Part 10. Security, Privacy and Assurance

Chapter 8. Information Technology (IT) Security

Section 1. Policy and Guidance (Cont. 1)

10.8.1  Policy and Guidance (Cont. 1)

10.8.1.4 
Operational Controls

10.8.1.4.1 
Personnel Security

10.8.1.4.1.5  (11-25-2011)
Personnel Departures (Separation from Duty)

  1. The IRS shall implement and maintain procedures to ensure appropriate system accesses are revoked for employees/contractors who leave the IRS, are reassigned to other duties, on extended leave, or are under disciplinary actions. (NIST SP 800-53 PS-5)

    1. Accounts for IRS employees placed on Leave Without Pay (LWOP) while performing military duty shall adhere to the inactivity provisions in the Business Role Account Inactivity section of this IRM.

    2. IRS employees placed on furlough may be provided access to e-mail, intranet and internet only for usage during the furlough time-period.

  2. All appropriate personnel shall be notified promptly of all reassignments/transfers, promotions, terminations, or retirements of departing employees or contractors to ensure that accesses are removed.

  3. Access shall be suspended for any employee or contractor on extended leave or detail over 90 days.

    1. The employee's supervisor or Contracting Officer's Technical Representative (COTR) shall request reinstatement of access upon the return to active duty of the employee or contractor.

  4. The IRS shall implement procedures that require departing employees to return all forms of media used to gain system access to IRS media, personal electronic devices, keys, identification (ID) cards, proxy cards, and any other IRS property on their last workday. (NIST SP 800-53 PS-4)

  5. Each employee’s manager shall have the primary responsibility for notifying the responsible organization via OL5081, Automated Information System (AIS) User Registration/Change Request, of system user status changes (e.g., terminations, transfers, reclassifications).

    1. The responsible organization shall immediately suspend, cancel, and/or adjust all access privileges associated with changes in status of the user.

  6. The IRS shall implement and maintain periodic follow-up reviews and corrective action procedures to ensure timely adjustment of access privileges associated with transfers, terminations, and changes in contractual agreements with non-IRS entities. The procedures shall include, at a minimum:

    1. Review of inactive user IDs/accounts;

    2. Coordinated review of access control lists with information owners;

    3. Coordinated review of network, system, and resource access authority for non- IRS entities with responsible IRS business areas; and

    4. Setting of automated account expiration for non-IRS entities, where technically feasible, and when the access termination date can be predetermined.

  7. Employees shall be instructed whether or not to remove data from their computer before leaving. If cryptography is used to protect data, the availability of cryptographic keys to management personnel must be ensured.

10.8.1.4.1.5.1  (11-25-2011)
Personnel Termination

  1. Upon an individual’s (employee, contractor, etc.) termination, at a minimum, the IRS shall include the following procedures in their termination procedures (NIST SP 800-53 PS-4):

    1. Terminate information system access;

    2. Retrieve security-related IRS information system-related property (e.g., hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes);

    3. Brief on the continuing responsibilities for confidentiality and privacy;

    4. Retain access to IRS information and information systems formerly controlled by the terminated individual; and

    5. Conduct certificate revocation in accordance with IRM 10.8.52, Information Technology (IT) Security, PKI Security Policy.

  2. After an individual's termination, but before their departure, an exit interview shall take place to ensure all out processing/exit actions are completed and all IRS property and equipment is returned. (NIST SP 800-53 PS-4)

10.8.1.4.1.5.2  (11-25-2011)
Personnel Transfer

  1. Logical and physical access authorizations to information systems and facilities shall be reviewed when personnel are reassigned or transferred to other positions within the IRS. (NIST SP 800-53 PS-5)

  2. Transfer or reassignment actions shall be initiated in accordance with the OL5081 processes within five (5) business days of the formal transfer action. (NIST SP 800-53 PS-5)

    Note:

    Reviews and OL5081 process actions apply when the reassignment or transfer of an employee is permanent or of such an extended duration as to make the actions warranted.

10.8.1.4.1.6  (11-25-2011)
Disciplinary Action

  1. The IRS shall employ a formal sanctions process for personnel failing to comply with established information security policies and procedures. (NIST SP 800-53 PS-8)

    1. The sanctions process shall be consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

      Note:

      The process is described in access agreements and can be included as part of the general personnel policies and procedures for the IRS.

  2. IRS employees shall be subject to disciplinary action for failure to comply with IRS security policy, whether or not the failure results in criminal prosecution.

  3. All users (e.g., employees, non-IRS federal employees, and IRS contractors) who fail to comply with IRS security policy shall be subject to having their access to IRS information systems and facilities terminated, whether or not the failure results in criminal prosecution.

  4. Any person who improperly discloses sensitive information shall be subject to criminal and civil penalties and sanctions under the appropriate law (e.g., Privacy Act, Trade Secrets Act, and Bank Secrecy Act).

    1. Refer to the Sensitive But Unclassified (SBU) Information, Controlled Unclassified Information (CUI), and Personally Identifiable Information (PII) sections of this IRM for further guidance.

  5. The IRS shall establish procedures for disciplinary actions for security violations for employees, in accordance with applicable personnel and conduct regulations.

    1. Disciplinary actions shall take into account the sensitivity of the information involved, the impact of the offense, and the number of prior offenses.

  6. SATE and the Rules of Behavior for each system shall specify the disciplinary actions for security violations.

  7. The IRS shall adopt standard contract terms for addressing disciplinary action, consistent with the Federal Acquisition Regulations, which shall be incorporated into all contracts that permit contractor employees access to IRS information and information systems.

    1. Contract terms shall permit the government to exclude contractor employees from accessing IRS information and information systems.

  8. Suspected security violations shall be reported to the appropriate IRS personnel, depending on the type of incident (IT, personnel, etc.) for investigation and recommended disciplinary action.

10.8.1.4.1.7  (11-25-2011)
Third-Party Personnel Security

  1. Personnel security requirements, to include security roles and responsibilities, shall be established and document for third-party providers. (NIST SP 800-53 PS-7)

    Note:

    Third-party providers include, for example, service bureaus, contractors, and other organizations providing information system development, information technology services, outsourced applications, and network and security management.

  2. Personnel security requirements for third-party providers shall be monitored for compliance. (NIST SP 800-53 PS-7)

  3. Third-party personnel shall comply with the requirements outlined within the personnel security section of this IRM, and IRM 10.23.1, Personnel Security, IRM 10.23.2, Contractor Investigations, and IRM 10.23.3, Personnel Security/Suitability Program.

10.8.1.4.2  (05-03-2012)
Physical and Environmental Protection

  1. The IRS shall develop, disseminate, review, and update every three (3) years (or if there is a significant change) a formal, documented Physical and Environmental Protection Policy that addresses the following: (NIST SP 800-53 PE-1)

    • Purpose

    • Scope

    • Roles and Responsibilities

    • Management commitment

    • IRS coordination

    • Compliance

  2. The IRS shall develop, disseminate, review, and update annually procedures to facilitate the implementation of the Physical and Environmental Protection Policy and associated physical and environmental protection controls. (NIST SP 800-53 PE-1)

    1. The Physical and Environmental Protection Policy and procedures shall be consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

  3. Information system components entering and exiting a facility shall be controlled, recorded, maintained, and authorized by appropriate personnel. (NIST SP 800-53 PE-16)

    Note:

    Effectively enforcing authorizations for entry and exit of information system components may require restricting access to delivery areas and possibly isolating the delivery areas from the information system and media libraries.

  4. The IRS shall:

    1. Position information system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access. (NIST SP 800-53 PE-18) (M, H)

    2. Plan the location or site of the facility where the information system component resides with regard to physical and environmental hazards and for existing facilities, consider the physical and environmental hazards in its risk mitigation strategy. (NIST SP 800-53 PE-18 CE1) (H)

    Note:

    Physical and environmental hazards include, for example, flooding, fire, tornados, earthquakes, hurricanes, acts of terrorism, vandalism, electromagnetic pulse, electrical interference, and electromagnetic radiation. Whenever possible, consider the location or site of the facility with regard to physical and environmental hazards. In addition, consider the location of physical entry points where unauthorized individuals, while not being granted access, might nonetheless be in close proximity to the information system and therefore, increase the potential for unauthorized access to organizational communications (e.g., through the use of wireless sniffers or microphones).

  5. The physical removal of SBU information from IRS facilities must be approved by the AO.

  6. SBU information shall not be physically removed from IRS facilities prior to receiving documented approval from the AO.

  7. A clean desk policy shall be in place for the protection of taxpayer, privacy act, and other protected sensitive data and computer media (e.g., paper output, diskettes, etc.) to preclude unauthorized disclosures.

    1. See IRM 10.2.14, Methods of Providing Protection, for addition guidance.

  8. The IRS shall designate restricted IT areas that house IT assets such as, but not limited to, mainframes, servers, controlled interface equipment, associated peripherals, and communications equipment.

    1. See the IRM 10.2, Physical Security Program series for additional information related to restricted IT areas.

10.8.1.4.2.1  (05-03-2012)
Physical Access Authorization and Control

  1. The IRS shall: (NIST SP 800-53 PE-2)

    1. Develop and keep current a list of personnel with authorized access to IRS facilities where information systems and data reside (except for those areas within the facility officially designated as publicly accessible);

    2. Issue authorization credentials (e.g., badges, identification cards, and smart cards);

    3. Review and approve the access list and authorization credentials at least annually, removing from the access list personnel no longer requiring access

  2. See the IRM 10.2 series for employee and contractor identification requirements.

  3. The IRS shall: (NIST SP 800-53 PE-3)

    1. Enforce physical access authorization for all physical access points (including designated entry/exit points) to the facility where information systems reside (excluding those areas within the facility officially designated as publicly accessible);

    2. Limit access to Department of the Treasury and IRS buildings and structures housing sensitive information systems to authorized personnel;

    3. Verify individual access authorizations before granting access to a facility;

    4. Control entry to facilities containing information systems using physical access devices and/or guards;

    5. Control access to areas officially designated as publicly accessible in accordance with the IRS’s assessment of risk;

    6. Secure keys, combinations, and other physical access devices;

    7. Inventory physical access devices at a minimum annually; and

    8. Change combinations and keys at least annually and when keys are lost, combinations are compromised, or individuals who have access are transferred, terminated, or no longer require access.

