WPC '  ԩeq1u`c* ]ݝnڞn2p];:Ek{̴2EpftQ:4+9}r/:`~(Op~K?BV\ >IUQpkNѠM$o6#EE끍&ÿQtd3F>#*9_t5t1'Rc "Muᣥf6T1rj=6{Js XqMQR~֙/wcCOlTN p]T 4-ǕR,&U\Ztl;gΟ5 nݥ&;xf*éE]}3jD?_f{ % 0 (U:@6!w@W4 1m@0'WzU:X 0#D    !z!UAJ\# 0v#$ A&UN^'o4'[t\UJ\B]o9^ 0DUN 02=H 0AF 0Yh˘ Ba3UNUNb08bbE\ 0C 0sUDU:- 0CgU: b BRW D3t 0 Cm 0J AMG`ԢԢ4 0C 0C= A [DۥZy?^UNsU:^  0 DUNU:5 0JoU:U: 1-UJU:<UNvijmTb(b08U:ڸUJ 0`< 0TU:/*UNYUNUNC 0PU:HUNUNоUNUN1UN AUNLUNUNUN6UNUNUN UNnUNUN UNXUNUNUNBUNUNUN,UNzU:UNUNPU:[UN\U:U:U:U:<U:UN=U:nU:oUNU:UJUN^_U: bEUU:UNVU:U:UNU:-U:.b bUJ(U:rU:U:UNU:UN,`zU:|UJ AMMU:%UJ_UNU:UJ@U:bVb^bfbnbvUJ~U:vUJtn7U:UJOU:dUJrZU:`UJU:U:UJU:?yUJb{U:U:U:UJIU:UJWU:UJU:UJ&bpbx UJDU: UJDU:l UJ  U:  U: UJ ( U: UJG  U:ZUJU:UJ<U:UJ=U:jUJU:UJ9U:bVUJjU:{UJU:UJfU:-UJgU:UJU:UJc~U:aUJU:  A  D+!UJ!"U:"UJ!#k#U:2$UJl$$$$@8'o''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/oU:_U:77qU:UUg,HP LaserJet 4 Plus/4M PlusHPPCL5E,,,,0 c:\ca\polman\aisfinal\polkey2.%($,@0AZ"Arial Regulare:\dingman\ncsc-029.wmf %%%% %i e%%D%V%%Eφ 3|x%# e37=CIQYag1.a.i.(1)(a)(i)1)a)f:\powerpnt\org2.wmf  BC"  o[X` hp x (#%'0*,.8135@8:<H?AXo CommissionerofCustomsfulfillstheresponsibilitiesofHeadofBureauand  authorizestheimplementationofCustomsAISsecuritysafeguardsbasedonFederalpolicyandguidelines .Reference:TDP7110.HeadofBureau.  BC"  TheprocessownersaredesignatedasAccreditingAuthoritiesfortheCustoms  processesforwhichtheyhaveresponsibility. TheAssistantCommissioner,OIT,performsthefunctionsofPrincipalAccreditingAuthority(PAA)andsharesaccreditingresponsibilitywiththeProcessOwners.Reference:TDP7110.PrincipalAccreditingAuthority(PAA)US Customs AIS Security Policy manual(Final in WP 6.0," ' $David Dingman$0David Dingman,.Computer Security   ,@0AZ"Arial Regular(3$ !  ab '  .(#U%c%%%MINIMUMSECURITYREQUIREMENTS#%y%%U%c-#Ԉ X A7-) xd9E1xAAIS org p Vf$Ӏ  1    0  OMBCircularA130,February8,1996requiresthatsecurityawarenesstrainingmustbe X periodic.TheNISTComputerSecurityTrainingGuidelines,11/89recommendannual 2 refreshertraining,butitisnotarequirement.[NIST500172]F  Z 2CG Times (WN) Regular(-!2Vf$ !  Ӏ  0    Vf$Ӏ  2    9%  <DL!X9ThisCircular'suseoftheterm"materialweakness"shouldnotbeconfusedwithuseofthesame X termbygovernmentauditorstoidentifymanagementcontrolweaknesseswhich,intheiropinion,poseariskorathreattotheinternalcontrolsystemsofanauditedentity,suchasaprogramoroperation.Auditorsarerequiredtoidentifyandreportthosetypesofweaknessesatanylevelofoperationororganization,evenifthemanagementoftheauditedentitywouldnotreporttheweaknessesoutsidetheagency.*:P3 I&mage <=8C HKKKK'C Z 6Times New Roman RegularWPC'x< x< 9!x< 3ƚ`@ @U 1&`@  & &$TNPPMicrosoft PowerPoint & TNPPf & &TNPP ` @ 145--A `&Mt &&&--x0-I--'- $ & &lt---llI--'- $lH & &--t-I--'- $7 & &--p(-I--'- $ & &dl-- -ddI--'- $d@ & & --l-  I--'- $ / & &--p-I--'- $3 & &--b-I--'- $ & &V^---VVI--'- $V2y &  & &--u-P --' &  & &T\---TT--' & &Mty--ytMT--YmTimes New Roman\-.  2  EXECUTIVEDQEJQE%QDTimes New Roman-.  2 ORDERSQKPEK> & &\--"System-\?---' & &it--ti--Times New RomanX-.  !2 NATIONAL SECURITYQQD%QQQE>DKQK%DQTimes New Roman-.  2 DIRECTIVESQ%KDKD&QD> & & \---\b---' & &f--f--Times New RomanX-.  2 W PUBLIC LAWS>QKD&JEQi? & &2:\---\-22--' & &t--t2-- Times New RomanX-.   2 OMBQcKTimes New Roman-.  2 E CIRCULARSK%KJQEQJ? & &\---\'---' & &\--\} 5-T--' & &x -- x-- Times New RomanX-.   2 eFIPS>&>>Times New Roman-.   2 IPUBS>QK> & &H &H --- H--lh$Times New RomanX-.  "2 \TECHNICAL SECURITYDEKPQ&JQE>DKQK%DQTimes New Roman-.  !2 \COMPUTER SECURITYKQc>QEDK>EJQK%EPTimes New RomanX-.  %2 8\INFORMATION SECURITY%Q>QKdQD%QQ>EJQK%EQTimes New Roman-.  *2 \COMMUNICATIONS SECURITYKQcdQQ%KPE%QQ>>EKPK%EQTimes New RomanX-.  2 \ TEMPEST *DEc?D>E8Times New Roman-.  "2 0\PERSONNEL SECURITY>EJ?QPQED>EKPK%EQTimes New RomanX-.  $2 \OPERATIONS SECURITYQ>EJQE%QQ>>EJQK%EQTimes New Roman-.  !2 \PHYSICAL SECURITY>QQ>&JQE>DKQK%DQTimes New RomanX-.  $2 (\INDUSTRIAL SECURITY%QQQ>EJ&QD>EJQK%EQ & &  ---` - --' & & --t - --' & &hp--(-hh --' & & --X - --' & & --l - --' & & T\-- -TT --' & & --P - --' & & --d - --' &  & &T$--$}T5- --' & &&--x0-=--'- $ & &lt---ll=--'- $ lH & &--t-=--'- $ 7 & &--p(-=--'- $  & &dl-- -dd=--'- $ d@ & & --l-  =--'- $ / & &--p-=--'- $ 3 & &--b-=--'- $  & &V^---VV=--'- $ V2y &  & &!H L--L H!V=--, hATimes New RomanX-.  2 yNCSC GUIDELINESQK>KPQ&QDD&QD> & &,@ P---P @,V=--0 `LTimes New Roman-.  2 AGENCY/SERVICEQQDQKQ>DKQ%KDTimes New RomanX-.  2 f (TREASURY)%EJEQ>QKP&Times New Roman-.  2  REGULATIONSKDQQDQE%QQ> & &N ---N V=--l. "Times New RomanX-.  2 ]CUSTOMSKQ>DQd>Times New Roman-.  2 ( REGULATIONSKDQQDQE%QQ> & &%---x0- '--'- $ & &D=L---DDU--'- $5D g & &EBM--B-pEE--'- $Eh" &  & &TNPP & --Level 1Level 2Level 3Level 4Level 5 j :C#  P Figure  2   ݀PolicyHierarchyF  Z 2CG Times (WN) Regular M(  %c%%%MINIMUMSECURITYREQUIREMENTS#%y%%%c# X A7-) xdE1xAWPC'rfrf9!rf9ƚPp @QU }<&Pp & &$TNPPMicrosoft PowerPoint & TNPPf & &TNPP pP  `345-- pP&--(- --' & &x--(x-P--' & & --L -r=--' & &--]-v6--' & &&--o---' & &----yTimes New Roman-.  02 Security Steering CommitteeL<<L<&-D"L-=<<&LD"bDqr%.-<=yTimes New Roman-.  2 2 (Oversight)-jD<=5&DK-. &  & &*RX---XR*yTimes New Roman-.  2 O Commissioner,bDrq&54&DL<="yTimes New Roman-.  %2 NU.S. Customs Serviceb"L""bL5-Dq5"L<<D&=< & &*R---R*yTimes New Roman-.  %2 !Deputy Commissioner,b=KL-D"bDrq&55%DL<="yTimes New Roman-.  %2 JNU.S. Customs Serviceb"L""bL5-Dq5"L<<D&=< & &q2---2qyTimes New Roman-.  $2 aAsst. Commissioner,b55-""cDqq&55&DK=<"yTimes New Roman-.  '2 )EOffice of Informationj--&=<"D-"5L-D<rD-&DKyTimes New Roman-.  2 and TechnologyDLK"[<=KLD&DDD & &w---wyTimes New Roman-. yTimes New Roman-.  *2 ISecurity AdministrationL<<L<&-D"cKr%L&5-<D.%DL & &wV---VwyTimes New Roman-.  2 M Director,b&<=<-D="yTimes New Roman-.  '2 GAIS Security Divisionb5L"K=<L<&-D"b&D&5&DK & &5a--"System-)&GTNPP=5a5a0d40W5aa5 & TNPP---$5aal5l5a$555-$5llv5v5l$555-$5vv55v$555-$555$555-$555$555-$555$5||55|-$555$5qq|5|5q-$555$5ffq5q5f-$555$5\\f5f5\-$555$5QQ\5\5Q-$555$5FFQ5Q5F-$555$5<<F5F5<-$555$511<5<51-$555$5&&1515&-$555$5&5&5-$5 5 5$555-$5  55 $555-$5"5"5$555-$5"",5,5"$555-$5,,7575,$555-$577B5B57$555-$5BBL5L5B$555-$5LLW5W5L$555-$5WWb5b5W$555-$5bbm5m5b$555-$5mmw5w5m$555-$5ww55w$555$555--' & TNPP & TNPP--'-a5yTimes New Roman-. yTimes New Roman-.  32 Field Security AdministratorsS&<&L"K=<L<&-D"bLq&L%5.<D-D=5 & &v>.---)&GTNPP=v>.v6&0d40Wv>..>v & TNPP---$v>v>~~v$&>&>..&-$~>~>~$>>&&-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>$>>-$>>  $>>-$ > > $>>-$>>$>>-$>>""$>>-$">">**"$z>z>z-$*>*>22*$r>r>zzr-$2>2>992$k>k>rrk-$9>9>AA9$c>c>kkc-$A>A>IIA$[>[>cc[$I>I>[[I--' & TNPP & TNPP--'-.>vyTimes New Roman-.  12 %Security Compliance & ReviewL<<L<&-D"cDqL%&DL<="q"b<D&=byTimes New Roman-.  2  Group (DSOs)j<DLK".bLi5. & & &&N-$PFPF & &-- &  & & Times New Roman-.  '2 N- Systems Engineering%?8+%2],K>8>222>8 '2 N- Computer Operations%Q8]?>%22W>228%8>,Times New Roman-.  -2 - Database Administration%Q8%8?8+2Q>^>,%28%8> '2 - Applications (each)%Q>?28%8>,%282>%Times New Roman-.  2 Z- Communications%Q8]^>>28% 8>+ 2 Z- Field Support%E2>>?>>82% &  & & 2--2 yTimes New Roman-.  $2 Asst. Commissioner,b55-""cDqq&55&DK=<"yTimes New Roman-.   2 )wCFObSjyTimes New Roman-.  -2 (Financial Process Owner)-S&LDK=&D%"S=D<=45"jbL<=- & &2---2yTimes New Roman-.  $2 BAsst. Commissioner,b55-""cDqq&55&DK=<"yTimes New Roman-.  2 )(Other Process-j-L<="S<D=<55yTimes New Roman-.  2 Owners)jbL<<5. & &n &n &qn --$f ii}} & &?d --e ? &  & &Times New Roman-.  <2 #Distributed Systems Access ControlsQ,%8828>8,2W+Q221,,J88&8+Times New Roman-.  -2 Mainframe Access Controlsd18&%2W2P222+,J88 %8,Times New Roman-.  62 !Policy, Procedures, & Standards>8 18?%82188&1,W>2882%8,Times New Roman-.  !2 Technical SupportD228821?8888% &  & &}---??}}}-=\}--' & &--^-M=--' & &px-- 0-pp--' & &TNPP & --(3$ !  'C Z 6Times New Roman Regular($0 ($0 0 (@$0  0` (#(#0 ` (#` (# ` ]Gray MatE d <d d <d d'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular2-  Level 1 Level 2 Level 3 Level 4 Level 51- 5-  '  @@*(#4%c%%%SECURITYINCIDENTSANDVIOLATIONS#%y%%4%c-#Ԉ X A7-) xdE1xA($    >a$"Small Circle"0.. :C#  P Figure  3   .CustomsAISSecurityOrganization  ,@0AZ"Arial Regular(2C$ !  ,@0AZ"Arial Regular#$% X BC"  Ownersofsensitivedatamustensurethatappropriatesafeguardsareemployed  toprotectthedatafromunauthorizedaccessduringthelifeofthedatawhiletheyaretheresponsibleowner.Thisincludesthetransferofthedatabyanymeans,toanotherperson,application,AIS,orprocess . d7777'dxd Level 1 Level 2 Level 3 Level 4 Level 5(2C$ !  ("$ Figure    9:;8A<< c  BC"  o[X` hp x (#%'0*,.8135@8:<H?AXo TheAISSecurityAdministratorisassignedthefunctionalresponsibilitiesofthe  InformationSystemsSecurityOfficer(ISSO)andNetworkSecurityOfficer(NSO). Reference:TDP7110.InformationSystemsSecurityOfficer. V 3C)  A7-) xdEWxA X Q%c%%%Q&&%%cJune1996NN(#U.S.CustomsServiceAISSecurityPolicyManual#T&&&&q##T%y%&&#Ԉ g ̃ Level 1 Level 2 Level 3 Level 4 Level 5($     (2C$ !  @B:A87777E<< c : :C#  Figure3 .WarningBanner P BC"  &&%%o[X` hp x (#%'0*,.8135@8:<H?AXo TheADPSteeringCommittee,SecuritySubcommitteeprovidesauthorityfor  theCustomsAISSecurityProgram. #%y%&&#ԅLevel 1Level 2Level 3Level 4Level 5  BC"  &&%%o[X` hp x (#%'0*,.8135@8:<H?AXo TheDirector,AISSecurityDivision,OIT,isthedesignatedAISSecurity  Officer.    6Times New Roman Regular  BC"  TheAssistantCommissioner(AC),OIT,&&%%ԀperformsthefunctionsoftheSenior  InformationResourcesManagementOfficial(SIRMO)and#%y%&&C#Principal  AccreditingAuthority(PAA) .  TheACisdesignatedasanAccreditingAuthority(AA)forCustomsAISsprocessing,storing,ortransmittingsensitiveinformation.TheProcessOwnersarealsodesignatedasAAsfortheirCustomsprocesses.Reference:TDP7110.PrincipalAccreditingAuthority(PAA)andSeniorInformationResourcesManagementOfficial(SIRMO).,@0AZ"Arial Regular  BC"    &&%%THISISAU.S.CUSTOMSSERVICECOMPUTERNETWORK  SYSTEM.U.S.CUSTOMSSERVICECOMPUTERNETWORKSYSTEMSAREPROVIDEDFORTHEPROCESSINGOFOFFICIALU.S.GOVERNMENTINFORMATIONONLY.ALLDATACONTAINEDONU.S.CUSTOMSSERVICECOMPUTERNETWORKSYSTEMSAREOWNEDORCONTROLLEDBYTHEU.S.CUSTOMSSERVICE,ANDMAY,FORTHEPURPOSEOFPROTECTINGTHERIGHTSANDPROPERTYOFTHEU.S.CUSTOMSSERVICE,BEMONITORED,INTERCEPTED,RECORDED,READ,COPIED,ORCAPTUREDINANYMANNERBYAUTHORIZEDSYSTEMSPERSONNEL.THEREISNORIGHTOFPRIVACYINTHISSYSTEM.SYSTEMSPERSONNELMAYGIVETOLAWENFORCEMENTOFFICIALSANYPOTENTIALEVIDENCEOFCRIMEFOUNDONU.S.CUSTOMSSERVICECOMPUTERNETWORKSYSTEMS.USE    OFTHISSYSTEMBYANYUSER,AUTHORIZEDORUNAUTHORIZED,CONSTITUTESCONSENTTOTHISMONITORING,INTERCEPTION,RECORDING,READING,COPYING,ORCAPTURINGANDDISCLOSURE. #%y%&&*#(3$ !  6Times New Roman Regular,@0AZ"Arial Regular("$ Figure    ,@0AZ"Arial Regular,@0AZ"Arial Regular$359AM]q111.11.1.11.1.1.11.1.1.1.11.1.1.1.1.11.1.1.1.1.1.11.1.1.1.1.1.1.1F  Z 2CG Times (WN) Regular,@0AZ"Arial Regular'C Z 6Times New Roman Regular '  =(#O%c%%%GENERALPOLICY#%y%%O%c-#Ԉ X A7-) xdE1xA M(  %c%%%GENERALPOLICY#%y%%%c# X A7-) xdE1xA '  R%c%%%4(#AISSECURITYLIFECYCLE#%y%%R%c#Ԉ X A7-) xdE1xA M(  %c%%%AISSECURITYLIFECYCLE#%y%%%c# X A7-) xddE1xA3- 4-    *  ^%c%%%^&&%%cA7-) xdEWxA X U.S.CustomsServiceAISSecurityPolicyManualB(#June1996#^%c%&&:#^&&%%c#`&&&&#Ԉ g #`%y%&&#,@0AZ"Arial Regular M(  c%c%%%SECURITYINCIDENTSANDVIOLATIONS#%y%%c%c# X A7-) xdE1xAF  Z 2CG Times (WN) Regular(8c$0  0` (#(#   (,!$0  0` (#(#  ,@0AZ"Arial Regular % '  C(#%c%%%&&%|%cFOREWORD X A7-) xddE1xA 2 #&&&|&-##%y%&&L#'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular '  j%c%%%66C(#GLOSSARY X A7-) xdE1xA((3/Q$ !   d ,@0AZ"Arial Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular M(  %c%%%GLOSSARY#%y%%%c# X A7-) xdE1xA'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular:y  <<= 8C'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular,@0AZ"Arial Regular'C Z 6Times New Roman Regular'C Z 6Times New Roman Regular '  %c%%%  APPENDIXC#%y%%%c# X :A7-) xdE1xA '  A(#%c%%%APPENDIXA#%y%%%c-#Ԉ X A7-) xdE1xA,@0AZ"Arial Regular M(  %c%%%APPENDIXA#%y%%%c# X A7-) xddE1xA'C Z 6Times New Roman Regular,@0AZ"Arial Regular '  %c%%%  APPENDIXB#%y%%%c# X :A7-) xdE1xA,@0AZ"Arial Regular M(  %c%%%APPENDIXB#%y%%%c# X A7-) xdE1xA,@0AZ"Arial Regular,@0AZ"Arial Regular M(  %c%%%APPENDIXC#%y%%%c# X A7-) xdE1xA,@0AZ"Arial Regular'C Z 6Times New Roman Regular '  %c%%%  APPENDIXD#%y%%%c# X :A7-) xdusE1xA,@0AZ"Arial Regular M(  %c%%%APPENDIXD#%y%%%c# X A7-) xd E1xA,@0AZ"Arial Regular'C Z 6Times New Roman Regular '  %c%%%  APPENDIXE#%y%%%c# X :A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular'C Z 6Times New Roman Regular U 3C)  A7-) xdEWxA X %c%%%&&%%cJune1996NN(#U.S.CustomsServiceAISSecurityPolicyManual#&&&&q##%y%&&#Ԉ g ,@0AZ"Arial RegularIndex-  M(  %c%%%APPENDIXE#%y%%%c# X A7-) xddE1xA,@0AZ"Arial Regular'C Z 6Times New Roman Regular '    %c%%%APPENDIXF#%y%%%c'# X A7-) xdE1xA,@0AZ"Arial Regular M(  %c%%%APPENDIXF#%y%%%c# X A7-) xdE1xA,@0AZ"Arial Regular'C Z 6Times New Roman Regular '  %c%%%  APPENDIXG#%y%%%c# X :A7-) xdE1xA,@0AZ"Arial Regular M(  %c%%%APPENDIXG#%y%%%c# X A7-) xddE1xA,@0AZ"Arial Regular '    %c%%%COMMENT#%y%%%c'# X A7-) xd^E1xABib- Glos- F  Z 2CG Times (WN) Regular,@0AZ"Arial Regular '    %c%%%INDEX#%y%%%c'# X A7-) xdE1xA,@0AZ"Arial Regular M(  %c%%%INDEX#%y%%%c# X A7-) xdE1xA,@0AZ"Arial Regular'C Z 6Times New Roman Regular   *  A7-) xdEWxA X %c%%%&&%%cU.S.CustomsServiceAISSecurityPolicyManualB(#June1996#%c%&&#&&%%c#&&&&q#&&&&Ԉ g #&&&&_##%y%&&#,@0AZ"Arial Regular'C Z 6Times New Roman Regular V 3C)  A7-) xdEWxA X %c%%%&&%%cJune1996NN(#U.S.CustomsServiceAISSecurityPolicyManual#&&&&q##%y%&&#Ԉ g    *  %c%%%&&%%cA7-) xdEWxA X U.S.CustomsServiceAISSecurityPolicyManualB(#June1996#%c%&&:#&&%%c#&&&&#Ԉ g #%y%&&#,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular*:P8A<< C '  %c%%%88C(#CONTENTS#%y%%2%c#Ԉ X A7-) xd^E1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular'C Z 6Times New Roman Regular M(  %c%%%CONTENTS#%y%%%c# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  ?(#%c%%%INTRODUCTION#%y%%K%c-#Ԉ X A7-) xdE1xA,@0AZ"Arial RegularC- D- E- F- G- F  Z 2CG Times (WN) Regular M(  %c%%%INTRODUCTION#%y%%%c# X A7-) xdE1xA '  %c%%%  BIBLIOGRAPHY#%y%%%c# X :A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular j :C#  P Figure  2   ݀PolicyHierarchy M(  %c%%%BIBLIOGRAPHY#%y%%%c# X A7-) xdE1xA '  =(#%c%%%GENERALPOLICY#%y%%O%c-#Ԉ X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  %c%%%GENERALPOLICY#%y%%%c# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular  BC"  o[X` hp x (#%'0*,.8135@8:<H?AXo CommissionerofCustomsfulfillstheresponsibilitiesofHeadofBureauand  authorizestheimplementationofCustomsAISsecuritysafeguardsbasedonFederalpolicyandguidelines .Reference:TDP7110.HeadofBureau. :C#  P Figure  3   .CustomsAISSecurityOrganization   P BC"  &&%%o[X` hp x (#%'0*,.8135@8:<H?AXo TheADPSteeringCommittee,SecuritySubcommitteeprovidesauthorityfor  theCustomsAISSecurityProgram. #%y%&&#,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular,@0AZ"Arial Regular  BC"  TheAssistantCommissioner(AC),OIT,&&%%ԀperformsthefunctionsoftheSenior  InformationResourcesManagementOfficial(SIRMO)and#%y%&&C#Principal  AccreditingAuthority(PAA) .  TheACisdesignatedasanAccreditingAuthority(AA)forCustomsAISsprocessing,storing,ortransmittingsensitiveinformation.TheProcessOwnersarealsodesignatedasAAsfortheirCustomsprocesses.Reference:TDP7110.PrincipalAccreditingAuthority(PAA)andSeniorInformationResourcesManagementOfficial(SIRMO).,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular,@0AZ"Arial Regular  BC"  &&%%o[X` hp x (#%'0*,.8135@8:<H?AXo TheDirector,AISSecurityDivision,OIT,isthedesignatedAISSecurity  Officer. F  Z 2CG Times (WN) Regular  BC"  TheprocessownersaredesignatedasAccreditingAuthoritiesfortheCustoms  processesforwhichtheyhaveresponsibility. TheAssistantCommissioner,OIT,performsthefunctionsofPrincipalAccreditingAuthority(PAA)andsharesaccreditingresponsibilitywiththeProcessOwners.Reference:TDP7110.PrincipalAccreditingAuthority(PAA) X BC"  Ownersofsensitivedatamustensurethatappropriatesafeguardsareemployed  toprotectthedatafromunauthorizedaccessduringthelifeofthedatawhiletheyaretheresponsibleowner.Thisincludesthetransferofthedatabyanymeans,toanotherperson,application,AIS,orprocess .,@0AZ"Arial Regular  BC"  o[X` hp x (#%'0*,.8135@8:<H?AXo TheAISSecurityAdministratorisassignedthefunctionalresponsibilitiesofthe  InformationSystemsSecurityOfficer(ISSO)andNetworkSecurityOfficer(NSO). Reference:TDP7110.InformationSystemsSecurityOfficer.,@0AZ"Arial Regular '  %c%%%4(#AISSECURITYLIFECYCLE#%y%%R%c#Ԉ X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  %c%%%AISSECURITYLIFECYCLE#%y%%%c# X A7-) xddE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  .(#%c%%%MINIMUMSECURITYREQUIREMENTS#%y%%U%c-#Ԉ X A7-) xd9E1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  %c%%%MINIMUMSECURITYREQUIREMENTS#%y%%%c# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) RegularA- B-   BC"    &&%%THISISAU.S.CUSTOMSSERVICECOMPUTERNETWORK  SYSTEM.U.S.CUSTOMSSERVICECOMPUTERNETWORKSYSTEMSAREPROVIDEDFORTHEPROCESSINGOFOFFICIALU.S.GOVERNMENTINFORMATIONONLY.ALLDATACONTAINEDONU.S.CUSTOMSSERVICECOMPUTERNETWORKSYSTEMSAREOWNEDORCONTROLLEDBYTHEU.S.CUSTOMSSERVICE,ANDMAY,FORTHEPURPOSEOFPROTECTINGTHERIGHTSANDPROPERTYOFTHEU.S.CUSTOMSSERVICE,BEMONITORED,INTERCEPTED,RECORDED,READ,COPIED,ORCAPTUREDINANYMANNERBYAUTHORIZEDSYSTEMSPERSONNEL.THEREISNORIGHTOFPRIVACYINTHISSYSTEM.SYSTEMSPERSONNELMAYGIVETOLAWENFORCEMENTOFFICIALSANYPOTENTIALEVIDENCEOFCRIMEFOUNDONU.S.CUSTOMSSERVICECOMPUTERNETWORKSYSTEMS.USE    OFTHISSYSTEMBYANYUSER,AUTHORIZEDORUNAUTHORIZED,CONSTITUTESCONSENTTOTHISMONITORING,INTERCEPTION,RECORDING,READING,COPYING,ORCAPTURINGANDDISCLOSURE. #%y%&&*#F  Z 2CG Times (WN) Regular : :C#  Figure3 .WarningBanner '  @@*(#%c%%%SECURITYINCIDENTSANDVIOLATIONS#%y%%4%c-#Ԉ X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  %c%%%SECURITYINCIDENTSANDVIOLATIONS#%y%%c%c# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  %c%%%66C(#GLOSSARY X A7-) xdE1xA,@0AZ"Arial Regular M(  %c%%%GLOSSARY#%y%%%c# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  %c%%%  BIBLIOGRAPHY# %y%%%c# X :A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(   %c%%%BIBLIOGRAPHY# %y%%%c# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  A(#%c%%%APPENDIXA#%y%%%c-#Ԉ X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  %c%%%APPENDIXA#%y%%%c# X A7-) xddE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  %c%%%  APPENDIXB#%y%%%c# X :A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  %c%%%APPENDIXB#%y%%%c# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  %c%%%  APPENDIXC#%y%%%c# X :A7-) xdE1xA,@0AZ"Arial RegularComment- F  Z 2CG Times (WN) Regular M(  %c%%%APPENDIXC#%y%%%c# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  !%c%%%  APPENDIXD#"%y%%%c# X :A7-) xdusE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  $%c%%%APPENDIXD#%%y%%%c# X A7-) xd E1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular '  '%c%%%  APPENDIXE#(%y%%%c# X :A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  *%c%%%APPENDIXE#+%y%%%c# X A7-) xddE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular  Vf$Ӏ  1    0  OMBCircularA130A130,February8,1996requiresthatsecurityawareness#awareness#Ԁtraining!training!Ԁmustbe X periodic.TheNISTComputerSecurityTraining!Training!ԀGuidelines,11/89recommendannual 2 refreshertraining!training!,butitisnotarequirement.[NIST500172] '    .%c%%%APPENDIXF#/%y%%%c'# X A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  1%c%%%APPENDIXF#4%y%%%c# X A7-) xdE1xA,@0AZ"Arial Regular*:P3&OLE 2.0 Box <=8C HKKKK'dxdF  Z 2CG Times (WN) Regular '  6%c%%%  APPENDIXG#7%y%%%c# X :A7-) xdE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular M(  9%c%%%APPENDIXG#:%y%%%c# X A7-) xddE1xA,@0AZ"Arial RegularF  Z 2CG Times (WN) Regular  Vf$Ӏ  2    9%  <DL!X9ThisCircular'suseoftheterm"materialweakness3)material weakness3"shouldnotbeconfusedwithuseofthesame X termbygovernmentauditorstoidentifymanagementcontrolweaknesseswhich,intheiropinion,poseariskorathreattotheinternalcontrolsystemsofanauditedentity,suchasaprogramoroperation.Auditorsarerequiredtoidentifyandreportthosetypesofweaknessesatanylevelofoperationororganization,evenifthemanagementoftheauditedentitywouldnotreporttheweaknessesoutsidetheagency.?C:\CA\POLMAN\CS-SEAL.TIFWPC,,9,, =}x 96756 35 24231202/1 /0 ?.0./-/?-.,.,-+-+-*,*,)+)+?  )+  (* (* ?()')')'( &( &( &'?%'%'?%'??$&?$&?$&#%#%#%?#%?"$?"$"$?"$?!#!#?!# !# ? "   "? ?? ? "   "  ?!  ?!?  ! p !     ?  ? ? ??  ? ? ?|? ? ??  ?? ??????????  ? ? ? ?? ???? ?? ?????%%????%??&?????.???*????*????+????'??????0??;???1?1???? ?????????????????<? `?? ? ??? ? ?|?<? ?     ??  ??       ??  ??? `? ? ?? ?     ??   ?   ?? ? ?q?   ?<?  ~?? ? ?  ??? ???     ! "???""#?$x??$?$ %? &?? ?& & ?&  (  ( ?? (  (  )?  ?* ? *  *  * ? +  ,  ? ?,?  ,  ,  ,  -? .? . . ?. / ?/ 0?? 0 0 0? 0 1 2? 2 ?2 ?2 ?2 3? 3? 4? ?       ???  ?     ? ?    ? ???                ??     ??  ?              ?     ? ?   ?  ??       ?     ?           ?   ?   ??    ?? ?             ? ?    - ??  . ??  .   /?   ?/              ? ?     ?   ?    ?   ?    ?   ??   ?     ?     ?    ? ? ?? ?    ? ?? ? ??  ? ??  > ??  ??  ? ??     ?   ? ???? ? ?? ? ?  ?   ?? ??????????????8!p!??!???!?"?''~??    ?  ? ?   ?      ?   ?   ? ?           ? ?   ? ?   ? ?      ?      ?     ?  ?     ?      ?   ?  ?   ?  ?   ?    ? ?    ? ?    ? ?     ?            ?     ?    ?    ?     ?      ?                ?     ?                 ?  ?  ?  ?  ?  ?  ?      ?               ? 8     8  ?  0 x  ?  8|  ?  x  ?    ?               ?    ?        ?    ? ?    ?   ? ? ?  ?  ??  ?  ??  ?  ??  ?  ??    ?              ?     ?     ?           ?      ??      ??      ?    ?  ? ?   ?  ?    ?  ?  ?  ?  ?  ?  ?  ?  ?   ??     ??     ?  ?    ?  ?    ?    ?  ?    ?  ??  ? ?  ?  ? ?  ?  ? ?  ?  ? ?  ? ?   ?                            ?      ? ?     ?                                ?                 ?     ?   ?  ?   ?  ?    ?  ?<  ?  ~  ?    ?    ?  ??  ?  ?  ?    ?  ?  ?      ?    ?        ??  ?    ?    ?  ?  ?    ?    ?    ?   ?   ? ? ??   ?? 8 ?? | ?? ? ??   ?? ?  ???   ?? ?   ?? ?   ??    ??     ??    ??    ???    ??    ??    ??    ???    ??    ??    ??    ??    ???  ?  ???    ??    ??    ??  <  ??  ~?  ??     ??     ~??      ??      ??      ??     ??     ?     ?     ?     ?        ?    |              ?     ? ?  ?   ? ?  ? ? <  ? ~?  ? ?  ? ?  ?   ?   ? ?  ? ?  ?  ?  ?  ??  ?    ?   ? ?  ?  ??  ?  ? ? ?  ?? ? ??   ???   ????    ?  ?  0 ?    x ?    ? ?  `        ?    ?? ? ??  ? ? ?  ?? ?    ?     ?     ?     ???   ?  ?? ?  ?  ?  ?  ?  ?  ?  ?  ?  ?  ??  ??  ??  ?  ?  ?  ?  ?    ?   ?? ?  ?     ??????>??>?~??????? ?? ??? ? ?`` ?? ?? ?? ?8 ? ?     ?  ??? ? ???  ???  ?? ? ?   ??   ? ? ? ?  ?       ? ?   ?? ? ? ?? ? ?  ?  ???  >~   ?  ? ?  ? ?? ?  ?  ??? ??  ??? ??? ? ? ? ? ? ? ?? ? ???         ?   ?     ?        @                 ?  ?    ?   ??   ??  ?   ? ?  ?? ???   ???   ??          ?              ? ?   ? ?   ??  ?0? ?  ?  ?   ?   ?          ?   ? ? ?  ?    ? ?  ?? ? ????  ? ? ?   ?   ?  ?    ?    ?               ??  ?  ??  ??  ???  ??  ???  ? ?  ' ?' ? &   ?% ?  %   %  ? %  ?? #   ?# ? ? # ?? ? # ??  " ?  !   !   ! ?  !  ? ? ?    ?   ???  ? ??        ?? ?  ?   <    ?  ?               ?   ??   ?     ? ? ?? ?   ?    ?  ?   ?  ? ?     ?   ?    ?  ?  ?         ? ?  ? ?  ??  ? ?     ? ?  ? ?  ?? ?  ?   ???  ??  ?? ?   ?? ??????? ???  ?? ?????????~? ? ?????  ?? ??? p??? p?? ????  ??    ??              ?? ? ??    ??   ??  ? ? ? ? ? ? ?? <? ? ? ??  ?   ?       ?? ?? ?? ?    ?? ?? ? ?   ? ??? ?? ??   ?  ? ?? ????~??~<?<?    ? < < ? < > ?> ??> ?? ? ? ? ?? ????? ??    ? ?? ?!??!??!?! ?!  `?" " "   ?" 0? # |  # ? |  # ? #  !$  !$ !$?!$ "%? "%"%?"%?#&?#&#&?$&$'$'?$' %(? %(? ?%(&)&)?&)'*?'* ?'*? (+ (+ ?(, ),),*-*-*.+.,/,/,0 -0 -1 .2/2/3041415 ?26 38 ?496<9x# % '  C(#|%c%%%|&&%|%cFOREWORD X A7-) xddE1xA 2 #&&&|&-##%y%&&L#,@0AZ"Arial Regular U 3C)  A7-) xdEWxA X %c%%%&&%%cJune1996NN(#U.S.CustomsServiceAISSecurityPolicyManual#&&&&q##%y%&&#Ԉ g ,@0AZ"Arial Regular   *  A7-) xdEWxA X %c%%%&&%%cU.S.CustomsServiceAISSecurityPolicyManualB(#June1996#%c%&&#&&%%c#&&&&q#&&&&Ԉ g #&&&&_##%y%&&#,@0AZ"Arial Regular '  2%c%%%88C(#CONTENTS#%y%%2%c#Ԉ X A7-) xd^E1xA M(  %c%%%CONTENTS#%y%%%c# X A7-) xdE1xA '  ?(#K%c%%%INTRODUCTION#%y%%K%c-#Ԉ X A7-) xdE1xA M(  %c%%%INTRODUCTION#%y%%%c# X A7-) xdE1xA !  %%XX7NpQNdd7%%%>%%%%]%      &&%%Z&&@  #&&ZF#xx&&AUTOMATEDINFORMATION X @SYSTEMSSECURITYPOLICY#&&xx# &&  0 j>6&"`x0   `(El  ! Vj ! ! (#(# ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  ! ! ! !  (#(#! ! @77#CISHB140005 "  @&June1996@@  D  B$! DepartmentoftheTreasury'(#OfficeofInformationandTechnology *(# UnitedStatesCustomsServicexx(#AutomatedInformationSystemsSecurityDivision#&& 3#Ԉ  +)$v   @*  J 2 %{%%d%%~%%%%%%%  C(#&&Foreword#&&#Ԉ X A&-) xdE7xA 8 TheU.S.CustomsService,OfficeofInformationandTechnologyAutomatedInformationSystems(AIS)SecurityPolicyManualisintendedforthosewhouseCustomsAISservicesandsystems.InformationthroughoutthemanualsupportstheCustomsmissionbyprovidingdirectionandguidancetoprotectAISresources.Itestablishesuniformpolicies,responsibilities,andauthoritiesforcarryingouttheCustomsAISSecurityProgram.Securityisprovidedforinformationthatiscollected,processed,transmitted,stored,ordistributedforallotheragenciesutilizingCustomsgeneralsupportsystemsandmajorapplications.ThishighlevelpolicymanualsupplementstheAISsecuritypoliciesestablishedbytheU.S.DepartmentoftheTreasury,andisconsistentwithgovernmentwidepolicies,standards,andproceduresissuedbytheOfficeofManagementandBudget%%OEOffice of Management and BudgetO%%,theDepartmentofCommerce,theGeneralServicesAdministration,andtheOfficeofPersonnelManagement%%MCOffice of Personnel ManagementM%%.Additionaldetailedandspecificproceduralguidelines,particulartoCustomsneedsandrequirements,willbeissuedinaniterativefashion,asappropriate.Priorreleasesofthismanual(CISHB140004)aresuperseded.%y%&&AdditionalcopiesmaybeobtainedbysubmittingCustomsFormCF205toU.S.CustomsService, ' Printing&MailTeam,1301ConstitutionAvenue,NW,RoomB338,Washington,DC20229.NonCustomsFederalandcivilagencies,organizations,andmembersofthetradecommunity%%/%trade community/%%maycontacttheirCustomsrepresentative,orobtainthemanualviatheInternet%%!Internetu!!Internetu!%%fromCustomsWorldWideWeb%%-#World Wide Web-%%(WWW)pageontheNationalTechnicalInformationService(NTIS)FedWorld,at   http://fedworld.gov ,asavailable. i #&&%%y #TheU.S.CustomsServicewishestoextendspecialthankstotheFederalBureauofInvestigation%%OEFederal Bureau of Investigation@O%%,InformationSystemsSecurityUnit,forvaluableinputwhichprovidedthebasisforthedevelopmentofthisdocument,totheNationalSecurityAgency%%A7National Security AgencyaA%%fortheirreviewandsuggestions,andtotheU.S.DepartmentoftheTreasury,OfficeofInformationSystemsSecurity,fortheiroversight%%#oversightc#%%andguidance.0  0` (#(#0 ` (#` (#0 (# (#0h(#(#0h(#h(#(original%signd%%signed%byGeorgeJ.Weise) (#(# 0  0` (#(#0 ` (#` (#0 (# (#0h(#(#0h(#h(#0(#(#Commissioner%%)Commissioneri)%% (#(# Distribution%%)Distributioni)%%:G-25  "Y %    @*  J  %{%%{%%%%%    HP@@TT"&&Contents X A&-) xdE7xA###&&# 8 5%  #  #0     INTRODUCTION#4"4"H(#., , (#(##%%%%%%11%%%%%%#݌ m Ќ  $  $0  0` (#(#    1.10` ` (#` (#PURPOSE#4"4"H(#. ` (#` (##%%%%%%11%%%%%%$ ݌ G Ќ  $  $0  0` (#(#    1.20` ` (#` (#REFERENCES#4"4"H(#. ` (#` (##%%%%%%11%%%%%%$.݌ !  Ќ  $  $70  0` (#(#    1.30` ` (#` (#DEFINITIONS#4"4"H(#. ` (#` (##%%%%%%11%%%%%%$7R݌   Ќ  $  $\0  0` (#(#    1.40` ` (#` (#SCOPE#4"4"H(#. ` (#` (##%%%%%%11%%%%%%$\w݌  }  Ќ  $  ${0  0` (#(#    1.50` ` (#` (#BACKGROUND#4"4"H(#.nn` (#` (##%%%%%%12%%%%%%${݌  W  Ќ  $  $0  0` (#(#    1.6 ` INFORMATIONSECURITYPOLICYANDGUIDANCEHIERARCHY#4"4"H(#.::F` (#` (##%%%%%%16%%%%%%$݌  1  Ќ  #  #0     GENERALPOLICY#4"4"H(#. (#(##%%%%%%21%%%%%%#݌ =  Ќ  $  $ 0  0` (#(#    2.10` ` (#` (#GENERALPOLICYSTATEMENT#4"4"H(#.,` (#` (##%%%%%%21%%%%%%$ ݌   Ќ  $  $"0  0` (#(#    2.20` ` (#` (#ROLESANDRESPONSIBILITIES#4"4"H(#..` (#` (##%%%%%%21%%%%%%$"."݌   Ќ  #  #G#0     AISSECURITYLIFECYCLE#4"4"H(#. !(#(##%%%%%%31%%%%%%#G#b#݌ M Ќ  $  $N$0  0` (#(#    3.10` ` (#` (#SECURITYPLANNING#4"4"H(#.%` (#` (##%%%%%%31%%%%%%$N$i$݌ ' Ќ  %  %y%0  0` (#(#0 ` (#` (# `   3.1.10 (# (#Approvals#4"4"H(#." (# (##%%%%%%31%%%%%%%y%%݌ Y Ќ  %  %&0  0` (#(#0 ` (#` (# `   3.1.20 (# (#AISSecurityPlan#4"4"H(#.* (# (##%%%%%%32%%%%%%%&&݌ 3 Ќ  %  %'0  0` (#(#0 ` (#` (# `   3.1.30 (# (#DisasterRecoveryandContingencyOperationsPlanning#4"4"H(#.^^N (# (##%%%%%%33%%%%%%%'(݌   Ќ  $  $X)0  0` (#(#    3.20` ` (#` (#SECURITYREQUIREMENTS#4"4"H(#.)` (#` (##%%%%%%34%%%%%%$X)s)݌  Ќ  %  %*0  0` (#(#0 ` (#` (# `   3.2.10 (# (#PolicyDerivedRequirements#4"4"H(#.TT4 (# (##%%%%%%34%%%%%%%**݌ i Ќ  %  %+0  0` (#(#0 ` (#` (# `   3.2.2 RiskManagement#4"4"H(#.( (# (##%%%%%%35%%%%%%%++݌ C Ќ  $  $ -0  0` (#(#    3.30` ` (#` (#DEVELOPMENT#4"4"H(#.` (#` (##%%%%%%36%%%%%%$ -$-݌ u Ќ  $  $..0  0` (#(#    3.40` ` (#` (#CERTIFICATIONANDACCREDITATION#4"4"H(#.3` (#` (##%%%%%%36%%%%%%$..I.݌ O Ќ  %  %g/0  0` (#(#0 ` (#` (# `   3.4.10 (# (#Certification#4"4"H(#.^^& (# (##%%%%%%37%%%%%%%g//݌ ) Ќ  %  %00  0` (#(#0 ` (#` (# `   3.4.20 (# (#Accreditation#4"4"H(#.& (# (##%%%%%%38%%%%%%%00݌  Ќ  $  $10  0` (#(#    3.50` ` (#` (#PROCEDURESANDPRACTICES#!!G(#.,` (#` (##%%%%%%310%%%%%%$11݌  Ќ  $  $30  0` (#(#    3.60` ` (#` (#EDUCATION,TRAINING,ANDAWARENESS#!!G(#.&&6` (#` (##%%%%%%310%%%%%%$3/3݌ _ Ќ  $  $Q40  0` (#(#    3.70` ` (#` (#SECURITYOVERSIGHT#!!G(#.,,&` (#` (##%%%%%%311%%%%%%$Q4l4݌ 9 Ќ  #  #~50     MINIMUMSECURITYREQUIREMENTS#4"4"H(#.'(#(##%%%%%%41%%%%%%#~55݌ E! Ќ  $  $60  0` (#(#    4.10` ` (#` (#FACILITYSECURITY#4"4"H(#.jj%` (#` (##%%%%%%41%%%%%%$66݌  " Ќ  %  %70  0` (#(#0 ` (#` (# `   4.1.10 (# (#Physical#4"4"H(#.&&! (# (##%%%%%%41%%%%%%%77݌  # Ќ  %  %80  0` (#(#0 ` (#` (# `   4.1.20 (# (#Environmental#4"4"H(#.& (# (##%%%%%%42%%%%%%%8 9݌ !{$ Ќ  $  $+:0  0` (#(#    4.20` ` (#` (#PERSONNELSECURITY#4"4"H(#.JJ&` (#` (##%%%%%%42%%%%%%$+:F:݌ "U % Ќ  $  $W;0  0` (#(#    4.30` ` (#` (#AUTOMATEDSECURITY#4"4"H(#.&` (#` (##%%%%%%43%%%%%%$W;r;݌ #/!& Ќ  %  %<0  0` (#(#0 ` (#` (# `   4.3.10 (# (#MinimumSecurityRequirements#4"4"H(#.hh6 (# (##%%%%%%43%%%%%%%<<݌ a$ "' Ќ  %  %=0  0` (#(#0 ` (#` (# `   4.3.20 (# (#SecurityAssurances#4"4"H(#., (# (##%%%%%%45%%%%%%%==݌ ;%"( Ќ  %  %?0  0` (#(#0 ` (#` (# `   4.3.30 (# (#DesirableSecurityFeatures#4"4"H(#.4 (# (##%%%%%%47%%%%%%%?.?݌ &#) Ќ  $  $^@0  0` (#(#    4.40` ` (#` (#ADMINISTRATIVESECURITY#4"4"H(#.DD+` (#` (##%%%%%%47%%%%%%$^@y@݌ &$* Ќ  %  %A0  0` (#(#0 ` (#` (# `   4.4.10 (# (#AccountabilityandAccessControlCriteria#4"4"H(#.ZZC (# (##%%%%%%47%%%%%%%AA݌ 'q%+ Ќ  %  %B0  0` (#(#0 ` (#` (# `   4.4.20 (# (#SoftwareandDataSecurity#4"4"H(#.3 (# (##%%%%%%48%%%%%%%BC݌ (K&, Ќ  %  %3D0  0` (#(#0 ` (#` (# `   4.4.30 (# (#TechnicalSupportandMaintenance#4"4"H(#.::: (# (##%%%%%%49%%%%%%%3DND݌ })%'- Ќ  %  %E0  0` (#(#0 ` (#` (# `   4.4.40 (# (#PortableComputerEquipment#!!G(#.4 (# (##%%%%%%410%%%%%%%EE݌ W*'. Ќ  %  %F0  0` (#(#0 ` (#` (# `   4.4.50 (# (#ClassificationandControls#!!G(#.4 (# (##%%%%%%410%%%%%%%FF݌ 1+(/ Ќ  %  %H0  0` (#(#0 ` (#` (# `   4.4.60 (# (#ExternalLabels#!!G(#.NN( (# (##%%%%%%411%%%%%%%H7H݌  ,)0 Ќ  %  %\I0  0` (#(#0 ` (#` (# `   4.4.70 (# (#CustomsWorkPerformedatnonCustomsLocations#!!G(#.00H (# (##%%%%%%411%%%%%%%\IwI݌ ,*1 Ќ  %  %J0  0` (#(#0 ` (#` (# `   4.4.80 (# (#UseofNonCustomsOwnedAISs#!!G(#.6 (# (##%%%%%%412%%%%%%%JJ݌ -g+2 HP    ь  $  $6L0  0` (#(#    4.50` ` (#` (#TELECOMMUNICATIONSSECURITY#!!G(#./` (#` (##%%%%%%412%%%%%%$6LQL݌   Ќ  %  %lM0  0` (#(#0 ` (#` (# `   4.5.10 (# (#InformationSystemStandards#!!G(#.5 (# (##%%%%%%412%%%%%%%lMM݌  Ќ  %  %N0  0` (#(#0 ` (#` (# `   4.5.20 (# (#NetworkConnections#!!G(#., (# (##%%%%%%412%%%%%%%NN݌  Ќ  %  %O0  0` (#(#0 ` (#` (# `   4.5.40 (# (#ElectronicMail(EMail)#!!G(#.1 (# (##%%%%%%413%%%%%%%OP݌  Ќ  %  %FQ0  0` (#(#0 ` (#` (# `   4.5.50 (# (#Facsimile(FAX)#!!G(#.( (# (##%%%%%%413%%%%%%%FQaQ݌ qh Ќ  %  %R0  0` (#(#0 ` (#` (# `   4.5.60 (# (#PBXandVoiceMailSystems#!!G(#.ff3 (# (##%%%%%%414%%%%%%%RR݌ KB Ќ  %  %S0  0` (#(#0 ` (#` (# `   4.5.70 (# (#CommunicationsSecurity(COMSEC)#!!G(#.9 (# (##%%%%%%414%%%%%%%SS݌ %  Ќ  #  #"U0     SECURITYINCIDENTSANDVIOLATIONS#4"4"H(#.+(#(##%%%%%%51%%%%%%#"U=U݌   Ќ  #  #3V0     GLOSSARY#8!8!E(#.pp(#(##%%%%%%Glos1%%%%%%#3VNV݌    Ќ  #  #.W0     BIBLIOGRAPHY#!!F(#. (#(##%%%%%%Bib1%%%%%%#.WIW݌ A8  Ќ  $  $,X0  0` (#(#    SelectedReadings#!!F(#.L L ` (#` (##%%%%%%Bib5%%%%%%$,XGX݌   Ќ  #  #HY0     APPENDIXA AbbreviationsandAcronyms# " "H(#.ff)(#(##%%%%%%A1%%%%%%#HYcY݌   Ќ  #  #pZ0     APPENDIXB GoodSecurityPractices#""H(#.&(#(##%%%%%%B1%%%%%%#pZZ݌ ;2 Ќ  #  #[0     APPENDIXC ControlledAccessProtection(C2)Outline#""H(#.``8(#(##%%%%%%C1%%%%%%#[[݌  Ќ  #  #\0     APPENDIXD SecurityPlanFormat#""H(#.B B #(#(##%%%%%%D1%%%%%%#\\݌ [R Ќ  #  #]0     APPENDIXE ComputerSecurityTraining#""H(#.(()(#(##%%%%%%E1%%%%%%#] ^݌  Ќ  #  #_0     APPENDIXF SecurityRequirementsMethodology#$"$"H(#.0(#(##%%%%%%F1%%%%%%#_1_݌ {r Ќ  #  #E`0     APPENDIXG OMBCirculars# " "H(#. (#(##%%%%%%G1%%%%%%#E```݌  !" Ќ  %  %`a0  0` (#(#0 ` (#` (# `   OMBCircularNo.A123,Introduction&Comments# " "H(#.C (# (##%%%%%%G1%%%%%%%`a{a݌ !# Ќ  %  %b0  0` (#(#0 ` (#` (# `   CircularNo.A123,Revised# " "H(#.  0 (# (##%%%%%%G7%%%%%%%bb݌ "$ Ќ  %  %c0  0` (#(#0 ` (#` (# `   OMBCircularNo.A130,AppendixIII,Revised#!!G(#.""B (# (##%%%%%%G16%%%%%%%cc݌ #% Ќ  #  #e0     INDEX# D(#.(#(##%%%%%%Index1%%%%%%#e:e݌ O%F!' Ќ  #  #f0     ReadersCommentForm#B(#.  (#(##%%%%%%Comment1%%%%%%#f3f݌ '") Ќ  %  ($+ %HP    % u 7NNXXdNd7+  %%%%%%%%&&&&B(#&&"CHAPTER1#"h##&&h#Ԉ X ?(#&&'  INTRODUCTION i#'i##&&xi#Ԉ 8 A&-) xdExA    1.10  PURPOSE j A(#(# 0  Thisdocumentestablishesuniformpolicies,responsibilities,andauthoritiesforimplementingtheU.S.CustomsService,fromnowoncalled Customs ,AutomatedInformationSystems(AIS) '  SecurityProgram.ItpromotestheCustomsmissionandprovidesguidancetoprotectCustomsAISresourcesandassureadequatesecurity%%3)adequate security&3%%forallagencyinformationcollected,processed,transmitted,stored,ordisseminatedinitsgeneralsupportsystemsandmajorapplications. (#(# 0  CustomsAISsecuritypoliciesareconsistentwithgovernmentwidepolicies,standards,andproceduresissuedbytheOfficeofManagementandBudget%%OEOffice of Management and Budget@O%%(OMB),theDepartmentofCommerce,theGeneralServicesAdministrationandtheOfficeofPersonnelManagement%%MCOffice of Personnel ManagementM%%(OPM%% OPMe%%).Ataminimum,theCustomsAISSecurityProgramincludesthesetofcontrolsestablishedbyOMBCircularA130%%A130o%%,AppendixIII,SecurityofFederalAutomatedInformationResources,dated } February8,1996. (#(#   1.20  REFERENCES vp c (#(# 0  TheBibliographycontainsspecificreferencecitationsusedintheAISSecurityPolicyManual,andSelectedReadingreferenceswhichsupportthepolicies. (#(#   1.30  DEFINITIONS q M(#(# 0  AppearintheGlossary. (#(#   1.40  SCOPE *r  (#(# 0  ThispolicymanualsupplementstheAISsecuritypoliciesestablishedbytheU.S.TreasuryDepartmentandpresentedintheTreasurySecurityManual,TDP7110.C(#(# 0  (1)0` (#(#Inclusions:PolicyprovisionsapplytoallCustomspersonnel,contractorsactingfor O ! Customs,andallauthorizeduserswhoaccessCustomsAISs,networks%%!networksP!%%,andsupportfacilities.PolicyprovisionsalsoapplytononCustoms%%'nonCustoms'%%organizations,ortheirrepresentatives,whoaregrantedaccesstoCustomsAISresources,includingothergovernmentagenciesandmembersofthetradecommunity%%/%trade community/%%. ` (#` (#   (2)0 ` Exclusions:Microprocessorsembeddedinordedicatedtoproductionorprocesscontrol k%#' equipment(e.g.,testandlaboratoryequipment)arenotcoveredbythesepolicyprovisions. ` (#` (# 0  (3)0` (#(#Pointofcontact:DirectquestionsconcerningthispolicymanualtotheDirector%%!Directoru!%%,AIS ({&+ SecurityDivision,OfficeofInformationandTechnology,7681BostonBoulevard,Springfield,Virginia22153. #*/(-` (#` (# #  1.50  BACKGROUND 0x  (#(# 0  CustomsMission :[USCS96PLAN;USCSIRMPLAN](#(# 0  0a"0` (#(#  EnsurethatallgoodsandpersonsenteringorexitingtheUnitedStatesdosoincompliance ul withalltheUnitedStateslawsandregulation. ` (#` (# 0  0a"0` (#(#  Protectthepublicagainstviolations%%%violations%%%whichthreatenthenationaleconomyandhealthand )  safety. ` (#` (# 0  0a"0` (#(#  Bethenationalresourceforinformationongoodsandpersonscrossingourborders. ` (#` (# 0  Customsiscommittedtocarryoutitsmissionwithincreasingeffectivenessandefficiencyusinginformationtechnologyasanessentialsupportingelement.CustomsemployeesworldwideuseAISsforallfacetsofCustomsoperationsandtosupportlawenforcement,governmentagencies,andthecommercial%%%commercial%%%tradecommunity%%/%trade community/%%.TheseactivitiesfacilitateenforcementofUnitedStateslaws,andthecontrolandgenerationofsignificantfinancialrevenuetotheU.S.Treasury. (#(# 0  (1)0` (#(#AISSecurityProgramgoals: ` (#` (# 0  0` (#(# AllFederalapplicationsrequiresomelevelofprotection.Certainapplications,becauseofthesensitiveinformationinthem,however,requirespecialmanagementoversight%%#oversightn#%%andshouldbetreatedasmajor.Adequatesecurity%%3)Adequate security3%%forotherapplicationsshouldbeprovidedbysecurityofthesystemsinwhichtheyoperate.[OMBA130%%A130e%%,AIII] ` (#` (# 0  0` (#(#(a)0 ` (#` (#EstablishandmaintainadequateandeffectiveAISsecuritysafeguards  (countermeasures)toensuredataconfidentiality%%/%confidentiality/%%,integrity,andoperationalavailability%%)availabilityy)%%ofallCustomsAISsthatprocess,store,ortransmitnonsensitive,andsensitivebutunclassified%%E;sensitive but unclassified E%%(SBU%% SBUt%%,fromnowoncalled sensitive)information.  (# (# 0   ` (b)0 (#(#ThesecurityprogramisdesignedtoprotectAISprocessedinformationby: (# (# 0  0` (#(# (i)0` (#` (#denyingunauthorizedAISaccess;(#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#restrictinglegitimateuserstodataorprocessesforwhichtheyare MD  authorized;and (#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#controllingaccessbecauseofinadequatesecuritydesign,implementation, !# oroperation. (#(# 0   ` (c)0 (#(#AISsecuritysafeguardswillpreserveinformationprocessingintegrity,reliability i$` & andavailability%%)availabilityu)%%toensurethatthedataareaccurateandrelevanttoprovidelawenforcementandinvestigativesupport,helpachieveCustomsrevenuecollections,andmeetcommercial%%%commercial%%%andadministrativerequirements.Theapplication%%'application'%%ofCustomsAISsecuritypoliciesisevolutionary.Whenfullyimplemented,securityprogramswillconformtoanacceptablelevelofmandatedFederalrequirements.  (# (# 0   ` (d)0 (#(#Withinoperationalconstraints,AISsecuritycontrols%%3)security controlss3%%willallowrequiredAIS _*V&- servicestobeavailabletoauthorizeduserswhiledenyingtheseservicestounauthorizedusers.  (# (#   ,(0 & B  0  (2)0` (#(#Securityclassification%%-#classification-%%: ` (#` (# 0  0` (#(#(a)0 ` (#` (#AllFederaldata,applications,andAISsmustbeaffordedadequatesecurity%%3)adequate security3%%. (# (# 0  0` (#(#0 ` (#` (#[OMBA130%%A130e%%,AIII]  (# (# 'B S0  0` (#(#(b)0 ` (#` (#Unlessotherwisedesignated,Customsgeneralsupportsystemsandmajor KB applicationsareconsideredtocontainsensitiveinformation.  (# (# .0  0` (#(#(c)0 ` (#` (#Classified%%%Classifiedu%%%(nationalsecurity)informationpolicyandproceduresareaddressedin   SafeguardingClassified%%%Classified%%%InformationHandbook,CISHB140003.   (# (# 0  (3)0` (#(#Informationrelease:g ^ ` (#` (# 0  0` (#(#Thepublicreleaseofinformationiscontrolledbystatutes(FreedomofInformation%%=3Freedom of Information=%%Act(FOIA%%FOIAm%%),PrivacyAct%%'Privacy Actf'%%(PA),ElectronicCommunicationsPrivacyAct%%'Privacy Actf'%%,etc...).Regulationsalsocontrolthereleaseofsuchinformation,asdointeragencyagreements. ` (#` (# 0  0` (#(#[OMBA130%%A130 %%;TDP2504;TDP2505] ` (#` (# 0  (4)0` (#(#Policyapplication%%'applicationf'%%:]T` (#` (# 0  0` (#(#AISsecurityincludesapplicablesecuritylifecycle%%%lifecycle%%%requirements.AdditionalrelatedprogramsareincorporatedinthisdocumentbyreferenceandshouldbeconsideredwhenestablishingandreviewingAISsecurityrequirements.Theirapplicablepoliciesandproceduresmaybeobtainedviatheappropriateprogrammanagers. ` (#` (# 0  0` (#(#(a)0 ` (#` (# OfficeofInformationandTechnology(OIT) SJ (# (# 0  0` (#(#0 ` (#` (#TheOfficeofInformationandTechnologyisresponsibleforthedesign,development,programming,testing%%testing,%%,implementation,andmaintenance%%'maintenance'%%ofCustomsautomatedinformationsystems,andoversight%%#oversight#%%andmanagementoftheresearchanddevelopmentandcommunicationsfunctionsoftheCustomsService.TheOfficeisresponsibleformanagementofallCustomscomputerfacilities,hardware,software,dataandvoice%%voiceh%%telecommunications%%5+telecommunications5%%,andrelatedfinancialresources.Itisresponsibleforidentifyingandevaluatingnewtechnologiesforapplication%%'applicationt'%%toCustomsautomatedsystems;developingandmaintainingalloperationalaspectsofCustomscomputersecurityprogram;establishingrequirementsforcomputertocomputerinterfacesbetweenCustomsandvarioustradegroupsandgovernmentagencies;representingCustomsonmattersrelatedtoautomatedimportprocessingandsystemsdevelopment;andimplementingaviableInformationResourcesManagement(IRM%% IRMc%%)program.  (# (# 0  0` (#(#(b)0 ` (#` (# ApplicationsDevelopmentDivision &") (# (# 0  0` (#(#0 ` (#` (#TheApplicationsDevelopmentDivisionisresponsibleforthedesign,development,programming,testing%%testing,%%,implementationandmaintenance%%'maintenance'%%ofCustomsautomatedinformationsystems.TheDivision,inconjunctionwiththeADPSteeringCommittee%%5+Steering Committee5%%,isresponsibleforapprovingprojectinitiation.Specifically,thisorganizationwillberesponsiblefor:providingsystemspecificsupportforusersonexistingapplicationsduringthetransitiontonewintegratedsystems;changecontrolandsoftwarerelease;andcorrectingsystemproblemsthatarise -)1 afterimplementation.Inaddition,theprojectteamsoperatingoutofthisDivisionareassignedfullresponsibilityfordevelopmentofnewsystemsandmajorenhancementstoexistingsystems.Theyaremultifunctionalandintegratedtoaddressbothsystemsdevelopmenteffortsandnewtechnologies.  (# (# 0  0` (#(#(c)0 ` (#` (# UserSupportServicesDivision KB (# (# 0  0` (#(#0 ` (#` (#TheUserSupportServicesDivisionisresponsibleforfunctionsthatdealdirectlywithfieldusersonadailybasis,includingtraining%%!training!%%activitiessupportingmainframeanddistributed/PC/LANapplications,supportoffieldequipment,includinginstallationofPCs,LANsandperipheralequipment,dataandvoice%%voiceg%%communicationlinesandcircuits;providinguserassistance,includingLANadministration;operationoftheCustomsHelpDesk;andsupportingallusersofCustomsautomatedsystems.  (# (# 0  0` (#(#(b)0 ` (#` (# AISSecurityDivision(AISS)   (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#Developssecuritypoliciesandstandards.(#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#ProvidesliaisonactivitiesforAISsecurityrelatedpolicies,issues,and ?6 products: (#(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  withinCustoms,h(#h(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  totheDepartmentofTreasuryandoutsideagencies,h(#h(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  tothetradecommunity%%/%trade community/%%,h(#h(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  tootherlawenforcementagencies,andxh(#h(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  toprivateorganizations.[Rh(#h(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#Managessecuritysoftwarepackages.(#(# 0  0` (#(#0 ` (#` (#(iv)0 (# (#AdministerssecurityaccesscontrolsforCustomsmainframesystems.(#(# 0  0` (#(#0 ` (#` (#(v)0 (# (#Providesassistanceandcertification%%+!certification+%%forCustomsAISusers.wn(#(# 0  0` (#(#0 ` (#` (#(vi)0 (# (#Coordinatesthedevelopmentofdisaster%%!disasteri!%%recovery%%!recoveryi!%%andcontingency%%'contingency'%%plans.+ "!(#(# 0  0` (#(#(c)0 ` (#` (# InformationResourcesManagementDivision(IRM%% IRM%%) !# (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#Developsguidelinesandstandardsforalldevelopmentalactivities.#%(#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#PerformsandcoordinatesIRM%% IRM%%reviews,andmonitorscorrectiveactions.K%B!'(#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#Providessecurityoversight%%#oversight:#%%.&")(#(# 0  0` (#(#0 ` (#` (#(iv)0 (# (#EvaluatesandplansCustomsAISresourcecapacityrequirements.($+(#(# 0  0` (#(#0 ` (#` (#(v)0 (# (#Coordinatesstrategicplanningefforts.g*^&-(#(# 0  0` (#(#0 ` (#` (#(vi)0 (# (#ConductsanalyticalstudiesasneededinsupportofallOITentities.,(/(#(# 0  0` (#(#0 ` (#` (#(vii)0 (# (#Providestechnologyassessments.-)1(#(# Ї0  0` (#(#0 ` (#` (#(viii)0 (# (#DevelopstheInformationSystemsPlan(ISP). (#(# 0  0` (#(#0 ` (#` (#(ix)0 (# (#PlansandcoordinatesmajorprocurementsforAISequipmentand  services. (#(# 0  0` (#(#0 ` (#` (#(x)0 (# (#ProvidesSystemsDevelopmentLifeCycle%%MCSystems Development Life Cycle5M%%(SDLC%%SDLCs%%)advice,assistance,and KB ensurescompliance. (#(# 0  0` (#(#(d)0 ` (#` (# SystemsOperationsDivision(OPS)   (# (# 0  0` (#(# ` (#` (# 0  0` (#(#0 ` (#` (#TheSystemsOperationsDivisionisresponsibleformanagingallnewandexistingCustomscomputerfacilities,hardwareandsoftware,andformanagingtherelatedfinancialresources.Itisresponsiblefordatabase%%#data base:#%%administration;systemsengineering;computeroperations;communicationssoftwaredesignandimplementation;andmanagementoftheCustomsDataCenterfacility%%!facility!%%.  (# (# 0  0` (#(#(e)0 ` (#` (# SecurityProgramsDivision%%E;Security Programs Division@E%%(SPD%% SPD%%)   (# (# 0  0` (#(#0 ` (#` (#TheSecurityProgramsDivision%%E;Security Programs DivisionE%%prescribespolicy,procedures,andspecificationsformaintainingCustomspersonnelsecurityprograms.  (# (# 0  0` (#(#0 ` (#` (#TheSecurityProgramsDivision%%E;Security Programs DivisionE%%,SecurityManagementBranchisresponsibleforfacility%%!facilityr!%%andindustrialsecurityprograms.  (# (# &  0  0` (#(#(f)0 ` (#` (# CommunicationsManagementDivision(CMD) x (# (# 0  0` (#(#0 ` (#` (#TheOfficeofInvestigations,CommunicationsManagementDivision,CommunicationsSecurityBranchsetspolicyforhandlingCustomscommunicationssecurity(COMSEC%%COMSEC%%)materialsandequipment,andestablishesstandardsandproceduresforgrantingauthorizationtoCustomsemployeesforaccessoruseofthosematerialsandequipment.TheyalsoevaluateandapproveAIScryptographyandcommunicationssecuritymeasures.[USCS430009]  (# (# '$0  0` (#(#(g)0 ` (#` (# OfficeofRegulationsandRulings(ORR) / &! (# (# 0  0` (#(#0 ` (#` (#TheOfficeofRegulationsandRulings,DisclosureLawBranch,setspolicyforCustomsFreedomofInformation%%=3Freedom of Information=%%ActandPrivacyAct%%'Privacy Actf'%%(FOIA%%FOIAy%%/PA)programs.  (# (# 0  0` (#(#0 ` (#` (#[TDP2504;TDP2505]  (# (# 0  0` (#(#& F (h)0 ` (#` (# OfficeofChiefCounsel O%F!' (# (# 0  0` (#(#0 ` (#` (#TheOfficeofChiefCounselprovideslegaladvicetoallCustomsOfficesonCustomsenforcementauthoritiesandrelatedsubjects.  (# (# 'FO%  ($+   1.6  INFORMATIONSECURITYPOLICYANDGUIDANCEHIERARCHY     Thefollowingisforgeneralinformationpurposes.ItiscopiedfromIntroductiontoCertification%%+!Certification8+%%and  Accreditation%%+!Accreditation8+%%.[NCSCTG029]  Securitypolicyexistsatdifferentlevelsofabstraction.Federalandnationallevelpolicyisstatedinpubliclaws,ExecutiveOrders(EO),NationalSecurityDirectives(NSD),NationalSecurityTelecommunications%%5+Telecommunications5%%andInformationSystemsSecurity(NSTISS)issuances,FederalInformationProcessingStandardPublications(FIPSPUBS),OfficeofManagementandBudget%%OEOffice of Management and Budget O%%(OMB)circulars,andotherresources.FederalserviceandagencypoliciesinterpretDepartmentofDefense(DoD)andnationallevelpolicies,asappropriate,andmayimposeadditionalrequirements.%o9)%p p0 & `.pE/x8x<Za o (#(#                     (#(#%%o9)%p p0 & `.pE/x8x<Za o%*0  TEMPEST%%TEMPEST %%generallyappliestoclassified%%%classified8%%%informationandisnotaddressedinthismanual.Itrefers # ! controlofelectronicemanationsandisnotauthorizationtouseclassified%%%classified8%%%data.TEMPEST%%TEMPESTd%%issuesshouldbedirectedtotheTreasuryOfficeofInformationSystemsSecurity. (#(# 0  [TDP7110;HB140003] (#(# ManynationalandFederalsecuritypolicydocumentsexistthatapplytobothcivilanddefenseagencies.Currentoverallsecuritypolicydoesnotreflectaninterdependent,cohesivecollectionofsecuritydisciplines.Thisproliferationofpolicymakesitdifficultforsecuritypersonneltokeepupwiththechangesandbeawareofalltheapplicablepoliciesforagivensystem.Rapidlychangingtechnologyalsomakesitdifficultforpolicytokeepupwithnewsecuritychallengescausedbyadvancesincapabilitiesandtechnology.  )x%,   %W%%%%X%%%)+&&(  7NNXXdNXXd7CHAPTER2 X   GENERALPOLICY #(4##&&# 8 SA&-) xdExA    2.10  GENERALPOLICYSTATEMENT  A(#(# 0  (1)0` (#(#ACustomsAISisanyautomatedinformationortelecommunications%%5+telecommunications5%%systemowned, M  leased,oroperatedbyorforCustoms. ` (#` (#   (2)0 ` Customswillimplementatleasttheminimumsecurityrequirementsasidentifiedinthis   policy,toprotectAISresourcesandinformation(nonsensitiveandsensitivedata)processed,stored,ortransmittedbyCustomsAISs.Basedonriskmanagement%%/%risk managements/%%,theymayapplyadditionalsafeguardstoprovidethemostrestrictivesetofcontrols(privileges)thatpermittheperformanceofauthorizedtasks(principleofleastprivilege).[TDP7110] ` (#` (#   (3)0 ` SensitiveinformationinCustomsAISsmustbesafeguardedagainstunauthorized  disclosure,modification,access,use,destruction,ordelayinservice. ` (#` (# 0  0` (#(#[USCS1460010] ` (#` (#   (4)0 ` AllAISsprocessing,storing,ortransmittingsensitiveinformationmustbeaccredited._` (#` (# 0  0` (#(#[TDP7110] ` (#` (#   (5)0 ` ConnectivityisprohibitedbetweenCustomsAISswhichhandlesensitivedataandany  othersystemsornetworks%%!networkse!%%notunderCustomsauthority%%#authoritym#%%,unlessformallyapprovedbyanappropriateCustomsAccreditingAuthority%%#Authoritym#%%.[USCS550007] ` (#` (# 0  (6)0` (#(#AllCustomsAISsareforofficialCustomsbusinessonlyandusershavenoexpectationof U privacywhileusingtheseresources.[USCS550007] ` (#` (#   (7)0 ` Allpersonswhouse,manage,operate,maintain,ordevelopCustomsAISs,applications,  ordatamustcomplywiththesepolicies. ` (#` (#   2.20  ROLESANDRESPONSIBILITIES  q (#(# 0  CustomsperformsAISSecuritythroughavarietyofroleswithspecificresponsibilities. (#(# 0  ThegeneralAISSecurityorganizationisshowninFigure2.CustomsAISSecurityOrganization. (#(# 0  (1)0` (#(# Commissioner%%)Commissioner&)%%ofCustoms responsibilities:#[!%` (#` (# %C L<8xx C< p @ PddddEL %zttk%X~ (#(#%%CL<8xx C< p @ PddddEL %zttk%X~% (#(#0  0` (#(#(a)0 ` (#` (#AnnuallycertifytheadequacyofCustomsAISSecurityProgramtothe */(- DepartmentoftheTreasury.  (# (#   ;,)/ &   0   ` (b)0 (#(#EnsurethataviableCustomsAISsecurityeducation%%#education#%%,training%%!training!%%,andawareness%%#awareness#%%   programisestablished.'   (# (# 0   ` (c)0 (#(#EnsurethatCustomsAISSecurityPlan%%+!Security Plan8+%%documentationisdevelopedand  maintainedaccordingtoTreasuryandFederalstandards.  (# (# 0   ` (d)0 (#(#DesignateAccreditingAuthorities(AA)forsensitiveCustomsAISs.%  (# (# 0  0` (#(#(e)0 ` (#` (#Designateanoversight%%#oversighta#%%authority%%#authoritya#%%forreviewandvalidationoftheAISSecurity   Program.  (# (# 0  0` (#(#(f)0 ` (#` (#DelegatetoHeadquartersandfieldmanagerstheresponsibilityforassigninglocal g ^  AISsecurityofficers,DesignatedSecurityOfficer(DSO).A8  (# (# %m 17'#p 0  `,'ExBW&d  m (#(#                                   (#(#%%m 7'#p 0  `,'ExBW&d  m% -)1 0  (2)0` (#(#The ADPSteeringCommittee %%5+Steering Committee5%%, SecuritySubcommittee responsibilities: ` (#` (# %CEL<8xx Cr p @ PddddEL YttX (#(#%%CL<8xx Cr p @ PddddEL YttX% (#(#0  0` (#(#(a)0 ` (#` (#Providegeneraloversight%%#oversight#%%authority%%#authority#%%fortheAISSecurityProgram.)  (# (# 0  0` (#(#(b)0 ` (#` (#ConductindependentreviewsoftheAISSecurityProgramandassurecompliance   withFederalandTreasurypolicies.  (# (# 0  0` (#(#(c)0 ` (#` (#ReporttheAISsecurityposturestatustotheCommissioner%%)Commissioner)%%.k b  (# (# 0  (3)0` (#(# AssistantCommissioner %%)Commissioner&)%%,OIT,responsibilities: ` (#` (# %CJL<8xx 5` p @ PddddE> ]p ttvX  vv(#(#%%CL<8xx 5` p @ PddddE> ]p ttvX % (#(#vv0  0` (#(#(a)0 ` (#` (#EnsurethatanoperationalAISsecurityprogramisinplacewhichprovidesa  centrallyadministeredsecuritypolicy.TheAISSecurityprogrammustcomplywithatleasttheminimumsecurityrequirementsdefinedbyTreasuryandotherFederalmandates,andpreservetheoperationalflexibilitynecessarytoCustoms.  (# (# 0  0` (#(#(b)0 ` (#` (#AccreditsensitiveCustomsAIS(generalsupportsystemsandmajorapplications). QH  ThisresponsibilityissharedwithProcessOwners.  (# (# 0  0` (#(#(c)0 ` (#` (#ImplementCustomsAISSecurityeducation%%#education#%%,training%%!training!%%,andawareness%%#awareness#%%program.!# (# (# 0  0` (#(#(d)0 ` (#` (#Establishadequateandeffectivemanagementaccountabilityandcontroltoensure #% theprotectionofAISresources.  (# (# 0  0` (#(#(e)0 ` (#` (#DesignateanAISSecurityOfficertodevelop,implement,andenforcetheAIS !&"( SecurityProgramtocomplywithC2%% C2e%%levelfunctionalsecurityrequirements.  (# (# 0  0` (#(#(f)0 ` (#` (#SupportAISsecurityauditsandreviews.($+ (# (# 0  (4)0` (#(#The Director%%!Director!%%,AISSecurityDivision ,responsibilities:c*Z&-` (#` (# %CGL<8xx BS p @ PddddEK +ttA+X (#(#%%CL<8xx BS p @ PddddEK +ttA+X%-)1 0  0` (#(#(a)0 ` (#` (#DevelopandpromotetheCustomsAISSecurityprogrampolicy,including:  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#InterpretpolicyrelatingtoAISsecurityfunctionsanddevelopunique  guidance,asneeded. (#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#Assistwithpolicycomplianceeffortsbyprovidingexplanationor KB clarificationofAISsecurityrelatedquestionsonissuesthatmayimpactCustomsmission. (#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#EnsuresecurityadministrationforsensitiveAIS,includinggeneralsupport    systemsandmajorapplications. (#(# 0  0` (#(#(b)0 ` (#` (#CoordinatetheDesignatedSecurityOfficers(DSOs)forsensitiveCustomsAISs, A8  andprovidethemguidanceandassistanceincarryingouttheirfunctions.  (# (# 0  0` (#(#(c)0 ` (#` (#Reviewandauthorizeacquisitions,incoordinationwiththeDSOs,andcertifythat   theacquisition%%'acquisition '%%specificationsincludeappropriateAISsecurityrequirementsfor:  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#AISinstallationfacility%%!facilityn!%%operations,equipment,orapplications.]T(#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#Acquisition%%'Acquisition '%%ofAIShardware,software,and/orrelatedservices.(#(# 0  0` (#(#(d)0 ` (#` (#Providedirectionandguidancetosystemdevelopersindefiningandapproving  softwaredevelopmentsecurityrequirements.  (# (# 0  0` (#(#(e)0 ` (#` (#Ensurethataccreditation%%+!accreditationX+%%packagesarepreparedforsensitiveCustomsAISsand SJ applications.  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#Provideguidanceonthescopeandcontentsofsecurityplans:(#(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  ReviewsecurityplanspreparedbyorfortheDSOs.h(#h(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  Preparestatementsofresidualrisk%%+!residual risk+%%andcompliancesummary,to  completeeachaccreditation%%+!accreditation+%%package. h(#h(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  Submittheaccreditation%%+!accreditation+%%packagetotheappropriateauthorities.I@ h(#h(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#ActasaliaisonforAISsecurityissuestotheInformationResources  " Management(IRM%% IRMd%%)andSecurityProgramsDivision%%E;Security Programs DivisionE%%(SPD%% SPDi%%)managers. (#(# 0  0` (#(#(f)0 ` (#` (#Maintainacurrentstatusonallrequiredaccreditation%%+!accreditationm+%%documentation.#% (# (# 0  0` (#(#(g)0 ` (#` (#EstablishandmaintainaRiskManagement%%/%Risk Management /%%program,includingriskassessments, ?%6!' forsensitiveCustomsAISresources,including:  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#AISfacilities.'#*(#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#GeneralsupportAISs.)x%,(#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#Majorapplications.5+,'.(#(# 0  0` (#(#(h)0 ` (#` (#ActastheliaisonforAISsecuritymatterstotheDepartmentoftheTreasury.,(0 (# (#  -)1 0  0` (#(#(i)0 ` (#` (#Reportcomputersecurityincidents%%5+security incidents5%%andviolations%%%violationsi%%%totheOITAssistant   Commissioner%%)Commissionere)%%(AC),ProcessOwners(PO),andOfficeofInternalAffairs%%1'Internal Affairs1%%(IA),asappropriate.  (# (# &  0  0` (#(#(j)0 ` (#` (#CoordinateCustomsAISVirus%%Virus%%Preventionprogram,including,recommending qh virus%%virus%%preventionsolutions,providingguidanceindefiningtherequirements,andselectingtheapproach.'q   (# (# 0  0` (#(#(k)0 ` (#` (#EstablishstandardsandprovideguidanceforthepreparationofAISDisaster%%!Disaster!%%   Recovery%%!Recovery!%%andContingency%%'Contingency'%%Operationsplansincluding,conductingofagencywideanalyses,andestablishingandverifyingstrategiesforbusinessrecovery%%!recoveryy!%%andalternateprocessing.ThisincludescoordinatingthedevelopmentofviableDisaster%%!Disastery!%%Recovery%%!Recoveryy!%%andContingency%%'Contingency'%%OperationsplansforCustomsAISfacilities.  (# (# 0  0` (#(#(l)0 ` (#` (#EstablishstandardsandprovideguidanceforpreparingEndUserAIS   Contingency%%'Contingency'%%plans.  (# (# 0  0` (#(#(m)0 ` (#` (#EnsurethatallinteractiveusersofCustomsAISmeetatleasttheminimum z standardsofeligibilityforaccess.[USCS1460010]  (# (# 0  0` (#(#(n)0 ` (#` (#ConductAISsecuritycompliancereviewandoversight%%#oversight#%%activities. (# (# 0  0` (#(#(o)0 ` (#` (#SupportareasorissuesrequiringAISsecurityrelatedresearchanddevelopment  effort.  (# (# 0  0` (#(#(p)0 ` (#` (#SupportAISsecurityauditsandreviews,providingassistanceasappropriate.SJ (# (# 0  (5)0` (#(# IRM%% IRMi%%manager responsibilities:` (#` (# 0  0` (#(#(a)0 ` (#` (#Ensuresecurityrelatedqualityassurancethroughoutthesoftwaredevelopment  life-cycle.  (# (# 0  0` (#(#(b)0 ` (#` (#CoordinatewithAISSecurityforreviewoftheSDLC%%SDLC%%documentsandactivitiesto MD  incorporatesecurityintodevelopedproducts.[TDP84-01]  (# (# 0  0` (#(#(c)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate.!# (# (# 0  (6)0` (#(# ProcessOwner %%+!Process Owner+%%(identifiedintheMajorApplication%%3)Major Application&3'Application'%%SecurityPlan%%+!Security Plan+%%)responsibilities:#%` (#` (# 0  0` (#(#[USCSPPP] ` (#` (# %C L<8xx _ p @ PddddEh &ttG%Xf (#(#%%CL<8xx _ p @ PddddEh &ttG%Xf% ,(0 &   0  0` (#(#(a)0 ` (#` (#AccreditassignedCustomsAISProcess(responsibilitysharedwiththeAssistant   Commissioner%%)Commissioner)%%,OIT).  (# (# ' 0  0` (#(#(b)0 ` (#` (#EstablishuserrequirementsandcontrolsthatconformtoCustomsSystem  DevelopmentLifeCycle(SDLC%%SDLCs%%)Handbook.[USCS550004]  (# (# 0  0` (#(#(c)0 ` (#` (#SpecifythatlocallydevelopedsensitiveAISproductscomplywithC2%% C2%%level %  functionalsecurityrequirements.  (# (# 0  0` (#(#(d)0 ` (#` (#Designateorensurethatinformationsensitivitylevelsareassignedforthe    informationprocessed,stored,ortransmittedbytheCustomsAISProcess.  (# (# 0  0` (#(#(e)0 ` (#` (#CoordinatewiththeCustomsOfficeofRegulationsandRulings,DisclosureLaw A8  Branch,topublisha"SystemofRecords"intheFederalRegisterforanyCustomsProcess%%/%Customs Process/%%thatcontainsPrivacyAct%%'Privacy Acts'%%data,asappropriate.[TDP2504]  (# (# 0  0` (#(#(f)0 ` (#` (#EnsurethatuseraccessrequirementsandcontrolsaredefinedfortheCustomsAIS   Process.  (# (# 0  0` (#(#(g)0 ` (#` (#Delegateuseraccessrequestauthorization.7. (# (# 0  0` (#(#(h)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate. (# (# 0  (7)0` (#(# Application%%'Applications'%%DevelopmentManager responsibilities:` (#` (# 0  0` (#(# ` (#` (# 0  0` (#(#Application%%'Application'%%developmentmanagers(bothOITanddevelopmentorganizationsexternaltoOIT)havedataownershipresponsibilitiesforapplication%%'application'%%relatedinformationprocessed,stored,created,manipulatedortransmittedbyand/orfortheapplication%%'application'%%,unlessdataownershipisotherwisedesignatedbyagreements,functions,and/orassignments. ` (#` (# %fC62"`x `EL GTttlXf (#(#%%fC2"`x `EL GTttlXf% (#(#0  0` (#(#(a)0 ` (#` (#EnsurethatlocallydevelopedAISproductscomplywithC2%% C2%%levelfunctional "$ securityrequirements.  (# (# 0  0` (#(#(b)0 ` (#` (#Ensurethatatleasttheminimumsecurityrequirementsmandatedbylaw,statute, C%:!' orregulationareincorporatedintoCustomsAISProcessapplications.  (# (# 0  0` (#(#(c)0 ` (#` (#AdheretoCustomsSystemDevelopmentLifeCycle(SDLC%%SDLCW%%)Handbook '#* developmentstandards.[USCS550004]  (# (# 0  0` (#(#(d)0 ` (#` (#Preparedocumentationforapplication%%'application'%%certification%%+!certificationW+%%andaccreditation%%+!accreditationW+%%packages._*V&- (# (# 0  0` (#(#(e)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate., (/ (# (#   ,(0 & F  0  (8)0` (#(# AISOwner %%#AIS Owner#%%responsibilities: ` (#` (# 0  0` (#(#(a)0 ` (#` (#OwnershipresponsibilitiesforsensitiveCustomsAISsareassignedtotheOffice  ofInformationandTechnology,unlessotherwiseidentified.  (# (# 'F +0  0` (#(#(b)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate.OF (# (# &  0  (9)0` (#(# AISSecurityAdministrator responsibilities: ` (#` (# %C=L<8xx 52 p @ PddddE> zttv Xt  vv(#(#%%CL<8xx 52 p @ PddddE> zttv Xt % (#(#vv0  0` (#(#(a)0 ` (#` (#ActastheprimarypointofcontactforAISsecurityissues.  (# (# ' /.0  0` (#(#(b)0 ` (#` (#Identifysecuritythreatsandestablishsafeguards(countermeasures)toprotect  CustomsAISresources.  (# (# 0  0` (#(#(c)0 ` (#` (#ImplementsecuritypolicyforAISresourcesforwhichCustomshasdirect  operationalresponsibility.  (# (# 0  0` (#(#(d)0 ` (#` (#EnsurethatallpersonnelreceiveappropriateAISsecuritytraining%%!training!%%. (# (# 0  0` (#(#(e)0 ` (#` (#AdministertheComputerSecurityIncidentReportingCapability(CSIRC%%CSIRCg%%) [R programincludingestablishingreportingcriteria,andcoordinatingwiththeOfficeofInternalAffairs%%1'Internal Affairs81%%(IA),asappropriate.  (# (# 0  0` (#(#(f)0 ` (#` (#ReporttotheAISSecurityOfficeranysecurityincidents%%5+security incidents5%%,suchasattemptstogain  unauthorizedaccesstoinformation,virus%%virusy%%infections,orothereventsaffectingAISsecurity,includingdamageassessmentsandactionstakentopreventfutureincidents,asappropriate.  (# (# 0  0` (#(#(g)0 ` (#` (#EnsurethatviableEndUserAISContingency%%'Contingencyd'%%Plansaredevelopedtoassure !" continuedoperationsofessentialAISfunctionsshouldanemergency%%#emergency#%%occur.  (# (# 0  0` (#(#(h)0 ` (#` (#CoordinatelocalAISSecurityAdministrators.#% (# (# 0  0` (#(#(i)0 ` (#` (#AdviseCustomsmanagementonimplementingprovisionsofthispolicyand G%>!' applicableguidelines.  (# (# 0  0` (#(#(j)0 ` (#` (#EnsureallAISoperationsareconductedasauthorizedintheaccreditation%%+!accreditationn+%%,orthat '#* certification%%+!certificationn+%%packagemodificationsarepreparedtoaccommodatethevariances.  (# (# 0  0` (#(#(k)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate.c*Z&- (# (# 0  (10)0` (#(#A DesignatedSecurityOfficer(DSO) mustbeassignedforeachsensitiveAIS,including ,(/ generalsupportsystemsandmajorapplications. ` (#` (#  -)1 0  0` (#(#DesignatedSecurityOfficer:TheCustomspersonresponsibletotheAAforensuringthat   securityisprovidedforandimplementedthroughoutthelifecycle%%%lifecycle%%%ofanAIS(fromconceptdevelopmentthroughdesign,development,operations,maintenance%%'maintenance '%%,anddisposalphases). ` (#` (# &  0  0` (#(#TheDSOresponsibilities: ` (#` (# 0  0` (#(#(a)0 ` (#` (#EnsurethatappropriatesecurityfeaturesareimplementedinnewsensitiveAISs %  andthattheymeetatleasttheminimumsecurityrequirementsdefinedinthispolicy.  (# (# 'q>0  0` (#(#0 ` (#` (#Reviewandauthorizeacquisitions,incoordinationwiththeAISSecurityOfficer,andcertifythatappropriateAISsecurityisincludedinthespecificationsfortheoperationofanAISinstallationfacility%%!facilitye!%%,equipment,orapplication%%'application '%%,andforacquisition%%'acquisition '%%ofAIShardware,software,orrelatedservices.  (# (# 0  0` (#(#(b)0 ` (#` (#Preparesite%%sitei%%certification%%+!certificationX+%%packagesinpreparationforaccreditation%%+!accreditationX+%%.  (# (# 0  0` (#(#0 ` (#` (#Certification%%+!CertificationX+%%relatedactivitiesinclude:  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#Conductdesignreviews,securitytests,andcertifytheresultswhen 7. securityrelevantchanges(hardware,software,firmware,etc.)aremade,toensurethattheaccreditation%%+!accreditationX+%%statusisnotaffected. (#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#IdentifyandrecommendAISsecurityimprovementstomanagement.(#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#Ensurethatconfigurationmanagement%%A7configuration managementA%%(CM)isusedandmaintainedto SJ protecttheAISsecurityrelatedfeatures. (#(# 0  0` (#(#(c)0 ` (#` (#Prepare,oroverseethepreparationof,AISsecurityplans,andmaintainrelated  documentationforeachAISundertheirpurview.  (# (# 0  0` (#(#(d)0 ` (#` (#Ensurethedistribution%%)distributionm)%%ofendusersecurityprocedurestailoredforadministrators, of andoperatorsofsensitiveAISs;advisingusersofthesecurityfeaturesandproceduresusedontheAISs.[USCS550004]  (# (# 0  0` (#(#(e)0 ` (#` (#CoordinatewiththeappropriateDSOsofotherAISs,processowners,application%%'application'%% !# developmentmanagers,andtheCustomsAISSecurityOfficertoensurethatplanningadequatelyaddressestheAISsecurityrequirements.  (# (# 0  0` (#(#(f)0 ` (#` (#Establish,incoordinationwithAISSecurityAdministration,accesscontrolcriteria ?%6!' andadministrativeproceduresconsistentwithCustomspolicy,bywhichonlyauthorizedpersonsgainaccesstotheAIS.  (# (# 0  0` (#(#(g)0 ` (#` (#Providesupportforaudit%%auditt%%trailreviewsandrelateddiscrepancyinvestigations.($+ (# (# 0  0` (#(#(h)0 ` (#` (#ReportimmediatelytoAISSecurityAdministration,anysecurityincident,such [*R&- asattemptstogainunauthorizedaccesstoinformation,virus%%virus%%infections,orothereventsorconditionswhichmayaffectAISsecurityaccreditation%%+!accreditation+%%.  (# (#   ,(0 & h  0  0` (#(#(i)0 ` (#` (#ConductperiodicsecurityreviewsofAISfacilitiesundertheirpurviewtoassure   safeguardsarecommensuratewiththeAISinformationbeingstored,processedortransmitted.  (# (# 'h N0  0` (#(#(j)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate.qh (# (# 0  (11)0` (#(# LocalAISSecurityAdministrator responsibilities:% ` (#` (# 0  0` (#(#(a)0 ` (#` (#Requestand/orgrantuseraccesstoAISbasedonmanagementauthorization.  (# (# 0  0` (#(#(b)0 ` (#` (#Removeormodifyuseraccessbasedonauthorizedrequestsofmanagement,    processowners,and/oradministrativeprocesses.  (# (# 0  0` (#(#(c)0 ` (#` (#Conductauthorizedreviewsoftheuseraccesstoassuretimelydetectionof   suspicious,inappropriate,orunauthorizedactivity.  (# (# 0  0` (#(#(d)0 ` (#` (#ReporttoDSOorAISSecurityAdministration,anysecurityincidents%%5+security incidents:5%%orother   eventsaffectingAISsecurity(e.g.,virus%%virusy%%infections,attemptstogainunauthorizedaccesstoinformation,suspicious,inappropriate,orunauthorizedactivity,etc.).  (# (# 0  0` (#(#(e)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate.  (# (# 0  0` (#(#(f)0 ` (#` (#SupportcomplianceofC2%% C2s%%levelfunctionalsecurityrequirementsforlocally  developedsensitiveAISproducts,asappropriate.  (# (# 0  (12)0` (#(# Facility%%!Facilityn!%%manager (orfunctionalequivalent)responsibilities:WN` (#` (# 0  0` (#(#(a)0 ` (#` (#Ensurethataphysicalinventoryismaintained(usuallybythelocalproperty  officer)ofallAISresourceswithintheirareaofresponsibility.  (# (# 0  0` (#(#(b)0 ` (#` (#Ensurethephysicalsecurity%%3)physical security&3%%andaccreditation%%+!accreditationt+%%ofthesensitiveAISfacility%%!facilityi!%%(site%%sitet%%). (# (# 0  0` (#(#0 ` (#` (#IncludedintheseresponsibilitiesareAISrelatedsafetyandsecurityactivities(e.g.,OccupantEmergency%%#Emergencyo#%%Plan,PhysicalSecurity%%3)Physical Security&3%%Plan%%+!Security Plant+%%,etc.).  (# (# 0  0` (#(#(c)0 ` (#` (#CoordinatewithappropriateDSOsanyAISsecurityrelevantfacility%%!facilityl!%%changes.!# (# (# 0  0` (#(#(d)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate.#% (# (# 0  (13)0` (#(# Manager and Supervisor responsibilities:G%>!'` (#` (# 0  0` (#(#(a)0 ` (#` (#EnsurethatsensitiveAISdataandresourceswithintheirareaofresponsibilityare &") properlyprotectedbyappropriatesecuritysafeguards.  (# (# 0  0` (#(#(b)0 ` (#` (#EnsurethatsubordinateshaveaccessonlytothoseAISapplicationsanddata )%, necessarytoperformauthorizedtasks(principleofleastprivilege).  (# (# 0  0` (#(#(c)0 ` (#` (#ReporttotheappropriateSecurityAdministratoranychangestoemployeeaccess ,(/ requirements.AlsocoordinatewithappropriatemanagementwhenemployeeormanagementtransfersoccurwhichmightaffectAISaccess.-)1 (# (# Ї0  0` (#(#(d)0 ` (#` (#ReviewemployeeAISaccessactivitytoensurecompliancetoAISsecurity   requirementsandprovidetimelydetectionofsuspicious,inappropriate,orunauthorizedactivity.  (# (# &  0  0` (#(#(e)0 ` (#` (#EnsurethataDSOisidentifiedforeachsensitiveAIS(orgroupoffacilities qh designatedasasensitiveAIS)usedbyemployeesundertheirmanagementauthority%%#authority#%%,aswarranted.'qa  (# (# 0  0` (#(#(f)0 ` (#` (#ReportAISsecurityrelatedchangesintheirownjobstatustotheresponsible   SecurityAdministrator.  (# (# 0   ` (g)0 (#(#EnsurethatproposedacquisitionsofsensitiveAISrelatedhardware,software, g ^  communications,applications,andequipmentsatisfyAISsecurityrequirementsandreceiveDSOconcurrencepriortoacquisition%%'acquisition '%%.  (# (# 0  0` (#(#(h)0 ` (#` (#EnsurethatsensitiveAISproductsdevelopedundertheirmanagementauthority%%#authority#%%   complywithC2%% C2o%%levelfunctionalsecurityrequirements.  (# (# 0  0` (#(#(i)0 ` (#` (#Ensurethatemployeesundertheirmanagementauthority%%#authority#%%receiveAISsecurity ]T training%%!training!%%relevanttotheirassignments,asrequiredbylaws,regulations,MOUs,orotheragreements.  (# (# 0  0` (#(#(j)0 ` (#` (#AttendAISsecuritytraining%%!training!%%asrequiredbylaws,regulations,MOUs,orother  agreements.  (# (# 0  0` (#(#(k)0 ` (#` (#AssistwithAISsecurityauditsandreviews,asappropriate.SJ (# (# 0  (14)0` (#(# User responsibilities:` (#` (# 0  0` (#(#(a)0 ` (#` (#ProtectaccessIDs,authenticationcodes(e.g.,passwords,personalidentification  numbers[PIN],encryption%%%encryption%%%codes,etc.)fromimproperdisclosure.  (# (# 0  0` (#(#(b)0 ` (#` (#AccessonlyauthorizedAISapplicationsanddatanecessarytoperformapproved MD  responsibilities.  (# (# 0  0` (#(#0 ` (#` (#DuetotechnicalcapabilityofsomeAIS,accessmightexceedauthority%%#authority#%%.Accesscapabilityhowever,doesnotequatetoauthority%%#authority#%%(e.g., casualbrowsingofdata "$ isnotpermitted ).#% (# (# 0  0` (#(#0 ` (#` (# ItisaviolationoflawforuserstoaccessU.S.GovernmentAISdatainexcess K%B!' oftheirauthorization.[18USC1030] %&"( (# (# 0  0` (#(#(c)0 ` (#` (#NotifysupervisorandAISSecurityAdministratorwhenAISaccessorauthority%%#authority)#%% '#* isnolongerrequiredfortheirauthorizedtasks.  (# (# 0  0` (#(#(d)0 ` (#` (#Applythesecuritycontrols%%3)security controlsg3%%requiredbyAISsecuritypoliciesandstandards.g*^&- (# (# 0  0` (#(#(e)0 ` (#` (#ComplywiththeprovisionsintheCustomsAISSecurityPolicymanual.,(/ (# (#   ,(0 &   0  0` (#(#(f)0 ` (#` (#AttendAISsecuritytraining%%!training!%%asrequiredbylaws,regulations,MOUs,orother   agreements.' q  (# (# 0  0` (#(#(g)0 ` (#` (#ProvideassistancewithAISsecurityauditsandreviewsasrequiredbylaws,  regulations,MOUs,orotheragreements,asappropriate.  (# (# 0  (15)0` (#(# Externalagencyuser responsibilities:% ` (#` (# 0  0` (#(#(a)0 ` (#` (#ComplywithU.S.GovernmentAISrelatedlawsandregulations.  (# (# 0  0` (#(#(b)0 ` (#` (#ComplywithinteragencyMOU%% MOU%%(MemorandumofUnderstanding)orotherformal    agreementsbetweenthemselvesandCustoms.  (# (# 0  0` (#(#0 ` (#` (#ExternalagenciesmustdesignateAISSecurityCoordinators.Theheadoftheexternalagency,ordelegate(asidentifiedinwriting),isresponsibleforensuring   thatemployeesandcontractorsundertheirauthority%%#authority#%%observeCustomsAISSecurityPolicyasidentifiedinthismanual.  (# (# 0  0` (#(#(c)0 ` (#` (#ProtectaccessIDs,authenticationcodes(e.g.,passwords,personalidentification aX numbers[PIN],encryption%%%encryption:%%%codes,etc.)fromimproperdisclosure.  (# (# 0  0` (#(#(d)0 ` (#` (#AccessonlyauthorizedAISapplicationsanddatanecessarytoperformapproved  activities.  (# (# 0  0` (#(#0 ` (#` (#DuetothetechnicalcapabilityofsomeAIS,accessmightexceedauthority%%#authority#%%.Accesscapabilityhowever,doesnotequatetoauthority%%#authority#%%(e.g., casualbrowsing WN ofdataisnotpermitted ).5, (# (# 0  0` (#(#0 ` (#` (# ItisaviolationoflawforuserstoaccessU.S.GovernmentAISdatainexcess  oftheirauthorization.[18USC1030]  (# (# 0  0` (#(#(e)0 ` (#` (#NotifyCustomsAISSecurityAdministratorwhenAISaccessorauthority%%#authority:#%%isno {r longerrequiredforapprovedtasks.  (# (# 0  0` (#(#(f)0 ` (#` (#Usethesecuritycontrols%%3)security controls3%%requiredbyAISsecuritypoliciesandstandards. !" (# (# 0  0` (#(#(g)0 ` (#` (#ComplywiththeprovisionsintheCustomsAISSecurityPolicymanual."$ (# (# 0  0` (#(#(h)0 ` (#` (#AttendAISsecuritytraining%%!trainingo!%%asrequiredbylaws,regulations,MOUs,orother q$h & agreements.  (# (# 0  0` (#(#(i)0 ` (#` (#ProvideassistancewithAISsecurityauditsandreviewsasrequiredbylaws, &") regulations,MOUs,orotheragreements,asappropriate.  (# (# 0  (16)0` (#(# Tradecommunity%%/%Trade community/%%user responsibilities:)%,` (#` (# 0  0` (#(#(a)0 ` (#` (#ComplywithU.S.GovernmentAISrelatedlawsandregulations;E+<'. (# (#   ,(/ & B  0  0` (#(#(b)0 ` (#` (#ComplywithanyformalagreementsgoverningaccesstoCustomsAISresources.  (# (# 0  0` (#(#0 ` (#` (#Tradecommunity%%/%Trade community/%%useraccesstoCustomsAISresourcesmustbeapprovedbytheappropriateCustomsAccreditingAuthoritiesandformallydocumented.  (# (# 'B 0  0` (#(#(c)0 ` (#` (#AccessonlyauthorizedAISapplicationsanddatanecessarytoperformapproved KB activities.  (# (# 0  0` (#(#0 ` (#` (#  (# (# 0  0` (#(#0 ` (#` (#AISaccesswillberestrictedtoauthorizeddataandprocesses.DuetothetechnicalcapabilityofsomeAIShowever,accessmightexceedauthority%%#authorityn#%%.Accesscapabilitydoesnotequatetoauthority%%#authorityn#%%(e.g., casualbrowsingofdataisnot    permitted ).k b  (# (# 0  0` (#(#0 ` (#` (# ItisaviolationoflawforuserstoaccessU.S.GovernmentAISdatainexcess #  oftheirauthorization.[18USC1030]   (# (# 0  0` (#(#(d)0 ` (#` (#ProtectaccessIDs,authenticationcodes(e.g.,passwords,personalidentification   numbers[PIN],encryption%%%encryption1%%%codes,etc.)fromimproperdisclosure.  (# (# 0  0` (#(#(e)0 ` (#` (#NotifyCustomsAISSecurityAdministratorwhenAISaccessorauthority%%#authority#%%isno ?6 longerrequiredforapprovedtasks.  (# (# 0  0` (#(#(f)0 ` (#` (#Usethesecuritycontrols%%3)security controls3%%requiredbyCustomsAISsecuritypoliciesandstandards. (# (# 0  0` (#(#(g)0 ` (#` (#ComplywiththeprovisionsintheCustomsAISSecurityPolicymanual.x (# (# 0  0` (#(#(h)0 ` (#` (#AttendAISsecuritytraining%%!trainingo!%%asrequiredbylaws,regulations,MOUs,orother 5, agreements.  (# (# 0  0` (#(#(i)0 ` (#` (#SupportCustomsAISsecurityauditsandreviewsasrequiredbylaws,regulations,  MOUs,orotheragreements.  (# (#     %YW %%W %%ZX %%X %[)  &&VCHAPTER3 X   AISSECURITYLIFECYCLE V#V##&&# 8 A&-) xddExA  Thissectiondocumentsactivitiesforacquisition%%'acquisition'%%anddevelopmentofAISandrelatedapplications.ItprovidesguidancetoensurethatsensitiveAISsandapplicationsaredeveloped,acquired,anddocumentedaccordingtoCustomspolicy.Topicsinclude:SecurityPlanning.SecurityplanningactivitiesaretheresponsibilityoftheappropriateCustomsProcess%%/%Customs Process/%%  ]  Owner%%+!Process Owner+%%,AISowner%%#AIS ownere#%%,ApplicationsDeveloper,DSO,andAISSecurityOfficer.Theseactivitiespertaintothedevelopmentoracquisition%%'acquisition'%%ofnewCustomsAISsandapplications,orchangestoexistingones.Certification%%+!Certification+%%andAccreditation%%+!Accreditation+%%.Certification%%+!Certification+%%andaccreditation%%+!accreditation+%%activitiesaretheresponsibilityofthe   appropriateAccreditingAuthorities(AAs),DSO,andtheAISSecurityOfficer.SecurityEducation%%#Educationo#%%,Training%%!Training!%%,andAwareness%%#Awarenesso#%%.Theseactivitiesareongoingandapplytoallpersonnelwho S manage,use,oroperateCustomsAISs,whetherornottheyareCustomsemployees.SecurityOversight%%#Oversighto#%%.TheAISSecurityOfficerconductspolicyrelatedsecurityoversight%%#oversighto#%%activitiesfor 9 ongoingdaytodayoperations.TheADPSteeringCommittee%%5+Steering Committee5%%,SecuritySubcommittee,isdesignatedastheoversight%%#oversight#%%authority%%#authority#%%forCustomsAISSecurityProgram.  3.10  SECURITYPLANNING _ I(#(# 0  Securityplanningactivitiessupporttheaccreditation%%+!accreditation8+%%ofallsensitiveCustomsAISs,includinggeneralsupportsystemsandmajorapplications.ThissectiondiscussestheprocessesforAISsecurityplanning,riskmanagement%%/%risk management/%%,disaster%%!disastere!%%recovery%%!recoverye!%%,contingency%%'contingencyn'%%operations,andthedocumentationrequiredtoachievecertification%%+!certification+%%andaccreditation%%+!accreditation+%%. (#(# 0  Priortothedevelopmentoracquisition%%'acquisition'%%ofsensitiveAISsandapplications,theAISSecurityOfficermustbeconsultedtoestablishthescopeofthesecurityrelatedactivitiesandnecessarydocumentation. (#(#   3.1.10  Approvals  !#(#(# 0  ThesecurityplanningprocessrequirestheDSOtoseekapprovalsatseveralstepsduringsystemplanningactivities. (#(# 0  (1)0` (#(#Totheextentfeasible,securityrequirementsmustbedefinedpriortothestartofAIS A&#( development,beapprovedbytheDSOandAISSecurityOfficer,andincludedaspartoftheacquisition%%'acquisition'%%process. ` (#` (# 0  (2)0` (#(#PriortothestartofAISdevelopment,systemdesignsmustincludesecurityreviewsand )Q', beapprovedbytheAISSecurityOfficer. ` (#` (# 0  (3)0` (#(#Securitytestplansandsecuritytesting%%testing%%resultsmustbeapprovedbytheAISSecurity 7,)/ Officer.#-*0` (#` (#w #Ї0  (4)0` (#(#Priortoaccreditation%%+!accreditationX+%%,AISsecurityplanningdocumentationmustbeapprovedbyAIS   SecurityAdministration. ` (#` (#   3.1.20  AISSecurityPlan   %%+!Security Plan8+%%(#(# 0  TheobjectiveofsecurityplanningistoimprovetheprotectionofAISresourcesandinformation. (#(# 0  (1)0` (#(#Informationowners(thosemanagersmostdirectlyaffectedbyandinterestedinthe   informationorprocessingcapabilities),mustdemonstratehowtheyareplanningtoprotectinformationandprocessingcapabilitiesfromloss,misuse,unauthorizedaccess,modification,unavailability,orundetectedsecurityrelatedactivities. ` (#` (# 0  (2)0` (#(#TheAISSecurityOfficerwilldefinethescopeandformatforCustomsAISsecurityplans A8  toensureastandardizedapproachthatprovidessufficientinformationtoassessthesecuritypostureandcomplieswithapplicableregulations. ` (#` (# 0  (3)0` (#(#EachsensitiveCustomsAISrequiresasecurityplan%%+!security plan8+%%todocumentitssecurityrequirements,   fromdevelopmentoracquisition%%'acquisition'%%,throughimplementationandoperation,todisposal.TheassignedDSOwillprepareandmaintainthesystemsecurityplan%%+!security plan8+%%. ` (#` (# 0  0` (#(#(a)0 ` (#` (#WhenanexistingnonsensitiveAISischangedtoasensitiveCustomsAIS,an  appropriateAISSecurityPlan%%+!Security Plan8+%%mustbeprepared.  (# (# 0  0` (#(#(b)0 ` (#` (#AISSecurityOfficerwilldeterminethefinalboundariesforAISnetworks%%!networksl!%%. (# (# 0  0` (#(#(c)0 ` (#` (#TheDSOswillclearlydefinetheboundariesofnonnetworkedsensitiveAISs SJ undertheirpurviewandareresponsibleforensuringthattheAISsareoperatedaccordingtotheapprovedAISsecurityplan%%+!security plan8+%%.  (# (# 0  (4)0` (#(#AnAISsecurityplan%%+!security plan8+%%willincludeatleastthefollowing:(Seealso:AppendixD)` (#` (# 0  0` (#(#(a)0 ` (#` (#Riskmanagement%%/%Risk management/%%actionspertainingtotheAIS.(Seealso:Section3.2.2)of (# (# 0  0` (#(#(b)0 ` (#` (#ACertification%%+!Certification+%%statementthatreflectstheresultsofsecurityfeaturestestsand # ! implementationschedulesapplicabletotheAIS.(Seealso:Section3.4)  (# (# 0  0` (#(#(c)0 ` (#` (#ADisaster%%!Disasteri!%%Recovery%%!Recoveryi!%%andContingency%%'Contingency'%%OperationsPlan,consistingof:(Seealso: "$ Section3.1.3)  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#emergency%%#emergency#%%responseplan,?%6!'(#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#backupoperationsplan,and&")(#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#postdisasterrecovery%%!recovery!%%plan.($+(#(# 0  0` (#(#(d)0 ` (#` (#SecurityproceduresandpracticesforusersandoperatorsofAISs.(Seealso: [*R&- Section3.5)  (# (#   ,(/ &   0  (5)0` (#(#Asingle(generic)securityplan%%+!security plan8+%%cancovermultipleAISsinsomesituations.Suchplans   mustconsiderownershipresponsibilities,administrativeburdens,technicalcomplexity,andbecosteffective.'  ` (#` (# & B 0  0` (#(#(a)0 ` (#` (#Asingle(generic)AISsecurityplan%%+!security plan8+%%canincludemultiplecomparableAISsin qh similarandassociatedoperatingenvironments.Ifadditionalsecuritymeasuresforaparticularoperatingenvironmentarerequired,theycanbeaddedassupplementaltotheprimarysecurityplan%%+!security plan8+%%,ratherthencreateanewplan.Theplanmustshowhowthechangesareassociatedandmaintaintheplanintegrity.'Bq   (# (# 0  0` (#(#(b)0 ` (#` (#Asingle(generic)AISsecurityplan%%+!security plan8+%%cancoverrelatedAISresourcesthatperform    similarand/orassociatedfunctionsandarephysicallyandlogicallylocatedinthesamegeneralarea.TheplanmightIncludeLocalAreaNetworks%%!Networksl!%%(LANs),hostswithterminals,groupsofstandalonepersonalcomputers,workstations,andotherrelatedofficeautomationsystems.  (# (# 0  0` (#(#(c)0 ` (#` (#Asingle(generic)AISsecurityplan%%+!security plan8+%%cancoverrelatedAISresourcesthatperform   similarand/orassociatedfunctionsinsupportofacommonmission,butmightbeatunspecifiedorphysicallyand/orlogicallydiverselocations.Suchaplanmustconsiderthediversityofconditionsthatmightbeencounteredandensurethatadequateandappropriatelevelsofsecurityareprovided.Theplanmightincludepersonalcomputers,workstations,andotherrelatedAISequipmentoverWideAreaNetworks%%!Networksl!%%(WANs),LocalAreaNetworks%%!Networksl!%%(LANs),and/orothercommunicationsnetworks%%!networksl!%%ormediums.  (# (#   3.1.30  Disaster%%!Disaster!%%Recovery%%!Recovery!%%andContingency%%'Contingency'%%OperationsPlanning W SJ(#(# 0  (1)0` (#(#Eachessential(missioncritical)sensitiveCustomsAIS,includinggeneralsupportsystems  andmajorapplications,orgroupingoflikesystems,shallhaveaviableandlogicalDisaster%%!Disaster!%%Recovery%%!Recovery!%%andContingency%%'Contingency'%%OperationsPlan.Plansshallbewellwritten,routinelyreviewed,tested,andupdatedtoprovideforreasonablecontinuityofAISsupportifnormaloperationsareinterrupted.Thisenablesrapidrestorationofvitaloperationsandresources,andreducesdowntime.[OMBA130%%A130e%%,AIII] ` (#` (# 0  (2)0` (#(#Disaster%%!Disastery!%%Recovery%%!Recoveryy!%%andContingency%%'Contingency'%%Operationsplanningelementsmustinclude,atleast  " thefollowing: ` (#` (# 0  0` (#(#(a)0 ` (#` (#Emergency%%#Emergency#%%responseproceduresappropriatetogovernmentlaws,regulations,and #% directives,civildisorder,fire,flood,naturaldisaster%%!disaster!%%,bombthreat,orotherincidentsoractivitywherelives,property,orthecapabilitytoperformessentialfunctionsarethreatenedorseriouslyimpacted.  (# (# 0  0` (#(#(b)0 ` (#` (#Backupoperationsplans,procedures,andresponsibilitiestoensurethatessential '#* (missioncritical)operationswillcontinueifnormalprocessingordatacommunicationsareinterruptedforanunacceptableperiod.Theminimallyacceptablelevelofdegradedoperationoftheessential(missioncritical)systemsorfunctionsmustbeidentifiedandrankedsothatplanprioritiesareaccomplished.Thismustincludeappropriateprovisionsforstorage,maintenance%%'maintenance'%%,andretrievalofessentialbackupandoperationalsupportdata.  (# (#  -)1 & h 0  0` (#(#(c)0 ` (#` (#Postdisaster%%!disaster!%%recovery%%!recovery!%%proceduresandresponsibilitiestofacilitatetherapid   restorationofnormaloperationsataprimarysite%%siter%%,orifnecessaryatanalternatefacility%%!facility!%%,followingdestruction,majordamage,orothersignificantinterruptionsoftheprimarysite%%sitet%%.'h   (# (# 0  (3)0` (#(#TheAISSecurityOfficerisresponsibleforensuringthedevelopmentofAISDisaster%%!Disaster!%% KB Recovery%%!Recovery!%%andContingency%%'Contingency '%%OperationsPlansforgeneralsupportsystemsandmajorapplications,andfordefiningthetesting%%testingc%%requirementsthattheDSOswillcarryout. ` (#` (# 0  0` (#(#(a)0 ` (#` (#TheAISDisaster%%!Disastery!%%Recovery%%!Recoveryy!%%andContingency%%'Contingency '%%OperationsPlansshallprovidefor    viableandreasonablecontinuityofessentialAIScapabilitiesifnormaloperationsareinterrupted.  (# (# 0  0` (#(#(b)0 ` (#` (#TheAISSecurityOfficerprovidesguidancefortheformulationoftheseplans.   Theplansmustaddressthebusinesscontinuityrequirementsforinterfacingwithapplicationsandbesupportedbyapplication%%'application'%%contingency%%'contingency'%%plans.  (# (# 0  0` (#(#(c)0 ` (#` (#AISapplication%%'application'%%contingency%%'contingency'%%planningactivitiesareconductedinconcertwith z facility%%!facilityy!%%disaster%%!disastery!%%recovery%%!recoveryy!%%planningand/orendusercontingency%%'contingency'%%planning,whensuchplansexist.  (# (# 0  0` (#(#(d)0 ` (#` (#Facility%%!Facilityy!%%disaster%%!disastery!%%recovery%%!recoveryy!%%plansaddressphysicalsecurity%%3)physical security3%%,theprotectionofgeneral  AISsupport,andhelpensuretheavailability%%)availabilityi)%%ofcriticalassets(resources)tofacilitatethecontinuityofoperations%%A7continuity of operations_A%%duringanemergency%%#emergencyo#%%.  (# (# 0  (4)0` (#(#TheDSOwilldevelopandmaintainacurrentviableAISDisaster%%!Disaster!%%Recovery%%!Recovery!%%and SJ Contingency%%'Contingency '%%OperationsPlanforeachsensitiveand/ormissioncriticalAIS(generalsupportsystem%%=3general support system=%%,microcomputers,etc.).Theplanwillprovidereasonableassurancethatcriticaldataprocessingsupportcanbecontinued,orquicklyresumed,ifnormaloperationsareinterrupted. ` (#` (# 0  0` (#(#(a)0 ` (#` (#Dependingontheresultsofthecriticalityassessment(businessimpactanalysis%%A7business impact analysis_A%%), of theDSOmaydeterminethatanAISisnotsufficientlycriticaltotheagencyorusercommunitytowarrantaDisaster%%!Disasterm!%%Recovery%%!Recoverym!%%andContingency%%'Contingencyc'%%OperationsPlan.InthiseventtheDSOwillprovideaContinuityofOperations%%A7Continuity of Operations_A%%Statementtothateffect,subjecttotheapproval%%!approval !%%oftheAccreditingAuthorities.  (# (# 0  0` (#(#(b)0 ` (#` (#EndUserAISContingency%%'Contingency '%%Plansshallbedeveloped,reviewed,andupdatedat #% leasteverythreeyears,orwhenevermajorprocessingenvironmentchangesoccur(e.g.,physicalsite%%siteg%%,hardware,software,operatingsystems,etc.).  (# (# 0  (5)0` (#(#Allplansmustbeoperationallytestedatafrequencycommensuratewiththeriskand &") importanceoflossorharmthatcouldresultfromdisruptionofAISsupport. ` (#` (#   3.20  SECURITYREQUIREMENTS  )x%,(#(#   3.2.10  PolicyDerivedRequirements & 5+,'.(#(# 0  Securityrequirementsmustberiskmanagement%%/%risk management/%%basedandresultfromananalysisofpolicyasappliedtodataandaugmentedbyariskanalysis%%+!risk analysis+%%.TheserequirementsmustbecomparedtoanAIS -)1 securityfeaturescostbenefitanalysis,notagainsttheminimumrequirements.AppendixFdiscussespolicymethodology. (#(#   &  3.2.1.1 ` GlobalSecurityPolicy    0  ThesecuritypolicyofCustomsistooperateitsAISsincompliancewithexistingFederalandnationallevelpolicyasstatedinpubliclaws(PL),ExecutiveOrders(EO),FederalInformationProcessingStandardPublications(FIPSPUBS),OfficeofManagementandBudget%%OEOffice of Management and Budget O%%(OMB)circularsandbulletins,TreasuryDirectives(TD),andCustomsDirectives(CD);toprotectthedataandinformationintheAISs;andtoeffectivelysupporttheCustomsmission.' (#(#   3.2.1.2 ` CostEffectiveSecurity Q  g ^  0  FederalregulationsandTreasurydirectivesrequirethat(i)resourcesareusedconsistentwiththeagencymission;(ii)programsandresourcesareprotectedfromwastefraudandmismanagement;and(iii)thebestavailableandmostcosteffectiveproductsareusedinthedesignandimplementationofAISsecurityprotection.Theselectionofsecurityproductsmustconsiderthecostsofmanagingandadministeringsuchproducts.Meetingtheserequirements,andthecontinuallyincreasingdemandsforprotectionofinformation,requiresconsiderationofproductswhicharecompatiblewithexistingandanticipatedAIShardwareandsoftwareconfigurations.[OMBA123;TDP7110]0h(#(#h(#h(#   3.2.2  RiskManagement  %%/%Risk Management/%%  0  (1)0` (#(#Riskmanagement%%/%Risk management/%%isthetotalprocessofidentifying,controlling,andeliminatingor yp reducingrisksthatmayaffectAISresources.Itincludes:riskanalysis%%+!risk analysis+%%(identifyandanalyzetherisks);adeterminationoftheappropriatelevelsofresourcesnecessarytoprotecttheAIS;amanagementdecisiontoimplementselectedAISsecuritysafeguardsbasedontheriskanalysis%%+!risk analysis+%%,includingacceptingresidualrisk%%+!residual risk+%%,ifnecessary;andeffectivenessreviews. ` (#` (# 0  (2)0` (#(#Risksarederivedfromtheanalysisofthreatsandvulnerabilities.Aformalriskanalysis%%+!risk analysis+%% of requiresdeterminingrelativityamongrisksandassessingassociateddamageorlosspotentials.Thisrelationshipformsthebasisforselectingeffectivesafeguards.Beforestartingtheriskanalysis%%+!risk analysis+%%process,theAISSecurityOfficershouldbeconsultedforguidanceonthescopeoftheanalysisandtherecommendedapproach.Intheabsenceofspecificdirections,refertotheTreasuryRiskAssessment%%/%Risk Assessment/%%Guideline.[TDP8503]"$` (#` (# 0  0` (#(#(a)0 ` (#` (#Ariskanalysis%%+!risk analysis+%%willbeconductedorsponsoredbytheAISSecurityOfficerfor e$\ & eachCustomsgeneralsupportAIS(mainframeornetwork)facility%%!facilitys!%%forthefollowingconditions.  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#WheneveraneworsubstantiallymodifiedAISfacility%%!facilitys!%%designisapproved.'#*(#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#BeforedesignspecificationsfornewgeneralsupportAISsandtheir )x%, supportinginstallationsareapproved. (#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#WheneverasignificantchangeoccurstothegeneralsupportAIS(e.g., ,(/ addingaLAN;changingfrombatchtoonlineprocessing;addingdialup%%dialup%%capability,etc.).Thecriteriafordefiningsignificantchangeswillbe -)1 commensuratewiththesensitivityofthedataprocessedbythegeneralsupportAIS. (#(# & h 0  0` (#(#0 ` (#` (#(iv)0 (# (#AtperiodicintervalsestablishedbytheAISSecurityOfficer  commensuratewiththesensitivityofthedataprocessed,butnottoexceedeverythreeyears,ifnoriskanalysis%%+!risk analysis+%%isperformedduringthatperiod. (#(# 'h0  0` (#(#(b)0 ` (#` (#TheDSOwillcoordinateorconductariskanalysis%%+!risk analysis+%%whichfocusesonthe   automated(technical)andadministrativesecuritycontroltechniquesassociatedspecificallywiththeAISorprocessunderreview.Thisincludestheinterfacebetweentheoperatingsystemsandtheapplications,and/orthecommunicationsenvironmentandtheapplications,andthethreatsinherentinprocessinginaspecificenvironment.Facility%%!Facilitys!%%(physical)riskanalysis%%+!risk analysis+%%mustbeconsideredwhendefiningandapprovingsecurityspecificationsforthemajorapplicationsornetworksystems.  (# (# 0  (3)0` (#(#Responsibilityforcarryingouttherecommendationsofariskanalysis%%+!risk analysis+%%restswiththe   manageroftheAISfacility%%!facilitys!%%underreview,ortheapplication%%'application'%%developer,asappropriate.Responsetotherecommendedsafeguardsincludesimplementationschedules,orrationalefornonimplementation.Theymustevaluatetherecommendationsanddeterminewhethertocarrythemoutbasedontechnicalandoperationalfeasibility,andcosts.CustomsAccreditation%%+!AccreditationW+%%Authorities(AAs)willconsidertheeffectsofthereviewer'sactionsinmakingaccreditation%%+!accreditationW+%%decisions. ` (#` (#   3.30  DEVELOPMENT A yp(#(# 0  (1)0` (#(#TheCustomsSystemDevelopmentLifeCycle(SDLC%%SDLC%%)methodologydescribedinthe -$ SDLC%%SDLC%%handbookappliestoallsystemsandapplications(mainframe,networked,orstandalone),developedbyorforCustomsandusedbyCustomsemployees,contractpersonnel,othergovernmentagencies,andpersonsorcompaniesusingCustomsresources,whetherornotunderdirectcontroloftheOfficeofInformationandTechnology(OIT).ItincorporatesastandardsbasedapproachtosystemsdevelopmentandAISdevelopmentpolicies. ` (#` (# 0  (2)0` (#(#TheSDLC%%SDLC%%handbookisrequiredreadingforallpersonsnewtotheCustomsautomation  " environmentandincorporatesGovernmentandindustrydevelopmentstandardsapplicabletoCustoms.ItdescribestheminimumrequirementsthatCustomsapplicationsmustmeettocomplywithexistingstandardsanddirectivesthroughouttheirprojectedlifecyclesandfacilitatesastepbystepprocesstodeliveraccurate,effectiveandefficientAISstotheusers.[USCS55004] ` (#` (#   3.40  CERTIFICATION%%+!CERTIFICATION8+%%ANDACCREDITATION  %%+!ACCREDITATION8+%%&")(#(# 0  Certification%%+!Certification8+%%andaccreditation%%+!accreditation8+%%,althoughrelated,arenotthesameprocessesnordotheyhavethesameobjectives.Certification%%+!Certification8+%%isashorttermactivitythatisrepeatedafteranysignificantAISrelatedchangeandisaprerequisiteforaccreditation%%+!accreditation6+%%.Accreditation%%+!Accreditation6+%%isalongtermauthorization,uptothreeyears,foranAIStooperatebasedonthefacts,plans,andschedulesdevelopedduringcertification%%+!certification6+%%. (#(#   ,(0 &   0  (1)0` (#(#EachCustomsgeneralsupportAISandmajorapplication%%3)major application3'applicationt'%%isconsideredtocontainor   processsensitiveinformationandmustbecertifiedandaccredited.'  ` (#` (# 0  (2)0` (#(#AllotherCustomsAISsandapplicationswhichcontainorprocesssensitiveinformation  andmustbecertifiedandaccredited,asappropriate. ` (#` (#   & h 3.4.10  Certification 3 %%+!Certification8+%%% (#(# 0  Certification%%+!Certification8+%%isthecomprehensivetesting%%testingt%%andevaluationofthetechnicalandnontechnicalAISsecurityfeatures,andothersafeguardsusedinsupportoftheaccreditation%%+!accreditation8+%%process.'h% @ԀItestablishestheextenttowhichaparticularAISdesignandimplementationmeetaspecifiedsetofsecurityrequirements.Certification%%+!Certification8+%%primarilyaddressessoftwareandhardwaresecuritysafeguards,butalsoconsidersprocedural,physical,andpersonnelsecuritymeasuresemployedtoenforceAISsecuritypolicy. (#(# 0  (1)0` (#(#SoftwareCertification%%+!Certification8+%% ` (#` (# 0  0` (#(#(a)0 ` (#` (#Inhousedevelopedsoftware.Designreviewsandsystemstestswillbe z performed,andacertification%%+!certification8+%%oftheresultsrecorded,fornewlydevelopedsoftware,andforexistingsoftwarewhensignificantmodificationsaremade.  (# (# 0  0` (#(#(b)0 ` (#` (#GovernmentOffTheShelfSoftware(GOTS).Governmentdevelopedsoftware  willbeexaminedtoassurethatthesoftwaredoesnotcontainfeatureswhichmightbedetrimentaltoCustomsAISsecurity.Softwaredesignreviewsandsystemstestswillbeperformed,andacertification%%+!certification8+%%oftheresultsrecordedwhensignificantmodificationsaremadetoGOTSsoftware.  (# (# 0  0` (#(#(c)0 ` (#` (#Commercial%%%Commercialn%%%OffTheShelfSoftware(COTS%%COTSc%%).Commerciallyprocuredsoftware  willbeexaminedtoassurethatthesoftwaredoesnotcontainfeatureswhichmightbedetrimentaltoAISsecurity.Securityrelatedsoftwarewillbeexaminedtoassurethatthesecurityfeaturesfunctionasspecified.  (# (# 0  (2)0` (#(#TheDSOwilloverseeorconductAIScertification%%+!certification8+%%tests.Individualswhoconductthe I@  certification%%+!certification8+%%testing%%testingt%%willbeindependentoftheAISdevelopers,ifresourcesareavailable.Thetesting%%testingt%%processandresultswillbedocumentedinaformatthatensuresthatthetestscanberepeatedandachievetheresultsreflectedinthecertification%%+!certification8+%%report,ifrequired. ` (#` (# 0  (3)0` (#(#AISsecuritysafeguardsmustbemodifiedtocorrectanydeficiencies%%)deficiencies)%%foundduring #% certification%%+!certification8+%%testing%%testingt%%,asappropriate. ` (#` (# 0  (4)0` (#(#Certification%%+!Certification8+%%testing%%testingt%%willvarywiththeAISsecuritymode%%+!security mode8+%%ofoperation.&"(` (#` (# 0  0` (#(#(a)0 ` (#` (#Dedicatedsecuritymode%%?5Dedicated security mode ?+!security modei+%%doesnotrequireextensivecertification%%+!certificationi+%%effortsasusers '#* anddataarenotrequiredtobeseparatedwithtechnicalsecuritymeasures.Certification%%+!Certificationi+%%focusesonthephysical,procedural,andpersonnelsecuritymeasurestoensurethatallusershavetheappropriateaccessapproval%%!approvali!%%andneedtoknowforallCustomsdataontheAIS.(Example:astandalonepersonalcomputer).  (# (# 0  0` (#(#(b)0 ` (#` (#Systemhighsecuritymode%%+!security modei+%%requiresthathardwareandsoftwaresecurityfeatures ,(0 reliablysegregateusersfromdataforwhichtheydonothaveaneedtoknow,in -)1 additiontotherequirementsofDedicatedsecuritymode%%?5Dedicated security mode ?+!security modei+%%.(Example:ageneralsupportAIS).  (# (# 0  0` (#(#(c)0 ` (#` (#Compartmentedandmultilevelsecuritymodesareusedforclassified%%%classifiede%%%AISsandare  notaddressedinthemanual.(Reference:CISHB140003).  (# (# 0  (5)0` (#(#TheAISSecurityOfficerwillprovideguidanceonconductingcertification%%+!certificationi+%%testing%%testingt%%.% ` (#` (#   3.4.20  Accreditation A %%+!Accreditation8+%% (#(# 0  AnysignificantmodificationmadetoanSBU%% SBUd%%AISornetworkshouldbereviewedtodeterminetheimpactonsecurity. (#(# 0  Modifiedsystems/networks%%!networksi!%%willbereaccreditedbyappropriateofficialsasoutlinedinTDP7110,Sect.7.Ainlightoftheresultsofthesecurityreview.[TDP7110] (#(# 0  (1)0` (#(#Accreditation%%+!Accreditation6+%%istheofficialmanagementauthorizationtooperateanAISbasedonthe   followingcriteria. ` (#` (# 0  0` (#(#(a)0 ` (#` (#Theparticularsecuritymode%%+!security mode6+%%ofoperation.7. (# (# 0  0` (#(#(b)0 ` (#` (#Thedefinedsetofthreats,withrelatedvulnerabilitiesandprescribedsafeguards. (# (# 0  0` (#(#(c)0 ` (#` (#Thegivenoperationalenvironment. (# (# 0  0` (#(#(d)0 ` (#` (#Thestatedoperationalconcept.SJ (# (# 0  0` (#(#(e)0 ` (#` (#ThestatedinterconnectiontootherAISs. (# (# 0  0` (#(#(f)0 ` (#` (#Theoperationalnecessity. (# (# 0  0` (#(#(g)0 ` (#` (#AnacceptablelevelofriskforwhichtheAccreditingAuthoritieshaveformally of assumedresponsibility.  (# (# 0  (2)0` (#(#TheAccreditingAuthorities(AA)officiallydeclarethatacertifiedAISwilladequately  " protectrelatedinformation,willoperateinoneofthefollowingsecuritymodes,andacceptsecurityresponsibilitiesfortheAISoperation. ` (#` (# 0  0` (#(#TheAISsecuritymode%%+!security modeV+%%ofoperationisbasedondatasensitivity,accessapproval%%!approvalo!%%,and e$\ & needtoknowoftheAISusers.AvailableorproposedAISsecurityfeaturesdonot ?%6!' determinethesecuritymode%%+!security modeV+%%. ` (#` (# 0  0` (#(#ApplicableSecurityModesofoperationsare: ` (#` (# 0  0` (#(#(a)0 ` (#` (#Dedicatedsecuritymode%%?5Dedicated security mode,?+!security modei+%%.(Seealso:Certification%%+!Certificationi+%%.Section3.4.1.(4)(a).)x%, (# (# 0  0` (#(#(b)0 ` (#` (#Systemhighsecuritymode%%+!security modei+%%.(Seealso:Certification%%+!Certificationi+%%.Section3.4.1.(4)(b).5+,'. (# (# 0  (3)0` (#(#AllsensitiveAISs,includinggeneralsupportsystemsandmajorapplications,mustbe ,(0 submittedforandbeaccreditedexpeditiously.-)1` (#` (# Ї0  (4)0` (#(#TheAISsecurityplan%%+!security planX+%%documentation,discussedinSection3.1,willbesubmittedbythe   DSOtotheAISSecurityOfficerforreview.TheAISSecurityOfficerwilldevelopasummaryofcompliancetoincludesecurityrequirementsandastatementofresidualrisk%%+!residual riskX+%%. ` (#` (# 0  (5)0` (#(#Priortoaccreditation%%+!accreditationX+%%,CustomsInformationResourcesManagement(IRM%% IRMd%%)andSecurity qh ProgramsDivision%%E;Security Programs DivisionE%%(SPD%% SPDi%%)representativeswillreviewsecurityplan%%+!security planm+%%documentation,forsensitiveAIS,includingthesummaryofcomplianceandstatementofresidualrisk%%+!residual riskm+%%. ` (#` (# 0  (6)0` (#(#TheappropriateCustomsAAswillmaketheaccreditation%%+!accreditationm+%%decisionbasedonthesummary   ofcompliance,astatementofresidualrisk%%+!residual riskm+%%,andanapprovedAISsecurityplan%%+!security planm+%%.Theaccreditation%%+!accreditationm+%%processresultsinadecisionthattheAISis: ` (#` (# 0  0` (#(#(a)0 ` (#` (#accreditedtooperate,orA8  (# (# 0  0` (#(#(b)0 ` (#` (#giveninterimoperatingapproval%%!approvali!%%foraspecifictimependingsatisfactory   completionofspecifiedrequirements,or  (# (# 0  0` (#(#(c)0 ` (#` (#deniedpermissiontooperate,untilidentifieddeficiencies%%)deficiencies)%%arecorrected.z (# (# 0  (7)0` (#(#EverysensitiveAIScoveredbythispolicymustbereaccreditedatleasteverythreeyears. 7. Theaccreditation%%+!accreditationm+%%statusandsupportingdocumentationwillbereviewedandrevisedforthefollowingconditionsorevents,asappropriate. ` (#` (# 0  0` (#(#(a)0 ` (#` (#Asignificantchangeoccursinthehardware,software,ordatacommunications  configurationthatimpactstheAISsecuritysafeguardsdefinedintheoriginalaccreditation%%+!accreditation+%%package.AsignificantchangeisonewhoseimpactissuchthatitneedstobebroughttotheattentionoftheAAs.  (# (# 0  0` (#(#(b)0 ` (#` (#Thesensitivityleveloftheinformationbeingprocessedissignificantlychanged. (# (# 0  0` (#(#(c)0 ` (#` (#Thesecuritymode%%+!security mode+%%ofoperationischanged. (# (# 0  0` (#(#(d)0 ` (#` (#AISfacility%%!facilityo!%%orremoteterminalareachangesoccur,includingrelocationsor I@  structuralmodifications,whichmayaffectAISsecurity.  (# (# 0  0` (#(#0 ` (#` (#Wheneveramajorofficerelocationoccurs(e.g.,movestoanewbuilding),theAISSecurityOfficershouldconductanAIScompliancereviewtodecidewhetherthechangeinphysicallocationimpactstheAISsecurityposture.TheresultsofthesecurityreviewshouldberetainedaspartofCustomsAISsecuritydocumentation.  (# (# 0  0` (#(#(e)0 ` (#` (#AnAISsecurityrelatedeventoccursthatappearstoinvalidatetheaccreditation%%+!accreditation+%%.&") (# (# 0  (8)0` (#(#Theaccreditation%%+!accreditation+%%packagerevisionandreviewprocesswillincludeatleastthefollowing ($+ activitiesandinformation. ` (#` (# 0  0` (#(#(a)0 ` (#` (#Thesamestepsrequiredfortheoriginalaccreditation%%+!accreditation+%%packagewillbecompleted. 5+,'. Portionsofthepackagewhichconfigurationmanagement%%A7configuration management1A%%showstostillbevalid,neednotberedone.  (# (#  -)1 0  0` (#(#(b)0 ` (#` (#TheIRM%% IRM"%%andSPD%% SPD"%%representativeswillreviewandapprovetheAISsecurityplan%%+!security planX+%%,   summaryofcompliance,andstatementofresidualrisk%%+!residual riskX+%%,asappropriate.  (# (# 0  0` (#(#(c)0 ` (#` (#TheappropriateAAswillreviewandreaccredittheAIS. (# (# 0  (9)0` (#(#TheAISSecurityOfficerwillmaintainarecordsystemcontainingthestatusofthe KB documentsintheCustomsAISaccreditation%%+!accreditationX+%%packages. ` (#` (# &  0  (10)0` (#(#TheAAsaretheonlyonesauthorizedtoexemptanoperationfromthesecurity   requirementsspecifiedintheaccreditation%%+!accreditationX+%%statement.Thisexemption%%#exemptiono#%%mustbeformallydocumentedinawrittenwaiver%%waivern%%andretainedwiththeoriginalaccreditation%%+!accreditationX+%%package.' B ` (#` (#   3.50  PROCEDURESANDPRACTICES oD A8 (#(# 0  ThispolicymanualdoesnotcontainAISsecurityrelatedproceduresandpractices.TheyarepresentedseparatelyandprovidedtoCustomsAISusers,administrators,andoperators,asappropriate.ProceduresandpracticesexplainspecificAISsecuritymechanismoperationssothatusers,administrators,andoperatorsmayconsistentlyandeffectivelyprotectCustomsinformation.Suchinformationshouldalsobeaddressedduringtraining%%!training!%%,whenapplicable.(Seealso:Section1.5.1) (#(#   3.60  EDUCATION%%#EDUCATION:#%%,TRAINING%%!TRAINING!%%,ANDAWARENESS G %%#AWARENESS:#%%(#(# 0  TheComputerSecurityAct%%;1Computer Security Act;%%requiresFederalagenciestoprovideforthemandatoryperiodictraining%%!traininge!%%incomputersecurityawareness%%#awarenessc#%%andacceptedcomputersecuritypracticeofallemployeeswhoareinvolvedwiththemanagement,use,oroperationofaFederalcomputersystemwithinorunderthesupervisionoftheFederalagency.Thisincludescontractorsaswellasemployeesoftheagency. (#(# 0  Trainingisparticularlyimportantinviewofthechangingnatureofinformationresourcesmanagement.Decentralizationofinformationtechnologyhasplacedthemanagementofautomatedinformationandinformationtechnologydirectlyinthehandsofnearlyallagencypersonnelratherthaninthehandsofafewemployeesatcentralizedfacilities. (#(# 0  TheOMBCircularA130%%A130%%,AppendixIIIenforcessuchmandatorytraining%%!training!%%byrequiringitscompletionpriortograntingaccesstothesystem.[OMBA130%%A130g%%,AIII] (#(# 0  (1)0` (#(#TheDirector%%!Director!%%,AISSecurityDivision,shallensurethataCustomsAISSecurityEducation%%#Education)#%%, #% Training%%!Training!%%,andAwareness%%#Awareness)#%%Programisestablished. ` (#` (# 0  (2)0` (#(#Training%%!Training!%%maybepresentedinstages,forexample,asmoreaccessisgranted.Insome &"( cases,thetraining%%!training!%%shouldbeintheformofclassroominstruction.Inothercases,interactivecomputersessionsorwell-writtenandunderstandablebrochuresmaybesufficient,dependingontheriskandmagnitudeofharmrelatedtothesubjectmatter. ` (#` (# 0  (3)0` (#(#Refresherawareness%%#awareness#%%training%%!training!%%frequencyshallbedeterminedbytheDirector%%!Director!%%,AISSecurity.[*R&-` (#` (# 0  (4)0` (#(#Eachnewuserofageneralsupportsystem%%=3general support system=%%insomesenseintroducesarisktoallother ,(/ users.Therefore,eachusershouldbeversedinacceptablebehavior--therulesofthesystem%%7-rules of the systemm7%%--beforebeingallowedtousethesystem.-)1` (#` (# Ї0  (5)0` (#(#Training%%!Training!%%shouldbetailoredtowhatauserneedstoknowtousethesystemsecurely,given   thenatureofthatuse,andhowtogethelpintheeventofdifficultywithusingorsecurityofthesystem. ` (#` (# &  0  (6)0` (#(#Accessprovidedtomembersofthepublicshouldbeconstrainedbycontrolsinthe qh applicationsthroughwhichaccessisallowed,andtraining%%!training!%%shouldbewithinthecontextofthosecontrols.'qU ` (#` (# &  0  (7)0` (#(#Additionalawareness%%#awareness#%%training%%!training!%%willbeprovidedwhensignificantchangesoccurinAIS   securityenvironmentsorprocedures,ortoemployeeswhoassumenewpositionsorassignmentsdealingwithinformationatahigherlevelofsensitivity.' V ` (#` (# 0  (8)0` (#(#Securityawareness%%#awareness#%%training%%!training!%%shouldincludethefollowingtopics,asappropriate.A8 ` (#` (# .0  0` (#(#(a)0 ` (#` (#CommonAISthreats,vulnerabilities,andrisks.  (# (# 0  0` (#(#(b)0 ` (#` (#Informationaccessibility,handling,labeling,andstorageprotection   considerations.  (# (# 0  0` (#(#(c)0 ` (#` (#Physicalandenvironmental%%+!environmentalX+%%AISprotectionconsiderations.7. (# (# 0  0` (#(#(d)0 ` (#` (#AISdataaccesscontrolsandrulesofbehavior%%3)rules of behavior3%%. (# (# 0  0` (#(#(e)0 ` (#` (#Proceduresfordisaster%%!disastere!%%recovery%%!recoverye!%%andcontingency%%'contingencyv'%%operationsplans. (# (# 0  0` (#(#(f)0 ` (#` (#AISsecurityconfigurationmanagement%%A7configuration management2A%%andcontrolrequirements.SJ (# (# 0  0` (#(#(g)0 ` (#` (#AISrelatedsecurityincidentreportingrequirementsandprocedures. (# (# 0  (9)0` (#(#Specializedtraining%%!trainingi!%%isrequiredforallindividualsgivenaccesstoanapplication%%'application '%%,including  membersofthepublic.Itshouldvarydependingonthetypeofaccessallowedandtheriskthataccessrepresentstothesecurityoftheapplication%%'application '%%andinformationinit.Thistraining%%!trainingn!%%willbeinadditiontothatrequiredforaccesstoasupportsystem.Suchtraining%%!trainingn!%%mayvaryfromanotificationatthetimeofaccess(e.g.,formembersofthepublicusinganinformationretrievalapplication%%'application '%%)toformaltraining%%!trainingn!%%(e.g.,foranemployeethatworkswithahigh-riskapplication%%'application '%%). ` (#` (# & h 0  (10)0` (#(#Allpersonnelwhodesign,develop,operate,ormaintainsensitiveAISwillbeprovided #% securitytraining%%!trainingn!%%appropriatetothelevelofrisktheypresenttoCustomsAIS.Thetraining%%!trainingn!%%shalladdressthetypesofsecurityandinternalcontroltechniquesthatoughttobeincorporatedintoAISdevelopment,operation,andmaintenance%%'maintenance '%%.'h#c ` (#` (# 0  (11)0` (#(#AISSecurityAdministrationshouldbeconsultedforguidanceonachievingtraining%%!traininge!%% '#* objectives. ` (#` (#   3.70  SECURITYOVERSIGHT f %%#OVERSIGHT:#%%[*R&-(#(# 0  TheADPSteeringCommittee%%5+Steering Committee5%%,SecuritySubcommittee,istheoversight%%#oversightm#%%authority%%#authoritym#%%forCustomsAISSecurityProgram.(Seealso:Section2.2(2)) (#(#  -)1 0  TheAISSecurityOfficerconductsongoingdaytodayoperationalpolicyrelatedsecurityoversight%%#oversight#%%activitiesandensuresthatperiodicAISsecurityreviewsareconducted. (#(# & h 0  (1)0` (#(#TheAISSecurityOfficermustdevelopandmaintain,withtheassistanceofAISSecurity  Administration,IRM%% IRMi%%,andSPD%% SPDi%%managers,alistofAISsrequiringaccreditation%%+!accreditationX+%%.Thislistmustbeannuallyverifiedandshouldincludetherecommendedaccreditation%%+!accreditationX+%%priorityandAAidentityforeachAIS.'hi ` (#` (# &  0  (2)0` (#(#GiventheglobalnatureofCustomsAISresources,theappointmentofDSOsprovidelocal   oversight%%#oversighto#%%andhelptoensureadherencetoAISsecuritypolicy.TheyprovidepointsofcontactforaccomplishingAISsecurityrelatedactivities.' cl ` (#` (# 0   (#(# 0  (3)0` (#(#CustomsOfficeofInformationandTechnology(OIT)isasignofftoAISrelated A8  acquisitionsandwillenforceAISsecurityaspartoftheprocurementprocess. ` (#` (# 0  0` (#(#TheAISSecurityOfficerreviewsandauthorizesallsecurityrelatedacquisitionsforsensitiveAISstoensurethattheappropriateAISsecurityrequirementsareincludedinthespecificationsfortheoperationofanAISinstallationfacility%%!facility!%%,equipment,application%%'application'%%system,ortheacquisition%%'acquisition'%%ofAIShardware,software,orrelatedservices. ` (#` (# 0  (4)0` (#(#TheContractingOfficer%%7-Contracting OfficerN7%%TechnicalRepresentative(COTR%%COTRc%%)hascontractoversight%%#oversight #%%andwill  ensurethatthecontractorrelatedAISsecurityrequirementsarefollowedthroughoutthecontractlifecycle%%%lifecycleO%%%. ` (#` (# 0  (5)0` (#(#TheAISsecuritypolicyprogramisimplementedthroughthefollowingactions:yp` (#` (# 0  0` (#(#(i)0 ` (#` (#appointmentofDSOs;-$ (# (# 0  0` (#(#(ii)0 ` (#` (#acquisition%%'acquisitionf'%%reviews; (# (# 0  0` (#(#(iii)0 ` (#` (#reviewandapproval%%!approvaln!%%ofsecurityrequirementstosupportAISdevelopment; (# (# 0  0` (#(#(iv)0 ` (#` (#preparation,approval%%!approvaln!%%,andimplementationofcertification%%+!certificationi+%%requirements;I@  (# (# 0  0` (#(#(v)0 ` (#` (#preparationandapproval%%!approvali!%%ofaccreditation%%+!accreditationi+%%documentation; " (# (# 0  0` (#(#(vi)0 ` (#` (#securitytraining%%!trainingi!%%reviews;"$ (# (# 0  0` (#(#(vii)0 ` (#` (#securitycontrols%%3)security controls3%%andauditing;ande$\ & (# (# 0  0` (#(#(viii)0 ` (#` (#securityincidentreporting. &"( (# (#  e %Y %%Y %%Z %%Z %  \[&&  CHAPTER4 X   MINIMUMSECURITYREQUIREMENTS z#&&]z# 8 A&-) xdExA|z  0  TheAISsecuritygoalistodevelopafunctionallysecure,efficient,costeffectiveenvironmentbasedonanassessmentofsecurityrisksandsafeguards.AllAISsprocessing,storing,ortransmittingsensitiveinformationmustmeettherequirementsofthispolicythroughautomatedormanualmeans.Morestringentrequirementsmaybeimposedbasedonariskanalysis%%+!risk analysisV+%%. (#(# 0  ThissectiondocumentstheminimumsecurityrequirementsforCustomsAISsprocessingsensitivedatawithrespectto:Facility%%!Facilitys!%%,Personnel,Automated,andTelecommunications%%5+Telecommunications:5%%security. (#(#   4.10  FACILITY%%!FACILITYi!%%SECURITY ~ i (#(# 0  (1)0` (#(#TheSecurityProgramsDivision%%E;Security Programs DivisionE%%(SPD%% SPDi%%),SecurityManagementBranch,prescribespolicies,   procedures,andstandardsfortheCustomsfacility%%!facilityr!%%securityprogram. ` (#` (# 0  (2)0` (#(#Facility%%!Facilityr!%%securityaddressestherequirementstoprovideadequatephysicaland S environmental%%+!environmentalm+%%controlsbasedonthelevelofrisktotheAISssupportedinafacility%%!facilityt!%%,asidentifiedbyariskanalysis%%+!risk analysism+%%.Thesecuritycontrols%%3)security controlsi3%%mustnotbelessthantheminimumrequirementsdiscussedinthissection,unlessawrittenwaiver%%waiver %%hasbeengrantedbytheAccreditingAuthorities(AAs). ` (#` (# 0  (3)0` (#(#Forthepurposesofthispolicy,anAISfacility%%!facilityo!%%includesphysicalspacehousingAIS o equipmentsuchasterminals,microcomputers,mainframesystems,communicationsequipment,orsupportingenvironmental%%+!environmentall+%%controlutilities.FacilitiesalsoincludedatastorageandAISdocumentationlibraries(e.g.,offsite%%siten%%backupstoragefacilities). ` (#` (#   4.1.10  Physical V  (#(# 0  (1)0` (#(#Physicalsecurity%%3)Physical securityi3%%isconcernedwiththemeasuresdesignedtopreventunauthorizedphysical e accesstoequipment,facilities,material,information,anddocuments,andtosafeguardthemagainstespionage,sabotage,damage,tampering,theft,andothercovertorovertacts.AIShardware,software,documentation,andallsensitiveinformationhandledbytheAISwillbeprotectedtopreventunauthorizeddisclosure,modification,ordestruction.AIShardware,software,ordocumentationmustbeprotectedifaccesstosuchresourcesmayrevealinformationthatcanbeusedtoeliminate,bypass,orotherwiserenderineffectivethesecuritysafeguards(countermeasures)usedtoprotectsensitiveinformation. ` (#` (# 0  &  (2)0` (#(#SensitiveCustomsinformation,whileoperational,mustbeprocessed,stored,or g%#' transmittedinphysicalspaces(i.e.,buildings,communicationsfacilities,etc.)whichareunderexclusiveCustomscontrol,includingMOUs(MemorandumofUnderstanding)andcontractualagreements.Whennotinoperation,orunderthedirectcontrolofanauthorizedperson,CustomsAISsandinformationmustbeprotectedbycontrolsystemsandmeasuresconsistentwithCustomsfacility%%!facility!%%securityprogram.'g% ` (#` (# 0  0` (#(#PriortoconductingsensitiveAISoperationsatanylocation,AISsecurityplanningmustconsiderthefacility%%!facility!%%securityprogramaspartoftheaccreditation%%+!accreditation+%%process. ` (#` (#  -*0  & h 0  (3)0` (#(#Foralltypesoffacilitieswheresensitiveinformationisstored,processed,ortransmitted,   physicalaccesswillberestrictedtothoseindividualswhoareauthorizedaccordingtothepersonnelsecurityrequirementsandwhoarenecessarytocompleteassignedjobfunctionsandrelatedduties.(Seealso:Section4.2)'h  ` (#` (# 0  0` (#(#Allotherpersonnelgrantedfacility%%!facility!%%accessmustbeproperlyescortedandrestrictedtothoseareasnecessarytocompletetheirtasks.SensitiveCustomsinformationmustbeprotectedfromunauthorizeddisclosuretosuchpersons. ` (#` (#   4.1.20  Environmental  %%+!EnvironmentalX+%%  (#(# 0  (1)0` (#(#Environmental%%+!EnvironmentalX+%%controlsaddresstherequirementstoprovideappropriatetemperatureand g ^  humiditycontrols,fireprotection,power,andnaturaldisaster%%!disastert!%%protectionnecessarytoensurethecontinuityofoperations%%A7continuity of operationsA%%forAISfacilitiesandequipment. ` (#` (# 0  (2)0` (#(#AreasthatsupportdesktopAISequipmentgenerallyrequireenvironmental%%+!environmentalp+%%controls   specifiedforhumansafetyandcomfort.Additionalphysical,electrical,temperature,andhumiditycontrolsmaybeneededtoensurereliableAISoperationsinsomecases. ` (#` (# 0  (3)0` (#(#FacilitiessupportinglargescaleAISoperations,suchasmainframecomputersand 7. telecommunicationfacilities,mayrequireadditionalenvironmental%%+!environmentalp+%%controlsasdeterminedbyoperationalneedsandriskanalysis%%+!risk analysisp+%%.Thefollowingadditionalcontrolsshouldbeconsidered: ` (#` (# 0  0` (#(#(a)0 ` (#` (#Fireprevention,detection,suppression,andprotectionmeasures.yp (# (# 0  0` (#(#(b)0 ` (#` (#Waterhazarddetection,prevention,andcorrectivemeasures.-$ (# (# 0  0` (#(#(c)0 ` (#` (#Electricpowersupplyprotection. (# (# 0  0` (#(#(d)0 ` (#` (#Temperatureandhumiditycontrols. (# (# 0  0` (#(#(e)0 ` (#` (#Protectiveorcontrolmeasuresfromtheeffectsofearthquakes,lightning, I@  windstorms,andothernaturaldisasters.  (# (# 0  0` (#(#(f)0 ` (#` (#Protectiveorcontrolmeasuresfromtheeffectsofindustrial,environmental%%+!environmentalp+%%,or !# otherphysicalconditionswhichmightseriouslyimpactnormalAISoperations.  (# (# 0  0` (#(#(g)0 ` (#` (#Housekeepingprotectionfromdirt,dust,andothercontaminants.e$\ & (# (# 0  0` (#(#(h)0 ` (#` (#Personnelsafetyfeatures.&"( (# (#   4.20  PERSONNELSECURITY E '#*(#(# 0  (1)0` (#(#TheSecurityProgramsDivision%%E;Security Programs Division@E%%(SPD%% SPDi%%)setspolicyandprovidesproceduresandguidance )x%, insupportofCustomspersonnelsecurityprogram.PriortoconductingAISoperations,andaspartoftheaccreditation%%+!accreditationm+%%process,AISsecurityplanningmustconsiderthepersonnelsecurityprogram. ` (#` (#   ,(0 &   0  (2)0` (#(#Allpersonnelentrustedwiththemanagement,operation,maintenance%%'maintenance'%%,oruseofaCustoms   AISprocessing,storing,ortransmittingsensitiveinformationrequireappropriatepersonnelsecurityapproval%%!approvale!%%.[USCS5100005]'  ` (#` (# 0  (3)0` (#(#CustomspersonnelandNonCustoms%%'NonCustoms'%%contractorpersonnelentrustedwiththemanagement, qh operation,maintenance%%'maintenance'%%,oruseofsensitiveCustomsAISsrequireanappropriateauthorizationandmusthaveacompletedBackgroundInvestigation(BI). ` (#` (# 0  0` (#(#[USCS1460010] ` (#` (# 0  (4)0` (#(#NonCustoms%%'NonCustoms'%%governmentpersonnelentrustedwiththemanagement,operation,    maintenance%%'maintenance'%%,oruseofsensitiveCustomsAISsrequireanappropriateauthorizationandbackgroundinvestigation. ` (#` (# 0  (5)0` (#(#NonCustoms%%'NonCustoms'%%personnel(membersofthetradecommunity%%/%trade community/%%),whouseCustomsAISsmust   beauthorizedinwritingbytheAISSecurityOfficer,ProcessOwner%%+!Process Owner+%%,orsomeotherformalizedprocessthatassuresappropriateauthorization. ` (#` (# 0  (6)0` (#(#NonCustoms%%'NonCustoms'%%AIStechnicalsupportpersonnelwhoarerequiredtoperformmaintenance%%'maintenance'%% z onCustomsAISswithinCustomscontrolledfacilitiesmaybeapprovedforunescortedaccessbasedonanappropriateauthorizationandacompletedBI. ` (#` (# 0  (7)0` (#(#AISsecuritytraining%%!traininge!%%mustbeprovidedtoallpersonnelwhomanage,operate,developor  useAISs.(Seealso:Section3.6) ` (#` (#   4.30  AUTOMATEDSECURITY  yp(#(# 0  ThissectionestablishesneartermrequirementsandlongtermgoalstoimprovethesecurityofCustomsAISsthroughincreasingrelianceonautomatedsecurityfeatures.Theminimumsecurity  requirementsaddressedinthissectionarefeasibleinthecurrentCustomsAISenvironment.As  technologyevolves,thedesirablesecurityfeaturesidentifiedinthissectionshouldbeassessed  duringAISplanninganddevelopment. (#(#   4.3.10  MinimumSecurityRequirements [ OF (#(# 0  NationalPolicyonControlledAccessProtection.TheWhiteHouse,National !" Telecommunications%%5+Telecommunications5%%andInformationSystemsSecurityCommittee,07/15/87,directsthatbyFederalagenciesmustprovideautomatedControlledAccessProtection(C2%% C2c%%level)forallsensitiveorclassified%%%classifieda%%%informationprocessedormaintainedbyAIS,whenallusersdonothavethesameauthorizationtousethesensitiveinformation.[NTISSP200] (#(# 0  (1)0` (#(#AISsusedfortheprocessingofsensitiveinformationmusthavethesecurityfunctionality &"( oftheC2%% C2s%%leveloftrust,asdefinedintheDepartmentofDefense(DoD),Trusted &") ComputerSystemEvaluationCriteria%%g]Trusted Computer System Evaluation Criteriag%%(TCSEC%%TCSEC %%).[5200.28STD]'#*` (#` (# 0  0` (#(#(a)0 ` (#` (#IncaseswhereC2%% C2C%%functionalsecurityrequirementsaretimeconsuming, )~%, technicallyunsound,oradverselyaffectoperationstoanunacceptabledegree,othersafeguardsmaybesubstitutediftheymaintainthelevelofsystemsecuritycommensuratewiththesensitivityofthedata.TheAISSecurityOfficermustapproveexceptions(writtenwaiver%%waiverC%%)toC2%% C2e%%functionalsecurityrequirementsforsensitiveAIS.(Seealso:AppendixC)-)1 (# (# Ї0  0` (#(#(b)0 ` (#` (#TheNationalComputerSecurityCenter(NCSC)TechnicalGuide,Trusted   NetworkInterpretationoftheTrustedComputerSystemEvaluationCriteria%%g]Trusted Computer System Evaluation Criteriag%%(TNI  TCSEC%%TCSEC8%%,commonlyknownasthe redbook),providesguidanceonachievingC2%% C28%%functionalityinnetworks%%!networks!%%.[NCSCTG005]  (# (# 0  (2)0` (#(#ThedesignofAISsthatprocess,store,ortransmitsensitiveinformationmustincludeat KB aminimum,theautomatedsecurityfeaturesdiscussedinthissection.SecuritysafeguardswillbeinplacetoensureeachpersonhavingaccesstoasensitiveAISisindividuallyaccountablefortheiractionsonthesystem. ` (#` (# 0  0` (#(#(a)0 ` (#` (#UserIdentification.Useraccesswillbecontrolledandlimitedbasedonpositive    useridentificationandauthenticationmechanismsthatsupporttheminimumrequirementsofaccesscontrol,leastprivilege%%/%least privilege/%%,andsystemintegrity.  (# (# 0  0` (#(#(b)0 ` (#` (#Authentication.ForAISrequiringauthenticationcontrols,theAISwillensure   thateachuserisauthenticatedpriortoAISaccess.Thepreferredmethodforauthenticatingusersisapassword%%!passwordi!%%systemwhereauthenticationisdoneeachtimethepassword%%!passwordi!%%isused.Moresophisticatedauthenticationtechniques,suchas smartcards,MISSI%%MISSId%%(MultilevelInformationSystemsSecurityInitiative)technology(Fortezza,Capstone,etc.),biologicalrecognitionsystems(retinascanners,handprint,voice%%voiced%%recognition,etc.),mustbecostjustifiedthroughtheriskanalysis%%+!risk analysis+%%process.[MISSI]  (# (# 0  0` (#(#(c)0 ` (#` (#Audit%%Audita%%Records.AIStransactionsaresubjecttorecordingandroutinereviewfor  inappropriateorillegalactivity.Audit%%Audita%%trailrecordsshouldbesufficientindetailtofacilitatereconstructionofeventsifcompromiseormalfunctionoccurs,orissuspected,andshouldbereviewedasspecifiedintheAISsecurityplan%%+!security plan6+%%.Theaudit%%audity%%trailrecordsshouldcontainatleastthefollowinginformation.  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#Identifierofeachuseranddeviceaccessingorattemptingtoaccessan  AIS. (#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#Thetimeanddateoftheaccessandofthelogoff.I@ (#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#Identifyactivitiesthatmightmodify,bypass,ornegateAISsecurity  " safeguards. (#(# 0  0` (#(#0 ` (#` (#(iv)0 (# (#Logofsecurityrelevantactionsassociatedwithprocessing.#%(#(# 0  0` (#(#(d)0 ` (#` (#ObjectReuse%%)Object Reuse)ReuseR%%.SensitiveAISmustclear%%clearR%%memoryand/ordatastorageareas(RAM, ?%6!' DASD,tape,R/WOptical,etc.)priortoreallocationoftheareatoadifferentuser.Thispreventsoneuserfromobtainingresidualdata%%+!residual data6+%%ofanotheruser.  (# (# 0  0` (#(#(e)0 ` (#` (#AccessControl.SensitiveAISmayimplementadditionaldiscretionaryaccess ($+ control%%I?discretionary access controlI%%(DAC)measuressuchasfilepasswords,accesscontrollists,diskencryption%%%encryptiony%%%,orothertechniques,asdefinedintheapprovedsystemsecurityplan%%+!security planc+%%.  (# (# 0  (3)0` (#(#ForsensitiveAISthefollowing WarningBanner %%-#Warning Bannerc-%%(exactlyaswordedinFigure3)must ,(/ bedisplayedtousersatlogontime,followedbyapauserequiringmanualinterventiontocontinue.ThisaddressestheconcernthatusersareinformedthatallCustomsAISsare -)1 subjecttomonitoring%%%monitoring%%%andthatbyusingtheAIStheyconsenttosuchmonitoring%%%monitoring%%%. ` (#` (# %nCLD8 ($pxdp `E Gp8ttTZp d n   (#(#%%nC8 ($pxdp `E Gp8ttTZp d n% (#(#  0  (4)0` (#(#Automaticinteractivesessiontimeout(logoff)willbeprovidedforallgeneralsupport  and/orsensitiveAISs.Thiswilllockoutausersessionafteranintervalofinactivity,nottoexceedthetimeintervalandrestartrequirementsspecifiedintheAISsecurityplan%%+!security plan2+%%.SystemlogonwillberequiredtoreaccesstheAIS. ` (#` (# 0  (5)0` (#(#InterconnectionsbetweensensitiveCustomsAISsandnonCustoms%%'nonCustoms'%%AISsmustbe  establishedthroughcontrolledinterfacesandwillbeaccreditedatthehighestsecuritylevelofinformationonthenetwork.ConsulttheAISSecurityOfficerforguidanceonestablishingcontrolledinterfaces. ` (#` (# 0  0` (#(#Controlledinterfacefunctionsareacombinationofgatewayandguardfunctions. ` (#` (# 0  0` (#(# 0a"0 ` (#` (#  Gatewaysprovidesecurepointsofinterconnectionbetweennetworks%%!networks!%%,connected !# peripheraldevices,remoteterminals,orremotehosts,andprovideareliableexchangeofinformationtoallowsecureinterconnectionsbetweencomponents.  (# (# 0  0` (#(# 0a"0 ` (#` (#  Automatedguardprocessorsandsecurityfilters(e.g.,firewall)aresoftware, ?%6!' combinedhardware/softwaretechniques,orspecializedhardwarethatfilterinformationinadatastreambasedonassociatedsecurityinformationand/ordatacontent.  (# (#   4.3.20  SecurityAssurances " )x%,(#(# 0  (1)0` (#(#AISswillbeexaminedwhenreceivedfromthevendor%%vendor%%(s)andbeforebeingplacedinto 5+,'. operation.Thefollowingareasmustbeconsidered: ` (#` (#   ,(0 & B  0  0` (#(#(a)0 ` (#` (#Hardware.Anexaminationwillresultinassurancethattheequipmentappearsto   beingoodworkingorderandhasnocomponentsthatmightbedetrimentaltothesecureoperationoftheresourcewhenplacedunderCustomscontrolandcognizance.Subsequentchangesanddevelopmentswhichaffectsecuritymayrequireadditionalexamination.'B   (# (# 0  0` (#(#(b)0 ` (#` (#InhouseDevelopedSoftwareorGovernmentOffTheShelf(GOTS).Newor %  significantlychangedsoftwaredevelopedbyorspecificallyforCustomsortheGovernmentwillbesubjecttotesting%%testing%%andreviewatallstagesofthedevelopment,asrequiredbytheSDLC%%SDLCg%%.[USCS55004]  (# (# 0  0` (#(#(c)0 ` (#` (#Commercial%%%Commercial%%%OffTheShelfSoftware(COTS%%COTSc%%).Commerciallyprocuredsoftware g ^  willbeexaminedtoassurethatthesoftwaredoesnotcontainfeatureswhichmightbedetrimentaltoAISsecurity.SecurityrelatedsoftwarewillbeexaminedbyCustomsauthorizedpersonneltoassurethatthesecurityfeaturesfunctionasspecified.  (# (# 0  (2)0` (#(#CustomsendorsestheuseofproductsfromtheEvaluatedProductsList%%?5Evaluated Products List?%%(EPL%% EPLa%%)ofthe z NationalComputerSecurityCenter(NCSC).EPL%% EPLa%%productsarecomputersystems,software,orcomponentsthatprotectinformationwhileitisbeingstoredorprocessed. ` (#` (# 0  0` (#(#WhencertifiedasproperlyimplementedthroughtheprocessdiscussedinSection3.4,theseproductswillbeacceptedasmeetingthesecurityrequirementsfortheportionofthesensitiveAISwheretheyareused. ` (#` (# 0  (3)0` (#(#WhenEPL%% EPLa%%productsarenotspecifiedorusedforsensitiveAIS,theAISsecurityplan%%+!security planc+%%must SJ includeafunctionalitystatementandimplementationscheduleofhowtheC2%% C2r%%securitylevelfunctionalitywillbeachieved.Thestatementwillbecomepartoftheaccreditation%%+!accreditationc+%%packageandmustaddressthefollowingEPL%% EPLd%%evaluationareas. ` (#` (# 0  0` (#(#(a)0 ` (#` (#Confidenceinsoftwaresource.Inacquiringsoftwareresourcestobeusedaspart  ofasensitiveAIS,considerationwillbegiventothelevelofconfidenceplacedinthevendor%%vendora%%toprovideaqualityproduct,tosupportthesecurityfeaturesoftheproduct,andtohelpinthecorrectionofanyflaws.  (# (# 0  0` (#(#(b)0 ` (#` (#Securityperformancetesting%%testingt%%.Securityperformancetesting%%testingt%%includesboth !# certification%%+!certificationc+%%testing%%testingt%%thatisperformedbeforetheAISisaccreditedandongoingperformancetesting%%testingt%%thatisperformedonaregularbasis.  (# (# 0  0` (#(#(c)0 ` (#` (#Securitypenetrationtesting%%testingt%%.Inadditiontotesting%%testingt%%theperformanceoftheAIS, ?%6!' therewillbetesting%%testingt%%toattempttopenetratethesecuritysafeguardsofthesystem.Thetestprocedureswillbedocumentedinthetestplanforcertification%%+!certificationc+%%andintheongoingtestplan.  (# (# 0  0` (#(#(d)0 ` (#` (#Lifecycle%%%Lifecyclen%%%assurance.Thedevelopmentofhardware,firmware,andsoftwarewill )x%, beconductedunderlifecycle%%%lifecyclen%%%controlandmanagement.  (# (# 0  (4)0` (#(#Aconfigurationmanagement%%A7configuration managementA%%(CM)systemisrequiredtopreservetheAISaccreditation%%+!accreditationa+%% ,(/ integrityandmaintaincontrolofchangestoanyoftheAISfeaturesthatmayaltertheaccreditation%%+!accreditationa+%%status.ExamplesofCMactivitiesincludesecurityrelatedhardwarechanges, -)1 orchangestoanylineofsourceorobjectcodeofthesecurityrelatedsoftware.TheCMsystemwillrecordbywhom,forwhatreason,andwhenthechangeismade.Documentationofthesecurityrelatedhardwareand/orsoftwaredesignwillbemaintainedandkeptcurrent.[NCSCTG006] ` (#` (#   4.3.30  DesirableSecurityFeatures / KB(#(# 0  (1)0` (#(#AISplanningmustconsidertechnologicaladvancesinsecurityfeatures.Theplanning   processwillbedocumentedandapprovedviatheAISsecurityplan%%+!security plan8+%%. ` (#` (# 0  (2)0` (#(#Interoperabilitywithexternalsystemsmustconsidersupportfordigitalsignaturestandards    (DSS),nonrepudiationinmessagingsystems,anddataencryption%%%encryptionn%%%issuesastheyrelatetointeragencycommunicationsorinteroperability. ` (#` (# 0  (3)0` (#(#ContinuousOnLineAutomatedMonitoring%%%Monitoringn%%%andWarningfunctionsforsensitiveAIScan   providerealtimeusemonitoring%%%monitoringn%%%(audit%%auditi%%)andrealtimewarningtotheDSOsofsuspectedAISmisuse. ` (#` (# 0  (4)0` (#(#NetworkAccessControlFeaturesshouldaddressthefollowingareas,toachieveC2%% C2t%%level ]T securityofcommunicationspaths: ` (#` (# 0  0` (#(#(a)0 ` (#` (#IdentificationandAuthenticationForwarding.Reliableforwardingofthe  identificationshouldbeusedbetweenAISswhenusersareconnectingthroughanetwork.Whenidentificationforwardingcannotbeverified,arequestforaccessfromaremoteAISshouldrequireauthenticationbeforepermittingaccesstothesystem.  (# (# 0  0` (#(#(b)0 ` (#` (#ProtectionofAuthenticatorData.Inforwardingtheauthenticatorinformationand  anytables(e.g.,password%%!password!%%tables)associatedwithit,thedatashouldbeprotectedfromaccessbyunauthorizedusers(e.g.,byencryption%%%encryptionn%%%)toensureitsintegrity.  (# (#   4.40  ADMINISTRATIVESECURITY B of(#(# 0  Administrativesecurityconsistsofthecontrolsandoperationalproceduresusedwithorinplaceofcomputersecurityfeatures.Administrativesecuritycontrols%%3)security controls3%%mustbedocumentedintheAISsecurityplan%%+!security planl+%%,SecurityFeaturesUsersGuide%%MCSecurity Features Users GuideM%%(SFUG%%SFUGt%%),andTrustedFacility%%!Facilityc!%%Manual%%?5Trusted Facility ManualG?%%(TFM%% TFMi%%)foreachaccreditedAIS. (#(#   4.4.10  AccountabilityandAccessControlCriteria  e$\ &(#(# 0  TheDSOwillestablishaccesscontrolcriteriaandadministrativeprocedurestolimitaccesstoinformationprocessed,stored,ortransmittedbysensitiveCustomsAISs.TheseactivitiesaredocumentedintheAISsecurityplanningprocess,approvedbytheAISSecurityOfficer,andaccreditedasdiscussedinSection3.4andshouldincludeatleastthefollowing: (#(# 0  (1)0` (#(#TheaccesscontrolcriteriaidentifywhoisauthorizedAISaccessandwhoisresponsible [*R&- forapprovingsuchaccess. ` (#` (# 0  0` (#(#(a)0 ` (#` (#Theindividualwhorequiresaccessmustpossesstheappropriatesecurity ,(0 authorizationandhaveavalidneedtoknow.-)1 (# (# Ї0  0` (#(#(b)0 ` (#` (#TheAISsecurityfeaturesmusthavethecapabilitytorestricttheuser'saccessto   onlythatinformationwhichisnecessaryforscopeofthejoborassignment.  (# (# 0  (2)0` (#(#CustomsandcontractorpersonnelwhoaccesssensitiveCustomsAISsmusthavea  completedBI(discussedinSection4.2).PersonnelmustonlybegrantedaccesstoAISsforwhichtheyhaveavalidneedtoknowbasedontheiroperationalneeds(i.e.,principleofleastprivilege). ` (#` (# 0  (3)0` (#(#CustomsAISsaregenerallydesignedfortheuseofCustomspersonnel,butbyspecial   arrangementsCustomsmayauthorizecertaintypesofaccesstootherFederal,State,local,orinternationallawenforcementagencies,othergovernmentagencies,privatecontractors,andtradecommunity%%/%trade community/%%membersinsupportofparticularoperations. ` (#` (# 0  0` (#(#WrittenrequestsforspecialaccessmustbesubmittedtotheappropriateCustomsSecurityAdministratorwhocoordinatestheAISsecurityprocessforthesponsoringorganization.TheSecurityAdministratorwillensurethatsuchrequestsmeetthefollowingcriteria. ` (#` (# 0  0` (#(#(a)0 ` (#` (#Theindividualforwhomaccessisrequestedmusthaveappropriatesecurity z authorizationfortheinformationorfunctionswhicharebeingrequested.  (# (# 0  0` (#(#(b)0 ` (#` (#Theindividualmusthaveavalidneedtoknow(i.e.,accessisanoperational  necessity)documentedintheapplication%%'applicationt'%%bythesponsoringorganization.  (# (# 0  0` (#(#(c)0 ` (#` (#TheAISsecurityfeatureshavethecapabilitytorestricttheuser'saccesstoonly  informationand/orfunctionsappropriatefortheauthorizedactivities.  (# (# 0  0` (#(#(d)0 ` (#` (#IftheAISaccessisformemberstradecommunity%%/%trade community/%%,itmustbebasedonlimitsas -$ specifiedinformalagreementswithCustoms.  (# (# 0  (4)0` (#(#SomeCustomsAISsaredesignedforthesupportofthelawenforcement,trade  communities(e.g.,TECS,ACS),andotheragencies.Accessrequirements,controls,andproceduresaredefinedforeachsystemanddocumentedinitsSystemSecurityPlan%%+!Security Plan+%%.ReferencetheappropriateAISsupportdocumentationfordetailsrelatedtosuchsystems. ` (#` (#   4.4.20  SoftwareandDataSecurity *  "(#(# 0  (1)0` (#(#AllexecutablesoftwareusedonsensitiveCustomsAISsshouldbeobtainedthrough "$ authorizedprocurementchannels.Softwareacquiredbyanyothermeans(e.g.,publicdomainsoftware,bulletinboardservices,personallyownedsoftware[developedorpurchased])isrestrictedandmustbeapprovedinwritingbyAISSecurityAdministration ?%6!' asanoperationalnecessity. ` (#` (# 0  (2)0` (#(#Safeguardsmustbeinplacetodetectandminimizeinadvertentormaliciousmodification '#* ordestruction,orattemptstodoso,ofasensitiveAIS'sapplication%%'application'%%software,operatingsystemsoftware,andcriticaldatafiles.ThesafeguardsshouldachievetheintegrityobjectivesandbedocumentedintheAISsecurityplan%%+!security plan8+%%. ` (#` (# 0  0` (#(#(a)0 ` (#` (#ExecutablesoftwareauthorizedtorunonasensitiveCustomsAISwillbe ,(/ identifiedintheAISsecurityplan%%+!security plan8+%%.  (# (#  -)1 &  0  0` (#(#(b)0 ` (#` (#Thelevelofprotectionmustbecommensuratewiththesensitivityofthe   informationprocessed.'    (# (# 0  0` (#(#(c)0 ` (#` (#Ataminimum,essentialdatashouldbebackedupandthemediastoredphysically  separatefromtheAIS(preferablyatanoffsite%%site%%location).AppropriateAISsecuritycontrols%%3)security controls3%%mustbeinplacetoassureviabilityofsuchbackups.  (# (# 0  (3)0` (#(#Virus%%Virusy%%andmaliciouscode%%-#malicious codes-%%(software)preventionandcontrolmeasures,commensuratewith   theidentifiedlevelofrisk,willbeemployedtoprotecttheintegrityofthesoftwareanddataforapplicableAIS. ` (#` (# 0  0` (#(#(a)0 ` (#` (#TheAISSecurityOfficermanagesthevirus%%virusu%%protectionprogramforCustomsand g ^  shouldbecontactedforapprovedpreventionandcontrolmeasures(e.g.,behaviordetection,scanning,cleanuptechniquesand/orprocedures)ifthereisasuspectedorknownmaliciouscode%%-#malicious codes-%%(software)threat.  (# (# 0  0` (#(#(b)0 ` (#` (#Identifiedincidentsofmaliciouscode%%-#malicious codes-%%(software),orvirus%%virusu%%infectionsshouldbe   reportedpromptlytotheDSO,AISSecurityOfficer,and/orIA,asappropriate.  (# (# 0  0` (#(#(c)0 ` (#` (#PriortointroductionintoorusebyCustoms,AISdatarecordingmediawillbe 7. scannedformaliciouscode%%-#malicious codes-%%(software),including:  (# (# 0  0` (#(#0 ` (#` (#(i)0 (# (#allCustomsseizedAISmachinesandmedia,(#(# 0  0` (#(#0 ` (#` (#(ii)0 (# (#allremovableAISmagneticoropticalrecordingmedia(e.g.,floppy yp disks,CDROM,etc.),regardlessofsource,and (#(# 0  0` (#(#0 ` (#` (#(iii)0 (# (#allfixedAISstoragedevices(e.g.,harddrives,R/WOptical,etc.),ona  periodicbasis. (#(# 0  (4)0` (#(#Useofcopyrightedsoftwarewillcomplywithcopyright%%#copyrighto#%%lawsandlicense%%license%%agreements.` (#` (# 0  (5)0` (#(#Introductionofdatafromsourcesand/orinformatsotherthanthosespecifiedinthe I@  appropriateAISsecurityplan%%+!security plan+%%(e.g.,financialdatareceivedfromfinancialinstitutions)mustbeapprovedinwritingbytheAISSecurityOfficerasanoperationalnecessity.Theseactivitiesmustbeinconformancewiththeaccreditation%%+!accreditation+%%oftheAISandFOIA%%FOIAi%%/PA(FreedomofInformation%%=3Freedom of Information=%%Act/PrivacyAct%%'Privacy Actf'%%)requirements. ` (#` (# 0  (6)0` (#(#Tomaintainsoftwareintegrity,properconfigurationmanagement%%A7configuration managementA%%(CM)andcontrolsmust e$\ & beusedtomonitorsoftwareinstallationandupdates.Thisprocesswillprovideahistoricalrecordofsoftwarechanges;helpingtoensurethatthesoftwarefunctionsasexpected,ismaintained,andthatonlyauthorizedsoftwareispermittedontheAIS. ` (#` (#   4.4.30  TechnicalSupportandMaintenance  %%'Maintenance'%%($+(#(# 0  (1)0` (#(#Technicalsupportandmaintenance%%'maintenance'%%activitiesforCustomsAISmustensurethat:[*R&-` (#` (# 0  0` (#(#(a)0 ` (#` (#Hardwareandsoftwaremaintenance%%'maintenance'%%activitiesdonotaffecttheintegrityof ,(/ existingsafeguardsorpermittheintroductionofsecurityexposuresintoanAIS(e.g.,computerviruses,TrojanHorses,logicbombs,maliciouscode%%-#malicious code-%%,etc.).-)1 (# (# Ї0  0` (#(#(b)0 ` (#` (#SensitiveCustomsAISelectronicstorageandmemorydevicesarenotreleased   fromCustomscontrolwithoutproperclearing%%!clearing!%%procedurestoremoveresidualdata%%+!residual dataV+%%.Exceptions(waivers)mustbeapprovedbytheAISSecurityOfficer.  (# (# 0  0` (#(#(c)0 ` (#` (#Automated(i.e.,computerconnected)dialup%%dialupd%%diagnostic%%%diagnostica%%%maintenance%%'maintenance'%%ofsensitive qh CustomsAISviaremotecommunicationsbetweenvendorsandCustomsAISfacilitiesisprohibitedunlessauthorizedbyPrincipalAccreditingAuthority%%OEPrincipal Accrediting AuthorityO#Authorityc#%%(PAA%% PAAr%%)intheAISAccreditation%%+!Accreditationd+%%.TheAccreditation%%+!Accreditationd+%%shouldreferenceanapprovedcontract,MOU%% MOUd%%,orotheragreementwhensuchaserviceisincluded.  (# (# 0  (2)0` (#(#AIStechnicalsupportandmaintenance%%'maintenance'%%workperformedinCustomsfacilities(onsite%%siten%%)must    besupervisedbyorunderthecontrolofCustomspersonnelknowledgeableinappropriateAISoperations. ` (#` (# 0  0` (#(#Onsite%%siten%%AIStechnicalsupportandmaintenance%%'maintenance'%%personnelmustmeetthepersonnelsecurityrequirements.(Seealso:Section4.2) ` (#` (# 0  (3)0` (#(#AIStechnicalsupportandmaintenance%%'maintenance'%%mustbeconsideredinAIScertification%%+!certificationd+%%.z` (#` (#   4.4.40  Portable%%!Portablei!%%ComputerEquipment /( 7.(#(# 0  CustomsAISportable%%!portable!%%computers,relatedtypesofequipment,andstoragemediamustberestrictedtotheexclusiveauthorizedCustomsuse.UnattendedCustomsAISequipmentandstoragemediamustbesecuredinanappropriatemannercommensuratewiththesensitivityofthedata,equipment,andauthorizeduse.Totheextentpossible,suchequipmentandstoragemediamustbekeptinthepossessionoftheindividualtowhomitisissuedorchargedout. (#(#   4.4.50  Classification%%-#Classification8-%%andControls * (#(# 0  (1)0` (#(#CustomsAISsthatstore,process,ortransmitsensitiveinformationmustbeadequately  safeguardedtoensurethataccesstosensitiveCustomsinformationisrestrictedtoCustomsauthorizedpersonnel,andoperatedonlybyCustomsauthorizedpersonsinfacilities(physicalspace)underCustomsauthorizationorcontrol. ` (#` (# 0  (2)0` (#(#WhennotunderthecontrolofCustomsauthorizedpersonnel,CustomssensitiveAISsand  " relatedequipmentmust,ataminimum,besecuredasfollows: ` (#` (# 0  0` (#(#(a)0 ` (#` (#Microcomputers,terminals,displays,andrelatedAISequipmentwhichmight #% provideunauthorizedaccesstosensitivedataorresources,mustbeturnedofforotherwisemadeunaccessible.Additionalappropriatesecuritycontrolmeasuresmaybenecessaryinsomesituations.Exceptions(waivers)mustbepartoftheaccreditation%%+!accreditation8+%%statementorseparatelyapprovedbytheAISSecurityOfficer.  (# (# 0  0` (#(#(b)0 ` (#` (#Diskettes,tapes,removablestoragedevices,printerribbonsorlasercartridges, ($+ andotherAISmediawhichcontainsensitiveinformationmustbelabeledandsecuredcommensuratewiththehighestlevelofinformationstoredonthedevice.Destructionofsuchmediamustbeappropriatetothelevelofsensitivityofthedatastoredonit.  (# (#   ,(0   &   4.4.60  ExternalLabels 2 %%Labels%% (#(# 0  InanAISenvironmentwherenoclassified%%%classified1%%%informationisprocessedorstored,specialsecuritylabels%%labelse%%withtheword Unclassified,arenotrequiredtoidentifythatthestoragemediacontainsunclassifiedinformation.However,forsomecategoriesofSBU%% SBUs%%data,specialidentificationlabels%%labelse%%arerequired.ReferenceSafeguardingClassified%%%Classified1%%%InformationHandbook,fortheappropriate KB procedures.[USCSHB140003] (#(# ' 20  Theterm unclassifiedisnotasecurityclassification%%-#classification-%%,butisacategoryofdatawithinwhichareseveralsubcategories,includingsensitivebutunclassified%%E;sensitive but unclassified@E%%(SBU%% SBUt%%)andpublicinformation. (#(# 0  Sensitivebutunclassified%%E;Sensitive but unclassified@E%%(SBU%% SBUt%%)informationisrestrictedtoauthorizedpersonswithaneedtoknowandrequiresappropriatecontrolsasexplainedinthismanual. (#(#   4.4.70  CustomsWorkPerformedatnonCustoms%%'nonCustoms'%%Locations 8  (#(# 0  WhenoperationalnecessityrequiresthatCustomsauthorizedworkbeperformedatnonCustoms%%'nonCustoms'%%controlledlocations(e.g.,fieldassignment,workathome%%)work at home)%%,etc.),thefollowingpoliciesapplyandassociatedrisksmustbeappropriatelymanaged. (#(# 0  (1)0` (#(#Customsmanagementmustdeterminethatrequiredsecuritycontrols%%3)security controls3%%anddocumentation  areinplaceforauthorizedAISoperationsandthatSBU%% SBUi%%informationisproperlyprotected.Althoughcurrenttechnologymakesitfeasibletoaddresstheserequirements,providingadequatesafeguardsandconductingrelatedactivitiesforindividualAISsmaynotalwaysbecosteffective. ` (#` (# 0  0` (#(#& h AISsecuritycontroldocumentationincludesthefollowing. ` (#` (# 0  0` (#(#(a)0 ` (#` (#Systemsecurityplan%%+!security planl+%%. (# (# 'h-A=0  0` (#(#(b)0 ` (#` (#Riskanalysis%%+!Risk analysisl+%%. (# (# 0  0` (#(#(c)0 ` (#` (#Contingency%%'Contingency'%%plan%%1'Contingency plan1%%.I@  (# (# 0  0` (#(#(d)0 ` (#` (#Securityprocedures. " (# (# 0  0` (#(#(e)0 ` (#` (#Certification%%+!Certificationn+%%."$ (# (# 0  0` (#(#(f)0 ` (#` (#Accreditation%%+!Accreditationn+%%.e$\ & (# (# 0  (2)0` (#(#AISequipment(whetherornotCustomsowned)usedtoprocessSBU%% SBUd%%atnonCustoms%%'nonCustoms'%% &"( controlledlocationsmustmeetthesecurityrequirementsforsensitiveCustomsAISsaspresentedinthispolicymanual. ` (#` (# 0  (3)0` (#(#AuthorizeduseofCustomsownedcomputerequipmentathomeispermittedwhensuch )x%, usageisconsistentwiththepolicyaspresentedinthismanual. ` (#` (#   5+,'.   & B  4.4.80  UseofNonCustoms%%'NonCustoms'%%OwnedAISs D  (#(# 0  (1)0` (#(#ItisTreasurypolicythat, Personallyownedcomputersandsoftwarewillnotbeusedto  processsensitivebutunclassified%%E;sensitive but unclassified@E%%(SBU%% SBUt%%)informationwithouttheapproval%%!approvalb!%%ofthePrincipalAccreditingAuthority%%OEPrincipal Accrediting Authority O#Authorityc#%%.(Reference:TDP7110,Chap.VI,Section4.D.1).'B 'D ` (#` (# 0  0` (#(#Treasurypolicydefines,Personallyowned%%1'Personallyownedi1%%computersorsoftwareas, Computersor %  softwarepurchasedwithnongovernmentfunds,exceptthoseturnedoverforexclusiveU.S.GovernmentcontrolanduseandwheretheharddrivewillbeproperlyerasedwhenthesystemisnolongerinU.S.Governmentuse. ` (#` (# 0  0` (#(#(Reference:TDP7110,AppendixB.Definitionupdated11/24/95). ` (#` (# 0  (2)0` (#(#ItisCustomspolicythat,nonCustoms%%'nonCustomsn'%%ownedcomputersorsoftwarewillnotbeusedto A8  process,access,orstoreSensitiveButUnclassified%%E;Sensitive But UnclassifiediE%%(SBU%% SBUt%%)informationwithoutthewrittenapproval%%!approvalB!%%ofthePrincipalAccreditingAuthority%%OEPrincipal Accrediting Authority O#Authorityc#%%(PAA%% PAAr%%). ` (#` (# 0  0` (#(#(a)0 ` (#` (#Policyexceptions(waivers)mustbeapprovedbythePAA%% PAAr%%whoassumesthe   associatedrisksforauthorizingtheuse.  (# (# 0  0` (#(#(b)0 ` (#` (#TheprotectionrequirementsfordataonCustomsownedequipmentapplyequally 7. totheprotectionofdatawhenusedonnonCustoms%%'nonCustoms'%%ownedequipment.  (# (#   4.50  TELECOMMUNICATIONS%%5+TELECOMMUNICATIONS:5%%SECURITY N(#(# 0  TheFederalgovernmentisdevelopingappropriatesecuritypoliciesandinfrastructuresthatdealwiththerapidlychangingfieldoftelecommunications%%5+telecommunications,5%%.UndertheauspicesoftheWhiteHouseOfficeofScienceandTechnologyPolicy,theNationalInformationInfrastructure%%WMNational Information InfrastructureNW%%TaskForce(NITF)isadrivingforceinthiseffort.TheNITFincludeshighlevelrepresentativesofFederalagenciesthatplayamajorroleinthedevelopmentandapplication%%'applicationr'%%ofinformationandtelecommunications%%5+telecommunications 5%%technologies.[GAO94285;GAO9523] (#(#   4.5.10  InformationSystemStandards Rof(#(#  0  ItisthepolicyoftheDepartmentoftheTreasurytocomplywithallmandatoryFederalInformationProcessingStandards(FIPS),mandatoryFederalTelecommunications%%5+Telecommunications5%%Standards(FEDSTDs),voluntaryFIPS,FEDSTDs,AmericanNationalStandardsInstitute(ANSI),orotherinformationsystemstandardsandguidelinestotheextenttheyaredeterminedtobecosteffectiveandappropriatefortheintendeduse.Awaiver%%waiver%%processisdefinedinTreasuryInformationSystems #% StandardProgram,8/23/89.[TD8701;COHEN]e$\ &(#(#   & B 4.5.20  NetworkConnections -V &"((#(# 0  TelecommunicationconnectionsbetweenCustomsAISsandnonCustoms%%'nonCustoms'%%AISsornetworks%%!networkss!