Account Management (AC-2 (1) (2) (3) (4)) SOM accounts are managed by DTMB/Office Automation (OA) Application accounts are managed by ……… Database accounts are managed by …… Temporary and emergency accounts are set to expire in Active Directory when the account is set up through the DTMB-0161 process. Complies with this control Yes No N/A See Risk # Access Enforcement (AC-3) DTMB 1350.10 Authentication Requirement for Access to Networks, Systems, Computers, Databases, and Applications requires the identification and use of approved personal authentication methods, appropriate for the identified of security required, for access to SOM information technology resources to prevent unauthorized access or maintain resource data integrity. DTMB 1350.40 Access Control Criteria for Right to Use Automated Information Resources establishes, documents, and manages the allocation of user access rights. Access privileges are limited on the of an approved specific business need (i.e., a need-to-know basis or the least privilege concept). Access privileges are granted to authorize users, modified when each user’s job duties change, terminated when a user separates service. Complies with this control Yes No N/A See Risk # Information Flow Enforcement (AC-4) DTMB 1350.10 Authentication Requirement for Access to Networks, Systems, Computers, Databases, and Applications requires the identification and use of approved personal authentication methods, appropriate for the identified of security required, for access to SOM information technology resources to prevent unauthorized access or maintain resource data integrity. DTMB 1350.40 Access Control Criteria for Right to Use Automated Information Resources establishes, documents, and manages the allocation of user access rights.
1. Lack of data classification by Agency Data not properly classified lead to the following: Confidentiality risks – These risks represent unauthorized access, use disclosure, disruption, modification, perusal, inspection, recording or destruction of information. Integrity risks – risks represent threats to business resources from unauthorized users and malicious code that attempts to corrupt the business data or system on which it relies. Availability risks – These risks represent threats to business processes by unauthorized users and malicious code that attempt to disrupt the way business is done and how information is processed. Moderate Moderate Agency to develop a data classification by which it assigns a level of sensitivity and an owner to each piece of information that it owns and maintains. Classifies information and the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance Compliancy with DTMB Policy 1340.00 Information Technology Security
4. Lack of DR/BCP and update By not having a DR/BCP, results in the Agency’s inability to prepare for, respond to, manage, and recover from adverse events that may affect its mission. If the DR/BCP is not reviewed/updated at least annually for system/Agency changes or when problems are encountered during system implementation, execution, or testing, the plan may not accurately reflect the mission, functions, or business processes supported by the information system, and therefore not be a viable plan and could result in: Resource ramifications to Agency Efficiency ramifications to customer. Inability to provide required federal reports. Primary and secondary systems located in different hosting centers. Backups of system are performed and stored in off site location Low Moderate Compliance with DTMB 1390.00 Policy - Information Technology Continuity of Business Planning. Completion of Business Application Criticality Request (DTMB-208) by Agency and DTMB/Agency Services Compliance with NIST 800-53; CP-2 Contingency Plan CP-10 Info Systems Recovery and Reconstitution Create and review the DR/BCP at least annually to address system/Agency changes, or problems encountered during the system implementation, execution or testing. Revise the plan necessary for these changes and communicate updates to appropriate organizational elements responsible for related plans. 5. Lack of testing and training of DR/BCP DR/BCP must be maintained in a of readiness, which must include having personnel trained to fulfill their roles and responsibilities within a plan, having plans exercised in a secure environment to validate their content, and having systems and system components tested to ensure their operability in an operational environment specified by the plan. Lack of a tested DR/BCP will hinder the Agency’s ability to prepare for, respond to, manage, and recover from adverse events that may affect its mission. Compliance with NIST 800-53; CP-3 Contingency Training & CP-4 Contingency Plan Testing and Exercises
11. Inadequate review of audit logs Malicious individual gains unauthorized access to system and modifies information without being detected or misuses resources of the system/application Moderate Moderate Agency to document an audit and accountability policy and procedure for reviewing audit logs. Procedures should include how often they are reviewed, how long they are retained and by whom Compliance with NIST 800-53; AU-1 thru AU-12 12. Lack of segmentation of PI/PII PI/PII is located in zone 2 and not firewalled off from other zone 2 devices, which could result in: Compromise of confidentiality, integrity and availability of PI/PII. Access controls logs Low Moderate Segment PI/PII to zone 2P or zone 3 which provides additional security controls Compliance with NIST 800-53; SC-32 Information System Partitioning
Approved by: ________________________________________ Date: ___________________ Rock Rakowski, Manager, Office of Security Appendix A - System and Information Security Level Matrix Security Objective Potential Impact Low Moderate High Confidentiality: Preserving authorized restrictions on information access and disclosure, including for protecting personal privacy and proprietary information. The unauthorized disclosure of information would have limited adverse effect on State of operations, assets, or individuals. Example(s): Public Information Information available via Freedom of Information Act The unauthorized disclosure of information would have a serious adverse effect on State of operations, assets, or individuals. Example(s): Personal information affecting an individual’s privacy (e.g. an individual’s medical information; driver’s license number; social security number; banking information, etc…) The unauthorized disclosure of information have a severe or catastrophic adverse effect on State of operations, assets, or individuals. Example(s): Highly sensitive information that may affect human life or safety (e.g. under cover investigation information; confidential response plans for emergencies) Information that if released violate State or Federal Law Significant amount of privacy information (e.g. thousands of individuals credit card numbers; social security numbers; banking information; medical information, etc…)