  4. Access controls shall be in place for deterring, detecting, monitoring, restricting, and regulating access to specific areas at all times.

  5. Access controls shall be:

    1. Based on the level of risk; and (NIST SP 800-53 PE-3)

    2. Sufficient to safeguard assets against possible loss, theft, destruction, accidental damage, hazardous conditions, fire, malicious actions, and natural disasters.

  6. Physical access authorization to IRS information systems shall be enforced independent of the physical access controls for the facility in which they are located. (NIST SP 800-53 PE-3 CE1) (H)

    Note:

    This control enhancement applies to server rooms, media storage areas, communications centers, or any other areas within an organizational facility containing large concentrations of information system components. The intent is to provide additional physical security for those areas where the organization may be more vulnerable due to the concentration of information system components.

  7. Physical access to information system distribution and transmission lines within IRS facilities shall be controlled. (NIST SP 800-53 PE-4) (M, H)

    Note:

    Physical protections applied to information system distribution and transmission lines help prevent accidental damage, disruption, and physical tampering. Additionally, physical protections are necessary to help prevent eavesdropping or in transit modification of unencrypted transmissions. Protective measures to control physical access to information system distribution and transmission lines include: (i) locked wiring closets; (ii) disconnected or locked spare jacks; and/or (iii) protection of cabling by conduit or cable trays.

  8. Refer to the IRM 10.2 series for additional guidance on physical access.

10.8.1.4.2.1.1  (05-03-2012)
Physical Access Controls (Devices)

  1. Physical access to information system output devices (e.g., monitors, printers, and audio devices) shall be controlled to prevent unauthorized individuals from obtaining the output. (NIST SP 800-53 PE-5) (M, H)

  2. If Federal Personal Identity Verification (PIV) credentials are used as an identification token and token-based access control is employed, the physical access control system shall conform to the requirements of FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, and NIST SP 800-73, Interfaces for Personal Identity Verification.

  3. The IRS shall specifically require all employees and contractors with recurring physical or logical access requirements to Department of the Treasury facilities or systems to be issued credentials that comply with HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors (see also FIPS 201). (TD P 85-01 P-AC&O.3)

  4. Physical access control systems with token-based access control functions employing cryptographic verification shall conform to the requirements of NIST SP 800-78, Cryptographic Algorithms and Key Sizes for Personal Identity Verification.

  5. Physical access control systems with token-based access control functions employing biometric verification shall conform to the requirements of NIST SP 800-76, Biometric Data Specification for Personal Identity Verification.

  6. Effective the beginning of FY2012, existing physical access control systems shall be upgraded to use PIV credentials, in accordance with NIST guidelines, prior to using development and technology refresh funds to complete other activities. (OMB M-11-11)

  7. Refer to the IRM 10.2 series for additional guidance on physical access.

10.8.1.4.2.1.2  (05-03-2012)
Monitoring Physical Access

  1. The IRS shall: (NIST SP 800-53 PE-6)

    1. Monitor physical access to IRS information systems to detect and respond to physical security incidents;

    2. Review physical access logs at a minimum annually; and

    3. Coordinate results of reviews and investigations with the IRS's incident response capability.

    Note:

    Investigation of and response to detected physical security incidents, including apparent security violations or suspicious physical access activities are part of the IRS’s incident response capability.

  2. The IRS shall monitor real-time physical intrusion alarms and surveillance equipment. (NIST SP 800-53 PE-6 CE1) (M, H)

  3. The IRS shall employ automated mechanisms to recognize potential intrusions and initiate designated response actions. (NIST SP 800-53 PE-6 CE2) (H)

10.8.1.4.2.1.3  (05-03-2012)
Visitor Control

  1. The IRS shall control physical access to an information system by authenticating visitors before authorizing access to the facility (e.g., access roster) where the information system resides other than areas designated as publicly accessible. (NIST SP 800-53 PE-7)

    Note:

    Individuals (to include IRS employees, contract personnel, and others) with permanent authorization credentials for the facility are not considered visitors.

  2. All visitors shall:

    1. Sign-in upon entering the facility; and

    2. Sign-out when exiting the facility.

  3. Refer to the IRM 10.2 series for additional guidance on visitor controls.

10.8.1.4.2.1.3.1  (05-03-2012)
Escort Access

  1. Escort access to an IRS facility requires the non-IRS personnel (e.g., visitor) to be accompanied by an authorized IRS employee and their activity to be monitored the entire time they are within the facility.

    1. Visitors shall be escorted and their activity monitored when required. (NIST SP 800-53 PE-7 CE1) (M, H)

  2. Escort access shall not be used for contractor employees who have been denied final staff-like access approval. These employees shall be removed from the IRS contract.

  3. Instances where contractor employees shall be escorted include the following:

    1. Prior to the contractor employee being granted interim staff-like access;

    2. During the time the final investigation is pending completion when interim staff-like access has been denied; or

    3. During any period of time that staff-like access has been suspended such as during the period of time after a proposal to deny staff-like access.

  4. When work is to be performed by an uncleared contractor outside an IRS facility (e.g., IRS sensitive data or information provided to a contractor employee off-site) or via remote system access:

    1. Escort access shall be accomplished by the accompaniment of an IRS employee at the same or higher position risk level as the contractor employee.

    2. Uncleared contractor employees shall not have access to IRS sensitive information or data unless the contractor is escorted by an IRS employee.

  5. Management controls such as individual accountability requirements, separation of duties enforced by access controls, or limitations on the processing privileges of individuals shall be approved by the management official responsible for the system.

  6. Escorts shall: a.

    1. Be IRS employees specifically assigned to the area(s) where the visit will occur; and

    2. Have knowledge of the system sufficient to determine when the visitor's actions could cause damage or harm to the system or data.

  7. Exceptions to escorted access requirements shall be approved by the Associate Director, Personnel Security.

  8. Refer to the IRM 10.2 series for additional guidance on escorted access.

10.8.1.4.2.1.3.2  (05-03-2012)
Access Records

  1. The IRS shall maintain visitor access records/logs to facilities where an information system resides (except for those areas within the facility officially designated as publicly accessible). (NIST SP 800-53 PE-8)

    1. Visitor access records shall be reviewed at the following minimum frequencies:
      i. Semi-annually (H)
      ii. Annually (L, M)

    2. An automated capability for maintaining and reviewing access logs shall be utilized at facilities where information systems are located. (NIST SP 800-53 PE-8 CE1) (H)

    3. Maintain a record of all physical access, both visitor and authorized individuals. (NIST SP 800-53 PE-8 CE2) (H)

10.8.1.4.2.2  (11-25-2011)
Staff-Like Access

  1. Staff-like access refers to unescorted access by contractor employees to:

    1. IRS-owned or controlled facilities, or

    2. Information systems, and/or

    3. SBU information.

  2. Interim staff-like access approval shall be granted when staff-like access is required prior to the completion of the required background investigation.

  3. Interim staff-like access shall be granted only in cases where it has been determined that the risk is acceptable.

  4. Interim staff-like access approval shall be granted by the Associate Director, Personnel Security.

10.8.1.4.2.3  (11-25-2011)
Environmental Protection

  1. The IRS shall incorporate environmental protection controls for all facilities where information is generated, stored, processed, displayed, or transmitted based on the level of potential harm. (NIST SP 800-53 PE-1)

10.8.1.4.2.3.1  (05-03-2012)
Power Equipment and Power Cabling

  1. The IRS shall protect power equipment and power cabling for information systems from damage and destruction. (NIST SP 800-53 PE-9) (M, H)

10.8.1.4.2.3.2  (05-03-2012)
Emergency Shutoff

  1. The IRS shall: (NIST SP 800-53 PE-10) (M, H)

    1. Provide the capability of shutting off power to an information system or individual system components in emergency situations;

    2. Place emergency shutoff switches or devices in a location near an information system or system component to facilitate safe and easy access for personnel; and

    3. Protect emergency power shutoff capability from unauthorized activation.

    Note:

    This control applies to facilities containing concentrations of information system resources, for example, data centers, server rooms, and mainframe computer rooms.

10.8.1.4.2.3.3  (05-03-2012)
Emergency Power

  1. The IRS shall provide a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power loss. (NIST SP 800-53 PE-11) (M, H)

10.8.1.4.2.3.4  (05-03-2012)
Emergency Lighting

  1. The IRS shall employ and maintain an automatic emergency lighting system that activates in the event of a power outage or a disruption of emergency exit/evacuation route areas. (NIST SP 800-53 PE-12)

10.8.1.4.2.3.5  (05-03-2012)
Fire Protection

  1. The IRS shall employ and maintain fire suppression and detection devices/systems (e.g., sprinkler systems, handheld fire extinguishers, fixed fire hoses, and smoke detectors) for information systems that are supported by an independent energy source. (NIST SP 800-53 PE-13)

    1. Detection and suppression systems shall automatically activate in the event of a fire and provide automatic notification of the activation to the IRS and emergency responders. (NIST SP 800-53 PE-13 CE1 & PE-13 CE2) (M, H)

    2. An automatic fire suppression capability shall be employed for information systems when the facility is not staffed on a continuous basis. (NIST SP 800-53 PE-13 CE3) (M, H)

10.8.1.4.2.3.6  (05-03-2012)
Temperature and Humidity Control

  1. The IRS shall: (NIST SP 800-53 PE-14)

    1. Maintain temperature and humidity levels within facilities where information systems reside at acceptable levels; and

    2. Monitor temperature and humidity levels daily.

10.8.1.4.2.3.7  (05-03-2012)
Water Damage Protection

  1. The IRS shall protect information systems from damage resulting from water leakage by:

    1. Providing master shutoff valves that are accessible, working properly, and known to key personnel. (NIST SP 800-53 PE-15)

    2. Employing mechanisms that, without the need for manual intervention (e.g., automated shutoff valves), protect the information system from water damage in the event of a water leak. (NIST SP 800-53 PE-15 CE1) (H)

    Note:

    The usage of manual shutoff valves along with automated shutoff valve allows for an alternate shutoff capability in the event the automated shutoff valve fails.