%%,publicorprivate,maybeauthorizedbytheAISSecurityOfficerunderthefollowingconditions: (#(# 'B&:V0  (1)0` (#(#NonsensitiveCustomsAIS,whenoperatedinadedicatedsecuritymode%%?5dedicated security mode ?+!security modei+%%,mustbelocally [*R&- documented,includingtheadministrativeapproval%%!approvalo!%%oftheAISSecurityOfficerandatechnicaldescriptionoftheconnection(s).Example:microcomputers,PCs,etc.,thatdonotcontainorprocessSBU%% SBUv%%dataandarenotconnectedphysicallyorlogicallytoanyotherCustomsAISornetwork(TreasuryorCustoms).-)1` (#` (# Ї0  (2)0` (#(#AllotherCustomsAISconnectionstononCustoms%%'nonCustoms '%%networks%%!networkss!%%mustbeapprovedbytheAIS   SecurityOfficer,onacasebycasebasis.TheAISSecurityOfficerwillensurethattheappropriatesafeguardsareinplaceandthatdocumentation,suchaslicense%%license%%agreements,memorandaofunderstanding(MOU%% MOUs%%),interconnectionagreements,etc.,areexecutedonbehalfofCustoms,aspartoftheapproval%%!approvals!%%process.Example:CustomsAISaccesstotheNationalInformationInfrastructure%%WMNational Information Infrastructure8W%%(NII)orcommercial%%%commercialo%%%informationdatabases(e.g.,LEXIS/NEXIS,Dun&BradstreetBusinessrecords,D&BWorldbase,etc.). ` (#` (#  4.5.3 0  Internet%%!Internet!!Internet!%%Services  (#(# 0  Treasurypolicy:IssuedApril28,1995,bytheDeputyAssistantSecretaryforInformation    Systems.[TDINTERNET] (#(# 0  TreasuryoperatingpolicyrequiresthatanyaccesstotheInternet%%!Internet!!Internet!%%servicesfromTreasuryAIS(includingCustoms)beprovidedviaprotectedInternet%%!Internet!!Internet!%%gateways(accesscontrolmechanisms)thathavebeenapprovedbytheOfficeofTelecommunications%%5+Telecommunications,5%%Management(OTM). (#(# 0  ExceptionsmustbeapprovedinwritingbytheDirector%%!Directori!%%,OTM. (#(# & B 0  Customspolicy:7.(#(# 0  InadditiontoTreasurypolicy,CustomsownedorcontrolledAISsmayonlyaccesstheInternet%%!Internet!!Internet!%%viaCustomsapprovedgateways. (#(# 'B7c0  ThislimitationmeansthatCustomsowned,controlled,orauthorizedcomputerequipment,regardlessofitslocationormeansofconnectiontoanynetworkorsystem,maynotbeusedtoaccesstheInternet%%!Internet!!Internet!%%,directlyorindirectly(e.g.,viaserviceproviderssuchasCompuServe,AOL,etc.)unlesssuchconnectionisviaaCustomsapprovedInternet%%!Internet!!Internet!%%gateway(i.e.,firewall).Whiletheconfigurationofsomenetworks%%!networks!%%makeittechnicallypossibletoaccesstheInternet%%!Internet!!Internet!%%withoutgoingthroughanapprovedgateway,suchaccessisnotauthorized. (#(# 0  ExceptionstothispolicymustbeapprovedinwritingbytheDirector%%!Director!%%,OTM,U.S.TreasuryDepartment.[TDINTERNET] (#(#   4.5.40  ElectronicMail(EMail) h  "(#(# 0  Governmentprojectsandcommercial%%%commercial1%%%productsforsecureelectronicmail(EMail)systemsareundergoingrapiddevelopmentandwillbeavailableinthecomingyears.Untilsuchproductsareimplemented,usersarecautionedNOTtosendsensitiveinformationviaEMail. (#(#   4.5.50  Facsimile%%#Facsimile#%%(FAX%% FAXm%%) xj &"((#(# 0  Sensitiveinformationwillonlybetransmittedviaasecurefacsimile%%#facsimile#%%system(e.g.,encryptedorviaaprotectednetwork).Commercial%%%Commercial1%%%offtheshelf(COTS%%COTSc%%)softwareandhardwareareavailabletoprovidethenecessarysafeguardsandshouldbeemployedasappropriate. (#(#   [*R&-   &   4.5.60  PBX%% PBX%%andVoice%%Voice%%MailSystems 'm  (#(# 0  PrivateBranchExchanges(PBX%% PBX%%)andVoice%%Voice%%mailsystemsdonotcurrentlymeetstandardsecurityspecificationsandarenotgenerallyconsideredsecuresystems.Theyaresusceptibletounauthorizedaccessandmessagesleftonavoice%%voice%%mailsystemshouldcontaintheleastamountofinformationpossible.Donotleaveanyinformationonavoice%%voice%%mailsystemthat,ifcompromised,coulddamageCustomsmission.ReportsuspectedunauthorizedaccessattemptstoAISSecurityAdministration. (#(# ' 4m0  PBX%% PBX%%systemsmustbephysicallysecuredandsystemsecurityfeaturesconfigured(totheextentpossibleforaspecificsystem)topreventunauthorizedaccesstodialtones,modems,orotherAISaccess.(Seealso:AppendixD.GoodSecurityPractices%%5+Security Practices5%%). (#(# 0  Voice%%Voicey%%MailandVoice%%Voicey%%InteractiveResponsesystemsmustbeconfigured(totheextentpossible)topreventunauthorizedaccesstodialtones,modems,orotherAISaccess. (#(# 0  (Seealso:AppendixB.GoodSecurityPractices%%5+Security Practices[5%%). (#(#   4.5.70  CommunicationsSecurity(COMSEC%%COMSEC%%) 4tz(#(# 0  COMSEC%%COMSEC%%isintendedistodenyunauthorizedpersonsinformationderivedfromtelecommunications%%5+telecommunications,5%%oftheUnitedStatesGovernmentrelatedtonationalsecurityandtoensuretheauthenticityofsuchcommunications.COMSEC%%COMSECu%%issuesshouldbedirectedtotheCommunicationsSecurityManagementBranch,Orlando,FL.[USCS430009] (#(#  r ,\%. %% %%_%%%  &&CHAPTER5 X   SECURITYINCIDENTS%%5+SECURITY INCIDENTS5%%ANDVIOLATIONS x#w##&&w#%%%VIOLATIONSI%%% 8 A&-) xddExAw  Definition:AISSecurityIncident.AnAISsecurityincidentisanyeventand/orconditionthathasthe A potentialtoimpactthesecurityand/oraccreditation%%+!accreditation +%%ofanAISandmayresultfromintentionalorunintentionalactions.Examplesinclude:unauthorizedattemptstogainaccesstoinformation;introductionofmaliciouscode%%-#malicious code^-%%orvirusesintoCustomsAISs;lossortheftofcomputermedia;orthefailureofanAISsecurityfunctiontoperformasdesigned.Forreportingpurposes,maliciouscode%%-#malicious code^-%%(software)incidentsincludeanydetectionofmaliciouscode%%-#malicious code8-%%,whetherdetectedonmagneticmediapriortothemediasentryintoaCustomsAISorafterinfectionoftheAIS,andanyactualexecutionofmaliciouscode%%-#malicious code8-%%.Definition:AISSecurityViolation.Aneventwhichmayresultindisclosureofsensitiveorclassified%%%classifiedd%%%   informationtounauthorizedindividuals,orthatresultsinunauthorizedmodificationordestructionofsystemdata,lossofcomputersystemprocessingcapability,orlossortheftofanycomputersystemresources.(Seealso:TDP7110,ChapterIII.4)(1)0  Customsemployees,contractors,and/orusersshouldreportsecurityrelatedincidentsand/or _ violations%%%violationsd%%%throughtheappropriatesupervisorychannelstotheDSOs,SecurityAdministrators,AISSecurityOfficer,orInternalAffairs%%1'Internal AffairsA1%%(IA),asappropriate.TheAISSecurityOfficerwillmaintaintheappropriaterecordsandaddresstheimpactofthesecurityincidents%%5+security incidentsA5%%ontheaccreditation%%+!accreditationn+%%statusofrelatedAISs.Additionalsecuritysafeguardstoreducegenericrisksmayberecommended,asrequired. (#(# (2)0  Additionally,maliciouscode%%-#malicious codet-%%(software)andvirus%%virusu%%infectionincidentsonCustomsAIS(i.e., U mainframes,microcomputers,networks%%!networksc!%%,PCS,floppydisksorothermedia,etc.)shouldbepromptlyreportedtotheCustomsHELPDESK,18009278729,fortechnicalresolution. (#(# (3)0  CustomsemployeesmaybesubjecttodisciplinaryactionforfailuretocomplywithCustomsAIS e securitypolicy,whetherornotthefailureresultsincriminalprosecution. (#(# 0  AISsecurityrelatedviolations%%%violationsd%%%areaddressedintheTreasuryStandardsofEthicalConductfor K ! EmployeesoftheExecutiveBranchandtheCustomsConductandEmployeeResponsibilities. %!" Suchviolations%%%violationsd%%%shouldbereportedthroughtheappropriatesupervisorychannelstotheAISSecurityOfficerand/orIA,asappropriate.[TDETHICS;USCS5100005] (#(# (4)0  NonCustoms%%'NonCustomse'%%employeeswhofailtocomplywiththispolicyaresubjecttohavingtheiraccessto $5"& CustomsAISsandfacilitiesterminated,whetherornotthefailureresultsincriminalprosecution. (#(# (5)0  Anypersonwhoimproperlydisclosessensitiveorclassified%%%classified%%%informationissubjecttocriminaland '$) civilpenaltiesandsanctionsunderavarietyoflaws(e.g.,PrivacyAct%%'Privacy Acte'%%...). #'%*(#(#w #@(ThisPageIntentionallyLeftBlank)    C %h.%%.%%m_%%_%7IIXXdNXXd7,&&r   GLOSSARY #r##&&# X A&-) xdE7xA 8 Editorsnote:0 ` Computertermshaveevolvedandbecomemoreclearlydefinedduringthepastdecade. a Thereferenceddefinitionsarefromrecentpublicationsofestablishedsources,andaregenerallypreferred.DHD. ` (#` (# Sourcereferences:0   GlossaryofComputerSecurityTerminology,developedbytheNationalSecurityTelecommunications%%5+Telecommunications5%%and  }  InformationSystemsSecurityCommittee(NSTISSC)andpublishedbyNISTasNISTIR4659.AvailablefromNTISasPB92112259. (#(# 0   GlossaryforComputerSecurityTerms.NationalTechnicalInformationService(NTIS),FIPSPUB39, =  Springfield,VA.,02/15/76. Withdrawn 4/93.ReplacementisFIPS113. (#(# 0   IntroductiontoCertification%%+!Certification+%%andAccreditation%%+!Accreditation+%%.NationalComputerSecurityCenter(NCSC), w NCSC-TG-029,Ver.1,NSA,Ft.GeorgeG.Meade,MD.,January1994. (#(# TreasurySecurityManual,TDP7110,AppendixB,1993. ] n&&&&@*n&n& A#n'##&&X#    Access  = 0  Aspecifictypeofinteractionbetweenasubjectandanobjectthatresultsintheflowofinformationfromonetotheother.Thecapabilityandopportunitytogainknowledgeof,ortoalterinformationormaterialsincludingtheabilityandmeanstocommunicatewith(i.e.,inputorreceiveoutput),orotherwisemakeuseofanyinformation,resource,orcomponentinacomputersystem. (#(#  AccessControl  Y 0  Theprocessoflimitingaccesstotheresourcesofasystemtoonlyauthorizedpersons,programs,processes,orothersystems.Synonymouswithcontrolledaccessandlimitedaccess.Requiresthataccesstoinformationresourcesbecontrolledbyorforthetargetsystem.Inthecontextofnetworksecurity,accesscontrolistheabilitytolimitandcontroltheaccesstohostsystemsandapplicationsviacommunicationslinks.Toachievethiscontrol,eachentitytryingtogainaccessmustfirstbeidentified,orauthenticated,sothataccessrightscanbetailoredtotheindividual. (#(#  Accreditation%%+!Accreditation8+%%/Approval %%!Approvali!%% %)#& 0  TheofficialmanagementauthorizationforoperationofanAIS.ItprovidesaformaldeclarationbyanAccreditingAuthority%%#Authority#%%thatacomputersystemisapprovedtooperateinaparticularsecuritymode%%+!security mode6+%%usingaprescribedsetofsafeguards.Accreditation%%+!Accreditation6+%%isbasedonthecertification%%+!certification6+%%processaswellasothermanagementconsiderations.Anaccreditation%%+!accreditation6+%%statementaffixessecurityresponsibilitywiththeAccreditingAuthority%%#Authorityo#%%andshowsthatpropercarehasbeentakenforsecurity. (#(#   *E(,  &    AccreditingAuthority%%#Authority:#%%(AA)    0  Theofficialwhohastheauthority%%#authority:#%%todecideonacceptingthesecuritysafeguardsprescribedforacomputersystemorthatofficialwhomayberesponsibleforissuinganaccreditation%%+!accreditation8+%%statementthatrecordsthedecisiontoacceptthosesafeguards. (#(# 0  Seealso: DesignatedApprovingAuthority%%#Authority:#%%(DAA),PrincipalAccreditingAuthority %%OEPrincipal Accrediting AuthorityO#Authority:#%%.qh(#(# '  z AdequateSecurity %%3)Adequate Security3%% )  0  Securitycommensuratewiththeriskandmagnitudeoftheharmresultingfromtheloss,misuse,orunauthorizedaccesstoormodificationofinformation.Thisincludesassuringthatsystemsandapplicationsusedbytheagencyoperateeffectivelyandprovideappropriateconfidentiality%%/%confidentiality/%%,integrity,andavailability%%)availabilityy)%%,throughtheuseofcosteffectivemanagement,personnel,operationalandtechnicalcontrols.[OMBA130%%A130i%%,AIII] (#(#  AdministrativeSystems    0  AnautomatedCustomssystemtoprovidesupportinareasofaccounting,personnel,payroll,logisticsandothersupportservices. (#(#  ADP  ~ 0  AutomaticDataProcessing.Seealso: AutomatedInformationSystem aX(#(#  AIS   0  See: AutomatedInformationSystem .(#(#  AISOwner %%#AIS Owner:#%%  0  Theofficialwhohastheauthority%%#authority:#%%todecideonacceptingthesecuritysafeguardsprescribedforanAISandisresponsibleforissuinganaccreditation%%+!accreditationT+%%statementthatrecordsthedecisiontoacceptthosesafeguards. (#(# 0  Seealso: AccreditingAuthority%%#Authority:#%%(AA) , Application%%'Application'%%Owner %%3)Application Owner3%%, ProcessOwner%%+!Process Owner+%%,PAA%% PAA%%,DAA . (#(#  AISSecurity   0  MeasuresorcontrolsthatsafeguardorprotectanAISagainstunauthorized(accidentalorintentional)disclosure,modification,destructionoftheAISanddata,ordenialofservice.AISsecurityprovidesanacceptablelevelofriskfortheAISandthedatacontainedinit.Considerationsinclude:1)allhardwareand/orsoftwarefunctions,characteristics,and/orfeatures;2)operationalprocedures,accountabilityprocedures,andaccesscontrolsatallcomputerfacilitiesintheAIS;3)managementconstraints;4)physicalstructuresanddevices;and5)personnelandcommunicationscontrols. (#(#  Application %%'Application'%% u$l & 0  Asoftwareorganizationofrelatedfunctions,orseriesofinterdependentorcloselyrelatedprograms,thatwhenexecutedaccomplishaspecifiedobjectiveorsetofuserrequirements.Customsapplicationsinclude:AutomatedCommercial%%%Commercial%%%System(ACS),AutomatedExportSystem(AES),TreasuryEnforcementCommunicationSystems(TECS),andAdministrativeSystems(AS).[USCS550005]Seealso: MajorApplication %%3)Major Application 3'Application'%%, Process .($+(#(#   )%,  &    Application%%'Application'%%Owner %%3)Application Owner3%%   0  Theofficialwhohastheresponsibilitytoensurethattheprogramorprogramswhichmakeuptheapplication%%'application'%%accomplishthespecifiedobjectiveorsetofuserrequirementsestablishedforthatapplication%%'application'%%,includingappropriatesecuritysafeguards. (#(# 0  Seealso: AccreditingAuthority%%#Authority:#%%(AA) , ProcessOwner %%+!Process Owner+%%.qh(#(# '  ̬ Audit %%Audit%% )  0  Toconducttheindependentreviewandexaminationofsystemrecordsandactivities. (#(#  Audit%%Audit%%trail     0  Asetofrecordsthatcollectivelyprovidesdocumentaryevidenceofprocessing.Itisusedtoaidintracingfromoriginaltransactionsforwardtorelatedrecordsandreports%%reports%%,and/orbackwardsfromrecordsandreports%%reports%%totheircomponentsourcetransactions. (#(#  AutomatedCommercial%%%Commercial1%%%System(ACS)    0  Ajointpublic/privatedataprocessingsystemusedbyCustomsandtheimporttradecommunity%%/%trade community/%%toprocessmillionsofcommercial%%%commercial1%%%cargoshipmentsenteringU.S.commerceeachyear. (#(#  AutomaticDataProcessing(ADP)  aX 0  Theassemblyofcomputerhardware,firmware,andsoftwareusedtocategorize,sort,calculate,compute,summarize,store,retrieve,control,process,and/orprotectdatawithaminimumofhumanintervention.ADPsystemscaninclude,butarenotlimitedto,processcontrolcomputers,embeddedcomputersystemsthatperformgeneralpurposecomputingfunctions,supercomputers,personalcomputers,intelligentterminals,officesautomationsystems(whichincludesstandalonemicroprocessors,memorytypewriters,andterminalconnectedtomainframes),firmware,andotherimplementationsofAIStechnologiesasmaybedeveloped:theyalsoincludeapplicationsandoperatingsystemsoftware.Seealso: AutomatedInformationSystem(AIS) .1((#(#  AutomatedExportSystem(AES)   0  AdataprocessingsystemusedbyCustomstoprovideautomaticreleaseofcargothatissubjecttoU.S.exportregulatoryrequirements,collectexportdataandstatisticsforuseinlawenforcement,illegalchemicalinterdiction,exportverification,revenuecollection,andotheractivities. (#(#  AutomatedInformationSystem(AIS)  + "! 0  AnAISisanassemblyofcomputerhardware,software,and/orfirmwareconfiguredtocollect,create,communicate,compute,disseminate,process,store,and/orcontroldataorinformation.Examplesinclude:informationstorageandretrievalsystems,mainframecomputers,minicomputers,personalcomputersandworkstations,officeautomationsystems,automatedmessageprocessingsystems(AMPSs),andthosesupercomputersandprocesscontrolcomputers(e.g.,embeddedcomputersystems)thatperformgeneralpurposecomputingfunctions. (#(# 0  [TDP7110] (#(#  &  Authenticate/Authentication  '#* 0  1) ` Theprocesstoverifytheidentityofauser,device,orotherentityinacomputersystem, ($+ oftenasaprerequisitetoallowingaccesstoresourcesinasystem. (#(# 0  2) ` Aprocessusedtoverifythattheoriginoftransmitteddataiscorrectlyidentified,with c*Z&- assurancethattheidentityisnotfalse.Toestablishthevalidityofaclaimedidentity. (#(# '' Authenticateduser  ,(0 0  AuserwhohasaccessedanAISwithavalididentifierandauthenticationcombination.-)1(#(# Ї Authorization    0  Theprivilegesandpermissionsgrantedtoanindividualbyadesignatedofficialtoaccessoruseaprogram,process,information,orsystem.Theseprivilegesarebasedontheindividual'sapproval%%!approval!%%andneedtoknow. (#(#  &  AuthorizedPerson  KB 0  Apersonwhohastheneedtoknowforsensitiveinformationintheperformanceofofficialdutiesandwhohasbeengrantedauthorizedaccessattherequiredlevel.Theresponsibilityfordeterminingwhetheraprospectiverecipientisanauthorizedpersonrestswiththepersonwhohaspossession,knowledge,orcontrolofthesensitiveinformationinvolved,andnotwiththeprospectiverecipient. (#(# 'K3 Availability %%)Availability&)%% A8  0  Thepropertyofbeingaccessibleandusableupondemandbyanauthorizedentity.SecurityconstraintsmustmakeAISservicesavailabletoauthorizedusersandunavailabletounauthorizedusers. (#(# o&&&& o&o&  B#ox##&&#  ]T  Backup   0  Acopyofaprogramordatafileforthepurposesofprotectingagainstlossiftheoriginaldatabecomesunavailable. (#(#  BackupOperation  I@ 0  Amethodofoperationstocompleteessentialtasksasidentifiedbyariskanalysis%%+!risk analysis+%%.ThesetaskswouldbeemployedfollowingadisruptionoftheAISandcontinueuntiltheAISisacceptablyrestored.Seealso: Disaster%%!Disasters!%%Recovery%%!Recoverys!%%,Contingency%%'Contingency'%%Operations .(#(#  Bacteria %%!Bacteriay!%%  0  AmaliciouscomputerprogramthatconsumesAISresourcesbyreplicatingitself.Theprogramdoesnotexplicitlycausedamagetofilesbutreplicatesitself,therebydenyingnormalavailability%%)availability)%%ofAISresources.Seealso: Virus %%Virusi%%, Worm%%Worm%%,TrojanHorse%%)Trojan Horse)%%,MaliciousCode%%-#Malicious Code-%%,TrapDoor. "!(#(#  & B Baud  ## 0  Thesignalingrateofacommunicationsdevice,suchasamodem,asmeasuredbythechangespersecondofanevent(usuallyanelectricaloropticalchange).UsingencodingthebitspersecondratecanbemultiplesoftheBaudrate. (#(# 'B# Bitspersecond  ($( 0  Thesignalingrateofacommunicationsdevice,suchasamodem,measuredbybinarydigitstransferspersecond.Usingencoding,bitspersecondratecanbemultiplesoftheBaudrate. (#(# 0  Seealso: BAUD .*&+(#(#   ],T(- &   0  @*(#(# &&eC #e##&&#Ԉ    C2 %% C2%%  0  Alevelofsecuritysafeguardcriteria.Seealso: ControlledAccessProtection,TCSEC %%TCSEC%%.g ^(#(# '  CATOPSECRET    0  AcomputersystemsecurityprogrammarketedbyComputerAssociatesInternationalCorporation.OriginallylabeledunderthetrademarkofTOPSECRET)itwasrenamedCATOPSECRETtoavoidconfusionwiththeDoDclassification%%-#classification-%%. (#(#  Capstone  aX  0  TheU.S.Governmentslongtermprojecttodevelopasetofstandardsforpubliclyavailablecryptography,asauthorizedbytheComputerSecurityAct%%;1Computer Security Act;%%of1987.TheCapstonecryptographicsystemwillconsistoffourmajorcomponentsandbecontainedonasingleintegratedcircuitmicrochipthatprovidesnonDoDdataencryption%%%encryptionu%%%forSensitiveButUnclassified%%E;Sensitive But Unclassified`E%%information.ItimplementstheSkipjack%%!SkipjackB!%%algorithm. (#(# 0  Seealso: Clipper , Fortezza , SensitiveButUnclassified %%E;Sensitive But Unclassified1E%%, MISSI %%MISSI%%.}t(#(#  CategoryI  5, 0  "ConsistsofFederaldepartmentsandagenciesexpectedtoplayamajorroleinestablishingbroadpolicyparameters,participatinginsettingnationalpriorities,anddefiningandimplementingstrategiesforresponsetonationalsecurityemergencies.Departmentsandagenciesinthiscategoryhaveuninterruptiblefunctionswhicharevitaltothenationalsecurity,immediatesurvival,andcontinuityofgovernment."(Reference:TDP7110,V.1.I.2.a,AttachmentSection1,10/01/92). (#(# 0  Note:TheCustomsServiceisdesignatedCategoryI. (#(#  Certification %%+!Certification8+%%  0  Thecomprehensiveanalysisofthetechnicalandnontechnicalfeatures,andothersafeguards,toestablishtheextenttowhichaparticularAISmeetsasetofspecifiedsecurityrequirements.Certification%%+!Certification8+%%ispartoftheaccreditation%%+!accreditation8+%%processandcarrieswithitanimplicitmandateforaccreditation%%+!accreditation8+%%.Seealso: Accreditation %%+!Accreditation8+%%.m d(#(#  &  Channel  %"! 0  Aninformationtransferpathwithinasystemorthemechanismbywhichthepathisaffected.'%"w (#(#  CICS)(CustomerInformationControlSystem)  $ $ 0  AnIBMprogramproductforthemanagementofonlinecommunicationsbetweenterminalusersandadatabase%%#data base:#%%. (#(#  Cipher  ($( 0  Analgorithmforencryption%%%encryption1%%%ordecryption.Acipherreplacesapieceofinformation(anelementofplaintext)withanotherobject,withtheintenttoconcealmeaning.Typically,thereplacementruleisgovernedbyasecretkey.Seealso: Encryption%%%Encryption1%%%,Decryption .*&+(#(#   +~',  &   Classification %%-#Classification-%%   0  Asystematicarrangementofinformationingroupsorcategoriesaccordingtoestablishedcriteria.Intheinterestofnationalsecurityitisdeterminedthattheinformationrequiresaspecificdegreeofprotectionagainstunauthorizeddisclosuretogetherwithadesignationsignifyingthatsuchadeterminationhasbeenmade.TheestablishedcategoriesareTopSecret,Secret,andConfidential,asspecifiedinE.O.12958,4/17/95.Fordetailsonclassified%%%classified%%%informationhandlingprocessesreference:CISHB140003,1991.Seealso: LimitedOfficialUse .% (#(# ' 7 &   Clear%%Clear%%orclearing%%!clearing!%%(AISStorageMedia)    0  TheremovalofsensitivedatafromAISstorageandotherperipheraldeviceswithstoragecapacity,attheendofaperiodofprocessing.Itincludesdataremovalinsuchawaythatassures,proportionaltodatasensitivity,itmaynotbereconstructedusingnormalsystemcapabilities,i.e.,throughthekeyboard.Seealso: Remanence%%#Remanence:#%%,ObjectReuse %%)Object Reuse)Reuse%%.E< (#(# '  d Clipper    0  Clipperisanencryption%%%encryption1%%%chipdevelopedandsponsoredbytheU.S.governmentaspartoftheCapstoneproject.AnnouncedbytheWhiteHouseinApril,1993,ClipperwasdesignedtobalancecompetingconcernsofFederallawenforcementagenciesandprivatecitizensbyusingescrowedencryption%%%encryption1%%%keys.Seealso: Capstone,Fortezza,MISSI%%MISSI%%,Skipjack%%!Skipjack!%%. e\(#(#  Commercial%%%Commercial1%%%OffTheShelf(COTS %%COTS%%)  0  Productsthatarecommerciallyavailableandcanbeutilizedasgenerallymarketedbythemanufacturer. (#(#  Compromise   0  Thedisclosureofsensitiveinformationtopersonsnotauthorizedaccessorhavinganeedtoknow. (#(#  COMSEC%%COMSEC%%(Communicationsecurity)   0  Measuresandcontrolsthatdenyunauthorizedpersonsaccessto,andensuretheauthenticityof,sensitive(orclassified%%%classified1%%%)informationderivedfromtelecommunications%%5+telecommunications5%%.FordetailsonapplyingCOMSEC%%COMSECu%%toclassified%%%classifieda%%%informationreference:CISHB140003,1991. (#(#  ComputerFraudandAbuseActof1986  YP  0  ThislawmakesitacrimetoknowinglygainaccesstoaFederalGovernmentcomputerwithoutauthorizationandtoaffectitsoperation.[18USC1030]Seealso: FederalGovernment  !" Computer .!#(#(#  ComputerSecurity  #% 0  TechnologicalandmanagerialproceduresappliedtoAIStoensuretheavailability%%)availability&)%%,integrity,andconfidentiality%%/%confidentiality/%%ofinformationmanagedbytheAIS.Seealso: InformationSystemSecurity .W%N!'(#(#  ComputerSecurityAct%%;1Computer Security Act;%%of1987  '#) 0  Thelawprovidesforimprovingthesecurityandprivacyofsensitiveinformationin"federalcomputersystems""acomputersystemoperatedbyaFederalagencyorotherorganizationthatprocessesinformation(usingacomputersystem)onbehalfoftheFederalGovernmenttoaccomplishaFederalfunction."[PL100235]Seealso: FederalGovernmentComputer .w*n&-(#(#   U+L'.  & F  Confidential    0  Asecurityclassification%%-#classification-%%forinformationrelevanttonationalsecurity.Fordetailsonclassified%%%classifiedo%%%informationhandlingprocessesreference:CISHB140003,1991;E.O.12958,4/17/95. (#(# 0  Seealso: LimitedOfficialUse .(#(# 'F 8 Confidentiality %%/%Confidentiality/%% OF 0  Theconditionwhendesignatedinformationcollectedforapprovedpurposesisnotdisseminatedbeyondacommunityofauthorizedknowers.Itisdistinguishedfromsecrecy,whichresultsfromtheintentionalconcealmentorwithholdingofinformation.[OTATCT606] (#(# 0  Confidentiality%%/%Confidentiality/%%refersto:1)howdatawillbemaintainedandusedbytheorganizationthatcollectedit;2)whatfurtheruseswillbemadeofit;and3)whenindividualswillberequiredtoconsenttosuchuses.Itincludestheprotectionofdatafrompassiveattacksandrequiresthattheinformation(inanAISortransmitted)beaccessibleonlyforreadingbyauthorizedparties.Accesscanincludeprinting,displaying,andotherformsofdisclosure,includingsimplyrevealingtheexistenceofanobject. (#(#  ConfigurationManagement%%A7Configuration ManagementNA%%(CM)  ~ 0  ThemanagementofchangesmadetoanAIShardware,software,firmware,documentation,tests,testfixtures,testdocumentation,communicationsinterfaces,operatingprocedures,installationstructures,andallchangestheretothroughoutthedevelopmentandoperationallifecycle%%%lifecycle:%%%oftheAIS.[NCSCTG006] (#(#  Contingency%%'Contingency'%%Plan %%1'Contingency Plan 1%%  0  Thedocumentedorganizedprocessforimplementingemergency%%#emergency #%%response,backupoperations,andpostdisaster%%!disaster!%%recovery%%!recovery!%%,maintainedforanAISaspartofitssecurityprogram,toensuretheavailability%%)availability)%%ofcriticalassets(resources)andfacilitatethecontinuityofoperations%%A7continuity of operations8A%%inanemergency%%#emergencyo#%%. (#(# 0  Seealso: Disaster%%!Disaster!%%Recovery%%!Recovery!%%,Emergency%%#Emergencyo#%%Plan . (#(# & F Contingency%%'Contingency'%%Planing   0  Theprocessofpreparingadocumentedorganizedapproachforemergency%%#emergency#%%response,backupoperations,andpostdisaster%%!disaster!%%recovery%%!recovery!%%thatwillensuretheavailability%%)availability)%%ofcriticalAISresourcesandfacilitatethecontinuityofAISoperationsinanemergency%%#emergencyy#%%. (#(# 0  Seealso: Contingency%%'Contingency'%%Plan%%1'Contingency Plan1%%,Disaster%%!Disastery!%%Recovery%%!Recoveryy!%%,Emergency%%#Emergency #%%Plan ,'F+ "!(#(#  ControlledAccessProtection(C2%% C2%%)  !# 0  AcategoryofsafeguardcriteriaasdefinedintheTrustedComputerSecurityEvaluationCriteria(TCSEC%%TCSEC%%).Itincludesidentificationandauthentication,accountability,auditing,objectreuse%%)object reuse)reuser%%,andspecificaccessrestrictionstodata.ThisistheminimumlevelofcontrolforSBU%% SBU%%information.(Reference:TDP7110,VI,4.B.1).Seealso: TCSEC%%TCSECr%%,AppendixE (thisdocument).K%B!'(#(#  ConventionalEncryption %%%Encryption1%%% '") 0  Aformofcryptosysteminwhichencryption%%%encryption1%%%anddecryptionareperformedusingthesamekey. (#(# 0  Seealso: SymmetricEncryption%%%Encryption1%%%. ($+(#(#  COTS %%COTSt%% o*f&- 0  See: Commercial%%%Commercial1%%%OffTheShelf .I+@'.(#(#   ',(/  &   Countermeasures    0  See: SecuritySafeguards (#(# '  Cracker   0  See: Hacker .ul(#(#  CriticalAssets  - $ 0  Thoseassetswhichprovidedirectsupporttotheorganization'sabilitytosustainitsmission.Assetsarecriticaliftheirabsenceorunavailabilitywouldsignificantlydegradetheabilityoftheorganizationtocarryoutitsmission,andwhenthetimethattheorganizationcanfunctionwithouttheassetislessthanthetimeneededtoreplacetheasset. (#(#  & l Criticalprocessing  I@  0  Anyapplicationswhicharesoimportanttoanorganizationthatlittleornolossofavailability%%)availability&)%%isacceptable;criticalprocessingmustbedefinedcarefullyduringdisaster%%!disastert!%%andcontingency%%'contingency'%%planning.Seealso: CriticalAssets'lI3  (#(#  Cryptanalysis   0  Thebranchofcryptologydealingwiththebreakingofaciphertorecoverinformation,orforgingencryptedinformationwhatwillbeacceptedasauthentic. (#(#  Cryptography   0  Thebranchofcryptologydealingwiththedesignofalgorithmsforencryption%%%encryption1%%%anddecryption,intendedtoensurethesecrecyand/orauthenticityofmessages. (#(#  &  Cryptology  _V 0  Thestudyofsecurecommunications,whichencompassesbothcryptographyandcryptanalysis.'_J  (#(# 0  @*(#(# &&fD #fR ##&&3 #Ԉ   DAA  K!B  0  See: DesignatedApprovingAuthority%%#Authority:#%%,PAA%% PAAr%%,AA .%"!(#(#  DAC  ## 0  See: DiscretionaryAccessControl%%I?Discretionary Access Control&I%%,C2%% C2%%,TCSEC %%TCSEC%%.$ $(#(#  DASD(DirectAccessStorageDevice)  o&f"& 0  Aphysicalelectromagneticdatastorageunitusedinlargercomputers.Usuallytheseconsistofcylindricalstackedmultiunitassemblieswhichhavelargecapacitystoragecapabilities. (#(#  Data  )%* 0  Arepresentationoffacts,concepts,information,orinstructionssuitableforcommunication,interpretation,orprocessing.Itisusedasapluralnounmeaningfactsorinformationasin:Thesedataaredescribedfullyintheappendix,orasasingularmassnounmeaninginformation e,\(- asin:Thedataisenteredintothecomputer.[RandomHouseWebstersCollegeDictionary,1994]A-8).(#(# Ї DataEncryption%%%Encryption1%%%Standard%%A7Data Encryption Standard2A%%(DES)    0  DataEncryption%%%Encryptioni%%%Standard%%A7Data Encryption StandardNA%%isanencryption%%%encryptioni%%%blockcipherdefinedandendorsedbytheU.S.governmentin1977asanofficialstandard(FIPSPUB59).DevelopedbyIBM,ithasbeenextensivelystudiedforover15yearsandisthemostwellknowandwidelyusedcryptosystemintheworld.Seealso: Capstone,Clipper,RSA,Skipjack %%!Skipjack!%%.qh(#(#  Dataintegrity  )  0  Thestatethatexistswhencomputerizeddataarethesameasthosethatareinthesourcedocumentsandhavenotbeenexposedtoaccidentalormaliciousalterationsordestruction.ItrequiresthattheAISassetsandtransmittedinformationbecapableofmodificationonlybyauthorizedparties.Modificationincludeswriting,changing,changingstatus,deleting,creating,andthedelayingorreplayingoftransmittedmessages.Seealso: Integrity,Systemintegrity .k b (#(#  Deciphering  #  0  Thetranslationofencryptedtextordata(calledciphertext)intooriginaltextordata(calledplaintext).Seealso: Decryption . (#(#  Decryption   0  Thetranslationofencryptedtextordata(calledciphertext)intooriginaltextordata(calledplaintext).Seealso: Deciphering .C:(#(#  DedicatedSecurityMode %%?5Dedicated Security Mode,?+!Security Mode8+%%  0  Anoperationalmethodwheneachuserwithdirectorindirectindividualaccesstoacomputersystem,itsperipherals,andremoteterminalsorhostshasavalidpersonnelsecurityauthorizationandavalidneedtoknowforallinformationcontainedwithinthesystem. (#(# 0  Seealso: SystemHighSecurityMode %%C9System High Security ModeC+!Security Mode8+%%.cZ(#(# 0   (#(#  DesignatedApprovingAuthority%%#Authority:#%%(DAA)   0  Theofficialwhohastheauthority%%#authority:#%%todecidetoacceptthesecuritysafeguardsprescribedforanAISortheofficialwhomayberesponsibleforissuinganaccreditation%%+!accreditation8+%%statementthatrecordsthedecisiontoacceptthosesafeguards.Seealso: AccreditingAuthority%%#Authority:#%%,AA,DAA,PAA %% PAA%%.(#(#  DES  aX  0  See: DataEncryption%%%Encryption1%%%Standard %%A7Data Encryption StandardA%%; 2!(#(# 0  Seealso: Capstone,Clipper,RSA,Skipjack %%!Skipjack!%%.!"(#(#  DedicatedSystem  "$ 0  Asystemthatisspecificallyandexclusivelydedicatedtoandcontrolledforaspecificmission,eitherforfulltimeoperationoraspecifiedperiodoftime.Seealso: DedicatedSecurityMode %%?5Dedicated Security Mode ?+!Security Mode8+%%.$| &(#(#  DenialofService  =&4"( 0  Thepreventionofauthorizedaccesstoresourcesorthedelayingoftimecriticaloperations.ReferstotheinabilityofanAISsystemoranyessentialparttoperformitsdesignatedmission,eitherbylossof,ordegradationofoperationalcapability. (#(#   )%,  &    DepartmentofDefense(DOD)TrustedComputerSystemEvaluationCriteria %%g]Trusted Computer System Evaluation Criteriag%%   0  TheNationalComputerSecurityCenter(NCSC)criteriaintendedforuseinthedesignandevaluationofsystemsthatwillprocessand/orstoresensitive(orclassified%%%classified:%%%)data.Thisdocumentcontainsauniformsetofbasicrequirementsandevaluationclassesusedforassessingthedegreesofassuranceintheeffectivenessofhardwareandsoftwaresecuritycontrols%%3)security controls3%%builtinthedesignandevaluationofAIS.[5200.28STD]Seealso: C2%% C2r%%,OrangeBook%%'Orange Book'%%,TCSEC %%TCSEC%%.'  1$KB(#(#  DesignatedSecurityOfficer    0  ThepersonresponsibletotheDAAforensuringthatsecurityisprovidedforandimplementedthroughoutthelifecycle%%%lifecycle1%%%ofanAISfromthebeginningofthesystemconceptdevelopmentphasethroughitsdesign,development,operations,maintenance%%'maintenance'%%,anddisposal.[NCSCTG027] (#(# 0  Seealso: DSO , ISSO .k b (#(#  DigitalSignatureStandard  #  0  DSSistheDigitalSignatureStandard,whichspecifiesaDigitalSignatureAlgorithm(DSA),andispartoftheU.S.governmentsCapstoneproject.ItwasselectedbyNISTandNSAtobethedigitalauthenticationstandardoftheU.S.government,buthasnotyetbeenofficiallyadopted. (#(# 0  Seealso: Capstone,Clipper,RSA,Skipjack %%!Skipjack!%%.(#(#  & l Disaster%%!Disaster!%%Recovery%%!Recovery!%%Plan  C: 0  Theprocedurestobefollowedshouldadisaster%%!disaster!%%(fire,flood,etc.)occur.Disaster%%!Disaster!%%recovery%%!recovery!%%plansmaycoverthecomputercenterandotheraspectsofnormalorganizationalfunctioning. (#(# 0  Seealso: Contingency%%'Contingency'%%Plan %%1'Contingency Plan1%%, Emergency%%#Emergency #%%Plan .'lC|,(#(#  DiscretionaryAccessControl%%I?Discretionary Access Control&I%%(DAC)   0  Ameansofrestrictingaccesstoobjectsbasedontheidentityofsubjectsand/orgroupstowhichtheybelongoronthepossessionofanauthorizationgrantingaccesstothoseobjects.Thecontrolsarediscretionaryinthesensethatasubjectwithacertainaccesspermissioniscapableofpassingthatpermission(perhapsindirectly)ontoanyothersubject.[NCSCTG003] (#(#  Discretionaryprocessing   0  Anycomputerworkthatcanwithstandinterruptionresultingfromsomedisaster%%!disaster!%%. (#(#  DoD  3 *! 0  U.S.DepartmentofDefense. (#(#  DoDDirective5200.28STD  "$ 0  The1988DoDpolicyestablishinguniformsecurityrequirements,administrativecontrols,andtechnicalmeasurestoprotectclassified%%%classified1%%%informationprocessedbyDoDcomputersystems. (#(# 0  Seealso: C2%% C2s%%,TCSEC%%TCSECi%%,OrangeBook %%'Orange Book'%%.O%F!'(#(#  DSO  '") 0  See: DesignatedSecurityOfficer '#*(#(# 0  Seealso: ISSO ($+(#(#  DSS  w*n&- 0  See: DigitalSignatureStandard,Capstone,Clipper,RSA,Skipjack %%!Skipjack!%%.Q+H'.(#(#   /,&(/ 0  @$$*(#(# &&gE #g<7##&&7#Ԉ    Emergency%%#Emergency#%%Response   0  Aresponsetoemergenciessuchasfire,flood,civilcommotion,naturaldisasters,bombthreats,etc.,inordertoprotectlives,limitthedamagetopropertyandtheimpactonAISoperations. (#(#  Emergency%%#Emergency#%%OperatingRecords    0  RecordswhicharevitaltothecontinuationofessentialfunctionsoftheDepartmentanditsoperatingunitsandshouldbesafeguarded.Suchrecordsarethosethatwouldberequiredonanimmediatebasistosupporttheimplementationoftheemergency%%#emergency:#%%operationsoftheDepartmenttoensurethecontinuityoftheFederalgovernment.(Reference:TDP7110,V.1.III.2.a,1992). (#(# 0  Seealso: VitalRecords%%+!Vital Records8+%%andRightsandInterestsRecords .7. (#(#  Emanations    0  See: TEMPEST %%TEMPEST,%%.(#(#  &  Enciphering  x 0  Theconversionofplaintextordataintounintelligibleformbymeanofareversibletranslationthatisbasedonatranslationtableoralgorithm.Seealso: Encryption %%%Encryption1%%%.'<5,(#(#  &  Encryption %%%Encryption1%%%  0  Theconversionofplaintextordataintounintelligibleformbymeanofareversibletranslationthatisbasedonatranslationtableoralgorithm.Seealso: Enciphering , MISSI %%MISSIi%%.'=(#(#  Entity  YP 0  Somethingthatexistsasindependent,distinctorselfcontained.Forprograms,itmaybeanythingthatcanbedescribedusingdata,suchasanemployee,product,orinvoice.Dataassociatedwithanentityarecalledattributes.Aproduct'sprice,weight,quantitiesinstock,anddescriptionallconstituteattributes.Itisoftenusedindescribingdistinctbusinessorganizationsorgovernmentagencies. (#(#  Environment  O!F  0  Theaggregateofexternalcircumstance,conditions,andeventsthataffectthedevelopment,operation,andmaintenance%%'maintenance'%%ofasystem.Environmentisoftenusedwithqualifierssuchascomputingenvironment,application%%'application'%%environment,orthreatenvironment,whichlimitthescopebeingconsidered. (#(#  Evaluation  k&b"& 0  Evaluationistheassessmentforconformancewithapreestablishedmetric,criteria,orstandard. (#(#  EvaluatedProductsList%%?5Evaluated Products List,?%%(EPL%% EPL%%)  ($) 0  TheInformationSystemsSecurityProductsandServicesCatalog,publishedquarterlybyNSA. )%* ContainsinformationsystemssecurityproductsandservicesthathavebeenevaluatedbytheNationalComputerSecurityCenter(NCSC)andapprovedbytheNSAtoassistintheselectionofproductsthatwillprovideanappropriatelevelofinformationsecurity.Seealso: TrustedProduct .a,X(-(#(# 0  ?-6).(#(# Ї0  @55*(#(# &&kF #kF##&&F#Ԉ    FederalGovernmentComputer .  0  AFederalgovernmentcomputerisanycomputerusedbytheUnitedStatesgovernmentand/orFederallyinsuredfinancialinstitutions.[18USC1030] (#(# 0  Seealso: ComputerFraudandAbuseActof1986 . (#(#  Firewall    0  Acollectionofcomponentsorasystemthatisplacedbetweentwonetworks%%!networks!%%andpossessesthefollowingproperties:1)alltrafficfrominsidetooutside,andviceversus,mustpassthroughit;2)onlyauthorizedtraffic,asdefinedbythelocalsecuritypolicy,isallowedtopassthroughit;3)thesystemitselfisimmunetopenetration.[CHES94] (#(#  Firmware    0  Equipmentordeviceswithinwhichcomputerprogramminginstructionsnecessarytotheperformanceofthedevicesdiscretefunctionsareelectricallyembeddedinsuchamannerthattheycannotbeelectricallyalteredduringnormaldeviceoperations.[NCSCTG006] (#(#  Fortezza  5, 0  See: FortezzaCryptoCard (#(#  FortezzaCryptoCard   0  AcreditcardsizedatasecuritydevicecontainingMISSI%%MISSI%%Phase1encryption%%%encryption1%%%algorithms,keymaterialanduserrelatedinformation.ThisdeviceisbasedonaPersonalComputerMemoryCardInterfaceAssociation(PCMCIA)cardwhichhasbeenbuilttoperformthecryptographicfeaturesrequiredbytheMISSI%%MISSI%%Phase1program(datahashing,signing,encryptinganddecrypting).Thiscardwasformerlyknownasthe TesseraCryptoCard.[MISSI] (#(# 0  Seealso: Capstone,Encryption%%%Encryption1%%%,MISSI%%MISSIi%%,Clipper,RSA,Skipjack %%!Skipjack!%%.(#(# 0  @*(#(# &&lG #lEP##&&&P#Ԉ u l  Gateway  $ " 0  Amachineorsetofmachinesthatprovidesrelayservicesbetweentwonetworks%%!networks!%%. (#(#  GeneralSupportSystem %%=3General Support System=%% '~#% 0  Aninterconnectedsetofinformationresourcesunderthesamedirectmanagementcontrolwhichsharescommonfunctionality.Asystemnormallyincludeshardware,software,information,data,applications,communications,andpeople.Asystemcanbe,forexample,alocalareanetwork(LAN)includingsmartterminalsthatsupportabranchoffice,anagencywidebackbone,acommunicationsnetwork,adepartmentaldataprocessingcenterincludingitsoperatingsystemandutilities,atacticalradionetwork,orasharedinformationprocessingserviceorganization(IPSO). (#(# 0  [OMBA130%%A130%%,AIII]}-t),(#(# Ї&  0  @*(#(# &&pH#p0U##&&U#    Hack  g ^ 0  Anysoftwareinwhichasignificantportionofthecodewasoriginallyanotherprogram.Manyhackedprogramssimplyhavethecopyright%%#copyright#%%noticeremoved.Somehacksaredonebyprogrammersusingcodetheyhavepreviouslywrittenthatservesasaboilerplateforasetofoperationsneededintheprogramtheyarecurrentlyworkingon.Inothercasesitsimplymeansadraft.' TԀCommonlymisusedtoimplytheftofsoftware.Seealso: Hacker  (#(#  Hacker  aX  0  CommonnicknameforanunauthorizedpersonwhobreaksintoorattemptstobreakintoanAISbycircumventingsoftwaresecuritysafeguards.Also,commonlycalleda cracker. (#(# 0  Seealso: Intruder , Hack . (#(#  @xx*&&I #&&aY#Ԉ x  InformationSecurity   0  Theprotectionofinformationsystemsagainstunauthorizedaccesstoormodificationofinformation,whetherinstorage,processingortransit,andagainstthedenialofservicetoauthorizedusersortheprovisionofservicetounauthorizedusers,includingthosemeasuresnecessarytodetect,document,andcountersuchthreats. (#(#  InformationSystemsSecurity(INFOSEC)  ! 0  Theprotectionofinformationassetsfromunauthorizedaccesstoormodificationofinformation,whetherinstorage,processing,ortransit,andagainstthedenialofservicetoauthorizedusersortheprovisionofservicetounauthorizedusers,includingthosemeasuresnecessarytodetect,document,andcountersuchthreats.INFOSECreflectstheconceptofthetotalityofAISsecurity. (#(# 0  Seealso: ComputerSecurity. c"Z(#(#  Identification  $ ! 0  Theprocessthatenablesrecognitionofanentitybyasystem,generallybytheuseofuniquemachinereadableusernames. (#(#  InformationSystemSecurityOfficer(ISSO)  'z#% 0  ThepersonresponsibletotheDAAforensuringthatsecurityisprovidedforandimplementedthroughoutthelifecycle%%%lifecycle1%%%ofanAISfromthebeginningofthesystemconceptdevelopmentphasethroughitsdesign,development,operations,maintenance%%'maintenance'%%,anddisposal.[NCSCTG027] (#(# 0  Seealso: DSO , DesignatedSecurityOfficer*&)(#(#   +'*  &   Integrity    0  Asubgoalofcomputersecuritywhichensuresthat:1)dataisaproperrepresentationofinformation;2)dataretainsitsoriginallevelofaccuracy;3)dataremainsinasound,unimpaired,orperfectcondition;3)theAISperformcorrectprocessingoperations;and4)thecomputerizeddatafaithfullyrepresentthoseinthesourcedocumentsandhavenotbeenexposedtoaccidentalormaliciousalterationordestruction.[NCSCCTR7991]Seealso: Dataintegrity,System KB integrity .) (#(# ' ` InterconnectedSystem    0  Anapproachinwhichthenetworkistreatedasaninterconnectionofseparatelycreated,managed,andaccreditedAIS. (#(#  Internet %%!Internet!!Internet!%% I@  0  Aworldwide networkofnetworksthatusesTransmissionControlProtocol/Internet%%!Internet!!Internet!%%Protocol(TCP/IP)forcommunications.[WACK] (#(#  Intruder    0  Anindividualwhogains,orattemptstogain,unauthorizedaccesstoacomputersystemortogainunauthorizedprivilegesonthatsystem.Seealso: Hacker e\(#(#  ISSO   0  See: InformationSystemSecurityOfficer , DSO , DesignatedSecurityOfficer .(#(# 0  @VV*(#(# &&sJ #shg##&&Ig#Ԉ  @nn"NONEATTHISTIME0  @*(#(# &&tK #tXh##&&9h#Ԉ   KeyDistribution%%)Distribution)%%Center  $ ! 0  Asystemthatisauthorizedtotransmittemporarysessionkeystoprincipals(authorizedusers).Eachsessionkeyistransmittedinencryptedform,usingamasterkeythatthekeydistribution%%)distribution)%%shareswiththetargetprincipal.Seealso: DSS,Encryption%%%Encryption1%%%,Kerberos .&"$(#(#  Kerberos  e(\$& 0  KerberosisasecretkeynetworkauthenticationsystemdevelopedbyMITandusesDESforencryption%%%encryption1%%%andauthentication.Unlikeapublickeyauthenticationsystem,itdoesnotproducedigitalsignatures.Kerberoswasdesignedtoauthenticaterequestsfornetworkresourcesratherthantoauthenticateauthorshipofdocuments.Seealso: DSS .+'*(#(#  -|), 0  @$$*(#(# &&uL #u:m##&&m#Ԉ    Label   0  Themarkingofanitemofinformationthatreflectsitsinformationsecurityclassification%%-#classificationV-%%.Aninternallabelisthemarkingofanitemofinformationthatreflectstheclassification%%-#classificationV-%%ofthatitemwithintheconfinesofthemediumcontainingtheinformation.Anexternallabelisavisibleorreadablemarkingontheoutsideofthemediumoritscoverthatreflectsthesecurityclassification%%-#classificationV-%%informationresidentwithinthatparticularmedium.Seealso: Confidential,LimitedOfficialUse . (#(#  LAN(LocalAreaNetwork)  ~  0  Aninterconnectedsystemofcomputersandperipherals.LANuserscansharedatastoredonharddisksinthenetworkandcanshareprintersconnectedtothenetwork. (#(#  LeastPrivilege %%/%Least Privilege/%%   0  Theprinciplethatrequireseachsubjectbegrantedthemostrestrictivesetofprivilegesneededfortheperformanceofauthorizedtasks.Theapplication%%'application'%%ofthisprinciplelimitsthedamagethatcanresultfromaccident,error,orunauthorizeduse.[5200.28STD] (#(#  & l LimitedOfficialUse(LOU)  1( 0  AcategoryofSBU%% SBU%%informationthatmustbeprotectedinthesamemannerasnationalsecurityinformationclassified%%%classified1%%%Confidential.(Reference:TDP7110,III.2;CISHB140003). (#(# 0  Seealso: SensitiveButUnclassified%%E;Sensitive But Unclassified@E%%(SBU%% SBU%%) , Confidential .'l1s(#(# 0  @*(#(# &&vM#vZv##&&;v#  QH  MaliciousCode %%-#Malicious Code-%%  0  SoftwareorfirmwarethatisintentionallyincludedinanAISforanunauthorizedpurpose. (#(# 0  Seealso: Bacteria %%!Bacteria!%%, Trapdoor , TrojanHorse %%)Trojan Horse)%%, Virus %%Virus%%, Worm %%Worm%%.!(#(#  MajorApplication %%3)Major Application3'Application'%% A#8  0  Anapplication%%'application'%%thatrequiresspecialattentiontosecurityduetotheriskandmagnitudeoftheharmresultingfromtheloss,misuse,orunauthorizedaccesstoormodificationoftheinformationintheapplication%%'application'%%.Note:AllFederalapplicationsrequiresomelevelofprotection.Certainapplications,becauseofthesensitiveinformationinthem,however,requirespecialmanagementoversight%%#oversight#%%andshouldbetreatedasmajor.Adequatesecurity%%3)Adequate security3%%forotherapplicationsshouldbeprovidedbysecurityofthesystemsinwhichtheyoperate.[OMBA130%%A130e%%,AIII]Seealso: Application %%'Applicationr'%%, Process .](T$&(#(# 0   (#(#  Microprocessor  * &( 0  Asemiconductorcentralprocessingunitcontainedonasingleintegratedcircuitchip. (#(#   +'*  &   MISSI %%MISSI%%   0  TheMISSI%%MISSI%%isaNationalSecurityAgency%%A7National Security Agency1A%%(NSA)programwhichprovidesvalueaddedsecurityservicesforUnclassifiedButSensitive(SBU%% SBUn%%)information.Theseservicesprovidedconfidentiality%%/%confidentiality /%%throughdataencryption%%%encryptioni%%%anddecryption,originalauthenticationthroughpublickeydigitalsignatures,nonrepudiation(undeniableproofofidentity)oftheoriginatorandrecipient,alsobypublickeydigitalsignaturesonthemessageandreceiptsrespectively,anddataintegritythroughasecurehashingalgorithm.[MISSI]Seealso: Capstone,Fortezza,CryptoCard' v~ % (#(# 0  @*(#(# &&wN #w##&&#Ԉ     NationalComputerSecurityCenter (NCSC) ;2  0  ThegovernmentagencypartoftheNationalSecurityAgency%%A7National Security AgencyA%%(NSA)andthatproducestechnicalreferencematerialsrelatingtoawidevarietyofcomputersecurityareas.Itislocatedat9800SavageRd.,Ft.GeorgeG.Meade,MD. (#(#  NationalTelecommunications%%5+Telecommunications5%%andInformationSystemsSecurityPolicy  x 0  DirectsFederalagencies,byJuly15,1992,toprovideautomatedControlledAccessProtection(C2%% C2%%level)forAIS,whenallusersdonothavethesameauthorizationtousethesensitiveinformation.[NTISSP200] (#(#  & B NeedtoKnow   0  Adeterminationbytheownerofsensitiveinformationthataprospectiverecipienthasarequirementforaccessto,knowledgeof,orpossessionoftheinformationinordertoperformtasksorservicesessentialtocarryoutofficialduties. (#(# 'B & h Network   0  Acommunicationsmediumandallcomponentsattachedtothatmediumwhoseresponsibilityisthetransferenceofinformation.SuchcomponentsmayincludeAISs,packetswitches,telecommunications%%5+telecommunications,5%%controllers,keydistribution%%)distributioni)%%centers,andtechnicalcontroldevices.'h (#(#  NetworkSecurity  G!>  0  Protectionofnetworks%%!networks!%%andtheirservicesfromunauthorizedmodification,destruction,ordisclosure,andtheprovisionofassurancethatthenetworkperformsitscriticalfunctionscorrectlyandtherearenoharmfulsideeffects. (#(#  NIST  %!% 0  NationalInstituteofStandardsandTechnologyinGaithersburg,MD.(Priorto1988,calledtheNationalBureauofStandards).NISTpublishesawidevarietyofmaterialsoncomputersecurity,includingFIPSpublications. (#(#  NonRepudiation  )%* 0  Methodbywhichthesenderisprovidedwithproofofdeliveryandtherecipientisassuredofthesendersidentity,sothatneithercanlaterdenyhavingprocessedthedata. (#(#   Y,P(-  &   NonvolatileMemoryUnits    0  Deviceswhichcontinuetoretaintheircontentswhenpowertotheunitisturnedoff(e.g.bubblememory,ReadOnlyMemoryROM).'  (#(# 0  @*(#(# &&xO #x##&&Ǝ#Ԉ KB  Object    0  Apassiveentitythatcontainsorreceivesinformation.Accesstoanobjectpotentiallyimpliesaccesstotheinformationitcontains.Examplesofobjectsarerecords,blocks,pages,segments,files,directories,directorytree,andprograms,aswellasbits,bytes,words,fields,processors,videodisplays,keyboards,clocks,printers,networknodes,etc. (#(#  ObjectReuse %%)Object Reuse&)Reuse%%   0  Thereassignmenttosomesubjectofamedium(e.g.,pageframe,disksector,ormagnetictape)thatcontainedoneormoreobjects.Tobesecurelyreassigned,noresidualdata%%+!residual data8+%%frompreviouslycontainedobject(s)canbeavailabletothenewsubjectthroughstandardsystemmechanisms. (#(# 0  [NCSCTG025]Seealso: Remanence %%#Remanencet#%%.SJ(#(#  OfficialUseOnly    0  AcategoryofSBU%% SBU%%informationthatmustbeadministrativelycontrolledandprotectedatasecuritylevelatleastequaltoC2%% C2%%.(Reference:TDP7110,III.2;CISHB140003,1991). (#(# 0  Seealso: SensitiveButUnclassified%%E;Sensitive But Unclassified@E%%(SBU%% SBU%%),C2 %% C2%%.(#(#  &  Offline  QH 0  Pertainingtotheoperationofafunctionalunitwhennotunderdirectcontrolofacomputer. (#(# 0  Seealso: Online .'Q(#(#  Online   0  Pertainingtotheoperationofafunctionalunitwhenunderthedirectcontrolofacomputer. (#(# 0  Seealso: Offline .q h(#(#  Orangebook %%'Orange book'%% )" ! 