Management of Cybersecurity Over the Clearance Action Tracking System

Define actions not permitted by application administrators to ensure separation of duties is adequate and implement technical controls, or determine other mechanisms, to prohibit application administrators from conducting those actions.

Prioritize efforts to implement automated account management to lessen the burden on administrators and ensure appropriate roles and access are granted.

Ensure that all required controls are fully assessed for CATS and its operating environment on the frequency basis described within the ISCM plan to determine whether controls were implemented correctly, operating as intended, and producing desired outcomes. Controls assessments should be shared with relevant stakeholders. Any deficiencies should be documented in a plan of action and milestones, as appropriate.

Communicate with the Authorizing Official of eDISS+ during the annual review process of the ISA to ensure that all technical changes are updated appropriately within the agreement and that both parties are aware of any potential system changes that may impact either system’s security categorization and/or implemented controls.

Ensure that annual reviews and updates to the CATS risk assessment are performed to include the evaluation of all risks and subsequential existence of mitigating controls, in accordance with NNSA’s internal policies and NIST requirements.

Ensure that the CATS security categorization is reevaluated to consider all relevant factors and additional security controls are implemented, as necessary.

Reevaluate the risks and needs associated with implementing an alternate storage site for the CATS backup information and implement changes, as necessary.

Ensure that an analysis is conducted to identify PSFs in the system that are eligible for dispositioning, per Federal and Department requirements. Once completed, direct system personnel to communicate those results to the respective CPSOs to prepare for destruction where it is warranted.

Ensure initial and refresher training is provided to security personnel regarding the management, retention, and destruction of PSFs housed in CATS.

Ensure that all system users and system personnel receive training on CATS-specific incident response activities, to include but not limited to topics such as incident reporting procedures and incident response roles and responsibilities.

Ensure that rules of behavior are developed for privileged system users and require all users of the system to sign the appropriate rules of behavior according to their assigned role.

Develop and update, as appropriate, cybersecurity policies, plans, and procedures related not only to CATS, but also the NNSA Enterprise System to reflect current Federal and Department requirements.

Ensure that application security controls are implemented in the CATS application to protect against known types of attacks, including user spoofing.

Create and implement a firewall rule configuration review process to ensure firewall rules are periodically reviewed for unauthorized rule deviations and to determine if rules can be removed on a continuous basis.

Prioritize efforts to implement automated account management to lessen the burden on administrators and ensure appropriate roles and access are granted.

Ensure that all required controls are fully assessed for CATS and its operating environment on the frequency basis described within the ISCM plan to determine whether controls were implemented correctly, operating as intended, and producing desired outcomes. Controls assessments should be shared with relevant stakeholders. Any deficiencies should be documented in a plan of action and milestones, as appropriate.

Communicate with the Authorizing Official of eDISS+ during the annual review process of the ISA to ensure that all technical changes are updated appropriately within the agreement and that both parties are aware of any potential system changes that may impact either system’s security categorization and/or implemented controls.

Ensure that annual reviews and updates to the CATS risk assessment are performed to include the evaluation of all risks and subsequential existence of mitigating controls, in accordance with NNSA’s internal policies and NIST requirements.

Reevaluate the risks and needs associated with implementing an alternate storage site for the CATS backup information and implement changes, as necessary.

Ensures that an analysis is conducted to identify PSFs in the system that are eligible for dispositioning, per Federal and Department requirements. Once completed, direct system personnel to communicate those results to the respective CPSOs to prepare for destruction where it is warranted.

Create and implement a firewall rule configuration review process to ensure firewall rules are periodically reviewed for unauthorized rule deviations and to determine if rules can be removed on a continuous basis.

Ensure that application security controls are implemented in the CATS application to protect against known types of attacks, including user spoofing.

Develop and update, as appropriate, cybersecurity policies, plans, and procedures related not only to CATS, but also the NNSA Enterprise System to reflect current Federal and Department requirements.

Ensure that rules of behavior are developed for privileged system users and require all users of the system to sign the appropriate rules of behavior according to their assigned role.

Ensure that all system users and system personnel receive training on CATS-specific incident response activities, to include but not limited to topics such as incident reporting procedures and incident response roles and responsibilities.

Ensure initial and refresher training is provided to security personnel regarding the management, retention, and destruction of PSFs housed in CATS.