Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-2 validated, respectively. Digital signature encryption algorithms - Reference: Block cypher encryption algorithms - Reference: Transmission SC-8/ Secure hashing algorithms Reference: – Confidentiality and M, H Integration Internet accessible Websites shall implement HTTPS Only and (HSTS), reference OMB Memorandum M-15-13. SSL/TLS implementations align with GSA IT Security Procedural Guide 14-69, Implementation.” “SSL/TLS Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-2 validated, respectively. Cryptographic SC-13 L, M, H Protection Digital signature encryption algorithms - Reference: Block cypher encryption algorithms - Reference: Secure hashing algorithms Reference: – Implement appropriate creation, use, and signing of crypto certs in agreement with GSA IT Security Procedural Guide SC-17 PKI Certificates M, H Implementation,” and NIST Special Publications “SSL/TLS 800-32, NIST 800-63. iOS and Android app creation, usage restrictions. Mobile applications shall undergo assessment and authorization SC-18 Mobile Code M, H practices as documented in GSA IT Security Procedural Guide 12-67, Mobile Devices and Applications.” “Securing Information systems shall be Domain Name System Security Architecture and Extensions (DNSSEC) compliant. Reference OMB Provisioning for SC-22 L, M, H Memorandum M-08-23, which requires all Federal Name / Address Government departments and agencies that have registered Resolution Service and are operating second level .gov to be DNSSEC. GSA Required Systems bearing PII must implement protect information at Protection of For systems rest. At a minimum, fields bearing PII data must be encrypted – Information at with with field level encryption. Encryption algorithms shall be SC-28 (1) Rest | Personally FIPS-approved; implemented encryption modules shall be FIPS Cryptographic Identifiable PUB 140-2 validated. Protection Information Only All projects and systems must be adequately tested for all Critical, High, and Moderate risk findings must be SI-2 Flaw Remediation L, M, H remediated prior to go-live. Post go-live, all critical and high vulnerabilities identified must be mitigated within 30 days and all moderate vulnerabilities mitigated within 90 days.
SC-8/ Transmission Confidentiality and Integration M, H Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-2 validated, respectively. Digital signature encryption algorithms - Reference: Block cypher encryption algorithms - Reference: Secure hashing algorithms – Reference: Internet accessible Websites shall implement HTTPS Only and (HSTS), reference OMB Memorandum M-15-13. SSL/TLS implementations align with GSA IT Security Procedural Guide 14-69, “SSL/TLS Implementation.” SC-13 Cryptographic Protection L, M, H Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS PUB 140-2 validated, respectively. Digital signature encryption algorithms - Reference: Block cypher encryption algorithms - Reference: Secure hashing algorithms – Reference: SC-17 PKI Certificates M, H Implement appropriate creation, use, and signing of crypto certs in agreement with GSA IT Security Procedural Guide “SSL/TLS Implementation,” and NIST Special Publications 800-32, NIST 800-63. SC-18 Mobile Code M, H iOS and Android app creation, usage restrictions. Mobile applications shall undergo assessment and authorization practices as documented in GSA IT Security Procedural Guide 12-67, “Securing Mobile Devices and Applications.” SC-22 Architecture and Provisioning for Name / Address Resolution Service L, M, H Information systems shall be Domain Name System Security Extensions (DNSSEC) compliant. Reference OMB Memorandum M-08-23, which requires all Federal Government departments and agencies that have registered and are operating second level .gov to be DNSSEC. SC-28 (1) Protection of Information at Rest | Cryptographic Protection GSA Required – For systems with Personally Identifiable Information Only Systems bearing PII must implement protect information at rest. At a minimum, fields bearing PII data must be encrypted with field level encryption. Encryption algorithms shall be FIPS-approved; implemented encryption modules shall be FIPS PUB 140-2 validated. SI-2 Flaw Remediation L, M, H All projects and systems must be adequately tested for all Critical, High, and Moderate risk findings must be remediated prior to go-live. Post go-live, all critical and high vulnerabilities identified must be mitigated within 30 days and all moderate vulnerabilities mitigated within 90 days.
Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_%5BCIO_IT_Security_09-48_Rev_4%5D_01-25-2018.docx