10.8.1.4.2.4  (05-03-2012)
Alternate Work Site

  1. The IRS shall: (NIST SP 800-53 PE-17) (M, H)

    1. Employ management, operational, and technical information system security controls as defined within this IRM at alternate work sites;

    2. Assess the effectiveness of security controls at alternate work sites; and

    3. Provide a means for employees to communicate with information security personnel in case of security incidents or problems.

    Note:

    Alternate work sites may include, for example, government facilities or private residences of employees. Different sets of security controls for specific alternate work sites or types of sites may be defined.

  2. Individuals within the IRS organization shall employ appropriate information system security controls while at alternate work sites.

10.8.1.4.3  (05-03-2012)
Contingency Planning

  1. The IRS shall develop, disseminate, review, and update every three (3) years (or if there is a significant change) a formal, documented Contingency Planning Policy that addresses the following: (NIST SP 800-53 CP-1)

    • Purpose

    • Scope

    • Roles and Responsibilities

    • Management commitment

    • IRS coordination

    • Compliance

  2. The IRS shall develop, disseminate, review, and update annually procedures to facilitate the implementation of the Contingency Planning Policy and associated contingency planning controls. (NIST SP 800-53 CP-1)

    1. The Contingency Planning Policy and procedures shall be consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

  3. All IRS information systems shall:

    1. Develop and maintain for all information systems, a contingency plan that: (NIST SP 800-53 CP-2)
      i.Identifies essential missions and business functions and associated contingency requirements;
      ii.Provides recovery objectives, restoration priorities, and metrics;
      iii. Addresses contingency roles, responsibilities, assigned individuals with contact information;
      iv. Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
      v.Addresses eventual, full information system restoration without deterioration of the security measures originally planned and implemented; and
      vi. Is reviewed and approved by designated officials within the organization;

    2. Distribute copies of the contingency plan to key contingency personnel and IRS elements;

    3. Coordinate contingency planning activities with incident handling activities;

    4. Review the contingency plan for the information system at least annually;

    5. Revise the contingency plan to address changes to the IRS, information systems, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; and

    6. Communicate contingency plan changes to key contingency personnel and IRS elements.

  4. An emergency response capability shall be composed of the following components:

    1. An emergency staff with primary and alternate representatives designated for each key position;

    2. A viable plan with recovery procedures that can be successfully executed by the emergency staff;

    3. One or more alternate operating facilities for recovery of business operations and services (e.g., manufacturing or site-unique operations; information resources);

    4. Saved, retrieved, and usable vital records; and

    5. A dynamic crisis management structure.

  5. The emergency response capability shall encompass methods and techniques that guarantee a high level of readiness and enable implementation in response to any threat with and without warning. The threat spectrum includes localized acts of nature, accidental incidents, technological emergencies, criminal acts, and terrorist attacks using weapons of mass destruction.

  6. Business continuity planning shall encompass the following:

    1. Identification of essential IRS business processes;

    2. A recovery time objective is established for each process.
      i. During an emergency, essential IRS processes are recovered and reconstituted no later than the recovery time objective.
      ii. Recovery of other processes deemed non-critical is deferred until resources are available to permit restoration;

    3. A recovery strategy is developed for the resumption of each essential IRS business process, including the associated information system, application, and telecommunications;

    4. Standards to meet recovery strategies include instructions for:
      i. Backing up and restoring systems/applications,
      ii. A methodology for reconstructing lost data,
      iii. Steps for implementing alternative work methods or emergency operations,
      iv. Steps required for managing and processing work backlog, and
      v. Synchronizing of files and data;

    5. An assessment of the efficiency/sufficiency of a recovery strategy assessed for sufficiency in meeting the recovery time objective for the essential IRS business processes;

    6. An acknowledgement of risk and any associated data loss;

    7. Recovery strategies that make use of internal recovery, commercial recovery centers, or cooperative agreements, or are a combination of the aforementioned. Implementation of the strategy is achieved via hot sites, cold sites, mutual internal support, or reciprocal agreements;

    8. An Incident Action Plan that is developed for managing an orderly response and recovery of business processes;

    9. An established and maintained vital records program.
      i. Vital records shall be identified, duplicated, and stored in a suitable alternate storage site.
      ii. Sending vital records to and from the alternate storage site shall be done using reliable packing methods, and transport mechanisms that guarantee delivery and safe storage while in transit.
      iii. Frequency of shipping shall correlate directly to the recovery objectives of the IRS.

    10. Designation of the emergency staff (teams), duties/responsibilities and procedures for notification, and recall of the emergency staff (teams) during duty and non-duty hours are identified;

    11. Succession and emergency delegations clearly stating those individuals authorized to act on the behalf of the senior IRS or Treasury officials during an emergency are identified;

    12. A strategy for communicating with non-emergency staff and rendering assistance to them as required/needed is documented;

    13. Guidance for continued and uninterrupted command, control, and leadership of the IRS is documented;

    14. A strategy that is developed for communicating with employees, visitors, and others (including the media) during an emergency;

    15. Procedures that are developed for restoring or replacing damaged or destroyed facilities while maintaining operations at the alternate operating facility or facilities; and

    16. Continuity plans and procedures that are reviewed at least annually and updated whenever there is a significant change to the system or when problems are encountered during plan implementation, execution, or testing.

  7. The IRS shall develop, test, and maintain a disaster recovery plan for mission or business critical systems for use in the event normal operations cease.

  8. Contingency plan development for information systems shall be coordinated with organizational elements responsible for related plans. (NIST SP 800-53 CP-2 CE1)

    Note:

    Examples of related plans include Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Crisis Communications Plan, Critical Infrastructure Plan, Cyber Incident Response Plan, and Occupant Emergency Plan.

  9. Capacity planning for information systems shall be conducted so the necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations. (NIST SP 800-53 CP-2 CE2) (H)

    Note:

    Clarification to be provided for necessary capacity.

  10. The resumption of essential missions and business functions within a specified time-period of contingency plan activation, as defined within each information system’s recovery strategy, shall be planned for. (NIST SP 800-53 CP-2 CE3) (H)

  11. For some smaller (particularly FIPS 199 Low availability) systems, a full contingency plan may not exist when the IRS decides that the contingency plan is to not bring the system back up after an incident. This must still be documented. To satisfy this requirement, include a summary of the Business Impact Analysis that supports the decision to not recover or reconstitute the system. The testing requirement for these systems can be satisfied by annually validating and appropriately updating documentation of the decision. (TD P 85-01 S-CP.6)

  12. The IRS can use a system’s FIPS 199 category for Availability instead of the overall system security category to determine the required controls for contingency planning, if the IRS conducts an organizational assessment of risk that supports that decision. (TD P 85-01 S-CP.7)

  13. A completed assessment of risk should be included as an appendix to the contingency plan. (TD P 85-01 S-CP.8)

  14. Information systems in a development and testing environment shall adhere to the Contingency Planning requirements based on an assessment of risk and assigned FIPS 199 categorization impact-level.

10.8.1.4.3.1  (05-03-2012)
Contingency Training

  1. All personnel shall be trained in their roles and responsibilities in executing the contingency plan and recovery capability with respect to the information system and provided refresher training at least annually. (NIST SP 800-53 CP-3)

    1. Training shall incorporate realistic, simulated events into contingency training in order to ensure personnel are adequately prepared for times of crisis. (NIST SP 800-53 CP-3 CE1) (H)

10.8.1.4.3.1.1  (05-03-2012)
Contingency Plan Testing and Exercises

  1. The contingency plan for each system shall be tested and/or exercised, in whole or in part, at a minimum annually, or at a greater frequency as determined by the IRS. (NIST SP 800-53 CP-4; TD P 85-01 S-CP.1)

    1. The scope, objectives, and schedule of each test shall be determined and executed under the direction of the IRS.

  2. Testing of contingency plans shall occur through a variety of mechanisms including classroom and functional exercises. (TD P 85-01 S-CP.1)

    1. Classroom exercises shall be used to walk through contingency plan procedures to ensure the documentation reflects the ability to adequately perform the tasks outlined without any actual recovery operations occurring.

    2. Functional exercises (e.g., simulations, war gaming) shall be incorporated to test more extensive capabilities of the contingency plan to ensure that each item can be met as planned.

  3. The results of each test shall be reviewed and documented. (NIST SP 800-53 CP-4, TD P 85-01 S-CP.2)

    1. At a minimum, the following items should be included: (TD P 85-01 S-CP.2)
      Name of Test;
      Name of System;
      Date of Test - Testing point of contact;
      Purpose, Type of Test, and Scope;
      Objectives - Methodology - Activities and Results (Action, Expected Results, Actual Results); and
      Action Item Assessment.

