5.x |
Approved w/Constraints [6, 8, 10] |
Approved w/Constraints [6, 8, 10] |
Approved w/Constraints [6, 8, 10] |
Approved w/Constraints [6, 8, 10] |
Authorized w/ Constraints [6, 10, 11, 12] |
Approved w/Constraints [6, 10, 11, 12] |
Approved w/Constraints [6, 10, 11, 12] |
Approved w/Constraints [6, 10, 11, 12] |
Authorized w/ Constraints [6, 10, 11, 12] |
Authorized w/ Constraints [6, 10, 11, 12] |
Authorized w/ Constraints [6, 10, 11, 12] |
Authorized w/ Constraints [6, 10, 11, 12] |
| | [1] | This Technology is currently being evaluated, reviewed, and tested in controlled environments. Use of this technology is strictly controlled and not available for use within the general population. | | [2] | Veterans Affairs (VA) users must ensure VA sensitive data is protected properly in accordance with VA Handbook 6500 and the Federal Information Security Management Act (FISMA). Per VA Handbook 6500, FIPS 140-2 certified encryption must be used to protect and encrypt data in transit and at rest if Personally Identifiable Information/Protected Health Information/VA (PII/PHI/VA) sensitive information is involved.
If FIPS 140-2 certified encryption in not used, additional mitigating controls must be documented in an
approved System Security Plan (SSP). In addition, the technology must be implemented within the VA
production network (not in a Demilitarized Zone (DMZ)) unless the specific uses and instances of the technology are authorized by the Enterprise Security Change Control Board (ESCCB). In these cases,
Memorandum of Understanding and Interconnection Security Agreements (MOU/ISA), which detail the security requirements for users and systems that share information and resources outside of the VA production network must be included. | | [3] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | [4] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | [5] | Users must ensure that Microsoft Internet Information Services (IIS) and Microsoft Internet Explorer are implemented with VA-authorized baselines. (refer to the ‘Category’ tab under ‘Runtime Dependencies’) | | [6] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | [7] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISO (Information Security Officer) to ensure compliance with VA Handbook 6500. | | [8] | Users must ensure that Microsoft .NET Framework, Google Chrome, Firefox, and Microsoft Internet Information Services (IIS) are implemented with VA-authorized baselines. (Refer to the ‘Category’ tab under ‘Runtime Dependencies’)
| | [9] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with VA Handbook 6500. | | [10] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | [11] | Users must ensure that Microsoft Edge, Google Chrome, Firefox, and Microsoft Internet Information Services (IIS) are implemented with VA-authorized baselines. (Refer to the ‘Category’ tab under ‘Runtime Dependencies’) | | [12] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. |
|