03-75A0126R00001_RFP Att 2 ASPR Security Requirements.pdf

Attachment 2: ASPR Security Requirements

* This list of deliverables and ASPR-mandated security requirements may be required for any contract or agreement awarded by or on behalf of ASPR. ASPR shall be the sole determiner of the necessity of inclusion of these requirements, or subset thereof, on a case-by-case basis, as identified in the Deliverables Section of the Solicitation. Included with Project Proposals, offerors must include a statement attesting to their intent and ability to comply with these deliverables and security requirements within the deadline dates stated in Section F.3.2 (Deliverable Table) of the RFP solicitation. These ASPR deliverables and security requirements are included in the solicitation to enable awareness and early planning by offerors for their inclusion as performance requirements under contract awards.

1 Security Reporting Requirements

The partner facility shall notify the Government Security Team within 24 hours of any activity or incident that is in violation of established security standards or indicates the loss or theft of government products associated with this Agreement. The facts and circumstances associated with these incidents will be documented in writing for government review.

2 Operational Security (OPSEC)

The performer shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within ninety (90)-calendar-days after project award to be reviewed and approved by the responsible Government OPSEC officer. This plan will be submitted to the COR for coordination of approval. This SOP/Plan will include identifying the critical information related to this award, why it needs to be protected, where it is located, who is responsible for it, and how to protect it.

3 Security Plan

The contractor shall develop a comprehensive security program that provides overall protection of personnel, information, data, and facilities associated with fulfilling the Government requirement.

This plan shall establish security practices and procedures that demonstrate how the contractor will meet and adhere to the security requirements outlined below prior to the commencement of product manufacturing. The Draft Security Plan shall be delivered to the CO and COR no later than 30 calendar days after award. The contractor shall also ensure all subcontractors, consultants, researchers, etc. performing work on behalf of this effort, comply with all Government security requirements and prime contractor security plans.

a. The Government will perform an internal review in detail and submit comments within ten (10) business days to the CO and COR to be forwarded to the Contractor. The Contractor shall review the Draft Security Plan comments and submit a Final Security Plan to the U.S. Government within ten (10) calendar days after receipt of the comments.

b. The Security Plan shall include a timeline for compliance of all the required security measures outlined by the Government.

c. Upon completion of initiating all security measures, the Contractor shall supply to the CO and COR a letter certifying compliance to the elements outlined in the Final Security Plan.

At a minimum, the Final Security Plan shall address the following items:

Security Requirements:

1. Facility Security Plan Description: As part of the partner facility’s overall security program, the contractor shall submit a written security plan with their proposal to the Government for review and approval by Government security subject matter experts. The performance of work under the contract will be in accordance with the approved security plan. The security plan will include the following processes and procedures at a minimum:

Security Administration

• organization chart and responsibilities

• written security risk assessment for site

• threat levels with identification matrix (High, Medium, or Low)

• enhanced security procedures during elevated threats

• liaison procedures with law enforcement

• annual employee security education and training program

Physical Security Policies and Procedures

• internal/external access control

• protective services

• identification/badging

• employee and visitor access controls

• parking areas and access control

• perimeter fencing/barriers

• product shipping, receiving and transport security procedures

• facility security lighting

• restricted areas

• signage

• intrusion detection systems

• alarm monitoring/response

• closed circuit television

• product storage security

• other control measures as identified

Information Security • identification and marking of sensitive information

• access control

• storage of information

• document control procedures

• retention/ destruction requirements

Information Technology/Cyber Security Policies and Procedures

• intrusion detection and prevention systems

• threat identification

• employee training (initial and annual)

• encryption systems

• identification of sensitive information/media

• password policy (max days 90)

• lock screen time out policy (minimum time 20 minutes)

• removable media policy

• laptop policy

• removal of IT assets for domestic/foreign travel

• access control and determination

• VPN procedures

• WiFi and Bluetooth disabled when not in use

• system document control

• system backup

• system disaster recovery

• incident response

• system audit procedures

• property accountability

2. Site Security Master Plan Description: The partner facility shall provide a site schematic for security systems which includes:

main access points; security cameras; electronic access points; IT Server Room; Product Storage Freezer/Room; and bio-containment laboratories.

