Clarifying Metadata in Legacy Rev. 5 Systems

[controlled-chaos916]

I'm working to reconcile MAS-CSO-MDI & MAS-CSO-IIR for my Rev.5/CR26 environment. Can you clarify a few things for me?

1. Everything included in the minimum assessment scope is subject to the rest of Rev.5/CR26?
2. Is metadata such as IPs, URLs, server names okay to exist in a corporate (read: outside MAS) system? If yes or no, can you give rationale and/or examples of potential use cases you considered?

Thanks so much!

[pete-gov]

Everything included in the minimum assessment scope is subject to the rest of Rev.5/CR26?

Yes, that's right.

Is metadata such as IPs, URLs, server names okay to exist in a corporate (read: outside MAS) system? If yes or no, can you give rationale and/or examples of potential use cases you considered?

MAS-CSO-MDI (Metadata Inclusion) gives you the path to make this determination - we can't say definitively in each particular environment because it will vary from architecture to architecture.

In general though, things like IP addresses, URLs, and server names are not very likely to potentially impact the confidentiality, integrity, or availability of federal customer data if they are managed responsibly, and would not be inside the MAS. Those things are typically not private and their use transits the public internet, and if you were to get a hold of an IP address or host name it shouldn't generally matter. So what if you know something is called database-useast1?

On the other hand, if your server names are something like cia-secret-project-mkultraand contain actual federal customer data or something (in this fictional example, the name of a secret project that no one would want out there), then they'd definitely be in the MAS. A list of allow-list IPs for a special recovery process might be potentially sensitive if it allows bypassing certain controls. Etc.

Again, if things are configured and designed responsibly, then metadata shouldn't put federal customer data at risk though.