Additional unemployment insurance information security guidance

UIPL24-04c3acc.pdf (https://www.dol.gov/sites/dolgov/files/ETA/advisories/UIPL/2009/UIPL24-04c3acc.pdf)

                                                         CLASSIFICATION
       EMPLOYMENT AND TRAINING ADMINISTRATION            UI
                   ADVISORY SYSTEM                       CORRESPONDENCE SYMBOL
              U.S. DEPARTMENT OF LABOR
                                                         OWS/DPM
                                                         DATE
                 Washington, D.C. 20210
                                                         March 5, 2009




ADVISORY:             UNEMPLOYMENT INSURANCE PROGRAM LETTER NO. 24-04,
                      Change 3

TO:                   STATE WORKFORCE AGENCIES

FROM:                 DOUGLAS F. SMALL /s/
                      Deputy Assistant Secretary

SUBJECT:              Unemployment Insurance (UI) Information Technology (IT) Security –
                      Additional Information

1. Purpose. To provide State Workforce Agencies (SWAs) with additional information on the
   National Institute of Standards and Technology’s (NIST) Information Technology (IT)
   security guidelines.

2. References. Unemployment Insurance Program Letter (UIPL) 24-04; UIPL 24-04 Change 1,
   UIPL 24-04 Change 2, ET Handbook No. 336, 18th Edition; the Unemployment Insurance
   State Quality Service Plan (SQSP) and Reporting Guidelines, Chapter 1, Section VI, C,
   Supplemental Budget Requests (SBRs) and Chapter 1, Section VII, J, Assurance of
   Automated Information System Security.

3. Background. In the last five years, the Office of Inspector General (OIG) conducted IT
   Security audits to determine if the Employment and Training Administration (ETA) provides
   sufficient oversight of the SWAs' IT security for the UI program. UIPL 24-04, UIPL 24-04
   Change 1, and UIPL 24-04 Change 2, provided the SWAs with IT security guidance via a
   CD, titled IT Security Information.

4. Additional Guidance. As an ongoing effort to provide security guidance to the SWAs, this
   UIPL is issued to provide a CD which includes the new and updated NIST Special
   Publications including new guidelines in conducting security assessments of UI systems.
   Particularly, the following NIST publications are important for conducting security
   assessments of UI systems.

   •    Federal Information Processing Standards (FIPS) Publication 199, provides standards for
        categorizing information and information systems.
   •    FIPS Publication 200 and NIST Special Publication (SP) 800-53, provide guidelines for
        selecting and specifying security controls that meet minimum security requirements for
        information systems.
 RESCISSIONS                                             EXPIRATION DATE
 None                                                    March 5, 2010

   •   NIST SP 800-53A, provides a standard methodology for capturing the results of system-
       level security controls assessments by providing a form to comprehensively, consistently,
       and cost-effectively show the results of a security controls assessment.

   The U.S. Department of Labor (DOL) strongly encourages each SWA to conduct an IT
   security assessment in accordance with the NIST guidelines. The results of this security
   assessment can be used each year as a basis for providing the assurance referenced in
   Handbook 336, Chapter 1, Section VI, C. SBRs and Chapter 1, Section VII, J. Assurance of
   Automated Information System Security.

   SWAs can use the “UI IT Security” document as a reference while conducting the security
   assessment to find the specific law, regulation, or NIST Special Publication to help answer
   their questions. The security assessment is based on criteria and guidance established by
   NIST and specified in the Special Publications. SWAs can conduct a security assessment of
   the UI systems to verify that the security controls conform to the different laws, regulations,
   and the guidance established by NIST.

5. Action. SWAs are encouraged to:

   •   Review the NIST IT security documents and guidelines;
   •   Use FIPS 199 to categorize the information system, FIPS 200/NIST SP 800-53 for the
       specification of security controls, and NIST SP 800-53A for the assessment of security
       control effectiveness.

6. Inquiries. Direct any questions to your Regional Office or the National Office to Paul
   Bankes at 202-693-3053 or [email protected] or Jagruti Patel at 202-693-3059 or
   [email protected]

7. Separate Cover. A paper titled, Unemployment Insurance Information Technology Security
   – Version 4 and a “CD” titled IT Security Information – Version 4 will be sent under separate
   cover.