0  Namedbecauseofthecolorofitscover,thisistheDoDTrustedComputerSystemEvaluationCriteria%%g]Trusted Computer System Evaluation Criteriag%%,DoD5200.28STD.ItprovidestheinformationneededtoclassifycomputersystemsassecuritylevelsofA,B,C,orD,definingthedegreeoftrustthatmaybeplacedinthem. (#(# 0  Seealso: C2%% C2t%%,TCSEC %%TCSEC %%.%!%(#(#  OverwriteProcedure  I'@#' 0  Aprocesswhichremovesordestroysdatarecordedonacomputerstoragemediumbywritingpatternsofdataover,orontopof,thedatastoredonthemedium. (#(#   *&+ & 8  0  @55*(#(# &&yP #y ##&&#Ԉ    Password %%!Password!%%  0  AprotectedandprivatecharacterstringusedtoauthenticateanAISuser.'8  (#(#  Personallyowned%%1'Personallyowned1%%computersorsoftware    0  Computersorsoftwarepurchasedwithnongovernmentfunds,exceptthoseturnedoverforexclusiveU.S.GovernmentcontrolanduseandwheretheharddrivewillbeproperlyerasedwhenthesystemisnolongerinU.S.Governmentuse. (#(# 0  (Reference:TDP7110,AppendixB.Definitionupdated11/24/95). (#(#  PersonnelSecurity  7.  0  Theproceduresestablishedtoensurethatallpersonnelwhohaveaccesstoanysensitiveinformationhaveallrequiredauthoritiesorappropriatesecurityauthorizations. (#(#  PhysicalSecurity %%3)Physical Security3%%  0  Theapplication%%'application'%%ofphysicalbarriersandcontrolproceduresaspreventativemeasuresorsafeguardsagainstthreatstoresourcesandinformation. (#(#  PrincipalAccreditingAuthority%%OEPrincipal Accrediting Authority O#Authority:#%%(PAA%% PAAr%%)   0  Theofficialwhohastheauthority%%#authority:#%%todecideonacceptingthesecuritysafeguardsprescribedforanAISortheofficialwhomayberesponsibleforissuinganaccreditation%%+!accreditation+%%statementthatrecordsthedecisiontoacceptthosesafeguards. (#(# 0  Seealso: AccreditingAuthority%%#Authority:#%%(AA),DesignatedApprovingAuthority%%#Authority:#%%(DAA) .of(#(#  &  PrivacyAct%%'Privacy Act'%%of1974  ' 0  AUSlawpermittingcitizenstoexamineandmakecorrectionstorecordsthegovernmentmaintains.ItrequiresthatFederalagenciesadheretocertainproceduresintheirrecordkeepingandinteragencyinformationtransfers.Reference:FIPSPub.41,05/30/75(ImplementingthePrivacyAct%%'Privacy Act'%%of1975),andthePrivacyAct%%'Privacy Act'%%of1974,AsAmended.[5USC552a.PL93579](#(# 0  Seealso: SystemofRecords .i `(#(# ''% PrivateBranchExchange %%?5Private Branch Exchange,?%% !"! 0  PrivateBrancheXchange%%?5Private Branch eXchange ?%%(PBX%% PBXt%%)isatelephoneswitchprovidingspeechconnectionswithinanorganization,whilealsoallowingusersaccesstobothpublicswitchesandprivatenetworkfacilitiesoutsidetheorganization.ThetermsPABX,PBX%% PBXt%%,andPABXareusedinterchangeably. (#(#  Process  c&Z"& 0  Anorganizationalassignmentofresponsibilitiesforanassociatedcollectionofactivitiesthattakesoneormorekindsofinputtoaccomplishaspecifiedobjectivethatcreatesanoutputthatisofvalue.Customsprocessesinclude:PassengerCompliance,CargoCompliance,InformedCompliance,StrategicTrade,Antismuggling,OutboundProcess,IntelligenceandInvestigations.[USCSPPP]Seealso: Application %%'Applicationh'%%.*&+(#(#   +z',  &   ProcessOwner %%+!Process Owner+%%   0  TheofficialwhodefinestheprocessparametersanditsrelationshiptootherCustomsprocesses.Theprocessowner%%+!process owner8+%%hasAccreditingAuthority%%#Authoritye#%%(AA)todecideonacceptingthesecuritysafeguardsprescribedfortheAISprocessandisresponsibleforissuinganaccreditation%%+!accreditation8+%%statementthatrecordsthedecisiontoacceptthosesafeguards. (#(# 0  Seealso: AccreditingAuthority%%#Authority:#%%(AA) , Application%%'Application'%%Owner %%3)Application Owner3%%.KB(#(# '  PublicLaw100235    0  Establishedminimalacceptablestandardsforthegovernmentincomputersecurityandinformationprivacy.Seealso: ComputerSecurityAct%%;1Computer Security Act1;%%of1987 .  (#(# 0  @*(#(# &&zQ#z(##&& #  I@  @nn"NONEATTHISTIME0  @*(#(# &&{R #{##&&#Ԉ [R  RainbowSeries   0  AseriesofdocumentspublishedbytheNationalComputerSecurityCenter(NCSC)todiscussindetailthefeaturesoftheDoD,TrustedComputerSystemEvaluationCriteria%%g]Trusted Computer System Evaluation Criteriag%%(TCSEC%%TCSEC %%)andprovide  guidanceformeetingeachrequirement.Thename"rainbow"isanicknamebecauseeachdocumenthasadifferentcolorofcover.Seealso: NCSC .G>(#(#  Read   0  Afundamentaloperationsthatresultsonlyintheflowofinformationfromanobjecttoasubject. (#(#  Recovery %%!Recoverym!%% ! 0  TheprocessofrestoringanAISfacility%%!facilitym!%%andrelatedassets,damagedfiles,orequipmentsoastobeusefulagainafteramajoremergency%%#emergency)#%%whichresultedinsignificantcurtailingofnormalADPoperations.Seealso: Disaster%%!Disaster!%%Recovery %%!Recovery!%%.$ !(#(#  &   Remanence %%#Remanence)#%% %!# 0  Theresidualinformationthatremainsonstoragemediaaftererasure.Fordiscussionpurposes,itisbettertocharacterizemagneticremanence%%#remanence)#%%asthemagneticrepresentationofresidualinformationthatremainsonmagneticmediaafterthemediahasbeenerased.Themagneticfluxthatremainsinamagneticcircuitafteranappliedmagnetomotiveforcehasbeenremoved. (#(# 0  [RandomHouseWebstersCollegeDictionary,1994;NCSCTG025]Seealso: ObjectReuse %%)Object Reuse)Reuse%%.' %* &((#(#  ResidualRisk %%+!Residual Risk+%% +'* 0  Thepartofriskremainingaftersecuritymeasureshavebeenimplemented. (#(#  -x),  & l RightsandInterestsRecords    0  "RecordsthatarenecessaryforthepreservationoftherightsandinterestsofindividualcitizensandtheFederalgovernment."(Reference:TDP7110,V.1.III.2.b,1992). (#(# 0  Seealso: Emergency%%#Emergency:#%%OperatingRecords , VitalRecords %%+!Vital Records+%%.'l (#(#  RiskAnalysis %%+!Risk Analysis+%% OF 0  Theprocessofidentifyingsecurityrisks,determiningtheirmagnitude,andidentifyingareasneedingsafeguards.Ananalysisofanorganizationsinformationresources,itsexistingcontrols,anditsremainingorganizationalandAISvulnerabilities.Itcombinesthelosspotentialforeachresourceorcombinationofresourceswithanestimatedrateofoccurrencetoestablishapotentiallevelofdamageindollarsorotherassets.[TD85-03]Seealso: RiskAssessment%%/%Risk Assessment/%%,Risk    Management %%/%Risk Management/%%.o f (#(#  RiskAssessment %%/%Risk Assessment/%% '  0  ProcessofanalyzingthreatstoandvulnerabilitiesofanAIStodeterminetherisks(potentialforlosses),andusingtheanalysisasabasisforidentifyingappropriateandcosteffectivemeasures.[TD85-03]Seealso: RiskAnalysis,RiskManagement %%/%Risk Management/%%. (#(# 0  Note:Riskanalysis%%+!Risk analysis+%%isapartofriskmanagement%%/%risk management/%%,whichisusedtominimizeriskbyspecifyingsecuritymeasurescommensuratewiththerelativevaluesoftheresourcestobeprotected,thevulnerabilitiesofthoseresources,andtheidentifiedthreatsagainstthem.Themethodshouldbeappliediterativelyduringthesystemlifecycle%%%lifecyclee%%%.Whenappliedduringtheimplementationphaseortoanoperationalsystem,itcanverifytheeffectivenessofexistingsafeguardsandidentifyareasinwhichadditionalmeasuresareneededtoachievethedesiredlevelofsecurity.Therearenumerousriskanalysis%%+!risk analysis+%%methodologiesandsomeautomatedtoolsavailabletosupportthem. (#(#  RiskManagement %%/%Risk Management/%% =4 0  Thetotalprocessofidentifying,measuring,controlling,andeliminatingorminimizinguncertaineventsthatmayaffectsystemresources.Riskmanagement%%/%Risk management/%%encompassestheentiresystemlifecyclesandhasadirectimpactonsystemcertification%%+!certification6+%%.Itmayincluderiskanalysis%%+!risk analysis6+%%,cost/benefitanalysis,safeguardselection,securitytestandevaluation,safeguardimplementation,andsystemreview.[OMBA130%%A130a%%,AIII;TD85-03]Seealso: RiskAnalysis%%+!Risk Analysis6+%%,RiskAssessment %%/%Risk Assessment/%%v(#(#  ROM  7 .! 0  ReadOnlyMemory.Seealso: NonvolatileMemoryUnits .!"(#(#  RSA  "$ 0  Apublickeycryptosystemforbothencryption%%%encryption1%%%andauthenticationbasedonexponentiationinmodulararithmetic.Thealgorithmwasinventedin1977byRivest,Shamir,andAdelmanandisgenerallyacceptedaspracticalorsecureforpublickeyencryption%%%encryption1%%%. (#(# 0  Seealso: DES,Capstone,Clipper,RSA,Skipjack %%!Skipjack!%%.1&("((#(#   '#* &   0  @EE*(#(# &&|S #|##&&#Ԉ    Safeguards   0  Countermeasures,specifications,orcontrols,consistingofactionstakentodecreasetheorganizationsexistingdegreeofvulnerabilitytoagiventhreatprobability,thatthethreatwilloccur. (#(# '  SecurityIncident    0  AnAISsecurityincidentisanyeventand/orconditionthathasthepotentialtoimpactthesecurityand/oraccreditation%%+!accreditation8+%%ofanAISandmayresultfromintentionalorunintentionalactions. (#(# 0  Seealso: SecurityViolation .]T (#(#  SecurityPolicy    0  Thesetoflaws,rules,directives,andpracticesthatregulatehowanorganizationmanages,protects,anddistributescontrolledinformation. (#(#  SecurityRequirements  }t 0  Typesandlevelsofprotectionnecessaryforequipment,data,information,applications,andfacilitiestomeetsecuritypolicies. (#(#  SecuritySafeguards(countermeasures)   0  Theprotectivemeasuresandcontrolsthatareprescribedtomeetthesecurityrequirementsspecifiedforasystem.Thosesafeguardsmayinclude,butarenotnecessarilylimitedto:hardwareandsoftwaresecurityfeatures;operatingprocedures;accountabilityprocedures;accessanddistribution%%)distribution&)%%controls;managementconstraints;personnelsecurity;andphysicalstructures,areas,anddevices.Alsocalledsafeguardsorsecuritycontrols%%3)security controls3%%. (#(#  SecuritySpecifications   0  Adetaileddescriptionofthesecuritysafeguardsrequiredtoprotectasystem. (#(#  SecurityViolation  i ` 0  Aneventwhichmayresultindisclosureofsensitiveinformationtounauthorizedindividuals,orthatresultsinunauthorizedmodificationordestructionofsystemdata,lossofcomputersystemprocessingcapability,orlossortheftofanycomputersystemresources.Seealso: Security "" Incident .##(#(#  SensitiveInformation  %!% 0  AcategoryofunclassifiedGovernmentcontrolledinformation. (#(# 0  Seealso: SensitiveButUnclassified%%E;Sensitive But Unclassified@E%%(SBU%% SBU%%),LimitedOfficialUse,Confidential .A'8#'(#(#  SensitiveButUnclassified%%E;Sensitive But Unclassified1E%%(SBU%% SBU%%)Information  ($) 0  Anyinformation,theloss,misuse,orunauthorizedaccesstoormodificationofwhichcouldadverselyaffectthenationalinterestortheconductofFederalprograms,ortheprivacytowhichindividualsareentitledunder5USC552a(PrivacyAct%%'Privacy Act'%%),butwhichhasnotbeenspecificallyauthorizedundercriteriaestablishedbyanExecutiveorder%%/%Executive order/%%oranActofCongresstobekeptsecretintheinterestofnationaldefenseofforeignpolicy.Thisdefinitionissynonymouswith  sensitive ;-2). information asdefinedinPublicLaw100.235, TheComputerSecurityAct%%;1Computer Security Act;%%of1987,dated   January8,1988.Inaddition,TreasurySBU%% SBUt%%informationalsoincludestradesecretorconfidentialinformationprotectedbySection1905ofTitle18,USC(TradeSecretAct).AllinformationdesignatedLimitedOfficialUse(LOU)isincludedwithinSBU%% SBUt%%information. (#(# 0  (Reference:TDP7110,AppendixB,page52;alsoChapterVI,Section2.A.4.b). (#(# 0  SBUAISandnetworks%%!networks!%%shallbeprotectedtoatleasttheminimumlevelofcontrolledaccessprotection(C2%% C2o%%)asdefinedinSection4.B.1.(Reference:TDP7110,ChapterVI.4.B). (#(# 0  ExamplesofSBU%% SBUr%%informationincludefinancial,lawenforcement,andcounternarcoticsinformation.(Reference:TDP7110,ChapterVI,Section2.A.4.b). (#(# 0  EditorNotes :E< (#(# 0  SensitiveButUnclassified%%E;Sensitive But Unclassified1E%%(SBU%% SBUt%%)isacategoryof unclassified Governmentcontrolledinformation. #  Similartermsmayappearinothergovernmentdocumentsas unclassifiedbutsensitiveor sensitive.Themeaninghowever,remainsthesame.ThemajorityoftheinformationinCustomsAISiscategorizedasSBU%% SBU%%andmayinclude,butisnotlimitedto,information,theimproperuseordisclosureofwhichcouldadverselyaffecttheabilityofCustomstoaccomplishitsmission;informationthatisinvestigativeinnature;grandjuryinformationsubjecttotheFederalRulesofCriminalProcedure,Rule6(e),GrandJurySecrecyofProceedingsandDisclosure;proprietaryinformation;recordsaboutindividualsrequiringprotectionunderthePrivacyAct%%'Privacy Act'%%;informationnotreleasableundertheFreedomofInformation%%=3Freedom of Information8=%%Act;andinformationwhichcouldbemanipulatedforpersonalprofitortohidetheunauthorizeduseofmoney,equipment,orprivileges.DHD. (#(# 0  Seealso: Confidential,C2%% C2%%,LimitedOfficialUse,TCSEC%%TCSEC%%. |(#(#  Site %%Site%% =4 0  Usuallyasinglephysicallocation,butitmaybeoneormoreAISsthataretheresponsibilityoftheDSO.ThesystemmaybeastandaloneAIS,aremotesite%%site%%linkedtoanetwork,orworkstationsinterconnectedviaalocalareanetwork(LAN). (#(#  Skipjack %%!Skipjack!%% v 0  Aclassified%%%classified1%%%NSAdesignedencryption%%%encryption1%%%algorithmcontainedintheClipperChip.ItissubstantiallystrongerthanDESandIntendedtoprovideaFederallymandatedencryption%%%encryption1%%%processwhichwouldenablelawenforcementagenciestomonitorandwiretapprivatecommunications.[MISSI] (#(# 0  Seealso: Capstone,DES,Fortezza,Clipper,RSA,Skipjack %%!Skipjack!%%.!#(#(#  &  StandardSecurityProcedures  #% 0  StepbystepsecurityinstructionstailoredtousersandoperatorsofAISsthatprocesssensitiveinformation.'#F (#(#  StandaloneSystem  '") 0  AsingleuserAISnotconnectedtoanyothersystems. (#(#  &  SymmetricEncryption %%%Encryption1%%% )%, 0  See: ConventionalEncryption %%%Encryption1%%%.o*f&-(#(# ') System  ',(/ 0  See: AutomatedInformationSystem,AIS -(0(#(# Ї SystemHighSecurityMode %%C9System High Security Mode8C+!Security Mode8+%%   0  AmodeofoperationwhereinallusershavingaccesstotheAISpossessasecurityauthorization,butnotnecessarilyaneedtoknowforalldatahandledbytheAIS.[5200.28.STD,1985] (#(# 0  Seealso: DedicatedSecurityMode %%?5Dedicated Security Mode ?+!Security Mode8+%%.(#(# 0   (#(#  SystemIntegrity  OF 0  Theattributeofasystemrelatingtothesuccessfulandcorrectoperationofcomputingresources. (#(# 0  Seealso: Integrity . (#(#  SystemofRecords     0  AgroupofanyrecordsunderthecontroloftheDepartmentfromwhichinformationisretrievedbythenameofanindividual,orbysomeotheridentifyingnumber,symbol,orotheridentifyingparticularassignedtoanindividual.[TD2504]Seealso: PrivacyAct%%'Privacy Act'%%of1974 I@ (#(# 0  @$$*(#(# &&}T #}##&&#Ԉ    TCSEC %%TCSEC%% _V 0  TrustedComputerSystemEvaluationCriteria%%g]Trusted Computer System Evaluation Criteriag%%(TCSEC%%TCSEC %%).DoD5200.28STD,NationalInstitute 90 ofStandardsandTechnology(NIST),Gaithersburg,MD.,1985.Establishesuniformsecurityrequirements,administrativecontrols,andtechnicalmeasurestoprotectsensitiveinformationprocessedbyDoDcomputersystems.Itprovidesastandardforsecurityfeaturesincommercial%%%commercial1%%%productsandgivesametricforevaluatingthedegreeoftrustthatcanbeplacedincomputersystemsforthesecuringofsensitiveinformation.Seealso: C2%% C2e%%,OrangeBook %%'Orange Book'%%.{r(#(#  TestCondition  3* 0  Astatementdefiningaconstraintthatmustbesatisfiedbytheprogramundertest. (#(#  TestData   0  Thesetofspecificobjectsandvariablesthatmustbeusedtodemonstratethataprogramproducesasetofgivenoutcomes.Seealso: Disaster%%!Disaster!%%Recovery %%!Recovery!%%, Testprogram .u l(#(#  TestPlan  -"$! 0  Adocumentorasectionofadocumentwhichdescribesthetestconditions,data,andcoverageofaparticulartestorgroupoftests. (#(# 0  Seealso: Disaster%%!Disaster!%%Recovery %%!Recovery!%%, TestCondition , TestData , Testprocedure(Script) .$ $(#(#  Testprocedure(Script)  s&j"& 0  Asetofstepsnecessarytocarryoutoneoragroupoftests.Theseincludestepsfortestenvironmentinitialization,testexecution,andresultanalysis.Thetestproceduresarecarriedoutbytestoperators. (#(#  Testprogram  *&+ 0  Aprogramwhichimplementsthetestconditionswheninitializedwiththetestdataandwhichcollectstheresultsproducedbytheprogrambeingtested. (#(# 0  Seealso: Disaster%%!Disaster!%%Recovery %%!Recovery!%%, TestCondition , TestData , Testprocedure(Script) .C-:).(#(# Ї & h TEMPEST %%TEMPEST%%   0  ThestudyandcontrolofspuriouselectronicsignalsemittedfromAISequipment.AllTEMPEST%%TEMPEST%%issuesshouldbedirectedtotheTreasuryOfficeofInformationSystemsSecurity. (#(# 0  [5200.28STD;TDP7110;CISHB430009]'h   (#(#  TopSecret  KB 0  AhighDoDsecurityclassification%%-#classification-%%.Seealso: CATOPSECRET % (#(#  &  Threat    0  Anevent,process,activity(act),substance,orqualityofbeingperpetuatedbyoneormorethreatagents,which,whenrealized,hasanadverseeffectonorganizationassets,resultinginlossesattributedto: (#(# 0  0a"0` (#(#  DirectlossE< ` (#` (# 0  0a"0` (#(#  Relateddirectloss ` (#` (# 0  0a"0` (#(#  Delaysordenials ` (#` (# 0  0a"0` (#(#  Disclosureofsensitiveinformation ` (#` (# 0  0a"0` (#(#  Modificationofprogramsordatabases ` (#` (# 0  0a"0` (#(#  Intangible,i.e.,goodwill,reputation,etc.' ~` (#` (#  Threatagent  ;2 0  Anypersonorthingwhichacts,orhasthepowertoact,tocause,carry,transmit,orsupportathreat.Seealso: Threat .(#(#  Trapdoor   0  Asecretundocumentedentrypointintoacomputerprogram,usedtograntaccesswithoutnormalmethodsofaccessauthentication.Seealso: MaliciousCode %%-#Malicious Code-%%.[R(#(#  TreasuryEnforcementCommunicationsSystem(TECS)    0  AnautomatedenforcementandinspectionsupportsystembuilttoaidCustomsandotherFederalagencies. (#(#  TrojanHorse %%)Trojan Horse&)%% {r 0  Acomputerprogramwithanapparentlyoractuallyusefulfunctionthatcontainsadditional(hidden)functionsthatsurreptitiouslyexploitthelegitimateauthorizationsoftheinvokingprocesstothedetrimentofsecurity.Seealso: MaliciousCode %%-#Malicious Code-%%. !"(#(#  TrustedComputerBase%%;1Trusted Computer Base;%%(TCB%% TCB%%)  "$ 0  Thetotalityofprotectionmechanismswithinacomputersystem,includinghardware,firmware,andsoftware,thecombinationofwhichisresponsibleforenforcingasecuritypolicy.ATCB%% TCB%%consistsofoneormorecomponentsthattogetherenforceasecuritypolicyoveraproductorsystem.Seealso: C2%% C2%%,TCSEC%%TCSEC%%,OrangeBook %%'Orange Book'%%.)& "((#(#  & h TrustedComputingSystem  '#* 0  Acomputerandoperatingsystemthatemployssufficienthardwareandsoftwareintegritymeasurestoallowitsuseforsimultaneouslyprocessingarangeofsensitiveinformationandcanbeverifiedtoimplementagivensecuritypolicy.'h'G (#(#   I+@'.  & F  TrustedProduct    0  AproductthathasbeenevaluatedbytheNationalComputerSecurityCenter(NCSC)andapprovedbytheNationalSecurityAgency%%A7National Security AgencyNA%%(NSA)forinclusionintheEvaluatedProductsList%%?5Evaluated Products List?%%(EPL%% EPLa%%).Seealso: EvaluatedProductsList%%?5Evaluated Products List?%%(EPL%% EPL%%) (#(# 'F &  0  @*(#(# &&~U #~##&&#Ԉ )   UPS(UninterruptiblePowerSupply)    0  Asystemofelectricalcomponentstoprovideabufferbetweenutilitypower,orotherpowersource,andaloadthatrequiresuninterrupted,precisepower.Thisoftenincludesatricklechargebatterysystemwhichpermitsacontinuedsupplyofelectricalpowerduringbriefinterruption(blackouts,brownouts,surges,electricalnoise,etc.)ofnormalpowersources. (#(# ' ) z0  @*(#(# &&V#z##&&[#    Vaccine  ' 0  Anysoftwaredesignedtopreventtheintroductionofacomputervirus%%virus%%toasystem. (#(# 0  Seealso: Bacteria %%!Bacteria!%%, MaliciousCode %%-#Malicious Code-%%.(#(#  Verification   0  Theprocessofcomparingtwolevelsofsystemspecificationsforpropercorrespondence. (#(#  VitalRecords %%+!Vital Records+%% ! 0  RecordsdesignatedbyCategoryIagenciesanddepartmentsasnecessarytoaccomplishassignedessentialfunctionsduringemergency%%#emergency#%%situations.Theserecords,identifiedasvitalrecords%%+!vital recordsS+%%,aregroupedintotwodistinctcategories:1)emergency%%#emergencyd#%%operatingrecords;and2)rightsandinterestsrecords.(Reference:TDP7110,V.1.III.1,1992). (#(# 0  Seealso: Emergency%%#Emergencyd#%%OperatingRecords,RightsandInterestRecords,CategoryI .c"Z(#(#  Virus %%Virus%% $ ! 0  Codeimbeddedwithinaprogramthatcausesacopyofitselftobeinsertedinoneormoreotherprograms.Inadditiontopropagationthevirus%%virus%%usuallyperformssomeunwantedfunction.Notethataprogramneednotperformmaliciousactionstobeavirus%%virus%%;itneedonlyinfectotherprograms.Seealso: Bacteria %%!Bacteria!%%, MaliciousCode %%-#Malicious Code-%%.'z#%(#(#  & h Vulnerability  ;)2%' 0  Aweakness,orfindingthatisnoncompliant,nonadherencetoarequirement,aspecificationorastandard,orunprotectedareaofanotherwisesecuresystem,whichleavesthesystemopento potentialattackorotherproblem.'h;)+'*(#(# 0  @*(#(# &&W # ##&& #Ԉ    WAN(WideAreaNetwork)   0  AnetworkofLANswhichprovidescommunicationservicesoverageographicarealargerthanservedbyaLAN. (#(#  WWW    0  See: WorldWideWeb %%-#World Wide Web-%% (#(#  WorldWideWeb %%-#World Wide Web-%% ~  0  AnassociationofindependentinformationdatabasesaccessibleviatheInternet%%!Internet!!Internet!%%.OftencalledtheWEB,WWW,orW. (#(#  Worm %%Worme%%   0  Acomputerprogramthatcanreplicateitselfandsendcopiesfromcomputertocomputeracrossnetworkconnections.Uponarrival,theworm%%worme%%maybeactivatedtoreplicateandpropagateagain.Inadditiontopropagation,theworm%%worme%%usuallyperformssomeunwantedfunction. (#(# 0  Seealso: MaliciousCode %%-#Malicious Code-%%.WN(#(#  Write   0  Afundamentaloperationthatresultsonlyintheflowofinformationfromasubjecttoanobject. (#(# 0  @*(#(# &&X #\'##&&='#Ԉ wn @nn"NONEATTHISTIME0  @*(#(# &&Y #K(##&&,(#Ԉ   @nn"NONEATTHISTIME0  @$$*(#(# &&Z #:)##&&)#Ԉ &"" @nn"NONEATTHISTIME  *&$   %h%%h%%m%% m%  &&  BIBLIOGRAPHY *#*##&&*# X *A&-) xdE7xA 8 Thefollowinglaws,regulations,standards,policies,directives,guidelines,andreferencesarethebasisfortheU.S.CustomsServiceAISSecurityPolicyManual,HB140005.Note:ThefollowinglistissortedalphabeticallybyReferenceID. G ReferenceID0 ` 0 ` (#` (#DocumentTitle  (# (# [CHES94]0 ` 0 ` (#` (#0 (# (# WilliamR.CheswickandStevenM.Bellovin.Firewalls%%#Firewalls)#%%andInternet%%!Internet!!Internet!%%Security.  W  AddisonWesley,Reading,MA,1994. (#(# [COHEN]0 ` 0 ` (#` (#0 (# (# InformationTechnologyManagementReformActof1996.Wash.,DC.Also =  knownasthe CohenBill. (#(# [EO12958]0 ` 0 ` (#` (#0 (# (# OfficeofthePresident,Classified%%%Classified1%%%NationalSecurityInformation.EO12958, s Wash.,DC,April17,1995,(RevokedEO12356,04/06/82). (#(# [FIPSP39]0 ` 0 ` (#` (#0 (# (# GlossaryforComputerSecurityTerms.U.S.DepartmentofCommerce,National Y TechnicalInformationService(NTIS),FIPSPUB39,Springfield,VA.,02/15/76. (#(# [GAO94285]0 ` 0 ` (#` (#0 (# (# InformationSuperhighway:IssuesAffectingDevelopment.GAOReport. i GAO/RCED94285. (#(# [GAO9523]0 ` 0 ` (#` (#0 (# (# InformationSuperhighway:AnOverviewofTechnologyChallenges.GAO O Report.GAO/AIMD9523 (#(# [MISSI]0 ` 0 ` (#` (#MISSI%%MISSIi%%Phase1.NSA,Ft.GeorgeG.Meade,MD.,1994. (# (# [NCSCTG003]0 0 (# (# AGuidetoUnderstandingDiscretionaryAccessControl%%I?Discretionary Access ControlI%%inTrustedSystems. 9 NCSC,NCSCTG003,Ver.1,NSA,Ft.GeorgeG.Meade,MD.,September1987. (#(# [NCSC-TG-005]0 0 (# (# TrustedNetworkInterpretation.NCSC,NCSC-TG-005,Ver.1,NSA,Ft.  # GeorgeG.Meade,MD.,July1987.aka.RedBook%%!Red Booka!%%. (#(# [NCSCTG006]0 0 (# (# AGuidetoUnderstandingConfigurationManagement%%A7Configuration ManagementoA%%inTrustedSystems. #/!& NCSC,NCSCTG006,Ver.1,NSA,Ft.GeorgeG.Meade,MD.,March1988. (#(# [NCSCTG025]0 0 (# (# DataRemanence%%#Remanenceo#%%inAutomatedInformationSystems.NCSC,NCSCTG025, &$* Ver.2,NSA,Ft.GeorgeG.Meade,MD.,September1991. (#(# [NCSCTG027]0 0 (# (# AGuidetoUnderstandingInformationSystemsSecurityOfficerResponsibilities })%'- forAIS.NCSC,NCSCTG027,Ver.1,NSA,Ft.GeorgeG.Meade, W*'. MD.,May1992. (#(#    ,)0 &   [NCSC-TG-029]0 0 (# (# IntroductiontoCertification%%+!Certification8+%%andAccreditation%%+!Accreditation8+%%.NCSC,NCSC-TG-029,Ver.1,   NSA,Ft.GeorgeG.Meade,MD.,January1994. (#(# ' q:[NCSCTR7991]0 0 (# (# IntegrityinAutomatedInformationSystems.NCSC,NCSCCTR7991,NSA,  Ft.GeorgeG.Meade,MD.,September1991. (#(# [NTISSP200]0 ` 0 ` (#` (#0 (# (# NationalPolicyonControlledAccessProtection.TheWhiteHouse.National %  Telecommunications%%5+Telecommunications5%%andInformationSystemsSecurityCommittee.07/15/87. (#(# [NIST500172]0 0 (# (# Todd,MaryAnne,andConstanceGuitan,ComputerSecurityTraining%%!Training!%%    Guidelines.NIST,SP500172,Gaithersburg,MD.,11/89.g ^ (#(# [OMBA123]0 ` 0 ` (#` (#0 (# (# ManagementAccountabilityandControl.Cir.A123%%A123%%,Revised,Wash.,DC,June   21,1995. (#(# [OMBA130]0 ` 0 ` (#` (#0 (# (# ManagementofFederalInformationResources.OMBCir.A130%%A130%%,Wash.,DC,   1985,1993,1994,1996. (#(# [OMBA130%%A130%%,AIII]0 0 (# (# SecurityofFederalAutomatedInformationResources.OMBCir.A130%%A130%%, 7. AppendixIII.,Wash.,DC,02/08/96. (#(# [OTATCT606]0 0 (# (# InformationSecurityandPrivacyinNetworkEnvironments.U.S.Congress.  OfficeofTechnicalAssistance.OTATCT606.Wash.,DC:GPO,September1994. (#(# [PL100235]0 ` 0 ` (#` (#0 (# (# ComputerSecurityAct%%;1Computer Security Act;%%of1987.40USC759,101STAT1724.PL100235, -$ Wash.,DC,01/08/88.0p(#(#p(#p(# [TDETHICS]0 ` 0 ` (#` (#0 (# (# U.S.TreasuryDepartment.StandardsofEthicalConductforEmployeesofthe  ExecutiveBranch.Wash.,DC,02/03/93.(#(# [TDINTERNET]0 0 (# (# U.S.TreasuryDepartment.TreasuryDirective.MANAGINGTHEINTERNET%%!INTERNETe!!INTERNETe!%% I@  ACCESS:OperatingPolicyforBureauTelecommunications%%5+Telecommunicationst5%%ManagersandInformationResourcesManagementOfficialswithintheDepartmentoftheTreasury.4/28/95.!#(#(# [TDP2504]0 ` 0 ` (#` (#0 (# (# U.S.TreasuryDepartment.PrivacyAct%%'Privacy Actt'%%Handbook.TDP2504,Wash.,DC, #% 04/91. (#(# [TDP2505]0 ` 0 ` (#` (#0 (# (# U.S.TreasuryDepartment.FreedomofInformation%%=3Freedom of Information=%%ActHandbook.TDP25 &"( 05,Wash.,DC,06/93. (#(# [TD8401]0 ` 0 ` (#` (#0 (# (# U.S.TreasuryDepartment.InformationSystemsDevelopmentLifeCycle%%MCSystems Development Life CycleM%% ($+ Manual.TD8401,Wash.,DC,07/94.)x%,(#(# [TD8701]0 ` 0 ` (#` (#0 (# (# U.S.TreasuryDepartment.InformationSystemsStandardsProgram.TD8701, 5+,'. Wash.,DC,08/23/89. (#(# [TDP7110]0 ` 0 ` (#` (#0 (# (# U.S.TreasuryDepartment.SecurityManual.TDP7110,Wash.,DC,12/93.-)1(#(# Ї&  [TD85-03]0 ` 0 ` (#` (#0 (# (# U.S.TreasuryDepartment.RiskAssessment%%/%Risk Assessment/%%Guidelines,VolumesI&II.TD   85-03,Wash.,DC,June1990.' L (#(# [USCSPPP]0 ` 0 ` (#` (#0 (# (# U.S.CustomsService.People,ProcessesandPartnerships:AReportonthe  CustomsServiceforthe21stCentury,Wash.,DC,September1994.qh(#(# [USCS96PLAN]0 0 (# (# U.S.CustomsService.AnnualPlanFiscalYear1996..Wash.,DC,10/95.% (#(# [USCSIRMPLAN]0 0 (# (# U.S.CustomsService.StrategicIRM%% IRMe%%Plan%%5+Strategic IRM Plan5%%forFiscalYears19982002.Wash.,   DC,04/96. (#(# &  [USCS1400-03]0 0 (# (# U.S.CustomsService.SafeguardingClassified%%%ClassifiedM%%%InformationHandbook.USCS g ^  HB1400-03,Wash.,DC,02/91. (#(# 'g Q[USCS1460-010]0 0 (# (# U.S.CustomsService.AccessRequirementsforCustomsAutomatedInformation   Systems.USCSDirective1460-010,Wash.,DC,09/11/92. (#(# Ѐ[USCS430009]0 0 (# (# U.S.CustomsService.CommunicationsSecurity(COMSEC%%COMSECe%%)Handbook.USCS z HB430009,Wash.,DC,12/92.(Supersedes/rescindsUSCSDirectives435001,4350-02,and435003,alsoHandbookdated1/90). (#(# [USCS5100005]0 0 (# (# U.S.CustomsService.ConductandEmployeeResponsibilities.USCSManual  Transmittal5100005,Wash.,DC,12/29/77. (#(# [USCS550004]0 0 (# (# U.S.CustomsService.SystemsDevelopmentLifeCycle%%MCSystems Development Life CycleM%%Handbook.Officeof yp InformationManagement,Springfield,VA.,1995. (#(# [USCS550005]0 0 (# (# U.S.CustomsService.AutomatedInformationSystemsServicesHandbook.  OfficeofInformationandTechnology,Springfield,VA.,%11/%%November,19%95. (#(# [USCS550007]0 0 (# (# U.S.CustomsService.IllegalUseofADPandTelecommunications%%5+TelecommunicationsL5%%Systems.  USCSDirective550007,Wash.,DC,02/22/89. (#(# [5USC552]0 ` 0 ` (#` (#0 (# (# FreedomofInformation%%=3Freedom of Information =%%andReformAct(FOIA%%FOIAm%%).5USC552.Wash.,DC, # ! August13,1987. (#(# [5USC552a74]0 0 (# (# PrivacyAct%%'Privacy Actf'%%of1974.5USC552a,Wash.,DC,12/31/74."$(#(# [5USC552a87]0 0 (# (# PrivacyAct%%'Privacy Actf'%%of1974,AsAmended.5USC552a,PL93579,Wash.,DC, e$\ & 07/14/87 (#(# [18USC1030]0 ` 0 ` (#` (#0 (# (# ComputerFraudandAbuseActof1986.18USC1030,PL99474,Wash.,DC, &") 10/16/86. (#(# [5200.28STD]0 ` 0 ` (#` (#0 (# (# DepartmentofDefense.TrustedComputerSystemEvaluationCriteria%%g]Trusted Computer System Evaluation Criteriag%%(TCSEC%%TCSEC %%). )x%, DoD5200.28STD,NIST,Gaithersburg,MD.,aka.OrangeBook%%'Orange Bookt'%%,1985. (#(# [WACK]0 ` 0 ` (#` (#0 (# (# Wack,JohnP.andLisaJ.Carnahan.KeepingYourSite%%Site %%ComfortablySecure:An ,(/ IntroductiontoInternet%%!Internetk!!Internetk!%%Firewalls%%#Firewalls#%%.NIST,SP80010,Gaithersburg,MD, ,(0 December1994.% -)1(#(# %%%%%%%&&&&%%%@(ThisPageIntentionallyLeftBlank)%%%#&&&& a#%%%%  -$ &&"   SelectedReadings#" b##&&a# 5b   A&-) xddExA  )bEditorNote:Thefollowinglistissortedalphabeticallybyauthor,title,ordepartment.Reference:GPOManualofStyle.March1984.DHD.0   AGuidetoUnderstandingIdentificationandAuthenticationinTrustedSystems.NCSC,NCSCTG017,   Ver.1,NSA,Ft.GeorgeG.Meade,MD.,September1992. (#(# 0   AGuidetoUnderstandingObjectReuse%%)Object Reuse)ReuseR%%inTrustedSystems.NCSC,NCSCTG018,Ver.1,NSA,Ft.  }  GeorgeG.Meade,MD.,July1992. (#(# 0   AGuidetoUnderstandingSecurityTesting%%Testingu%%andTestDocumentationinTrustedSystems.NCSC,   NCSC-TG-023,Ver.1,NSA,Ft.GeorgeG.Meade,MD.,July1993. (#(# 0   AGuidetoUnderstandingTrustedDistribution%%)Distribution)%%inTrustedSystems.NCSC,NCSCTG008,Ver.1,NSA,   Ft.GeorgeG.Meade,MD.,December1988. (#(# 0   AGuidetoUnderstandingTrustedRecovery%%!Recoveryo!%%inTrustedSystems.NCSC,NCSCTG022,Ver.1,NSA, 0' Ft.GeorgeG.Meade,MD.,December1991. (#(# 0   AGuidetoWritingtheSecurityFeaturesUser'sGuideforTrustedSystems.NCSC,NCSCTG026,Ver.  1,NSA,Ft.GeorgeG.Meade,MD.,September1991. (#(# 0   AnIntroductiontoComputerSecurity:TheNISTHandbook%%+!NIST Handbook +%%.NISTSP80012,Gaithersburg,MD., LC March1995. (#(# 0   AssessingControlledAccessProtection.NCSC,NCSCTG028,Ver.1,NSA,Ft.GeorgeG.Meade,  ЁMD.,May1992. (#(# 0   BombThreatsandPhysicalSecurity%%3)Physical Security3%%Planning.U.S.TreasuryDepartment,BureauofAlcohol,Tobacco, h_ andFirearms,ATFPublication7550.2,Wash.,DC,07/87. (#(# 0   ComputerMatchingandPrivacyAct%%'Privacy Actr'%%of1974.PL100503,Wash.,DC,1974. !(#(# 0   ComputerMatchingandPrivacyProtectionActof1988.PL100503,Wash.,DC.,12/1988."#(#(# 0   ComputerMatchingandPrivacyProtectionAmendmentsof1990.PL101508,Wash.,DC,11/05/90.^$U %(#(# 0   ComputerViruses:Prevention,Detection,andTreatment.NCSC,C1TR001,NSA,Ft.GeorgeG. & "' Meade,MD.,March1990. (#(# 0   CounterfeitAccessDeviceandComputerFraudandAbuseActof1984.PL98473,ChapterXXI ($* AccessDevicesandComputers,18USC2101and2102a,Chapter47,Wash.,DC10/12/84. (#(# 0   DepartmentofDefense.Password%%!Passwordt!%%ManagementGuidelines.CSC-STD-002-85,NSA,Ft.GeorgeG. .+%'- Meade,MD.,04/12/85. (#(#   ,(/ &   0   DepartmentofDefense.SecurityRequirementsforAutomatedInformationSystems(AISs).DoD   Directive5200.28,DOD,Wash.,DC,March1988.' p (#(# & B 0   DepartmentofDefense.TechnicalRationalBehindCSCSTD00385:COMPUTERSECURITY  REQUIREMENTSGuidanceforApplyingtheDoDTrustedComputerSystemEvaluationCriteria%%g]Trusted Computer System Evaluation Criteriag%%inSpecificEnvironments.CSC-STD00385,NSA,Ft.GeorgeG.Meade,MD.,June KB 1985. (#(# 'Bq0   DisclosureofConfidentialInformationGenerally.TradeSecretsAct.18USC1905,PL102-660,Wash.,   DC,Amended10/28/92. (#(# 0   ElectronicCommunicationsPrivacyAct%%'Privacy Actt'%%of1986.18USC2510etseq.,PL99508,Wash.,DC, g ^  10/21/86. (#(# 0   EscrowedEncryption%%%Encryption%%%Standard.U.S.DepartmentofCommerce,NationalTechnicalInformationService   (NTIS),FIPSPUB185,Springfield,VA. (#(# 0   Everhart,Kathie,ed.,ComputerSecurityTraining%%!Training!%%&Awareness%%#Awareness#%%CourseCompendium.NIST,NISTIR z 5495,Gaithersburg,MD.,September1994. (#(# 0   ExecutiveGuidetoADPContingency%%'Contingencyt'%%Planning.NIST,SP50085,Gaithersburg,MD.,1985.(#(# 0   FBIADPTSecurityPolicy.DepartmentofJustice%%;1Department of Justice ;%%,FederalBureauofInvestigation%%OEFederal Bureau of InvestigationnO%%,InformationSystems  SecurityUnit,NationalSecurityDivision,Wash.,DC,April29,1994. (#(# 0   FederalComputerSystemsSecurityTraining%%!Trainingr!%%.HR145-6,Section5,HouseofRepresentatives,Wash., SJ DC (#(# 0   FederalInformationResourcesManagementRegulation(FIRMR).40CFR201etseq.,Wash.,DC.(#(# 0   FederalManagersFinancialIntegrityActof1982.(FMFIA%%FMFIA%%)PL97255,H.R.1526,31USC1105,  1113,3512,Wash.,DC,September1982. (#(# 0   FinancialManagementSystems.OMBCir.A127%%A127%%(Revised),TransmittalMemorandumNo.1,Wash., # ! DC,07/23/93. (#(# 0   GlossaryofComputerSecurityTerminology.NationalSecurityTelecommunications%%5+TelecommunicationsN5%%andInformation "$ SystemsSecurityCommittee(NSTISSC),PublishedbyNISTasNISTIR4659.AvailablefromNTISasPB92112259,1992. (#(# 0   GuidelinesforADPContingency%%'Contingencyt'%%Planning.U.S.DepartmentofCommerce,NationalTechnical &"( InformationService(NTIS),FIPSPUB87,Springfield,VA.,03/81. (#(# 0   GuidanceforPreparationofSecurityPlansforFederalSystemsthatContainSensitiveInformation.OMB ($+ Bulletin90-08%%90-08e%%,Wash.,DC,07/09/90. (#(# 0   GuidelinesforWritingTrustedFacility%%!Facilityy!%%Manuals.NCSC,NCSC-TG-016,Ver.1,NSA,Ft.GeorgeG. 5+,'. Meade,MD.,October1992. (#(#   ,(0 &   0   InformationTechnologyInstallationSecurity.GSA.OfficeofTechnicalAssistance.Wash.,DC:GPO,   December1988. (#(# ' &  0   IntegrityOrientedControlObjectives:ProposedRevisionstotheTrustedComputerSystemEvaluation  Criteria%%g]Trusted Computer System Evaluation Criteriag%%(TCSEC%%TCSEC %%),DoD5200.28STD.NCSC,NCSCCTR11191,NSA,Ft.GeorgeG. qh Meade,MD.,October1991.'ނ (#(# 0   IssueUpdateOnInformationSecurityandPrivacyinNetworkEnvironments.U.S.Congress.Officeof   TechnicalAssistance.OTABPITC147.Wash.,DC:GPO,June1995. (#(# 0   ManagementAccountabilityandControl.OMBCir.A123%%A123 %%.Wash.,DC,June21,1995.  (#(# 0   OfficeofthePresident,NationalSecurityInformation.32CFRPart2001,DirectiveNo.1,National A8  SecurityCouncil,InformationSecurityOversight%%#Oversightp#%%Office,Wash.,DC,June1982. (#(# 0   OfficeofthePresident,NationalSecurityInformation:StandardForms.32CFRPart2003,National   SecurityCouncil,InformationSecurityOversight%%#Oversightp#%%Office,Wash.,DC,March1987. (#(# 0   ThePaperworkReductionAct%%?5Paperwork Reduction Actv?%%of1980.Asamended.44USC350,etseq.,PL96511.Wash.,DC, ]T 12/11/80. (#(# 0   ThePaperworkReductionReauthorizationActof1986.44USC3506,PL99500TitleVIII.Wash.,DC.(#(# 0   Password%%!PasswordR!%%Usage.U.S.DepartmentofCommerce,NationalTechnicalInformationService(NTIS),FIPS  PUB112,Springfield,VA.,May1985. (#(# 0   People,ProcessesandPartnerships:AReportontheCustomsServiceforthe21stCentury.U.S.Customs -$ Service,Wash.,DC,September1994. (#(# 0   PerformanceofCommercial%%%Commerciald%%%Activities.OMBCir.A76(Revised),TransmittalMemorandum#13,Wash.,  DC,03/02/94. (#(# 0   PersonnelSuitability.FederalPersonnelManual(FPM)Instruction311,Chapter31,Wash.,DC, I@  01/06/84. (#(# 0   PolicyandProceduresManualforGuidanceofFederalAgenciesTitle2,Accounting.Government !# AccountingOffice,Wash.,DC,August1987. (#(# 0   PublicKeyEncryption%%%Encryptiond%%%.NIST,SP800-2,Gaithersburg,MD.e$\ &(#(# 0   RequirementsforaSharedFederalComputerBackupFacility%%!Facility!%%.OfficeofTechnicalAssistance,Falls &"( Church,VA.,May1991. (#(# 0   Ruder,Brian,andJ.D.Madden,AnAnalysisofComputerSecuritySafeguardsforDetectionand ($+ PreventionofIntentionalComputerMisuse.NIST,SP50025,Gaithersburg,MD.)x%,(#(# 0   Ruthberg,ZellaG.andWilliamNugent,OverviewofComputerSecurityCertification%%+!Certification^+%%andAccreditation%%+!Accreditation^+%%. 5+,'. NIST,SP500109,Gaithersburg,MD.,April1984. (#(#   ,(0 &   0   SmartCardTechnology:NewMethodsforComputerAccessControl.NIST,SP500157,Gaithersburg,   MD.'  (#(# &  0   Training%%!Training!%%RequirementfortheComputerSecurityAct%%;1Computer Security Act;%%.OfficeofPersonnelManagement%%MCOffice of Personnel Management8M%%(OPM%% OPMe%%),5CFR  PART930,FederalRegisterVol.56,No.233,Wash.,DC,12/04/91.'ߓ (#(# 0   TrustedDatabaseManagementSystemInterpretation(TDI)oftheTrustedComputerSystemEvaluation %  Criteria%%g]Trusted Computer System Evaluation Criteriag%%.NCSC,NCSC-TG-021,Ver.1,NSA,Ft.GeorgeG.Meade,MD.,April1991. (#(# 0   TrustedNetworkInterpretationEnvironmentsGuideline.NCSC,NCSC-TG-011,Ver.2,NSA,Ft.    GeorgeG.Meade,MD.,August1990. (#(# 0   TrustedProductEvaluations:AGuideforVendors.NCSC,NCSC-TG-002,Ver.1,NSA,Ft.George A8  G.Meade,MD.,June1990. (#(# 0   TurningMultipleEvaluationProductsintoTrustedSystems.NCSC,TR003,NSA,Ft.GeorgeG.   Meade,MD.,July1994. (#(# 0   U.S.CustomsService.AbbreviationsandAcronyms.Wash.,DC,04/92.]T(#(# 0   U.S.CustomsService.Distribution%%)Distribution)%%,SubmissionandProcessingofBackgroundInvestigation(BI)Forms.  USCSDirective09951332004,Wash.,DC,03/08/92. (#(# 0   U.S.CustomsService.FiveYearPlan.Wash.,DC,12/91.(#(# 0   U.S.CustomsService.InformationSystemsPlanforFiscalYears19972001.Wash.,DC,April1995.SJ(#(# 0   U.S.CustomsService.PersonnelSecurityRequirementsforADPandDataCommunicationsContract  Employees.USCSDirective140012,Wash.,DC,11/02/88.(#(# 0   U.S.CustomsService.PhysicalSecurity%%3)Physical Security 3%%Handbook.USCSHB140002,Wash.,DC,08/89.(#(# 0   U.S.CustomsService.ProhibitionofUnauthorizedUseofElectronicMail.USCSDirective1460008, I@  Wash.,DC,11/25/91. (#(# 0   U.S.CustomsService.RestrictionofAccesstoProductionDataontheCustomsComputer.USCS !# InformationNotice92030,Wash.,DC,06/30/92. (#(# 0   U.S.CustomsService.ServiceLevelAgreement.OfficeofInformationManagement,Springfield,VA., e$\ & 09/30/92. (#(# 0   U.S.CustomsService.TableofOffensesandPenalties.USCSDirective5175101,Wash.,DC, &") 01/09/90. (#(# 0   U.S.CustomsService.UnauthorizedReleaseofOfficialInformation.Commissioner%%)Commissioneri)%%Memorandum, )x%, Wash.,DC,07/08/91. (#(# 0   U.S.CustomsService.UseofComputerVirus%%Virusi%%ProtectionSoftware.USCSDirective140026,Wash., ,(/ DC,05/01/91. (#(#  -)1 0   U.S.CustomsService.UseofPersonallyOwned%%1'PersonallyOwnedv1%%ComputersandSoftwareforClassified%%%Classifiedw%%%andSensitive   Work.USCSDirective1460-011,Wash.,DC,03/25/93.(#(# &  0   U.S.TreasuryDepartment.Acquisition%%'Acquisitionn'%%ofFederalInformationProcessingResources.TD83-01,Wash.,  DC,12/03/91.' (#(# &  0   U.S.TreasuryDepartment.DisclosureofRecords.31CFRPart1,SubpartAFreedomofInformation%%=3Freedom of Information=%% %  andReformAct(FOIA%%FOIAm%%).PL99570.Wash.,DC,August13,1987.'%  (#(# 0   U.S.TreasuryDepartment.ElectronicFundsandSecuritiesTransferPolicy.MessageAuthenticationand    EnhancedSecurity.TD1602,Wash.,DC,12/21/92.  (#(# &  0   U.S.TreasuryDepartment.InformationSystemsPlanning.TD8106,Wash.,DC,PL99570. A8  08/20/86.'A4 (#(# 0   U.S.TreasuryDepartment.NationalSecurityInformation.TreasuryDirective.31CFRPart2,Wash.,   DC,2/22/89. (#(# 0   U.S.TreasuryDepartment.ResponsibilitiesforTelecommunications%%5+Telecommunicationso5%%andInformationSystemsSecurity. ]T TD8509,Wash.,DC,09/25/90. (#(# 0   ViabilityStudyforaSharedFederalComputerBackupFacility%%!Facilityi!%%.OfficeofTechnicalAssistance,Falls  Church,VA.,November1990. (#(# 0   Wack,JohnP.,EstablishingComputerSecurityIncidentResponse%%WMComputer Security Incident ResponseW%%Capability%%I?Incident Response CapabilitypI%%(CSIRC%%CSIRCt%%).NIST,SP8003, yp Gaithersburg,MD.,1991. (#(# 0   Wack,JohnP.andStanleyA.Kutzban,ComputerVirus%%Virust%%Attacks.ComputerSystemsLaboratory(CSL)  Bulletin,NISTSpecial,Gaithersburg,MD,August1990. (#(# @(ThisPageIntentionallyLeftBlank)  SJ  . %%% %%%%%   &&  APPENDIXA X AbbreviationsandAcronyms ###&&ů# 8 A&-) xdExA  AA0  0` (#(#0 ` (#` (#AccreditingAuthority%%#Authority2#%%A (# (# ACS0  0` (#(#0 ` (#` (#AutomatedCommercial%%%Commercial8%%%Systems (# (# ADP0  0` (#(#0 ` (#` (#AutomaticDataProcessingM  (# (# AES0  0` (#(#0 ` (#` (#AutomatedExportSystem'  (# (# AIS0  0` (#(#0 ` (#` (#AutomatedInformationSystems  (# (# AISS0  0` (#(#0 ` (#` (#AISSecurityDivision  (# (# AS0  0` (#(#0 ` (#` (#AdministrativeSystems ]  (# (# BI0  0` (#(#0 ` (#` (#BackgroundInvestigation 7  (# (# CDROM0 ` 0 ` (#` (#CompactDiskReadOnlyMemoryi  (# (# CFR0  0` (#(#0 ` (#` (#CodeofFederalRegulationsC  (# (# CIS0  0` (#(#0 ` (#` (#CustomsIssuanceSystem  (# (# CICS0  0` (#(#0 ` (#` (#CustomerInformationControlSystem (# (# COMSEC%%COMSECa%%0 ` 0 ` (#` (#ComputerSecurityy (# (# COTS%%COTS%%0  0` (#(#0 ` (#` (#Commercial%%%Commercial8%%%OffTheShelfSoftwareS (# (# CM0  0` (#(#0 ` (#` (#ConfigurationManagement%%A7Configuration ManagementZA%%- (# (# CMD0  0` (#(#0 ` (#` (#CommunicationsManagementDivision_ (# (# CSC0  0` (#(#0 ` (#` (#DoDComputerSecurityCenter(nowNCSC)9 (# (# DAA0  0` (#(#0 ` (#` (#DesignatedAccreditingAuthority%%#Authorityo#%% (# (# DAC0  0` (#(#0 ` (#` (#DiscretionaryAccessControl%%I?Discretionary Access ControlI%% (# (# DES0  0` (#(#0 ` (#` (#DataEncryption%%%Encryptioni%%%Standard%%A7Data Encryption StandardoA%%o (# (# DOD0  0` (#(#0 ` (#` (#DepartmentofDefense(DoD)I (# (# DODD0  0` (#(#0 ` (#` (#DepartmentofDefenseDirective{# (# (# DSA0  0` (#(#0 ` (#` (#DigitalSignatureAlgorithmU (# (# DSO0  0` (#(#0 ` (#` (#DesignatedSecurityOfficer/ (# (# DSS0  0` (#(#0 ` (#` (#DigitalSignatureStandard  (# (# EO0  0` (#(#0 ` (#` (#ExecutiveOrder%%/%Executive Ordert/%% (# (# FBI0  0` (#(#0 ` (#` (#FederalBureauofInvestigation%%[QFBI Federal Bureau of Investigation1[OEFederal Bureau of InvestigationtO%%e (# (# FEDSIM0 ` 0 ` (#` (#FederalSystemsIntegrationandManagementCenter? (# (# FIPSPUB0 ` 0 ` (#` (#FederalInformationProcessingStandardsPublicationq  (# (# FOIA%%FOIAl%%0  0` (#(#0 ` (#` (#FreedomofInformation%%=3Freedom of Informationi=%%ActK ! (# (# GAO0  0` (#(#0 ` (#` (#U.S.GeneralAccountingOffice%%C9General Accounting OfficetC%%%!" (# (# GPO0  0` (#(#0 ` (#` (#U.S.GovernmentPrintingOffice!# (# (# GSA0  0` (#(#0 ` (#` (#U.S.GeneralServicesAdministration" $ (# (# HR0  0` (#(#0 ` (#` (#HouseofRepresentativesReport#[!% (# (# HB0  0` (#(#0 ` (#` (#Handbook$5"& (# (# IBM0  0` (#(#0 ` (#` (#InternationalBusinessMachinesg%#' (# (# IRM%% IRMa%%0  0` (#(#0 ` (#` (#InformationResourcesManagementA&#( (# (# IRS0  0` (#(#0 ` (#` (#InternalRevenueService'$) (# (# LAN0  0` (#(#0 ` (#` (#LocalAreaNetwork'%* (# (# LOU0  0` (#(#0 ` (#` (#LimitedOfficialUse(w&+ (# (# MOU%% MOUa%%0  0` (#(#0 ` (#` (#MemorandumofUnderstanding)Q', (# (# MISSI%%MISSI %%0  0` (#(#0 ` (#` (#MultilevelInformationSystemSecurityInitiative*+(- (# (# NBS0  0` (#(#0 ` (#` (#NationalBureauofStandards(nowNIST)]+). (# (# NCIC0  0` (#(#0 ` (#` (#NationalCrimeInformationCenter7,)/ (# (# NCSC0  0` (#(#0 ` (#` (#NationalComputerSecurityCenter#-*0 (# (# #NITF0  0` (#(#0 ` (#` (#NationalInformationInfrastructure%%WMNational Information InfrastructureW%%TaskForce  (# (# NIST0  0` (#(#0 ` (#` (#NationalInstituteofStandardsandTechnology (# (# NSA0  0` (#(#0 ` (#` (#NationalSecurityAgency%%A7National Security AgencysA%% (# (# NSD0  0` (#(#0 ` (#` (#NationalSecurityDirective (# (# NSDD0  0` (#(#0 ` (#` (#NationalSecurityDecisionDirectiveqh (# (# NTIS0  0` (#(#0 ` (#` (#NationalTechnicalInformationServiceKB (# (# NSTISS0 ` 0 ` (#` (#NationalSecurityTelecommunications%%5+Telecommunicationse5%%andInformationSystemsSecurity%  (# (# OIT0  0` (#(#0 ` (#` (#OfficeofInformationandTechnology  (# (# OMB0  0` (#(#0 ` (#` (#OfficeofManagementandBudget%%OEOffice of Management and BudgetrO%%  (# (# OPM%% OPMe%%0  0` (#(#0 ` (#` (#OfficeofPersonnelManagement%%YOOPM Office of Personnel ManagementYMCOffice of Personnel ManagementmM%%   (# (# OPS0  0` (#(#0 ` (#` (#SystemsOperationsDivision   (# (# ORR0  0` (#(#0 ` (#` (#OfficeofRegulationsandRulingsg ^  (# (# OTA0  0` (#(#0 ` (#` (#OfficeofTechnicalAssistanceA8  (# (# PA0  0` (#(#0 ` (#` (#PrivacyAct%%'Privacy Acts'%%  (# (# PAA%% PAAc%%0  0` (#(#0 ` (#` (#PrincipalAccreditingAuthority%%OEPrincipal Accrediting AuthorityeO#Authorityc#%%  (# (# PBX%% PBXr%%0  0` (#(#0 ` (#` (#PrivateBranchExchange%%?5Private Branch Exchangeh?%%  (# (# PC0  0` (#(#0 ` (#` (#PersonalComputer  (# (# PL0  0` (#(#0 ` (#` (#PublicLawz (# (# RAM0  0` (#(#0 ` (#` (#RandomAccessMemory]T (# (# ROM0  0` (#(#0 ` (#` (#ReadOnlyMemory7. (# (# R/W0  0` (#(#0 ` (#` (#Read/Write (# (# SBU%% SBUt%%0  0` (#(#0 ` (#` (#SensitiveButUnclassified%%E;Sensitive But UnclassifiediE%% (# (# SDLC%%SDLCi%%0  0` (#(#0 ` (#` (#SystemsDevelopmentLifeCycle%%MCSystems Development Life CycleM%% (# (# SFUG%%SFUGs%%   ` 0 SecurityFeaturesUsersGuide%%MCSecurity Features Users GuideM%% (# (# SP0  0` (#(#0 ` (#` (#SpecialPublicationyp (# (# SPD%% SPDi%%0  0` (#(#0 ` (#` (#SecurityProgramsDivision%%QGSPD Security Programs DivisionnQE;Security Programs DivisionsE%%SJ (# (# TCB%% TCBi%%0  0` (#(#0 ` (#` (#TrustedComputerBase%%;1Trusted Computer Basei;%%-$ (# (# TCSEC%%TCSEC %%0 ` 0 ` (#` (#DoDTrustedComputerSystemEvaluationCriteria%%g]Trusted Computer System Evaluation Criteria1g%%(theOrangeBook%%'Orange Bookt'%%) (# (# TECS0  0` (#(#0 ` (#` (#TreasuryEnforcementCommunicationSystems (# (# TD0  0` (#(#0 ` (#` (#TreasuryDirective (# (# TFM%% TFMe%%0  0` (#(#0 ` (#` (#TrustedFacility%%!Facilityc!%%Manual%%?5Trusted Facility Manualv?%% (# (# UPS0  0` (#(#0 ` (#` (#UninterruptiblePowerSupplyof (# (# USC0  0` (#(#0 ` (#` (#UnitedStatesCodeI@  (# (# USCS0  0` (#(#0 ` (#` (#U.S.CustomsService# ! (# (# WAN0  0` (#(#0 ` (#` (#WideAreaNetwork " (# (# WWW0  0` (#(#0 ` (#` (#WorldWideWeb%%-#World Wide Web -%%!# (# (#   "$  t %%%%%%%%  &&  APPENDIXB X GoodSecurityPractices ###&&#%%5+Security Practices5%% 8 A&-) xdExA   X6vX&&B.10  GeneralComputerCareandHandling#&&XX6vg# .A(#(# Theownersoroperatorsguidesforcomputersandcomponentsspecifyspecialprecautions,care,andhandlingproceduresthatcanhelpavoidsystemfailuresanddataloss.Thefollowingaregeneralguidelinesandrecommendations:1.0  Plugeachpowercableintoagrounded(3hole)outlet.Useagoodqualityelectricalsurge  M  protector,powerfiltersystem,oruninterruptiblepowersupplytoprotectthecomputersystemfromelectricalvariationswhichcancausefailures. (#(# 2.0  Donotconnectordisconnectcomputersystemcomponentswiththesystemturnedon,unlessthe   systemandcomponentsarespecificallydesignedforthatpurpose. (#(# 3.0  Electrostaticdischarge(EDS)cancausecomputercomponentfailures.Takeprecautionsto C dischargeyourselfbeforetouchingthecomputerorattachedcomponents.Ifyoumustworkinsidethecomputer,wearproperEDSgroundingequipment(e.g.,wriststraps,etc.)andfrequentlytouchtheunpaintedmetalchassisperiodicallytoneutralizestaticbuildup. (#(# 4.0  Keepstrongmagneticfieldsawayfromthecomputercomponentsandmagneticrecordingmedia  (e.g.,diskettes,tapes,etc.).Ifaudiospeakersareusedwiththesystem,ensurethattheyaredesignedwithpropermagneticshielding. (#(# 5.0  Donottouchthesurfacesofmagneticrecordingmedia(e.g.,diskettes,tapes,etc.)orgold E electricalconnectors(circuitcardcontactsorconnectors).Bodyoilswillcontaminatethesesurfacesandcanresultincomponentfailures. (#(# 7.0  Protectcomputerequipmentandrecordingmedia(e.g.portable%%!portable!%%PCS,diskettes,CDS,etc.)from U adverseenvironmental%%+!environmentalS+%%conditions(e.g.,extremesoftemperatureandhumidity,corrosivegases,liquids,dust,orothercontaminants). (#(# 6.0  Computercomponentsdofail.Makeappropriatebackupsofallcriticaldataandstoreinasecure "# area,preferablyseparatefromthesameareawherethecomputeriskept. (#(#  X6vX&&B.20  GeneralSecurityPractices#&&XX6vA#%%5+Security Practices5%%$K"&(#(#  1.0  Controlphysicalaccesstocomputersystemsandlimitaccesstoonlyauthorizedpersons.m&$((#(# 2.0  Positioncomputerdisplayssuchthattheymaynotbeviewedbyunauthorizedpersons(e.g., !(%* throughwindows,doors,openworkareas,etc.). (#(#   )}',' & B  3.0  Donotallowcomputeraccessbyunauthorizedpersons: (#(# 0  0a"0` (#(#  LogoffactivehostorLANconnectionswhenevertheterminalsessionsareunattended.` (#` (# 0  0a"0` (#(#  Poweroffcomputerequipmentwhennotinuse.` (#` (# 0  0a"0` (#(#  Secureunattendedterminalareas(lockthedoors).` (#` (# 'B &  4.0  Identifythelevelofsensitivityofthedatastored,processed,orusedinthecomputerand KB implementappropriatesecuritymeasures. (#(# 'K5.0  ForsystemswhichuselogonIDsand/orpassword%%!password!%%accesscontrols,ensurethatchosenIDsand/or   passwordsconformtotherequirementsofthespecificcontrolsystemwheretheyareused. (#(# 0  Note:Passwordsareacommonlyusedbuteasilycompromisedaccesscontrolmethod.Automatedcomputerpenetrationprogramscanquicklydeterminecommonwords,names,orcharactercombinationsusedforlogonIDsand/orpasswords.ItisthereforeprudenttomaketheIDand/orpassword%%!password!