Low Moderate High Availability: Ensuring timely and reliable access to and use of information and systems. The disruption of access to or use of information or an information system would have limited adverse effect on State of operations, assets, or individuals. The disruption of access to or use of information or an information system would have a serious adverse effect on State of operations, assets, or individuals. Example(s): Information or information system that if not available, would seriously affect the public’s trust of the State (e.g. unemployment applications; Secretary of State applications; OTIS) Information or information system that if not available, could seriously affect the State financially (e.g. large revenue generating applications;) The disruption of access to or use of information or an information system would have a severe or catastrophic adverse effect on State of operations, assets, or individuals. Example(s): Information or information system that if not available, affect human life or safety (e.g. LEIN; prisoner tracking systems; emergency response systems) Information or information system that if not available, would severely affect the public’s trust of the State (e.g. welfare checks; food stamps; voter registration) Information or information system that if not available, could severely affect the State financially (e.g. Tax systems;
Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. AU-10 Non-repudiation The information system protects against an individual falsely denying having performed a particular action. AU-11 Audit Record Retention The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements. AU-12 Audit Generation The information system: Provides audit record generation capability for the list of auditable events defined in AU-2 at [Assignment: organization-defined information system components]; Allows designated organizational personnel to select which auditable events are to be audited by specific components of the system; and Generates audit records for the list of audited events defined in AU-2 with the content defined in AU-3. (1) The information system compiles audit records from [Assignment: information system components] into a system-wide (logical or physical) audit trail that is time correlated to within [Assignment: organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail]. Security Assessment and Authorization CA-1 Security Assessment and Authorization Policies and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: Formal, documented security assessment and authorization policies that address purpose, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the security assessment and authorization policies and associated security assessment and authorization controls. CA-2 Security Assessments The organization: Develops a security assessment plan that describes the scope of the assessment including: Security controls and control enhancements assessment; Assessment procedures to be used to determine security control effectiveness; and Assessment environment, assessment team, and assessment roles and responsibilities; Assesses the security controls in the information system [Assignment: organization-defined (1) The organization employs an independent assessor or assessment team to conduct an assessment of the security controls in the information system. (2) The organization includes part of security control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection: in-depth monitoring; malicious user testing; penetration testing; red team exercises; [Assignme: other forms of security testing]].
Requiring to take, and having devices implement, specific measures to safeguard authenticators. (1) The information system, for password-based authentication: (a) Enforces minimum password complexity of [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, letters, numbers, and special characters, including minimum requirements for each type]; (b) Enforces at a [Assignment: number of changed characters] when new passwords are created; (c) Encrypts passwords in storage and in transmission; (d) Enforces password minimum and maximum lifetime restrictions of [Assignment: organization-defined numbers for lifetime minimum, lifetime maximum]; and (e) Prohibits password reuse for [Assignment: organization-defined number] generations. IA-6 Authenticator Feedback The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals. IA-7 Cryptographic Module Authentication The information system uses mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. IA-8 Identification and Authentication Users) The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users). Incident Response IR-1 Incident Response Policy and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A formal, documented incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the incident response policy and associated incident response controls. IR-2 Incident Response Training The organization: The organization incorporates simulated events into incident response training to
frequency], removing from the access list personnel no longer requiring access. PE-3 Physical Access Control The organization: Enforces physical access authorizations for all physical access points (including designated entry/exit points) to the facility where the information system resides (excluding those areas within the facility officially designated publicly accessible); Verifies individual access authorizations before granting access to the facility; Controls entry to the facility containing the information system using physical access devices and/or guards; Controls access to areas officially designated publicly accessible in accordance with the organization’s assessment of risk; Secures keys, combinations, and other physical access devices; Inventories physical access devices [Assignment: organization-defined frequency]; and Changes combinations and keys [Assignment: organization-defined frequency] and when keys are lost, combinations are compromised, or individuals are transferred or terminated. The organization enforces physical access authorizations to the information system independent of the physical access controls for the facility. PE-4 Access Control for Transmission Medium The organization controls physical access to information system distribution and transmission lines within organizational facilities. PE-5 Access Control for Output Devices The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output. PE-6 Monitoring Physical Access The organization: Monitors physical access to the information system to detect and respond to physical security incidents; Reviews physical access logs [Assignment: organization-defined frequency]; and Coordinates results of reviews and investigations with the organization’s incident response capability. (1) The organization monitors real-time physical intrusion alarms and surveillance equipment. The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions. PE-7 Visitor Control The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated publicly accessible. (1) The organization escorts visitors and monitors visitor activity, when required. PE-8 Access Records The organization: Maintains visitor access records to the facility where the information system resides (except for those areas within the facility officially designated publicly accessible); and Reviews visitor access records [Assignment: organization-defined frequency]. The organization employs automated mechanisms to facilitate the maintenance and review of access records. The organization maintains a record of all physical access, both visitor and authorized individuals.
