Information systems at the FIPS PUB 199 Moderate and High Identification and impact levels must implement multi-factor authentication for Authentication non-privileged accounts. (Organizational IA-2 (2) Users) | Network M, H Information systems technically integrate with a GSA Access to supported enterprise identification and authentication solution (e.g., SAML 2.0 with SSO integration (following 2FA Accounts with HSPD-12 PIV card)). The information system shall implement FIPS PUB 140-2 Cryptographic compliant encryption modules for authentication functions. IA-7 Module L, M, H Reference: Authentication Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives, diskettes, compact disks and MP-4 Media Storage M, H digital video disks shall be encrypted using a FIPS PUB 140-2 certified encryption module. Digital including magnetic tapes, external/removable hard drives, flash/thumb drives and digital video disks shall be MP-5 Transport M, H encrypted using a FIPS PUB 140-2 certified encryption module during transport outside of controlled areas. All information system security architectures must be formally Information reviewed and approved by the Office of the Chief Information PL-8 Security M, H Security Officer, Security Engineering Division during the Architecture system develop/design stages of the SDLC and prior to Security Assessment and Authorization. All systems must integrate with the GSA vulnerability scanning tool set managed by the Security Operations Division in the Vulnerability RA-5 L, M, H Office of the Chief Information Security Officer. Information Scanning systems shall coordinate integration with the scanning program by contacting . All systems must be comprised of software and hardware Unsupported components that are fully supported in terms of security SA-22 System GSA Required patching for the anticipated life of the system; software must Components be on GSA’s Enterprise Architecture IT Standards List.
IA-2 (2) Identification and Authentication (Organizational Users) | Network Access to Accounts M, H Information systems at the FIPS PUB 199 Moderate and High impact levels must implement multi-factor authentication for non-privileged accounts. Information systems technically integrate with a GSA supported enterprise identification and authentication solution (e.g., SAML 2.0 with SSO integration (following 2FA with HSPD-12 PIV card)). IA-7 Cryptographic Module Authentication L, M, H The information system shall implement FIPS PUB 140-2 compliant encryption modules for authentication functions. Reference: MP-4 Media Storage M, H Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives, diskettes, compact disks and digital video disks shall be encrypted using a FIPS PUB 140-2 certified encryption module. MP-5 Transport M, H Digital including magnetic tapes, external/removable hard drives, flash/thumb drives and digital video disks shall be encrypted using a FIPS PUB 140-2 certified encryption module during transport outside of controlled areas. PL-8 Information Security Architecture M, H All information system security architectures must be formally reviewed and approved by the Office of the Chief Information Security Officer, Security Engineering Division during the system develop/design stages of the SDLC and prior to Security Assessment and Authorization. RA-5 Vulnerability Scanning L, M, H All systems must integrate with the GSA vulnerability scanning tool set managed by the Security Operations Division in the Office of the Chief Information Security Officer. Information systems shall coordinate integration with the scanning program by contacting . SA-22 Unsupported System Components GSA Required All systems must be comprised of software and hardware components that are fully supported in terms of security patching for the anticipated life of the system; software must be on GSA’s Enterprise Architecture IT Standards List.
Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_%5BCIO_IT_Security_09-48_Rev_4%5D_01-25-2018.docx