    2. Summary results from the testing shall be sent to the Department of the Treasury quarterly. (TD P 85-01 S-CP.3)

    3. Any changes to the contingency plan necessitated or recommended as a result of each test shall be documented and the plans revised accordingly. (TD P 85-01 S-CP.4)

    4. If warranted based upon the test results, new items should be added to the appropriate system or program POA&M. (TD P 85-01 S-CP.5)

  4. Contingency plan development, testing and/or exercises, and maintenance shall be coordinated with other related plans including the Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Business Recovery Plan, and Incident Response Plan. (NIST SP 800-53 CP-4 CE1) (M, H)

  5. To ensure site and plan effectiveness in addition to personnel readiness and familiarizing contingency personnel with the facility and available resources, the contingency plan shall be fully executed at the alternate processing and storage sites. (NIST SP 800-53 CP-4 CE2) (H)

  6. A full recovery and reconstitution of the information system to a known state/configuration shall be included as part of a system's contingency plan testing. (NIST SP 800-53 CP-4 CE4) (H)

10.8.1.4.3.2  (05-03-2012)
Alternate Storage Site

  1. The IRS shall establish an alternate storage site including necessary agreements to permit the storage and recovery of information system backup information. (NIST SP 800-53 CP-6) (M, H)

    1. An alternate storage site shall be identified that is separated from the primary storage site so as not to be susceptible to the same hazards. (NIST SP 800-53 CP-6 CE1) (M, H)

      Note:

      Hazards of concern to the organization are typically defined in an organizational assessment of risk.

    2. The alternate storage site shall be configured to facilitate recovery operations in accordance with recovery time and recovery point objectives. (NIST SP 800-53 CP-6 CE2) (H)

    3. Potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster shall be identified and explicit mitigation actions outlined. (NIST SP 800-53 CP-6 CE3) (M, H)

    Note:

    Explicit mitigation actions include, for example, duplicating backup information at another alternate storage site if access to the first alternate site is hindered; or, if electronic accessibility to the alternate site is disrupted, planning for physical access to retrieve backup information.

10.8.1.4.3.3  (05-03-2012)
Alternate Processing Site

  1. The IRS shall: (NIST SP 800-53 CP-7) (M, H)

    1. Establish an alternate processing site including necessary agreements to permit the resumption of information system operations for essential missions and business functions in accordance with the recovery time objectives defined in the Information Technology Contingency Plan (ITCP) when the primary processing capabilities are unavailable; and

    2. Ensure that equipment and supplies required to resume operations are available at the alternate site or contracts are in place to support delivery to the site in time to support the organization-defined time period for resumption.

    3. Identify an alternate processing site that is separated from the primary processing site so as not to be susceptible to the same hazards. (NIST SP 800-53 CP-7 CE1) (M, H)

      Note:

      Hazards that might affect the information system are typically defined in the risk assessment.

    4. Identify potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. (NIST SP 800-53 CP-7 CE2) (M, H)

    5. Develop alternate processing site agreements that contain priority-of-service provisions in accordance with the organization’s availability requirements. (NIST SP 800-53 CP-7 CE3) (M, H)

    6. Ensure that the alternate processing site provides information security measures equivalent to that of the primary site. (NIST SP 800-53 CP-7 CE5) (M, H)

  2. Alternate processing sites for information systems shall be configured so it is ready to be used as the operational site supporting essential missions and business functions. (NIST SP 800-53 CP-7 CE4) (H)

  3. Information systems in a development and testing environment shall adhere to the Alternate Processing Site requirements based on an assessment of risk and assigned FIPS 199 categorization level.

  4. See IRM 10.8.60, Information Technology (IT) Security, Information Technology Disaster Recovery Policy and Guidance, for additional alternate processing site guidance.

10.8.1.4.3.4  (05-03-2012)
Telecommunications Services

  1. The IRS shall establish alternate telecommunications services including necessary agreements to permit the resumption of information system operations for essential missions and business functions within a specified time period (documented in the Service Level Agreement) when the primary telecommunications capabilities are unavailable. (NIST SP 800-53 CP-8) (M, H)

  2. The IRS shall: (NIST SP 800-53 CP-8 CE1) (M, H)

    1. Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with the organization’s availability requirements; and

    2. Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.

  3. Alternate telecommunications services with consideration for reducing the likelihood of sharing a single point of failure with primary telecommunications services shall be obtained. (NIST SP 800-53 CP-8 CE2) (M, H)

  4. Alternate telecommunications service providers that are separated from primary service providers so as not to be susceptible to the same hazards shall be obtained. (NIST SP 800-53 CP-8 CE3) (H)

  5. Primary and alternate telecommunications service providers shall be required to have contingency plans. (NIST SP 800-53 CP-8 CE4) (H)

10.8.1.4.3.5  (05-03-2012)
Information System Backup

  1. The IRS shall implement and enforce backup procedures for all information systems and information.

  2. The IRS shall establish backup procedures for each information system, including the following:

    1. Frequency;

    2. Retention;

    3. Offsite schedule, including personnel who are authorized to send and receive backup media;

    4. Logs of backups, including recording errors that might occur;

    5. Backup schedule;

    6. Restoration of software from the original medium, not from backups; and

    7. Reconfiguration of the media in accordance with IRS policy.

  3. The IRS shall: (NIST SP 800-53 CP-9)

    1. Conduct backups of user-level information contained in the information system at least:
      i. Daily for FIPS 199 HIGH systems,
      ii. Weekly for FIPS 199 MODERATE systems, and
      iii. Monthly for FIPS 199 LOW systems;

    2. Conduct backups of system-level information contained in the information system at least:
      i. Daily for FIPS 199 HIGH systems,
      ii. Weekly for FIPS 199 MODERATE systems, and
      iii. Monthly for FIPS 199 LOW systems;

    3. Conduct backups of information system documentation including security-related documentation at least:
      i. Daily for FIPS 199 HIGH systems,
      ii. Weekly for FIPS 199 MODERATE systems, and
      iii. Monthly for FIPS 199 LOW systems;

    4. Protect the confidentiality and integrity of backup information at the storage location at the highest level of sensitivity of the data.
      i. The media shall be marked with the highest level of sensitivity.

    5. Restrict access to backup media to authorized personnel only.

  4. The IRS shall test backup information to verify media reliability and information integrity at least: (NIST SP 800-53 CP-9 CE1)

    1. Quarterly for FIPS 199 HIGH systems;

    2. Semi-annually for FIPS 199 MODERATE systems; and

    3. Annually for all other information systems.

  5. A sample of backup information shall be used in the restoration of selected information system functions as part of contingency plan testing. (NIST SP 800-53 CP-9 CE2) (H)

  6. The IRS shall store backup copies of the operating system (i.e., deployed operating system with agency defined configurations and controls) and other critical information system software, as well as copies of the information system inventory (including hardware, software, and firmware components) in a separate facility or in a fire-rated container that is not co-located with the operational system. (NIST SP 800-53 CP-9 CE3) (H)

  7. Business units shall provide procedures to their users for backup and recovery of individual user data to ensure data is not lost.

10.8.1.4.3.5.1  (05-03-2012)
Information System Recovery and Reconstitution

  1. The IRS shall provide for the recovery and reconstitution of the information system to a known state/configuration after a disruption, compromise, or failure. (NIST SP 800-53 CP-10)

  2. IRS information systems shall implement transaction recovery for systems that are transaction-based. (NIST SP 800-53 CP-10 CE2) (M, H)

    Note:

    Database management systems and transaction processing systems are examples of information systems that are transaction-based. Transaction rollback and transaction journaling are examples of mechanisms supporting transaction recovery.

  3. The IRS shall provide compensating security controls for circumstances that can inhibit recovery and reconstitution to a known state/configuration. (NIST SP 800-53 CP-10 CE3) (M, H)

  4. The IRS shall provide the capability to reimage information system components within a specified restoration time-period, as defined within each systems recovery strategy and in accordance with End User Equipment and Services (EUES) and Enterprise Operations (EOps) guidance, from configuration-controlled and integrity-protected disk images representing a secure, operational state for the components. (NIST SP 800-53 CP-10 CE4) (H)

10.8.1.4.4  (05-03-2012)
Configuration Management

  1. The IRS shall develop, disseminate, review and update every three (3) years (or if there is a significant change) a formal, documented configuration management policy that addresses the following: (NIST SP 800-53 CM-1)

    • Purpose

    • Scope

    • Roles and Responsibilities

    • Management commitment

    • IRS coordination among organizational entities

    • Compliance

  2. The IRS shall develop, disseminate, review and update annually formal, procedures to facilitate the implementation of the configuration management policy, and associated configuration management controls. (NIST SP 800-53 CM-1)

    1. The configuration management policy and procedures shall be consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

    2. Configuration Management Procedures shall be developed for the security program in general, and for a particular IRS information system, when required.

  3. The IRS shall develop, document, and implement a configuration management plan for all IRS Information systems and networks that: (NIST SP 800-53 CM-9)

    1. Address roles, responsibilities, and configuration management processes and procedures;

    2. Define the configuration items for the IRS information system, and ensures these items are placed under configuration management when in the SDLC; and

    3. Establish the means for identifying configuration items throughout the SDLC and a process for managing the configuration of the configuration items.

  4. In acquiring information technology, the IRS shall ensure the use of common security configurations, when applicable, by: (TD P 85-01 S-CVM.24)

    1. Requiring vendors to configure information systems with common security configurations (when available and applicable, e.g., FDCC) prior to delivery; or

    2. Configuring acquired information systems to meet IRS-tailored, secure parameters (e.g., FDCC with approved deviations) after delivery but prior to deployment.

10.8.1.4.4.1  (05-03-2012)
Baseline Configuration

  1. The IRS shall develop, document, and maintain under configuration control, a current baseline configuration of IRS information systems and associated software or hardware components, including communications and connectivity-related aspects of the systems. (NIST SP 800-53 CM-2)

  2. The baseline configuration shall provide information about the components of an IRS information system and each component’s technology (e.g., the standard software load for a workstation, server, network component, or mobile device including operating system/installed applications with the current version numbers and patch information), network topology, and logical placement within the information system architecture. (NIST SP 800-53 CM-2)

    1. Only legal and licensed (including open source, shareware, and freeware licenses, etc.) software (including operating system, databases, applications, etc.) approved by MITS shall be used or installed on IRS systems and networks.

