Written Information Security Program (WISP)

(1)

Written Information Security

Program (WISP)

ACME Consulting, LLC

Your Logo

Will Be

Placed Here

(2)

W

RITTEN

I

NFORMATION

S

ECURITY

P

ROGRAM

(WISP)

O

VERVIEW

I

NTRODUCTION

The Written Information Security Program (WISP) provides definitive information on the prescribed measures used to establish and enforce the IT security program at ACME Consulting, LLC (ACME).

ACME is committed to protecting its employees, partners, clients and ACME from damaging acts that are intentional or unintentional. Effective security is a team effort involving the participation and support of every ACME user who interacts with data and information systems. Therefore, it is the responsibility of every user to know these policies and to conduct their activities accordingly.

Protecting company information and the systems that collect, process, and maintain this information is of critical importance. Consequently, the security of information systems must include controls and safeguards to offset possible threats, as well as controls to ensure accountability, availability, integrity, and confidentiality of the data:

Confidentiality – Confidentiality addresses preserving restrictions on information access and disclosure so that access is restricted to only authorized users and services.

Integrity – Integrity addresses the concern that sensitive data has not been modified or deleted in an unauthorized and undetected manner.

Availability – Availability addresses ensuring timely and reliable access to and use of information.

Security measures must be taken to guard against unauthorized access to, alteration, disclosure or destruction of data and information systems. This also includes against accidental loss or destruction.

P

URPOSE

The purpose of the Written Information Security Program (WISP) is to prescribe a comprehensive framework for: Creating an Information Security Management System (ISMS) in accordance with ISO 27001.

Protecting the confidentiality, integrity, and availability of ACME data and information systems. Protecting ACME, its employees, and its clients from illicit use of ACME information systems and data.

Ensuring the effectiveness of security controls over data and information systems that support ACME’s operations. Recognizing the highly networked nature of the current computing environment and provide effective company-wide

management and oversight of those related Information Security risks.

Providing for development, review, and maintenance of minimum security controls required to protect ACME’s data and information systems.

The formation of the policies is driven by many factors, with the key factor being risk. These policies set the ground rules under which ACME operates and safeguards its data and information systems to both reduce risk and minimize the effect of potential incidents.

These policies, including their related standards, procedures, and guidelines, are necessary to support the management of information risks in daily operations. The development of policies provides due care to ensure ACME users understand their day-to-day security responsibilities and the threats that could impact the company.

Implementing consistent security controls across the company will help ACME comply with current and future legal obligations to ensure long term due diligence in protecting the confidentiality, integrity and availability of ACME data.

(11)

S

COPE

&

A

PPLICABILITY

These policies, standards and procedures apply to all ACME data, information systems, activities, and assets owned, leased, controlled, or used by ACME, its agents, contractors, or other business partners on behalf of ACME. These policies, standards and procedures apply to all ACME employees, contractors, sub-contractors, and their respective facilities supporting ACME business operations, wherever ACME data is stored or processed, including any third-party contracted by ACME to handle, process, transmit, store, or dispose of ACME data.

Some policies are explicitly stated for persons with a specific job function (e.g., a System Administrator); otherwise, all personnel supporting ACME business functions shall comply with the policies. ACME departments shall use these policies or may create a more restrictive policy, but not one that is less restrictive, less comprehensive, or less compliant than this policy.

These policies do not supersede any other applicable law or higher-level company directive, or existing labor management agreement in effect as of the effective date of this policy.

Appendix E: Information Security Roles & Responsibilities provides a detailed description of ACME user roles and responsibilities, in regards to Information Security.

ACME reserves the right to revoke, change, or supplement these policies, procedures, standards, and guidelines at any time without prior notice. Such changes shall be effective immediately upon approval by management, unless otherwise stated.

P

OLICY

O

VERVIEW

In an effort to ensure an acceptable level of Information Security risk, ACME is required to design, implement and maintain a coherent set of policies, standards and procedures to manage risks to its data and information systems.

ACME users are required to protect and ensure the Confidentiality, Integrity, and Availability (CIA) of data and information systems, regardless of how it data is created, distributed, or stored. Security controls will be tailored accordingly so that cost-effective controls can be applied commensurate with the risk and sensitivity of the data and information system. Security controls must be designed and maintained to ensure compliance with all legal requirements.

