Previous SEC 501‐06 Control References: None
Withdrawn from SEC501‐07 PORTIONS KEPT FOR DMV Control: The organization:
a. Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information.
Supplemental Guidance: The control applies to information that may be restricted in some manner (e.g., privileged medical, contract‐
sensitive, proprietary, personally identifiable information, special access programs/compartments) based on some formal or administrative determination. Depending on the information‐sharing circumstance, the sharing partner may be defined at the individual, group, or organization level and information may be defined by specific content, type, or security categorization. Related control: AC‐3.
Control Enhancements for Sensitive Systems: None PCI compliance: PCI‐DSS has no requirement for this control.
AC‐22 PUBLICLY ACCESSIBLE CONTENT Previous SEC 501‐06 Control
References: 2.4.2.8 Control: The organization:
a. Designates individuals authorized to post information onto an organizational information system that is publicly accessible;
b. Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
c. Reviews the proposed content of publicly accessible information for nonpublic information prior to posting onto the organizational information system;
d. Reviews the content on the publicly accessible organizational information system for nonpublic information every 60‐days at a minimum and
e. Removes nonpublic information from the publicly accessible organizational information system, if discovered.
Supplemental Guidance: Nonpublic information is any information for which the general public is not authorized access in accordance with laws, directives, policies, regulations, standards, or guidance. Information protected under the Privacy Act and vendor proprietary information are examples of nonpublic information. This control addresses posting information on an organizational information system that is accessible to the general public, typically without identification or authentication. The posting of information on non‐
organization information systems is covered by appropriate organizational policy. Related controls: AC‐3, AU‐13.
Control Enhancements for Sensitive Systems: None PCI compliance: PCI‐DSS has no requirement for this control.
2.2 FAMILY: AWARENESS AND TRAINING CLASS: OPERATIONAL
AT‐2 SECURITY AWARENESS Previous SEC 501‐06 Control
References: 8.3.2.2 Control: The organization provides basic security awareness training to all information system users (including managers, senior
executives, and contractors) as part of initial training for new users, when required by system changes, and annually or more often as necessary thereafter.
Supplemental Guidance: The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security as it relates to the organization’s information security program. Security awareness techniques can include, for example, displaying posters, offering supplies inscribed with security reminders, generating email advisories/notices from senior organizational officials, displaying logon screen messages, and conducting information security awareness events.
Control Enhancements for Sensitive Systems: None
PCI compliance: The requirements specified in this security control meet the following PCI‐DSS requirements:
8.5.7 Communicate authentication procedures and policies to all users who have access to cardholder data.
12.6 Implement a formal security awareness program to make all personnel aware of the importance of cardholder data security.
12.6.1 Educate personnel upon hire at least annually.
AT‐2‐COV SECURITY AWARENESS (COV) Previous SEC 501‐06 Control
References: 8.3.2.6/8.3.2.7 1 Control: Develop an information security training program so that each IT system user is aware of and understands the following
concepts:
a. The Agency's policy for protecting IT systems and data, with a particular emphasis on sensitive IT systems and data;
b. The concept of separation of duties;
c. Prevention and detection of information security incidents, including those caused by malicious code;
d. Proper disposal of data storage media;
e. Proper use of encryption;
f. Access controls, including creating and changing passwords and the need to keep them confidential;
g. Agency acceptable use policies;
h. Agency Remote Access policies; and
i. Intellectual property rights, including software licensing and copyright issues.
j. Responsibility for the security of COV data;
k. Phishing; and l. Social engineering.
2 Require documentation of IT system users’ acceptance of the agency’s security policies after receiving information security training.
Supplemental Guidance: None
Control Enhancements for Sensitive Systems: None
PCI compliance: The requirements specified in this security control meet the following PCI‐DSS requirements:
8.5.7 Communicate authentication procedures and policies to all users who have access to cardholder data.
12.6 Implement a formal security awareness program to make all personnel aware of the importance of cardholder data security.
