, where these contractors are not authorized to access FTI.
9.18.4 | Certification, accreditation, and security and risk assessments are accepted best practices used to ensure that appropriate levels of control exist, are being managed and are compliant with all federal and state laws or statutes.
 | Describe how the agency implements a process or policy to ensure that data warehousing security meets the baseline security requirements defined in the current revision of NIST SP 800-53.  The process or policy must contain the methodology being used by the state or local agency to inform management, define accountability and address known security vulnerabilities.
 | Risk assessments must follow the guidelines provided in NIST Publication 800-30 Risk Management Guide for Information Technology Systems.
9.18.5 | Describe personnel security controls for the data warehouse environment.  Personnel clearances may vary from agency to agency. As a rule, personnel with access to FTI shall have a completed background investigation. In addition, when a staff member has administrator access to access the entire set of FTI records, additional background checks may be determined necessary.  All staff interacting with DW and DM resources are subject to background investigations in order to ensure their trustworthiness, suitability and work role need-to-know. Access to these resources must be authorized by operational supervisors, granted by the resource owners, and audited by internal security auditors.
9.18.6 | There are no additional physical security controls for a data warehousing environment. However, describe the physical security requirements throughout Publication1075 which do apply to the physical space hosting the data warehouse hardware.
9.18.7 | On line data resources shall be provided adequate tools for the back-up, storage, restoration, and validation of data. Agencies will ensure the data being provided is reliable.
 | Both incremental and special purpose data back-up procedures are required, combined with off-site storage protections and regular test-status restoration to validate disaster recovery and business process continuity. Standards and guidelines for these processes are bound by agency policy, and are tested and verified.
 | Describe the content of the agency’s contingency plan.  Ensure that the data warehouse is addressed to allow for restoration/recreation of data to take place.
9.18.8 | During the life cycle of the DW, on-line and architectural adjustments and changes will occur.  Describe the process for managing these DW configuration changes.  Ensure that the agency documents these changes and assures that FTI is always secured from unauthorized access or disclosure.
9.18.9 | Describe the policy and procedures in place for the cleansing process at the staging area and how the ETL process cleanses FTI when it is extracted, transformed, and loaded.  Additionally, describe the process of object re-use once FTI is replaced from data sets. IRS requires all FTI to be removed by a random overwrite software program.
9.18.10 | Describe the agency’s policy and procedures for incident response as it pertains to the data warehousing environment.
9.18.11 | Describe the agency’s disclosure awareness training program.  Ensure that training addresses how FTI security requirements will be communicated for end users.  Training shall be user specific to ensure all personnel receive appropriate training for a particular job, such as training required for administrators or auditors.
9.18.12 | The agency shall configure the web services to be authenticated before access is granted to users via an authentication server.  The web portal and 2-factor authentication requirements in Publication 1075 Section 9 apply in a data warehouse environment.
 | Business roles and rules shall be imbedded at either the authentication level or application level. In either case, roles must be in place to ensure only authorized personnel have access to FTI information.
 | Describe the identification and authentication policy and procedures as they pertain to the data warehousing environment.  Authentication shall be required both at the operating system level and at the application level, when accessing the data warehousing environment.
9.18.13 | Describe which application programs use FTI and how access to FTI is controlled. The access control to application programs relates to how file shares and directories apply file permissions to ensure only authorized personnel have access to the areas containing FTI.
 | Describe the security controls in place that include preventative measures to keep an attack from being a success.  These security controls shall also include detective measures in place to let the IT staff know there is an attack occurring.  If an interruption of service occurs, the agency shall have additional security controls in place that include recovery measures to restore operations.
 | Within the DW, describe how the agency protects FTI and grants access to FTI as it relates to aspects of a user’s job responsibility.  [NAME] how the agency enforces effective access controls so that end users have access to programs with the least privilege needed to complete the job.  [NAME] how the agency configures access controls in their DW based on personnel clearances.  Access controls in a data warehouse are generally classified as 1) General Users; 2) Limited Access Users; and 3) Unlimited Access Users.  FTI shall always fall into the Limited Access Users category.
 | The database servers that control FTI applications will copy the query request and load it to the remote database to run the application and transform its output to the client.  Therefore, access controls must be done at the authentication server.
 | Web-enabled application software shall:
 | 1.   Prohibit generic meta-characters from being present in input data
 | 2.   Have all database queries constructed with parameterized stored procedures to prevent SQL injection
 | 3.   Protect any variable used in scripts to prevent direct OS commands attacks
 | 4.   Have all comments removed for any code passed to the browser
 | 5.   Not allow users to see any debugging information on the client
 | 6.   Be checked before production deployment to ensure all sample, test and unused files have been removed from the production system
9.18.14 | Describe the agency’s audit and accountability policy and procedures as it pertains to creating and reviewing audit reports for data-warehousing-related access attempts.