V

IOLATIONS

Any ACME user found to have violated any policy, standard or procedure may be subject to disciplinary action, up to and including termination of employment. Violators of local, state, Federal, and/or international law will be reported to the appropriate law enforcement agency for civil and/or criminal prosecution.

E

XCEPTIONS

While every exception to a policy or standard potentially weakens protection mechanisms for ACME information systems and underlying data, occasionally exceptions will exist. Procedures for requesting an exception to policies, procedures or standards are available in Appendix F: Information Security Exception Request Procedures.

U

PDATES

Updates to the Written Information Security Program (WISP) will be announced to employees via management updates or email announcements. Changes will be noted in the Record of Changes to highlight the pertinent changes from the previous policies, procedures, standards and guidelines.

(12)

K

EY

T

ERMINOLOGY

In the realm of IT security terminology, the National Institute of Standards and Technology (NIST) IR 7298, Revision 1, Glossary of Key Information Security Terms, is the primary reference document that ACME uses to define common IT security terms. 1_Key terminology to be aware of includes:

Asset Custodian: A term describing a person or entity with the responsibility to assure that the assets are properly maintained, to assure that the assets are used for the purposes intended, and assure that information regarding the equipment is properly documented.

Cardholder Data Environment (CDE): A term describing the area of the network that possesses cardholder data or sensitive authentication data and those systems and segments that directly attach or support cardholder processing, storage, or transmission. Adequate network segmentation, which isolates systems that store, process, or transmit cardholder data from those that do not, may reduce the scope of the cardholder data environment and thus the scope of the PCI assessment

Control: A term describing any management, operational, or technical method that is used to manage risk. Controls are designed to monitor and measure specific aspects of standards to help ACME accomplish stated goals or objectives. All controls map to standards, but not all standards map to Controls.

Control Applicability: A term describing the scope in which a control or standard is relevant and applicable.

Control Objective: A term describing targets or desired conditions to be met that are designed to ensure that policy intent is met. Where applicable, Control Objectives are directly linked to an industry-recognized best practice to align ACME with accepted due care requirements.

Data: A term describing an information resource that is maintained in electronic or digital format. Data may be accessed, searched, or retrieved via electronic networks or other electronic data processing technologies. Appendix A: Data Classification & Handling Guidelines provides guidance on data classification and handling restrictions.

Data Owner: A term describing a person or entity that has been given formal responsibility for the security of an asset, asset category, or the data hosted on the asset. It does not mean that the asset belongs to the owner in a legal sense. Asset owners are formally responsible for making sure that assets are secure while they are being developed, produced, maintained, and used. Encryption: A term describing the conversion of data from its original form to a form that can only be read by someone that can reverse the encryption process. The purpose of encryption is to prevent unauthorized disclosure of data.

Guidelines: A term describing recommended practices that are based on industry-recognized best practices. Unlike Standards, Guidelines allow users to apply discretion or leeway in their interpretation, implementation, or use.

Information Security: A term that covers the protection of information against unauthorized disclosure, transfer, modification, or destruction, whether accidental or intentional. Focus is on the Confidentiality, Integrity, and Availability (CIA) of data.

Information System: A term describing an asset; a system or network that can be defined, scoped, and managed. Includes, but is not limited to, computers, workstations, laptops, servers, routers, switches, firewalls, and mobile devices.

Least Privilege: A term describing the theory of restricting access by only allowing users or processes the least set of privileges necessary to complete a specific job or function.

(13)

Personally Identifiable Information (PII): PII is commonly defined as the first name or first initial and last name, in combination with any one or more of the following data elements: 2

Social Security Number (SSN) / Taxpayer Identification Number (TIN) / National Identification Number (NIN)

Driver License (DL) or other government-issued identification number (e.g., passport, permanent resident card, etc.) Financial account number

Payment card number (e.g., credit or debit card)

Policy: A term describing a formally established requirement to guide decisions and achieve rational outcomes. Essentially, a policy is a statement of expectation that is enforced by standards and further implemented by procedures.

Procedure: A term describing an established or official way of doing something, based on a series of actions conducted in a certain order or manner. Procedures are the responsibility of the asset custodian to build and maintain, in support of standards and policies. Sensitive Data: A term that covers categories of data that must be kept secure. Examples of sensitive data include Personally Identifiable Information, Electronic Protected Health Information (ePHI), and all other forms of data classified as Restricted or Confidential in Appendix A: Data Classification & Handling Guidelines.