12.6.1 Educate personnel upon hire at least annually.
12.6.2 Require personnel to acknowledge at least annually that they have read and understood the security policy and procedures.
AT‐3 SECURITY TRAINING Previous SEC 501‐06 Control
References: 8.3.2.2/8.2.2.3 Control: The organization provides role‐based security‐related training: (i) before authorizing access to the system or performing
assigned duties; (ii) when required by system changes; and (iii) as practical and necessary thereafter.
Supplemental Guidance: The organization determines the appropriate content of security training based on assigned roles and responsibilities and the specific requirements of the organization and the information systems to which personnel have authorized access. In addition, the organization provides information system managers, system and network administrators, personnel performing independent verification and validation activities, security control assessors, and other personnel having access to system‐level software, adequate security‐related technical training to perform their assigned duties. Organizational security training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical safeguards and
countermeasures. The organization also provides the training necessary for these individuals to carry out their responsibilities related to operations security within the context of the organization’s information security program. Related controls: AT‐2, SA‐3 .
Control Enhancements for Sensitive Systems: None PCI compliance: PCI‐DSS has no requirement for this control.
AT‐4 SECURITY TRAINING RECORDS Previous SEC 501‐06 Control References: 8.3.2.5
Control: The organization:
a. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and
b. Retains individual training records for 3 years after completion of training then destroy.
Supplemental Guidance: While an organization may deem that organizationally mandated individual training programs and the development of individual training plans are necessary, this control does not mandate either. Documentation for specialized training may be maintained by individual supervisors at the option of the organization.
Library of Virginia Schedule GS‐103: Personnel Records, Training Records Not Required for Certification or Qualification, series 100501 ‐ specifies 3 year retention for employee training records.
Control Enhancements for Sensitive Systems: None PCI compliance: PCI‐DSS has no requirement for this control.
AT‐5 CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS Previous SEC 501‐06 Control
References: 9.2.2.5 Control: The organization establishes and institutionalizes contact with selected groups and associations within the security
community:
To facilitate ongoing security education and training for organizational personnel;
To stay up to date with the latest recommended security practices, techniques, and technologies; and To share current security‐related information including threats, vulnerabilities, and incidents.
Supplemental Guidance: Ongoing contact with security groups and associations is of paramount importance in an environment of rapid technology changes and dynamic threats. Security groups and associations can include, for example, special interest groups, specialized forums, professional associations, news groups, and/or peer groups of security professionals in similar organizations. The groups and associations selected are consistent with the organization’s mission/business requirements. Information‐sharing activities regarding threats, vulnerabilities, and incidents related to information systems are consistent with applicable laws, directives, policies, regulations, standards, and guidance.
Control Enhancements for Sensitive Systems: None PCI compliance: PCI‐DSS has no requirement for this control.
2.3 FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL
AU‐2 AUDITABLE EVENTS Previous SEC 501‐06 Control
References: 9.3.2.2 Control: The organization:
a. Determines, based on a risk assessment and mission/business needs, that the information system must be capable of auditing the following events: authenticated individual, access time, source of access, duration of access, and actions executed
b. Coordinates the security audit function with other organizational entities requiring audit related information to enhance mutual support and to help guide the selection of auditable events;
c. Provides a rationale for why the list of auditable events are deemed to be adequate to support after‐the‐fact investigations of security incidents; and
d. Determines, based on current threat information and ongoing assessment of risk, that the following events are to be audited within the information system: authenticated individual, access time, source of access, and actions executed
Supplemental Guidance: The purpose of this control is for the organization to identify events which need to be auditable as significant and relevant to the security of the information system; giving an overall system requirement in order to meet ongoing and specific audit needs. To balance auditing requirements with other information system needs, this control also requires identifying that subset of auditable events that are to be audited at a given point in time. For example, the organization may determine that the information system must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the extreme burden on system performance. In addition, audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network.
Selecting the right level of abstraction for audit record generation is a critical aspect of an audit capability and can facilitate the identification of root causes to problems. Related control: AU‐3.
