Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
4
Recommendation 3: {Section A} We recommend that the Chief Information Officer:
• Improve oversight of the security assessment and authorization process for the
Department's information systems, especially the OpenNet General Support System
(GSS) and ClassNet GSS as required by the National Institute of Standards and
Technology (NIST) (SP) 800-37.
• Improve existing procedures to ensure security authorization packages are updated every
3 years or when a significant change occurs or develop a risk-based approach for
implementing a continuous monitoring strategy as required by NIST SP 800-37.
• Improve existing procedures to ensure Systems Security Plans and Systems Assessment
Reports are updated as required to comply with the security baseline controls contained
in NIST SP 800-53 (Revision 3).
• Perform annual security assessments of a subset of a system's security controls as
required by NIST SP 800-37.
Department Response to Recommendation 3:
With regard to bullet 2, we note that FISMA FY2011 reporting instructions explicitly
removed any such requirement. We quote:
Is a security reauthorization still required every 3 years or when an information
system has undergone significant change as stated in OMB Circular A-130? No.
Rather than enforcing a static, three-year reauthorization process, agencies are expected
to conduct ongoing authorizations of information systems through the implementation of
continuous monitoring programs. [1] (emphasis in original)
Based on this instruction, the Department does not agree with the recommendation in
bullet l.
With regard to bullet 3, the new NIST SP 800-53 guidance was not fully implemented[2]
until June 2010, and thus compliance was not required for C&As starting before June
2011. All Department C&As commencing after June 2011 will comply with the new
version ofNIST 800-53/53A. The Department's C&A Toolkit has been fully updated to
implement this change. Applying a risk-based approach, the Department does not judge
it necessary to retroactively adjust prior C&As to meet this new standard. [3]
With regard to bullet 4, the Department performs such annual testing on all its systems,
except in rare cases that are vigorously pursued.
Recommendation 4: {Section B} We recommend that the Chief Information Officer expedite
the Information Resource Management, Operations, Enterprise Network Management and
Diplomatic Security, Security Infrastructure, Office of Computer Security process to finalize and
implement the elements within the Cyber Security Architecture draft target architecture and
[1] OMB M-1l-33, FAQ 28.
UNCLASSIFIED
[2] A new NIST 800-53A was needed to implement the new 800-53, and was not published until June 2010.
[3] Authority is OMB M-1l-33, FAQ 15.
65
UNCLASSIFIED