HHSOIG - A-18-19-11200 - 268665

The Information Security and Privacy Policy (IS2P) is HHS’ primary policy document governing cybersecurity which is pending a rewrite to address the upcoming requirements in NIST 800-53 revision 5. When this update occurs to the IS2P, HHS should: - Specify required cybersecurity control maturity levels in addition to identifying the selection of NIST controls. - Describe HHS’ Cybersecurity Shared Responsibility Model, including the key roles under centralized, federated and hybrid strategies for control implementation. Include responsibilities of the OCIO, the OPDIVs, and third-party stakeholders (including contractors). - Communicate that a Managed and Measurable or the optimal maturity level, based on HHS’s risk assessment, be required to be deemed “Effective”.