Essential Security Controls All NIST 800-53 controls must be implemented as per the applicable FIPS PUB 199 Low, Moderate, or High baseline. The following table identifies essential security controls from the respective baselines to highlight their importance and ensure they are implemented. The Contractor shall make the proposed system and security architecture of the information system available to the Security Engineering Division, in the Office of the Chief Information Security Officer for review and approval before commencement of system build (architecture, infrastructure, and code). Control Control Title Baseline GSA Implementation Guidance ID Account AC-2 L, M, H Management All remote accesses from internal users/systems to the Remote Access | external information system must be routed through GSA’s AC-17 (3) Managed Access M, H managed network access control points, subjecting them to Control Points security monitoring. Information systems shall implement audit configuration requirements as documented in applicable GSA IT Security Technical Hardening Guides (i.e., hardening and technology implementation guides); for web applications see GSA IT Security Procedural Guide 07-35, Section 2.8.10, What to Log. AU-2 Audit Events L, M, H For technologies where a Technical Guide and Standard does not exist, events from an industry source such as vendor guidance or Center for Internet Security benchmark, recommended by the GSA S/SO or Contractor to be approved and accepted by the GSA AO shall be used. Information systems, including vendor systems on behalf of GSA, shall configure their systems in agreement Configuration CM-6 L, M, H with GSA technical guidelines, NIST guidelines, Center for Settings Internet Security guidelines (Level 1), or industry best practice guidelines, as deemed appropriate. FIPS PUB 199 Moderate and High impact systems must implement processing across geographically-disparate locations to ensure fault tolerance. Amazon Web Services Alternative CP-7 M, H based architectures must implement a multi-region strategy Processing Site (multiple availability zones in a single region are not sufficient). FIP PUB 199 Moderate and High impact information systems must implement alternate telecom services to support CP-8 Telecom Services M, H resumption when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage
Essential Security Controls All NIST 800-53 controls must be implemented as per the applicable FIPS PUB 199 Low, Moderate, or High baseline. The following table identifies essential security controls from the respective baselines to highlight their importance and ensure they are implemented. The Contractor shall make the proposed system and security architecture of the information system available to the Security Engineering Division, in the Office of the Chief Information Security Officer for review and approval before commencement of system build (architecture, infrastructure, and code). Control ID Control Title Baseline GSA Implementation Guidance AC-2 Account Management L, M, H AC-17 (3) Remote Access | Managed Access Control Points M, H All remote accesses from internal users/systems to the external information system must be routed through GSA’s managed network access control points, subjecting them to security monitoring. AU-2 Audit Events L, M, H Information systems shall implement audit configuration requirements as documented in applicable GSA IT Security Technical Hardening Guides (i.e., hardening and technology implementation guides); for web applications see GSA IT Security Procedural Guide 07-35, Section 2.8.10, What to Log. For technologies where a Technical Guide and Standard does not exist, events from an industry source such as vendor guidance or Center for Internet Security benchmark, recommended by the GSA S/SO or Contractor to be approved and accepted by the GSA AO shall be used. CM-6 Configuration Settings L, M, H Information systems, including vendor systems on behalf of GSA, shall configure their systems in agreement with GSA technical guidelines, NIST guidelines, Center for Internet Security guidelines (Level 1), or industry best practice guidelines, as deemed appropriate. CP-7 Alternative Processing Site M, H FIPS PUB 199 Moderate and High impact systems must implement processing across geographically-disparate locations to ensure fault tolerance. Amazon Web Services based architectures must implement a multi-region strategy (multiple availability zones in a single region are not sufficient). CP-8 Telecom Services M, H FIP PUB 199 Moderate and High impact information systems must implement alternate telecom services to support resumption when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage
Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_%5BCIO_IT_Security_09-48_Rev_4%5D_01-25-2018.docx