(NASIS) Requirements Definition Document - Bureau of Indian ...

NASIS Requirements Definition Document (RDD)
Version 1.0
17 February 2006
• NASIS will undergo the DOI OMB Circular A-130, Appendix 3 certification and accreditation
process.
• NASIS will be subject to the annual security review required by OMB Circular A-130, Appendix
3. (http://www.whitehouse.gov/omb/circulars/a130/a130trans4.html)
• NASIS will comply with the requirements of the Privacy Act and the Family Educational Rights
Privacy Act (FERPA)
• NASIS will comply with the requirements of the Health Insurance Portability and Accountability
Act (HIPAA).
• NASIS will provide security controls as described in National Institute of Standards and
Technology (NIST) Standards Publication (SP) 800-26, Security Self-Assessment Guide for
Information Technology Systems.
• A contingency plan will exist, be updated annually, and be tested annually.
2.4.2 Identification and Authentication
Use of the system will be controlled through a log-on process requiring a user ID and a password. The
password parameters will be configurable, including length of password, use of alphabetic and numeric
characters, password re-use, password expiration, and account lockout due to failed log-on attempts.
NASIS will have a user-administered password reset capability.
Parental access to student data over the Web may use a simplified access capability if the student
identifying information is limited to a student ID number.
2.4.3 Audit Trail
The system will have the ability log events and transactions. Logging parameters will be customizable.
If NASIS is delivered by ASP, then BIA will have online access to audit facilities or be provided audit
log reports on a daily basis. The system shall record logon failures and successes.
2.4.4 Alerts
The system will generate alerts for selected significant events.
2.4.5 Network Perimeter Security
If NASIS is in an OIEP facility, the government will provide network perimeter security. If in an ASP
facility, the vendor will provide network perimeter security.
2.4.6 ASP Security
If NASIS is delivered via an ASP, the system and the supporting infrastructure will be subjected to
periodic tests by the government. The vendor will be required to provide certifications or test data
demonstrating its compliance with applicable Federal and State statutes.
12