Additional IT security guidance for state unemployment systems

UIPL24-04-Change5-ACC.pdf (https://www.dol.gov/sites/dolgov/files/ETA/advisories/UIPL/2011/UIPL24-04-Change5-ACC.pdf)

                                                         CLASSIFICATION
      EMPLOYMENT AND TRAINING ADMINISTRATION             UI
                  ADVISORY SYSTEM                        CORRESPONDENCE SYMBOL
             U.S. DEPARTMENT OF LABOR
                                                         OUI/DPM
                                                         DATE
                Washington, D.C. 20210
                                                         February 18, 2011




ADVISORY:            UNEMPLOYMENT INSURANCE PROGRAM LETTER NO. 24-04,
                     Change 5

TO:                  STATE WORKFORCE AGENCIES

FROM:                JANE OATES /s/
                     Assistant Secretary

SUBJECT:             Unemployment Insurance (UI) Information Technology (IT) Security –
                     Additional Information

1. Purpose. To provide State Workforce Agencies (SWAs) with additional information on the
   National Institute of Standards and Technology (NIST) IT security guidelines.

2. References. Unemployment Insurance Program Letter (UIPL) 24-04, and Changes 1, 2, 3, and
   4, ET Handbook No. 336, 18th Edition, the Unemployment Insurance (UI) State Quality Service
   Plan (SQSP) Planning and Reporting Guidelines, Chapter 1, Section VI, C, Supplemental
   Budget Requests (SBRs) and Chapter 1, Section VII, J, Assurance of Automated Information
   System Security, Federal Information Processing Standards (FIPS) Publication 199, Standards
   for Security Considerations of Federal Information and Information Systems, FIPS Publication
   200, Minimum Security Requirements for Federal Information and Information Systems, NIST
   Special Publication (SP) 800-53, Recommended Security Controls for Federal Information
   Systems, and NIST SP 800-53A, Guide for Assessing the Security Controls in Federal
   Information Systems.

3. Background. Since fiscal year 2002, the Office of Inspector General has conducted IT
   security audits to determine if the Employment and Training Administration provides
   sufficient oversight of the SWAs' IT security for the UI program. UIPL 24-04, and Changes
   1, 2, 3, and 4 provided the SWAs with IT security guidance via a Compact Disk (CD), titled
   IT Security Information.

4. Additional Guidance. In an ongoing effort to provide security guidance to the SWAs, this
   UIPL is issued to explain the accompanying CD, which includes new and updated NIST SPs.
   The following NIST publications are important for conducting security assessments of UI
   systems:

          FIPS Publication 199 provides standards for categorizing information and
           information systems.

 RESCISSIONS                                            EXPIRATION DATE
 None                                                   February 18, 2012

          FIPS Publication 200 and NIST SP 800-53 provide guidelines for selecting and
           specifying security controls that meet minimum security requirements for information
           systems.
          NIST SP 800-53A provides a standard methodology for capturing the results of
           system-level security controls assessments by providing a form to comprehensively,
           consistently, and cost effectively show the results of a security controls assessment.

   The U.S. Department of Labor strongly encourages each SWA to conduct an IT security
   assessment in accordance with the NIST guidelines. The results of this security assessment
   can be used each year as a basis for providing the assurance referenced in Handbook 336,
   Chapter 1, Section VI, C, SBRs and Chapter 1, Section VII, J, Assurance of Automated
   Information System Security.

   SWAs can use the “UI IT Security” document provided on the CD as a reference while
   conducting the security assessment to find the specific law, regulation, or NIST SP to help
   answer their questions. The security assessment is based on criteria and guidance established
   by NIST and specified in the SPs. SWAs can conduct a security assessment of their UI
   systems to verify that security controls conform to the different laws, regulations, and the
   guidance established by NIST.

5. Action Requested. SWAs are asked to:

      Review the NIST IT security documents and guidelines; and
      Use FIPS 199 to categorize the information system, FIPS 200/NIST SP 800-53 for the
       specification of security controls, and NIST SP 800-53A for the assessment of security
       control effectiveness.

6. Inquiries. Direct questions to the appropriate Regional Office or in the National Office to
   Paul Bankes at 202-693-3053, [email protected]; or Jagruti Patel, 202-693-3059,
   [email protected].

7. Separate Cover. A CD titled IT Security Information – Version 6 will be sent separately.