Main Content Start

How the USPS Protects Supplier Data in the Cloud

Man and woman inspecting servers to illustrate cloud security tips
September 30, 2016

Your security comes first

At USPS® we take our cyber security responsibilities seriously. Protecting the data of our customers, partners, vendors and suppliers is paramount. To help keep this information secure and protected, we have implemented comprehensive cloud security policies and procedures for avoiding data breaches.

What You
Should Know

USPS has a wide range of cloud security policies in place to help keep your data protected.

What You
Can Do

Require your business’s cloud providers to provide assurance around their security policies.

The guiding principle behind our cloud security strategy is that our supplier information must be protected from unauthorized access, use, disclosure, disruption, modification or destruction to help ensure integrity, confidentiality, and availability.

$10—The cost to buy stolen cloud-based credentials.1

To that end, all of our cloud providers must:

  • Be FedRAMP-certified. (Any exceptions must be cleared the CIO)
  • Comply with FISMA Moderate and/or High Authorization and Accreditation security controls and processes
  • Comply with the current version of the Payment Card Industry Data Security Standard (PCI-DSS)
43% of all spear-phishing attacks in 2015 were targeted at small businesses.1

Our cloud procedures, protocols and policies

What follows is a high-level overview of the controls and procedures the USPS has in place for USPS staff, cloud provider staff, as well as the security requirements cloud-providers must meet in order to do business with the USPS:

Executive sign-off
Each cloud initiative must have a design document provided to the chief information security officer (CISO) that outlines key infrastructure domains, communication channels/ responsibilities, and data storage locations. Additionally, any cloud-provider staff that have access to USPS data must pass background checks and receive regular security training.

Information storage
USPS information may only be processed or stored within the United States or U.S. Territories.

Identity management
Cloud-based applications must be integrated into an identity-management framework in order to avoid separate management of user identities by the cloud provider. The USPS also requires cloud providers to provide the following:

  • Single sign-on (SSO) – Upon authentication users must be able to access all cloud services without further authentication
  • Strong authentication – Two-factor authentication techniques to support sensitive and critical applications

Security Audit Information
Security audit data must be maintained for every aspect of a cloud service and for use in the analysis of security incidents when they are discovered.

Encryption is required for all USPS data, both at rest and in transit, to meet security requirements.

Data Deletion
The cloud provider must return all USPS data and ensure that data including backups, logs, usage and audit data is irrevocably deleted from all of its systems at the termination of its contract.

Governance, risk and compliance

USPS requires cloud suppliers to adhere to the following policies on internal GRC activities:

  • USPS policies, procedures and standards used for application design, development, testing, implementation, use and monitoring must be extended to the cloud
  • Virtualization and other data and software isolation techniques must be documented and assessed to understand all potential risks to the USPS
  • An independent assessment must be conducted to verify that the cloud environment is secure
  • The risk management program must be adapted to the constantly evolving and shifting cloud risk landscape for the lifecycle of the system
  • The security state of the information system must be continuously monitored to support ongoing risk management decisions
  • Audit mechanisms and tools must be put in place to ensure USPS practices are followed throughout the system lifecycle
  • The cloud provider’s electronic discovery capabilities and processes must not compromise the privacy or security of USPS data and applications

Incident response

The cloud provider must have a transparent response process in place and sufficient mechanisms to share information during and after an incident or breach to ensure that the USPS can respond to incidents and breaches in a coordinated fashion.

The importance of due diligence:

Due diligence is not only reviewing the cloud provider’s marketing material or relying on their claims of secure operations. The USPS must be sufficiently assured that the cloud provider’s methods meet the USPS’s security and operational needs. Prior to engaging a cloud provider, the USPS must:

  • Confirm it has a history of sound work practices and ethical behavior
  • Verifying it is compatible with the USPS’s business image and risk profile
  • Identify potential risks or circumstances associated with the cloud provider that may impact USPS operations or business
  • Identifying elements of the service that need to be clarified, and that need to be included in contracts or service agreements

To protect your business

Because of the many inherent security issues, the onus is on your business to follow a thorough due-diligence process prior to engaging with your own cloud provider, including:

  • Confirming the cloud provider has a history of sound work practices and ethical behavior (just as USPS does with ours)
  • Identifying potential risks or circumstances associated with the cloud provider that may impact your business’ operations
  • Identifying elements of the service that need to be clarified, and that need to be included in contracts or service agreements
Skip to footer