    2. The use of hardware or software that is not within the Baseline configuration shall be approved through the Enterprise Architecture (EA) waiver process.

  3. The IRS shall utilize or develop secure configurations for commercially available or open source operating systems and database systems. (TD P 85-01 S-CVM.1)

    1. IRS checklist shall be adhered to prior to looking outside the IRS to the National Checklist Program Checklist Repository (NCPCR) or other organizations.

    2. Where secure configuration baselines have not been identified or developed for a product where a configuration checklist exists in the National Checklist Program Checklist Repository (NCPCR), a security baseline shall be assumed based on the checklist submitted by the top-most applicable developer in the following list (if there is no checklist from the first provider identified, the default shall fall to the second, and so forth):
      1. Office of Management and Budget (OMB)
      2. NIST, Computer Security Division
      3. Defense Information Systems Agency (DISA)
      4. National Security Agency (NSA)
      5. Other government agencies
      6. Public/private consensus partnerships
      7. The product vendor

    3. When configuration settings are developed for any of the platforms for which a checklist exists in the NCPCR, the settings shall be derived from one of the secure baselines available through the NCPCR. (TD P 85-01 S-CVM.3)

    4. The NCPCR shall be checked, not less than annually, for updates to the selected secure baseline(s) (if used as the basis for its checklist) and, for each update found, determine whether changes should be made to Bureau-specific configuration settings. (TD P 85-01 S-CVM.3)

  4. IRS-developed configuration baselines shall be developed in accordance with NIST 800-70, Security Configuration Checklists Program for IT products, documented, and approved by the CIO/CTO or designee(s). (TD P 85-01 S-CVM.2)

  5. The IRS shall review and update the baseline configuration of IRS information systems: (NIST SP 800-53 CM-2 CE1)

    1. At a minimum annually;

    2. When required due to reorganizations, refreshes, etc. and

    3. As an integral part of IRS information system component installations and upgrades.

  6. Automated Security Configuration Scanning of operating systems and databases systems shall be conducted at a minimum monthly. (TD P 85-01 S-CVM.9)

  7. An automated capability shall be employed to maintain an up-to-date, complete, accurate, and readily available baseline configuration of IRS information systems and networks: (NIST SP 800-53 CM-2 CE2) (H)

    1. Automated tools shall be approved through the MITS organization.

    Note:

    Software inventory tools are examples of automated mechanisms that help organizations maintain consistent baseline configurations for IRS information systems. Software inventory tools can be deployed for each operating system in use within the IRS (e.g., on workstations, servers, network components, mobile devices) and used to track operating system version numbers, applications and types of software installed in the operating system, and current patch levels. Software inventory tools can also scan IRS information systems to validate IRS-defined lists of authorized software and to identify unauthorized software programs.

  8. Older versions of baseline configurations shall be retained to support rollback. (NIST SP 800-53 CM-2 CE3) (M, H)

  9. The IRS shall:

    1. Develop and maintain a current list of software programs not authorized to execute, on IRS information systems. (NIST SP 800-53 CM-2 CE4) (M)

    2. Employ an allow-all, deny-by-exception authorization policy to identify software allowed to execute on IRS information systems (i.e., white lists of authorized software). (NIST SP 800-53 CM-2 CE4) (M)

  10. The IRS shall:

    1. Develop and maintain a current list of software programs authorized to execute, on IRS information systems. (NIST SP 800-53 CM-2 CE5) (H)

    2. Employ a deny-all, permit-by-exception authorization policy to identify software allowed to execute on IRS information systems. (NIST SP 800-53 CM-2 CE5)

  11. A baseline configuration shall be maintained for development and test environments that is managed separately from the operational baseline configuration. (NIST SP 800-53 CM-2 CE6) (H)

10.8.1.4.4.2  (05-03-2012)
System Component Inventory

  1. The IRS shall develop, document, and maintain an inventory of IRS information system components that: (NIST SP 800-53 CM-8)

    1. Accurately reflects the current information system;

    2. Is consistent with the authorization boundary of IRS information systems;

    3. Is at a level of granularity deemed necessary for tracking and reporting, as requirements defined within this section for IRS information systems components;

    4. Includes all IRS-defined information deemed necessary to achieve effective property accountability; and

    5. Is available for review and audit by designated IRS officials.

  2. The IRS shall maintain a current and updated inventory of IRS information system components and relevant ownership information as an integral part of component installations, removals, and information system updates. (NIST SP 800-53 CM-8 CE1)

    1. The inventory management system shall include, at a minimum: (NIST SP 800-53 CM-8)

    • Manufacturer

    • Model Number

    • Serial Number

    • IP Address

    • IRS Barcode

    • Hostname

    • Function

    • Software License number

    • Interconnections

    • System/Component Information

    • System/Component Owner

  3. The IRS shall employ automated capabilities to help maintain an up-to-date, complete, accurate, and readily available inventory of IRS information system components. (NIST SP 800-53 CM-8 CE2)

  4. The IRS shall: (NIST SP 800-53 CM-8 CE3) (H)

    1. Employ automated mechanisms annually to detect the addition of unauthorized components/devices into IRS information systems and

    2. Disable network access by such components/devices or notify designated MITS personnel of unauthorized components/devices.

  5. The IRS shall include in property accountability information for IRS information system components, a means for identifying individuals (e.g. position, name and/or role), who are responsible for administering those components. (NIST SP 800-53 CM-8 CE4) (H)

  6. The IRS shall verify that all components within the physical boundary of IRS information systems are either inventoried as a part of the system or recognized by another system as a component within that system. (NIST SP 800-53 CM-8 CE5) (M, H)

  7. The IRS shall communicate inventory changes to the Treasury CIO/CTO Office in accordance with inventory guidelines stated in the IRM 2.14, Asset Management series.

  8. The IRS shall maintain an inventory of servers and network devices (e.g., routers, switches, gateways) applicable to an environment by device description (model and serial number or inventory control number), custodian information, and FISMA system(s). (TD P 85-01 S-CVM.12)

    1. The inventory of hardware information, by FISMA system, shall be uploaded into the IRS’ FISMA tool, updated within one month as changes occur, and reviewed at least annually.

10.8.1.4.4.3  (05-03-2012)
Security Change Management

  1. The IRS shall: (NIST SP 800-53 CM-3) (M, H)

    1. Establish, prepare, implement, and enforce a configuration management plan and its controls for all information systems and networks.

    2. Approve changes to IRS information systems with risk-based consideration for security impact analysis;

    3. Document approved configuration changes to the system;

    4. Retain and review records of configuration changes to a system;

    5. Audit activities associated with configuration changes to the system;

    6. Coordinate and provide oversight for configuration change control activities through a Configuration Control Board, which meets on a monthly basis, at a minimum; and

    7. Ensure all business and functional unit owners utilize the IRS’s FISMA guidance and the Security Configuration Management SOP for security change management. For more information on the Security Change Management processes, contact the Cybersecurity Project Management Office (PMO).

  2. The IRS shall evaluate the impact on the security posture, functionality and infrastructure for all proposed changes to an information system, including security patches.

  3. A formal written change request shall be submitted to the appropriate Change Control Board(s) for all changes, scheduled and unscheduled. (NIST SP 800-53 CM-3)

    1. The proposed changes shall be reviewed by the appropriate personnel, including the Information System Security Officer (ISSO), to determine the impact of the change on the information system and its interconnections, including the security posture of the information system (or it's supporting GSS).

    2. If the change request creates a significant change in the security posture of the system, the information system shall be required to undergo a re-certification and accreditation.

      Note:

      Examples of significant changes to an IRS information system that should be reviewed for possible reauthorization include, but are not limited to: (i) Installation of a new or upgraded operating system, middleware component, or application; (ii) Modifications to system ports, protocols, or services; (iii) Installation of a new or upgraded hardware platform or firmware component; or (iv) Modifications to cryptographic modules or services.

  4. An automated capability shall be employed to: (NIST SP 800-53 CM-3 CE1) (H)

    1. Document proposed changes to IRS information systems;

    2. Notify AO of changes;

    3. Report and track approvals that have not been received in accordance with FISMA guidance to the authorizing official;

    4. Prohibit changes until designated approval has been received; and

    5. Document completed changes to IRS information systems.

  5. Changes to IRS information systems shall be tested, validated, and documented before implementing the changes on operational systems in production environments. (NIST SP 800-53 CM-3 CE2) (M, H)

  6. The status of all change requests shall be tracked and maintained in accordance with the IRM 1.15, Records Management series or until baseline documentation has been updated to reflect the change, whichever is longer.