3. Site Threat / Vulnerability / Risk Assessment Description: The partner facility shall provide a written risk assessment for the facility addressing:

criminal threat, including crime data; foreign/domestic terrorist threat; industrial espionage;

insider threats; natural disasters; and potential loss of critical infrastructure (power/water/natural gas, etc.) This assessment shall include recent data obtained from local law enforcement agencies. The assessment should be updated annually.

4. Physical Security Description:

Closed Circuit Television (CCTV) Monitoring

a. Layered (internal/external) CCTV coverage with time-lapse video recording for buildings and areas where critical assets are processed or stored.

b. CCTV coverage must include entry and exits to critical facilities, perimeters, and areas within the facility deemed critical to the execution of the contract.

c. Video recordings must be maintained for a minimum of 30 days.

d. CCTV surveillance system must be on emergency power backup.

e. CCTV coverage must include entry and exits to critical facilities, perimeters, and areas within the facility deemed critical to the execution of the contract.

f. Video recordings must be maintained for a minimum of 30 days.

g. CCTV surveillance system must be on emergency power backup.

Facility Lighting a. Lighting must cover facility perimeter, parking areas, critical infrastructure, and entrances and exits to buildings.

b. Lighting must have emergency power backup.

c. Lighting must be sufficient for the effective operation of the CCTV surveillance system during hours of darkness.

Shipping and Receiving

a. Must have CCTV coverage and an electronic access control system.

b. Must have procedures in place to control access and movement of drivers picking up or delivering shipments.

c. Must identify drivers picking up Government products by government issued photo identification.

Access Control a. Must have an electronic intrusion detection system with centralized monitoring.

b. Responses to alarms must be immediate and documented in writing.

c. Employ an electronic system (i.e., card key) to control access to areas where assets critical to the contract are located (facilities, laboratories, clean rooms, production facilities, warehouses, server rooms, records storage, etc.).

d. The electronic access control should signal an alarm notification of unauthorized attempts to access restricted areas.

e. Must have a system that provides a historical log of all key access transactions and kept on record for a minimum of12 months.

f. Must have procedures in place to track issuance of access cards to employees and the ability to deactivate cards when they are lost or an employee leaves the company.

g. Response to electronic access control alarms must be immediate and documented in writing and kept on record for a minimum of 12 months.

h. Should have written procedures to prevent employee piggybacking access

i. to critical infrastructure (generators, air handlers, fuel storage, etc.) should be controlled and limited to those with a legitimate need for access.

j. Must have a written manual key accountability and inventory process.

k. Physical access controls should present a layered approach to critical assets within the facility.

Employee/Visitor Identification

a. Should issue company photo identification to all employees.

b. Photo identification should be displayed above the waist anytime the employee is on company property.

c. Visitors should be sponsored by an employee and must present government issued photo identification to enter the property.

d. Visitors should be logged in and out of the facility and should be escorted by an employee while on the premises at all times.

Security Fencing Requirements for security fencing will be determined by the criticality of the program, review of the security plan, threat assessment, and onsite security assessment.

5. Security Operations Description:

Security Management a. Designate a knowledgeable security professional to manage the security of the facility.

b. Ensure subcontractor compliance with all Government security requirements.

6. Information Security Description:

Physical Document Control

a. Applicable documents shall be identified and marked as procurement sensitive, proprietary, or with appropriate government markings.

b. Sensitive, proprietary, and government documents should be maintained in a lockable filing cabinet/desk or other storage device and not be left unattended.

c. Access to sensitive information should be restricted to those with a need to know.

