UI information technology security self-assessment

Signed letter (https://www.dol.gov/sites/dolgov/files/ETA/advisories/UIPL/2006/UIPL24-06_ch2.pdf):

EMPLOYMENT AND TRAINING ADMINISTRATION ADVISORY SYSTEM
U.S. DEPARTMENT OF LABOR, Washington, D.C. 20210
CLASSIFICATION: UI
CORRESPONDENCE SYMBOL: OWS/DUIO
DATE: March 29, 2006
ADVISORY: UNEMPLOYMENT INSURANCE PROGRAM LETTER NO. 24-04, CHANGE 2
TO: STATE WORKFORCE AGENCIES
FROM: CHERYL ATKINSON, Administrator, Office of Workforce Security
SUBJECT: Unemployment Insurance Information Technology Security – Additional Information and the Self-Evaluation Tool
RESCISSIONS: None
EXPIRATION DATE: March 31, 2007

1. Purpose. To provide State Workforce Agencies (SWAs) with both additional information on the National Institute of Standards and Technology’s (NIST) Information Technology (IT) security guidelines and the software tool to conduct a security self-assessment of unemployment insurance (UI) computer systems.

2. References. Unemployment Insurance Program Letter (UIPL) 24-04, UIPL 24-04 Change 1, ET Handbook No. 336, 17th Edition, the Unemployment Insurance State Quality Service Plan (SQSP) and Reporting Guidelines, Chapter 1, Section VI, C, SBRs and Chapter 1, Section VII, J, Assurance of Automated Information System Security.

3. Background. UIPL 24-04 and UIPL 24-04 Change 1 provided SWAs with IT security guidance via distribution of a CD, titled IT Security Information. This UIPL is issued to provide a CD which includes the NIST Special Publications including new releases and the NIST software tool called “Automated Security Self-Evaluation Tool” (ASSET). SWAs can use it to conduct a valid self-assessment on their IT systems using the NIST Special Publication (SP) 800-26 titled, “Security Self-Assessment Guide for Information Technology Systems.”

The U.S. Department of Labor (DOL) strongly encourages each SWA to conduct an IT security self-assessment in accordance with the NIST guidelines. The results of this self-assessment can be used each year as a basis for providing the assurance referenced in Handbook 336, Chapter 1, Section VI, C. SBRs and Chapter 1, Section VII, J. Assurance of Automated Information System Security.

SWAs can use the “UI IT Security” document as a reference while conducting the self-assessment to find the specific law, regulation, or NIST Special Publication to help answer their questions. The self-assessment is based on criteria and guidance established by NIST and specified in the Special Publications. SWAs can conduct a self-assessment of the UI systems to verify that the security controls conform to the different laws, regulations, and the guidance established by NIST.

DOL plans to provide funds during FY 2006 to selected states to address UI IT security weaknesses. These funds will be limited to resolving weaknesses that have been identified by an Office of Inspector General IT security audit, an internal state IT security audit, or an IT security self-assessment following the guidelines provided by NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems.

4. Action. SWAs are encouraged to:
• Review the NIST IT security documents and guidelines;
• Perform the self-assessment evaluation which complies with NIST SP 800-26; and
• Seek supplemental funds to address any weaknesses found.

5. Inquiries. Direct questions to your Regional Office or in the National Office to Paul Bankes at 202-693-3053 or [email protected] or Jagruti Patel at 202-693-3059 or [email protected]

6. Separate Cover. A paper titled, Unemployment Insurance Information Technology Security – Version 3 and a “CD” titled IT Security Information – Version 3 will be sent under separate cover.