%%ascomplexasappropriate.0(#(# (#(# 0  (a)0` (#(#Changedefaultpasswordsassoonaspractical.Donotallowsecurityaccesscontrolsto   beoperationalusingmanufacturerorvendor%%vendor%%suppliedpasswords. ` (#` (# 0  (b)0` (#(#KeeplogonIDsconfidential.DivulgeIDsonlyonaneedtoknowbasis.7.` (#` (# 0  (c)0` (#(#DONOTSHAREPASSWORDS.Ifapassword%%!password!%%mustbedivulged,changeitassoonas  possible. ` (#` (# Ѐ0  (#(# 0  (d)0` (#(#Generallydonotwritedownpasswords.Ifitisnecessarytowritethemdown,storethem yp inasecurearea. ` (#` (# 0  (e)0` (#(#Changepasswordsatleastevery90days(30daysisrecommended)oranytimetheyhave  been,oraresuspectedtohavebeen,compromised. ` (#` (# 0  (f)0` (#(#Donotincludepasswordsinprograms,scripts,orotherfileswheretheycanbe  compromised. ` (#` (# 0  (g)0` (#(#Recommendedpassword%%!password!%%patternsare:# !` (#` (# 0  0` (#(#6to8alphanumericcharacters,withatleastoneofeachtype(e.g.,PQT1FYX). ` (#` (# 0  0` (#(#nosequentiallyrepeatedcharacters(e.g.,11,aa,etc.). ` (#` (# 0  0` (#(#nonames,birthdays,commonlyusedidentifiers(e.g.,SocialSecurity#,etc.). ` (#` (# 0  0` (#(#noascendingordescendingdigits(e.g.,1234,abcd,etc.). ` (#` (# 6.0  Protectaccesscontroldevicesfromlossorunauthorizedaccess(e.g.,lockkeys,smartcards, ?%6!' Fortezzacards,encryption%%%encryption%%%cards/keys,securitycodes,etc.). (#(# 0  Note:Lossorcompromiseofencryptionscodesordevices(e.g.,Fortezzacards,etc.)mayrequirethereplacementofcodesand/ordevicesatbothsendingandreceivinglocations.Thiscanseverelyimpactdataavailability%%)availability)%%. Protectallencryptionscodesordevices. )x%,(#(# &  7.0  Ensurepropercontrolanddisposalofprinterribbons,laserprintercartridges,recordingmedia 9+0'. (e.g.,diskettes,CDS,tapes,etc.),printouts,andotherinformationstoragedeviceswhichcontainsensitivedata.'9+ (#(# 0  -)1(#(# & ^ 8.0  Useadequatesecurity%%3)adequate security3%%controls%%3)security controls3%%toprotectagainstmaliciouscode%%-#malicious codes-%%: (#(# 0  0a"0` (#(#  Useaqualityvirus%%virus1%%scannerand/orbehavioraldetectionprogram.` (#` (# 0  0` (#(# 0a"0 ` (#` (#  Virus%%Virus1%%scannersonlydetectvirus%%virus1%%codepatternsidentifiedintheparticularscanner. (# (# 0  0` (#(# 0a"0 ` (#` (#  Virus%%Virus1%%behavioraldetectionprogramsdetectcodepatternchangeswhicharesimilar  tothoseidentifiedinthedetectionprogram.  (# (# 0  0a"0` (#(#  Virus%%Virus1%%scannersandbehavioraldetectionprogramsmustbecurrent(notmorethan90180 KB daysold)tobeeffective.Newvirus%%virus1%%programsarebeingcreatedeverymonth. ` (#` (# 0  0a"0` (#(#  Anyrecordedmediawhosecontentisunknownorhasnotbeenscannedforknown   viruses,maybeasourceofmaliciouscode%%-#malicious codeS-%%contamination.Evennewprogramsfromestablishedmanufacturersandvendorshavebeensourcesofsuchcontamination. ` (#` (# '^  9.0  Informationstoredorprocessedbycomputers,relatedequipment,andprogramscanbedamaged g ^  innumerouswaysandfromvariouscauses.Itisimportantthatalldatawhichisconsideredessential(e.g.,programs,datafiles,etc.)beavailableandcapableofbeingrestoredtotheAISenvironment,shouldtheoriginalbecomeunusable.Backupfilesshouldbecreatedandmaintainedasappropriate.Securitycontrols%%3)Security controls3%%forthebackupfilesmustbecommensuratewiththesensitivityandcriticalityofthedata. (#(#  X6vX&&B.30  GoodSecurityPractices%%5+Security Practices5%%forPBX%% PBX,%%andVoice%%Voice:%%MailSystems#&&XX6v # ]T(#(# DialinaccesstosensitiveAIScanbeaserioussecurityexposureifappropriatesecuritycontrols%%3)security controls3%%arenotoperational.MostPrivateBranchExchange%%?5Private Branch Exchange?%%andVoice%%Voice %%mailsystemshavesecurityfeatureswhichcandeterorpreventunauthorizedaccess.Itisimportantthatthesefeaturesbeactivatedandenforced.ThefollowingrecommendationsareexcerptsprovidedbyAmericanTelephoneandTelegraph(ATT)totheU.S.TreasuryOfficeofTelecommunications%%5+Telecommunicationsn5%%Management. X6vX&&B.3.10  PBX%% PBX,%%Security#&&XX6v# C:(#(# 1.0  KeepPBX%% PBX,%%attendantconsolerooms,telephonewiringclosets,telephoneequipmentrooms,and   LocalExchangeCompany(LOC)demarcationroomslockedandsecured. (#(# 2.0  Requestpositiveidentificationfromallserviceequipmentvendorsandtechnicians.(#(# 3.0  Ensurethatanyremotemaintenance%%'maintenance'%%linephonenumberisunpublished,preferablynotinthesame O F! numbersgroups,andnotrecordedonjacks,wallfield,distribution%%)distribution)%%frame,etc. (#(# 4.0  Secureanyreports%%reportsi%%,documentation,orotherinformationfileswhichmayrevealthetrunkaccess "$ codesorpasswords. (#(# 5.0  Changealldefaultpasswordsimmediatelyafterinstallation.k%b!'(#(# 6.0  Choosepasswordsthataredifficult,buteasytoremember,andcontainasmanyalpha '#) characters/digitsaspossible,preferablysevenormore. (#(# 7.0  Deactivateunusedcodesandfeatures.)%,(#(# 8.0  Allowonlythreeattemptstoenteravalidaccesscode.a+X'.(#(# 9.0  HavethePBX%% PBXt%%waitfourorfiveringsbeforeansweringtheremoteaccessline.- )0(#(# Ї10.0  Restrictcallingprivilegestoindividualemployees. (#(# 11.0  Blockareacodeswherebusinessisnotdone,especially900,700,and976.(#(# 12.0  UsethemaximumauthorizationandRemoteAccessbarriercodelength.qh(#(# 13.0  Usesecuritydevicesonallports.% (#(#  X6vX&&B.3.20  Voice%%Voice:%%Mail#&&XX6v# (#(#  1.0  Dontallowoutgoingcallsfromamailbox.  (#(# 2.0  Setaminimumnumberofdigitsallowedforallpasswords(preferablyfiveormore).WN (#(# 3.0  Requireaminimumpassword%%!password!%%lengthtobeonedigitlongerthanextensionlength.  (#(# 4.0  Blockaccesstolongdistancetrunksorlocallines. (#(# 5.0  Requireuserstofrequentlychangepasswords.sj(#(# 6.0  Limitloginattemptstothreeorless.'(#(# 7.0  Tollrestrictlinesbetweenthevoice%%voiced%%mailsystemandPBX%% PBX%%.(#(# 8.0  Monitorvoice%%voiced%%mailsystemreports%%reports%%daily.(#(# 9.0  Deleteallunusedvoice%%voice%%mailboxes.C:(#(# 10.0  Ifoutcallingisused,restricttheporttoonlythosenumbersneededusingtheAutomaticRoute  Selectionpartitioning. (#(#  h %%%%%%%%&&   APPENDIXC X ControlledAccessProtection(C2%% C2%%)Outline ###&&d# 8 A&-) xddExA  TheNationalPolicyonControlledAccessProtection,issuedbytheWhiteHouse,National A Telecommunications%%5+Telecommunications5%%andInformationSystemsSecurityCommittee,07/15/87,directedthatbyJuly15,1992FederalagenciesmustprovideautomatedControlledAccessProtection(C2%% C2c%%level)forallsensitiveorclassified%%%classified1%%%informationprocessedormaintainedbyAIS,whenallusersdonothavethesameauthorizationtousethesensitiveinformation.[NTISSP200]ThisoutlinehighlightsTreasurySecurityManual,TDP7110,ChapterVI.4.B.1.on ControlledAccess  ]  Protection (C2%% C2%%levelfunctionality),forAISandnetworks%%!networks!%%processingSensitiveButUnclassified%%E;Sensitive But UnclassifiedE%%(SBU%% SBUt%%)  ;  Information.Exemption%%#Exemption#%%totheserequirementsrequireaformalRiskAssessment%%/%Risk Assessment1/%%andapprovals. X6vX&&FunctionalRequirements#&&XX6vG&#  %  1.0  ControlledAccessProtection(C2%% C2%%)mustprovideforthefollowing: (#(# 0  0a"0` (#(#  Authentication.u` (#` (# 0  0a"0` (#(#  Integrity.O` (#` (# 0  0a"0` (#(#  Confidentiality%%/%Confidentiality/%%.)` (#` (# 0  0a"0` (#(#  AccessControl.[` (#` (# 0  0a"0` (#(#  Nonrepudiation.5` (#` (# 0  0a"0` (#(#  Availability%%)Availability)%%.` (#` (# 2.0  Protectionisaccomplishedthrough: k(#(# 0  0a"0` (#(#  Accountability(useridentification/authentication).I` (#` (# 0  0a"0` (#(#  Audit%%Audit1%%trailforrelevantevents.{#` (#` (# 0  0a"0` (#(#  Controlofaccessrequests.U` (#` (# 0  0a"0` (#(#  Automaticclearing%%!clearing!%%ofresidualdata%%+!residual data+%%./` (#` (# 3.0  Protectionisrequiredfor: (#(# 0  0a"0` (#(#  Mainframesystemsi` (#` (# 0  0a"0` (#(#  Networks%%!Networks!%%running:C ` (#` (# 0  0` (#(# 0a"0 ` (#` (#  UNIX.u ! (# (# 0  0` (#(# 0a"0 ` (#` (#  MultitaskingmultiuserOperatingSystems.O!" (# (# 0  0` (#(# 0a"0 ` (#` (#  Dialup%%Dialup%%accesstonetworks%%!networks!%%.)"# (# (# 0  0` (#(# 0a"0 ` (#` (#  NetworkedDOSsystems# $ (# (# 0  0a"0` (#(#  StandaloneMicroprocessors.#!%` (#` (# 0  0` (#(# 0a"0 ` (#` (#  IfSBU%% SBU6%%issharedamongsystemstheninterimDACrequired.$_"& (# (# & F 4.0  C2%% C2%%levelrequirementsinclude: k&$((#(# 0  0a"0` (#(#  IdentificationbasedonUserID.I'$)` (#` (# 0  0a"0` (#(#  AuthenticationbasedonPassword%%!Password!%%.#(%*` (#` (# 0  0a"0` (#(#  Audit%%Audit1%%basedonanaudit%%audit1%%trailthatincludes:(&+` (#` (# 0  0` (#(# 0a"0 ` (#` (#  Recordsforalleventsmustinclude:'Fk&2)', (# (# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Date/time.*Y(-(#(# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  UserID.+3).(#(# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Eventtype.e, */(#(# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Success/failure.#?-*0(#(#w #0  0` (#(# 0a"0 ` (#` (#  Eventrecordsmustbecreatedandmaintained,including:  (# (# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Logon/logoff:(#(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  Originofrequest(e.g.,terminalID).h(#h(# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Password%%!Password!%%change:(#(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  Originofrequest(e.g.,terminalID).qhh(#h(# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Filerelatedevents:KB(#(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  Name,create,delete,open,close.% h(#h(# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Programinitiation. (#(# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Actionsby: (#(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  Systemoperators.  h(#h(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  Administrators.  h(#h(# 0  0` (#(#0 ` (#` (#0 (# (# 0a"0h(#(#  Securityofficers.g ^ h(#h(# 0  0` (#(# 0a"0 ` (#` (#  Dataaccessmustbeprotectedfrommodificationby:A8  (# (# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  LimitedReadaccess. (#(# 0  0` (#(# 0a"0 ` (#` (#  Reports%%Reports%%mustbe:  (# (# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  SelectivebyuserID. (#(# 5.0  DiscretionaryAccessControl%%I?Discretionary Access ControlVI%%(DAC)RequirementsSummary :z(#(# 0  0a"0` (#(#  Define/controlaccessfor:aX` (#` (# 0  0` (#(# 0a"0 ` (#` (#  Users.;2 (# (# 0  0` (#(# 0a"0 ` (#` (#  Resources(e.g.,filesandprograms).  (# (# 0  0a"0` (#(#  Dataaccessauthorization:` (#` (# 0  0` (#(# 0a"0 ` (#` (#  Userspecifiesaccesstodatatheown. (# (# 0  0` (#(# 0a"0 ` (#` (#  Unauthorizedaccessdenied. (# (# 6.0  DataRemanence%%#Remanence:#%%SecurityRequirementsSummary :WN(#(# 0  0a"0` (#(#  Magneticmediamayrequireclearing%%!clearing!%%.5,` (#` (# 0  0` (#(# 0a"0 ` (#` (#  Basedonriskanalysis%%+!risk analysis+%%. (# (# 0  0a"0` (#(#  ObjectReuse%%)Object Reuse)ReuseR%%:` (#` (# 0  0` (#(# 0a"0 ` (#` (#  Clearing%%!Clearing!%%,purgingofdataremanence%%#remanence#%%. (# (# 7.0  Testing%%Testing%%Requirement: wn(#(# 0  0a"0` (#(#  Assurancetesting%%testing,%%ofC2%% C2i%%featuresmustbeformallyconducted.UL ` (#` (# 8.0  DocumentationRequirementsSummary:  !"(#(# 0  0a"0` (#(#  SecurityFeaturesUser'sGuide.!#` (#` (# 0  0a"0` (#(#  TrustedFacility%%!Facilityc!%%Manual%%?5Trusted Facility Manual ?%%."$` (#` (# 0  0a"0` (#(#  TestDocumentation.#%` (#` (# 0  0a"0` (#(#  DesignDocumentation.u$l &` (#` (# 9.0  SecurityProductsAnalysismustinclude: )& "((#(# 0  0a"0` (#(#  Documentedreviewofproductrequirements/recommendations:'")` (#` (# 0  0` (#(# 0a"0 ` (#` (#  Stateareasofcompliance.'#* (# (# 0  0` (#(# 0a"0 ` (#` (#  Identifyareasofnoncompliance,including:($+ (# (# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Correctiveactions.)%,(#(# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Formalexceptions.o*f&-(#(#   I+@'. &   10.0  NetworkSecurityRequirements:  (#(# 0  0a"0` (#(#  LocalAreaNetworkSecurity(ToBeDeveloped)` (#` (# 0  0` (#(# 0a"0 ` (#` (#  ThissectionoftheTreasurySecurityManualisnotavailable. (# (# 0  0a"0` (#(#  Dialup%%Dialup,%%AccessControl.` (#` (# 0  0` (#(# 0a"0 ` (#` (#  ExplicitID,authentication,andaudit%%audit1%%trail.ul (# (# 0  0` (#(#0 ` (#` (# 0a"0 (# (#  Ifencrypted,thenmustcomplywithTDP7110,VI.3.A.OF(#(# 0  0a"0` (#(#  WhenSBU%% SBU6%%dataistransmittedusingNSATypeIIencryption%%%encryption%%%:) ` (#` (# 0  0` (#(# 0a"0 ` (#` (#  ItmustusetheDataEncryption%%%Encryptioni%%%Standard%%A7Data Encryption StandardNA%%(DES).' )R  (# (# 0  Note:0` (#(#Encryption%%%Encryptioni%%%isnotmandatory,butcanbeacosteffectiveriskmanagementconsideration.   ` (#` (# @(ThisPageIntentionallyLeftBlank)  yp   %%% %%%%#%&&   APPENDIXD X SecurityPlan%%+!Security Plan+%%Format jZ#?Z##&& Z# 8 A&-) xdExA  ^Z X6vX&&SecurityPlan%%+!Security Plan +%%Elements#&&XX6v[#  A Thereisnofixedformatforasecurityplan%%+!security plan+%%,howevertheplanshouldincludethefollowingbasicelements.1.0  SystemIdentification (#(# 0  0a"0` (#(#  ResponsibleOrganization ` (#` (# 0  0a"0` (#(#  SystemName/Title s ` (#` (# 0  0a"0` (#(#  SystemCategory M ` (#` (# 0  0a"0` (#(#  SystemOperationalStatus' ` (#` (# 0  0a"0` (#(#  GeneralDescription/PurposeY ` (#` (# 0  0a"0` (#(#  SystemEnvironmentandSpecialConsiderations3 ` (#` (# 0  0a"0` (#(#  InformationContact(s) ` (#` (# 2.0  InformationSensitivitytype:i(#(# 0  0a"0` (#(#  Public/UnclassifiedC` (#` (# 0  0a"0` (#(#  SensitiveButUnclassified%%E;Sensitive But UnclassifiedE%%u` (#` (# 0  0` (#(# 0a"0 ` (#` (#  SeveralcategoriesO (# (# 0   (#(# 3.0  SecurityMeasurestaken:(#(# 0  0a"0` (#(#  Physicalcontrol` (#` (# 0  0a"0` (#(#  Hardwarecontrol_` (#` (# 0  0a"0` (#(#  Softwarecontrols9` (#` (# 0  0a"0` (#(#  Administrativecontrolsk` (#` (# 0  0a"0` (#(#  AccessControlE` (#` (# 0  0a"0` (#(#  Dataprotection` (#` (# 0  0a"0` (#(#  Communicationprotection` (#` (# 0  0a"0` (#(#  Etc. #{` (#` (#w #ThefollowingmodelisfromtheCustomsSystemsDevelopmentLifeCycle%%MCSystems Development Life CycleM%%manual,CISHB550004,1996,andisanacceptableformatguideline.@xx$ SECURITYPLAN %%+!SECURITY PLANK+%%  ProjectName: `     h   ProjectNumber: wn DatePrepared:__/__/__DateUpdated:__/__/__DatePresented__/__/__DateApproved__/__/__]Ip @ xHP X !(#X] 3INITIATIONPHASE      1.  SystemIdentification 󀄀Thissectioncontainsbasicidentifyinginformationaboutthesystem. } t    A.  ResponsibleOrganization     B.  SystemName/Title     C.  SystemCategoryStatewhetheritisaMajorapplication%%3)Major application&3'applicationt'%%,Generalsupportsystem%%=3General support system=%%,etc. ZQ   D.0  SystemOperationalStatusStatewhetheritisOperational,Underdevelopment,Undergoinga  majormodificationorasignificantsecuritychange (#(#   E.  GeneralDescription/Purpose e\   F.  SystemEnvironmentandSpecialConsiderations    G.  InformationContact(s)   DEFINITIONSTAGE  ?6  2.0  SensitivityofInformation 󀄀Identifythetypesofinformationtobeprocessed.Foreachtypeof  information,identifythefollowing: (#(#   A.  ApplicableLawsorRegulations MD!   B.  Whethertheintegrityprotectionrequirementislow,medium,orhigh  #   C.  Whethertheavailability%%)availability)%%protectionrequiredislow,medium,orhigh "%   D.  Whethertheconfidentiality%%/%confidentiality/%%protectionrequiredislow,medium,orhigh '$ '  DEFINITIONSTAGE  %!)  3.0  SystemSecurityMeasures 󀄀Thissectionshoulddescribethecontrolmeasures(inplaceorplanned) c'Z#+ thatareintendedtomeettheprotectionrequirementsofthesystem.Thetypesofcontrolmeasuresshouldbeconsistentwiththeneedforprotectionofthesystemdescribedintheprevioussection. (#(#   A.  RiskAssessment%%/%Risk Assessment1/%%andManagement *&/   B.  ApplicableGuidance @,7(1  -)2 & m   C.0  SecurityControlMeasuresForeachcontrolmeasure(categories16below),specifywhetherit   is%inplace%%inplace%,planned,notapplicablewith"SecurityControlMeasuresDescribetheControlMeasures"'m &s (#(#     1. p ManagementControlsOverallmanagementcontrolsofthesystem. E<      p a. AssignmentofSecurityResponsibility       p b. RiskAnalysis%%+!Risk Analysis6+%%        p c. PersonnelScreening  x     2.0 p Acquisition%%'Acquisition'%%/Development/Installation/ImplementationControlsProcedurestoassure    protectionisbuiltintothesystem,especiallyduringsystemdevelopment. p(#p(#      p a. Acquisition%%'Acquisition'%%/SecuritySpecifications        p b. ConfigurationManagement%%A7Configuration ManagementA%% [R       p c. QualityAssurance *!       p d. DesignReviewandTesting%%Testingt%%        p e. Accreditation%%+!Accreditationa+%%/Certification%%+!Certificationa+%%       3.0 p OperationalControlsDaytodayproceduresandmechanismstoprotectsystemswhenthey f] becomeoperational. p(#p(#      p a. PhysicalandEnvironmental%%+!Environmentala+%%Protection       p b. Production,I/OControls       p c. Emergency%%#Emergencya#%%,Backup,andContingency%%'Contingency'%%Planning qh      p d. Audit%%Audite%%andVarianceDetection @7      p e.0 HardwareandSystemSoftwareMaintenance%%'Maintenance'%%Controls (# (#      p f. Documentation       p g. ConfigurationManagement%%A7Configuration ManagementA%%       p h. SecurityAdministration |s      p i. DatabaseAdministration KB     4.0 p SecurityAwareness%%#Awarenesso#%%andTraining%%!Training!%%񀄀Securityawareness%%#awarenesso#%%andtraining%%!training!%%ofusers,technicalstaff,   andmanagersconcerningthesystem. p(#p(#      p a. SecurityAwareness%%#Awareness#%%andTraining%%!Training!%%Measures V M#     5.0 p TechnicalControlsHardwareandsoftwarecontrolsusedtoprovideautomatedand/or !% facilitatemanualprotections. p(#p(#      p a. UserIdentificationandAuthentication a$X (      p b. Authorization/AccessControls 0%'!)      p c. Integrity/ValidationControls %!*      p d. Audit%%Auditg%%Trails &"+      p e. Confidentiality%%/%Confidentiality/%%Controls '#,     6.0 p ControlsOvertheSecurityofApplications(includingcontrolsprovidedbySupportSystems);)2%.p(#p(# 0  0(#(#0p(#(#Thesecurityofeachapplication%%'applicationt'%%thatprocessesonasupportsystemaffectsthesecurityofallothersprocessingthere.Themanagerofthesupportsystemshouldunderstandtheriskthateachapplication%%'applicationt'%%representstothesystem. p(#p(#   w,n(2  3&   4.0  AdditionalComments 󀄀Thisfinalsectionisintendedtoprovideanopportunitytoincludeadditional   commentsaboutthesecurityofthesubjectsystemandanyperceivedneedforguidanceorstandards.' t (#(# $ X,ph$  %%%&%%%%)%&&   APPENDIXE X ComputerSecurityTraining ###&&v#%%!Training&!%% 8 A&-) xddExA  C S $# C2  1  3  .0  INTRODUCTION A(#(# TheOfficeofPersonnelManagement%%MCOffice of Personnel ManagementM%%(OPM%% OPMe%%)hasissuedtraining%%!trainingP!%%regulationswhichimplementtheComputerSecurityActof1987byprescribingthegeneralprocedures,scope,andmannerofsecuritytraining%%!trainingP!%%tobeprovidedtoFederalcivilianemployees.2  2  3  .0  AUTHORITY %%#AUTHORITY8#%% a (#(# TheComputerSecurityAct%%;1Computer Security Act;%%of1987,PL100-235,wasenactedtoimprovethesecurityandprivacyofsensitiveinformationinFederalcomputersystems.Asonewayofmeetingthatgoal,thelawrequiresthateachagencyshallprovideforthe mandatoryperiodictraining %%!training!%%incomputersecurityawareness%%#awareness#%%and %  acceptedcomputerpracticesofallemployeeswhoareinvolvedwiththemanagement,use,oroperationofeachcomputersystemwithinorunderthesupervisionoftheagency.TheNationalInstituteofStandardsandTechnology(NIST)SpecialPublicationNo.500172,.Computer 9 SecurityTraining%%!Training!%%Guidelines,11/89,setsthespecific guidelines fordevelopmentandimplementationof m requiredawareness%%#awareness#%%training%%!training!%%andreporting.2  3  3  .0  ORGANIZATIONRESPONSIBILITIES (#(# 0  (Reference:TDP7110,VI.8.A,1992). (#(# 0  Director%%!Director!%%,OfficeofSecurity(DOS) :U.S.Treasury9(#(# 0  0` (#(#0 ` (#` (#Managetraining%%!training!%%andawareness%%#awareness#%%programs.o (# (# 0  0` (#(#0 ` (#` (#Coordinatetraining%%!training!%%andawareness%%#awareness#%%programs.I (# (# 0  0` (#(#0 ` (#` (#Reviewagencytraining%%!training!%%andawareness%%#awareness#%%programsforcompliance.# (# (# 0  DeputyAssistantSecretary,InformationSystems(DASIS): U.S.Treasury(#(# 0  0` (#(#0 ` (#` (#Developandreviewtraining%%!training!%%andawareness%%#awareness#%%guidelines.] (# (# 0  0` (#(#0 ` (#` (#Reviewagencytraining%%!training!%%andawareness%%#awareness#%%programsforcompliance.7  (# (#  0  HeadsofBureaus :C!"(#(# 0  0` (#(#0 ` (#` (#Develop,fund,andimplementtraining%%!training!%%andawareness%%#awareness:#%%program.!"# (# (# 0  0` (#(#0 ` (#` (#Ensurecontractorsaretrained(requiredcontractprovisions)." $ (# (# 0  0` (#(#0 ` (#` (#Appointbureauofficialasliaisontoannually(July31)reporttraining%%!training!%%and #}!% awareness%%#awareness:#%%programstatustoDOS(Treasury).  (# (# 0  0` (#(#0 ` (#` (#Annuallydevelop,maintain,andupdatetraining%%!training!%%andawareness%%#awareness:#%%program.%1#' (# (# 0  0` (#(#0 ` (#` (#Annuallyreporttraining%%!training!%%statusandplanssummarytoDOS.c& $( (# (#   ='$) &   2  4  3  .0  AWARENESS%%#AWARENESS8#%%TRAINING%%!TRAINING!%%BASICREQUIREMENTS  (#(# 0  ComputerSecurityTraining%%!Training!%%Guidelines,11/89.[NIST500172](#(# 2  4  .  1  3  .0  Objectives: (#(# 0  0` (#(#a.0 ` (#` (#Understandthevalueofinformation.{r (# (# 0  0` (#(#b.0 ` (#` (#Awareness%%#Awareness:#%%ofvulnerabilities,risks,andthreatstoAIS.UL (# (# 0  0` (#(#c.0 ` (#` (#UnderstandingtoenablepersonneltoapplyFederal,Treasury,andBureau / & INFOSEC/COMSEC%%COMSECs%%policies,practices,andprocedures.  (# (# ' 2  4  .  2  3  .0  Procedures:   (#(# 0  0` (#(#a.0 ` (#` (#Newpersonnelwithin5daysofappointment.   (# (# 0  0` (#(#0 ` (#` (#Orientationonspecificresponsibilities.  (# (# 0  0` (#(#0 ` (#` (#Managers,users,oroperatorsusingSBU%% SBU%%data,within60days.  (# (# 0  0` (#(#b.0 ` (#` (#Training%%!Training!%%updatewheneverAISINFOSEC/COMSEC%%COMSEC%%environmentchanges.)  (# (# 0  0` (#(#c.0 ` (#` (#Threatbriefingandawareness%%#awareness:#%%refresher.Allpersonnel.%%%,% /  1        (# (# 0  0` (#(#0 ` (#` (#Examplesoftraining%%!training'!%%:eMail,newsletter,memoranda,training%%!training'!%%diskettes,videos.  (# (# 2  4  .  3  3  . Content/Audience:   0  0` (#(#a.0 ` (#` (#Minimumcontent/subjectmatter:of (# (# 0  0` (#(#0 ` (#` (#Securitybasics,securityplanningandmanagement.  (# (# 0  0` (#(#0 ` (#` (#Mayuseinhouseorcommercial%%%commercial1%%%training%%!training!%%.  (# (# 0  0` (#(#b.0 ` (#` (#Mustincludebureauandcontractorpersonnelforeachcontentarea: (# (# 0  0` (#(#0 ` (#` (#executives,operations,programmingstaff,andusers.  (# (# 0  0` (#(#c.0 ` (#` (#Training%%!Training!%%levelforeachspecifictargetaudiencecategory,basedonindividual  responsibilities,shouldinclude:  (# (# 0  0` (#(#0 ` (#` (#awareness%%#awareness#%%,policy,implementation,andperformance.  (# (# 2  4  .  4  3  .0  Reporting: (#(# 0  0` (#(#a.0 ` (#` (#BureauHeadreports%%reports,%%toDOSby07/31annually. (# (# 0  0` (#(#0 ` (#` (#Name,phone,addressofagencytraining%%!training!%%liaison.  (# (# 0  0` (#(#b.0 ` (#` (#Prior12monthtraining%%!training!%%summary. (# (# 0  0` (#(#c.0 ` (#` (#Projectedcourseofstudyfornextfiscalyear.| (# (# 0  0` (#(#0 ` (#` (#Approximatenumberofjobs(billets)involved.  (# (# 0  0` (#(#0 ` (#` (#Areasofstudy.  (# (# 0  0` (#(#0 ` (#` (#Audiencetype(e.g.,technical,management,etc.).  (# (# 2  5  3  .0  COMPUTERSECURITYBASICSTOPICALOUTLINE "$(#(# 2  5  .  1  3  .0  ThreatsandVulnerabilities $v &(#(# 0  0` (#(#Definitionsofterms ` (#` (# 0  0` (#(#Majorthreats: ` (#` (# 0  0` (#(#0 ` (#` (#Unauthorized,accidental,orintentional;  (# (# 0  0` (#(#0 ` (#` (#disclosure;  (# (# 0  0` (#(#0 ` (#` (#modification;  (# (# 0  0` (#(#0 ` (#` (#destruction;and)%, (# (# 0  0` (#(#0 ` (#` (#delay.  (# (# 0  0` (#(#Impactareas. ` (#` (# 0  0` (#(#Computerabuseexamples.` (#` (# 0  0` (#(#Vulnerabilityexamples. ` (#` (# 2  5  .  2  3  .0  Organizationalresponsibilities KB(#(# 0  0` (#(#Policymakers. ` (#` (# 0  0` (#(#Seniormanagement. ` (#` (# 0  0` (#(#Endusers,programmers,orFunctionalmanagers. ` (#` (# 0  0` (#(#DataProcessingorganization. ` (#` (# 0  0` (#(#InformationResourcesManagement,Security,andAudit%%Audit%%functions. ` (#` (# &   2  5  .  3  3  .0  Riskmanagement%%/%Risk management/%%basicconcepts E< (#(# 0  0` (#(#Threatandvulnerabilityassessment. ` (#` (# 0  0` (#(#Cost/benefitanalysis. ` (#` (# 0  0` (#(#Costeffectivecontrols. ` (#` (# 0  0` (#(#Efficiency/effectivenessofcontrols. ` (#` (# ' E2  5  .  4  3  .0  Policyforprotectinginformation e\(#(# 0  0` (#(#Agencycomputersecuritypolicy. ` (#` (# 0  0` (#(#Employee/contractoraccountabilityforinformationresources. ` (#` (# 2  5  .  5  3  .0  Goodsecuritypractices %%5+security practices5%%(#(# 0  0` (#(#Physical/electronicprotectionof: ` (#` (# 0  0` (#(#0 ` (#` (#physicalareas(spaces);  (# (# 0  0` (#(#0 ` (#` (#equipment;  (# (# 0  0` (#(#0 ` (#` (#passwords;  (# (# 0  0` (#(#0 ` (#` (#datafiles;  (# (# 0  0` (#(#0 ` (#` (#againstviruses,worms,etc.;  (# (# 0  0` (#(#0 ` (#` (#backupofdatafiles;  (# (# 0  0` (#(#0 ` (#` (#storageofmagneticmedia;and  (# (# 0  0` (#(#0 ` (#` (#reportingsecurityviolations%%%violations1%%%.  (# (# & f 2  6  3  .0  BASICLEVEL:COMPUTERSECURITYAWARENESS%%#AWARENESS:#%%TRAINING %%!TRAINING!%%3 *!(#(# 2  6  .  1  3  .0  ThreatsandVulnerabilities !#(#(# 0  0` (#(#Definitionsofterms. ` (#` (# 0  0` (#(#Sourcesofthreats: ` (#` (# 0  0` (#(#0 ` (#` (#External:  (# (# 0  0` (#(#0 ` (#` (#0 (# (#Thingsoutsidethecomputersystems, (#(# 0  0` (#(#0 ` (#` (#0 (# (#facilities, (#(# 0  0` (#(#0 ` (#` (#0 (# (#environment, (#(# 0  0` (#(#0 ` (#` (#0 (# (#physicalcontrols,and (#(# 0  0` (#(#0 ` (#` (#0 (# (#physicalemergencies,etc.'f 3  (#(# 0  0` (#(#SupervisorMode: ` (#` (# 0  0` (#(#0 ` (#` (#Thingsinsidethecomputersystems:  (# (# 0  0` (#(#0 ` (#` (#0 (# (#hardware, (#(# 0  0` (#(#0 ` (#` (#0 (# (#firmware,and (#(# 0  0` (#(#0 ` (#` (#0 (# (#operatingsoftware.-(0(#(# 0  0` (#(#UserMode: ` (#` (# 0  0` (#(#0 ` (#` (#Thingsusersinterfacetothecomputersystems:  (# (# 0  0` (#(#0 ` (#` (#0 (# (#application%%'application '%%software, (#(# 0  0` (#(#0 ` (#` (#0 (# (#usersoftware, (#(# 0  0` (#(#0 ` (#` (#0 (# (#utilitysoftware,and (#(# 0  0` (#(#0 ` (#` (#0 (# (#communications,etc. (#(# 0  0` (#(#ObjectofThreats: ` (#` (# 0  0` (#(#0 ` (#` (#OperatingSystemandSubsystemIntegrity,  (# (# 0  0` (#(#0 ` (#` (#Accountingmechanisms,  (# (# 0  0` (#(#0 ` (#` (#Uservalidation,  (# (# 0  0` (#(#0 ` (#` (#Priorityandprocessscheduling,  (# (# 0  0` (#(#0 ` (#` (#Integrityofcode,  (# (# 0  0` (#(#0 ` (#` (#Memoryaccesscontrol,and  (# (# 0  0` (#(#0 ` (#` (#Continuityofoperations%%A7Continuity of operationsA%%.  (# (# 0  0` (#(#DataSetAccessControl: ` (#` (# 0  0` (#(#0 ` (#` (#Read,  (# (# 0  0` (#(#0 ` (#` (#Write,  (# (# 0  0` (#(#0 ` (#` (#Execute,  (# (# 0  0` (#(#0 ` (#` (#Append,  (# (# 0  0` (#(#0 ` (#` (#Delete,  (# (# 0  0` (#(#0 ` (#` (#Restrictaccesstospecificprograms,and  (# (# 0  0` (#(#0 ` (#` (#Controlofofflinefiles(tape,disk,etc.).  (# (# 0  0` (#(#Majorthreats: ` (#` (# 0  0` (#(#0 ` (#` (#Unauthorized,accidental,orintentional,  (# (# 0  0` (#(#0 ` (#` (#disclosure,  (# (# 0  0` (#(#0 ` (#` (#modification,  (# (# 0  0` (#(#0 ` (#` (#destruction,and  (# (# 0  0` (#(#0 ` (#` (#delay.  (# (# 0  0` (#(#Impactareas: ` (#` (# 0  0` (#(#0 ` (#` (#Computerabuseexamples,and  (# (# 0  0` (#(#0 ` (#` (#Vulnerabilityexamples.  (# (# 2  6  .  2  3  .0  Organizationalresponsibilities I@ (#(# 0  0` (#(#Policymakers: ` (#` (# 0  0` (#(#0 ` (#` (#Seniormanagement;  (# (# 0  0` (#(#Endusers,programmers,orFunctionalmanagers; ` (#` (# 0  0` (#(#DataProcessingorganization;and ` (#` (# 0  0` (#(#InformationResourcesManagement,Security,andAudit%%Audit%%functions. ` (#` (# 2  6  .  3  3  .0  Riskmanagement%%/%Risk management/%%basicconcepts C%:!'(#(# 0  0` (#(#Threatandvulnerabilityassessment, ` (#` (# 0  0` (#(#Cost/benefitanalysis, ` (#` (# 0  0` (#(#Costeffectivecontrols,and ` (#` (# 0  0` (#(#efficiency/effectivenessofcontrols. ` (#` (# 2  6  .  4  3  .0  Policyforprotectinginformation c*Z&-(#(# 0  0` (#(#Agencycomputersecuritypolicy, ` (#` (# 0  0` (#(#Employee/contractoraccountabilityforinformationresources. ` (#` (#   ,(0 &   2  6  .  5  3  .0  Goodsecuritypractices %%5+security practices5%% (#(# 0  0` (#(#Physical/electronicprotectionof: ` (#` (# 0  0` (#(#0 ` (#` (#areas,  (# (# 0  0` (#(#0 ` (#` (#equipment,  (# (# 0  0` (#(#0 ` (#` (#passwords,  (# (# 0  0` (#(#0 ` (#` (#datafiles,  (# (# 0  0` (#(#0 ` (#` (#againstviruses,worms,etc.,  (# (# 0  0` (#(#0 ` (#` (#backupofdatafiles,  (# (# 0  0` (#(#0 ` (#` (#storageofmagneticmedia,and  (# (# 0  0` (#(#0 ` (#` (#reportingsecurityviolations%%%violations1%%%.'   (# (#      @(ThisPageIntentionallyLeftBlank)  yp  l %%%-%%%%0%&&   APPENDIXF X SecurityRequirementsMethodology ###&&# 8 A&-) xd?ExA   SECURITYPOLICY  A [TDP7110;USCS96PLAN]TheU.S.TreasuryDepartmentdesignatesCustomsasaCategoryIagencywhoseessentialfunctionsareuninterruptibleandcriticaltothecontinuityoftheFederalgovernment.Customsmissionincludes:0  (a)0` (#(#EnsurethatallgoodsandpersonsenteringorexitingtheUnitedStatesdosoincompliance  7  withalltheUnitedStateslawsandregulation. ` (#` (# 0  (b)0` (#(#Protectthepublicagainstviolations%%%violations:%%%whichthreatenthenationaleconomyandhealthand C  safety. ` (#` (# 0  (c)0` (#(#Bethenationalresourceforinformationongoodsandpersonscrossingourborders.` (#` (# TheseactivitiesprovideactiveenforcementofU.S.laws,includingthecontrolandgenerationofsignificantfinancialrevenuetotheU.S.Treasury.CustomsgeneralsupportAISsandmajorAISapplicationsthatcreate,collect,communicate,compute,disseminate,store,and/orcontroldatawhichincludeslawenforcement,personal,financial,andcounternarcoticsinformationareassignedthesecuritycategoryofSensitiveButUnclassified%%E;Sensitive But UnclassifiedE%%(SBU%% SBUt%%).SBU%% SBUt%%informationmustbeprotectedinamannerfunctionallyequivalenttotheDoDclassification%%-#classificationc-%%levelofC2%% C2s%%. OPERATIONALSECURITYPOLICY  {# CustomsoperationalsecuritypolicyspecifiesthecriticalaspectsofCustomsAISsandthemannerinwhichregulatorypolicyistobesatisfied.ItincludesthetradeoffdecisionsmadebetweenvarioussecuritysafeguardsandinvolvesthefunctionalallocationofthevarioussecurityrelatedtaskstotheelementsoftheAISs.Thetradeoffsofcost,performance,andriskhelpdeterminehowsecuritywillbebuiltandimplemented. ANALYSISANDDESIGNOFAIS  K ! TheanalysisofexistingAISsandthedesignofevolvingornewonesgenerallyproceedsfromtheregulatingpolicy(ies)tothemechanismsimplementingcompliancetothosepolicies.Therearemanywaystosatisfysecurityrequirementsandpolicyisfrequentlysubjecttochangetoaccommodatechangesintechnology,environment,politicalandorganizationstructure,andregulationsofvariouskinds.Itis thereforeimportantthatanyanalysisordesignconsidercurrentrequirements. g%#'O  &   INTERFACEPOLICY    TheexchangeofbetweenAISsisbasedonexplicitinterfacepolicyandcanbethoughtofasanaugmentationofimportingandexportingofdata.Suchexchangemustconsiderthat:1)thedatasentmustcontinuetobeprotectedattheownerassignedlevelofcontrol,and2)thedatareceivedmustcontinuetobeprotectedattheownerassignedlevelofcontrol.Inmostcases,CustomsdatamustbecontrolledatsecurityfunctionallevelequivalenttoC2%% C2%%.ItistheresponsibilityofthesendingAIStoassurethatanyvirtualcommunicationschannels,and/orreceivingAIS,provideappropriateprotectioncontrols.'   TRUSTEDCOMPUTERBASE%%;1TRUSTED COMPUTER BASE;%%(TCB%% TCB%%)POLICY  g ^  TheTrustedComputerBase%%;1Trusted Computer Base1;%%(TCB%% TCBe%%)conceptprovidesasoundmethodofAISsecurityevaluation.EvaluationsofmechanismswhicharesharedbyTCBsmustbedoneindividuallytoensureconsistencywithinterfacepolicyanddiscretionaryaccesscontrols(DAC).EachTCB%% TCBe%%mustprovideforasecurityadministratorandgeneraterelevantaudit%%audit %%records.NetworkedTCBsmustbereviewedtoconsidertheimplicationsoffailureononeofthecomponentTCBsfromthestandpointofitsimpacttoalloftheinterconnectingentities.Ameanstocooperativelyshutdownandrecoverinasecuremannermustexist. RISKMANAGEMENT%%/%RISK MANAGEMENTB/%%POLICY   ATCB%% TCB%%whichhasnotbeenassuredtocomplywiththesecurityconsiderationsshouldbeconsideredandtreatedasarisk.Asmallpartoftheriskmanagement%%/%risk management/%%processistheriskassessment%%/%risk assessment/%%procedure.Consideringtheresultsofriskassessment%%/%risk assessment/%%,theriskmanagement%%/%risk management/%%mayrequireaniterationofoperationalpolicytoensurecompliancetoregulatorypolicy.PropagatedriskresultsfromtherisklevelofoneAIScascadingtoanotherinterconnectedAIS.TheinherentriskofoneAISmayincreasetheexposedriskofanotherAISwheninterconnectiondoesnotlimitrelatedrisks.ItispossiblethatinterconnectionsofAISscanresultinacombinedcontributedriskgreaterthanthatsolelycontributedbyanysingleAIS.Thefourriskfactors(riskindex,exposedrisk,contributedrisk,andsolelycontributedrisk)mustbeconsideredwhenevaluatinganAIS.[TD8503]InmanysituationsthesecuritygoalscanbeachievedwithoutredesignofexistingAISs,alsoevolvingandnewsystemscangenerallyaddmorefunctionandcapabilitywhilerealizingsecuritygoals.Theriskmanagement%%/%risk management/%%approachisalsoamajorsteptowardsachievingthesecurityrecommendedfornetworkedAISs.  e$\ &  m %%%5%% %%8 %&&   APPENDIXG X OMBCirculars #U##&&6# 8 A&-) xd?ExA  t    OMBCircularNo.A123%%A123%%,Introduction&Comments   A  OFFICEOFMANAGEMENTANDBUDGET %%OEOFFICE OF MANAGEMENT AND BUDGET O%% M   ManagementAccountabilityandControl     AGENCY :OfficeofManagementandBudget%%OEOffice of Management and BudgetO%%  ]   ACTION : FinalRevisionofOMBCircularNo.A123 %%A123%% m  Є SUMMARY :ThisNoticerevisesOfficeofManagementandBudget%%OEOffice of Management and Budget@O%%(OMB)CircularNo.A123%%A123%%,  "ManagementAccountabilityandControl."TheCircular,whichwaspreviouslytitled"InternalControlSystems," implementstheFederalManagers'FinancialIntegrityAct%%cYFederal Managers' Financial Integrity Actc%%of1982(FMFIA%%FMFIA%%).  _  FORFURTHERINFORMATIONCONTACT :OfficeofManagementandBudget%%OEOffice of Management and BudgetO%%,OfficeofFederal o FinancialManagement,ManagementIntegrityBranch,Room6025,NewExecutiveOfficeBuilding,Washington,D.C.20503,telephone(202)3956911andfax%% fax%%(202)3953952.ForacopyoftherevisedCircular,contactOfficeofAdministration,PublicationsOffice,Room2200,NewExecutiveOfficeBuilding,Washington,D.C.20503,ortelephone(202)3957332. ELECTRONICACCESS :ThisCircularisalsoaccessibleontheU.S.DepartmentofCommerce's 7 FedWorldNetworkundertheOMBLibraryofFiles.0  TheTelnetaddressforFedWorldviaInternet%%!Internet!!Internet!%%is"fedworld.gov".G(#(# 0  TheWorldWideWeb%%-#World Wide Web-%%addressis"http://www.fedworld.gov/ftp.htm#omb".!(#(# 0  Forfiletransferprotocol(FTP)access,theaddressis  "ftp://fwux.fedworld.gov/pub/omb/omb.htm". (#(# ThetelephonenumberfortheFedWorldhelpdeskis(703)487-4608. SUPPLEMENTARYINFORMATION:  c !  A.Background  "#   CircularNo.A123%%A123%%waslastissuedonAugust4,1986. OnMarch13,1995theOfficeof #s!% ManagementandBudget%%OEOffice of Management and Budget O%%requestedpubliccommentsonarevisedversionoftheCircular(60FR13484) . %+#'   Therevisionannouncedherealtersrequirementsforexecutiveagenciesonevaluating ;'$) managementcontrols,consistentwithrecommendationsmadebytheNationalPerformanceReview.  (%* TheCircularnowintegratesmanypolicyissuancesonmanagementcontrolintoasingledocument,andprovidesaframeworkforintegratingmanagementcontrolassessmentswithotherworknowbeingperformedbyagencymanagers,auditorsandevaluators.  +)).y &     TheCircularemphasizesthatmanagementcontrolsshouldbenefitratherthanencumbermanagement,andshouldmakesenseforeachagency'soperatingstructureandenvironment.BygivingagenciesthediscretiontodeterminewhichtoolstouseinarrivingattheannualassurancestatementtothePresidentandtheCongress,theCircularrepresentsanimportantsteptowardastreamlinedmanagementcontrolprogramthatincorporatesthereinventionprinciplesofthisAdministration.' a  &  B.AnalysisofComments  %    Thirtythreeresponseswerereceivedfrom23FederalagenciesandtheAmericanInstitute   ofCertifiedPublicAccountants(AICPA) .Ofthe33responses,14simplyagreedwiththeproposed    revisionandmadenocommentsonthedocument,althoughsomehadminorcommentsonaproposalbytheChiefFinancialOfficers'Counciltostreamlinereporting.Almostalloftheremaining19responseswerealsoinfavoroftherevision,butmadesomespecificsuggestions.'% {  AsummaryofthetransmittalmemorandumandthefivesectionsoftheCircularfollows.Eachsectionindicateswhichcommentswereacceptedandwhichwerenotaccepted.  TransmittalMemorandum. Thismemorandum,signedbytheOMBDirector%%!Director!%%,summarizesthe ~ purpose,authority%%#authority#%%,andpolicyreflectedintheCircular,theactionsrequired,andrelatedadministrativeinformation.Fouragenciesmadecommentsrelatingtothememorandum.  CommentsAccepted:Thestatementdescribingmanagementaccountabilityisnowrepeatedin  SectionIoftheCircular.Thedefinitionofmanagementcontrols(whichappearsinboththememorandumandSectionII)hasbeenamendedtostatethatcontrolsshouldensurereliable"andtimely"information.Therequirementthatagenciesreportannuallyonmanagementcontrolsisnowexplicitlystatedinthememorandum.Inaddition,OMBhasaddedinstructionsonaccessingtheCircularelectronically.  CommentNotAccepted:Oneagencysuggestedthatperformanceappraisalsbeusedtohold  managersaccountableformanagementcontrolresponsibilities.OMBsupportsthisconceptbutprefersthatthespecificcontentofappraisalsbelefttoeachagency.     SectionI.Introduction .Thissectiondescribesaframeworkforagencymanagementcontrol {r programsthatintegratesmanagementcontrolactivitieswithothermanagementrequirementsandpolicies,suchasthe GovernmentPerformanceandResultsAct%%]SGovernment Performance and Results Act]%%(GPRA),theChiefFinancialOfficers(CFOs) 3 *! Act%%WMChief Financial Officers (CFOs) ActW%%,theInspectorGeneral%%3)Inspector General3%%(IG%% IGe%%)Act, andothercongressionalandExecutiveBranchrequirements.The !" foundationofthispolicyisthatmanagementcontrolactivitiesarenotstandalonemanagementpractices,butratherarewovenintothedaytodayoperationalresponsibilitiesofagencymanagers.  AgenciesareencouragedtoplanforhowtherequirementsoftheCircularwillbeimplemented.Agenciesarealsoencouragedtoestablishseniorlevelmanagementcouncilstoaddressmanagementaccountabilityandrelatedissueswithinthebroadcontextofagencyoperations.  CommentsAccepted:Atthesuggestionofthreeagencies,thelanguageillustratinghowcontrols '#* canbeintegratedintotheoverallmanagementprocesshasbeenclarified.Thetextnowindicatesmoreclearlythattheexamplesusedtomakethispointareinfactexamples,notnewCircularrequirements.BecausetheActencompassesagencyoperations,aswellasprogramandadministrativeareas,appropriatelanguagehasbeenincludedintheCircular.Inaddition,theCircularstatesthat 24agenciesarecovered O+F'. bytheCFOsAct ,whichreflectsthelegislationlastyearthatmadetheSocialSecurityAdministrationan -,$(/ independentagencyfromtheDepartmentofHealthandHumanServices.  -)0 Ї& D   CommentsNotAccepted:TwoagenciesquestionedeliminationoftheManagementControlPlan.   TheimportanceofplanninghasnotbeendiminishedinthenewCircular,butOMBwillnolongerdictate  thescopeandcontentofanagency'splanningdocument.Anagencymaychoose,forexample,tomeet  theCircular'splanningrequirementbyaddressingmanagementcontrolsinabroaderstrategicplanforagencymanagement.'D    SectionII.EstablishingManagementControls .Thissectiondefinesmanagementcontrols,and '  requiresagencymanagerstodevelopandimplementappropriatemanagementcontrols.Includedinthissectionaregeneralandspecificmanagementcontrolstandards,drawninlargepartfromthestandardsissuedbytheGeneralAccountingOffice%%C9General Accounting Office:C%%(GAO).ByincludingthesestandardsintheCircular,OMBiscontinuingitseffortstointegratevariousmanagementcontrolpoliciesintoasingledocumenttomakeiteasierforFederalmanagerstoimplementgoodmanagementcontrols.  CommentsAccepted:Fouragenciesquestionedwhetherthedefinitionofinternalcontrols%%3)internal controls&3%%asa !  subsetofmanagementcontrolsshouldbelimitedtoconditions"thatcouldhaveamaterialeffecton[theentity's]financialstatements."Oneagencypointedoutthatdeficiencies%%)deficiencies)%%ininternalcontrols%%3)internal controls3%%relatedtoeventsthathavelessthanamajorimpactonfinancialstatements,likesecurityweaknessesorconflictofinterestproblems,couldbereportableundertheIntegrityAct.OMBagreesandhasdeletedtherestrictivephrase.  Inresponsetooneagency'scomment,languageondevelopingmanagementcontrolshasbeenexpandedtoemphasizethatcontrolsmustbedevelopedasprogramsareinitiallyimplemented,aswellasreengineered.Atanotheragency'ssuggestion,astatementhasbeenincludedonthevalueofdrawingontheexpertiseoftheCFO%% CFOn%%andIG%% IG%%ascontrolsaredeveloped.  Respondingtotwoagencies'commentsonthestandardsformanagementcontrols,thestandardoncompliancewithlawhasbeenexpandedtoincludedcompliancewithregulations,andthestandardondelegationofauthority%%#authority)#%%nowclearlystatesthatmanagersshouldensurethatauthority%%#authority)#%%,responsibilityandaccountabilityaredefinedanddelegated.  CommentsNotAccepted:TheAICPArecommendedthattheCircularadopttheframeworkand  definitionsofinternalcontrols%%3)internal controls3%%developedbytheCommitteeofSponsoringOrganizationsoftheTreadwayCommission(theCOSOframework).OMBhascarefullyreviewedtheCOSOapproachandfeelsconfidentthattheCircularincorporatesvirtuallyalloftheconceptsunderlyingtheCOSOframework.Itiscritical,however,fortheCirculartopresenttheseconceptsinlanguagethatismeaningfultoFederalprogrammanagersaswellasfinancialmanagers.Therefore,OMBhasdecidedtoretaintheCircular'sbroaderterminology.  OneagencyquestionedOMB'sauthority%%#authorityn#%%to(i)includemanagementcontrolstandardsintheCircularand(ii)modifythelanguageofGAO'sStandardsforInternalControl.OMBhasincludedGAOindiscussionsabouttheCircular'srevisionsincethebeginningoftheeffort,andhasprovidedGAOwiththeopportunitytocommentonnumerousdraftsofthedocument.GAOhasnotobjectedtoinclusionofthestandardsintheCircular,norhasGAOquestionedthedocument'sspecificlanguage.OMBbelievesthattheCircularaccuratelyincorporatestheGAOstandards,andappropriatelyupdatesthelanguagetoreflectdevelopmentsinthisareasinceGAOissueditsstandardsin1983.  Twoagenciesrecommendedmoreflexibilityinthestandardrelatingtoseparationofduties%%9/separation of duties9%%,arguingthattheprinciplemaybeoverlyrigidinaneraofdownsizing.Oneagencydescribedthedifficultyofapplyingthisstandardinsmallfieldoffices,andsuggestedthatalternativecontrolsbasedonadvancedtechnology,suchassystemsaccesscontrolsandautomatedaudit%%auditi%%trails,maybeappropriate.WhileOMB -)1 believesthatseparationofduties%%9/separation of duties9%%isakeymanagementcontrolstandard,itrecognizesthevalidityoftheseexamples.Thestandardhasnotbeenmodifiedbecauseappropriateflexibilityisalreadyprovided;thelanguagestatesthatkeyduties"should"beseparatedamongindividuals.  OneagencyquestionedwhethertheCircularadequatelyemphasizestheconceptofreasonableassurance.OMBrecognizestheimportanceofthisconcept,andbelievesthatitsinclusionasoneofthegeneralmanagementcontrolstandardsissufficient.   SectionIII.AssessingandImprovingManagementControls .Thissectionstatesthatagency   managersshouldcontinuouslymonitorandimprovetheeffectivenessofmanagementcontrols.Thiscontinuousmonitoring%%%monitoring%%%,andotherperiodicevaluations,shouldprovidethebasisfortheagencyhead'sannualassessmentofandreportonmanagementcontrols.AgenciesareencouragedtouseavarietyofinformationsourcestoarriveattheannualassurancestatementtothePresidentandtheCongress.Severalexamplesofsourcesofinformationareincludedinthissection.Theroleoftheagency'sseniormanagementcouncilinmakingrecommendationsontheannualassurancestatementandonwhichdeficiencies%%)deficiencies)%%inmanagementcontrolsshouldbeconsideredmaterialisalsoaddressed.  CommentsAccepted:OMBrecognizestheneedtoclarifyhowtheterm" materialweakness %%3)material weakness&3%%"as ~ usedintheCirculardiffersfromthesametermasusedbyFederalauditors.Thisissuewasraisedbyoneagencyinitswrittencomments,andbyotherpartiesindiscussionsofearlierdrafts. TheCircularnow ?6 recognizesthatFederalauditorsarerequiredtoidentifyandreportweaknessesthat,intheiropinion,poseariskorthreattotheinternalcontrolsystemsofanentity(suchasaprogramoroperation)evenifthemanagementofthatentitywouldnotreporttheweaknessoutsidetheagency.     CommentsNotAccepted:TwoagenciesfoundtheCircular'srequirementsonassessingand | documentingthesufficiencyofmanagementcontrolstobeinadequate,andsuggestedthattheCircularprovidemorespecificguidanceintheseareas.InkeepingwiththephilosophybehindtheCircular,OMBpreferstogiveagenciesthelatitudetoexpandupontheCircular'srequirementsintheseareas,iftheybelieveitisnecessary,ratherthantoimposeuniformcriteriafordetermining,forexample,whatshouldbereportedasamaterialweakness%%3)material weakness3%%.  Alongthoselines, OMBhaschosennottoadoptthedefinitionsusedbyFederalauditorsof  areportableconditionandmaterialweakness%%3)material weakness3%%,asadvocatedbyoneagencyandtheAICPA .Those x definitionsareweightedheavilytowardtechnical,financiallyorientedtermsthatareprobablynotmeaningfultoFederalprogrammanagers.Theyalsofocusonfinancialstatementsastheprimaryendproductofaninternalcontrolstructure.Whilefinancialstatementsareimportanttoolsfortheagencyheadinarrivingatanassurancestatementonmanagementcontrols,theyarenottheonlysourceofinformationformakingthisdetermination.Therefore,itisimportantthattheCircularuselanguagethataccuratelyreflectsthebroadnatureofagencymanagementcontrols.& B   TwoagenciesfeltthattheCircularshouldrequirethatagenciestesttheirmanagementcontrols.OMBagreesthattesting%%testingw%%isanimportantmethodfordeterminingwhethercontrolsactuallywork,andencouragesagenciestousesomeformoftesting%%testingw%%.Becausetesting%%testingw%%isalreadyimplicitinseveraloftheinformationsourcestobeusedtoassesscontrols,andislessfeasibleforotherinformationsources,itisnotincludedasablanketrequirement.'BU%B  )%, & B    Threeagenciescommentedonthecompositionofanagency'sseniormanagementcouncil;twofeltthattheCircularshouldbemorespecificindiscussingmembership,whileonefoundthissectiontooprescriptive.OMBbelievesthatthecurrentlanguageadequatelyaddressestheimportanceofincludingbothlineandstaffmanagementandinvolvingtheIG%% IG%%,withoutinfringingontheagency'sabilitytodeterminethecouncil'smembership.'B D& l    SectionIV.CorrectingManagementControlDeficiencies %%)Deficiencies&)%%.Thissectionstatesthatagency %  managementisresponsiblefortakingtimelyandeffectiveactiontocorrectmanagementcontroldeficiencies%%)deficiencies)%%.Correctingthesedeficiencies%%)deficiencies)%%isanintegralpartofmanagement'sresponsibilitiesandmustbeconsideredaprioritybytheagency.'l% F  TheonlycommentreceivedonthissectionreflectedamisunderstandingoftheCircular'srequirementsoncorrectiveactionplans.Plansmustbedeveloped,tracked,andreportedforallmaterialweaknesses(weaknessesincludedintheIntegrityActreport).Forweaknessesthatarenotincludedinthereport,plansshouldbedevelopedandtrackedataleveldeemedappropriatebytheagency.   SectionV.ReportingonManagementControls .Thissectiondescribestherequiredcomponents   oftheagency'sannualIntegrityActreportanditsdistribution%%)distribution)%%tothePresidentandtheCongress.ThissectionalsodescribesaninitiativetostreamlinereportingbyconsolidatingIntegrityActinformationwithotherperformancerelatedreportingintoabroader"AccountabilityReport"tobeissuedannuallybytheagencyhead.Lastly,thissectionpresentsIntegrityActrequirementsastheypertaintogovernmentcorporationspursuanttotheCFOsAct.  CommentsAccepted:Atthesuggestionoftwocommenters,agenciesarenowencouragedtomake  theirIntegrityActreports%%reports%%availableelectronically.ThereferencetoaHousecommitteehasbeenchanged z toreflectthenomenclatureofthe104thCongress.  Thissectionalsodescribesannewapproachtowardsfinancialmanagementreportingthatcouldhelpintegratemanagementinitiatives.ThisapproachisbeingpilottestedbyseveralagenciesforFY1995.FurtherinformationontheimplicationsofthisinitiativeforotheragencieswillbeissuedbyOMBafterthepilotreports%%reports%%havebeenevaluated.  CommentsNotAccepted:Oneagencyquestionedthewisdomofpermittingagenciestoprovide SJ  aqualifiedstatementofassurance.OMBexpectsagenciestoprovidethemostdirectpossiblestatementofassurance.Theoptionofaqualifiedstatementrecognizesthatinsomecases,themostaccuratestatementofassuranceisonethatisqualifiedbyexceptionsthatareexplicitlynoted.  