VERSION HISTORY/CHANGE RECORD Change Number Person Posting Change Change Reason for Change Page Number of Change Initial Version - June 24, 2015 1 Desai Updates necessary to support requirements within OMB M-14-03. OMB M-14-03 Throughout the document 2 Desai, Davis Updates necessary to support NIST SP 800-53 R4 and addition of Continuous Monitoring Performance Metrics. NIST SP 800-53 R4 Throughout the document Revision 1 - May 11, 2017 1 Dean/Klemens Reformatted to current style and structure. Removed database scanning requirements. Update to the reflect updates to GSA CIO Order 2100.1 and Security-06-30. Throughout the document Revision 2 - October 10, 2017 1 Dean/Feliksa/ Klemens/Desai/ Valenzuela Restructured document to reflect current GSA ISCM strategy and program. Updated to align with GSA’s use of Federal CDM tools and Federal guidance on ISCM and ongoing authorization. Incorporated Executive Order 13800 and NIST Cybersecurity Framework. Throughout the document IT
CM-2(2) PR.IP-1 Baseline Configuration | Automation Support for Accuracy / Currency Please refer to the for enterprise tool(s) used to maintain the baseline configuration of information systems hosted at GSA facilities. OCISO Oversight using Automated Tools Semiannually CM-6 PR.IP-1 Configuration Settings All systems must adhere to GSA hardening guides, United States Government Configuration Baseline, NIST guidelines, Center for Internet Security (CIS) Benchmarks (Level 1), or industry best practice guidelines, as deemed appropriate by the AO. All information systems must document and get approval for any deviations from GSA agency-wide hardening guides. This control is inherited from the underlying major information system. OCISO Oversight using Automated Tools Security Deviation Request Form and GSA Security Benchmarks, as applicable Semiannually CM-6 (1) PR.IP-1 Configuration Settings | Automated Central Management / Application / Verification Please refer to the for enterprise tool(s) used to implement and monitor security configuration settings of information systems IAW GSA hardening guides, United States Government Configuration Baseline, NIST guidelines, Center for Internet Security (CIS) Benchmarks (Level 1), or industry best practice guidelines, as deemed appropriate by the AO. OCISO Oversight using Automated Tools Semiannually
CM-8 (3) DE.CM-7 Information System Component Inventory | Automated Unauthorized Component Detection Please refer to the for enterprise tool(s) used to maintain an up-to-date and readily available hardware asset inventory, including unauthorized component detection. OCISO Oversight using Automated Tools Semiannually CM-8 (4) DE.CM-7 Information System Component Inventory | Accountability Information Please refer to the for enterprise tool(s) used to maintain an up-to-date and readily available hardware asset inventory with accountability information. OCISO Oversight using Automated Tools Semiannually CM-8(5) ID.AM-1 Information System Component Inventory | No Duplicate Accounting of Components Please refer to the for enterprise tool(s) used to ensure components are not duplicated in system hardware asset inventories. OCISO Oversight using Automated Tools Semiannually CM-8(7) PR.DS-3 Information System Component Inventory | Centralized Repository Please refer to the for enterprise tool(s) used to provide a centralized repository for hardware asset inventory. Oversight using Automated Tools Semiannually
RA-5 ID.RA-1 PR.IP-12 DE.CM-8 DE.DP-4 DE.DP-5 RS.CO-3 RS.MI-3 Vulnerability Scanning For all systems hosted in GSA Facilities, OCISO will conduct vulnerability scans IAW GSA IT Security Procedural Guide CIO-IT Security-17-80, “Vulnerability Management Process.” No deliverable needs to be provided by internally hosted systems. However, the ISSO for the information system needs to ensure that all of their assets have the agent installed (for agent-based tool) and/or all assets are being scanned for vulnerabilities using the enterprise scan tool. Oversight using Automated Tools Semiannually RA-5 (1) DE.CM-8 DE.DP-5 Vulnerability Scanning | Update Tool Capability For systems scanned by GSA OCISO, the Security Operations Division (ISO) will update scanning tools. For systems not scanned by ISO, scanning tool updates must be performed prior to scans. OCISO Oversight using Automated Tools Semiannually SI-2 ID.RA-1 PR.IP-12 Flaw Remediation SSOs must use an automated tool for flaw remediation and management. Please refer to the for enterprise tool(s) used for flaw remediation and patch management. OCISO Oversight using Automated Tools Semiannually SI-2(2) ID.RA-1 Flaw Remediation | Automated Flaw Remediation Status SSOs must use an automated tool to determine the status of systems regarding flaw remediation and patches. Please refer to the for enterprise tool(s) used for flaw remediation and patch management. Oversight using Automated Tools Semiannually