9.18.15 | Whenever FTI is located on both production and test environments, these environments will be segregated. This is especially important in the development stages of the data warehouse.  [NAME] how the agency segregates the data warehouse’s production and test environments.
 | Describe how the agency ensures the following:
 | ·      All Internet transmissions should be encrypted using HTTPS protocol utilizing Secure Sockets Layer (SSL) encryption based on a certificate containing a key no less than 128 bits in length, or FIPS 140-2 compliant, whichever is stronger. This will allow information to be protected between the server and the workstation. During the Extract, Transform and Load stages of data entering a warehouse, data is at its highest risk.  Encryption shall occur as soon as possible.  All sessions shall be encrypted and provide end-to-end encryption, i.e., from workstation to point of data.
 | ·      Web server(s) that receive online transactions shall be configured in a “Demilitarized Zone” (DMZ) in order to receive external transmissions but still have some measure of protection against unauthorized intrusion.
 | ·      Application server(s) and database server(s) shall be configured behind the firewalls for optimal security against unauthorized intrusion. Only authenticated applications and users shall be allowed access to these servers.
 | ·      Transaction data shall be “swept” from the web server(s) at frequent intervals consistent with good system performance, and removed to a secured server behind the firewalls, to minimize the risk that these transactions could be destroyed or altered by intrusion.
 | ·      Anti-virus software shall be installed and maintained with current updates on all servers and clients that contain tax data.
 | ·      For critical online resources, redundant systems shall be employed with automatic failover capability.
9.19 | Additional Information Technology Controls – Transmitting FTI
9.19.1 | Describe the policy and procedures in place that address how the agency secures FTI data while in transit.  All FTI data in transit must be encrypted, when moving across a Wide Area Network (WAN) and within the agency’s Local Area Network (LAN).
 | If encryption is not used, the agency must use other compensating mechanisms (e.g., switched vLAN technology, fiber optic medium, etc.) to ensure that FTI is not accessible to unauthorized users.
9.19.2 | Indicate whether or not unsecured cable circuits are used by the agency.  If in use, describe measures being taken to secure unencrypted cable circuits.
 | Unencrypted cable circuits of copper or fiber optics is an acceptable means of transmitting FTI.  Measures must be taken to ensure that circuits are maintained on cable and not converted to unencrypted radio (microwave) transmission.  Additional precautions must be taken to protect the cable, (e.g., burying the cable underground or in walls or floors and providing access controls to cable vaults, rooms, and switching centers).
 | In instances where encryption is not used, the agency must ensure that all wiring, conduits, and cabling are within the control of agency personnel and that access to routers and network monitors are strictly controlled.
9.2 | Additional Information Technology Controls – Remote Access
9.20.1 | Describe how the agency secures communications over public telephone lines.  Authentication should be provided through ID and password encryption for use over public telephone lines.
9.20.2 | Describe how the agency controls and enforces key management.  Authentication is controlled by centralized Key Management Centers/Security Management Centers with a backup at another location.
9.20.3 | Describe the agency’s remote telephone access procedures.
 | Both access methods (toll free and local numbers) require a special (encrypted) modem and/or Virtual Private Network (VPN) for every workstation and a smart card (microprocessor) for every user. Smart cards must have both identification and authentication features and must provide data encryption as well. Two-factor authentication is required whenever FTI is being accessed from an alternate work location or if accessing FTI via the agency’s web portal.
9.21 | Additional Information Technology Controls – Internet
 | Describe the agency’s policy and procedures for restricting access to sensitive data on systems that connect to the Internet.  Describe the types of security measures employed.
9.22 | Additional Information Technology Controls – Electronic Mail (E-mail)
9.22.2 | Describe the agency’s policy and procedures toward transmitting FTI via E-mail.  If E-mail is used to transmit FTI, describe the secure measures implemented to safeguard FTI.
 | If transmittal of FTI within the agency’s internal e-mail system is necessary, the following precautions must be taken to protect FTI sent via E-mail:
 | ·     Do not send FTI unencrypted in any email messages
 | ·     The file containing FTI must be attached and encrypted
 | ·     Ensure that all messages sent are to the proper address
 | ·     Employees must log off the computer when away from the area.
