Cybersecurity Program

7.1 What is the purpose of this chapter?

7.2 What is the scope of this chapter?

7.3 What is the overall policy?

7.4 What are the authorities for this chapter?

7.5 What terms do you need to know to understand this chapter?

(1) Approving or declining to approve Servicewide cybersecurity policies and procedures, and

(2) Ensuring the Service has an effective cybersecurity program.

(1) Ensuring that employees within their areas of responsibility are aware of this and any other cybersecurity policies, procedures, and guidance and comply with all applicable directives; and

(2) Recommending employees to serve as system owners for programmatic or Regional systems and to carry out the responsibilities in section 7.6F below.

(1) Ensuring the confidentiality, integrity, and availability of the Service’s information resources;

(2) Serving as the AO for Service information systems and designating system owners for those systems in writing;

(3) Providing direction for the Service’s cybersecurity program, including the areas of cybersecurity operations, compliance, and risk management, and ensuring the program has the necessary resources; and

(4) Designating the Service’s ACISO.

(1) Overseeing and managing the Service’s cybersecurity program in accordance with applicable laws, regulations, policies, and standards;

(2) Advising the Service Directorate (including the ACIO) on cybersecurity matters including, but not limited to, risk management, assessment and authorization, and incident response;

(3) Developing and maintaining cybersecurity policies, procedures, and control techniques and incorporating security requirements into policies and procedures in other subject areas, as needed;

(4) Overseeing Servicewide implementation of security controls in accordance with the Department’s security control standards;

(5) Implementing continuous monitoring of the Service’s information resources and security controls and addressing any vulnerabilities or gaps discovered;

(6) Coordinating with the Department’s CISO and other Departmental officials to carry out Departmentwide cybersecurity activities;

(7) Leading all Servicewide FISMA reporting and compliance activities;

(8) Ensuring system owners are aware of their security responsibilities and adequately implement applicable security requirements for information systems under their control;

(9) Overseeing the Service’s response activities for audit compliance initiated by the Office of the Inspector General and other entities;

(10) Developing the Service’s security incident response plan and leading, or delegating another employee to lead, the Service’s Computer Security Incident Response Team (CSIRT); 

(11) Ensuring cybersecurity considerations are integrated into the Service’s Information Management and Technology (IMT) planning, budgeting, acquisition, project management, and portfolio management processes and are incorporated throughout the lifecycles of information systems and IMT investments;

(12) Developing and overseeing the Service’s A&A process for information systems in accordance with Departmental standards; 

(13) Assigning, or delegating the authority to assign, Information System Security Officers to Service information systems; and

(14) Performing all duties assigned in Departmental policy and regulation. 

(1) Coordinating with the appropriate system owners to ensure the security of assigned information systems throughout the systems’ lifecycles;

(2) Ensuring documentation required to receive and maintain an ATO is updated in accordance with organization-defined timeframes, including privacy impact assessments for systems that collect or maintain PII; 

(3) Assisting system owners with the implementation of security and privacy controls in alignment with the security categorization of the information system;

(4) Maintaining a system component inventory for systems within their areas of responsibility;

(5) Providing security briefings and updates to system owners throughout the lifecycles of their systems;

(6) Providing the ACISO with briefings on any changes impacting the security posture of assigned information systems or the organization’s overall risk tolerance; 

(7) Attending information system project meetings while the system is under development or enhancement to ensure security requirements are appropriately incorporated; and

(8) Collaborating with the APO and other members of the Service’s privacy program to ensure the security of information systems that maintain or collect PII.

(1) Coordinating with their ISSO to ensure the security of information systems under their control, including by implementing required security and privacy controls;

(2) Planning and ensuring adequate resources are available throughout the lifecycles of their systems;

(3) Reporting security costs, including the cost of implementing security controls, as required through the Department’s Capital Planning and Investment Control (CPIC) process in accordance with 270 FW 6, IMT Portfolio and Investment Management;

(4) Coordinating with their ISSO to provide necessary information in response to Federal and Departmental audits, security control assessments, and other reporting requirements;

(5) Receiving an ATO from the Service’s AO through the A&A process prior to deploying a system;

(6) Ensuring assigned ISSOs are part of system development teams and aware of system changes prior to development and implementation in production; and

(7) Serving as (or designating another employee to serve as) a Privacy Act System Manager for information systems that are also a Privacy Act system of records (see 204 FW 1, Privacy Act Program, for more information). 

(1) Ensuring all employees under their supervision:

     (a) Complete required security and privacy training, including Role-Based Security Training (RBST) and Role-Based Privacy Training (RBPT);

     (b)  Adhere to Servicewide cybersecurity policies and procedures, including, but not limited to, those described in this chapter; and

     (c) Complete all necessary tasks to receive access to the Service network and information systems, including agreeing to and signing the Department’s Rules of Behavior;

(2) Working with the Joint Administrative Operation’s Division of Human Capital to:

     (a) Ensure employees under their supervision have the requisite security clearances, training, and access  privileges appropriate to their duties; and

     (b) Complete the exit clearance process in accordance  with  223 FW 13, Exit Clearance for Fish and Wildlife Service Employees, and 223 FW 14, Exit Clearance for Non-Fish and Wildlife Service Employees, when the people they supervise separate from the Service; 

(3) Ensuring employees report suspected or actual security incidents through the appropriate reporting applicationor through the Enterprise Service Desk (ESD) (or by phone at 1-800-520-2433) if they don’t have network access; and

(4) Ensuring position descriptions and performance standards for employees reference security responsibilities, as appropriate. 