Standard: A term describing formally established requirements in regard to processes, actions, and configurations. Target Audience: A term describing the intended group for which a control or standard is directed.

2_{The source of this definition comes from two state laws - Oregon Consumer Identity Theft Protection Act - ORS 646A.600(11)(a) -}

http://www.leg.state.or.us/ors/646a.html and Massachusetts 201 CMR 17.00” Standards For The Protection of Personal Information of Residents of The Commonwealth - MA201CMR17.02 http://www.mass.gov/ocabr/docs/idtheft/201cmr1700reg.pdf

(14)

I

NFORMATION

S

ECURITY

P

ROGRAM

S

TRUCTURE

P

OLICIES

,

S

TANDARDS

,

P

ROCEDURES

&

G

UIDELINES

S

TRUCTURE

Information security documentation is comprised of four main parts: a core policy; measureable standards used to quantify the policy; procedures that must be followed; and guidelines that are recommended, but not mandatory.

Figure 1: IT Security Documentation Framework

I

NFORMATION

S

ECURITY

C

ONTROL

O

BJECTIVES

Security control objectives are sometimes synonymous with standards. Since security control objectives have a well-defined organization and structure, ACME’s standards are likewise organized into classes and families for ease of use in the control selection and specification process. There are five (5) general classes of security control objectives and these classes are further broken down into twenty-six (26) families of security control objective.

Common

o_{Common control objectives address information security program-level security topics.}

o_{These common control objectives establish the overall framework for management, operational and technical} controls.

Management

o_{Management control objectives address techniques and concerns that are normally addressed by management in} ACME’s information security program.

o_{In general, Management control objectives focus on the management of the information security program and} the management of risk within ACME.

Operational

o_{Operational control objectives address techniques and concerns that are generally implemented and executed by} people, as opposed to systems, that are put in place to improve the security of a particular system or group of systems.

o_{Operational control objectives often require technical or specialized expertise; often relying upon management} activities as well as technical controls.

Technical

o_{Technical control objectives address processes and concerns that a computer system executes.}

o_{Technical control objectives are dependent upon the proper functioning of the system for their effectiveness and} therefore require significant operational considerations.

Privacy

o_{Privacy control objectives address Personally Identifiable Information (PII).}

o_{Privacy control objectives are dependent upon the proper functioning of the other classes of controls for their} effectiveness and therefore require significant operational considerations.

(15)

Each family contains security controls related to the security functionality of the family. A two-character identifier is assigned to uniquely identify each control family. The table below summarizes the classes and families in the security control catalog and the associated family identifiers.

Class Family Identifier

Common Security Program Management PM

Management Certification, Accreditation & Security Assessments CA

Management Planning PL

Management Risk Assessment RA

Management System & Services Acquisition SA

Operational Awareness & Training AT

Operational Configuration Management CM

Operational Contingency Planning CP

Operational Incident Response IR

Operational Maintenance MA

Operational Media Protection MP

Operational Personnel Security PS

Operational Physical & Environmental Protection PE

Operational System & Information Integrity SI

Technical Access Control AC

Technical Audit & Accountability AU

Technical Identification & Authentication IA

Technical System & Communications Protection SC

Privacy Authority & Purpose AP

Privacy Data Accountability, Audit & Risk Management AR

Privacy Data Quality & Integrity DI

Privacy Data Minimization & Retention DM

Privacy Individual Participation & Redress IP

Privacy Data Security SE

Privacy Data Transparency TR

Privacy Data Use Limitation UL

Figure 2: NIST SP 800-53 Control Objectives Families & Classes

(16)

C

ONTROL

P

RECEDENCE

Control transparency is an important characteristic of security controls. A transparent security control is one that does not require the user to perform extra steps or get in the way of user productivity. A good transparent security control also does not give the user any information about how it works. This helps prevent the user from circumventing the security controls, so transparency is a goal of security controls.

The Common, Management, Operational, Technical, and Privacy Controls create security baselines for systems, based on their Assurance Level. The precedence of security controls is:

1._{Common controls: Corporate-level scope pertaining to the IT security program.} 2._{Management controls: Management-level scope.}

3. Operational controls: Infrastructure or project-level scope. 4._{Technical controls: System-level scope.}

5._{Privacy controls: Corporate-level scope pertaining to Personally Identifiable Information (PII).}

A security control is inheritable by an information system or application when that system or application receives protection from the security control (or portions of the security control) and the control is developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the system or application.

