Security guidance for state unemployment IT systems

UIPL24-04c4acc.pdf (https://www.dol.gov/sites/dolgov/files/ETA/advisories/UIPL/2010/UIPL24-04c4acc.pdf)

                                                        CLASSIFICATION
                                                        UI
   EMPLOYMENT AND TRAINING ADMINISTRATION
               ADVISORY SYSTEM                          CORRESPONDENCE SYMBOL
                                                        OUI/DPM
          U.S. DEPARTMENT OF LABOR
             Washington, D.C. 20210                     DATE
                                                        February 16, 2010




ADVISORY:            UNEMPLOYMENT INSURANCE PROGRAM LETTER NO. 24-04,
                     Change 4

TO:                  STATE WORKFORCE AGENCIES

FROM:                JANE OATES /s/
                     Assistant Secretary

SUBJECT:             Unemployment Insurance (UI) Information Technology (IT) Security –
                     Additional Information

1. Purpose. To provide State Workforce Agencies (SWAs) with additional information on the
   National Institute of Standards and Technology (NIST) IT security guidelines.

2. References. Unemployment Insurance Program Letter (UIPL) 24-04, UIPL 24-04 Change 1,
   UIPL 24-04 Change 2, UIPL 24-04 Change 3, ET Handbook No. 336, 18th Edition, the
   Unemployment Insurance State Quality Service Plan (SQSP) and Reporting Guidelines,
   Chapter 1, Section VI, C, Supplemental Budget Requests (SBRs) and Chapter 1, Section VII, J,
   Assurance of Automated Information System Security.

3. Background. Since fiscal year 2002, the Office of Inspector General (OIG) has conducted
   IT security audits to determine if the Employment and Training Administration (ETA)
   provides sufficient oversight of the SWAs' IT security for the UI program. UIPL 24-04,
   UIPL 24-04 Change 1, UIPL 24-04 Change 2, and UIPL 24-04 Change 3 provided the SWAs
   with IT security guidance via a CD, titled IT Security Information.

4. Additional Guidance. As an ongoing effort to provide security guidance to the SWAs, this
   UIPL is issued to provide a CD, which includes new and updated NIST Special Publications
   (SP). The following NIST publications are important for conducting security assessments of
   UI systems:

   •   Federal Information Processing Standards (FIPS) Publication 199 provides standards for
       categorizing information and information systems.
   •   FIPS Publication 200 and NIST SP 800-53 provide guidelines for selecting and
       specifying security controls that meet minimum security requirements for information
       systems.



 RESCISSIONS                                            EXPIRATION DATE
 None                                                   February 16, 2011

   •   NIST SP 800-53A provides a standard methodology for capturing the results of system-
       level security controls assessments by providing a form to comprehensively, consistently,
       and cost effectively show the results of a security controls assessment.

   The U.S. Department of Labor (USDOL) strongly encourages each SWA to conduct an IT
   security assessment in accordance with the NIST guidelines. The results of this security
   assessment can be used each year as a basis for providing the assurance referenced in
   Handbook 336, Chapter 1, Section VI, C. SBRs and Chapter 1, Section VII, J, Assurance of
   Automated Information System Security.

   SWAs can use the “UI IT Security” document provided on the CD as a reference while
   conducting the security assessment to find the specific law, regulation, or NIST SP to help
   answer their questions. The security assessment is based on criteria and guidance established
   by NIST and specified in the SPs. SWAs can conduct a security assessment of their UI
   systems to verify that security controls conform to the different laws, regulations, and the
   guidance established by NIST.

5. Action Requested. SWAs are encouraged to:

   •   Review the NIST IT security documents and guidelines; and
   •   Use FIPS 199 to categorize the information system, FIPS 200/NIST SP 800-53 for the
       specification of security controls, and NIST SP 800-53A for the assessment of security
       control effectiveness.

6. Inquiries. Direct questions to the appropriate Regional Office or in the National Office to
   Paul Bankes at 202-693-3053 or [email protected] or Jagruti Patel at 202-693-3059 or
   [email protected].

7. Separate Cover. A CD titled IT Security Information – Version 5 will be sent under
   separate cover.