40
Computer System Security
Section 9.0
Publication 1075 (October 2014)
Page 71
9.3.8 Incident Response
These incident response controls apply to both physical and information system security
relative to the protection of FTI.
9.3.8.1 Incident Response Policy and Procedures (IR-1)
The agency must:
a. Develop, document, and disseminate to designated agency officials:
1. An incident response policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among agency
entities, and compliance; and
2. Procedures to facilitate the implementation of the incident response policy
and associated incident response controls; and
b. Review and update the current:
1. Incident response policy every three years; and
2. Incident response procedures at least annually.
9.3.8.2 Incident Response Training (IR-2)
Agencies must train personnel with access to FTI, including contractors and
consolidated data center employees if applicable, in their incident response roles on the
information system and FTI. The agency must provide incident response training to
information system users consistent with assigned roles and responsibilities:
a. Prior to assuming an incident response role or responsibility;
b. When required by information system changes; and
c. Annually thereafter.
9.3.8.3 Incident Response Testing (IR-3)
Agencies entrusted with FTI must test the incident response capability for the
information system at least annually.
a. Agencies must perform tabletop exercises using scenarios that include a breach
of FTI and should test the agency
’
s incident response policies and procedures.
b. All employees and contractors with significant FTI incident response capabilities,
including technical personnel responsible for maintaining consolidated data
centers and off-site storage, must be included in tabletop exercises.
c. Each tabletop exercise must produce an after-action report to improve existing
processes, procedures, and policies.
See Section 10.3, Incident Response Procedures, for specific instructions on incident
response requirements where FTI is involved.
C# Excel - Excel Conversion & Rendering in C#.NET without using other external third-party dependencies like Adobe Acrobat. file conversion from Excel document to image or document, or Excel to PDF Conversion.
how to add a jpg to a pdf; add picture to pdf file
36
Computer System Security
Section 9.0
Publication 1075 (October 2014)
Page 72
9.3.8.4 Incident Handling (IR-4)
The agency must:
a. Implement an incident handling capability for security incidents that includes
preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinate incident handling activities with contingency planning activities; and
c. Incorporate lessons learned from ongoing incident handling activities into incident
response procedures, training, and testing/exercises, and implement the
resulting changes accordingly.
9.3.8.5 Incident Monitoring (IR-5)
The agency must track and document all physical and information system security
incidents potentially affecting the confidentiality of FTI.
9.3.8.6 Incident Reporting (IR-6)
The agency must:
a. Require personnel to report suspected security incidents to internal agency
incident response resources upon discovery of the incident; and
b. Contact the appropriate special agent-in-charge, TIGTA, and the IRS Office of
Safeguards immediately but no later than 24 hours after identification of a
possible issue involving FTI.
Refer to Section 10.0, Reporting Improper Inspections or Disclosures, for more
information on incident reporting requirements required by the Office of Safeguards.
9.3.8.7 Incident Response Assistance (IR-7)
The agency must provide an incident response support resource, integral to the agency
incident response capability that offers advice and assistance to users of the information
system for the handling and reporting of security incidents.
9.3.8.8 Incident Response Plan (IR-8)
The agency must:
a. Develop an incident response plan that:
1. Provides the agency with a roadmap for implementing its incident
response capability;
2. Describes the structure of the incident response capability;
3. Provides a high-level approach for how the incident response capability
fits into the overall agency;
40
Computer System Security
Section 9.0
Publication 1075 (October 2014)
Page 73
4. Meets the unique requirements of the agency, which relate to mission,
size, structure, and functions;
5. Defines reportable incidents;
6. Provides metrics for measuring the incident response capability within the
agency;
7. Defines the resources and management support needed to effectively
maintain and mature an incident response capability; and
8. Is reviewed and approved by designated agency officials.
b. Distribute copies of the incident response plan to authorized incident response
personnel;
c. Review the incident response plan at a minimum on an annual basis or as an
after-action review;
d. Update the incident response plan to address system/agency changes or
problems encountered during plan implementation, execution, or testing;
e. Communicate incident response plan changes to authorized incident response
personnel; and
f. Protect the incident response plan from unauthorized disclosure and
modification.
9.3.8.9 Information Spillage Response (IR-9)
The agency must respond to information spills by:
a. Identifying the specific information involved in the information system
contamination;
b. Alerting authorized incident response personnel of the information spill using a
method of communication not associated with the spill;
c. Isolating the contaminated information system or system component;
d. Eradicating the information from the contaminated information system or
component; and
e. Identifying other information systems or system components that may have been
subsequently contaminated.