  7. Changes to information systems shall be analyzed prior to implementation as part of the change approval process to determine potential security impacts. (NIST SP 800-53 CM-4)

  8. New software shall be analyzed in a separate test environment before installation in an operational/production environment, reviewing for security impacts due to flaws, weaknesses, incompatibility, or intentional maliciousness. (NIST SP 800-53 CM-4 CE1)

    1. The analysis findings shall be reported to the AO for resolution/remediation.

  9. After an IRS information system has had approved changes implemented, including system upgrades and modifications, the IRS shall: (NIST SP 800-53 CM-4 CE2)

    1. Validate the security functions were implemented correctly;

    2. Verify the security functions are operating as intended;

    3. Ensure the security functions are producing the desired outcome with respect to meeting the security requirements for the system; and

    4. Report findings to the AO for resolution/remediation.

  10. The IRS shall define, document, approve, and enforce physical and logical access restrictions associated with changes to IRS information systems. Examples of access restrictions include: implementing Smart Card Identity Access Management for physical and logical access, workflow automation, media libraries, and change windows. (NIST SP 800-53 CM-5) (M, H)

  11. An automated capability shall be employed to enforce access restrictions and support auditing of the enforcement actions. (NIST SP 800-53 CM-5 CE1) (H)

  12. Audits shall be conducted of IRS information system changes or when a risk severity and impact assessment determines the need for an audit to determine whether an unauthorized change has occurred. (NIST SP 800-53 CM-5 CE2) (H)

  13. The installation of device drivers that are not signed with an IRS approved certificate shall be prevented. (NIST SP 800-53 CM-5 CE3) (H)

10.8.1.4.4.4  (11-25-2011)
Patches and Hot Fixes

  1. The IRS shall establish and implement a patch management process for all information systems under the control of the IRS, in accordance with the agency's Patch Management policy and as specified: (TD P 85-01 S-PM.1)

    1. Procedures shall be established for evaluating, approving, and installing patches and hot fixes to ensure patches are installed;

    2. Security patches shall be tested and installed on a timeline in accordance with the criticality of the patches. (TD P 85-01 S-PM.2)

    3. The IRS shall ensure that, upon daily power up and/or connection to the IRS’s network, workstations (including remote connections using government furnished equipment [GFE]) are checked to ensure the most recent MITS-approved patches have been applied, and any absent or new patches are applied as necessary or otherwise checked no less than once every 24 hours (excluding weekends, holidays, etc.). (TD P 85-01 S-PM.3)
      i. Workstations shall include desktop and laptop computers that connect at any time to IRS networks.

    4. The IRS shall apply patches available from the Department of Homeland Security when addressing new vulnerabilities. (TD P 85-01 S-CVM.17)

10.8.1.4.4.5  (11-25-2011)
FISMA Reporting Requirements

  1. MITS Cybersecurity shall be responsible for submitting compliance metrics annually for IRS’ FISMA reporting.

  2. Business and Functional Unit Owners and AOs that own FISMA reportable assets shall be responsible for reporting Security Configuration Management compliance metrics.

  3. MITS Cybersecurity shall be responsible for gathering and reporting configuration data for the entire IRS enterprise.

  4. Business and Functional Unit Owners and AOs shall report compliance metrics on all applicable software installations.

    1. All installations that are IRS owned or outsourced operations shall be reported monthly for FISMA and Treasury submission. This includes all systems in the following environments: production, disaster recovery, training, development & testing.

  5. Business and Functional Unit Owners and AOs shall assume responsibility for:

    1. Ensuring that configurations are measured and reported;

    2. Changes to security controls are tested and documented; and

    3. Compliance metrics for all of their reportable FISMA assets are reported to Security Configuration Management.

  6. All IRS systems shall be verified for configuration management compliance by using the IRS-approved compliance verification applications (i.e. policy checkers) or the approved security posture monitoring system.

  7. Refer to MITS IT Security Program Management Office Security Configuration Management SOP for further detail related to all FISMA requirements within this sub-section.

  8. The IRS shall upload the following artifacts into the Department of Treasury’s FISMA tool as these are revised/completed: (P-INV.9)

    1. System name

    2. All Data Elements within the “System Inventory Report” tab (to include all dates for artifacts such as security categorization (FIPS 199), contractor system designation; system category, major/minor stand-alone/child designator; national security system designator, etc.)

    3. Interfaces, interconnections, etc.

    4. Annual testing reports as they are completed.

    5. Contingency plans

    6. Contingency plan test results

    7. Privacy-related artifacts or links.

    8. Security Awareness Training and Education (SATE) Plan

    9. Awareness training statistics, funding, etc.

    10. Specialized training statistics, funding, etc.

    11. Security Authorization Documentation:
      i. Accreditation Letter (for accredited system)
      ii. Certification Letter
      iii. E-Authentication (if applicable)
      iv. FIPS 199 Review
      v. Risk Assessment
      vi. Security Test & Evaluations (ST&E)
      vii. System Security Plan
      viii. Security Assessment Report – Self Assessment
      ix. Inter-agency agreements/Inter-Service Agreements
      x. Incident Response data

    12. Other items as advised to security officers through the Cyber Security Sub-Council.

    Note:

    National Security System Designator - The Treasury Department is only using the FISMA tool to track UNCLASSIFIED systems, so this should always indicate that the system is not a national security system.

10.8.1.4.4.6  (05-03-2012)
Configuration Settings

  1. Throughout an information system’s lifecycle, and in accordance with IRS security policies, the IRS shall: (NIST SP 800-53 CM-6)

    1. Establish and document mandatory configuration settings for IT products employed within IRS information systems using an automated means to check that the security configuration settings of IRS-installed/operated equipment are continually maintained in accordance with security configuration checklists (e.g., NIST checklist, DISA Security Technical Implementation Guide (STIG), NSA hardening guides, Center for Internet Security (CIS) security benchmark guides) that reflect the most restrictive mode consistent with operational requirements;

    2. Implement and enforce the established configuration settings;

    3. Identify, document, and approve exceptions from the mandatory configuration settings for individual components within IRS information systems based on explicit operational requirements; and

    4. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.

  2. The Basic Input/Output System (BIOS) configurations for information systems shall be configured in accordance with IRS operating system and/or platform specifications.

  3. Automated mechanisms shall be employed to centrally manage, apply, and verify configuration settings. (NIST SP 800-53 CM-6 CE1) (H)

  4. Automated mechanisms shall be employed to respond (e.g. notification, restoration of settings, halting affected system processes) to unauthorized changes to IRS-defined baseline configuration settings. (NIST SP 800-53 CM-6 CE2) (H)

  5. An automated means to check that the security configuration settings of IRS-installed/operated equipment are continually maintained in accordance with the applicable NIST-promulgated or other NIST 800-70, Security Configuration Checklists Program for IT Products – Guidance for Checklists Users and Developers, compliant checklists shall be implemented. (TD P 85-01 S-CVM.8)

  6. Automate enforcement for using selected configurations shall be implemented. (TD P 85-01 S-CVM.14)

  7. The detection of unauthorized, security-relevant configuration changes shall be incorporated into the computer security incident response capability to ensure such detected events are tracked, monitored, corrected, and available for historical purposes. (NIST SP 800-53 CM-6 CE3) (M, H)

  8. Standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved FDCC configuration.

  9. In order to comply with OMB and Department of the Treasury mandated security standards, the IRS shall:

    1. Ensure that changes/upgrades to systems, applications, and programs are compatible with the SCAP and the FDCC;

    2. Use tools compatible with the SCAP when monitoring security configurations of Vista and Windows XP; and (TD P 85-01 S-CVM.6)

    3. Refer to NIST SP 800-126, The Technical Specifications for the Security Content Automation Protocol (SCAP) and NIST SP 800-117, Guide to Adopting and Using the Security Content Automation Protocol (SCAP) for further guidance.

  10. When employing tools that have been SCAP-validated by NIST for configuration compliance checking, the IRS shall implement Production-level SCAP content provided by NIST (as opposed to SCAP content from other sources). (TD P 85-01 S-CVM.21)

    Note:

    Once SCAP content has been obtained from NIST, users should consult their product documentation to determine how to import the content into the product and execute it. While any validated product will have this capability, specific mechanisms for doing so will vary from one product to another. Issues with the importation and/or execution of the content should be addressed to the product vendor

  11. Acting upon a request from the IRS CIO, the Department of Treasury CIO shall, where appropriate, approve IRS-specific deviations for those FDCC settings that are not expected to be implemented in the foreseeable future. (TD P 85-01 S-CVM.19)

    1. Such CIO-approved "permanent" deviations are not required to be tracked in POA&Ms.

    2. All other FDCC deviations, not approved as a "permanent" deviation by the Department of Treasury CIO, shall be tracked in a POA&M. (TD P 85-01 S-CVM.20)

  12. Administration of configuration settings shall be restricted to only IRS authorized professionals (TD P 85-01 S-CVM.15)

  13. Configurations shall be tested in a non-production environment to identify adverse effects on system functionality. (TD P 85-01 S-CVM.13)

  14. Data related to security configuration and vulnerability management shall be reported in accordance with processes and mechanisms as may be established by the Department of the Treasury and this IRM. (TD P 85-01 S-CVM.5)

  15. IRS information systems shall be configured in accordance with the principle of least functionality--specifically, prohibiting and/or restricting the use of the functions, ports, protocols, and/or services as outlined in the Network Protection and Design section of this IRM. (NIST SP 800-53 CM-7)

  16. IRS information systems shall be reviewed at a minimum annually to identify and eliminate unnecessary functions, ports, protocols, and/or services. (NIST SP 800-53 CM-7 CE1)

    1. This requirement applies to information systems categorized at the following FIPS 199 impact-levels:
      • LOW systems connected to an IRS network
      • MODERATE
      • HIGH

  17. An automated capability shall be employed to prevent program execution using one of the following means (e.g., White List, Black List, Gray List): (NIST SP 800-53 CM-7 CE2) (H)

    1. A list of authorized software programs

    2. A list of unauthorized software programs

    3. Rules authorizing the terms and conditions of software program usage

10.8.1.4.5  (05-03-2012)
Maintenance

  1. The IRS shall develop, disseminate, review, and update every three (3) years (or if there is a significant change) a formal, documented System Maintenance Policy that addresses the following: (NIST SP 800-53 MA-1)

    • Purpose

    • Scope

    • Roles and Responsibilities

    • Management commitment

    • IRS coordination

    • Compliance

  2. The IRS shall develop, disseminate, review, and update annually procedures to facilitate the implementation of the System Maintenance Policy and associated system maintenance controls. (NIST SP 800-53 MA-1)

    1. The System Maintenance Policy and procedures shall be consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

  3. Refer to IRM 2.7.1, Modernization and Information Technology Services (MITS) Operations, Inter-Center for additional guidance on system maintenance.

