Technical Specifications and Systems Security.
1. The Requesting Party will not have direct access to SSA’s databases. The verification requests must be encrypted using either the Advanced Encryption Standard (AES) or triple DES (DES3) encryption methods to secure the data in transport to SSA. SSA will use the same method of encryption when returning data to the Requesting Party. To accomplish the transmission of data, the parties will use TLS protocol (TLS 1.0).
2. The Requesting Party must obtain, at its own expense, the hardware, software, or other equipment that may be necessary to establish connection to CBSV either through the BSO website or the web service. The Requesting Party must obtain, at its own expense, Internet service in order to access the CBSV portion of the BSO website. The Requesting Party must provide SSA with a valid e-mail address for communications via e-mail.
3. The Requesting Party may use more than one method of CBSV services (online and web service) at the same time. If the Requesting Party chooses to use both online and web service, it must assign two different Authorized Users, due to the unique registration needs of CBSV Web Service. The Requesting Party is only responsible for the one-time enrollment fee ($5000) and one annual advance payment for estimated transactions, regardless of the number of methods of services it uses.
4. The Requesting Party must bear all costs it incurs for site preparation, connection, operating costs, and any other miscellaneous costs to participate in CBSV. SSA reserves the right to conduct on-site visits to review the Requesting Party’s documentation and in- house procedures for protection of and security arrangements for confidential information and adherence to terms of this User Agreement.
5. SSA’s User Guide is available online at xxxx://xxx.xxx.xxx/cbsv/docs/, which SSA may amend at its discretion. The detailed requirements and procedures for using CBSV are set forth in the User Guide.
6. If the Requesting Party and its Principals access CBSV through the web service platform client application, the Requesting Party must maintain an automated audit trail record identifying either the individual Authorized User or the system process that initiated a request for information from SSA. Every request for information must be traceable to the individual Authorized User or the system process that initiated the transaction. At a minimum, individual audit trail records must contain the data needed to associate each request to its initiator and t...
Technical Specifications and Systems Security. 1. The Permitted Entity may use a real-time service or batch functionality, when available. All fees charged by SSA to the Permitted Entity will be applied regardless of the methods of service it uses.
2. Detailed technical requirements and procedures for using the eCBSV system are set forth on SSA’s internet website at: xxxxx://xxx.xxx.xxx/dataexchange/eCBSV/, which SSA may amend at its discretion.
3. If the Permitted Entity accesses the eCBSV system through the real-time platform client application, the Permitted Entity must maintain an automated audit trail record for five (5) years identifying either the Authorized User or the system process that initiated a request for information from SSA. Every SSN Verification request must be traceable to the Authorized User or the system process that initiated the transaction. The Permitted Entity shall process all SSN Verifications and Written Consents in a manner that will protect the confidentiality of the records and prevent the unauthorized use of the SSN Verifications and Consent Forms.
4. The Permitted Entity should integrate with SSA’s entity services using identity federation. Identity federation requires the Permitted Entity to:
a. Identity proof Authorized Users in a manner that meets National Institute of Standards and Technology (NIST) Special Publications (SP) 800-63-3 Identity Assurance Level (IAL) 2, require that authentication meets NIST SP 800-63-3 Authenticator Assurance Level (AAL) 2, and enable single sign-on for individuals that will use federation to access SSA web applications.
b. Follow the session management guidelines for AAL2, found in NIST SP 800-63-3 B, Chapter 7 - xxxxx://xxxxx.xxxx.xxx/800-63-3/sp800-63b.html#sec7.
c. Ensure controls are in place to properly set attributes that allow Authorized Users access to the eCBSV service.
d. Recertify attributes that allow Authorized Users access to SSA web sites every 90 days.
e. Ensure private keys are protected to prevent unauthorized access as outlined in NIST SP 800-57, “Recommendation for Key Management.”
