2016_HSA_Yrbk_YUMPU_r2___

ing Cloud based systems and systems outside of the
FEMA Enterprise Network, were deployed at the end of
March, meeting the initial six-month deadline through
tight collaboration across all stakeholders.
The completion of PIV/SSO enablement is a significant
step in furthering FEMA’s cyber defenses and
controls to better protect FEMA data, including information
from disaster survivors and FEMA partners. The
PIV/SSO effort not only introduced a scalable enterprise
security platform but it also integrated all FEMA’s critical
systems within the infrastructure to ensure the security
of the organization’s applications and the data which
it maintains. This was accomplished with minimal user
interruption as the integrated FEMA-IBM team carefully
planned the deployment of the systems taking into consideration
FEMA restrictions of system changes during
active disaster declarations.
This project PIV enabled FEMA systems at the application
level, allowing FEMA to attain the Level of
Assurance 4, in accordance with the NIST SP 800-63
requirements, for their high value systems. With this
capability, the agency has transformed the way all users
access their applications, simplifying and streaming
their access to the applications while improving system
security and reducing FEMA operational overhead of
manually updating employee records. By creating a
standardized solution approach across disparate identity
architectures throughout different FEMA IT Systems,
this project also reduces the effort for any new system to
be integrated within FEMA’s enterprise security infrastructure
in the future. The FEMA PIV/SSO effort applied
industry-leading security standards and created a robust
security layer, which enhances FEMA’s ability to both
secure and control access to sensitive information. This
implementation not only leveraged an architecture that
conforms to various FICAM model objectives, but also
helped FEMA reach its objective of meeting OMB and
DHS mandates.
Summary highlights of how the PIV/SSO initiative transformed
FEMA’s security posture include:
• Implementation of an architecture that conforms
to goals for Federal Identity, Credential, and Access
Management (FICAM) model.
• FEMA attainment of Level of Assurance 4, in
accordance with the NIST SP 800-63 requirements,
for their high value systems.
• Implementation of appropriate policy controls
such as User Based Enforcement (UBE).
• Reduced PII Exposure and improved audit
reporting.
• A standardized solution across disparate
identity architecture throughout different
FEMA IT Systems.
• Reduced FEMA operational overhead of manually
updating employee records.
84