Environmental Protection Agency Shared Service Center

1. Environmental Protection AgencyShared Service Center INTEGRATED SECURITY SOLUTION FOR FISMA REPORTING

2. Our Vision • Help federal managers & and IT • professionals understand • & successfully implement the • federal risk management framework • so they can manage information • and IT assets in accordance with • federal standards

3. Agenda/Presentation Overview • SSC Goals • Role in the Risk Management Framework • ASSERT Capabilities • EPA’s SSC Process • Consortium Benefits • Implementation Timeframe • Pricing • Summary

4. Integrated Security Solution – Our Goals • Assistyour information security program using proven, effective practices • Savetime and resources spent on FISMA quarterly and annual reporting to OMB • Aidperformance on the Annual Congressional Scorecard

5. EPA’s Integrated Security Solution FIPS 199 FIPS 200 FIPS 200 800-42 800-60 800-53 800-53a ASSERT Information System C&A 800-37 800-30 800-37 800-18 FIPS 200 800-53a 800-64 800-70

6. Time to Talk AboutASSERT

7. Secure Web Access Portal for Ease of Use System Categorization System Inventory Management Risk Identification Control Tailoring Continuous Monitoring: Implementation, Testing, and Remediation (POAM Tasks) Management Oversight FISMA Reporting Compliance ASSERTCapabilities • “Since 2004 SSA has used • the ASSERT tool.  It has • met all our expectations • and more as the IG and • their contractor have also • given it a ‘thumbs up.’  • … We at SSA highly • recommend the tool.”  • Bob Burch, • FISMA Manager • Social Security Administration

8. ASSERTSecure Web Access Customized with your logo and colors Conforms with Moderate Baseline & FIPS 140-2 encryption Post news and announcements for users

9. ASSERTPortal: Ease of Use See summary information What you see is based on your job assignments Focus on critical items Perform key functions at the click of a button Access details via links

10. ASSERTSystem CategorizationBusiness Orientation Helps users identify Business Areas, Lines of Business Walks users through a structured interview or supports expert mode Extensive links to help Button navigation

11. ASSERTSystem CategorizationGuidance for Users Coaching for decisions on confidentiality, integrity, and availability Low Low Moderate Helps identify Other Factors and Special Factors affecting categorization

12. ASSERTInventory Management Maintain FISMA or full Agency Inventory Identify GSS/MA Relationships across Agency 12

13. ASSERTRisk Identification and Control Tailoring Scoping Risk values Review status 13

14. ASSERTContinuous Monitoring: Implementation Base Control Implementation documented & available for export to Security Plan Enhancements

15. ASSERTContinuous Monitoring: Testing Show expected test step results and require documentation of variances Roll up to Control status Document the test step result Certify the test step result

16. ASSERTContinuous Monitoring: Remediation Tasks for remediating the control

17. ASSERTManagement Oversight Real-time report data Export to PDF or Excel or on-screen view

18. ASSERTManagement Oversight Color coding and words

19. ASSERTFISMA Reporting Compliance Expands to show totals by categorization level

20. ASSERTFISMA Reporting Compliance

21. ASSERTTechnical Specifications • ColdFusion MX7 front-end • Oracle 10g database • Accessed via the Web using FIPS 140-2 compliant encrypted connection (https://) • No mobile code or special ports • Scalable for number of organizational units, systems and users

22. A Solid Foundation inASSERT • A stable, effective, full-featured tool • Secure web-based access to a centralized database • Complies with Moderate baseline controls • Full cycle of FISMA-mandated activities supported • Reporting capabilities “The elements and phases of the ASSERT SPM appear not only to comply with DITSCAP requirements, but they are much more comprehensive and specify many more steps in the software accreditation and implementation process for EPA. In addition, each element of the ASSERT System has very specific QA requirements for documentation and approval.” Kevin Hull, December 2006 Independent QA Auditor 22

23. EPA’s Shared Service Center:Customized Services 23

24. EPA’s Shared Service Center Offerings • Implementation support • Software deployment • Ongoing management & operational support • Technical hosting options • Consortium membership

25. SSC Implementation Support • Evaluate current processes and security environment • Recommend implementation plan based on effective practices • If requested, provide CISO and staff with business and technical consulting • Help migrate existing data, tailor controls • Offer user training and help desk support

26. SSC Software Deployment • Flexibility through customization of… • Agency logo and preferred colors • Organizational structure • Standardized terms • Support for loading information • System-user information • Assessment and POAM history • Agency specific NIST-compliant policies to reference • Agency specific common controls, risk management decisions

27. SSC Management & Operational Support • Sharing of best practices • FISMA management and reporting services: • Management and business process consultation • Analysis, such as policy alignment • Customized reports • Staff augmentation • Comprehensive user training • Relates software to business processes • Can qualify as specialized IT training • Help desk support

28. SSC Technical Hosting Options • EPA hosting service • Centralized database instance for each agency, with segregation of data • System platforms, management and monitoring • Fully certified and accredited environments • Participant agency hosting • Provide own system platforms, management and monitoring

29. ASSERTConsortium • Consortium Board sets vision and directs software evolution • Configuration Control Board oversees the ASSERTfeature set • Members share best practices and leverage costs • Reasonablypriced to accommodate agencies of all sizes • 2006 membership: • EPA, GSA, SSA, USDA

30. Consortium Members’ Security Grades: 2001-2005 NOTE: USDA joined in 2006.

31. Consortium Process Gather Requirements Analyze & Define Review by Consortium Board Formalize Request Approval by CCB Develop & Deploy Process repeats as necessary

32. EPA’s Integrated Security Solution: Getting There

33. Cost: Sliding Scale * To Be Negotiated 33

34. SummaryEPA’s Integrated Security Solution • A proven business model • Conformance to the federal risk management framework • Proven, stable software solution since 2002 • Services to support implementation and beyond • Consortium in operation since 2004 • Consortium members got “A’s” on 2005 Congressional Scorecard

35. Benefits • Conforms to the federal risk management framework and federal standards • Standardizes and integrates security practices with business processes • Affordable for agencies of all sizes • Comprehensive solution: • Services for implementation plus ongoing management and operations support • ASSERTsoftware

36. Benefits (continued) • Well-integrated with OMB regulations and NIST methodology for continuous monitoring of controls • Active consortium of government agencies • Direct the system vision and development • Reduce costs through shared resources • Sets software feature direction

37. Summary: This Approach Standardizes and integrates security practices with business processes… …with the help of an agency that has been there before.

38. EPA Open House • Consortium Open House, April 5 from 9 am to 3 pm • At EPA East, 12th & Constitution, Rooms 1117A & B • Come for panel discussions, Q&A, and demos 38

39. Environmental Protection AgencyShared Service Center FISMA Reporting Solution For more information, please contact: Don Huddleston U.S. EPA 202-566-1462 huddleston.don@epa.gov Bernice Bealle U.S. EPA 202-566-0716 bealle.bernice@epa.gov Marian Cody, CISO U.S. EPA 202-566-0302 cody.marian@epa.gov 39