Security controls are deemed inheritable by processes, information systems or information system components when the systems or components receive protection from the implemented controls, but the controls are developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the systems.

C

ONTROL

S

COPING

&

E

NHANCEMENTS

Security control enhancements are used to strengthen or broaden the fundamental security capability described in the base control. The tailored security control baseline represents elevated security requirements. There are additional security controls and control enhancements that appear in the catalog that are not used in any of the baselines. These “enhanced” controls are available to use on any information system, but may only be required by certain laws and regulations. Moreover, security controls the elevated baselines can also be used in standard baselines, if deemed appropriate, to provide additional protection measures.

K-1:TARGET AUDIENCES &CONTROL APPLICABILITY OVERVIEW

There are five different combinations of target audience & control applicability.

K-1.1:TARGET AUDIENCE IS INTENDED FOR ALL USERS IN ALL PARTS OF THE ORGANIZATION All end-users need to be familiar with and follow these standards:

Target Audience: All Users Control Applicability: Standard Control

K-1.2:TARGET AUDIENCE IS INTENDED FOR TECHNICAL-ORIENTED PERSONNEL IN ALL PARTS OF THE ORGANIZATION

All network administrators / system admins / database admin (DBAs) / data owners / technical project managers / IT personnel need to be familiar with and follow these standards:

Target Audience: Technical Users Control Applicability: Standard Control

K-1.3:TARGET AUDIENCE IS INTENDED FOR TECHNICAL-ORIENTED PERSONNEL IN ONLY CERTAIN PARTS OF THE ORGANIZATION

Enhanced controls are focused on “enhanced” requirements that might not apply to all systems, such as environments covered by PCI DSS, HIPAA, GLBA, SOX, FACTA or other laws. For all network administrators / system admins / database admin (DBAs) / data owners / project managers / IT personnel that have assets that are within scope for regulatory or non-regulatory coverage, they need to be familiar with and follow these standards:

(17)

K-1.4:TARGET AUDIENCE IS INTENDED FOR MANAGERS THROUGHOUT THE ORGANIZATION

All personnel in management positions need to be familiar with and follow these standards:

Target Audience: Management Control Applicability: Standard Control

K-1.5:TARGET AUDIENCE IS INTENDED FOR MANAGERS THROUGHOUT WITH OVERSIGHT IN ONLY CERTAIN PARTS OF THE ORGANIZATION

Enhanced controls are focused on “enhanced” requirements that might not apply to all systems, such as environments covered by PCI DSS, HIPAA, GLBA, SOX, FACTA or other laws. For personnel in management positions that have assets that are within scope for regulatory or non-regulatory coverage, they need to be familiar with and follow these standards:

Target Audience: Management Control Applicability: Enhanced Control

I

NFORMATION

S

ECURITY

P

ROGRAM

A

CTIVITIES

An Information Security Management System (ISMS) focuses on IT security management and IT-related risks. The governing principle behind ACME’s ISMS is that, as with all management processes, the ISMS must remain effective and efficient in the long-term, adapting to changes in the internal organization and external environment.

In accordance with ISO/IEC 27001, ACME’s ISMS incorporates the typical "Plan-Do-Check-Act" (PDCA), or Deming Cycle, approach: Plan: This phase involves designing the ISMS, assessing IT-related risks, and selecting appropriate controls.

Do: This phase involves implementing and operating the appropriate security controls.

Check: This phase involves reviewing and evaluating the performance (efficiency and effectiveness) of the ISMS. Act: This has involves making changes, where necessary, to bring the ISMS back to optimal performance.

I

NFORMATION

S

ECURITY

C

ONSIDERATIONS

F

OR

P

ROTECTING

S

YSTEMS

Appendix G: Types of Security Controls provides a detailed description of information security considerations for protecting information systems, based on the importance of the system and the sensitivity of the data processed or stored by the system.