PE-9 Power Equipment and Power Cabling The organization protects power equipment and power cabling for the information system from damage and destruction. PE-10 Emergency Shutoff The organization: Provides the capability of shutting off power to the information system or individual system components in emergency situations; Places emergency shutoff switches or devices in [Assignment: organization-defined location by information system or system component] to facilitate safe and easy access for personnel; and Protects emergency power shutoff capability from unauthorized activation. PE-11 Emergency Power The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power source loss. The organization provides a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability in the event of an extended loss of the primary power source. PE-12 Emergency Lighting The organization employs and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility. PE-13 Fire Protection The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source. (1) The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire. (2) The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders. (3) The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis. PE-14 Temperature and Humidity Controls The organization: Maintains temperature and humidity levels within the facility where the information system resides at [Assignment: organization-defined acceptable levels]; and Monitors temperature and humidity levels [Assignment: organization-defined frequency]. PE-15 Water Damage Protection The organization protects the information system from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly, and known to key personnel. The organization employs mechanisms that, without the need for manual intervention, protect the information system from water damage in the event of a water leak.
Rescreens individuals according to [Assignment: organization-defined list of conditions requiring rescreening and, where re-screening is so indicated, the frequency of such rescreening]. PS-4 Personnel Termination The organization, upon termination of individual employment: Terminates information system access; Conducts exit interviews; Retrieves all security-related organizational information system-related property; and Retains access to organizational information and information systems formerly controlled by terminated individual. PS-5 Personnel Transfer The organization reviews logical and physical access authorizations to information systems/facilities when personnel are reassigned or transferred to other positions within the organization and initiates [Assignment: organization-defined transfer or reassignment actions] within [Assignment: time period following the formal transfer action]. PS-6 Access Agreements The organization: Ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access; and Reviews/updates the access agreements [Assignment: organization-defined frequency]. PS-7 Personnel Security The organization: Establishes personnel security requirements including security and responsibilities for providers; Documents personnel security requirements; and Monitors provider compliance. PS-8 Personnel Sanctions The organization employs a formal sanctions process for personnel failing to comply with established information security policies and procedures. Risk Assessment RA-1 Risk Assessment Policy and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A formal, documented risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls. RA-2 Security Categorization The organization: Categorizes information and the information system in accordance with applicable federal laws,
organization to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies). presence of unauthorized software on organizational information system and notify designated organizational officials. System and Services Acquisition SA-1 System and Services Acquisition Policy and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A formal, documented system and services acquisition policy that includes information security considerations and that addresses purpose, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls. SA-2 Allocation of Resources The organization: Includes a determination of information security requirements for the information system in mission/business process planning; Determines, documents, and allocates the resources required to protect the information system part of its capital planning and investment control process; and Establishes a discrete line item for information security in organizational programming and budgeting documentation. SA-3 Life Cycle Support The organization: Manages the information system using a system development life cycle methodology that includes information security considerations; Defines and documents information system security roles and responsibilities throughout the system development life cycle; and Identifies individuals having information system security roles and responsibilities. SA-4 Acquisitions The organization includes the following requirements and/or specifications, explicitly or by reference, in information system acquisition contracts on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards: Security functional requirements/specifications; Security-related documentation requirements; and Developmental and evaluation-related assurance requirements. (1) The organization requires in acquisition documents that vendors/contractors provide information describing the functional properties of the security controls to be employed within the information system, information system components, or information system services in sufficient detail to permit analysis and testing of the controls. (4) The organization ensures that each information system component acquired is explicitly assigned to an information system, and that the owner of the system acknowledges this assignment. The organization requires in acquisition documents that vendors/contractors provide information describing the design and implementation details of the security controls to be deployed within the information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.
SI-7 Software and Information Integrity The information system detects unauthorized changes to software and information. (1) The organization reassesses the integrity of software and information by performing [Assignment: organization-defined frequency] integrity of the information system. The organization employs automated tools that provide notification to designated individuals upon discovering discrepancies during integrity verification. SI-8 Spam Protection The organization: Employs spam protection mechanisms at information system entry and exit points and at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, or other common means; and Updates spam protection mechanisms (including signature definitions) when new releases are available in accordance with organizational configuration management policy and procedures. The organization centrally manages spam protection mechanisms. SI-9 Information Restrictions The organization restricts the capability to input information to the information system to authorized personnel. SI-10 Information Validation The information system checks the validity of information inputs. SI-11 Error Handling The information system: Identifies potentially security-relevant error conditions; Generates error messages that provide information necessary for corrective actions without revealing [Assignment: organization-defined sensitive or potentially harmful information] in error logs and administrative messages that could be exploited by adversaries; and Reveals error messages only to authorized personnel. SI-12 Information Output Handling and Retention The organization handles and retains both information within and output from the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.