Section |
HCQIS Security Awareness Training (SAT) & Certification Administration InstructionsHHS and CMS in accordance to Federal Information Security Management Act (FISMA) of 2002 and other policies requires that all Federal CMS and Contractor users of Federal Information Systems to be exposed to security and privacy awareness training materials at least annually. This is to inform federal employees, contractors and other users of information systems that support the operations and assets of the agency, of:- Information Security risks associated with technologies and their activities while utilizing those technologies.
- Responsibilities in complying with agency policies and procedures designed to reduce risks.
- Overview of protecting Personally Identifying Information (PII) or Personal Health Information (PHI) of any individual as directed in the Privacy Act of 1974.
- Records Management and Retention.
During onboarding and before access to any HCQIS system or application each user must complete proper training requirements on an annual basis and must provide evidence of completion to his/her respective Security Point of Contact (SPOC) who will track all required training within the organization
Column |
---|
| Awareness & Training |
|
. Background Color |
---|
|
section4 | Column |
---|
Image Removed65
Section |
---|
Column |
---|
| IntroductionDuring onboarding, and before |
|
access to HCQIS QualitNet system or application, each user must |
|
complete proper training requirements on an annual basis and must sign Rules of Behavior, complete the appropriate training, and provide evidence of training completion to |
|
his/her respective their Security Point of Contact (SPOC) |
|
who ; the SPOC will track all required training within |
|
the Note: most many cases, an annual attestation is also provided to the organization’s CMS Contracting Officer’s Representative (COR) as a deliverable. |
|
Contact your COR for specific contract deliverables and dates. If you have questions about policy or need more information regarding contract requirements, please contact your COR. |
|
Security Awareness TrainingThe HCQIS system utilizes the DoD Cyber Exchange (h ttps://public.cyber.mil/cyber-training/)
HTML |
---|
<hr style="border: 1px dashed #1e3d59;" /> |
Background Color |
---|
|
Section |
---|
Column |
---|
| Image Added
|
|
Section |
---|
Column |
---|
|
Security Awareness Training (SAT) - The QualityNet program utilizes the DoD Cyber Exchange |
|
|
, a publicly accessible training library with course offerings, to allow |
|
|
Contractors contractors to meet part of the CMS SAT requirements. |
|
|
These trainings include the C yber Awareness Challenge and SAT Training is broken into two (2) separate trainings: |
|
|
Identifying and Safeguarding Personable Privacy Training.The Department of Health and Human Services (HHS) Records Management training Training - Additional to Security Awareness training, the HHS Records Management Training is a mandatory |
|
|
training and is and the Office of Management and Budget (OMB) |
|
|
and /National Archives and Records Administration (NARA) joint Directive |
|
|
M-19-21, Transition to Electronic Records. |
|
|
The purpose of this The records management training is to provide an overview of |
|
|
employee user responsibilities for records |
|
|
management employees users tell the difference between records and non-records, and assist |
|
|
employees in them in learning how to manage the federal records lifecycle. Note: |
|
|
The HHS Office of Human Capital manages |
|
|
Records Management records management training and requirements for CMS. Therefore, |
|
|
separate or updated instructions may be |
|
|
sent which updates to links requirements or content and should be used as underlining guidance outside of these instructionscontent or links. Please check with your COR |
|
|
on these requirements. Column |
Below are the links to the websites where the three required trainings are hosted. DoD provides the links for the security trainings and are subject to change at any time. If a link is broken, you may also do a web search for the name of the training and use the appropriate search result since they are publicly available.
HTML |
---|
<hr style="border: 1px dashed #1e3d59;" /> |
Section |
---|
Anchor |
---|
| User Instructions |
---|
| User Instructions |
---|
|
Section |
---|
Column |
---|
| Image Added
|
|
|
|
Step 1 - Complete the required online training by selecting the corresponding modules listed below. |
|
|
252525Step 2 - Enter your name in the Certification of Completion’s online display, which is provided at the successful conclusion of the training. Step 3 - Take a screen capture (shot) or save a copy of the certificate locally then provide a copy of your completed certification to your organization’s assigned Security Point of Contact (SPOC) who will maintain a copy for record retention.
Recently transitioned from a previous contract?New users take training during onboarding and before initial access then annually thereafter. Some contracts and organizations require all users to complete training by a specific time each year. There also may be times where a user has transferred from another contract and has taken required training. Therefore, if a user has started or transferred from a previous QualityNet contract and has taken all required trainings within the last 90 days, that user is except from taking any training again until the following calendar year or deliverable period; whichever schedule is followed. Please contact your COR for any questions regarding requirements.
Back to Top
|
|
|
HTML |
---|
<hr style="border: 1px dashed #1e3d59;" /> |
Anchor |
---|
| Certification |
---|
| Certification |
---|
|
Image Removed |
Image Added
|
|
|
40section4 | Column |
---|
|
The SPOC should adhere to the following guidelines related to certification and attestation of training results: - Only one
|
|
|
Only (1) - memo is required for all sites under each prime contract region/area/site.
- The Certification Memo must be signed
|
|
|
by the Security Point of Contact (SPOC)/ Security Officer (SO) and the organization's - (digitally if preferred) by any designated SPOC and the organization’s designated Program Lead.
- You may apply a naming convention that best suits your organization, Contract or deliverable
|
|
|
. Some examples of the document format names are listed below:- Naming format for BFCC: "BFCC-QIO-(Contract Name)_SAT_20xx.pdf"
- Naming format for QIN: "QIN-QIO-(Contract Name)_SAT_20xx.pdf"
- Other Organizations: "(Org/Contract Name)_SAT_20xx.pdf"
You may also have multiple sites that need to be tracked separately. "Site Identification" located at the top of the Certification Memo will help (if applicable):- Region/Area/Network ID; this will vary between contract type/organization.
- "BFCC-QIO Region 1"
- "QIN-QIO Area-G"
- , but that is easy to understand by other readers.
|
|
|
- Submit the completed certification memo electronically to
|
|
|
your - you’re COR using the specified vehicle outlined in the contract
|
|
|
(email, CDS, DARRT, etc.) - as directed by the CMS COR
|
|
|
(if applicable). Column |
---|
|
Column |
---|
Image Removed
|
HTML |
---|
<hr style="border: 1px dashed #1e3d59;" /> |
Column |
---|
width | 40 Background Color |
---|
|
Section |
---|
Section |
---|
Newly on-boarded HCQIS Services users who have taken all three training modules within the last 90 days of the organization's certification period are EXEMPT from taking SAT training for the current annual certification period. This group of users will take security awareness training as normal during the following annual certification period.
Note: Any deviations from either training module will require the user to take any missed training during the current certification period. | Image Added
|
|
4 Column |
---|
Image Removed40 | Section |
section4 Column |
SAT Records are not required for submission unless
Records must be updated and maintained at all times, but they are only to be submitted to CMS if requested by the COR or the Information Systems Security Officer (ISSO |
|
. SAT Records must always be updated and maintained. (SAT record ). Record templates are available within |
|
HCQIS Resources on QNP by the /ISSO acting under operating across multiple sites (prime/sub) may exercise the option of having multiple |
|
SAT SAT ALL all individual sites and each user |
|
respectfullyrespectively. At the top of each page insert the Contract name and specify the site if applicable. |
|
For multiple sites in a single area, you may use a different table that identifies each |
|
state
HTML |
---|
<hr style="border: 1px dashed #1e3d59;" /> |