PB 22164 - September 29, 2005 - USPS.com® - About

POSTAL BULLETIN 22164 (9-29-05)
USPS CA Certificate Practice Statement (CPS)
Boilerplate for Contracts and Agreements
Guidelines for New Development of Web-based
Applications
Guide to Coding Secure Software
Information Security Code Review Standards
COTS Software Security Evaluation Process
Pub. 805-A, Information Security Assurance
(ISA) Process
Pub. 805-E, What Every Employee Needs to
Know About Information
Security
HANDBOOK AS-805-A REVISION
Application Information Security Assurance (ISA) Process
Effective September 29, 2005, we are revising Handbook
AS-805-A, Application Information Security
Assurance (ISA) Process, to address the registering of applications
in eAccess and the acceptance of responsibility
letter for documented vulnerabilities that will not be
mitigated.
We will incorporate these revisions into the next online
version of Handbook AS-805-A accessible on the Postal
Service PolicyNet Web site:
Go to http://blue.usps.gov.
Under “Essential Links” in the left-hand column, click
on References.
Under “References” in the right-hand column, under
“Policies,” click on PolicyNet.
Then click on HBKs.
(The direct URL for the Postal Service PolicyNet Web
site is http://blue.usps.gov/cpim.)
Handbook AS-805-A, Application Information
Security Assurance (ISA) Process
* * * * *
2 Roles and Responsibilities
* * * * *
2-6 Portfolio Managers
Portfolio managers are responsible for the following:
* * * * *
[Reletter current e as new h. Add new items e, f, and g to
read as follows:]
e. Preparing and signing an acceptance of responsibility
letter, if a documented vulnerability will not be
mitigated.
f. Ensuring that the application is registered in
eAccess.
97
PS Form 1357, Request for Computer Access
PS Form 1360, Information Security Incident
Report
MOP IT-03-11-2002, Computer Use
* * * * *
— Corporate Information Security,
Information Technology, 9-29-05
g. Accepting all risks, liabilities, and responsibilities and
assuming personal accountability for any damage to
the Postal Service (including direct financial losses
and any costs resulting from remedial actions in
operating the application) for authorizing an application
to enter the production environment prior to
completing the application ISA process.
* * * * *
4 The ISA Process
* * * * *
4-1 Phase 1 — Definition
* * * * *
4-1.5 Next Steps
* * * * *
[Swap sections 4-1.5.2 and 4-1.5.3 as follows: 4-1.5.2, Applications
Designated as Legacy and 4-1.5.3, All Other
Applications.]
* * * * *
4-2 Phase 2 — Design and Integration
* * * * *
4-2.4 Activities
* * * * *
[Renumber current 4-2.4.9 through 4-2.4.10 as new
4-2.4.12 through 4-2.4.13. Add new 4-2.4.9 through
4-2.4.11 to read as follows:]
4-2.4.9 Incorporate Security Requirements in Service
Level Agreements and Trading Partner
Agreements
Service level agreements (SLAs) are developed for all
applications. Trading partner agreements (TPAs) are
developed for all externally managed and/or developed applications.
Information security requirements are
addressed in all SLAs and TPAs.