Control Enhancements for Sensitive Systems:
(3) The organization reviews and updates the list of auditable events once a year at a minimum.
Enhancement Supplemental Guidance: The list of auditable events is defined in AU‐2.
(4) The organization includes execution of privileged functions in the list of events to be audited by the information system.
PCI compliance: The requirements specified in this security control meet the following PCI‐DSS requirements:
10.1 Establish a process for linking all access to system components (especially access done with administrative privileges such as root) to each individual user.
10.2 Implement automated audit trails for all system components to reconstruct the following events:
10.2.1 All individual accesses to cardholder data.
10.2.2 All actions taken by any individual with root or administrative privileges.
10.3 Record at least the following audit trail entries for all system components for each event:
10.3.1 User identification.
10.3.2 Type of event.
10.3.3 Date and time.
10.3.4 Success or failure indication.
10.3.5 Origination of event.
10.3.6 Identity or name of affected data, system component, or resource.
AU‐3 CONTENT OF AUDIT RECORDS Previous SEC 501‐06 Control
References: 9.3.2.2
Control: The information system produces audit records that contain sufficient information to, at a minimum, establish what type of event occurred, when (date and time) the event occurred, where the event occurred, the source of the event, the outcome (success or failure) of the event, and the identity of any user/subject associated with the event.
Supplemental Guidance: Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Related controls: AU‐2, AU‐8.
Control Enhancements for Sensitive Systems:
(1) The information system may include additional organization defined requirements in the audit records for audit events identified by type, location, or subject.
Enhancement Supplemental Guidance: An example of detailed information that the organization may require in audit records is full‐text recording of privileged commands or the individual identities of group account users.
(2) The organization centrally manages the content of audit records generated by all web servers, database servers, messaging servers, file servers, print servers, middleware servers, dns servers, routers, firewalls, IDS/IPS, and VoIP servers.
DMV‐Specific Requirements:
DMV requires audit records/logs to be stored and managed on server(s) on an internal network segment.
PCI 10.5.4 VITA AU‐3
PCI compliance: The requirements specified in this security control meet the following PCI‐DSS requirements:
10.1 Establish a process for linking all access to system components (especially access done with administrative privileges such as root) to each individual user.
10.2 Implement automated audit trails for all system components to reconstruct the following events:
10.2.1 All individual accesses to cardholder data.
10.2.2 All actions taken by any individual with root or administrative privileges.
10.3 Record at least the following audit trail entries for all system components for each event:
10.3.1 User identification.
10.3.2 Type of event.
10.3.3 Date and time.
10.3.4 Success or failure indication.
10.3.5 Origination of event.
10.3.6 Identity or name of affected data, system component, or resource.
10.5.4 Write logs for external‐facing technologies onto a log server on the internal LAN.
AU‐4 AUDIT STORAGE CAPACITY Previous SEC 501‐06 Control
References: None Control: The organization allocates audit record storage capacity and configures auditing to reduce the likelihood of such capacity
being exceeded.
Supplemental Guidance: The organization considers the types of auditing to be performed and the audit processing requirements when allocating audit storage capacity. Related controls: AU‐2, AU‐5, AU‐6, AU‐7, SI‐4.
Control Enhancements for Sensitive Systems: None PCI compliance: PCI‐DSS has no requirement for this control.
AU‐5 RESPONSE TO AUDIT PROCESSING FAILURES Previous SEC 501‐06 Control
References: None Control: The information system:
a. Alerts designated organizational officials in the event of an audit processing failure; and
Supplemental Guidance: Audit processing failures include, for example, software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Related control: AU‐4.
Control Enhancements for Sensitive Systems:
(2) The information system provides a real‐time alert when the following audit failure events occur: recording of authentication attempts, modification of sensitive data, or escalation of privilege.
PCI compliance: PCI‐DSS has no requirement for this control.