(1) Following applicable cybersecurity requirements in this chapter and related policies when accessing, handling, managing, and disposing of information resources;

(2) Completing necessary requirements to gain and maintain access to the Service network and specific information systems;

(3) Abiding by the Department’s Rules of Behavior;

(4) Reporting any suspected or actual cybersecurity incidents to the Service’s CSIRT through the appropriate reporting application or through the ESD (or by phone at 1-800-520-2433) if they don’t have network access; and

(5) Completing required security and privacy training, including RBST and RBPT, if applicable. 

(a) Define and document a process for provisioning accounts to authorized system users and permit only authorized accounts to access systems.

(b) Assign appropriate permissions to accounts.

(c) Ensure system users are only able to access the information and systems needed to perform their job functions in accordance with the principles of least privilege and separation of duties. 

(a) Employees must complete annual training to maintain access to information systems so that they are aware of requirements for appropriate use, protection, and security of information.

(b) Employees with defined cybersecurity responsibilities must complete RBST and RBPT. 

(a) Systems must be capable of creating audit records and event logs in response to events such as password changes, failed logons, administrative privilege usages, and more.

(b) A process must exist for reviewing audit records and event logs at an appropriate interval or in response to any suspicious activities.

(a) Create Servicewide and system-specific continuous monitoring plans for security controls in accordance with Departmental continuous monitoring policy. 

(b) Assess the security controls of information systems and provide the results to the AO. 

(c) Ensure the AO provides an ATO before the system enters the operation phase.

(d) Document any security deficiencies or vulnerabilities within a Plan of Action and Milestones (POAM) that describes planned remedial actions. 

(a) Ensure information systems comply with established baseline configurations.

(b) Develop and maintain component inventories, including hardware, software, and firmware.

(c) Create a process for reviewing, approving, and documenting changes to information systems and system components. 

(a) Establish and maintain plans for emergency response, backup operations, and post-disaster recovery.

(b) Test contingency plans at least annually.

(a) Appropriately identify user accounts and devices permitted to access system resources.

(b) Authenticate (or verify) users or devices before system access is granted.

(a) The cybersecurity program must have an operational incident handling capability.

(b) Track, document, and report incidents to appropriate organizational officials and authorities in accordance with an established incident response plan.

(c) Provide employees with training for reporting and responding to security incidents. 

(a) Ensure maintenance on IT is performed periodically in accordance with manufacturer or vendor recommendations.

(b) An appropriate Service employee must authorize and monitor maintenance activities whether in person or remote. 

(a) Ensure Service information in storage media (both paper and digital) is protected from loss, alteration, or theft and is appropriately labeled.

(b) Only use approved removable storage media to store Service information, including refraining from using personally owned removable storage media.

(c) Sanitize digital storage media prior to the media leaving Service control.

(a) Limit physical access to information systems, equipment, and operating environments to authorized individuals.

(b) Protect assets against unauthorized use, theft, environmental hazards, or inadvertent destruction.

(c) Implement environmental controls including emergency shutoffs, emergency power, and emergency lighting. 

(a) Maintain system security plans and review them at least annually.

(b) Ensure system security plans describe the security controls in place or planned for the information systems.

(a) Implement Departmental requirements for critical infrastructure, risk management, insider threats, security workforce, continuous monitoring, enterprise architecture, POAMs, and other similar policies and plans.

(b) Document and implement additional Service-specific policies, procedures, plans, and requirements for the aforementioned areas. 

(a) Ensure employees (including contractors and other service providers) are trustworthy and meet established security criteria for their positions.

(b) Terminate system access of separated employees and contractors promptly to prevent unauthorized or malicious access.

(c) Develop formal sanctions for personnel failing to comply with organizational security policies and procedures.

(a) Conduct risk assessments in accordance with applicable NIST guidance.

(b) Review risk assessments on a periodic basis or whenever there are significant changes to an information system.

(c) Conduct periodic vulnerability scans of information systems.

(a) Allocate sufficient resources to protect information systems as part of the CPIC process.

(b) Incorporate cybersecurity requirements and considerations throughout the lifecycles of information systems, including when acquiring, developing, managing, and decommissioning a system.

(c) Incorporate security requirements into the appropriate acquisition documents such as statements of work and contracts, including supply chain risk management clauses.

(d) Ensure third-party providers employ adequate security measures to protect outsourced information, systems, applications, and services.

(a) Monitor, control, and protect organizational communications (i.e., information that our systems transmit or receive) at the external boundaries and key internal boundaries of those systems.

(b) Employ architectural designs, software development techniques, and engineering principles that promote effective information security.

(a) Employ processes to identify, report, and correct information and information system flaws in a timely manner, including through patch management and other means.

(b) Protect information systems from malicious code or other vulnerabilities.

(a) Protect against risks associated with IT supply chains including insertion or use of counterfeits, tampering, theft, insertion of hardware and software, and poor manufacturing and development.

(b) Incorporate required elements into contracting documents in accordance with Departmental policy.