Continuously Available CMS Hosting Environment

• PIA Validation (PIA Refresh/Annual Review)

Software Deployments: 

1. IBM Products: IBM Z Automation, IBM CL Supersession, IBM DevOps Deploy, replaced CA Broadcom software.
2. Entuity, a replacement for the SolarWinds software.
3. Device42 software collects system hardware and virtual machine (VM) information. 
4. PDS software simplifies dealing with the contents of Partitioned Data Sets (PDS). 
5. Apache Maven- DevOps automation.

Hardware Deployments: 

1. Replaced Cisco switches with Arista switches in Central office), Local offices and regional office CMS offices
2. Cohesity data protection replaced Actifio solution.
   Cisco Firepower Cluster was also deployed, and it is a high-availability Next Generation Firewall (NGFW) deployment (e.g., Firepower 42xx series) positioned at the data center edge.

Expansion of DRaaS-CACHE ATO Boundary: 

1. Systems pulled under ATO boundary: Central and Remote location equipment, Baltimore Data Center (BDC) legacy infrastructure/shared systems and Companion Data Services (CDS) Virtual Data Center (VDC) legacy management systems (CDS VDC retired as of 8-10-26), "CMS Digital Multimedia Services (DMS high-capacity multimedia storage systems and Oracle Cloud@Customer infrastructure located in Ashburn, VA and Phoenix, AZ.
2. In addition, a new data center site managed by Iron Mountain located in Phoenix, AZ. 

Change in Internet Service: CMS moved from Trusted Internet Connection (TIC) 1 technology to TIC 3 technology which called for a high-availability cluster of Zscaler (ZIA) Private Service Edges (PSE). 

Employee and contractor credentials to include first name, last name, work physical street address, work phone number, work email address, User ID, user's hashed password are collected. The PII (user first and last name, cell phone number and email address) is collected and maintained to grant user’s access to the system. This information is collected to associate the username and password with an individual. The username and password are created and distributed by the system administrator to the individual user.

This PII is retained only if the individual has authorized access to the DRaaS-CACHE environment and/or systems. Once a user's access is no longer authorized, it is removed from the environment.

Continuously Available CMS Hosting Environment (DRaaS-CACHE) is the physical data center space, infrastructure components and enterprise services available for CMS systems and applications hosted in the DRaaS-CACHE General Support System.  There are three geographically disperse locations of DRaaS-CACHE, Ashburn, VA, Phoenix, AZ and Kent, WA. These three locations act as disaster recovery sites for the others.

DRaaS-CACHE does not directly collect, maintain, or disseminate information, but rather provides support infrastructure for other CMS applications to perform these functions. 

The description of PII collected for employees and contractors includes first name, last name, work physical street address, work phone number, work email address, User ID, user's hashed password. The PII (user first and last name, cell phone number and email address) is collected and maintained to grant user’s access to the system.

This PII is obtained through Lightweight Directory Access Protocol (LDAP) which is linked with Enterprise User Administration (EUA). The attributes are obtained from the EUA system.

The PII collected is necessary to manage authorized user credentials for access to the DRaaS-CACHE environment and these credentials are not shared with any other systems.
The first name, last name, work physical street address, work phone number, work email address, are obtained from the EUA system to identify/link a person with each User ID created to access the DRaaS-CACHE environment.  This data is also used to contact each user in relation to their access to provide user ids and passwords. 

• Name
• E-Mail Address
• Phone Numbers
• Other - Work physical street address, and user credentials - User ID and Password. The DRaaS-CACHE LDAP system is linked with EUA which is where the LDAP system retrieves the user attributes. The EUA system manages the PII attributes.

• Employees
• Vendors/Suppliers/Contractors

• In-person
• Online

• Within the OPDIV

• Other - Individual access request from CMS, CMS contractors and CMS subcontractors

To maintain the integrity, availability, accuracy, and relevancy of the PII, System Administrators review user accounts annually. Any anomalies are addressed and resolved by contacting the user, and modifying their user data, or by removing their access if no longer required. Under this process, outdated, unnecessary, irrelevant, and inaccurate PII is identified and deleted. The PII is available as needed and is sufficient (minimum required) for the purposes needed. Only system administrators can create or modify PII.

Activities of all users including system administrators are logged and reviewed by System Information System Security Officer (ISSO) to identify abnormal activities if any.

• Administrators: Administrators require access to PII to maintain the system.

Physical: DRaaS-CACHE is located at a secured facility. Physical controls are in place such as security guards to ensure access to the buildings is granted to only authorize individuals. Identification of personnel is checked at the facility. 

Administrative: The principle of least privilege is used as well as a role-based access control to ensure system administrators are granted access on a "need-to-know" and "need-to-access” commensurate with their assigned duties. The information is protected using Access Control Lists (ACLs) defined for allowing only administrator access to the PII.

Technical: This access is further protected by the system controls which enforce two-factor authentication into the Amazon Web Service (AWS) system. Furthermore, the information is maintained in an encrypted manner by ensuring the databases are encrypted. Access is provided based on an approved request by the Information System Security Officer (ISSO). Lastly, audit logs are reviewed for suspicious activity by the ISSO on a regular basis.