(18)

I

NFORMATION

S

ECURITY

P

OLICIES

P

OLICY

S

TATEMENT

1:

I

NFORMATION

S

ECURITY

P

ROGRAM

M

ANAGEMENT

Purpose: The purpose of the Program Management (PM) policy is for ACME to specify the development, implementation, assessment, authorization, and monitoring of the IT security program management. The successful implementation of security controls for organizational information systems depends on the successful implementation of the organization’s program management controls. The IT security Program Management (PM) controls are essential for managing the IT security program. Information Security Program Management Policy: ACME shall implement IT security program management controls to provide a foundation for ACME’s Information Security Management System (ISMS).

Supporting Documentation: Program Management (PM) control objectives & standards directly support this policy.

P

OLICY

S

TATEMENT

2:

C

ERTIFICATION

,

A

CCREDITATION

&

S

ECURITY

A

SSESSMENT

Purpose: The purpose of the Certification, Accreditation & Security Assessment (CA) policy is to ensure that risk determinations made during the initial risk assessment for a project or information system are accurate and provide a thorough portrayal of the risks to the ACME.

Certification, Accreditation & Security Assessment Policy: ACME shall periodically assess information systems to determine if IT security controls are effective and ensure IT security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.

Supporting Documentation: Certification, Accreditation & Security Assessment (CA) control objectives & standards directly support this policy.

P

OLICY

S

TATEMENT

3:

P

LANNING

Purpose: The purpose of the Planning (PL) policy is to ensure due care planning considerations are addressed to minimize risks to ACME.

Planning Policy: ACME shall develop, document, implement, and periodically update measures to protect its critical information systems.

Supporting Documentation: Planning (PL) control objectives & standards directly support this policy.

P

OLICY

S

TATEMENT

4:

R

ISK

A

SSESSMENT

Purpose: The purpose of the Risk Assessment (RA) policy is to ensure that risk determinations made during the initial risk assessment for a project or information system are accurate and provide a thorough portrayal of the risks to ACME.

Risk Assessment Policy: ACME shall periodically assess the risk to operations, assets, and data, resulting from the operation of information systems and the associated processing, storage, or transmission of data.

(19)

C

OMMON

C

ONTROLS

Common Controls are essential for managing information security program. The Common Controls’ focus complements the other 26 families of security controls by focusing on company-wide information security requirements that are independent of any particular information system and are essential for managing an information security program.

Common Controls are security controls whose implementation results in a security capability that is inheritable. Security capabilities provided by Common Controls can be inherited from many sources including, for example, organizations, business units, sites, enclaves, environments of operation, or other information systems.

P

ROGRAM

M

ANAGEMENT

(PM)

PM-01:INFORMATION SECURITY PROGRAM PLAN

Control Objective: The organization: 3

Develops and disseminates organization-wide information security standards that:

o_{Provides an overview of the requirements for the information security program and a description of the controls} in place, or planned, for meeting those requirements;

o_{Provides sufficient information about controls to enable an implementation that is unambiguously compliant with} the intent of the plan;

o_{Includes roles, responsibilities, management commitment, and compliance;}

o_{Is approved by a senior management with responsibility and accountability for the risk being incurred to} organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, and other organizations;

Reviews standards for applicability; and

Revises standards to address organizational changes and problems identified during implementation or security assessments.

Standard: ACME’s information security policies and standards shall be represented in a single document, the Written Information Security Program (WISP) that:

(a)_{Shall be reviewed and updated at least annually;} and

(b) Disseminated to the appropriate parties to ensure all ACME personnel understand their applicable requirements. Procedures: No formal procedures are currently applicable to this control.

Supplemental Guidance: The security plans for individual information systems and the organization-wide information security program plan together, provide complete coverage for all security controls employed within the organization.

Enhancements: None

PM-02:ASSIGNED INFORMATION SECURITY RESPONSIBILITIES

Control Objective: The organization appoints an individual assigned with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.4

Standard: The authority and responsibility for managing the information security program is delegated to ACME’s Information Security Officer (ISO and he/she is required to perform or delegate the following information security management responsibilities:

(a)_{Establish, document, and distribute security policies and procedures;} (b) Monitor and analyze security alerts and information;

(c)_{Distribute and escalate security alerts to appropriate personnel;}

3_{HIPAA 164.308(a)(1)(i) & 164.316(a)-(b) / GLBA Sec 6801(b)(1) / PCI DSS 12.1 & 12.1.1 / MA201CMR17 17.03(1), 17.04 & 17.03(2)(b)(2) / NIST CSF ID.GV-1 &}

ID.GV-2

(20)

(d) Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations;

(e)_{Administer user accounts, including additions, deletions, and modifications;}and (f)_{Monitor and control all access to data.}

Procedures: The ISO is authorized by executive management to take all actions necessary to establish, implement and manage ACME’s Information Security Program.