AU‐6 AUDIT REVIEW, ANALYSIS, AND REPORTING Previous SEC 501‐06 Control
References: None Control: The organization:
a. Reviews and analyzes information system audit records at least every 30‐days at a minimum for indications of inappropriate or unusual activity, and reports findings to designated organizational officials; and
b.
Adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Commonwealth based on law enforcement information, intelligence information, or other credible sources of information.
Supplemental Guidance: Related control: AU‐7.
Control Enhancements for Sensitive Systems:
(1) The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
(3) The organization analyzes and correlates audit records across different repositories to gain organization‐wide situational awareness.
(4) The information system centralizes the review and analysis of audit records from multiple components within the system.
Enhancement Supplemental Guidance: An example of an automated mechanism for centralized review and analysis is a Security Information Management (SIM) product. Related control: AU‐2.
(5) The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity.
Enhancement Supplemental Guidance: A Security Event/Information Management system tool can facilitate audit record aggregation and consolidation from multiple information system components as well as audit record correlation and analysis. The use of
standardized audit record analysis scripts developed by the organization (with localized script adjustments, as necessary), provides a more cost‐effective approach for analyzing audit record information collected. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of the vulnerability scans and correlating attack detection events with scanning results. Related control: AU‐7, RA‐5, SI‐4.
PCI compliance:
10.6 Review logs for all system components at least daily. Log reviews must include those servers that perform security functions like intrusion detection system (IDS) and authentication, authorization, and accounting protocol (AAA) servers (for example, RADIUS).
NOTE: The requirement for daily log review (PCI 10.6) applies only to systems in‐scope for PCI; those storing, processing or transmitting cardholder or transaction data only. Control AU‐6's requirements apply to all other DMV systems.
AU‐8 TIME STAMPS Previous SEC 501‐06 Control
References: 9.3.2.2 Control: The information system uses internal system clocks to generate time stamps for audit records.
Supplemental Guidance: Time stamps generated by the information system include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.
Related control: AU‐3.
Control Enhancements for Sensitive Systems: None
PCI compliance: The requirements specified in this security control meet the following PCI‐DSS requirements:
10.4 Using time synchronization technology, synchronize all critical system clocks and times and ensure that the following is implemented for acquiring, distributing, and storing time.
10.4.1 Critical systems have the correct and consistent time.
10.4.3 Time settings are received from industry‐accepted time sources.
AU‐9 PROTECTION OF AUDIT INFORMATION Previous SEC 501‐06 Control
References: None Control: The information system protects audit information and audit tools from unauthorized access, modification, and deletion.
Supplemental Guidance: Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Related controls: AC‐3, AC‐6.
Control Enhancements for Sensitive Systems:
(2) The information system backs up audit records at least once every twenty‐four hours onto a different system or media than the system being audited.
(4) The organization:
(a) Authorizes access to management of audit functionality to only a limited subset of privileged users; and PCI compliance: The requirements specified in this security control meet the following PCI‐DSS requirements:
10.4.2 Time data is protected.
10.5 Secure audit trails so they cannot be altered.
10.5.1 Limit viewing of audit trails to those with a job‐related need.
10.5.2 Protect audit trail files from unauthorized modifications.
10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter.
AU‐11 AUDIT RECORD RETENTION Previous SEC 501‐06 Control
References: None Control: The organization retains audit records consistent with the Agency’s records retention policy to provide support for after‐the‐
fact investigations of security incidents and to meet regulatory and organizational information retention requirements.
Supplemental Guidance: The organization retains audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoena, and law enforcement actions. Standard categorizations of audit records relative to such types of actions and standard response processes for each type of action are developed and disseminated. The Library of Virginia and the Payment Card Industry Data Security Standard (PCI‐DSS) provide the policy on records retention. DMV will comply with the most restrictive requirements of these two sources.
Control Enhancements for Sensitive Systems: None
PCI compliance: The requirements specified in this security control meet the following PCI‐DSS requirements:
10.7 Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from backup).