RFI_-_Attachment_A_-_Redefined_IPS_SIN_Scope_Description.pdf

Proposed Revision of Special Item Numbers (SINs) 52016, 52017, and 52020 Professional Services Schedule (PSS)

52016: BUSINESS INFORMATION SERVICES (BIS) Electronic and nonelectronic transmission of consumer and/or business: credit reports, address verification reports, skip location reports, public information, domestic business profile, international business profile, mortgage reports, supplemental credit reference reports, bond rating, managed fund rating, institutional ranking, data processing (credit/financial) credit scoring, merged credit files, business credit risk assessment and miscellaneous business information services. Firms may provide computer software intended for BIS use and customization of reports.

52017: RISK ASSESSMENT AND MITIGATION SERVICES To include but not limited to: the deployment of financial risk assessment and mitigation strategies and techniques; improvement of capabilities through the reduction, identification, and mitigation of risks; detailed risk statements, risk explanations and mitigation recommendations; design and development of new business applications, processes, and procedures in response to risk assessments; and ensuring compliance with governance and regulatory requirements. Under this SIN, firms can also assist the Ordering Agency with preventive measures in protecting Personally Identifiable Information (PII) and Protected Health Information (PHI) through the evaluation of threats and vulnerabilities to PII and PHI type of information; training of Government personnel on how to prevent data breaches and identity theft; vulnerability assessments; privacy impact and policy assessments; review and creation of privacy and safeguarding policies; prioritization of threats; maintenance and demonstration of compliance; and evaluation and analysis of internal controls critical to the detection and elimination of weaknesses to the protection of PII and PHI type of information.

52020: DATA BREACH RESPONSE AND IDENTITY PROTECTION SERVICES (IPS)

Integrated, total solution for services to provide identity monitoring and notification of Personally Identifiable Information (PII) and Protected Health Information (PHI), identity theft insurance and identity restoration services, breach mitigation and forensics services, and protect (safeguard) the confidentiality of PII and PHI. This includes the requirements found in IPS Requirements Document 1A, applicable to SIN 52020.

NOTE 1: Additional Proposal Instructions are found in IPS Requirements Document 1B.

NOTE 2 : Any firm offering this SIN will be required to provide a System Security Plan (SSP) in accordance with the template found in IPS Requirement Document 1C. The firm will also be required to submit a Firm Fixed Price per impacted individual per month pricing methodology unless otherwise defined at the Task Order level (e.g. “per product redeemed per the agreedupon coverage period (month, year, etc.)”) covering ALL services cited in Section I of IPS Requirements Document 1A. Firms are encouraged to provide separate line item pricing for key services within this total solution SIN the firm believes could be ordered independently (e.g., credit monitoring, restoration, reports, etc.). This will allow the Ordering Agency to obtain only those services needed depending on level of breach. See IPS Pricing Document 2 for pricing tables.

NOTE 3: Services provided shall be performed in accordance with applicable Federal laws and policies, including the Identity Theft and Assumption Deterrence Act of 1998, as amended by Public Law 105318, 112 Statute 3007 (Oct. 30, 1998), and implemented by 18 U.S.C. § 1028. Firms are required to adhere to all applicable Office of Management and Budget (OMB) policies including OMB Circular A130, Management of Federal Information Resources, and a ny updates to OMB Memorandum M0716, “Safeguarding Against and Responding to Breach of Personally Identifiable Information,” and OMB Memorandum M0619, “Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments.”

NOTE 4 : The Agency Ordering Guide can be found at www.gsa.gov/psschedule click on “Data Breach Response and Identity Protection Services.”

http://www.gsa.gov/psschedule

Identity Protection Services (IPS) IPS Requirements Document 1A in Support of SIN 52020

SECTION I: DEFINITIONS

CREDIT MONITORING: is defined as the process of monitoring credit history in order to detect any suspicious activity or changes.

CYBER INCIDENT: is defined as actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on a protected Contractor information system and/or the protected information residing therein.

GOVERNMENT INFORMATION: is defined as information created, collected, processed, stored, disseminated, or disposed of by or for the Federal Government.

DATA BREACH: is defined as an incident in which personally identifiable information or protected health information has potentially been viewed, stolen, or used by an individual not authorized to do so. As defined in OMB Memorandum M0716, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” a breach includes the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purposed have access or potential access to PII whether physical or electronic.

DAYS: represent calendar days unless otherwise specified.

