CMS Microsoft Azure Government Enclave

CMS MAG GSS will collect, maintain/store PII (user first and last name, cellphone number and email address) to grant the users access to the Azure Portal component ONLY which will be operated and maintained by a small user group. 

For all other users, CMS MAG GSS will not collect, maintain (store), or share user credential PII directly. The CMS Enterprise User Administration (EUA) system will be used to manage enterprise User IDs and passwords.

The CMS MAG GSS will provide the infrastructure to host CMS Major Applications. The CMS MAG GSS does not directly collect, maintain, or disseminate information, but rather provides cloud support infrastructure for other CMS Major Applications to perform these functions. 

This PIA only considers the CMS MAG GSS. Separate PIAs will need to be evaluated for each Major Application to be hosted by the CMS MAG GSS. The CMS MAG GSS will collect, maintain/store PII (user first and last name, cellphone number and email address) to grant the users access to the Azure Portal component ONLY.

CMS MAG GSS Applications/Services List:

• Microsoft Azure Government FedRAMP High Approved Services
• Splunk SIEM
• Trend Micro Antivirus
• Tenable Vulnerability Scanning
• InfoBlox DNS
• LDAP Proxy Services
• Active Directory Services
• VM Gold Images

• Name
• E-Mail Address
• Phone Numbers

• Employees
• Vendors/Suppliers/Contractors

• 5 USC Section 301, Departmental Regulations

• In-person
• Online
• Other - Personal Identity Verification (PIV) cards

• Within the OPDIV

• Other - Not Applicable.

• Administrators: Administrators access user credential PII to create, monitor and modify account/user credential PII if necessary. Activities of administrators are logged and reviewed by the System Information System Security Officer (ISSO) to identify abnormal activities if any.
• Contractors: CMS Direct Contractors are Administrators, they access user credential PII to create, monitor and modify PII if necessary. Activities of administrators are logged and reviewed by the System Information System Security Officer (ISSO) to identify abnormal activities if any.

Administrative Controls: SecOps employs administrative controls to secure user credential PII with written policies, procedures and guidelines. The CMS MAG is located at a secure facility. 

Physical Controls: Physical controls are in place such as security guards and video monitoring to ensure access to the facility is granted to only authorized individuals. Identification of personnel is checked at the facility and prior approval must be obtained. 

Technical Controls: System administrators are vetted prior to hiring and required to receive annual Security and Privacy awareness training in addition to role-based access and permissions, and periodic review of users and deletion of non-active accounts. The principle of least privilege ensures that system administrators are granted access on a "need-to-know" and "need-to-access" commensurate with their assigned duties. The information is protected using Access Control Lists (ACLs) defined for allowing only administrator access to the user credential PII. This access is further protected by the system controls which enforce two-factor authentication (i.e. Personal Identification Verification (PIV) cards) required to access the system. 

Furthermore, the technical controls for the CMS MAG include but are not limited to firewalls, system information and event management software (SIEM), intrusion detection/prevention systems (IDS/IPS), antivirus management systems, vulnerability management systems, control compliance systems, and access log management.  The information is maintained in an encrypted manner.  Access is provided based on an approved request by the Information System Security Officer (ISSO). Lastly, audit logs are reviewed for suspicious activity by the ISSO on regularly basis.