SSA’s Electronic Information Data Exchange Information Security Certification and Compliance Monitoring Program Presented by: Michael G. Johnson, Director, Division of Compliance and Oversight, Office of Information Security, Office of the Chief Information Officer

A formal agreement with SSA SSA’s security certification Ongoing conformance to SSA’s information security requirements Acquiring and Continuing to Receive Electronic Information from SSA Pivots on …

Federal laws and policies OMB mandates Recognized NIST standards Due diligence SSA’s Security Requirements and Guidelines are in Consideration of …

Technical access controls Transaction audit trails Monitoring and anomaly detection Management controls and oversight User security awareness training User sanctions Personally Identifiable Information management and breach reporting SSA’s Suite of Information Security Requirements and Guidelines Address …

Fluid Articulated in a formal living document that is sensitive and distributed on a “need to know” basis Security Requirements, Certification and Compliance Monitoring Procedures are …

New higher level requirements; e.g., Federal mandate New technologies Emergence of new threats or attack methods Some Factors That Impact Security Requirements are …

Written plan addressing all facets of SSA’s requirements (plan format SSA’s requirements (plan format follows a prescribed template) follows a prescribed template) Self-certification SSA onsite certification Getting Certified Requires …

Generally every 3 years Reviews can be triggered by special circumstances; e.g., PII breaches, organizational changes potentially impacting the security of SSA information, introduction of new technology impacting SSA information Reviews may be remote or onsite Reviews are announced Reviews assess conformance to the suite of SSA’s security requirements Review findings are formally conveyed Actions required to address findings are monitored to closure Compliance Monitoring Entails Cyclical Reviews by SSA …

Not an “Aha, we gotcha!” exercise SSA will work with its partners in resolving deficiencies which occur subsequent to previous approval for access as the result of updated security requirements Security Certification and Compliance Monitoring Procedures …

Q S U N E O S I T S I E O U N Q S