Supplemental Guidance: None Enhancements: None

PM-03:INFORMATION SECURITY RESOURCES

Control Objective: The organization addresses all capital planning and investment requests, including the resources needed to implement the information security program, and documents all exceptions to this requirement.

Standard: The Information Security Officer (ISO) and his/her designated representatives are responsible for managing and providing oversight for the information security-related aspects of the planning and service / tool selection process.

Procedures: No formal procedures are currently applicable to this control. Supplemental Guidance: None

Enhancements: None

PM-04:VULNERABILITY REMEDIATION PROCESS

Control Objective: The organization implements a process for ensuring that vulnerabilities are properly identified, documents remediation actions and tracks vulnerabilities to mitigate risk to operations, assets, individuals, and other organizations. 5

Standard: ACME is required to use a Plan of Action & Milestones (POA&M), or some other company-approved method, as a key tool in documenting identified weaknesses, their status, and remediation steps.

Procedures: No formal procedures are currently applicable to this control.

Supplemental Guidance: POA&M-related issues shall be based on the findings from security control assessments, security impact analyses, and continuous monitoring activities.

Enhancements: None

PM-05:INFORMATION SYSTEM INVENTORY

Control Objective: The organization develops and maintains an inventory of its information systems. 6

Standard: ACME is required to maintain an inventory of its information systems that includes, but is not limited to: (a)_{A list of all such devices and personnel with access;}

(b)_{A method to accurately and readily determine owner, contact information, and purpose (e.g., labeling, coding, and/or} inventorying of devices);

5_{MA201CMR17 17.03(2)(j) / OR646A.622(2)(d)(B)(iii) / NIST CSF ID.RA-6} 6_{PCI DSS 12.3.3, 12.3.4 & 12.3.7 / NIST CSF ID.AM-1 & ID.AM-2}

(21)

RA-05:VULNERABILITY SCANNING

Scans for vulnerabilities in information systems and hosted applications and when new vulnerabilities potentially affecting the system/applications are identified and reported;

Employs vulnerability scanning tools and techniques that promote interoperability among tools and automate parts of the vulnerability management process by using standards for:

o_{Enumerating platforms, software flaws, and improper configurations;} o_{Formatting and making transparent, checklists and test procedures; and} o_{Measuring vulnerability impact;}

Analyzes vulnerability scan reports and results from security control assessments;

Remediates legitimate vulnerabilities in accordance with an organizational assessment of risk; and

Shares information obtained from the vulnerability scanning process and security control assessments with designated personnel throughout the organization to help eliminate similar vulnerabilities in other information systems (e.g., systemic weaknesses or deficiencies).

Standard: ACME’s IT security personnel are responsible for the following vulnerability scanning-related activities:

(a)_{Perform ongoing scans for vulnerabilities in information systems and hosted applications, as well as ad hoc scans when} new vulnerabilities potentially affecting system(s)/application(s) are identified and reported;

(b)_{Utilize vulnerability scanning tools and techniques that promote:}

i._{Enumerating platforms, software flaws, and improper configurations;} ii._{Formatting and making transparent, checklists and test procedures; and} iii._{Measuring vulnerability impact;}

(c)_{Analyze vulnerability scan reports and results;}

(d)_{Remediate legitimate vulnerabilities in accordance with a risk-based approach; and}

(e) Share information obtained from the vulnerability scanning process and security control assessments with designated personnel throughout ACME to help eliminate similar vulnerabilities in other information systems (e.g., systemic weaknesses or deficiencies).

Supplemental Guidance: Security categorization of information systems guides the frequency and comprehensiveness of vulnerability scans. Organization determine the required vulnerability scanning for all information system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or hybrid of the three approaches.