9.23 | Additional Information Technology Controls – Facsimile Mail (FAX)
9.23.1 | Describe the agency’s policy and procedures for transmitting FTI via FAX.
 | Securing FAX transmissions will include:
 | ·      Having a trusted staff member at both the sending and receiving fax machines.
 | ·      Maintaining broadcast lists and other preset numbers of frequent recipients of FTI.
 | ·      Placing fax machines in a secured area.
 | ·      Including a cover sheet on fax transmissions that explicitly provides guidance to the recipient, which includes: A notification of the sensitivity of the data and the need for protection and a notice to unintended recipients to telephone the sender—collect if necessary—to report the disclosure and confirm destruction of the information.
9.24 | Additional Information Technology Controls – Multi-Functional Printer-Copier Devices
9.24.1 | Describe the agency’s policy and procedures for transmitting FTI via multi-functional printer-copier devices.
 | If the agency uses a multi-functional printer-copier device, specific requirements regarding FTI must be followed.
 | ·     FTI must be encrypted in transit either to or from the device.
 | ·     FTI must not be emailed or faxed from the device.
 | ·     If FTI is scanned into the device, the user must authenticate on the device with a unique username and password.
 | ·     FTI may not be stored locally on the device
9.25 | Additional Information Technology Controls – Live Data Testing
9.25.1 | Describe the agency’s policy and procedures for testing with live FTI data.
9.26 | Additional Information Technology Controls – Web Portal
9.26.1 | Describe the agency’s policy and procedures for use of web portals when providing FTI over the Internet to customers.
 | To utilize a web portal that provides FTI over the Internet to a customer, the agency must meet the following requirements:
 | ·     The system architecture is configured as a three-tier architecture with physically separate systems that provide layered security of the FTI and access to the database through the application is limited.
 | ·     Each system within the architecture that receives, processes, stores or transmits FTI to an external customer through the web portal is hardened in accordance with the requirements of Publication 1075 and is subject to frequent vulnerability testing.
 | ·     Access to FTI via the web portal requires a strong identity verification process.  The authentication must use a minimum of two pieces of information although more than two are recommended to verify the identity. One of the authentication elements must be a shared secret only known to the parties involved and issued by the agency directly to the customer.  Examples of shared secrets include:  a unique username, PIN number, password or passphrase issued by the agency to the customer through a secure mechanism.  Case number does not meet the standard as a shared secret because that case number is likely shown on all documents the customer receives and does not provide assurance that it is only known to the parties involved in the communication.
9.27 | Additional Information Technology Controls – Integrated Voice Response (IVR) Systems
9.27.1 | Describe the agency’s policy and procedures for IVR system usage.
 | To utilize an IVR system that provides FTI over the telephone to a customer, the agency must meet the following requirements:
 | ·     The LAN segment where the IVR system resides is firewalled to prevent direct access from the Internet to the IVR system.
 | ·     The operating system and associated software for each system within the architecture that receives, processes, stores or transmits FTI to an external customer through the IVR is hardened in accordance with the requirements of Publication 1075 and is subject to frequent vulnerability testing.
 | ·     Independent security testing must be conducted on the IVR system prior to implementation.
 | ·     Access to FTI via the IVR system requires a strong identity verification process.  The authentication must use a minimum of two pieces of information although more than two are recommended to verify the identity. One of the authentication elements must be a shared secret only known to the parties involved and issued by the agency directly to the customer.  Examples of shared secrets include:  a unique username, PIN number, password or passphrase issued by the agency to the customer through a secure mechanism.  Case number does not meet the standard as a shared secret because that case number is likely shown on all documents the customer receives and does not provide assurance that it is only known to the parties involved in the communication.
9.28 | Additional Information Technology Controls – Emerging Technologies
9.28.1 | Describe the agency’s policy and procedures for maintaining FTI safeguards standards when using emerging technologies.  Emerging technologies are those not explicitly mentioned in this document and authoprization is to be granted by the OAG no less than 45-days prior to implementing said technology.
10. Disclosure Awareness Program
10.1 | Describe the agency’s formal disclosure awareness program.  Provide procedure information for initial and annual certification.  Provide a sample copy of training materials presented to employees and contractors.
 | Attachments:  Sample copy of training materials (required)