ThesameagencysuggestednewlanguageinthereportingsectiontorecognizethattheCircularbroadensthescopeofinternalcontrolaccountabilitybeyondtherequirementsoftheIntegrityAct.OMBdisagreeswiththepremisethatthelinkbetweenmanagementcontrolsandprogramperformanceisanewone.WhiletheIntegrityActusesfinanciallyorientedterminology,theAct"clearlyencompassesprogramandadministrativeareas,aswellasthemoretraditionalaccountingandfinancialmanagementareas"(HouseReport98937,"FirstYearImplementationoftheFederalManagers'FinancialIntegrityAct%%cYFederal Managers' Financial Integrity Actc%%,"CommitteeonGovernmentOperations,August2,1984,p.1).  )%, &     GeneralIssues. SomecommentswerenotlimitedtospecificsectionsoftheCircular.     CommentsAccepted:Inresponsetooneagency'ssuggestion,theacronym"FMFIA%%FMFIA%%"hasbeen  replacedthroughouttheCircularbytheterm"IntegrityAct"tobetteremphasizethepurposeandscopeofthelaw.OMBhasalsomodifiedtheterm"should"inseveralinstanceswherespecificagencyaction wn isrequired.' 2U  CommentsNotAccepted:TwoagenciesproposedthattheCircularbroadenthelinkagebetween   managementcontrolsandothermanagementinitiatives,particularlyperformancemeasurementandimplementationofGPRA.OMBencouragesagenciestointegratetheireffortstoevaluatemanagementcontrolsandprogramperformance,butisnotpreparedatthistimetoincludepolicyguidanceonperformancemeasurementinthisCircular.  OneagencyproposedinclusionoflanguagedescribingtheapplicabilityoftheCirculartodiscretionarypolicymatters,ashadbeendoneinthe1986version.OMBdoesnotbelievethatthislanguageisnecessarybecauseitisclear%%clear%%thatthePresidentandagencyheadhavefulldiscretionoverpolicymakingfunctions,includingdeterminingandinterpretingpolicy,determiningprogramneed,makingresourceallocationdecisions,andpursuingrulemaking.  TwoagenciessuggestedthattheCircularspecificallyaddressOMB'sHighRiskProgram.OMBhaschosennottodosobecauseimplementationofthemanagementcontrolprogramoutlinedintheCircularwilllikelyeliminatetheneedforseparatetrackingofhighriskareas.Ifagenciesreporttheirmostseriousmanagementdeficiencies%%)deficiencies)%%tothePresidentandtheCongressasenvisionedbytheCircular,theIntegrityActreports%%reportsi%%willessentiallyreflectthehighestriskareasingovernment,andaseparateHighRiskProgrammaynolongerbenecessary.(Signed)JohnB.Arthur,AssociateDirector%%!Directore!%%forAdministration       CircularNo.A123%%A123%%,Revised ^   June21,1995   ^TOTHEHEADSOFEXECUTIVEDEPARTMENTSANDESTABLISHMENTSFROM:0 ` AliceM.RivlinKB` (#` (# 0  0` (#(#Director%%!Director!%% ` (#` (# SUBJECT: ` ManagementAccountabilityandControl    1.  PurposeandAuthority%%#Authority:#%%.AsFederalemployeesdevelopandimplementstrategiesforreengineering    agencyprogramsandoperations,theyshoulddesignmanagementstructuresthathelpensureaccountabilityforresults,andincludeappropriate,costeffectivecontrols.ThisCircularprovidesguidancetoFederalmanagersonimprovingtheaccountabilityandeffectivenessofFederalprogramsandoperationsbyestablishing,assessing,correcting,andreportingonmanagementcontrols.  TheCircularisissuedundertheauthority%%#authority#%%ofthe FederalManagers'FinancialIntegrityAct%%cYFederal Managers' Financial Integrity Actc%%of   1982ascodifiedin31U.S.C.3512 %%-#31 U.S.C. 3512-%%.    TheCircularreplacesCircularNo.A123%%A123%%,"InternalControlSystems,"revised,datedAugust C: 4,1986,andOMB's1982"InternalControls%%3)Internal Controls3%%Guidelines"andassociated"QuestionsandAnswers"document,whichareherebyrescinded.   2.  Policy.Managementaccountabilityistheexpectationthatmanagersareresponsibleforthequality  andtimelinessofprogramperformance,increasingproductivity,controllingcostsandmitigatingadverseaspectsofagencyoperations,andassuringthatprogramsaremanagedwithintegrityandincompliancewithapplicablelaw.  Managementcontrolsaretheorganization,policies,andproceduresusedtoreasonablyensurethat(i)programsachievetheirintendedresults;(ii)resourcesareusedconsistentwithagencymission;(iii)programsandresourcesareprotectedfromwaste,fraud,andmismanagement;(iv)lawsandregulationsarefollowed;and(v)reliableandtimelyinformationisobtained,maintained,reportedandusedfordecisionmaking.3.  ActionsRequired.AgenciesandindividualFederalmanagersmusttakesystematicandproactive  !" measuresto(i)developandimplementappropriate,costeffectivemanagementcontrolsforresultsorientedmanagement;(ii)assesstheadequacyofmanagementcontrolsinFederalprogramsandoperations;(iii)identifyneededimprovements;(iv)takecorrespondingcorrectiveaction;and(v)reportannuallyonmanagementcontrols.4.0   EffectiveDate.ThisCirculariseffectiveuponissuance.%&"((#(#  5.  Inquiries.FurtherinformationconcerningthisCircularmaybeobtainedfromtheManagement '#* IntegrityBranch,OfficeofFederalFinancialManagement,OfficeofManagementandBudget%%OEOffice of Management and Budget O%%,Washington,DC20503,202/3956911.6.  Copies.CopiesofthisCircularmaybeobtainedbytelephoningtheExecutiveOfficeofthe E+<'. President,PublicationServices,at202/3957332.  ,(0 &   7.  ElectronicAccess.ThisdocumentisalsoaccessibleontheU.S.DepartmentofCommerce's    FedWorld NetworkundertheOMBLibraryofFiles.  0  TheTelnetaddressforFedWorldviaInternet%%!Internet!!Internet!%%is"fedworld.gov".(#(# 0  TheWorldWideWeb%%-#World Wide Web:-%%addressis"http://www.fedworld.gov/ftp.htm#omb".(#(# 0  Forfiletransferprotocol(FTP)access,theaddressis ul "ftp://fwux.fedworld.gov/pub/omb/omb.htm". (#(# ThetelephonenumberfortheFedWorldhelpdeskis703/487-4608.' mAttachment     A(#Attachment@" I.INTRODUCTION   TheproperstewardshipofFederalresourcesisafundamentalresponsibilityofagencymanagersandstaff.Federalemployeesmustensurethatgovernmentresourcesareusedefficientlyandeffectivelytoachieveintendedprogramresults.Resourcesmustbeusedconsistentwithagencymission,incompliancewithlawandregulation,andwithminimalpotentialforwaste,fraud,andmismanagement.Tosupportresultsorientedmanagement,the GovernmentPerformanceandResultsAct %%]SGovernment Performance and Results Act]%%(GPRA,P.L.    10362)requiresagenciestodevelopstrategicplans,setperformancegoals,andreportannuallyonactualperformancecomparedtogoals.AstheFederalgovernmentimplementsthislegislation,theseplansandgoalsshouldbeintegratedinto(i)thebudgetprocess,(ii)theoperationalmanagementofagenciesandprograms,and(iii)accountabilityreportingtothepubliconperformanceresults,andontheintegrity,efficiency,andeffectivenesswithwhichtheyareachieved.Managementaccountabilityistheexpectationthatmanagersareresponsibleforthequalityandtimelinessofprogramperformance,increasingproductivity,controllingcostsandmitigatingadverseaspectsofagencyoperations,andassuringthatprogramsaremanagedwithintegrityandincompliancewithapplicablelaw.Managementcontrolsorganization,policies,andproceduresaretoolstohelpprogramandfinancialmanagersachieveresultsandsafeguardtheintegrityoftheirprograms.ThisCircularprovidesguidanceonusingtherangeoftoolsatthedisposalofagencymanagerstoachievedesiredprogramresultsandmeettherequirementsoftheFederalManagers'FinancialIntegrityAct%%cYFederal Managers' Financial Integrity Actc%%(FMFIA%%FMFIA %%,referredtoastheIntegrityActthroughoutthisdocument).Framework.Theimportanceofmanagementcontrolsisaddressed,bothexplicitlyandimplicitly,inmany   statutesandexecutivedocuments. TheFederalManagers'FinancialIntegrityAct%%cYFederal Managers' Financial Integrity Actc%% (P.L.97255)  establishesspecificrequirementswithregardtomanagementcontrols.Theagencyheadmustestablishcontrolsthatreasonablyensurethat:(i)obligationsandcostscomplywithapplicablelaw;(ii)assetsaresafeguardedagainstwaste,loss,unauthorizeduseormisappropriation;and(iii)revenuesandexpendituresareproperlyrecordedandaccountedfor.31U.S.C.3512%%-#31 U.S.C. 3512-%%(c)(1).Inaddition,theagencyheadannuallymustevaluateandreportonthecontrolandfinancialsystemsthatprotecttheintegrityofFederalprograms.31U.S.C.3512%%-#31 U.S.C. 3512-%%(d)(2).TheActencompassesprogram,operational,andadministrativeareasaswellasaccountingandfinancialmanagement.Insteadofconsideringcontrolsasanisolatedmanagementtool,agenciesshouldintegratetheireffortstomeettherequirementsoftheIntegrityActwithothereffortstoimproveeffectivenessandaccountability.Thus,managementcontrolsshouldbeanintegralpartoftheentirecycleofplanning,budgeting,management,accounting,andauditing.Theyshouldsupporttheeffectivenessandtheintegrityofeverystepoftheprocessandprovidecontinualfeedbacktomanagement.Forinstance,goodmanagementcontrolscanassurethatperformancemeasuresarecompleteandaccurate.Asanotherexample,themanagementcontrolstandardoforganizationwouldalignstaffandauthority%%#authority5#%%withtheprogramresponsibilitiestobecarriedout,improvingbotheffectivenessandaccountability.Similarly,accountabilityforresourcescouldbeimprovedbymorecloselyaligningbudgetaccountswithprogramsandchargingthemwithallsignificantresourcesusedtoproducetheprogram'soutputsandoutcomes.  ,(0 &   Meetingtherequirementsofthe ChiefFinancialOfficersAct (P.L.101576,asamended)shouldhelp   agenciesbothestablishandevaluatemanagementcontrols.TheActrequiresthepreparationandaudit%%audit%%offinancialstatementsfor24Federalagencies.31U.S.C.901(b),3515.Inthisprocess,auditorsreportoninternalcontrols%%3)internal controls&3%%andcompliancewithlawsandregulations.Therefore,theagenciescoveredbytheActhaveaclear%%clearl%%opportunitybothtoimprovecontrolsovertheirfinancialactivities,andtoevaluatethecontrolsthatareinplace.' PThe InspectorGeneral%%3)Inspector General3%%Act (P.L.95452,asamended)providesforindependentreviewsofagency   programsandoperations.OfficesofInspectorsGeneral(OIGs)andotherexternalaudit%%audit%%organizationsfrequentlycitespecificdeficiencies%%)deficiencies)%%inmanagementcontrolsandrecommendopportunitiesforimprovements.Agencymanagers,whoarerequiredbytheActtofollowuponaudit%%audit%%recommendations,shouldusethesereviewstoidentifyandcorrectproblemsresultingfrominadequate,excessive,orpoorlydesignedcontrols,andtobuildappropriatecontrolsintonewprograms.Federalmanagersmustcarefullyconsidertheappropriatebalanceofcontrolsintheirprogramsandoperations.Fulfillingrequirementstoeliminateregulations( "EliminationofOneHalfofExecutive   BranchInternalRegulations ,"ExecutiveOrder%%/%Executive Order/%%12861)shouldreinforcetoagencymanagersthattoo   manycontrolscanresultininefficientandineffectivegovernment,andthereforethattheymustensureanappropriatebalancebetweentoomanycontrolsandtoofewcontrols.Managersshouldbenefitfromcontrols,notbeencumberedbythem.AgencyImplementation.Appropriatemanagementcontrolsshouldbeintegratedintoeachsystem ! establishedbyagencymanagementtodirectandguideitsoperations.Aseparatemanagementcontrolprocessneednotbeinstituted,particularlyifitssolepurposeistosatisfytheIntegrityAct'sreportingrequirements.AgenciesneedtoplanforhowtherequirementsofthisCircularwillbeimplemented.DevelopingawrittenstrategyforinternalagencyusemayhelpensurethatappropriateactionistakenthroughouttheyeartomeettheobjectivesoftheIntegrityAct.Theabsenceofsuchastrategymayitselfbeaseriousmanagementcontroldeficiency.Identifyingandimplementingthespecificproceduresnecessarytoensuregoodmanagementcontrols,anddetermininghowtoevaluatetheeffectivenessofthosecontrols,islefttothediscretionoftheagencyhead.However,agenciesshouldimplementandevaluatecontrolswithoutcreatingunnecessaryprocesses,consistentwithrecommendationsmadebytheNationalPerformanceReview.ThePresident'sManagementCouncil,composedofthemajoragencies'chiefoperatingofficers,hasbeenestablishedtofostergovernmentwidemanagementchanges("ImplementingManagementReformintheExecutiveBranch,"October1,1993).Manyagenciesareestablishingtheirownseniormanagementcouncil,oftenchairedbytheagency'schiefoperatingofficer,toaddressmanagementaccountabilityandrelatedissueswithinthebroadercontextofagencyoperations.Relevantissuesforsuchacouncilincludeensuringtheagency'scommitmenttoanappropriatesystemofmanagementcontrols;recommendingtotheagencyheadwhichcontroldeficiencies%%)deficiencies)%%aresufficientlyserioustoreportintheannualIntegrityActreport;andprovidinginputforthelevelandpriorityofresourceneedstocorrectthesedeficiencies%%)deficiencies)%%.(SeealsoSectionIIIofthisCircular.)@  II.ESTABLISHINGMANAGEMENTCONTROLS k*b&-  DefinitionofManagementControls.Managementcontrolsaretheorganization,policies,andprocedures ,(/ usedbyagenciestoreasonablyensurethat(i)programsachievetheirintendedresults;(ii)resourcesareusedconsistentwithagencymission;(iii)programsandresourcesareprotectedfromwaste,fraud,and -)1 mismanagement;(iv)lawsandregulationsarefollowed;and(v)reliableandtimelyinformationisobtained,maintained,reportedandusedfordecisionmaking.Managementcontrols,inthebroadestsense,includetheplanoforganization,methodsandproceduresadoptedbymanagementtoensurethatitsgoalsaremet.Managementcontrolsincludeprocessesforplanning,organizing,directing,andcontrollingprogramoperations.Asubsetofmanagementcontrolsaretheinternalcontrols%%3)internal controls3%%usedtoassurethatthereispreventionortimelydetectionofunauthorizedacquisition%%'acquisitionr'%%,use,ordispositionoftheentity'sassets.DevelopingManagementControls.AsFederalemployeesdevelopandexecutestrategiesforimplementing    orreengineeringagencyprogramsandoperations,theyshoulddesignmanagementstructuresthathelpensureaccountabilityforresults.Aspartofthisprocess,agenciesandindividualFederalmanagersmusttakesystematicandproactivemeasurestodevelopandimplementappropriate,costeffectivemanagementcontrols.TheexpertiseoftheagencyCFO%% CFOs%%andIG%% IG%%canbevaluableindevelopingappropriatecontrols.Managementcontrolsguaranteeneitherthesuccessofagencyprograms,northeabsenceofwaste,fraud,andmismanagement,buttheyareameansofmanagingtheriskassociatedwithFederalprogramsandoperations.Tohelpensurethatcontrolsareappropriateandcosteffective,agenciesshouldconsidertheextentandcostofcontrolsrelativetotheimportanceandriskassociatedwithagivenprogram.Standards.Agencymanagersshallincorporatebasicmanagementcontrolsinthestrategies,plans,  guidanceandproceduresthatgoverntheirprogramsandoperations.Controlsshallbeconsistentwiththefollowingstandards,whicharedrawninlargepartfromthe"StandardsforInternalControlintheFederalGovernment,"issuedbytheGeneralAccountingOffice%%C9General Accounting OfficeC%%(GAO).Generalmanagementcontrolstandardsare:0  ComplianceWithLaw .Allprogramoperations,obligationsandcostsmustcomplywith -$ applicablelawandregulation.Resourcesshouldbeefficientlyandeffectivelyallocatedfordulyauthorizedpurposes. (#(# 0  ReasonableAssuranceandSafeguards .Managementcontrolsmustprovidereasonableassurance  thatassetsaresafeguardedagainstwaste,loss,unauthorizeduse,andmisappropriation.Managementcontrolsdevelopedforagencyprogramsshouldbelogical,applicable,reasonablycomplete,andeffectiveandefficientinaccomplishingmanagementobjectives. (#(# 0  Integrity,Competence,andAttitude .Managersandemployeesmusthavepersonalintegrityand !# areobligatedtosupporttheethicsprogramsintheiragencies.ThespiritoftheStandardsofEthicalConductrequiresthattheydevelopandimplementeffectivemanagementcontrolsandmaintainalevelofcompetencethatallowsthemtoaccomplishtheirassignedduties.Effectivecommunicationwithinandbetweenofficesshouldbeencouraged. (#(# &  Specificmanagementcontrolstandardsare:0  DelegationofAuthority%%#Authority:#%%andOrganization .Managersshouldensurethatappropriateauthority%%#authority#%%, ($+ responsibilityandaccountabilityaredefinedanddelegatedtoaccomplishthemissionoftheorganization,andthatanappropriateorganizationalstructureisestablishedtoeffectivelycarryoutprogramresponsibilities.Totheextentpossible,controlsandrelateddecisionmakingauthority%%#authority#%%shouldbeinthehandsoflinemanagersandstaff. (#(#  '& ,(0 0  SeparationofDuties%%9/Separation of Duties-9%%andSupervision .Keydutiesandresponsibilitiesinauthorizing,processing,    recording,andreviewingofficialagencytransactionsshouldbeseparatedamongindividuals.Managersshouldexerciseappropriateoversight%%#oversight#%%toensureindividualsdonotexceedorabusetheirassignedauthorities. (#(# 0  AccesstoandAccountabilityforResources .Accesstoresourcesandrecordsshouldbelimited OF toauthorizedindividuals,andaccountabilityforthecustodyanduseofresourcesshouldbeassignedandmaintained. (#(# 0  RecordingandDocumentation .Transactionsshouldbepromptlyrecorded,properlyclassified%%%classified%%%    andaccountedforinordertopreparetimelyaccountsandreliablefinancialandotherreports%%reportsd%%.Thedocumentationfortransactions,managementcontrols,andothersignificanteventsmustbeclear%%clear%%andreadilyavailableforexamination. (#(# 0  ResolutionofAudit%%Audit%%FindingsandOtherDeficiencies %%)Deficiencies&)%%.Managersshouldpromptlyevaluateand   determineproperactionsinresponsetoknowndeficiencies%%)deficiencies)%%,reportedaudit%%auditn%%andotherfindings,andrelatedrecommendations.Managersshouldcomplete,withinestablishedtimeframes,allactionsthatcorrectorotherwiseresolvetheappropriatemattersbroughttomanagement'sattention. (#(# Otherpolicydocumentsmaydescribeadditionalspecificstandardsforparticularfunctionalorprogramactivities.Forexample,OMBCircularNo.A127%%A127n%%,"FinancialManagementSystems,"describesgovernmentwiderequirementsforfinancialsystems.TheFederalAcquisition%%'Acquisition'%%Regulationsdefinerequirementsforagencyprocurementactivities.@   III.ASSESSINGANDIMPROVINGMANAGEMENTCONTROLS   Agencymanagersshouldcontinuouslymonitorandimprovetheeffectivenessofmanagementcontrolsassociatedwiththeirprograms.Thiscontinuousmonitoring%%%monitoring1%%%,andotherperiodicevaluations,shouldprovidethebasisfortheagencyhead'sannualassessmentofandreportonmanagementcontrols,asrequiredbytheIntegrityAct.Agencymanagementshoulddeterminetheappropriatelevelofdocumentationneededtosupportthisassessment.SourcesofInformation.Theagencyhead'sassessmentofmanagementcontrolscanbeperformedusing YP  avarietyofinformationsources.Managementhasprimaryresponsibilityformonitoring%%%monitoring%%%andassessingcontrols,andshoulduseothersourcesasasupplementtonotareplacementforitsownjudgment.Sourcesofinformationinclude:0  Managementknowledgegainedfromthedailyoperationofagencyprogramsandsystems.#%(#(# 0  Managementreviewsconducted(i)expresslyforthepurposeofassessingmanagementcontrols, O%F!' or(ii)forotherpurposeswithanassessmentofmanagementcontrolsasabyproductofthereview. (#(# 0  IG%% IGt%%andGAOreports%%reportsg%%,includingaudits,inspections,reviews,investigations,outcomeofhotline ($+ complaints,orotherproducts. (#(# 0  Programevaluations.E+<'.(#(# 0  AuditsoffinancialstatementsconductedpursuanttotheChiefFinancialOfficersAct,asamended, ,(0 including:informationrevealedinpreparingthefinancialstatements;theauditor'sreports%%reportsg%%onthe -)1 financialstatements,internalcontrols%%3)internal controls73%%,andcompliancewithlawsandregulations;andanyothermaterialspreparedrelatingtothestatements. (#(# 0  ReviewsoffinancialsystemswhichconsiderwhethertherequirementsofOMBCircularNo.A  127arebeingmet. (#(# 0  ReviewsofsystemsandapplicationsconductedpursuanttotheComputerSecurityAct%%;1Computer Security Act;%%of1987(40 %  U.S.C.759note)andOMBCircularNo.A130%%A130r%%,"ManagementofFederalInformationResources." (#(# 0  Annualperformanceplansandreports%%reportsS%%pursuanttotheGovernmentPerformanceandResultsAct%%]SGovernment Performance and Results Act]%%.  (#(# 0  Reports%%Reportst%%andotherinformationprovidedbytheCongressionalcommitteesofjurisdiction.A8 (#(# 0  Otherreviewsorreports%%reportst%%relatingtoagencyoperations,e.g.fortheDepartmentofHealthand   HumanServices,qualitycontrolreviewsoftheMedicaidandAidtoFamilieswithDependentChildrenprograms. (#(# Useofasourceofinformationshouldtakeintoconsiderationwhethertheprocessincludedanevaluationofmanagementcontrols.Agencymanagementshouldavoidduplicatingreviewswhichassessmanagementcontrols,andshouldcoordinatetheireffortswithotherevaluationstotheextentpracticable.IfaFederalmanagerdeterminesthatthereisinsufficientinformationavailableuponwhichtobaseanassessmentofmanagementcontrols,thenappropriatereviewsshouldbeconductedwhichwillprovidesuchabasis.IdentificationofDeficiencies%%)Deficiencies)%%.Agencymanagersandemployeesshouldidentifydeficiencies%%)deficiencies)%%inmanagement -$ controlsfromthesourcesofinformationdescribedabove.Adeficiencyshouldbereportedifitisorshouldbeofinteresttothenextlevelofmanagement.Agencyemployeesandmanagersgenerallyreportdeficiencies%%)deficiencies)%%tothenextsupervisorylevel,whichallowsthechainofcommandstructuretodeterminetherelativeimportanceofeachdeficiency.&  Adeficiencythattheagencyheaddeterminestobesignificantenoughtobereportedoutsidetheagency(i.e.includedintheannualIntegrityActreporttothePresidentandtheCongress)shallbeconsidereda"materialweakness%%3)material weaknessP3%%."%%%;% /  2      ׀Thisdesignationrequiresajudgmentbyagencymanagersastotherelativeriskand  " significanceofdeficiencies%%)deficiencies1)%%.Agenciesmaywishtouseadifferenttermtodescribelesssignificantdeficiencies%%)deficiencies1)%%,whicharereportedonlyinternallyinanagency.Inidentifyingandassessingtherelativeimportanceofdeficiencies%%)deficiencies1)%%,particularattentionshouldbepaidtotheviewsoftheagency'sIG%% IGc%%.' IAgenciesshouldcarefullyconsiderwhethersystemicproblemsexistthatadverselyaffectmanagementcontrolsacrossorganizationalorprogramlines.TheChiefFinancialOfficer,theSeniorProcurementExecutive,theSeniorIRM%% IRMi%%Official,andthemanagersofotherfunctionalofficesshouldbeinvolvedin &") identifyingandensuringcorrectionofsystemicdeficiencies%%)deficiencies1)%%relatingtotheirrespectivefunctions.Agencymanagersandstaffshouldbeencouragedtoidentifyandreportdeficiencies%%)deficiencies1)%%,asthisreflectspositivelyontheagency'scommitmenttorecognizingandaddressingmanagementproblems.Failingtoreportaknowndeficiencywouldreflectadverselyontheagency.RoleofASeniorManagementCouncil.Manyagencieshavefoundthataseniormanagementcouncilis %  ausefulforumforassessingandmonitoring%%%monitoring%%%deficiencies%%)deficiencies)%%inmanagementcontrols.Themembershipofsuchcouncilsgenerallyincludesbothlineandstaffmanagement;considerationshouldbegiventoinvolvingtheIG%% IGc%%.Suchcouncilsgenerallyrecommendtotheagencyheadwhichdeficiencies%%)deficiencies)%%aredeemedtobematerialtotheagencyasawhole,andshouldthereforebeincludedintheannualIntegrityActreporttothePresidentandtheCongress.(Suchacouncilneednotbeexclusivelydevotedtomanagementcontrolissues.)Thisprocesswillhelpidentifydeficiencies%%)deficiencies)%%thatalthoughminorindividually,mayconstituteamaterialweakness%%3)material weaknessj3%%intheaggregate.Suchacouncilmayalsobeusefulindeterminingwhensufficientactionhasbeentakentodeclarethatadeficiencyhasbeencorrected.@Z Z  IV.CORRECTINGMANAGEMENTCONTROLDEFICIENCIES %%)DEFICIENCIES&)%%   Agencymanagersareresponsiblefortakingtimelyandeffectiveactiontocorrectdeficiencies%%)deficiencies)%%identified ]T bythevarietyofsourcesdiscussedinSectionIII.Correctingdeficiencies%%)deficiencies)%%isanintegralpartofmanagementaccountabilityandmustbeconsideredaprioritybytheagency.Theextenttowhichcorrectiveactionsaretrackedbytheagencyshouldbecommensuratewiththeseverityofthedeficiency.Correctiveactionplansshouldbedevelopedforallmaterialweaknesses,andprogressagainstplansshouldbeperiodicallyassessedandreportedtoagencymanagement.Managementshouldtrackprogresstoensuretimelyandeffectiveresults.Fordeficiencies%%)deficiencies)%%thatarenotincludedintheIntegrityActreport,correctiveactionplansshouldbedevelopedandtrackedinternallyattheappropriatelevel.& B Adeterminationthatadeficiencyhasbeencorrectedshouldbemadeonlywhensufficientcorrectiveactionshavebeentakenandthedesiredresultsachieved.Thisdeterminationshouldbeinwriting,andalongwithotherappropriatedocumentation,shouldbeavailableforreviewbyappropriateofficials.(SeealsoroleofseniormanagementcouncilinSectionIII.)'B/AsmanagersconsiderIG%% IG%%andGAOaudit%%audit%%reports%%reports%%inidentifyingandcorrectingmanagementcontroldeficiencies%%)deficiencies%)%%,theymustbemindfulofthestatutoryrequirementsforaudit%%auditn%%%followup%%followup%includedintheIG%% IGt%%Act,asamended.Underthislaw,managementhasaresponsibilitytocompleteaction,inatimelymanner,onaudit%%auditn%%recommendationsonwhichagreementwiththeIG%% IGt%%hasbeenreached.5U.S.C.Appendix3.(ManagementmustmakeadecisionregardingIG%% IGt%%audit%%auditn%%recommendationswithinasixmonthperiodandimplementationofmanagement'sdecisionshouldbecompletedwithinoneyeartotheextentpracticable.)AgencymanagersandtheIG%% IGt%%shareresponsibilityforensuringthatIG%% IGt%%Actrequirementsaremet.@  V.REPORTINGONMANAGEMENTCONTROLS  &") ReportingPursuanttoSection2.31U.S.C.3512%%-#31 U.S.C. 3512-%%(d)(2)(commonlyreferredtoasSection2oftheIntegrity ($+ Act)requiresthatannuallybyDecember31,theheadofeachexecutiveagencysubmittothePresidentandtheCongress(i)astatementonwhetherthereisreasonableassurancethattheagency'scontrolsareachievingtheirintendedobjectives;and(ii)areportonmaterialweaknessesintheagency'scontrols.OMBmayprovideguidanceonthecompositionoftheannualreport.%%&  %%0  StatementofAssurance.Thestatementonreasonableassurancerepresentstheagencyhead's -)1 informedjudgmentastotheoveralladequacyandeffectivenessofmanagementcontrolswithintheagency.Thestatementmusttakeoneofthefollowingforms:statementofassurance;qualifiedstatementofassurance,consideringtheexceptionsexplicitlynoted;orstatementofnoassurance. (#(# 0  Indecidingonthetypeofassurancetoprovide,theagencyheadshouldconsiderinformationfromthesourcesdescribedinSectionIIIofthisCircular,withinputfromseniorprogramandadministrativeofficialsandtheIG%% IG.%%.Theagencyheadmustdescribetheanalyticalbasisforthetypeofassurancebeingprovided,andtheextenttowhichagencyactivitieswereassessed.Thestatementofassurancemustbesignedbytheagencyhead. (#(# %%' 9%%0  ReportonMaterialWeaknesses.TheIntegrityActreportmustincludeagencyplanstocorrectthe    materialweaknessesandprogressagainstthoseplans. (#(# ReportingPursuanttoSection4.31U.S.C.3512%%-#31 U.S.C. 3512:-%%(d)(2)(B)(commonlyreferredtoasSection4ofthe A8  IntegrityAct)requiresanannualstatementonwhethertheagency'sfinancialmanagementsystemsconformwithgovernmentwiderequirements.These financialsystemsrequirementsarepresentedinOMB   CircularNo.A127%%A127%%,"FinancialManagementSystems,"section7 .Iftheagencydoesnotconformwith   financialsystemsrequirements,thestatementmustdiscusstheagency'splansforbringingitssystemsintocompliance.Iftheagencyheadjudgesadeficiencyinfinancialmanagementsystemsand/oroperationstobematerialwhenweighedagainstotheragencydeficiencies%%)deficiencies,)%%,theissuemustbeincludedintheannualIntegrityActreportinthesamemannerasothermaterialweaknesses.&  Distribution%%)Distribution,)%%ofIntegrityActReport.TheassurancestatementsandinformationrelatedtobothSections  2and4shouldbeprovidedinasingleIntegrityActreport.CopiesofthereportaretobetransmittedtothePresident;thePresidentoftheSenate;theSpeakeroftheHouseofRepresentatives;theDirector%%!Director!%%ofOMB;andtheChairpersonsandRankingMembersoftheSenateCommitteeonGovernmentalAffairs,theHouseCommitteeonGovernmentReformandOversight%%#Oversight)#%%,andtherelevantauthorizingandappropriationscommitteesandsubcommittees.Inaddition,10copiesofthereportaretobeprovidedtoOMB'sOfficeofFederalFinancialManagement,ManagementIntegrityBranch.Agenciesarealsoencouragedtomaketheirreports%%reports%%availableelectronically.'7&  StreamlinedReporting.TheGovernmentManagementReformAct(GMRA)of1994(P.L.103356) QH  permitsOMBforfiscalyears1995through1997toconsolidateoradjustthefrequencyandduedatesofcertainstatutoryfinancialmanagementreports%%reports%%afterconsultationwiththeCongress.GMRApromptedtheCFO%% CFOt%%CounciltorecommendtoOMBanewapproachtowardsfinancialmanagementreportingwhichcouldhelpintegratemanagementinitiatives.ThisproposalisbeingpilottestedbyseveralagenciesforFY1995.FurtherinformationontheimplicationsofthisinitiativeforotheragencieswillbeissuedbyOMBafterthepilotreports%%reports%%havebeenevaluated.Inthemeantime,thereportingrequirementsoutlinedinthisCircularremainvalidexceptforthoseagenciesidentifiedaspilotsbyOMB.'QEUndertheCFO%% CFOt%%Councilapproach,agencieswouldconsolidateIntegrityActinformationwithotherperformancerelatedreportingintoabroader"AccountabilityReport"tobeissuedannuallybytheagencyhead.Thisreportwouldbeissuedassoonaspossibleaftertheendofthefiscalyear,butnolaterthanMarch31foragenciesproducingauditedfinancialstatementsandDecember31forallotheragencies.Theproposed"AccountabilityReport"wouldintegratethefollowinginformation:theIntegrityActreport,management'sReportonFinalActionasrequiredbytheIG%% IG%%Act,theCFOsActAnnualReport(includingauditedfinancialstatements),CivilMonetaryPenaltyandPromptPaymentActreports%%reports%%,andavailableinformationonagencyperformancecomparedtoitsstatedgoalsandobjectives,inpreparationforimplementationoftheGPRA. -)1 ЇGovernmentCorporations.Section306ofthe ChiefFinancialOfficersAct establishedareporting   requirementrelatedtomanagementcontrolsforcorporationscoveredbythe GovernmentCorporation  andControlAct%%]SGovernment Corporation and Control Act]%%.31U.S.C.9106%%-#31 U.S.C. 9106-%%. Thesecorporationsmustsubmitanannualmanagementreporttothe  Congressnotlaterthan180daysaftertheendofthecorporation'sfiscalyear.Thisreportmustinclude,amongotheritems,astatementoncontrolsystemsbytheheadofthemanagementofthecorporationconsistentwiththerequirementsoftheIntegrityAct.& h ThecorporationisrequiredtoprovidethePresident,theDirector%%!Director!%%ofOMB,andtheComptrollerGeneralacopyofthemanagementreportwhenitissubmittedtoCongress.'h : @9 9   OMBCircularNo.A130%%A130%%,AppendixIII,Revised N  s j  @n n  EXECUTIVEOFFICEOFTHEPRESIDENT  '  @ OFFICEOFMANAGEMENTANDBUDGET%%OEOFFICE OF MANAGEMENT AND BUDGETO%%@llWASHINGTON,D.C.20503   @\\"February8,1996/(#CIRCULARNO.A130%%A130%%,Revised&&-(#(TransmittalMemorandumNo.3)MEMORANDUMFORHEADSOFEXECUTIVEDEPARTMENTSANDESTABLISHMENTSSUBJECT:ManagementofFederalInformationResources  CircularNo.A130%%A130%%providesuniformgovernment-wideinformationresourcesmanagementpoliciesasrequiredbythePaperworkReductionAct%%?5Paperwork Reduction Act ?%%of1980,asamendedbythePaperworkReductionAct%%?5Paperwork Reduction Act ?%%of1995,44U.S.C.Chapter35.ThisTransmittalMemorandumcontainsupdatedguidanceonthe"SecurityofFederalAutomatedInformationSystems,"AppendixIIIandmakesminortechnicalrevisionstotheCirculartoreflectthePaperworkReductionAct%%?5Paperwork Reduction Act ?%%of1995(P.L.104-13).%%0  0` (#(#0 ` (#` (#0 (# (#(Signed) (#(# 0  0` (#(#0 ` (#` (#0 (# (#AliceM.Rivlin (#(# 0  0` (#(#0 ` (#` (#0 (# (#Director%%!Director!%% (#(# %%Attachment  XFebruary8,1996 AppendixIIItoOMBCircularNo.A130%%A130%%-SecurityofFederalAutomatedInformationResources  &")  A.0  Requirements. ($+(#(# 1.0  Purposee*\&-(#(# ThisAppendixestablishesaminimumsetofcontrolstobeincludedinFederalautomatedinformationsecurityprograms;assignsFederalagencyresponsibilitiesforthesecurityofautomatedinformation;andlinksagencyautomatedinformationsecurityprogramsandagencymanagementcontrolsystemsestablished -)1 inaccordancewithOMBCircularNo.A123%%A123%%.TheAppendixrevisesproceduresformerlycontainedinAppendixIIItoOMBCircularNo.A130%%A130%%(50FR52730;December24,1985),andincorporatesrequirementsoftheComputerSecurityAct%%;1Computer Security Act;%%of1987(P.L.100-235)andresponsibilitiesassignedinapplicablenationalsecuritydirectives.2.0  DefinitionsKB(#(# Theterm:0  a."adequatesecurity%%3)adequate securityc3%%"meanssecuritycommensuratewiththeriskandmagnitudeoftheharmresultingfromtheloss,misuse,orunauthorizedaccesstoormodificationofinformation.Thisincludesassuringthatsystemsandapplicationsusedbytheagencyoperateeffectivelyandprovideappropriateconfidentiality%%/%confidentiality/%%,integrity,andavailability%%)availabilityy)%%,throughtheuseofcost-effectivemanagement,personnel,operational,andtechnicalcontrols. (#(# 0  b."application%%'application'%%"meanstheuseofinformationresources(informationandinformationtechnology)tosatisfyaspecificsetofuserrequirements. (#(# 0  c."generalsupportsystem%%=3general support system=%%"or"system"meansaninterconnectedsetofinformationresourcesunderthesamedirectmanagementcontrolwhichsharescommonfunctionality.Asystemnormallyincludeshardware,software,information,data,applications,communications,andpeople.Asystemcanbe,forexample,alocalareanetwork(LAN)includingsmartterminalsthatsupportsabranchoffice,anagency-widebackbone,acommunicationsnetwork,adepartmentaldataprocessingcenterincludingitsoperatingsystemandutilities,atacticalradionetwork,orasharedinformationprocessingserviceorganization(IPSO). (#(# 0  d."majorapplication%%3)major application 3'applicationt'%%"meansanapplication%%'applicationt'%%thatrequiresspecialattentiontosecurityduetotheriskandmagnitudeoftheharmresultingfromtheloss,misuse,orunauthorizedaccesstoormodificationoftheinformationintheapplication%%'application'%%.Note:AllFederalapplicationsrequiresomelevelofprotection.Certainapplications,becauseoftheinformationinthem,however,requirespecialmanagementoversight%%#oversight#%%andshouldbetreatedasmajor.Adequatesecurity%%3)Adequate security3%%forotherapplicationsshouldbeprovidedbysecurityofthesystemsinwhichtheyoperate. (#(# 3.  AutomatedInformationSecurityPrograms.Agenciesshallimplementandmaintainaprogramto # ! assurethatadequatesecurity%%3)adequate security3%%isprovidedforallagencyinformationcollected,processed,transmitted,stored,ordisseminatedingeneralsupportsystemsandmajorapplications.Eachagency'sprogramshallimplementpolicies,standardsandprocedureswhichareconsistentwithgovernment-widepolicies,standards,andproceduresissuedbytheOfficeofManagementandBudget%%OEOffice of Management and BudgetO%%,theDepartmentofCommerce,theGeneralServicesAdministrationandtheOfficeofPersonnelManagement%%MCOffice of Personnel ManagementM%%(OPM%% OPMe%%).Differentormorestringentrequirementsforsecuringnationalsecurityinformationshouldbeincorporatedintoagencyprogramsasrequiredbyappropriatenationalsecuritydirectives.Ataminimum,agencyprogramsshallincludethefollowingcontrolsintheirgeneralsupportsystemsandmajorapplications:0  a.Controlsforgeneralsupportsystems. (#(# 0  0(#(#1)  AssignResponsibilityforSecurity.Assignresponsibilityforsecurityineachsystemtoan ,(/ individualknowledgeableintheinformationtechnologyusedinthesystemandinprovidingsecurityforsuchtechnology.-)1(#(# Ї0  0(#(#2)  SystemSecurityPlan%%+!Security PlanX+%%.Planforadequatesecurity%%3)adequate security3%%ofeachgeneralsupportsystem%%=3general support system=%%aspartofthe   organization'sinformationresourcesmanagement(IRM%% IRMa%%)planningprocess.Thesecurityplan%%+!security plan +%%shallbeconsistentwithguidanceissuedbytheNationalInstituteofStandardsandTechnology(NIST).Independentadviceandcommentonthesecurityplan%%+!security plan +%%shallbesolicitedpriortotheplan'simplementation.AsummaryofthesecurityplansshallbeincorporatedintothestrategicIRM%% IRMe%%plan%%5+strategic IRM plane5%%requiredbythePaperworkReductionAct%%?5Paperwork Reduction Act?%%(44U.S.C.Chapter35)andSection8(b)ofthiscircular.Securityplansshallinclude: (#(# 0  0(#(#0(#(#a) 0 RulesoftheSystem%%7-Rules of the Systemc7%%.Establishasetofrulesofbehavior%%3)rules of behavior3%%concerninguseof,securityin,and   theacceptablelevelofriskfor,thesystem.Therulesshallbebasedontheneedsofthevarioususersofthesystem.Thesecurityrequiredbytherulesshallbeonlyasstringentasnecessarytoprovideadequatesecurity%%3)adequate security3%%forinformationinthesystem.Suchrulesshallclearlydelineateresponsibilitiesandexpectedbehaviorofallindividualswithaccesstothesystem.Theyshallalsoincludeappropriatelimitsoninterconnectionstoothersystemsandshalldefineserviceprovisionandrestorationpriorities.Finally,theyshallbeclear%%cleare%%abouttheconsequencesofbehaviornotconsistentwiththerules. (#(# 0  0(#(#0(#(#b) 0 Training%%!Traininge!%%.Ensurethatallindividualsareappropriatelytrainedinhowtofulfilltheir z securityresponsibilitiesbeforeallowingthemaccesstothesystem.Suchtraining%%!traininge!%%shallassurethatemployeesareversedintherulesofthesystem%%7-rules of the systemc7%%,beconsistentwithguidanceissuedbyNISTandOPM%% OPM %%,andapprisethemaboutavailableassistanceandtechnicalsecurityproductsandtechniques.Behaviorconsistentwiththerulesofthesystem%%7-rules of the systemc7%%andperiodicrefreshertraining%%!trainingh!%%shallberequiredforcontinuedaccesstothesystem. (#(# 0  0(#(#0(#(#c) 0 PersonnelControls.Screenindividualswhoareauthorizedtobypasssignificanttechnical yp andoperationalsecuritycontrols%%3)security controls3%%ofthesystemcommensuratewiththeriskandmagnitudeofharmtheycouldcause.Suchscreeningshalloccurpriortoanindividualbeingauthorizedtobypasscontrolsandperiodicallythereafter. (#(# 0  &  0(#(#0(#(#d) 0 IncidentResponseCapability%%I?Incident Response Capability I%%.Ensurethatthereisacapabilitytoprovidehelptousers  whenasecurityincidentoccursinthesystemandtoshareinformationconcerningcommonvulnerabilitiesandthreats.Thiscapabilityshallshareinformationwithotherorganizations,consistentwithNISTcoordination,andshouldassisttheagencyinpursuingappropriatelegalaction,consistentwithDepartmentofJustice%%;1Department of Justicei;%%guidance. (#(# 'j!0  0(#(#0(#(#e) 0 ContinuityofSupport%%;1Continuity of Supporti;%%.Establishandperiodicallytestthecapabilitytocontinueproviding !# servicewithinasystembasedupontheneedsandprioritiesoftheparticipantsofthesystem. (#(# 0  0(#(#0(#(#f) 0 TechnicalSecurity.Ensurethatcost-effectivesecurityproductsandtechniquesare e$\ & appropriatelyusedwithinthesystem. (#(# 0  0(#(#0(#(#g) 0 SystemInterconnection.Obtainwrittenmanagementauthorization,baseduponthe &") acceptanceofrisktothesystem,priortoconnectingwithothersystems.Whereconnectionisauthorized,controlsshallbeestablishedwhichareconsistentwiththerulesofthesystem%%7-rules of the system 7%%andinaccordancewithguidancefromNIST. (#(# 0  0(#(#3)  ReviewofSecurityControls%%3)Security Controls3%%.Reviewthesecuritycontrols%%3)security controls3%%ineachsystemwhensignificant 5+,'. modificationsaremadetothesystem,butatleasteverythreeyears.Thescopeandfrequencyofthereviewshouldbecommensuratewiththeacceptablelevelofriskforthesystem.Dependingonthepotentialriskandmagnitudeofharmthatcouldoccur,consideridentifyingadeficiency -)1 pursuanttoOMBCircularNo.A123%%A123%%,"ManagementAccountabilityandControl"andtheFederalManagers'FinancialIntegrityAct%%cYFederal Managers' Financial Integrity Actc%%(FMFIA%%FMFIA %%),ifthereisnoassignmentofsecurityresponsibility,nosecurityplan%%+!security plan+%%,ornoauthorizationtoprocessforasystem. (#(# 0  0(#(#4)  AuthorizeProcessing.Ensurethatamanagementofficialauthorizesinwritingtheuseofeach qh generalsupportsystem%%=3general support system8=%%basedonimplementationofitssecurityplan%%+!security plan +%%beforebeginningorsignificantlychangingprocessinginthesystem.Useofthesystemshallbere-authorizedatleasteverythreeyears. (#(# 0  b.  ControlsforMajorApplications.  (#(# 0  0(#(#1)  AssignResponsibilityforSecurity.Assignresponsibilityforsecurityofeachmajorapplication%%3)major applicationt3'applicationt'%% g ^  toamanagementofficialknowledgeableinthenatureoftheinformationandprocesssupportedbytheapplication%%'application'%%andinthemanagement,personnel,operational,andtechnicalcontrolsusedtoprotectit.Thisofficialshallassurethateffectivesecurityproductsandtechniquesareappropriatelyusedintheapplication%%'application'%%andshallbecontactedwhenasecurityincidentoccursconcerningtheapplication%%'application'%%. (#(# 0  0(#(#2)  Application%%'Application'%%SecurityPlan%%+!Security Plan+%%.Planfortheadequatesecurity%%3)adequate security 3%%eachmajorapplication%%3)major application 3'applicationt'%%,takinginto ]T accountthesecurityofallsystemsinwhichtheapplication%%'applicationt'%%willoperate.TheplanshallbeconsistentwithguidanceissuedbyNIST.Adviceandcommentontheplanshallbesolicitedfromtheofficialresponsibleforsecurityintheprimarysysteminwhichtheapplication%%'applicationt'%%willoperatepriortotheplan'simplementation.AsummaryofthesecurityplansshallbeincorporatedintothestrategicIRM%% IRMe%%plan%%5+strategic IRM planG5%%requiredbythePaperworkReductionAct%%?5Paperwork Reduction Act?%%.Application%%'Applicationu'%%securityplansshallinclude: (#(# &  0  0(#(#0(#(#a) 0 Application%%'Applicationu'%%Rules.Establishasetofrulesconcerninguseofandbehaviorwithinthe -$ application%%'applicationu'%%.Therulesshallbeasstringentasnecessarytoprovideadequatesecurity%%3)adequate security 3%%fortheapplication%%'applicationr'%%andtheinformationinit.Suchrulesshallclearlydelineateresponsibilitiesandexpectedbehaviorofallindividualswithaccesstotheapplication%%'applicationr'%%.Inaddition,therulesshallbeclear%%cleart%%abouttheconsequencesofbehaviornotconsistentwiththerules. (#(# '-q8&  0  0(#(#0(#(#b) 0 SpecializedTraining%%!Trainingn!%%.Beforeallowingindividualsaccesstotheapplication%%'applicationr'%%,ensurethatall I@  individualsreceivespecializedtraining%%!trainingn!%%focusedontheirresponsibilitiesandtheapplication%%'applicationr'%%rules.Thismaybeinadditiontothetraining%%!trainingn!%%requiredforaccesstoasystem.Suchtraining%%!trainingn!%%mayvaryfromanotificationatthetimeofaccess(e.g.,formembersofthepublicusinganinformationretrievalapplication%%'applicationr'%%)toformaltraining%%!trainingn!%%(e.g.,foranemployeethatworkswithahigh-riskapplication%%'applicationr'%%). (#(# 'I*<0  0(#(#0(#(#c) 0 PersonnelSecurity.Incorporatecontrolssuchasseparationofduties%%9/separation of dutiest9%%,leastprivilege%%/%least privilegei/%%and ?%6!' individualaccountability%%C9individual accountabilityC%%intotheapplication%%'applicationc'%%andapplication%%'applicationc'%%rulesasappropriate.Incaseswheresuchcontrolscannotadequatelyprotecttheapplication%%'applicationc'%%orinformationinit,screenindividualscommensuratewiththeriskandmagnitudeoftheharmtheycouldcause.Suchscreeningshallbedonepriortotheindividuals'beingauthorizedtoaccesstheapplication%%'applicationc'%%andperiodicallythereafter. (#(# 0  0(#(#0(#(#d) 0 Contingency%%'Contingencyc'%%Planning.Establishandperiodicallytestthecapabilitytoperformtheagency 5+,'. functionsupportedbytheapplication%%'applicationc'%%intheeventoffailureofitsautomatedsupport. (#(#   ,(0 %&   %0  0(#(#0(#(#e) 0 TechnicalControls.Ensurethatappropriatesecuritycontrols%%3)security controls3%%arespecified,designedinto,   tested,andacceptedintheapplication%%'applicationr'%%inaccordancewithappropriateguidanceissued%' F%byNIST. (#(# 0  0(#(#0(#(#f) 0 InformationSharing%%7-Information Sharing7%%.Ensurethatinformationsharedfromtheapplication%%'applicationh'%%isprotected  appropriately,comparabletotheprotectionprovidedwheninformationiswithintheapplication%%'applicationh'%%. (#(# 0  0(#(#0(#(#g) 0 PublicAccess%%+!Public Accessr+%%Controls.Whereanagency'sapplication%%'application'%%promotesorpermitspublicaccess%%+!public accessr+%%,   additionalsecuritycontrols%%3)security controls3%%shallbeaddedtoprotecttheintegrityoftheapplication%%'applicationr'%%andtheconfidencethepublichasintheapplication%%'applicationr'%%.Suchcontrolsshallincludesegregatinginformationmadedirectlyaccessibletothepublicfromofficialagencyrecords. (#(# 0  0(#(#3)  ReviewofApplication%%'Applicationr'%%Controls.Performanindependentrevieworaudit%%auditt%%ofthesecurity A8  controls%%3)security controls3%%ineachapplication%%'applicationr'%%atleasteverythreeyears.ConsideridentifyingadeficiencypursuanttoOMBCircularNo.A123%%A123t%%,"ManagementAccountabilityandControl"andtheFederalManagers'FinancialIntegrityAct%%cYFederal Managers' Financial Integrity Actc%%ifthereisnoassignmentofresponsibilityforsecurity,nosecurityplan%%+!security plans+%%,ornoauthorizationtoprocessfortheapplication%%'application'%%. (#(# 0  0(#(#4)  AuthorizeProcessing.Ensurethatamanagementofficialauthorizesinwritinguseofthe ]T application%%'application'%%byconfirmingthatitssecurityplan%%+!security plans+%%asimplementedadequatelysecurestheapplication%%'application'%%.Resultsofthemostrecentrevieworaudit%%auditt%%ofcontrolsshallbeafactorinmanagementauthorizations.Theapplication%%'application'%%mustbeauthorizedpriortooperatingandreauthorizedatleasteverythreeyearsthereafter.Managementauthorizationimpliesacceptingtheriskofeachsystemusedbytheapplication%%'application'%%. (#(# 4.  AssignmentofResponsibilities SJ 0  a.  DepartmentofCommerce.TheSecretaryofCommerceshall:(#(# 0  0(#(#1)  Developandissueappropriatestandardsandguidanceforthesecurityofsensitiveinformation  inFederalcomputersystems. (#(# 0  0(#(#2)  Reviewandupdateguidelinesfortraining%%!trainingn!%%incomputersecurityawareness%%#awareness#%%andaccepted I@  computersecuritypractice,withassistancefromOPM%% OPMn%%. (#(# 0  0(#(#3)  Provideagenciesguidanceforsecurityplanningtoassistintheirdevelopmentofapplication%%'application'%% !# andsystemsecurityplans. (#(# 0  0(#(#4)  Provideguidanceandassistance,asappropriate,toagenciesconcerningcost-effectivecontrols e$\ & wheninterconnectingwithothersystems. (#(# 0  0(#(#5)  Coordinateagencyincidentresponseactivitiestopromotesharingofincidentresponse &") informationandrelatedvulnerabilities. (#(# 0  0(#(#6)  Evaluatenewinformationtechnologiestoassesstheirsecurityvulnerabilities,withtechnical )x%, assistancefromtheDepartmentofDefense,andappriseFederalagenciesofsuchvulnerabilitiesassoonastheyareknown. (#(#   ,(/ %& h  %0  b.  DepartmentofDefense.TheSecretaryofDefenseshall: (#(# 0  0(#(#1)  Provideappropriatetechnicaladviceandassistance(includingworkproducts)tothe  DepartmentofCommerce.%'h \% (#(# 0  0(#(#2)  AssisttheDepartmentofCommerceinevaluatingthevulnerabilitiesofemerginginformation KB technologies. (#(# 0  c.  DepartmentofJustice%%;1Department of Justice;%%.TheAttorneyGeneralshall: (#(# 0  0(#(#1)  Provideappropriateguidancetoagenciesonlegalremediesregardingsecurityincidents%%5+security incidentse5%%and    waystoreportandworkwithlawenforcementconcerningsuchincidents. (#(# 0  0(#(#2)  Pursueappropriatelegalactionswhensecurityincidents%%5+security incidentse5%%occur. (#(# & B 0  d.  GeneralServicesAdministration.TheAdministratorofGeneralServicesshall: (#(# 0  0(#(#1)  Provideguidancetoagenciesonaddressingsecurityconsiderationswhenacquiringautomated z dataprocessingequipment(asdefinedinsection111(a)(2)oftheFederalPropertyandAdministrativeServicesActof1949,asamended).'Ba (#(# 0  0(#(#2)  Facilitatethedevelopmentofcontractvehiclesforagenciestouseintheacquisition%%'acquisitiond'%%of  cost-effectivesecurityproductsandservices(e.g.,back-up%%back-upo%%services). (#(# 0  0(#(#&  3)  ProvideappropriatesecurityservicestomeettheneedsofFederalagenciestotheextentthat yp suchservicesarecost-effective.'y9e (#(# 0  e.  OfficeofPersonnelManagement%%MCOffice of Personnel Management8M%%.TheDirector%%!DirectorP!%%oftheOfficeofPersonnelManagement%%MCOffice of Personnel Management8M%%shall:(#(# 0  0(#(#1)  Assurethatitsregulationsconcerningcomputersecuritytraining%%!trainingP!%%forFederalcivilianemployees  areeffective. (#(# 0  0(#(#2)  AssisttheDepartmentofCommerceinupdatingandmaintainingguidelinesfortraining%%!trainingP!%%in I@  computersecurityawareness%%#awarenesse#%%andacceptedcomputersecuritypractice. (#(# 0  f.  SecurityPolicyBoard.TheSecurityPolicyBoardshallcoordinatetheactivitiesoftheFederal !# governmentregardingthesecurityofinformationtechnologythatprocessesclassified%%%classifiedr%%%informationinaccordancewithapplicablenationalsecuritydirectives; (#(# 5.  CorrectionofDeficiencies%%)Deficiencieso)%%andReports%%Reportsi%% ?%6!' 0  a.  CorrectionofDeficiencies%%)Deficiencieso)%%.Agenciesshallcorrectdeficiencies%%)deficiencieso)%%whichareidentifiedthroughthe &") reviewsofsecurityforsystemsandmajorapplicationsdescribedabove. (#(# 0  b.  Reports%%Reportsi%%onDeficiencies%%)Deficiencieso)%%.InaccordancewithOMBCircularNo.A123%%A123n%%,"Management )x%, AccountabilityandControl",ifadeficiencyincontrolsisjudgedbytheagencyheadtobematerialwhenweighedagainstotheragencydeficiencies%%)deficiencieso)%%,itshallbeincludedintheannualFMFIA%%FMFIAn%%report.Lesssignificantdeficiencies%%)deficiencieso)%%shallbereportedandprogressoncorrectiveactionstrackedattheappropriateagencylevel. (#(#  -)1 0  c.  SummariesofSecurityPlans.Agenciesshallincludeasummaryoftheirsystemsecurityplansand   majorapplication%%3)major application3'applicationt'%%plansinthestrategicplanrequiredbythePaperworkReductionAct%%?5Paperwork Reduction Act"?%%(44U.S.C.3506). (#(#  B.  DescriptiveInformation.  