VERSION HISTORY/CHANGE RECORD Change Number Person Posting Change Change Reason for Change Page Number of Change Revision 1 – November 6, 2009 1 Bo Berlas Minor Changes to GSA 800-53 R3 Control Tailoring workbook in Appendix A GSA 800-53 Control Tailoring Workbook Update 17 Revision 2 – November 7, 2014 1 John Sitcharing/ Blanche Heard Minor changes to verbiage regarding Penetration Testing Update Penetration Testing verbiage 9 2 John Sitcharing/ Blanche Heard CISO mandated change in Penetration Testing requirement/ naming conventions based on consolidation efforts CISO Mandate Entire document Revision 3 – February 2, 2017 1 Bo Berlas Essential Security controls to Section 2 Security Controls Update 9 2 Bo Berlas Added sections 3-5 Updated to Provide Requirements for Internal Systems, Systems, and Mobile Applications 22-55 Revision 4 – January 25, 2018 1 Bryon Feliksa/ John Klemens Incorporated security references from MV 16-01 and additional references. Added a section on LiSaaS, Privacy controls, and updated Privacy and other sections to align with GSA policy and procedures. Incorporate MV 16-01 and consolidate GSA Cybersecurity and Privacy Guidance. Throughout
Essential Security Controls All NIST 800-53 controls must be implemented as per the applicable FIPS PUB 199 Low, Moderate, or High baseline. The following table identifies essential security controls from the respective baselines to highlight their importance and ensure they are implemented. The Contractor shall make the proposed system and security architecture of the information system available to the Security Engineering Division, in the Office of the Chief Information Security Officer for review and approval before commencement of system build (architecture, infrastructure, and code). Control ID Control Title Baseline GSA Implementation Guidance AC-2 Account Management L, M, H AC-17 (3) Remote Access | Managed Access Control Points M, H All remote accesses from internal users/systems to the external information system must be routed through GSA’s managed network access control points, subjecting them to security monitoring. AU-2 Audit Events L, M, H Information systems shall implement audit configuration requirements as documented in applicable GSA IT Security Technical Hardening Guides (i.e., hardening and technology implementation guides); for web applications see GSA IT Security Procedural Guide 07-35, Section 2.8.10, What to Log. For technologies where a Technical Guide and Standard does not exist, events from an industry source such as vendor guidance or Center for Internet Security benchmark, recommended by the GSA S/SO or Contractor to be approved and accepted by the GSA AO shall be used. CM-6 Configuration Settings L, M, H Information systems, including vendor systems on behalf of GSA, shall configure their systems in agreement with GSA technical guidelines, NIST guidelines, Center for Internet Security guidelines (Level 1), or industry best practice guidelines, as deemed appropriate. CP-7 Alternative Processing Site M, H FIPS PUB 199 Moderate and High impact systems must implement processing across geographically-disparate locations to ensure fault tolerance. Amazon Web Services based architectures must implement a multi-region strategy (multiple availability zones in a single region are not sufficient). CP-8 Telecom Services M, H FIP PUB 199 Moderate and High impact information systems must implement alternate telecom services to support resumption when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage
IA-2 (2) Identification and Authentication (Organizational Users) | Network Access to Accounts M, H Information systems at the FIPS PUB 199 Moderate and High impact levels must implement multi-factor authentication for non-privileged accounts. Information systems technically integrate with a GSA supported enterprise identification and authentication solution (e.g., SAML 2.0 with SSO integration (following 2FA with HSPD-12 PIV card)). IA-7 Cryptographic Module Authentication L, M, H The information system shall implement FIPS PUB 140-2 compliant encryption modules for authentication functions. Reference: MP-4 Media Storage M, H Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives, diskettes, compact disks and digital video disks shall be encrypted using a FIPS PUB 140-2 certified encryption module. MP-5 Transport M, H Digital including magnetic tapes, external/removable hard drives, flash/thumb drives and digital video disks shall be encrypted using a FIPS PUB 140-2 certified encryption module during transport outside of controlled areas. PL-8 Information Security Architecture M, H All information system security architectures must be formally reviewed and approved by the Office of the Chief Information Security Officer, Security Engineering Division during the system develop/design stages of the SDLC and prior to Security Assessment and Authorization. RA-5 Vulnerability Scanning L, M, H All systems must integrate with the GSA vulnerability scanning tool set managed by the Security Operations Division in the Office of the Chief Information Security Officer. Information systems shall coordinate integration with the scanning program by contacting . SA-22 Unsupported System Components GSA Required All systems must be comprised of software and hardware components that are fully supported in terms of security patching for the anticipated life of the system; software must be on GSA’s Enterprise Architecture IT Standards List.
SC-8/ Transmission Confidentiality and Integration M, H Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-2 validated, respectively. Digital signature encryption algorithms - Reference: Block cypher encryption algorithms - Reference: Secure hashing algorithms – Reference: Internet accessible Websites shall implement HTTPS Only and (HSTS), reference OMB Memorandum M-15-13. SSL/TLS implementations align with GSA IT Security Procedural Guide 14-69, “SSL/TLS Implementation.” SC-13 Cryptographic Protection L, M, H Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-2 validated, respectively. Digital signature encryption algorithms - Reference: Block cypher encryption algorithms - Reference: Secure hashing algorithms – Reference: SC-17 PKI Certificates M, H Implement appropriate creation, use, and signing of crypto certs in agreement with GSA IT Security Procedural Guide “SSL/TLS Implementation,” and NIST Special Publications 800-32, NIST 800-63. SC-18 Mobile Code M, H iOS and Android app creation, usage restrictions. Mobile applications shall undergo assessment and authorization practices as documented in GSA IT Security Procedural Guide 12-67, “Securing Mobile Devices and Applications.” SC-22 Architecture and Provisioning for Name / Address Resolution Service L, M, H Information systems shall be Domain Name System Security Extensions (DNSSEC) compliant. Reference OMB Memorandum M-08-23, which requires all Federal Government departments and agencies that have registered and are operating second level .gov to be DNSSEC. SC-28 (1) Protection of Information at Rest | Cryptographic Protection GSA Required – For systems with Personally Identifiable Information Only Systems bearing PII must implement protect information at rest. At a minimum, fields bearing PII data must be encrypted with field level encryption. Encryption algorithms shall be FIPS-approved; implemented encryption modules shall be FIPS PUB 140-2 validated. SI-2 Flaw Remediation L, M, H All projects and systems must be adequately tested for all Critical, High, and Moderate risk findings must be remediated prior to go-live. Post go-live, all critical and high vulnerabilities identified must be mitigated within 30 days and all moderate vulnerabilities mitigated within 90 days.