10.8.1.4.5.1  (05-03-2012)
Controlled Maintenance

  1. The IRS shall: (NIST SP 800-53 MA-2)

    1. Schedule, perform, document, and review records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or IRS requirements;

    2. Control all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

    3. Require that a designated official explicitly approve the removal of the information system or system components from IRS facilities for off-site maintenance or repairs;

    4. Sanitize equipment to remove all information from associated media prior to removal from IRS facilities for off-site maintenance or repairs; and

    5. Check all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions.

  2. Maintenance records for information systems shall be maintained that include: (NIST SP 800-53 MA-2 CE1) (M, H)

    1. Date and time of maintenance;

    2. Name of the individual performing the maintenance;

    3. Name of escort, if necessary;

    4. A description of the maintenance performed; and

    5. A list of equipment removed or replaced (including identification numbers, if applicable).

  3. Automated mechanisms shall be employed to schedule, conduct, and document maintenance and repairs as required, producing up-to date, accurate, complete, and available records of all maintenance and repair actions, needed, in process, and completed. (NIST SP 800-53 MA-2 CE2) (H)

  4. The IRS shall ensure that operations and maintenance of systems located in the U.S. are conducted by personnel physically located within the U.S. or its territories. (TD P 85-01 P-AC&O.7)

  5. Following information system upgrades or consolidations, surplus equipment shall be secured until it has been properly prepared for surplus.

  6. Changes made to hardware or software during maintenance shall be recorded per configuration management processes for the hardware or software.

10.8.1.4.5.2  (05-03-2012)
Maintenance Tools

  1. The IRS shall approve, control, monitor the use of, and maintain on an ongoing basis, information system maintenance tools. (NIST SP 800-53 MA-3) (M, H)

  2. All maintenance tools (e.g., diagnostic and test equipment used to conduct maintenance) carried into a facility by maintenance personnel shall be inspected for obvious improper modifications. (NIST SP 800-53 MA-3 CE1) (M, H)

  3. All media containing diagnostic and test programs shall be inspected for malicious code before the media is used in the maintenance or troubleshooting of an information system. (NIST SP 800-53 MA-3 CE2) (M, H)

  4. The unauthorized removal of maintenance equipment be prevented by one of the following means: (NIST SP 800-53 MA-3 CE3) (H)

    1. Verifying that there is no organizational information contained on the equipment;

    2. Sanitizing or destroying the equipment;

    3. Retaining the equipment within the facility; or

    4. Obtaining an exemption from a designated organization official explicitly authorizing removal of the equipment from the facility.

10.8.1.4.5.3  (05-03-2012)
Non-Local Maintenance

  1. The IRS shall: (NIST SP 800-53 MA-4)

    1. Authorize, monitor, and control non-local maintenance and diagnostic activities;

    2. Allow the use of non-local maintenance and diagnostic tools only as consistent with IRS policy and documented in the security plan for the information system;

    3. Employ strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions;

    4. Maintain records for non-local maintenance and diagnostic activities; and

    5. Terminate all sessions, maintenance ports, and network connections when non-local maintenance is completed.

    Note:

    Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network; either an external network (e.g., the Internet) or an internal network. "Maintenance Ports" are defined to be ports used in the remote maintenance of a system.

  2. Non-local maintenance and diagnostic sessions shall be audited. (NIST SP 800-53 MA-4 CE1) (M, H)

    1. Designated IRS personnel shall review the maintenance records of the sessions.

  3. The installation and use of non-local maintenance and diagnostic connections shall be documented in the security plan for the information system. (NIST SP 800-53 MA-4 CE2) (M, H)

  4. The IRS shall: (NIST SP 800-53 MA-4 CE3) (H)

    1. Require that non-local maintenance and diagnostic services be performed from an information system that implements a level of security at least as high as that implemented on the system being serviced; or

    2. Remove the component to be serviced from the information system and prior to non-local maintenance or diagnostic services, sanitizes the component (with regard to IRS information) before removal from IRS facilities, and after the service is performed, inspects and sanitizes the component (with regard to potentially malicious software and surreptitious implants) before reconnecting the component to the information system.

10.8.1.4.5.4  (05-03-2012)
Maintenance Personnel

  1. Individuals not previously identified in the information system, such as vendor personnel and consultants, may legitimately require privileged access to the system, for example, when required to conduct maintenance or diagnostic activities with little or no notice. Based on a prior assessment of risk, the IRS may issue temporary credentials to these individuals, which may be for one-time use or for a very limited time period.

  2. A process for authorizing maintenance personnel shall be established. (NIST SP 800-53 MA-5)

    1. A current list of authorized maintenance organizations or personnel shall be maintained.

  3. Personnel performing maintenance on the information system shall either: (NIST SP 800-53 MA-5)

    1. Have the required access authorizations, or

    2. Be accompanied by designate IRS personnel with required access authorizations and technical competence deemed necessary to supervise the information system maintenance when maintenance personnel do not possess the required access authorizations.

  4. Access to system software and hardware shall be limited to authorized personnel. (NIST SP 800-53 MA-5)

  5. Refer to IRM 10.23.2, Personnel Security, Contractor Investigations, for additional guidance.

10.8.1.4.5.5  (05-03-2012)
Timely Maintenance

  1. Maintenance support and/or spare parts shall be obtained for security-critical information system components and/or key information technology components to meet the Recovery Time Objective/Recovery Point Objective (RTO/RPO) timelines agreed upon in the information systems Information Technology Contingency Plan (ITCP). (NIST SP 800-53 MA-6) (M, H)

    Note:

    The IRS specifies those information system components that, when not operational, result in increased risk to organizations, individuals, or the Nation because the security functionality intended by that component is not being provided. Security-critical components include, for example, firewalls, guards, gateways, intrusion detection systems, audit repositories, authentication servers, and intrusion prevention systems.

10.8.1.4.6  (05-03-2012)
System and Information Integrity

  1. The IRS shall develop, disseminate, review, and update every three (3) years (or if there is a significant change) a formal, documented System and Information Integrity Policy that addresses the following: (NIST SP 800-53 SI-1)

    • Purpose

    • Scope

    • Roles and Responsibilities

    • Management commitment

    • IRS coordination

    • Compliance

  2. The IRS shall develop, disseminate, review, and update annually procedures to facilitate the implementation of the System and Information Integrity Policy and associated system and information integrity controls. (NIST SP 800-53 SI-1)

    1. The System and Information Integrity Policy and procedures shall be consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

  3. The IRS shall ensure that all devices across the enterprise that store IRS data are appropriately reviewed for security purposes prior to connection or reconnection to the IRS network (e.g., checks for malicious code, updates to malware detection software, critical software updates and patches, operating system integrity, and disabled hardware). Treasury Amended Control (TD P 85- 01 S-CVM.23)

    1. All devices across the enterprise that store IRS data, upon attempted connection or reconnection to the IRS network, shall connect to a quarantined network prior to a security review which includes the checks specified in this section prior to connection or reconnection to IRS network resources.

  4. Refer to IRM 2.7.1, for additional guidance on system and information integrity.

10.8.1.4.6.1  (05-03-2012)
Flaw Remediation

  1. The IRS shall: (NIST SP 800-53 SI-2)

    1. Identify, report, and correct information system flaws;

    2. Test software updates related to flaw remediation for effectiveness and potential side effects on IRS information systems before installation; and

    3. Incorporate flaw remediation into the IRS configuration management process.

    Note:

    Refer to the Configuration Management section of this IRM for configuration management processes.

  2. The flaw remediation process and installation of software upgrades shall be centrally managed automatically. Treasury has granted an exception of the automated requirement for stand-alone systems. (NIST SP 800-53 SI-2 CE1; TD P 85-01 S-EC.13)

    Note:

    Due to information system integrity and availability concerns, careful consideration should be given to the methodology used to carry out automatic updates. Automatic installation is not required for standalone systems which are not connected to the IRS Network.

  3. Automated mechanisms shall be employed, at a minimum monthly, to determine the state of information system components with regard to flaw remediation. Treasury has granted an exception of the automated requirement for stand-alone systems. (NIST SP 800-53 SI-2 CE2; TD P 85-01 S-EC.13)

  4. IRS information systems shall: (NIST SP 800-53 SI-11) (M, H)

    1. Identify potentially security-relevant error conditions;

    2. Generate error messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information that could be exploited by adversaries; and

    3. Reveal error messages only to authorized personnel.

    Note:

    The structure and content of error messages should be carefully considered. The extent to which the information system is able to identify and handle error conditions is guided by IRS policy and operational requirements. Sensitive information includes, for example, account numbers, social security numbers, and credit card numbers.

10.8.1.4.6.2  (05-03-2012)
Malicious Code Protection

  1. Malicious code protection mechanisms shall be employed at information system entry and exit points and at workstations, servers, or mobile computing devices on the network. (NIST SP 800-53 SI-3)

    Note:

    Examples of information system entry and exit points includes but is not limited to, firewalls, electronic mail servers, web servers, proxy servers, and remote-access servers. Examples of malicious code include but are not limited to, viruses, worms, Trojan horses, and spyware.

    1. UNIX and Linux systems functioning as a server on the internal, trusted network are not required to deploy anti-virus software; all other UNIX and Linux systems are still required to deploy anti-virus software.

      Note:

      All other systems (not a UNIX or Linux server on a trusted IRS network) uploading or downloading files from a UNIX or Linux server are responsible for checking the files with anti-virus software.

    2. Systems not required to deploy anti-virus software are still required to implement the operational and technical control guidance outlined within this IRM. These control functionalities include, but are not limited to:
      i. Access Controls (e.g., Role-based);
      ii. Incident Response training;
      iii. Patch Management;
      iv Audit log reviews;
      v. Firewalls and host intrusion detection system (HIDS); and
      vi. File integrity verification (e.g., hash or checksum).

