The Compliance Review Program and Process. ⮉ Similar to the certification process, the compliance review program entails a rigorous process intended to ensure that EIEPs who receive electronic information from SSA are in full compliance with the Agency’s security requirements and standards. As a practice, SSA attempts to conduct compliance reviews following a two to five year periodic review schedule. However, as circumstances warrant, a review may take place at any time. Three prominent examples that would trigger an ad hoc review are: • a significant change in the outside EIEP’s computing platform • a violation of any of SSA’s systems security requirements • an unauthorized disclosure of SSA information by the EIEP The following is a high-level flow chart of the OIS Compliance Review Process: ⮉ Make risked-based selection of target Monitor findings Finalize review documentation Conduct compliance review Set review date Gather background information Determine method of review SSA may conduct onsite compliance reviews and include both the EIEP’s main facility and a field office. SSA may, also at its discretion, request that the EIEP participate in an onsite compliance review of their security infrastructure to confirm the implementation of SSA’s security requirements. The onsite review may address any or all of SSA’s security requirements and include, where appropriate: • a demonstration of the EIEP’s implementation of each requirement • random sampling of audit records and transactions submitted to SSA • a walkthrough of the EIEP’s data center to observe and document physical security safeguards • a demonstration of the EIEP’s implementation of online exchange of data with SSA • discussions with managers/supervisors • examination of management control procedures and reports (e.g. anomaly detection reports, etc.) • demonstration of technical tools pertaining to user access control and, if appropriate, browsing prevention: o If the design uses a permission module or similar design, or is transaction driven, the EIEP will demonstrate how the system triggers requests for information from SSA. o If the design uses a permission module, the EIEP will demonstrate the process used to request SSA-provided information and prevent the EIEP’s system from processing SSNs not present in the EIEP’s system. We can accomplish this by attempting to obtain information from SSA using at least one, randomly created, fictitious number not known to the EIEP’s system. SSA may, at its discretion, perform an onsite or remot...
The Compliance Review Program and Process
