Part 10, Chapter 4: Manual Exhibit 10-4-A

Security Assessment and Authorization (CA)

CA-1

Security Assessment and Authorization Policies and Procedures

IHS:

1. Develops, documents, and disseminates to all IHS personnel (via IHS.gov websites) for IHS-wide policies/procedures, and to all system personnel for individual systems as required by the System Owner or designee:
   1. A Security Assessment and Authorization (SA&A) policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance (Note: IHS covers this control by establishing IHM Part 10, Cybersecurity); and
   2. Procedures to facilitate the implementation of the SA&A policy and associated security assessment and authorization controls; and
2. Per IHM Part 1, Chapter 1, “Indian Health Service Manual System,” reviews the SA&A policy at least every two years and submits to the Division of Management Policy and Internal Control for revision when needed.
3. Reviews the SA&A standard operating procedures at least every three years and updates the procedures when needed.

Selected

Selected

Selected

CA-2

Security Assessments

IHS:

1. Develops a security assessment plan that describes the scope of the assessment, including:
1. Security controls and control enhancements under assessment;
2. Assessment procedures to be used to determine security control effectiveness; and
3. Assessment environment, assessment team, and assessment roles and responsibilities;
2. Assesses the security controls in the information system and its environment of operation within the scope of the assessment plan, as defined by the Authorizing Official (AO) or their representative, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
3. Produces a security assessment report that documents the results of the assessment; and
4. Provides the results of the security control assessment to the Information Systems Security Officer, System Owner, and/or others designated by the System Owner, as well as all signees on the Security Assessment Report.

Selected

Selected

Selected

CA-2

c.e.1

Independent Assessors

IHS employs independent assessors or assessment teams with IHS-defined parameters of independence.

Note: The AO determines (i) the required level of assessor independence based on the security categorization of the information system and/or the ultimate risk to organizational operations and assets, and to individuals; and (ii) if the level of assessor independence is sufficient to provide confidence that the assessment results produced are sound and can be used to make a credible, risk-based decision.

Not Selected

Selected

Selected

CA-2

c.e.2

Specialized Assessments

IHS includes, as part of security control assessments, penetration testing at least once every two years, in compliance with CA-8.

Not selected

Not selected

Selected

CA-2

c.e.3

External Organizations

IHS accepts the results of an assessment of IHS information systems performed by a certified independent assessor when the assessment meets all Federal Information Security Modernization Act, Office of Management and Budget, Federal Information Processing Standards (FIPS), NIST, HHS, and IHS standards.

Not selected

Not selected

Selected

CA-3

System Inter-connections

IHS:

1. Authorizes connections to third-party information systems that reside outside the IHS network and are owned, operated, and maintained by non-IHS entities, only through the use of approved Interconnection Security Agreements (ISAs);
2. Documents, for each interconnection with systems not on the federal network, the interface characteristics, security requirements, and the nature of the information communicated; and
3. Reviews and, if necessary, updates ISAs at least every year and whenever significant changes are implemented that can affect the security state of the information system or that could impact the validity of the agreement.

Note: This control does not apply to cloud computing systems.

Selected

Selected

Selected

IHS also considers the following actions:

• Obtain written authorization from management (e.g., AO or designated representative) before connecting to external information systems.
• Consider that the terms and conditions of an ISA or data sharing agreement do not conflict with or otherwise contradict HHS and IHS information technology security and privacy policies, procedures, controls, and standards; applicable legislation, regulation, or guidance; or other contractual obligations.
• Ensure that system interconnection channels are securely configured commensurate with the required level of confidentiality and integrity of the data being exchanged.  Obtain authorization from the external System Owner if the IHS organization intends to use, modify, or disclose the external system’s information in a manner not authorized by the agreement.

CA-3

c.e.5

Restrictions on External System Connections

IHS employs a deny-all, permit-by-exception (i.e., whitelisting) policy for allowing IHS information systems to connect to external information systems.

Not selected

Selected

Selected

CA-5

Plan of Action and Milestones

IHS:

1. Develops a plan of action and milestones (POA&M) for the information system, in accordance with the HHS Standard for POA&M Management and Reporting, to document the IHS’s planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system; and
2. Updates existing POA&Ms at least quarterly based on the findings from security control assessments, security impact analyses, and continuous monitoring activities.

Selected

Selected

Selected

CA-6

Security Authorization

IHS:

1. Assigns the Chief Information Officer (CIO) as the authorizing official for IHS information systems;
2. Ensures that the authorizing official authorizes the information system for processing before commencing operations; and
3. Updates the security authorization at least every three years or when there is a significant change that is likely to affect the security state of that information system.

Selected

Selected

Selected

CA-7

Continuous Monitoring

IHS develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

1. Establishment of specific metrics to be monitored based on IHS security goals and objectives, and in accordance with the basic requirements set forth in NIST SP 800-137;
2. Establishment of real-time monitoring and at-least-annual assessments of monitoring procedures, based on IHS security goals and objectives supporting such monitoring;
3. Ongoing security control assessments in accordance with the IHS-specific continuous monitoring strategy;
4. Ongoing security status monitoring of IHS-defined metrics in accordance with the IHS-specific continuous monitoring strategy;
5. Correlation and analysis of security-related information generated by assessments and monitoring;
6. Response with actions to address results of the analysis of security-related information; and
7. Reporting the security status of IHS and the information system to the CIO, or their designee(s).

Selected

Selected

Selected

CA-7

c.e.1

Independent Assessment

The Cybersecurity Incident Response Team performs scans on all networked devices on an ongoing basis. Areas will also employ independent assessors, assessment teams, and continuous monitoring data reviewers to monitor the IHS-defined security control parameters for IHS information systems.

Note: The AO determines (i) the required level of assessor independence based on the security categorization of the information system and/or the ultimate risk to IHS operations and assets, and to individuals; and (ii) if the level of assessor independence is sufficient to provide confidence that the assessment results produced are sound and can be used to make a credible, risk-based decision.

Not Selected

Selected

Selected

CA-8

Penetration Testing

IHS conducts penetration testing at least every two years on FIPS 199 high-impact, high-profile (e.g., public-facing or highly visible), or high-risk systems, as identified by the IHS AO.

Not Selected

Not Selected

Selected

CA-9

Internal System Connections

IHS:

1. Authorizes internal connections of information system components, agreed to by the system owner or owners, prior to the connection being made to the information system; and
2. System owners’ documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated in the system security plan.

Note: This control applies to connections between IHS information systems and (separate) constituent system components (i.e., intra-system connections) including, for example, system connections with mobile devices, notebook/desktop computers, printers, copiers, facsimile machines, scanners, sensors, and servers.  The IHS can authorize each individual internal connection, or internal connections for a class of components (e.g., all digital printers, scanners, and copiers with a specified processing, storage, and transmission capability; or all smart phones with a specific baseline configuration).

Selected

Selected

Selected