  2. Malicious code protection mechanisms shall be employed to detect and eradicate malicious code: (NIST SP 800-53 SI-3)

    1. Transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means; or

    2. Inserted through the exploitation of information system vulnerabilities.

  3. Malicious code protection mechanisms (including signature definitions) shall be updated whenever new releases are available in accordance with IRS configuration management policy and procedures. (NIST SP 800-53 SI-3)

  4. The IRS shall, not less than daily, check for updates to malicious code scanning tools, including anti-virus and anti-spyware software and intrusion detection tools, and when updates are available, implement on all devices on which such tools reside. (TD P 85-01 S-CVM.22)

  5. Malicious code protection mechanisms shall be configured to: (NIST SP 800-53 SI-3)

    1. Perform weekly scans of an information system;

    2. Perform real-time scans of files from external sources as the files, internet downloads, and e-mail are received, downloaded, opened, or executed in accordance with IRS security policy; and

    3. Either block or quarantine malicious code, and send an alert to the system administrator in response to malicious code detection.

  6. The IRS shall address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of an information system. (NIST SP 800-53 SI-3)

  7. All information systems on an IRS network acting as a workstation, where malicious code protection is required, shall adhere to the following:

    1. Malicious code protection mechanisms shall be centrally managed. (NIST SP 800-53 SI-3 CE1)

    2. Malicious code protection mechanisms (including signature definitions) shall automatically update (NIST SP 800-53 SI-3 CE2)

    3. Non-privileged users shall be prevented from circumventing malicious code protection capabilities (e.g., disabling). (NIST SP 800-53 SI- 3 CE3)

10.8.1.4.6.2.1  (05-03-2012)
SPAM Protection

  1. Spam protection mechanisms shall be deployed at information system entry and exit points, on workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, or other common means. (NIST SP 800-53 SI-8) (M, H)

  2. Spam protection mechanisms shall be updated (including signature definitions) when new releases are available in accordance with IRS configuration management policy and procedures. (NIST SP 800-53 SI-8) (M, H)

    Note:

    Information system entry and exit points include, for example, firewalls, electronic mail servers, web servers, proxy servers, and remote-access servers.

  3. E-mail spamming, sending or forwarding chain letters, other junk e-mail, or inappropriate messages shall be prohibited.

10.8.1.4.6.3  (05-03-2012)
Electronic Mail (E-Mail) Security

  1. The IRS shall configure e-mail systems to provide appropriate security to the network where the systems reside and to the data stored and transmitted by the e-mail systems in accordance with NIST SP 800-45, Guidelines on Electronic Mail Security.

  2. All inbound e-mail, with the exception of mail with a sender address claiming to be from a Treasury entity and having originated from a trusted Department of the Treasury e-mail system, shall be delivered to Department of the Treasury recipients only after all hyperlinks have been rendered inactive (i.e., the text of links may be viewable, but no longer user clickable). (TD P 85-01 S-EMS.4)

    Note:

    This guidance does not restrict the ability to send active hyperlinks to users outside of Treasury nor within or among the various Bureaus.

  3. All e-mail services (for example, UNIX sendmail) shall be configured as securely as an e-mail server.

  4. E-mail messages, appointments, and other collaboration mechanisms shall not be used to transmit SBU data unless encrypted when transmitted and stored.

    1. Employees sending e-mail messages containing SBU shall do so using Outlook, encrypting the information when it is transmitted and stored with the MITS-approved solution for e-mail encryption.

    2. E-mail messages with text containing SBU sent to another IRS e-mail address or to an e-mail address external to the IRS shall be encrypted using the MITS-approved solution for e-mail encryption.

    3. Files containing SBU data sent to an IRS e-mail address or to an e-mail address external to the IRS must be encrypted using the MITS-approved solution for e-mail encryption.

  5. Access to privately-owned e-mail accounts regardless of method or protocol shall be prohibited.

  6. By using IRS e-mail, personnel shall consent to have their e-mail monitored via the System-use Notification Message/Warning Banner when logging onto an information system.

  7. Any use of IRS IT resources, including e-mail, shall be made with the understanding that such use may not be secure, is not private, is not anonymous and may be subject to disclosure under FOIA.

  8. The IRS shall use means to reduce junk e-mail (spam) and take steps to ensure that e-mail communications are free of known viruses, worms, spyware, and other malware (malicious code). (TD P 85-01 S-EMS.2)

  9. E-mail shall be retained as an official record. Refer to the IRM 1.15 series for additional instruction.

  10. Refer to IRM 1.10.3, Standards for Using E-Mail, for additional guidance on e-mail.

10.8.1.4.6.3.1  (05-03-2012)
Privately Owned E-Mail Accounts

  1. Non-IRS/Treasury accounts shall not be used for any government or official purposes.

  2. Automatic forwarding shall not be used to send messages to non-IRS/Treasury accounts.

  3. Federal Tax Information (FTI) transmitted to conduct IRS business shall be done in accordance with IRM 1.10.3.

10.8.1.4.6.4  (05-03-2012)
Information System Monitoring

  1. The IRS shall: (NIST SP 800-53 SI-4) (M, H)

    1. Monitor events on an information system and networks in accordance with MITS/Cybersecurity defined monitoring objectives and detect information system attacks;

    2. Identify unauthorized use of an information system;

    3. Deploy monitoring devices:
      i. Strategically within IRS networks to collect IRS-determined essential information; and
      ii. At ad hoc locations within a network to track specific types of transactions of interest to the IRS;

    4. Heighten a network’s and/or information system’s level of monitoring activity whenever there is an indication of increased risk to IRS operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; and

    5. Obtain legal opinion from the IRS Chief Counsel with regard to monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations.

  2. Automated tools shall be employed to support near-real-time analysis of events. (NIST SP 800-53 SI-4 CE2) (M, H)

  3. As part of the organization’s network boundary protection plan, automated tools shall be employed to support near-real-time analysis of events in support of attack detection: (TD P 85-01 S-NBP.7)

    1. Audit logs shall be maintained to track prohibited sources and services.

  4. IRS information systems shall:

    1. Monitor inbound and outbound communications for unusual or unauthorized activities or conditions. (NIST SP 800-53 SI-4 CE4) (M, H)

      Note:

      Unusual/unauthorized activities or conditions include, for example, internal traffic that indicates the presence of malicious code within an information system or propagating among system components, the unauthorized export of information, or signaling to an external information system. Evidence of malicious code is used to identify potentially compromised information systems or information system components.

    2. Provide near real-time alerts when indications of compromise or potential compromise occur. (NIST SP 800-53 SI-4 CE5) (M, H)

      Note:

      Alerts may be generated, depending on the organization-defined list of indicators, from a variety of sources, for example, audit records or input from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers.

    3. Prevent non-privileged users from circumventing intrusion detection and prevention capabilities. (NIST SP 800-53 SI-4 CE6) (M, H)

10.8.1.4.6.4.1  (05-03-2012)
Software and Information Integrity

  1. IRS information systems shall detect unauthorized changes to software and information. (NIST SP 800-53 SI-7) (M, H)

    Note:

    Integrity verification applications may be used on an information system to look for evidence of information tampering, errors, and omissions. The IRS should use approved software engineering practices with regard to commercial off-the-shelf integrity mechanisms (e.g., parity checks, cyclical redundancy checks, and cryptographic hashes) and use tools to automatically monitor the integrity of an information system and the applications it hosts.

  2. The integrity of software and information shall be reassessed by performing integrity scans of the information system at the following frequencies:. (NIST SP 800-53 SI-7 CE1)

    1. HIGH – at a minimum semi-annually

    2. MODERATE – at a minimum annually

  3. Automated tools shall be employed that provide notification to designated individuals upon discovering discrepancies during integrity verification. (NIST SP 800-53 SI-7 CE2) (H)

10.8.1.4.6.4.2  (05-03-2012)
Security Functionality Verification

  1. The correct operation of information system security functions shall be validated at least quarterly; system administrators (SA) shall be notified when any anomalies are discovered. (NIST SP 800-53 SI-6) (M, H)

    1. In addition, IRS information systems shall verify the correct operation of security functions: (NIST SP 800-53 SI-6) (M, H)
      i. On system start-up,
      ii. Upon issuance of the appropriate privileged command,
      iii. Upon command by user with appropriate privilege,
      iv. Every 7 days, and
      v. Notifies the system administrator when anomalies are discovered.

      Note:

      The need to verify security functionality applies to all security functions. For those security functions that are not able to execute automated self-tests, either implement compensating security controls or explicitly accept the risk of not performing the verification as required. Information system transitional states include, for example: startup, restart, shutdown, and abort.

  2. IRS information systems shall provide notification of failed automated security tests. (NIST SP 800-53 SI-6 CE1) (M, H)

  3. IRS information systems provide automated support for the management of distributed security testing. (NIST SP 800-53 SI-6 CE2) (M, H)

  4. The results of security function verifications shall be reported to designated IRS officials with information security responsibilities. (NIST SP 800-53 SI-6 CE3) (M, H)

10.8.1.4.6.5  (05-03-2012)
Security Alerts, Advisories, Directives

  1. The IRS shall: (NIST SP 800-53 SI-5)

    1. Receive information system security alerts, advisories, and directives from designated external organizations on an ongoing basis;

    2. Generate internal security alerts, advisories, and directives;

    3. Disseminate security alerts, advisories, and directives to IRS personnel; and

    4. Implement security directives in accordance with established timeframes, or notifies the issuing organization of the degree of non-compliance.

      Note:

      Security alerts and advisories are generated by the United States Computer Emergency Readiness Team (US-CERT) to maintain situational awareness across the federal government. Security directives are issued by OMB or other designated organizations with the responsibility and authority to issue such directives. Compliance to security directives is essential due to the potential immediate adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner.

  2. Automated mechanisms shall be employed to make security alert and advisory information available throughout the IRS as needed (NIST SP 800-53 SI-5 CE1) (H)


Prev Next

More Internal Revenue Manual