-
Notifications
You must be signed in to change notification settings - Fork 15
/
Copy pathac_low_impact_pri1.yaml
237 lines (179 loc) · 9.98 KB
/
ac_low_impact_pri1.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
id: ac_low_impact_pri1
name: NIST 800-53 AC Low Impact Priority 1
milestone: Access Control
issues:
- title: As the CIO, I want to document and communicate our organization's approach to managing access control mechanisms in our IT systems.
body: |
*Why:*
Access control is central to security compliance, and maintaining sensible rules for what classes of users have access to what types of systems will ensure lasting security for organizational systems.
*How:*
* Define roles in addition to ISSO or ISSM that the access control policy is to be disseminated to. (State if there are no additional roles)
* Define roles in addition to ISSO or ISSM that the access control procedures are to be disseminated to. (State if there are no additional roles)
* Ensure that the access control policy and procedures are disseminated
* Define frequency at which to review and update the access control policy and procedures (Annually).
* Maintain audit trail of reviews and updates.
*Acceptance Criteria / Evidence:*
* List of personnel to whom access control policy and procedures are to be disseminated
* Access control policy
* Access control policy version update page
* Access control policy audit trail of reviews and updates
*Links:*
* https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-1
labels:
- AC
- AC-1
- security
- compliance
- title: As the CIO, I want to ensure system accounts are identified, approved, assigned, monitored, and reviewed in accordance with organizational policy.
body: |
*Why:*
Having a robust process for the creation and review of IT system accounts ensures that users, and their privileges, are appropriately segmented in the organization.
*How:*
* Define types of accounts that exist within an organizational structure (eg. individual, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service).
* Nominate account managers for existing/future IT system accounts.
* Define conditions for group and role membership.
* Assign appropriate access and roles to existing accounts..
* Define roles to approve new IT system accounts.
* Manage existing and new accounts with defined policy (create, enable, modify, disable, and remove).
* Monitor account access across IT systems.
* Notify account managers when accounts are outdated, when users are no longer in the organization, or when system requirements change.
* Authorize access in accordance with authorization, intended use, and associated organizational goals.
* Review accounts at a defined frequency and evaluate compliance with account requirements.
* Define process for issuing group based credentials when individual accounts
*Acceptance Criteria / Evidence:*
* List of types of accounts within an organization
* List of account managers for each IT system
* List of conditions for membership in each group and role
* Logs of the process in which existing accounts have been assigned roles
* List of personnel who approve new accounts for each system
* Logs of IT system account access
* Logs of communication with account managers when account roles and requirements change
* Logs of process to allow access or a new account to IT systems
* Logs of existing account review
* Documented process for re-issuance of group-based credentials upon member change
*Links:*
* https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-2
labels:
- AC
- AC-2
- security
- compliance
- title: As the CIO, I want to not only enforce access control policies for IT systems, but also apply them to applications and services that exist on those systems.
body: |
*Why:*
Applications and services that run on IT systems present an equal, if not greater, danger to organizational security if left unexamined.
*How:*
* Apply access control policies to applications and services that run on IT systems.
*Acceptance Criteria / Evidence:*
* Retain equivalent documentation of access control methods for individual applications that you do for IT systems themselves.
*Links:*
https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-3
labels:
- AC
- AC-3
- security
- compliance
- title: As the CIO, I want to ensure that users are notified of privacy and security concerns when they are logging into or using U.S. Government systems.
body: |
*Why:*
Users interacting with U.S. Government systems should be aware of potential privacy and security concerns.
*How:*
* Display in notice or banner that users are accessing a U.S. Government system
* Display in notice or banner that usage may be monitored, recorded, and subject to audit
* Display in notice or banner that unauthorized usage may incur civil and criminal charges
* Display in notice or banner that system usage implies consent to these policies
* If the system is publicly accessible, inform user of the acceptable uses and potential for monitoring, audits, etc.
* Display the notice or banner until the user acknowledges it
*Acceptance Criteria / Evidence:*
* List of systems and their user privacy and security concerns
* Notice or banner alerts user of relevant information
* Notice or banner continues to display until user acknowledges it
*Links:*
* https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-8
labels:
- AC
- AC-8
- security
- compliance
- title: As the CIO, I want to create guidelines for different types of remote connections to IT systems and authorize the granting of those connections.
body: |
*Why:*
Different types of remote access present unique security concerns. Documenting the individual requirements for each type, and ensuring that authorization is granted accordingly, is key in maintaining organizational security.
*How:*
* Define acceptable types of remote access
* Define restriction, configuration and implementation details for each type of access
* Authorize the granting of remote connection access
*Acceptance Criteria / Evidence:*
* List of organization approved remote access types
* Remote access policy
* Remote access authorization policy
*Links:*
* https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-17
labels:
- AC
- AC-17
- security
- compliance
- title: As the CIO, I want to create guidelines for wireless access to IT systems and authorize the granting of those connections.
body: |
*Why:*
Wireless access to IT systems by definition can be intercepted, and as a result, present security concerns. Documenting the requirements for wireless access, and ensuring that authorization is granted accordingly, is key in maintaining organizational security.
*How:*
* Define restriction, configuration and implementation details of wireless access
* Authorize the granting of wireless access to IT systems
*Acceptance Criteria / Evidence:*
* Wireless access policy
* Wireless access authorization policy
*Links:*
* https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-18
labels:
- AC
- AC-18
- security
- compliance
- title: As the CIO, I want to create guidelines for organizational mobile devices and authorize the connection of said mobile devices to IT systems.
body: |
*Why:*
The distribution of mobile devices within an organization is increasingly common, and as such, having an organizational policy controlling how those devices are used, updated, authenticated and tracked is now a critical task.
*How:*
* Define restriction, configuration, connection and implementation details for organization mobile devices
* Policy points that may be considered:
* Acceptable types of mobile devices (embedded systems, smartphones, tablets)
* Acceptable software on mobile devices (Apple iOS, Android, Blackberry, Windows)
* Required security applications
* Integrity / version checks
* Authorize the connection of mobile devices to IT systems
*Acceptance Criteria / Evidence:*
* Mobile device policy
* Mobile device connection authorization policy
*Links:*
* https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-19
labels:
- AC
- AC-19
- security
- compliance
- title: As the CIO, I want to document terms and conditions regarding external access to IT systems and the use of external systems by our organization.
body: |
*Why:*
External access to IT systems by contractors, other agencies, etc will inevitably be required in some situations and, similarly, organizational information will need to be dealt with on IT systems external to the organization. Drafting policies governing these cases is a critical step in maintaining strong security.
*How:*
* Document terms and conditions regarding access from external systems/devices. May include:
* Personally owned systems/devices
* Contractor owned systems/devices
* Federal agency owned systems/devices
* Document terms and conditions regarding the use of external systems/devices. May include:
* Software/Platform as a service
* Cloud-based hosting
* Document agencies/entities that may be trusted without additional terms and conditions
*Acceptance Criteria / Evidence:*
* External access policy
* External systems policy
* List of exempt agencies/entities (if any)
*Links:*
* https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-20
labels:
- AC
- AC-20
- security
- compliance