2.x |
Unapproved |
Unapproved |
Unapproved |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
3.x |
Unapproved |
Unapproved |
Unapproved |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
4.x |
Approved w/Constraints [4, 6, 8, 9, 11] |
Approved w/Constraints [4, 6, 8, 9, 11] |
Approved w/Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
Authorized w/ Constraints [4, 11, 12, 13] |
| | [4] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | [6] | Users must ensure that Microsoft Internet Explorer, Google Chrome, and Firefox are implemented with VA-authorized baselines.
Users must Divest the use of Microsoft Internet Explorer with this technology. Other authorized internet browsers are available. See Category Tab for details. | | [8] | If this technology is an FDA certified medical device or is categorized by the Department as a networked medical device then it must be isolated and protected in accordance with The Medical Device Isolation Architecture (MDIA) 2015 Guidance. This guideline stipulates that if the device meets ANY of the following criteria, then it must be isolated:
- If the device cannot have the VA standard desktop security suite loaded on it. This includes but is not limited to Anti-Virus, HIPS, USB Access controls, software/hardware inventory, automated software updates/patches and Group Policy Objects (GPOs)
- If the device is a Windows device and cannot be part of the domain
- If the device is not part of the regular IT patched management process
- Non Windows devices (UNIX, Linux, MAC/Apple, etc.)
The criteria should be applied to both FDA certified and non-FDA certified devices which must maintain medical/clinical functionality. An example would be a PC that is not running the current supported operating system in order to manage medication-dispensing devices. While these may not be considered strictly medical devices, they are still vulnerable to attack and need to be protected. For guidance and assistance in security networked medical devices, please contact the Medical Device Isolation Architecture (MDIA) Working Group. | | [9] | This technology has received one or more VA security bulletins that provide specific guidance on vulnerability patching and mitigation. It is the responsibility of VA system owners to ensure that the appropriate mitigations are taken to address all known and future discovered vulnerabilities with this product. See the Reference tab for more information on security bulletins related to this product. | | [11] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | [12] | Users must ensure that Google Chrome and Firefox are implemented with VA-authorized baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Users must utilize authorized internet browsers, as Microsoft Internet Explorer has reached End of Life status. See Category Tab for details. | | [13] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. |
|