Enhancements: Enhancements:

RA-05(1) – External Vulnerability Assessment Scans for PCI DSS Compliance RA-05(2) – Internal Vulnerability Assessment Scans for PCI DSS Compliance

RA-05(1):VULNERABILITY SCANNING |EXTERNAL VULNERABILITY ASSESSMENT SCANS FOR PCIDSSCOMPLIANCE

Target Audience: Technical Users Control Applicability: Enhanced Control

Control Objective: If required by the Payment Card Industry Data Security Standard (PCI DSS), the organization: 37

Performs quarterly external vulnerability scans via an Approved Scanning Vendor (ASV), approved by the Payment Card Industry Security Standards Council (PCI SSC).

Verifies that the scan process includes rescans until passing results are obtained, or all “High” vulnerabilities as defined in the PCI DSS are resolved.

Standard: For assets within scope for PCI DSS, ACME is required to perform external network vulnerability scans, via an Approved Scanning Vendor (ASV), at least once every ninety (90) days or after any significant change in the network and include rescans until passing results are obtained, or all “High” vulnerabilities as defined in the PCI DSS are resolved.

36_{PCI DSS 11.2 / OR646A.622(2)(B)(iii) & OR646A.622(2)(d(A)(iii) / NIST CSF ID.RA-1, PR.IP-12, DE.CM-8, DE.DP-4, DE.DP-5, RS.CO-3 & RS.MI-3} 37_{PCI DSS 11.2, 11.2.2 & 11.2.3}

(22)

Supplemental Guidance: Training should focus on implementing best practices associated with the use of a vendor product or process. A record of this training should be saved as a log sheet or sign in sheet from the session or a certificate of completion from the vendor and documentation for specialized training should be maintained by individual supervisors.

AT-04:SECURITY TRAINING RECORDS

Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

Retains individual training records.

Standard: ACME requires personnel to acknowledge in writing or electronically, at least annually, that they have read and understood ACME’s information security policies.

Procedures: A record of the acknowledgement of Information Security training shall be maintained by Human Resources (HR) as evidence of training.

Supplemental Guidance: Any security bulletins or awareness training information should be archived as evidence of training. If possible, the individuals who received training or distribution list recipients should be documented. A record of the acknowledgement of information security training shall be maintained by Human Resources (HR) as evidence of training.

Enhancements: None

AT-05:SECURITY INDUSTRY ALERTS &NOTIFICATION PROCESS

Target Audience: Technical Users Control Applicability: Standard Control

Control Objective: The organization establishes and institutionalizes contact with selected groups and associations within the security community:61

To facilitate ongoing security education and training for organizational personnel;

To stay up to date with the latest recommended security practices, techniques, and technologies; and To share current security-related information including threats, vulnerabilities, and incidents.

Standard: ACME personnel responsible for incident response operations are required to subscribe to mailing lists or notification services to maintain awareness of security industry alerts.

Supplemental Guidance: There are five different mailing lists to select from the US-CERT subscription website ( https://forms.us-cert.gov/maillists). However, the most applicable mailing lists are:

Technical Cyber Security Alerts. Written for system administrators and experienced users, technical alerts provide timely information about current security issues, vulnerabilities, and exploits.

Cyber Security Bulletins. Bulletins summarize information that has been published about new security issues and vulnerabilities for the week prior. They are published weekly and are written primarily for system administrators and other technical users.

Cyber Security Alerts. Written for home, corporate, and new users, these alerts are published in conjunction with technical alerts when there are security issues that affect the general public.

Ongoing contact with security groups and associations is of paramount importance in an environment of rapidly changing technologies and threats. Security groups and associations include, for example, special interest groups, forums, professional associations, news groups, and/or peer groups of security professionals in similar organizations.

60_{PCI DSS 12.6.2}

(23)

T

ECHNICAL

C

ONTROLS

Technical Controls are logical controls, such as devices, processes, protocols, and other measures, that are used to protect the confidentiality, integrity and availability of the organization's information. Examples include logical access systems, encryptions systems, antivirus systems, firewalls, and intrusion detection systems.

A

CCESS

C

ONTROL

(AC)

AC-01:ACCESS CONTROL POLICY &PROCEDURES

Control Objective: The organization develops, disseminates, reviews & updates:153

A formal, documented access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Formal, documented procedures to facilitate the implementation of the access control policy and associated access controls.

Standard: ACME is required to document organization-wide access control controls that, at a minimum, include: (a)_{A formal, documented access control policy; and}

(b) Processes to facilitate the implementation of the access control policy, procedures and associated controls. Procedures: No formal procedures are currently applicable to this control.

