Enterprise Website Supporting Tool

The purpose of the Enterprise Website Support Tools (EWST) is to offer shared services to the Centers for Medicare and Medicaid (CMS) applications. EWST includes GitHub Enterprise Server; Jira Data Center; Confluence Data Center; Slack, MiniOrange and SonarQube. The EWST application is hosted in the CMS private cloud located in the Amazon Web Services (AWS) data center in the AWS East region (North Virginia). EWST depends upon AWS Infrastructure as a Service (IaaS) for its physical infrastructure and cloud components. On top of this, the CMS Office of Communication (OC) AWS Cloud Team provides AWS platform level management including providing security controls at the operating systems and Virtual Private Cloud (VPC) level.

EWST offers shared services that are available over the public internet, but only from white listed IP addresses. Akamai acts as the webhost proxy system, providing a Domain Name System (DNS) and a web application firewall. EWST, inside of Amazon Web Services (AWS), connects to the Akamai proxy through the public internet, but both sides white list each other and require public key infrastructure (PKI) certificates signed by VeriSign and validating the certificates with the Symantec Certificate Authority (CA).

EWST collects login credentials passed through Enterprise User Administration (EUA), for both Centers for Medicaid and Medicare (CMS) employees and contractor support which consists of login user ID and password.  

Akamai and Amazon Web Services (AWS) also collect within EWST (Jira) user ID, full name, email address, and mobile phone number for users, along with name and user ID of CMS approvers. This information is required to create user accounts within the Akamai Control Center (ACC) and to create within AWS administrative accounts for testing. AWS also collects the full name, phone number and email address of each key point of contacts for operational reasons.

Akamai, AWS and EUA have their own PIA that can be referenced for further information.

EWST subsystems pass login credentials from their applications to Enterprise User Administration (EUA) for identification and authentication. Akamai and Amazon Web Services (AWS) also collect within EWST (Jira) user ID, full name, email address, and mobile phone number for users, along with name and user ID of CMS approvers. This information is required to create user accounts within the Akamai Luna administration panel, and to create AWS administrative accounts for testing. Public Website Shared Services (PWSS) collects within EWST (Jira), the user’s full name, email address, organization name, and Short Message Service (SMS) phone number to issue GEO Application Programming Interface (API) encryption keys.  AWS also collects the full name, phone number and email address of each Key Point of Contact for operational reasons.  

Physical Security System personnel who access or use the system do not use any personal identifiers to retrieve records held in the system. This system does not retrieve records using Personal identifiable information (PII) on individuals, but instead obtains those credentials from Enterprise User Administration (EUA) and maintains them.

• Name
• E-Mail Address
• Phone Numbers
• Other - Login credentials- user ID and password; Organization Name.

• Employees
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors

• In-person
• Online

• Within the OPDIV
• State/Local/Tribal

All Tools are fronted by MiniOrange Identity Provider (IDP) and the IDP login page featuring a warning notice and the PII is collected by other CMS applications, which have other notifications in place such as AWS, Akamai and PWSS.

To maintain the integrity, availability, accuracy, and relevancy of the PII stored within the databases, regular synchronization between EUA, Lightweight Directory Access Protocol (LDAP) and EWST systems occurs daily.   

Under this process, outdated, unnecessary, irrelevant, and inaccurate PII is identified and deleted from EWST.  The PII is available as needed and is sufficient (minimum required) for the purposes needed. The PII fields are locked and cannot be changed; The process to ensure that individuals who provide or modify PII cannot be repudiated since that action is done within the source EUA system. Users can request that their PII (access) be deleted, by contacting their CMS Access Administrator (CAA), who in turn would take the corresponding action via EUA.  Data integrity is checked by the user when providing the information for user registration or by the system administrator when issuing accounts in Akamai Luna and AWS or when API keys are issued and distributed for PWSS.

• Users: Users require access to EWST to request test accounts, and to assist with configuration management of code and documentation.
• Administrators: Administrators require access to operate and maintain the system. They also have the ability to create, delete and modify user accounts.
• Contractors: Direct contractors as users require access to EWST to request test accounts and to assist with configuration management of the code as well as documentation.

The retention and destruction of EWST data is governed by the CMS Records Schedule. This schedule is aligned with the National Archives and Records Administration (NARA) guidelines for data retention and destruction.  The following CMS Records Schedule Items apply:

CMS Records Schedule / Records and Information Management Policy

Enrollment Records
Disposition Authority Number: DAA-0440-2015-0006-0001
Cutoff Instruction: Cutoff at the end of the calendar year.
Retention Period: Destroy no sooner than 7 year(s) after cutoff but longer retention is authorized.

Beneficiary Records
Disposition Authority Number: DAA-0440-2015-0007-0001
Cutoff Instruction: Cutoff at the end of the calendar year.
Retention Period: Destroy no sooner than 10 year(s) after cutoff but longer retention is authorized.

Provider and Health Plan Records
Disposition Authority Number: DAA-0440-2015-0008-0001
Retention Period: Destroy no sooner than 7 year(s) after cutoff but longer retention is authorized.

Analytic and Research Files (restricted) Disposition Authority Number DAA-0440-2015-0009-0002
Transfer to the National Archives for Accessioning: 20 year(s) after cutoff. 

Research and Program Analysis: Supporting Records
Disposition Authority Number: DAA-0440-2015-0009-0003
Cutoff Instruction: Cutoff at the end of the calendar year.
Retention Period: Destroy 10 year(s) after cutoff or when no longer needed for agency business, whichever is later.

In addition, the EWST application follows the Data Destruction Standards prescribed in NIST Special Publication (SP) 800-88.

The EWST system is located in a Tier-1 network data center (Amazon Web Services) which provides premier physical control protections. Physical controls are in place such as security guards ensure that access to the buildings is granted to authorize individuals. Identification of personnel is checked at the data center. The EWST system is built using industry best practices and independently reviewed against Federal Information Security Management Act (FISMA) and National Institute of Science and Technology (NIST) Security and Privacy controls to ensure technical, operational, and management controls are properly applied. Personally Identifiable Information (PII) on the EWST system is secured administratively by ensuring that the system goes through the Assessment and Authorization (A&A) process, and all documentation is submitted to the Information Security & Privacy Group (ISPG) that supports the system and comply with Federal Information Security Management Act (FISMA) regulations. The system is currently hosted at the Amazon Web Services (AWS) data center. The user identity data is stored in the centralized Lightweight Directory Access Protocol (LDAP) store managed by EUA. EWST sends user Identity information to EUA for user authentication and users are required to authenticate to establish their identity and role as an individual or system interacting with the target system.

EWST applies the principle of least privilege as well as a role based view on granting rights. All access for the groups is requested and approved before being granted. All Production access requires Manager Approval. Each user is assigned a role and each role's rights are restricted to only the data and server resources needed to perform their job. Access requests are tracked via service request tickets. For planning, approving, and auditing, EWST utilizes a Roles and Responsibilities matrix to review and track what resources are accessible at the application level as well as the server level.

A monthly audit is performed for system accounts and quarterly user driven validation of accounts is required. New EWST team members are processed through an on boarding process that defines their role and all information and approvals are archived in a service request.