Document Destruction Documents must be destroyed using approved destruction measures (i.e, shredders/approved third party vendors / pulverizing / incinerating).

7. Information Technology & Cybersecurity Description:

Identity Management a. Physical devices and systems within the organization are inventoried and accounted for annually.

b. Organizational cybersecurity policy is established and communicated.

c. Asset vulnerabilities are identified and documented.

d. Cyber threat intelligence is received from information sharing forums and sources.

e. Threats, vulnerabilities, likelihoods, and impacts are used to determine risk.

f. Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes.

g. Users, devices, and other assets are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)

Access Control a. Limit information system access to authorized users.

b. Identify information system users, processes acting on behalf of users, or devices and authenticate identities before allowing access.

c. Limit physical access to information systems, equipment, and server rooms with electronic access controls.

d. Limit access to/ verify access to use of external information systems.

Training a. Ensure that personnel are trained and are made aware of the security risks associated with their activities and of the applicable laws, policies, standards, regulations, or procedures related to information technology systems.

Audit and Accountability a. Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate system activity. Records must be kept for minimum must be kept for 12 months.

b. Ensure the actions of individual information system users can be uniquely traced to those users.

c. Update malicious code mechanisms when new releases are available.

d. Perform periodic scans of the information system and real time scans of files from external sources as files are downloaded, opened, or executed.

Configuration Management

a. Establish and enforce security configuration settings.

b. Implement sub networks for publicly accessible system components that are physically or logically separated from internal networks.

Contingency Planning a. Establish, implement, and maintain plans for emergency response, backup operations, and post-disaster recovery for information systems to ensure the availability of critical information resources at all times.

Incident Response a. Establish an operational incident handling capability for information systems that includes adequate preparation, detection, analysis, containment, and recovery of cybersecurity incidents. Exercise this capability annually.

Media and Information Protection

a. Protect information system media, both paper and digital.

b. Limit access to information on information systems media to authorized users.

c. Sanitize and destroy media no longer in use.

d. Control the use of removable media through technology or policy.

Physical and Environmental Protection

a. Limit access to information systems, equipment, and the respective operating environments to authorized individuals.

b. Intrusion detection and prevention system employed on IT networks.

c. Protect the physical and support infrastructure for all information systems.

d. Protect information systems against environmental hazards.

e. Escort visitors and monitor visitor activity.

Network Protection Employ intrusion prevention and detection technology with immediate analysis capabilities.

8. Transportation Security Description: Adequate security controls must be implemented to protect materials while in transit from theft, destruction, manipulation, or damage.

Drivers

a. Drivers must be vetted in accordance with Government Personnel Security Requirements.

b. Drivers must be trained on specific security and emergency procedures.

c. Drivers must be equipped with backup communications.

d. Driver identity must be 100 percent confirmed before the pick-up of any Government product.

e. Drivers must never leave Government products unattended, and two drivers may be required for longer transport routes or critical products during times of emergency.

f. Truck pickup and deliveries must be logged and kept on record for a minimum of 12 months.

Transport Routes a. Transport routes should be pre-planned and never deviated from except when approved or in the event of an emergency.

b. Transport routes should be continuously evaluated based upon new threats, significant planned events, weather, and other situations that may delay or disrupt transport.

Product Security a. Government products must be secured with tamper resistant seals during transport, and the transport trailer must be locked and sealed.

• Tamper resistant seals must be verified as “secure” after the product is placed in the transport vehicle.

b. Government products should be continually monitored by GPS technology while in transport, and any deviations from planned routes should be investigated and documented.

c. Contingency plans should be in place to keep the product secure during emergencies such as accidents and transport vehicle breakdowns.

9. Security Reporting Requirements Description: The partner facility shall notify the Government Security Team within 24 hours of any activity or incident that is in violation of established security standards or indicates the loss or theft of government products. The facts and circumstances associated with these incidents will be documented in writing for government review.