9.3.9 Maintenance
9.3.9.1 System Maintenance Policy and Procedures (MA-1)
The agency must:
a. Develop, document, and disseminate to designated agency officials:
1. A system maintenance policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among agency
entities, and compliance; and
40
Computer System Security
Section 9.0
Publication 1075 (October 2014)
Page 74
2. Procedures to facilitate the implementation of the system maintenance
policy and associated system maintenance controls; and
b. Review and update the current:
1. System maintenance policy every three years; and
2. System maintenance procedures at least annually.
9.3.9.2 Controlled Maintenance (MA-2)
The agency must:
a. Schedule, perform, document, and review records of maintenance and repairs on
information system components in accordance with manufacturer or vendor
specifications and agency requirements;
b. Approve and monitor all maintenance activities, whether performed on site or
remotely and whether the equipment is serviced on site or removed to another
location;
c. Require that designated agency officials explicitly approve the removal of the
information system or system components from agency facilities for off-site
maintenance or repairs;
d. Sanitize equipment to remove all FTI from associated media prior to removal
from agency facilities for off-site maintenance or repairs; and
e. Check all potentially impacted security controls to verify that the controls are still
functioning properly following maintenance or repair actions and update agency
maintenance records accordingly.
9.3.9.3 Maintenance Tools (MA-3)
The agency must approve, control, and monitor information system maintenance tools.
9.3.9.4 Non-Local Maintenance (MA-4)
The agency must:
a. Approve and monitor non-local maintenance and diagnostic activities;
b. Allow the use of non-local maintenance and diagnostic tools only as consistent
with agency policy and documented in the security plan for the information
system;
c. Employ multi-factor authenticator in the establishment of non-local maintenance
and diagnostic sessions;
d. Maintain records for non-local maintenance and diagnostic activities;
e. Terminates session and network connections when non-local maintenance is
completed; and
f. Documents policies and procedures for the establishment and use of non-local
maintenance and diagnostic connections. (CE2)
41
Computer System Security
Section 9.0
Publication 1075 (October 2014)
Page 75
9.3.9.5 Maintenance Personnel (MA-5)
The agency must:
a. Establish a process for maintenance personnel authorization and maintain a list
of authorized maintenance organizations or personnel;
b. Ensure that non-escorted personnel performing maintenance on the information
system have required access authorizations; and
c. Designate agency personnel with required access authorizations and technical
competence to supervise the maintenance activities of personnel who do not
possess the required access authorizations.
9.3.10 Media Protection
Information system media is defined to include both digital and non-digital media.
9.3.10.1 Media Protection Policy and Procedures (MP-1)
The agency must:
a. Develop, document, and disseminate to designated agency officials:
1. A media protection policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among agency
entities, and compliance; and
2. Procedures to facilitate the implementation of the media protection policy
and associated media protection controls; and
b. Review and update the current:
1. Media protection policy every three years; and
2. Media protection procedures at least annually.
9.3.10.2 Media Access (MP-2)
The agency must restrict access to digital and non-digital media containing FTI to
authorized individuals.
9.3.10.3 Media Marking (MP-3)
The agency must label information system media containing FTI to indicate the
distribution limitations and handling caveats.
The agency must label removable media (CDs, DVDs, diskettes, magnetic
tapes, external hard drives and flash drives) and information system
output containing FTI (reports, documents, data files, back-up tapes)
indicating
³
Federal Tax Information
´
. Notice 129-A and Notice 129-B IRS
provided labels can be used for this purpose.
43
Computer System Security
Section 9.0
Publication 1075 (October 2014)
Page 76
9.3.10.4 Media Storage (MP-4)
The agency must:
a. Physically control and securely store media containing FTI; and
b. Protect information system media until the media is destroyed or sanitized using
approved equipment, techniques, and procedures.
See Section 4.0, Secure Storage
—
IRC 6103(p)(4)(B), on additional secure storage
requirements.
9.3.10.5 Media Transport (MP-5)
The agency must:
a. Protect and control digital (e.g., diskettes, magnetic tapes, external/removable
hard drives, flash/thumb drives, CDs, DVDs) and non-digital (e.g., paper) media
during transport outside of controlled areas;
b. Maintain accountability for information system media during transport outside of
controlled areas;
c. Document activities associated with the transport of information system media
—
the agency must use transmittals or an equivalent tracking method to ensure FTI
reaches its intended destination; and
d. Restrict the activities associated with the transport of information system media
to authorized personnel.
The information system must implement cryptographic mechanisms to
protect the confidentiality and integrity of information stored on digital
media during transport outside of controlled areas. (CE4)
See Section 4.4, FTI in Transit, for more information on transmittals and media transport
requirements.
9.3.10.6 Media Sanitization (MP-6)
The agency must:
a. Sanitize media containing FTI prior to disposal, release out of agency control, or
release for reuse using IRS-approved sanitization techniques in accordance with
applicable federal and agency standards and policies;
b. Employ sanitization mechanisms with the strength and integrity commensurate
with the security category or classification of the information; and
c. Review, approve, track, document, and verify media sanitization and disposal
actions. (CE1)
Agencies must review and approve media to be sanitized to ensure compliance with
records-retention policies. Tracking/documenting actions include, for example, listing
personnel who reviewed and approved sanitization and disposal actions, types of media
Documents you may be interested
Documents you may be interested
