CMS FISMA Controls Tracking System-Cloud

• PIA Validation (PIA Refresh/Annual Review)

The CFACTS-Cloud application stores sensitive information pertaining to specific systems. System security and privacy controls, data diagrams, security and privacy plans, agreements and documents are only visible to personnel within CMS' Enterprise User Administration (EUA) user authorized roles. EUA is covered by its own separate Privacy Impact Assessment (PIA). This documentation and information tracks Centers for Medicare and Medicaid Services' (CMS') Federal Information System Management Act (FISMA) systems and their application security deficiencies, Plan of Action & Milestones (POA&Ms), Corrective Action Plans (CAPs), and automates the Certification & Accreditation (C&A) process through the System Development Life Cycle (SDLC). This allows senior management to have a clear view of the security posture and also provides OMB with required quarterly and annual security posture updates.

Information collected on users is point of contact (POC) information including full name, desk and work cell phone numbers, email address, desk and office location. It is used in order to provide CMS system stakeholder contact information as well as user account creation.

• Name
• E-Mail Address
• Mailing Address
• Phone Numbers
• Other - Desk and office location.

• Employees
• Vendors/Suppliers/Contractors

• Online
• Email

• Within the OPDIV

• Other - PII collected from Contractor domains

No prior notice is given by CFACTS-Cloud, as the system user PII is collected by CMS' EUA which has its own separate PIA.

EUA has dedicated policies and processes for notifying and providing consent to individuals about collecting their data.

The PII that is collected is in a separate application, which is the EUA, therefore there is no ability to opt-out. EUA has dedicated policies and processes for notifying and providing consent to individuals about collecting their data.  EUA is covered by its own PIA.

If the user requires access to CFACTS-Cloud, they cannot 'opt-out' of providing their PII to EUA, as the user ID, name, phone number, email address, and desk/office location are the identifiers used to create the user within the application's security module.

There is no process in place to resolve an individual's concerns by the CFACTS-Cloud system as the PII within CFACTS-Cloud is provided by EUA.

Individual's concerns involving their PII (user credentials), are addressed by the Enterprise Administration User team (a function of the maintenance contractor, Leidos). The CMS IT service desk personnel will assist in rectifying any incorrect user identification information within EUA.

• Administrators: Administrators have access to alter the token whether it is password or OKTA token.
• Developers: Developers have access to PII for testing/altering the pin code for end users.

Physical: Physical controls such as the security of the physical server, which include such items as providing long term power supply, emergency lighting, and fire protection; Physical controls are in place such as security guards to ensure access to the buildings are granted to only authorize individuals. Identification of personnel is checked at the facility. 

Technical: CFACTS is built using industry best practices and independently reviewed against Federal Information Security Management Act (FISMA) and National Institute of Science and Technology (NIST) Security and Privacy controls to ensure technical, operational, and management controls are properly appliedTechnical controls are in place such as the Data Center manages remote access, equipment ordering/testing, and has responsibility for the EUA system (management of user accounts), which defines the privileges for each user of the information system(s); Office of the Chief Information Security Officer (OCISO) coordinates compliance with security controls and the artifacts that document compliance by each application; and General Support System (GSS) manages, among others, telecommunications, remote access, and transmission confidentiality. 

Administrative: As the physical and technological aspects are managed by other organizations within CMS, and as access to CFACTS is a function of Host on Demand (HOD) and EUA, the duties of the System Administrator are solely, that of administration. Administrative controls are at the application level, although CFACTS-Cloud has built-in internal controls to enforce role-based access to datasets and functions, it is the responsibility of the System Administrator to enforce the Segregation of Duties Policy to ensure that each role has limited responsibility (user roles are defined to only allow access to specific functions of the application. PII is secured on the system level, through compliance with the policies in place, developed to accomplish that task. This involves the annual submission, by the System Administrator, of a System Security Plan (SSP), Information Security Risk Assessment (IR RA), Contingency Plan (CP), completion of the Privacy Impact Assessment (PIA), and adherence to the Security Controls.