qh Thefollowingdescriptivelanguageisexplanatory.ItisincludedtoassistinunderstandingtherequirementsoftheAppendix.TheAppendixre-orientstheFederalcomputersecurityprogramtobetterrespondtoarapidlychangingtechnologicalenvironment.Itestablishesgovernment-wideresponsibilitiesforFederalcomputersecurityandrequiresFederalagenciestoadoptaminimumsetofmanagementcontrols.Thesemanagementcontrolsaredirectedatindividualinformationtechnologyusersinordertoreflectthedistributednatureoftoday'stechnology.Forsecuritytobemosteffective,thecontrolsmustbepartofday-to-dayoperations.Thisisbestaccomplishedbyplanningforsecuritynotasaseparateactivity,butasanintegralpartofoverallplanning."Adequatesecurity%%3)Adequate security 3%%"isdefinedas"securitycommensuratewiththeriskandmagnitudeofharmresultingfromtheloss,misuse,orunauthorizedaccesstoormodificationofinformation."Thisdefinitionexplicitlyemphasizestherisk-basedpolicyforcost-effectivesecurityestablishedbytheComputerSecurityAct%%;1Computer Security Act;%%.TheAppendixnolongerrequiresthepreparationofformalriskanalyses.Inthepast,substantialresourceshavebeenexpendeddoingcomplexanalysesofspecificriskstosystems,withlimitedtangiblebenefitintermsofimprovedsecurityforthesystems.Ratherthancontinuetotrytopreciselymeasurerisk,securityeffortsarebetterservedbygenerallyassessingrisksandtakingactionstomanagethem.Whileformalriskanalysesneednotbeperformed,theneedtodetermineadequatesecurity%%3)adequate securityc3%%willrequirethatarisk-basedapproachbeused.Thisriskassessment%%/%risk assessment/%%approachshouldincludeaconsiderationofthemajorfactorsinriskmanagement%%/%risk management/%%:thevalueofthesystemorapplication%%'applicationn'%%,threats,vulnerabilities,andtheeffectivenessofcurrentorproposedsafeguards.Additionalguidanceoneffectiveriskassessment%%/%risk assessment/%%isavailablein"AnIntroductiontoComputerSecurity:TheNISTHandbook%%+!NIST Handbook+%%"(March16,1995).DiscussionoftheAppendix'sMajorProvisions.Thefollowingdiscussionisprovidedtoaidreviewersin I@  understandingthechangesinemphasisintheAppendix.AutomatedInformationSecurityPrograms.Agenciesarerequiredtoestablishcontrolstoassureadequate !# security%%3)adequate securityc3%%forallinformationprocessed,transmitted,orstoredinFederalautomatedinformationsystems.ThisAppendixemphasizesmanagementcontrolsaffectingindividualusersofinformationtechnology.Technicalandoperationalcontrolssupportmanagementcontrols.Tobeeffective,allmustinterrelate.Forexample,authenticationofindividualusersisanimportantmanagementcontrol,forwhichpassword%%!passworde!%%protectionisatechnicalcontrol.However,password%%!passworde!%%protectionwillonlybeeffectiveifbothastrongtechnologyisemployed,anditismanagedtoassurethatitisusedcorrectly.Fourcontrolsaresetforth:assigningresponsibilityforsecurity,securityplanning,periodicreviewofsecuritycontrols%%3)security controlsc3%%,andmanagementauthorization.TheAppendixrequiresthatthesemanagementcontrolsbeappliedintwoareasofmanagementresponsibility:oneforgeneralsupportsystemsandoneformajorapplications.Theterms"generalsupportsystem%%=3general support system8=%%"and"majorapplication%%3)major applicationt3'applicationt'%%"wereusedinOMBBulletinsNos.88-16%%88-16t%%and90-08%%90-08%%.Ageneralsupportsystem%%=3general support system=%%is"aninterconnectedsetofinformationresourcesunderthesamedirect -)1 managementcontrolwhichsharescommonfunctionality."Suchasystemcanbe,forexample,alocalareanetwork(LAN)includingsmartterminalsthatsupportsabranchoffice,anagency-widebackbone,acommunicationsnetwork,adepartmentaldataprocessingcenterincludingitsoperatingsystemandutilities,atacticalradionetwork,orasharedinformationprocessingserviceorganization.Normally,thepurposeofageneralsupportsystem%%=3general support system=%%istoprovideprocessingorcommunicationssupport.Amajorapplication%%3)major applicationt3'applicationt'%%isauseofinformationandinformationtechnologytosatisfyaspecificsetofuserrequirementsthatrequiresspecialmanagementattentiontosecurityduetotheriskandmagnitudeofharmresultingfromtheloss,misuseorunauthorizedaccesstoormodificationoftheinformationintheapplication%%'applicationt'%%.Allapplicationsrequiresomelevelofsecurity,andadequatesecurity%%3)adequate securityt3%%formostofthemshouldbeprovidedbysecurityofthegeneralsupportsystemsinwhichtheyoperate.However,certainapplications,becauseofthenatureoftheinformationinthem,requirespecialmanagementoversight%%#oversightc#%%andshouldbetreatedasmajor.Agenciesareexpectedtoexercisemanagementjudgementindeterminingwhichoftheirapplicationsaremajor.ThefocusofOMBBulletinsNos.88-16%%88-16h%%and90-08%%90-08h%%wasonidentifyingandsecuringbothgeneralsupportsystemsandapplicationswhichcontainedsensitiveinformation.TheAppendixrequirestheestablishmentofsecuritycontrols%%3)security controlst3%%inallgeneralsupportsystems,underthepresumptionthatallcontainsomesensitiveinformation,andfocusesextrasecuritycontrols%%3)security controlst3%%onalimitednumberofparticularlyhigh-riskormajorapplications.a.  GeneralSupportSystems.Thefollowingcontrolsarerequiredinallgeneralsupportsystems:  0  1)  AssignResponsibilityforSecurity.Foreachsystem,anindividualshouldbeafocalpointfor  assuringthereisadequatesecurity%%3)adequate securityt3%%withinthesystem,includingwaystoprevent,detect,andrecoverfromsecurityproblems.Thatresponsibilityshouldbeassignedinwritingtoanindividualtrainedinthetechnologyusedinthesystemandinprovidingsecurityforsuchtechnology,includingthemanagementofsecuritycontrols%%3)security controlst3%%suchasuseridentificationandauthentication. (#(# 0  2)  SecurityPlan%%+!Security Planl+%%.TheComputerSecurityAct%%;1Computer Security Act;%%requiresthatsecurityplansbedevelopedforallFederal  computersystemsthatcontainsensitiveinformation.GiventheexpansionofdistributedprocessingsincepassageoftheAct,thepresumptionintheAppendixisthatallFebruary8,1996generalsupportsystemscontainsomesensitiveinformationwhichrequiresprotectiontoassureitsintegrity,availability%%)availabilityi)%%,orconfidentiality%%/%confidentiality /%%,andthereforeallsystemsrequiresecurityplans. (#(# 0  PreviousguidanceonsecurityplanningwascontainedinOMBBulletinNo.90-08%%90-08n%%.ThisAppendixsupersedesOMBBulletin90-08%%90-08n%%andexpandsthecoverageofsecurityplansfromBulletin90-08%%90-08n%%toincluderulesofindividualbehavioraswellastechnicalsecurity.ConsistentwithOMBBulletin90-08%%90-08n%%,theAppendixdirectsNISTtoupdateandexpandsecurityplanningguidanceandissueitasaFederalInformationProcessingStandard(FIPS).Intheinterim,agenciesshouldcontinuetousetheAppendixofOMBBulletinNo.90-08%%90-08n%%asguidanceforthetechnicalportionoftheirsecurityplans. (#(# 0  TheAppendixcontinuestherequirementthatindependentadviceandcommentonthesecurityplan%%+!security plan+%%foreachsystembesought.Theintentofthisrequirementistoimprovetheplans,fostercommunicationbetweenmanagersofdifferentsystems,andpromotethesharingofsecurityexpertise. (#(# 0  ThisAppendixalsocontinuestherequirementfromtheComputerSecurityAct%%;1Computer Security Act;%%thatsummariesofsecurityplansbeincludedinagencystrategicinformationresourcesmanagementplans.OMBwillprovideadditionalguidanceaboutthecontentsofthosestrategicplans,pursuanttothePaperworkReductionAct%%?5Paperwork Reduction Act,?%%of1995.-)1(#(# Ї0  Thefollowingspecificsecuritycontrols%%3)security controls3%%shouldbeincludedinthesecurityplan%%+!security planl+%%forageneralsupportsystem%%=3general support system=%%: (#(# 0  0(#(#a)  Rules.Animportantnewrequirementforsecurityplansistheestablishmentofasetofrules  ofbehavior%%3)rules of behavior3%%forindividualusersofeachgeneralsupportsystem%%=3general support system =%%.Theserulesshouldclearlydelineateresponsibilitiesofandexpectationsforallindividualswithaccesstothesystem.Theyshouldbeconsistentwithsystem-specificpolicyasdescribedin"AnIntroductiontoComputerSecurity:TheNISTHandbook%%+!NIST Handbook +%%"(March16,1995).Inaddition,theyshouldstatetheconsequencesofnon-compliance.Therulesshouldbeinwritingandwillformthebasisforsecurityawareness%%#awarenesso#%%andtraining%%!training!%%. (#(# 0  0(#(#Thedevelopmentofrulesforasystemmusttakeintoconsiderationtheneedsofallpartieswhousethesystem.Rulesshouldbeasstringentasnecessarytoprovideadequatesecurity%%3)adequate securityt3%%.Therefore,theacceptablelevelofriskforthesystemmustbeestablishedandshouldformthebasisfordeterminingtherules. (#(# 0  0(#(#&  Rulesshouldcoversuchmattersasworkathome%%)work at homei)%%,dial-inaccess,connectiontotheInternet%%!Internetm!!Internetm!%%,useofcopyrightedworks,unofficialuseofgovernmentequipment,theassignmentandlimitationofsystemprivileges,andindividualaccountability%%C9individual accountabilityC%%.Oftenrulesshouldreflecttechnicalsecuritycontrols%%3)security controlsb3%%inthesystem.Forexample,rulesregardingpassword%%!passwordo!%%useshouldbeconsistentwithtechnicalpassword%%!passwordo!%%featuresinthesystem.Rulesmaybeenforcedthroughadministrativesanctionsspecificallyrelatedtothesystem(e.g.lossofsystemprivileges)orthroughmoregeneralsanctionsasareimposedforviolatingotherrulesofconduct.Inaddition,therulesshouldspecificallyaddressrestorationofserviceasaconcernofallusersofthesystem.' (#(# 0  0(#(#b)  Training%%!Trainingo!%%.TheComputerSecurityAct%%;1Computer Security Actt;%%requiresFederalagenciestoprovideforthemandatory SJ periodictraining%%!traininge!%%incomputersecurityawareness%%#awarenessc#%%andacceptedcomputersecuritypracticeofallemployeeswhoareinvolvedwiththemanagement,useoroperationofaFederalcomputersystemwithinorunderthesupervisionoftheFederalagency.Thisincludescontractorsaswellasemployeesoftheagency.Accessprovidedtomembersofthepublicshouldbeconstrainedbycontrolsintheapplicationsthroughwhichaccessisallowed,andtraining%%!training!%%shouldbewithinthecontextofthosecontrols.TheAppendixenforcessuchmandatorytraining%%!training!%%byrequiringitscompletionpriortograntingaccesstothesystem.Eachnewuserofageneralsupportsystem%%=3general support systemy=%%insomesenseintroducesarisktoallotherusers.Therefore,eachusershouldbeversedinacceptablebehavior--therulesofthesystem%%7-rules of the systemm7%%--beforebeingallowedtousethesystem.Training%%!Trainingh!%%shouldalsoinformtheindividualhowtogethelpintheeventofdifficultywithusingorsecurityofthesystem. (#(# 0  0(#(#Training%%!Trainingh!%%shouldbetailoredtowhatauserneedstoknowtousethesystemsecurely,giventhenatureofthatuse.Training%%!Trainingh!%%maybepresentedinstages,forexampleasmoreaccessisgranted.Insomecases,thetraining%%!trainingh!%%shouldbeintheformofclassroominstruction.Inothercases,interactivecomputersessionsorwell-writtenandunderstandablebrochuresmaybesufficient,dependingontheriskandmagnitudeofharm. (#(# 0  0(#(#Overtime,attentiontosecuritytendstodissipate.Inaddition,changestoasystemmaynecessitateachangeintherulesoruserprocedures.Therefore,individualsshouldperiodicallyhaverefreshertraining%%!training!%%toassurethattheycontinuetounderstandandabidebytheapplicablerules. (#(# 0  0(#(#Toassistagencies,theAppendixrequiresNIST,withassistancefromtheOfficeofPersonnelManagement%%MCOffice of Personnel ManagementM%%(OPM%% OPMe%%),toupdateitsexistingguidance.ItalsoproposesthatOPM%% OPMe%%assurethatitsrulesforcomputersecuritytraining%%!trainingP!%%forFederalcivilianemployeesareeffective.-)1(#(# Ї0  0(#(#c)  PersonnelControls.Ithaslongbeenrecognizedthatthegreatestharmhascomefrom   authorizedindividualsengagedinimproperactivities,whetherintentionaloraccidental.Ineverygeneralsupportsystem%%=3general support system=%%,anumberoftechnical,operational,andmanagementcontrolsareusedtopreventanddetectharm.Suchcontrolsincludeindividualaccountability%%C9individual accountability8C%%,"leastprivilege%%/%least privileget/%%,"andseparationofduties%%9/separation of dutiesi9%%. (#(# 0  0(#(#Individualaccountability%%C9Individual accountability8C%%consistsofholdingsomeoneresponsibleforhisorheractions.Inageneralsupportsystem%%=3general support systemy=%%,accountabilityisnormallyaccomplishedbyidentifyingandauthenticatingusersofthesystemandsubsequentlytracingactionsonthesystemtotheuserwhoinitiatedthem.Thismaybedone,forexample,bylookingforpatternsofbehaviorbyusers. (#(# 0  0(#(#&  Leastprivilege%%/%Least privilegey/%%isthepracticeofrestrictingauser'saccess(todatafiles,toprocessingcapability,ortoperipherals)ortypeofaccess(read,write,execute,delete)totheminimumnecessarytoperformhisorherjob.'g  (#(# 0  0(#(#Separationofduties%%9/Separation of duties9%%isthepracticeofdividingthestepsinacriticalfunctionamongdifferentindividuals.Forexample,onesystemprogrammercancreateacriticalpieceofoperatingsystemcode,whileanotherauthorizesitsimplementation.Suchacontrolkeepsasingleindividualfromsubvertingacriticalprocess. (#(# 0  0(#(#Nevertheless,insomeinstances,individualsmaybegiventheabilitytobypasssomesignificanttechnicalandoperationalcontrolsinordertoperformsystemadministrationandmaintenance%%'maintenance '%%functions(e.g.,LANadministratorsorsystemsprogrammers). (#(# 0  0(#(#Screeningsuchindividualsinpositionsoftrustwillsupplementtechnical,operational,andmanagementcontrols,particularlywheretheriskandmagnitudeofharmishigh. (#(# 0  0(#(#d)  IncidentResponseCapability%%I?Incident Response CapabilityI%%.Securityincidents%%5+Security incidentsp5%%,whethercausedbyviruses,hackers,or  softwarebugs,arebecomingmorecommon.Whenfacedwithasecurityincident,anagencyshouldbeabletorespondinamannerthatbothprotectsitsowninformationandhelpstoprotecttheinformationofotherswhomightbeaffectedbytheincident.Toaddressthisconcern,agenciesshouldestablishformalincidentresponsemechanisms.Awareness%%#Awarenessc#%%andtraining%%!training!%%forindividualswithaccesstothesystemshouldincludehowtousethesystem'sincidentresponsecapability%%I?incident response capabilityI%%. (#(# 0  0(#(#Tobefullyeffective,incidenthandlingmustalsoincludesharinginformationconcerningcommonvulnerabilitiesandthreatswiththoseinothersystemsandotheragencies.TheAppendixdirectsagenciestoeffectuatesuchsharing,andtasksNISTtocoordinatethoseagencyactivitiesgovernment-wide. (#(# 0  0(#(#TheAppendixalsodirectstheDepartmentofJustice%%;1Department of Justicei;%%toprovideappropriateguidanceonpursuinglegalremediesinthecaseofseriousincidents. (#(# 0  0(#(#e)  ContinuityofSupport%%;1Continuity of Supporti;%%.Inevitably,therewillbeserviceinterruptions.Agencyplansshould '#* assurethatthereisanabilitytorecoverandprovideservicesufficienttomeettheminimalneedsofusersofthesystem.Manualprocedures%%3)Manual procedures`3%%aregenerallyNOTaviableback-up%%back-upo%%option.Whenautomatedsupportisnotavailable,manyfunctionsoftheorganizationwilleffectivelycease.Therefore,itisimportanttotakecost-effectivestepstomanageanydisruptionofservice. (#(# 0  0(#(#Decisionsonthelevelofserviceneededatanyparticulartimeandonprioritiesinservicerestorationshouldbemadeinconsultationwiththeusersofthesystemandincorporatedinthe -)1 systemrules.Experiencehasshownthatrecovery%%!recoveryc!%%plansthatareperiodicallytestedaresubstantiallymoreviablethanthosethatarenot.Moreover,untestedplansmayactuallycreateafalsesenseofsecurity. (#(# 0  0(#(#f)  TechnicalSecurity.Agenciesshouldassurethateachsystemappropriatelyuseseffective qh securityproductsandtechniques,consistentwithstandardsandguidancefromNIST.Oftensuchtechniqueswillcorrespondwithsystemrulesofbehavior%%3)rules of behavior`3%%,suchasintheproperuseofpassword%%!passworde!%%protection. (#(# 0  0(#(#TheAppendixdirectsNISTtocontinuetoissuecomputersecurityguidancetoassistagenciesinplanningforandusingtechnicalsecurityproductsandtechniques.Untilsuchguidanceisissued,however,theplanningguidanceincludedinOMBBulletin90-08%%90-08d%%canassistindeterminingtechniquesforeffectivesecurityinasystemandinaddressingtechnicalcontrolsinthesecurityplan%%+!security plano+%%. (#(# 0  0(#(#g)  SystemInterconnection.Inorderforacommunitytoeffectivelymanagerisk,itmustcontrol   accesstoandfromothersystems.Thedegreeofsuchcontrolshouldbeestablishedintherulesofthesystem%%7-rules of the system 7%%andallparticipantsshouldbemadeawareofanylimitationsonoutsideaccess.TechnicalcontrolstoaccomplishthisshouldbeputinplaceinaccordancewithguidanceissuedbyNIST. (#(# 0  0(#(#Therearevaryingdegreesofhowconnectedasystemis.Forexample,somesystemswillchoosetoisolatethemselves,otherswillrestrictaccesssuchasallowingonlye-mailconnectionsorremoteaccessonlywithsophisticatedauthentication,andotherswillbefullyopen.Themanagementdecisiontointerconnectshouldbebasedontheavailability%%)availabilityy)%%anduseoftechnicalandnon-technicalsafeguardsandconsistentwiththeacceptablelevelofriskdefinedinthesystemrules. (#(# 0  3)  ReviewofSecurityControls%%3)Security Controls3%%.Thesecurityofasystemwilldegradeovertime,asthetechnology  evolvesandaspeopleandprocedureschange.Reviewsshouldassurethatmanagement,operational,personnel,andtechnicalcontrolsarefunctioningeffectively.Securitycontrols%%3)Security controls3%%maybereviewedbyanindependentaudit%%audit%%oraselfreview.Thetypeandrigorofrevieworaudit%%audit%%shouldbecommensuratewiththeacceptablelevelofriskthatisestablishedintherulesforthesystemandthelikelihoodoflearningusefulinformationtoimprovesecurity. (#(# 0  Technicaltoolssuchasvirus%%virus%%scanners,vulnerabilityassessmentproducts(whichlookforknownsecurityproblems,configurationerrors,andtheinstallationofthelatestpatches),andpenetrationtesting%%testing%%canassistintheon-goingreviewofdifferentfacetsofsystems.However,thesetoolsarenosubstituteforaformalmanagementreviewatleasteverythreeyears.Indeed,forsomehigh-risksystemswithrapidlychangingtechnology,threeyearswillbetoolong. (#(# 0  Dependingupontheriskandmagnitudeofharmthatcouldresult,weaknessesidentifiedduringthereviewofsecuritycontrols%%3)security controls 3%%shouldbereportedasdeficiencies%%)deficiencieso)%%inaccordancewithOMBCircularNo.A123%%A123%%,"ManagementAccountabilityandControl"andtheFederalManagers'FinancialIntegrityAct%%cYFederal Managers' Financial Integrity Actc%%.Inparticular,ifabasicmanagementcontrolsuchasassignmentofresponsibility,aworkablesecurityplan%%+!security plans+%%,ormanagementauthorizationaremissing,thenconsiderationshouldbegiventoidentifyingadeficiency. (#(#   5+,'. %& B  %0  4)  AuthorizeProcessing.Theauthorizationofasystemtoprocessinformation,grantedbya   managementofficial,providesanimportantqualitycontrol(someagenciesrefertothisauthorizationasaccreditation%%+!accreditation6+%%).Byauthorizingprocessinginasystem,amanageracceptstheriskassociatedwithit.Authorizationisnotadecisionthatshouldbemadebythesecuritystaff%%-#security staff8-%%. (#(# %'B $%0  &  Boththesecurityofficialandtheauthorizingmanagementofficialhavesecurityresponsibilities.Ingeneral,thesecurityofficialisclosertotheday-to-dayoperationofthesystemandwilldirectorperformsecuritytasks.Theauthorizingofficialwillnormallyhavegeneralresponsibilityfortheorganizationsupportedbythesystem. (#(# 0  Managementauthorizationshouldbebasedonanassessmentofmanagement,operational,andtechnicalcontrols.Sincethesecurityplan%%+!security plan2+%%establishesthesecuritycontrols%%3)security controls3%%,itshouldformthebasisfortheauthorization,supplementedbymorespecificstudiesasneeded.Inaddition,theperiodicreviewofcontrolsshouldalsocontributetofutureauthorizations.Someagenciesperform"certification%%+!certificationl+%%reviews"oftheirsystemsperiodically.Theseformaltechnicalevaluationsleadtoamanagementaccreditation%%+!accreditationl+%%,or"authorizationtoprocess."Suchcertifications(suchasthoseusingthemethodologyinFIPSPub102"GuidelineforComputerSecurityCertification%%+!Certificationl+%%andAccreditation%%+!Accreditationl+%%")canprovideusefulinformationtoassistmanagementinauthorizingasystem,particularlywhencombinedwithareviewofthebroadbehavioralcontrolsenvisionedinthesecurityplan%%+!security planl+%%requiredbytheAppendix.' K (#(# 0  Re-authorizationshouldoccurpriortoasignificantchangeinprocessing,butatleasteverythreeyears.Itshouldbedonemoreoftenwherethereisahighriskandpotentialmagnitudeofharm. (#(# b.  ControlsinMajorApplications.Certainapplicationsrequirespecialmanagementattentionduetothe  riskandmagnitudeofharmthatcouldoccur.Forsuchapplications,thecontrolsofthesupportsystem(s)inwhichtheyoperatearelikelytobeinsufficient.Therefore,additionalcontrolsspecifictotheapplication%%'application'%%arerequired.Sincethefunctionofapplicationsisthedirectmanipulationanduseofinformation,controlsforsecuringapplicationsshouldemphasizeprotectionofinformationandthewayitismanipulated.0  1)  AssignResponsibilityforSecurity.Bydefinition,majorapplicationsarehighriskandrequire  specialmanagementattention.Majorapplicationsusuallysupportasingleagencyfunctionandoftenaresupportedbymorethanonegeneralsupportsystem%%=3general support system=%%.Itisimportant,therefore,thatanindividualbeassignedresponsibilityinwritingtoassurethattheparticularapplication%%'applicationr'%%hasadequatesecurity%%3)adequate securityt3%%.Tobeeffective,thisindividualshouldbeknowledgeableintheinformationandprocesssupportedbytheapplication%%'applicationr'%%andinthemanagement,personnel,operational,andtechnicalcontrolsusedtoprotecttheapplication%%'applicationr'%%. (#(# 0  2)  Application%%'Applicationr'%%SecurityPlans.Securityforeachmajorapplication%%3)major applicationt3'applicationt'%%shouldbeaddressedbyasecurity #% plan%%+!security plano+%%specifictotheapplication%%'application'%%.Theplanshouldincludecontrolsspecifictoprotectinginformationandshouldbedevelopedfromtheapplication%%'application'%%manager'sperspective.Toassistinassuringitsviability,theplanshouldbeprovidedtothemanageroftheprimarysupportsystemwhichtheapplication%%'application'%%usesforadviceandcomment.Thisrecognizesthecriticaldependenceofthesecurityofmajorapplicationsontheunderlyingsupportsystemstheyuse.Summariesofapplication%%'application'%%securityplansshouldbeincludedinstrategicinformationresourcemanagementplansinaccordancewiththisCircular. (#(# 0  0(#(#a)  Application%%'Application'%%Rules.Rulesofbehavior%%3)Rules of behavior3%%shouldbeestablishedwhichdelineatetheresponsibilities [*R&- andexpectedbehaviorofallindividualswithaccesstotheapplication%%'applicationv'%%.Therulesshouldstatetheconsequencesofinconsistentbehavior.Oftentheruleswillbeassociatedwithtechnicalcontrolsimplementedintheapplication%%'applicationv'%%.Suchrulesshouldinclude,forexample,limitationsonchangingdata,searchingdatabases,ordivulginginformation.-)1(#(# Ї& B 0  0(#(#b)  SpecializedTraining%%!Training!%%.Training%%!Training!%%isrequiredforallindividualsgivenaccesstotheapplication%%'application '%%,   includingmembersofthepublic.Itshouldvarydependingonthetypeofaccessallowedandtheriskthataccessrepresentstothesecurityoftheapplication%%'application '%%andinformationinit.Thistraining%%!trainingn!%%willbeinadditiontothatrequiredforaccesstoasupportsystem. (#(# 'B 0  0(#(#c)  PersonnelSecurity.Formostmajorapplications,managementcontrolssuchasindividual KB accountability%%C9individual accountability8C%%requirements,separationofduties%%9/separation of dutiesi9%%enforcedbyaccesscontrols,orlimitationsontheprocessingprivilegesofindividuals,aregenerallymorecost-effectivepersonnelsecuritycontrols%%3)security controlss3%%thanbackgroundscreening.Suchcontrolsshouldbeimplementedasbothtechnicalcontrolsandasapplication%%'application'%%rules.Forexample,technicalcontrolstoensureindividualaccountability%%C9individual accountabilityC%%,suchaslookingforpatternsofuserbehavior,aremosteffectiveifusersareawarethatthereissuchatechnicalcontrol.Ifadequateaudit%%auditu%%oraccesscontrols(throughbothtechnicalandnon-technicalmethods)cannotbeestablished,thenitmaybecost-effectivetoscreenpersonnel,commensuratewiththeriskandmagnitudeofharmtheycouldcause.ThechangeinemphasisonscreeningintheAppendixshouldnotaffectbackgroundscreeningdeemednecessarybecauseofotherdutiesthatanindividualmayperform. (#(# 0  0(#(#d)  Contingency%%'Contingency'%%Planning.NormallytheFederalmissionsupportedbyamajorapplication%%3)major application 3'applicationt'%%is z criticallydependentontheapplication%%'applicationt'%%.ManualprocessingisgenerallyNOTaviableback-up%%back-upo%%option.Managersshouldplanforhowtheywillperformtheirmissionand/orrecoverfromthelossofexistingapplication%%'applicationt'%%support,whetherthelossisduetotheinabilityoftheapplication%%'applicationt'%%tofunctionorageneralsupportsystem%%=3general support system8=%%failure.Experiencehasdemonstratedthattesting%%testingu%%acontingency%%'contingencyr'%%plan%%1'contingency plans1%%significantlyimprovesitsviability.Indeed,untestedplansorplansnottestedforalongperiodoftimemaycreateafalsesenseofabilitytorecoverinatimelymanner. (#(# 0  0(#(#e)  TechnicalControls.Technicalsecuritycontrols%%3)security controlst3%%,forexampleteststofilterinvalidentries, SJ shouldbebuiltintoeachapplication%%'applicationr'%%.Oftenthesecontrolswillcorrespondwiththerulesofbehavior%%3)rules of behaviort3%%fortheapplication%%'applicationv'%%.UnderthepreviousAppendix,application%%'applicationv'%%securitywasfocusedontheprocessbywhichsensitive,customapplicationsweredeveloped.WhilethatprocessisnotaddressedindetailinthisAppendix,itremainsaneffectivemethodforassuringthatsecuritycontrols%%3)security controls 3%%arebuiltintoapplications.Additionally,thetechnicalsecuritycontrols%%3)security controls 3%%definedinOMBBulletinNo.90-08%%90-08y%%willcontinue,untilthatguidanceisreplacedbyNIST'ssecurityplanningguidance. (#(# 0  0(#(#f)  InformationSharing%%7-Information Sharing 7%%.AssurethatinformationwhichissharedwithFederalorganizations,State  " andlocalgovernments,andtheprivatesectorisappropriatelyprotectedcomparabletotheprotectionprovidedwhentheinformationiswithintheapplication%%'application'%%.Controlsontheinformationmaystaythesameorvarywhentheinformationissharedwithanotherentity.Forexample,theprimaryuseroftheinformationmayrequireahighlevelofavailability%%)availability%)%%whilethesecondaryuserdoesnot,andcanthereforerelaxsomeofthecontrolsdesignedtomaintaintheavailability%%)availability%)%%oftheinformation.Atthesametime,however,theinformationsharedmayrequirealevelofconfidentiality%%/%confidentiality/%%thatshouldbeextendedtothesecondaryuser.Thisnormallyrequiresnotificationandagreementtoprotecttheinformationpriortoitsbeingshared. (#(# &  0  0(#(#g)  PublicAccess%%+!Public Access+%%Controls.Permittingpublicaccess%%+!public access+%%toaFederalapplication%%'application'%%isanimportant )x%, methodofimprovinginformationexchangewiththepublic.Atthesametime,itintroducesriskstotheFederalapplication%%'application'%%.Tomitigatetheserisks,additionalcontrolsshouldbeinplaceasappropriate.Thesecontrolsareinadditiontocontrolssuchas"firewalls%%#firewalls#%%"thatareputinplaceforsecurityofthegeneralsupportsystem%%=3general support system =%%. (#(# ')R  -)1 0  0(#(#Ingeneral,itismoredifficulttoapplyconventionalcontrolstopublicaccess%%%%+!public accessX+%%systems,becausemanyoftheusersofthesystemmaynotbesubjecttoindividualaccountability%%C9individual accountability1C%%policies.Inaddition,publicaccess%%+!public accessu+%%systemsmaybeatargetformischiefbecauseoftheirhighervisibilityandpublishedaccessmethods. (#(# 0  0(#(#Officialrecordsneedtobeprotectedagainstlossoralteration.Officialrecordsinelectronicformareparticularlysusceptiblesincetheycanberelativelyeasytochangeordestroy.Therefore,officialrecordsshouldbesegregatedfrominformationmadedirectlyaccessibletothepublic.Therearedifferentwaystosegregaterecords.Someagenciesandorganizationsarecreatingdedicatedinformationdisseminationsystems(suchasbulletinboardsorWorldWideWeb%%-#World Wide Webn-%%servers)tosupportthisfunction.Thesesystemscanbeontheoutsideofsecuregatewayswhichprotectinternalagencyrecordsfromoutsideaccess. (#(# 0  0(#(#Inordertosecureapplicationsthatallowdirectpublicaccess%%+!public access+%%,conventionaltechniquessuchasleastprivilege%%/%least privileget/%%(limitingtheprocessingcapabilityaswellasaccesstodata)andintegrityassurances(suchascheckingforviruses,clearlylabelingtheageofdata,orperiodicallyspotcheckingdata)shouldalsobeused.Additionalguidanceonsecuringpublicaccess%%+!public access+%%systemsisavailablefromNISTComputerSystemsLaboratoryBulletin"SecurityIssuesinPublicAccess%%+!Public Access+%%Systems"(May,1993). (#(# 0  3)  ReviewofApplication%%'Application'%%Controls.Atleasteverythreeyears,anindependentrevieworaudit%%auditt%%ofthe 7. securitycontrols%%3)security controlsb3%%foreachmajorapplication%%3)major applicationb3'applicationt'%%shouldbeperformed.Becauseofthehigherriskinvolvedinmajorapplications,therevieworaudit%%auditt%%shouldbeindependentofthemanagerresponsiblefortheapplication%%'applicationt'%%.Suchreviewsshouldverifythatresponsibilityforthesecurityoftheapplication%%'applicationt'%%hasbeenassigned,thataviablesecurityplan%%+!security plano+%%fortheapplication%%'application'%%isinplace,andthatamanagerhasauthorizedtheprocessingoftheapplication%%'application'%%.AdeficiencyinanyofthesecontrolsshouldbeconsideredadeficiencypursuanttotheFederalManager'sFinancialIntegrityActandOMBCircularNo.A123%%A123t%%,"ManagementAccountabilityandControl." (#(# 0  Thereviewenvisionedhereisdifferentfromthesystemtestandcertification%%+!certificationo+%%processrequiredinthecurrentAppendix.Thatprocess,however,remainsusefulforassuringthattechnicalsecurityfeaturesarebuiltintocustom-developedsoftwareapplications.WhilethecontrolsinthatprocessarenotspecificallycalledforinthisAppendix,theyremaininBulletinNo.90-08%%90-08c%%,andarerecommendedinappropriatecircumstancesastechnicalcontrols. (#(# 0  4)  AuthorizeProcessing.Amajorapplication%%3)major applicationb3'applicationt'%%shouldbeauthorizedbythemanagementofficial  " responsibleforthefunctionsupportedbytheapplication%%'applicationt'%%atleasteverythreeyears,butmoreoftenwheretheriskandmagnitudeofharmishigh.Theintentofthisrequirementistoassurethattheseniorofficialwhosemissionwillbeadverselyaffectedbysecurityweaknessesintheapplication%%'applicationt'%%periodicallyassessesandacceptstheriskofoperatingtheapplication%%'applicationt'%%.Theauthorizationshouldbebasedontheapplication%%'applicationt'%%securityplan%%+!security plano+%%andanyreview(s)performedontheapplication%%'application'%%.Itshouldalsotakeintoaccounttherisksfromthegeneralsupportsystemsusedbytheapplication%%'application'%%. (#(# &  4.  AssignmentofResponsibilities.TheAppendixassignsgovernment-wideresponsibilitiestoagencies '#* thatareconsistentwiththeirmissionsandtheComputerSecurityAct%%;1Computer Security Actt;%%.''' 0  a.  DepartmentofCommerce.TheDepartmentofCommerce,throughNIST,isassignedthe [*R&- followingresponsibilitiesconsistentwiththeComputerSecurityAct%%;1Computer Security Actt;%%. (#(# 0  0(#(#1)  Developandissuesecuritystandardsandguidance.,(0(#(#  -)1 0  0(#(#2)  Reviewandupdate,withassistancefromOPM%% OPM"%%,theguidelinesforsecuritytraining%%!training!%%issuedin   1988pursuanttotheComputerSecurityAct%%;1Computer Security Act;%%toassuretheyareeffective. (#(# 0  0(#(#3)  ReplaceandupdatethetechnicalplanningguidanceintheappendixtoOMBBulletin90-08%%90-08r%%  Thisshouldincludeguidanceoneffectiverisk-basedsecurityabsentaformalriskanalysis%%+!risk analysist+%%. (#(# 0  0(#(#4)  Provideagencieswithguidanceandassistanceconcerningeffectivecontrolsforsystemswhen %  interconnectingwithothersystems,includingtheInternet%%!Internets!!Internets!%%.Suchguidanceon,forexample,so-called"firewalls%%#firewallsi#%%"isbecomingwidelyavailableandiscriticaltoagenciesastheyconsiderhowtointerconnecttheircommunicationscapabilities. (#(# 0  0(#(#5)  Coordinateagencyincidentresponseactivities.Coordinationofagencyincidentresponse g ^  activitiesshouldaddressboththreatsandvulnerabilitiesaswellasimprovetheabilityoftheFederalgovernmentforrapidandeffectivecooperationinresponsetoserioussecuritybreaches. (#(# 0  0(#(#6)  AssesssecurityvulnerabilitiesinnewinformationtechnologiesandappriseFederalagencies   ofsuchvulnerabilities.Theintentofthisnewrequirementistohelpagenciesunderstandthesecurityimplicationsoftechnologybeforetheypurchaseandfieldit.Inthepast,therehavebeentoomanyinstanceswhereagencieshaveacquiredandimplementedtechnology,thenfoundoutaboutvulnerabilitiesinthetechnologyandhadtoretrofitsecuritymeasures.Thisactivityisintendedtohelpavoidsuchdifficultiesinthefuture. (#(# 0  b.  DepartmentofDefense.TheDepartment,throughtheNationalSecurityAgency%%A7National Security Agency1A%%,shouldprovide  technicaladviceandassistancetoNIST,includingworkproductssuchastechnicalsecurityguidelines,whichNISTcandrawuponfordevelopingstandardsandguidelinesforprotectingsensitiveinformationinFederalcomputers. (#(# 0  Also,theDepartment,throughtheNationalSecurityAgency%%A7National Security Agency1A%%,shouldassistNISTinevaluatingvulnerabilitiesinemergingtechnologies.Suchvulnerabilitiesmaypresentarisktonationalsecurityinformationaswellastounclassifiedinformation. (#(# 0  c.  DepartmentofJustice%%;1Department of Justice;%%.TheDepartmentofJustice%%;1Department of Justice;%%shouldprovideappropriateguidancetoFederal of agenciesonlegalremediesavailabletothemwhenserioussecurityincidents%%5+security incidentse5%%occur.Suchguidanceshouldincludewaystoreportincidentsandcooperatewithlawenforcement. (#(# 0  Inaddition,theDepartmentshouldpursueappropriatelegalactionsonbehalfoftheFederalgovernmentwhenserioussecurityincidents%%5+security incidentse5%%occur. (#(# & h 0  d.  GeneralServicesAdministration.TheGeneralServicesAdministrationshouldprovideagencies e$\ & guidanceforaddressingsecurityconsiderationswhenacquiringinformationtechnologyproductsorservices.Thiscontinuesthecurrentrequirement. (#(# 'he$: 0  Inaddition,wherecost-effectivetodoso,GSAshouldestablishgovernment-widecontractvehiclesforagenciestousetoacquirecertainsecurityservices.Suchvehiclesalreadyexistforprovidingsystemback-up%%back-upi%%supportandconductingsecurityanalyses. (#(# 0  GSAshouldalsoprovideappropriatesecurityservicestoassistFederalagenciestotheextentthatprovisionofsuchservicesiscost-effective.Thisincludesproviding,inconjunctionwiththeDepartmentofDefenseandtheDepartmentofCommerce,appropriateserviceswhichsupportFederaluseoftheNationalInformationInfrastructure%%WMNational Information InfrastructureW%%(e.g.,useofdigitalsignaturetechnology).-)1(#(# Ї0  e.  OfficeofPersonnelManagement%%MCOffice of Personnel ManagementM%%.InaccordancewiththeComputerSecurityAct%%;1Computer Security Acta;%%,OPM%% OPMt%%should   reviewitsregulationsconcerningcomputersecuritytraining%%!traininge!%%andassurethattheyareeffective. (#(# 0  Inaddition,OPM%% OPMi%%shouldassisttheDepartmentofCommerceinthereviewandupdateofitscomputersecurityawareness%%#awarenessc#%%andtraining%%!training!%%guidelines.OPM%% OPMi%%workedcloselywithNISTindevelopingthecurrentguidelinesandshouldworkwithNISTinrevisingthoseguidelines. (#(# 0  f.  SecurityPolicyBoard.TheSecurityPolicyBoardisassignedresponsibilityfornationalsecurity   policycoordinationinaccordancewiththeappropriatePresidentialdirective.Thisincludespolicyforthesecurityofinformationtechnologyusedtoprocessclassified%%%classifiedu%%%information. (#(# 0  CircularA130%%A130i%%andthisAppendixdonotapplytoinformationtechnologythatsupportscertaincriticalnationalsecuritymissions,asdefinedin44U.S.C.3502(9)and10U.S.C.2315.Policyandproceduralrequirementsforthesecurityofnationalsecuritysystems(telecommunications%%5+telecommunicationst5%%andinformationsystemsthatcontainclassified%%%classifieda%%%informationorthatsupportthosecriticalnationalsecuritymissions(44U.S.C.3502(9)and10U.S.C.2315))isassignedtotheDepartmentofDefensepursuanttoPresidentialdirective.TheCircularclarifiesthatinformationclassified%%%classifieda%%%fornationalsecuritypurposesshouldalsobehandledinaccordancewithappropriatenationalsecuritydirectives.Whereclassified%%%classifieda%%%informationisrequiredtobeprotectedbymorestringentsecurityrequirements,thoserequirementsshouldbefollowedratherthantherequirementsofthisAppendix. (#(# 5.  Reports%%Reportsd%%.TheAppendixrequiresagenciestoprovidetworeports%%reportsd%%toOMB:  Thefirstisarequirementthatagenciesreportsecuritydeficiencies%%)deficienciesi)%%andmaterialweaknesseswithintheirFMFIA%%FMFIAn%%reportingmechanismsasdefinedbyOMBCircularNo.A123%%A123n%%,"ManagementAccountabilityandControl,"andtakecorrectiveactionsinaccordancewiththatdirective.Thesecond,definedbytheComputerSecurityAct%%;1Computer Security Acta;%%,requiresthatasummaryofagencysecurityplansbeincludedintheinformationresourcesmanagementplanrequiredbythePaperworkReductionAct%%?5Paperwork Reduction Acte?%%.   @(ThisPageIntentionallyLeftBlank)  yp  i A!"!  &&  INDEX#N ##&&~N # N  X A&-) xdME7xA 8 rN %%%  ac0  0(#(#     31U.S.C.3512#7(#.` ` (#(##%%%%%%G7,G9,G14,G15%%%%%% a 31U.S.C.9106!!G(#.` ` %%%%%%G16%%%%%% ; 8816A(#.\\%%%%%%G22,G23%%%%%% m 900844)(#.\\%%%%%%Bib6,G22,G23,G26,G28-G30%%%%%% G Accreditation (#.%%%%%%16,24,26-29,31,32,36-310,312,41,42,46,49-411,Glos1,Glos2, !     (#Glos5,Glos9,Glos18,Glos19,Glos21,Bib2,Bib7,D3,G27%%%%%%Acquisition$$(#.%%%%%%24,28,210,31,32,312,Bib9,D3,G11,G12,G21%%%%%%  }  AdequateSecurityBB(#. %%%%%%11-13,Glos2,Glos15,B3,G17-G19,G22-G24,G27%%%%%%  W  AISOwnerll;(#.%%%%%%27,31,Glos2%%%%%%  1  Application (#.%%%%%%12,13,25,26,28,34,36,37,311,312,48,412,Glos2,Glos3,Glos11, c  X X (#Glos15,Glos18,Glos19,D2-E4,G17,G19,G20,G22,G23,G27-G29%%%%%%ApplicationOwner4(#.@ @ %%%%%%Glos2,Glos3,Glos19%%%%%%   Approval..(#.ll%%%%%%34,37-39,312,43,412,413,Glos1,Glos4%%%%%%   Audit (#.PP%%%%%%28,44,47,Glos3,C1,E4,F2,G3,G10,G12,G14,G20,G26,G28,G29%%%%%% s AuthorityX X (#.~~%%%%%%21-23,25,210-212,31,311,410,412,Glos1-Glos3,Glos8,Glos9,Glos18, M !(#Glos19,A1,A2,E1-G3,G7,G9,G11%%%%%%Availability> > (#.%%%%%%12,34,Glos2,Glos4,Glos6-Glos8,B2,C1,D2,G17,G23,G26,G28%%%%%% Y Awareness (#.%%%%%%22,23,31,310,311,Bib6,D3,E1-E3,G20,G21,G24,G25,G31%%%%%% 3 A123$$(#.%%%%%%Bib2,Bib7,G1,G7,G17,G19-G21,G26,G29,G31%%%%%%   A127:(#.%%%%%%Bib6,G12,G15%%%%%%  A130..(#.%%%%%%11,310,Glos2,Glos12,Glos15,Glos20,G13,G16,G17,G31%%%%%% i Backup5(#.%%%%%%G21,G25,G28,G30%%%%%% C Bacteria3(#.%%%%%%Glos4,Glos15,Glos25%%%%%% u BusinessImpactAnalysis4"4"H(#.  "%%%%%%34%%%%%% O C2rr(#. %%%%%%23,26,29,210,43,44,46,47,Glos5,Glos7,Glos8,Glos10,Glos16,Glos17, ) XX((#Glos22-Glos24,C1,C2,F1,F2%%%%%%Certification (#.VV%%%%%%14,27,28,31,32,36-38,312,46,410,411,Glos1,Glos5,Glos20,Bib2,  **5(#Bib7,D3,G27,G29%%%%%%CFO88<(#. %%%%%%G3,G11,G15%%%%%% 9 ChiefFinancialOfficers(CFOs)Act " "H(#.bb-%%%%%%G2%%%%%% k  Classification00(#.%%%%%%13,410,411,Glos5-Glos7,Glos15,Glos24,F1%%%%%% E! Classified (#.%%%%%%13,16,38,43,411,51,Glos6,Glos7,Glos10,Glos15,Glos22,Bib1,Bib3,  " JJ/(#Bib9,C1,G12,G21,G31%%%%%%Clear0(#.HH%%%%%%44,G10,G12,G18,G19%%%%%% !{$ Clearingff5(#.22%%%%%%410,Glos6,C1,C2%%%%%% "U % CommercialL L (#.DD%%%%%%12,37,46,413,Glos2,Glos3,Glos6,Glos7,Glos23,Bib7,A1,E2%%%%%% #/!& Commissioner-(#.%%%%%%III,21,23,25,26,Bib8%%%%%% a$ "' ComputerSecurityAct (#.r r %%%%%%310,Glos5,Glos6,Glos19,Glos22,Bib2,Bib8,E1,G13,G17, ;%"( ^^7(#G22-G24,G29-G31%%%%%%ComputerSecurityIncidentResponse!!F(#.-%%%%%%Bib9%%%%%% &$* COMSEC)(#.%%%%%%15,414,Glos6,Bib3,A1,E2%%%%%% 'q%+ Confidentiality (#.  %%%%%%12,Glos2,Glos6,Glos7,Glos16,C1-D3,G17,G23,G28%%%%%% (K&, ConfigurationManagementLL&(#. "%%%%%%28,39,311,46,49,Glos7,D3%%%%%% })%'- Contingency(#.^^%%%%%%14,25,27,31,Glos7,Glos8,Glos10,Bib6,D3,G19,G28%%%%%% W*'. ContingencyPlan0(#. %%%%%%411,Glos7,Glos10,G28%%%%%% 1+(/ ContinuityofOperations6(#. "%%%%%%34,42,Glos7,E4%%%%%%  ,)0 ContinuityofSupportA(#.  %%%%%%G18,G25%%%%%% ,*1 ContractingOfficer!!G(#.h h %%%%%%312%%%%%% -g+2 Copyrightvv?(#.%%%%%%49,Glos13%%%%%%   COTR!!G(#.%%%%%%312%%%%%%  COTS((#.%%%%%%37,46,413,Glos6,Glos7,A1%%%%%%  CSIRC* * A(#.%%%%%%27,Bib9%%%%%%  CustomsProcess C(#. %%%%%%26,31%%%%%% qh DataBase@(#.%%%%%%15,Glos5%%%%%% KB DataEncryptionStandard"";(#.B B "%%%%%%Glos9,A1,C3%%%%%% %  DedicatedSecurityMode,(#.  !%%%%%%37,38,412,Glos9,Glos23%%%%%%   Deficiencies(#.FF%%%%%%37,39,G3-G6,G10,G12-G15,G21,G26,G31%%%%%%   DepartmentofJustice.(#.  %%%%%%Bib6,G18,G21,G25,G30%%%%%%    Diagnostic!!G(#.%%%%%%410%%%%%%    Dialupbb8(#.%%%%%%35,410,C1,C3%%%%%% g ^  Directorff(#.$$%%%%%%11,23,310,413,E1,G2,G6,G7,G15,G16,G21%%%%%% A8  Disaster (#.%%%%%%14,25,31-34,311,42,Glos4,Glos7,Glos8,Glos10,Glos19,Glos23%%%%%%   DiscretionaryAccessControl2(#.R R &%%%%%%44,Glos8,Glos10,C2%%%%%%   Distribution (#.,,%%%%%%III,28,Glos14,Glos16,Glos21,Bib5,Bib8,B3,G5,G15%%%%%%   Education8(#.%%%%%%22,23,31,310%%%%%%   Emergency (#.%%%%%%27,29,32-34,Glos7,Glos10,Glos11,Glos19,Glos20,Glos25,D3%%%%%% z Encryption (#.%%%%%%210-212,44,47,Glos5-Glos9,Glos11,Glos12,Glos14,Glos16,Glos20, ]T -(#Glos22,Bib6,Bib7,A1-C3%%%%%%Environmental3(#.%%%%%%311,41,42,B1,D3%%%%%%  EPL6(#. %%%%%%46,Glos11,Glos25%%%%%%  EvaluatedProductsList6(#. !%%%%%%46,Glos11,Glos25%%%%%%  ExecutiveOrderdd9(#. %%%%%%Glos21,A1,G10%%%%%%  ExemptionP P B(#.%%%%%%310,C1%%%%%% yp Facility6 6 (#.%%%%%%15,24,28,29,34-36,39,312,41,42,47,Glos19,Bib6,Bib7,Bib9%%%%%% SJ Facsimile!!G(#.||%%%%%%413%%%%%% -$ FAXJ J B(#.$$ %%%%%%413,G1%%%%%%  FederalBureauofInvestigation<(#. )%%%%%%III,Bib6,A1%%%%%%  FederalManagers'FinancialIntegrityAct'(#.  3%%%%%%G1,G5,G7,G9,G19,G20,G26%%%%%%  Firewalls3(#.dd%%%%%%Bib1,Bib3,G28,G30%%%%%%  FMFIA((%(#.%%%%%%Bib6,G1,G6,G9,G19,G21,G31%%%%%% of FOIA+(#.``%%%%%%13,15,49,Bib3,Bib9,A1%%%%%% I@  FreedomofInformation(#. %%%%%%13,15,49,Glos22,Bib2,Bib3,Bib9,A1%%%%%% # ! GeneralAccountingOffice=(#. #%%%%%%A1,G3,G11%%%%%%  " GeneralSupportSystem(#. %%%%%%34,310,Glos12,D2,G17-G19,G22-G25,G27,G28%%%%%% !# GovernmentCorporationandControlAct!!G(#.0%%%%%%G16%%%%%% "$ GovernmentPerformanceandResultsAct=(#.0%%%%%%G2,G9,G13%%%%%% #% IGRR3(#.pp %%%%%%G2,G3,G5,G11-G15%%%%%% e$\ & IncidentResponseCapability:(#.0 0 &%%%%%%Bib9,G18,G25%%%%%% ?%6!' IndividualAccountability/(#.  #%%%%%%G19,G24,G25,G28,G29%%%%%% &"( InformationSharingA(#. %%%%%%G20,G28%%%%%% &") InspectorGeneral" " B(#. %%%%%%G2,G10%%%%%% '#* InternalAffairshh>(#.0 0 %%%%%%25,27,51%%%%%% ($+ InternalControls1(#. %%%%%%G3,G7,G10,G11,G13%%%%%% )x%, Internethh (#.%%%%%%III,413,Glos14,Glos26,Bib1-Bib3,G1,G8,G24,G30%%%%%% [*R&- IRM(#.   %%%%%%13-25,39,310,312,Bib3,A1,G13,G18,G19%%%%%% 5+,'. Labels!!G(#.%%%%%%411%%%%%% ,(/ LeastPrivilege-(#.  %%%%%%44,Glos15,G19,G25,G29%%%%%% ,(0 Licenser r B(#.%%%%%%49,413%%%%%% -)1 LifeCycle  (#.%%%%%%13,28,312,46,Glos7,Glos10,Glos13,Glos20%%%%%%   Maintenance(#.hh%%%%%%13,28,33,311,43,49-Glos11,Glos13,G25%%%%%%  MajorApplication (#.  %%%%%%25,37,Glos2,Glos15,D2,G17,G19,G22,G23,G27-G29%%%%%%  MaliciousCode(#.L L %%%%%%49,51,Glos4,Glos15,Glos24-Glos26,B3%%%%%%  Manualprocedures!!G(#.N N %%%%%%G25%%%%%% qh MaterialWeakness88<(#.B B %%%%%%G4,G13,G14%%%%%% KB MISSI&(#.%%%%%%44-Glos6,Glos11,Glos12,Glos16%%%%%% %  Monitoringll2(#.%%%%%%45,47,G4,G12,G14%%%%%%   MOU6(#.bb %%%%%%211,410,413,A1%%%%%%   NationalInformationInfrastructure6(#.-%%%%%%412,413,A2,G30%%%%%%    NationalSecurityAgency+(#.8 8 "%%%%%%III,Glos16,Glos25,A2,G30%%%%%%    Networks (#.%%%%%%11,21-33,38,44,45,412,413,51,Glos12,Glos16,Glos22,C1%%%%%% g ^  NISTHandbook:(#. %%%%%%Bib5,G22,G24%%%%%% A8  NonCustoms.(#.%%%%%%11,43,45,411-413,51%%%%%%   ObjectReusebb(#.%%%%%%44,Glos6,Glos7,Glos17,Glos19,Bib5,C2%%%%%%   OfficeofManagementandBudget(#.)%%%%%%III,11,16,35,A2,G1,G7,G16,G17%%%%%%   OfficeofPersonnelManagementRR(#.ZZ(%%%%%%III,11,Bib8,A2,E1,G17,G21,G24,G31%%%%%%   OPM(#.BB %%%%%%11,Bib8,A2,E1,G17,G18,G20,G24,G30,G31%%%%%% z OrangeBook  (#.%%%%%%Glos10,Glos17,Glos23,Glos24,Bib3,A2%%%%%% ]T OversightR R (#.%%%%%%III,12-14,22,23,25,31,311,312,Glos15,Bib7,G12,G15,G17,G23%%%%%% 7. PAA(#.   %%%%%%23,25,410,412,Glos2,Glos8,Glos9,Glos18,A2%%%%%%  PaperworkReductionAct"(#.B B !%%%%%%Bib7,G16,G18,G19,G22,G23,G31%%%%%%  Password66(#.vv%%%%%%44,47,Glos18,Bib5,Bib7,B2,B4,C1,C2,G22,G24,G26%%%%%%  PBXFF5(#. %%%%%%414,Glos18,A2-B4%%%%%%  Personallyowned7(#. %%%%%%412,Glos18,Bib9%%%%%% yp PhysicalSecurity'(#. %%%%%%29,34,41,Glos18,Bib5,Bib8%%%%%% SJ Portable\ \ B(#.%%%%%%410,B1%%%%%% -$ PrincipalAccreditingAuthority!(#. )%%%%%%23,25,410,412,Glos2,Glos18,A2%%%%%%  PrivacyAct (#.((%%%%%%13,15,26,49,51,Glos18,Glos21-Glos23,Bib2,Bib3,Bib5,Bib6,A2%%%%%%  PrivateBranchExchange:(#.  !%%%%%%Glos18,A2,B3%%%%%%  ProcessOwner%(#.  %%%%%%25,31,43,Glos2,Glos3,Glos19%%%%%%  PublicAccess;(#.%%%%%%G20,G28,G29%%%%%% of Recovery (#.xx%%%%%%14,25,31-34,311,Glos4,Glos7,Glos10,Glos19,Glos23,Bib5,G26%%%%%% I@  RedBook!!F(#.%%%%%%Bib1%%%%%% # ! Remanence**'(#.  %%%%%%Glos6,Glos17,Glos19,Bib1,C2%%%%%%  " Reports%(#.%%%%%%Glos3,B3-G6,G12-G15,G21,G31%%%%%% !# ResidualData,,4(#.%%%%%%44,410,Glos17,C1%%%%%% "$ ResidualRisk/(#.%%%%%%24,35,39,310,Glos19%%%%%% #% Reusebb(#.pp%%%%%%44,Glos6,Glos7,Glos17,Glos19,Bib5,C2%%%%%% e$\ & RiskAnalysis(#.%%%%%%34-36,41,42,44,411,Glos4,Glos20,C2,D3,G30%%%%%% ?%6!' RiskAssessment)(#. %%%%%%35,Glos20,Bib3,C1-F2,G22%%%%%% &"( RiskManagement  (#. %%%%%%21,24,31,32,34,35,Glos20,E3,E4,F2,G22%%%%%% &") RulesofBehaviorff0(#. %%%%%%311,G18,G24,G26-G28%%%%%% '#* RulesoftheSystem5(#. %%%%%%310,G18,G24,G26%%%%%% ($+ SBU(#.   %%%%%%12,38,411,412,Glos7,Glos15-Glos17,Glos21,Glos22,A2,C1,C3,E2,F1%%%%%% )x%, SDLC:(#.%%%%%%15,25-46,A2%%%%%% [*R&- SecurityControls (#. %%%%%%12,210,41,47,49,411,Glos10,Glos21,B3,G18,G20,G22-G24, 5+,'. B(#G26-G29%%%%%%SecurityFeaturesUsersGuide C(#. (%%%%%%47,A2%%%%%% ,(0 SecurityIncidentsDD'(#. %%%%%%25,27,29,51,G21,G25,G30%%%%%% -)1 SecurityMode%(#.%%%%%%37-39,412,Glos1,Glos9,Glos23%%%%%%   SecurityPlanJ J (#.%%%%%%22,25,29,32,33,39,310,44-49,411,D1,D2,G18-G20,G23,G24,  ;(#G26,G27,G29%%%%%%SecurityPractices=(#. %%%%%%414,B1,E5%%%%%%  SecurityProgramsDivision5(#. $%%%%%%15,24,39,41-A2%%%%%% qh SecurityStaff!!G(#.%%%%%%G27%%%%%% KB SensitiveButUnclassifiedRR(#.J J $%%%%%%12,411,412,Glos5,Glos15,Glos17,Glos21,Glos22,A2,F1%%%%%% %  SeparationofDuties+(#. %%%%%%G3,G4,G12,G19,G25,G28%%%%%%   SFUG C(#.%%%%%%47,A2%%%%%%   Site(#.%%%%%%28,29,34,41,49,410,Glos22,Bib3%%%%%%    Skipjack||(#...%%%%%%Glos5,Glos6,Glos9,Glos10,Glos12,Glos20,Glos22%%%%%%    SPD&&)(#. %%%%%%15,24,39,310,312,41-A2%%%%%% g ^  SteeringCommittee8(#.| | %%%%%%13,23,31,311%%%%%% A8  StrategicIRMPlan:(#.N N %%%%%%Bib3,G18,G19%%%%%%   SystemHighSecurityModezz<(#. #%%%%%%Glos9,Glos23%%%%%%   SystemsDevelopmentLifeCycle  :(#.pp(%%%%%%15,Bib2,Bib3%%%%%%   TCBff?(#. %%%%%%Glos24,F2%%%%%%   TCSEC""(#.%%%%%%43-Glos5,Glos7,Glos8,Glos10,Glos17,Glos19,Glos22-Glos24,Bib3,Bib7,A2%%%%%% z Telecommunications4 4 (#. %%%%%%13,16,43,412-414,Glos1,Glos6,Glos16,Bib2,Bib3,Bib6,Bib9, ]T 8(#A2,B3,C1,G31%%%%%%Tempest6(#.((%%%%%%16,Glos11,Glos24%%%%%%  Testingxx(#.%%%%%%13,31,34,37,38,46,Bib5,C2-G4,G26,G28%%%%%%  TFM C(#.44 %%%%%%47,A2%%%%%%  TradeCommunity(#. %%%%%%III,11,12,14,211,212,43,48,Glos3%%%%%%  Training(#.00%%%%%%14,22,23,27,210-212,31,310-312,43,Bib2,Bib6,Bib8,D3,E1-E3,G18- yp )(#G21,G24,G25,G28,G30,G31%%%%%%TrojanHorse3(#.%%%%%%Glos4,Glos15,Glos24%%%%%% -$ TrustedComputerBaseff?(#. %%%%%%Glos24,F2%%%%%%  TrustedComputerSystemEvaluationCriteria(#.5%%%%%%43,44,Glos10,Glos17,Glos19,Glos23,Bib3,  ..;(#Bib6-Bib8,A2%%%%%%TrustedFacilityManual4"4"H(#. !%%%%%%47%%%%%%  VendorRR>(#.%%%%%%45,46,B2%%%%%% of Violations/(#.%%%%%%12,25,51,E3,E5,F1%%%%%% I@  Virus(#.LL%%%%%%25,27,49,51,Glos4,Glos15,Glos25,Bib8,Bib9,B3,G26%%%%%% # ! VitalRecords``2(#.%%%%%%Glos11,Glos20,Glos25%%%%%%  " VoiceJJ4(#.ff%%%%%%13-44,414,B3,B4%%%%%% !# WaiverJJ7(#.%%%%%%310,41,43,412%%%%%% "$ WarningBanner C(#. %%%%%%44,45%%%%%% #% WorkatHomeA(#. %%%%%%411,G24%%%%%% e$\ & WorldWideWeb""*(#. %%%%%%III,Glos26,A2,G1,G8,G29%%%%%% ?%6!' Worm3(#.%%%%%%Glos4,Glos15,Glos26%%%%%% &"( acO upd  O %%%%%  &")  i #  &&  7NNXXdIXXd7ReadersCommentForm#3 ##&& #   X A&-) xdE7xA 8 R Title:0  0(#(# AUTOMATEDINFORMATIONSYSTEMSSECURITYPOLICYMANUAL a(#(# 0  0(#(#0(#(#CISHB%%140005 (#(# 0  0(#(#0(#(#U.S.CustomsService (#(# 0  0(#(#0(#(#OfficeofInformationandTechnology (#(# 0  0(#(#0(#(#AutomatedInformationSystemsSecurityDivision (#(# 0  0(#(#0(#(#7681BostonBlvd. (#(# 0  0(#(#0(#(#Springfield,VA.22153 (#(# Attention:0  Mr.TomBovassoorAISSecurityAdministration. 5 (#(# DearReader:Youmayusethisformtocommunicateyourcommentsaboutthispublication,itsorganization,orsubjectmatterwiththeunderstandingthattheU.S.CustomsServicemayuseordistributewhateverinformationyousupplyinanywayitbelievesappropriatewithoutincurringanyobligationtoyou.Thankyouforyourcooperation.