Supplemental Guidance: None Enhancements: None

AC-02:ACCOUNT MANAGEMENT

Control Objective: The organization manages information system accounts, including: 154

Identifying account types (e.g., individual, group, system, application, guest/anonymous, and temporary); Establishing conditions for group membership;

Identifying authorized users of the information system and specifying access privileges; Requiring appropriate approvals for requests to establish accounts;

Establishing, activating, modifying, disabling, and removing accounts;

Specifically authorizing and monitoring the use of guest/anonymous and temporary accounts;

Notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes;

Deactivating accounts that are no longer required;

Granting access to the system based on a valid access authorization; and Reviewing accounts on a regular basis.

Standard: ACME’s IT department is responsible to ensure proper user identification and authentication management for all standard and privileged users on all information systems, as follows:

(a)_{Control addition, deletion, and modification of user IDs, credentials, and other identifier objects to ensure authorized use} is maintained;

(b) Verify user identity before issuing initial passwords or performing password resets;

(c)_{Set passwords for first-time use and resets to a unique value for each user and change immediately after the first use;} (d)_{Immediately revoke access for any terminated users;}

(e) Remove/disable inactive user accounts at least every ninety (90) days;

(f)_{Limit repeated access attempts by locking out the user ID after not more than six (6) attempts;}

(g)_{Set the lockout duration to a minimum of thirty (30) minutes or until administrator enables the user ID;}

153_{HIPAA 164.312(a)(1) / PCI DSS 8.1 & 8.4}

(24)

(h) If a session has been idle for more than fifteen (15) minutes, require the user to re-authenticate to re-activate the terminal or session;

(i)_{Establish and administer accounts in accordance with a role-based access scheme that organizes information system and} network privileges into roles;

(j)_{Track and monitors role assignments for privileged user accounts;}

(k)_{Automatically terminate access for temporary and emergency accounts after the accounts are no longer needed;}

(l)_{Enable accounts used by vendors for remote access only during the time period needed and monitor those vendor remote} access accounts when in use;

(m)_{Minimize the use of group, shared, or generic accounts and passwords;} (n)_{Default user IDs and accounts are disabled or removed;}

(o) Service providers with remote access to [Your Customer Name]’s premises (e.g., for support of POS systems or servers) must use a unique authentication credential (such as a password/phrase) for each customer; and

(p)_{Restrict user direct access or queries to databases to database administrators, including.}

i._{Verify that database and application configuration settings ensure that all user access to, user queries of, and user} actions on (e.g., move, copy, delete), the database are through programmatic methods only (e.g., through stored procedures);

ii. Verify that database and application configuration settings restrict user direct access or queries to databases to database administrators; and

iii._{Review database applications and the related application IDs to verify that application IDs can only be used by the} applications and not by individual users or other processes.

Procedures: No formal procedures are currently applicable to this control. Supplemental Guidance:

Access privileges granted to general users should be reviewed by information owners every six (6) months to determine if access rights are commensurate to the user's job duties.

Evidence of account and privilege reviews that documents the review occurred, who conducted the review, and what action (if any) was taken should be maintained for a period of twelve (12) months.

Asset custodians and data owners are required to promptly report all changes in user duties or employment status for the User IDs associated with the involved personnel and administrators should promptly revoke all unnecessary access privileges

Enhancements: None

AC-03:ACCESS ENFORCEMENT

Control Objective: Information systems enforce approved authorizations for logical access to the system in accordance with applicable policy.155

Standard: ACME is required to limit access to information systems and sensitive data to only those individuals whose job requires such access.

Procedures: No formal procedures are currently applicable to this control. Supplemental Guidance: Access limitations should include the following:

Restriction of access rights to privileged user IDs to least privileges necessary to perform job responsibilities; Assignment of privileges is based on individual personnel’s job classification and function;

Requirement for a documented approval by authorized parties specifying required privileges; and Implementation of an automated access control system.

Enhancements:

AC-03(1) – Role-Based Access Control (RBAC)

155_{HIPAA 164.308(a)(4(i) & (ii) / PCI DSS 7.1, 7.1.1-7.1.4, 7.2, 7.2.1 & 7.2.3 / MA201CMR17 17.04(1)(b) & 17.04(2)(a) / OR646A.622(2)(d)(C)(iii) / NIST CSF PR.AM-3,}

Written Information Security Program (WISP)