DATA CLEANSE: i s defined as the process of detecting and correcting (or removing) corrupt or inaccurate records from a record set, table, or database. Used mainly in databases, the term refers to identifying incomplete, incorrect, inaccurate, and irrelevant parts of the data and then replacing, modifying, or deleting this dirty data or coarse data.

IDENTITY PROTECTION: is defined as establishing appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained.

IMPACTED INDIVIDUALS: to be defined at the Task Order level.

PERSONALLY IDENTIFIABLE INFORMATION (PII) is defined as information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.

PROTECTED CONTRACTOR INFORMATION SYSTEM: is defined as an information system that is owned or operated by or for a Contractor and that processes, stores, or transmits protected information. Protected information is defined as information provided to the Contractor by or on behalf of the Federal Government or provided by impacted individuals in connection with the performance of the contract; or collected, received, transmitted, developed, used, or stored by or on behalf of the Contractor in support of the performance of the contract.

PROTECTED HEALTH INFORMATION (PHI) is defined in detail by 45 C.F.R.160.103 as: any information, including genetic information, whether oral or recorded in any form or medium, that:

(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

Records is defined as all books, papers, maps, photographs, machinereadable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of the data in them. Library and museum material made or acquired and preserved solely for reference or exhibition purposes, extra copies of documents preserved only for convenience of reference, and stocks of publications and of processed documents are not included. (44 U.S.C. 3301)

SYSTEM SECURITY PLAN

In order to provide services under SIN 52020, the Contractor shall be required to submit a “moderate impact level” System Security Plan (SSP) at the GSA contract level. This plan will be prepared in accordance with the template provided under IPS Requirements Document 1C (attached) and follow the security requirements outlined in NIST SP 80053 (latest revision).

The Contractor will be required to be knowledgeable of the requirements of both NIST SP 80053 and NIST SP 800171 (latest revision) as determined at the Task Order level.

Contractors with PHI and certain PII as determined by FIPS 199 classification may be required to provide a “high impact level” SSP and/or additional “compensating” controls at the Task Order level that requires additional controls to be implemented.

If no specific plan is identified at the Task Order level, the Contractor will be required to adhere to the template required by GSA.

http://www.ecfr.gov/cgi-bin/text-idx?SID=eb96c030254e469c876226074464df0d&mc=true&node=se45.1.160_1103&rgn=div8

If any changes/updates are required to the approved System Security Plan at the Task Order level, the Contractor will be required to submit an updated plan to the Ordering Agency designee and provide a copy of that revised plan to the GSA IPS Program Manager upon approval by the Ordering Agency.

SECURITY AND SECURITY RELATED REPORTING REQUIREMENTS :

The Contractor’s invoicing, billing, and other financial/administrative records/databases may not store or include any sensitive Government information, such as PII or PHI, that was created, obtained, or provided during the performance of the Task Order. It is acceptable to list the names, titles and contact information for the Ordering Contracting Officer, or other Ordering Agency personnel associated with the administration of the Task Order in the invoices as needed.

The Ordering Agency Contracting Officer's approval is required prior to engaging in any contractual relationship in support of any order requiring the disclosure of information, documentary material and/or records generated under, or relating to, work performed under the Task Order. The Contractor (and its subcontractor, partners, etc.) is required to abide by Government and individual Ordering Agency guidance for protecting sensitive and protected information.

POST AWARD DATA INCIDENT REPORTING PROCEDURES :

The Contractor must report ALL incidents involving PII and/or PHI breaches according to the notification requirements for data classification to the Ordering Agency designated official within one (1) hour of the initial discovery. This includes all incidents involving PII and/or PHI in electronic or physical form and should not distinguish between suspected and confirmed breaches. If, during performance of any Task Order awarded, the Contractor suffers a suspected and/or actual loss or compromise of PII or PHI, the Contractor is required to provide a written report to the designated Ordering Agency official within 24 hours of a suspected and/or actual loss or compromise of PII or PHI containing the following information:

a) Narrative, detailed description of the events surrounding the suspected loss/compromise

b) Date, time, and location of the incident

c) Type of information lost or compromised

d) Contractor’s assessment of the likelihood that the information was compromised or lost and the reasons behind the assessment

e) Contractor’s assessment of the likelihood that the information compromised can be recovered

f) Names of person(s) involved, including victim, Contractor employee/subcontractor and any witnesses

g) Cause of the incident and whether the company’s security plan was followed or not, and which specific provisions were not followed

h) Actions that have been or will be taken to minimize damage and/or mitigate further compromise

i) Require Contractors and subcontractors to properly encrypt PII and PHI using FIPS 1402 Security Requirements for Cryptographic Modules [1] and refrain from practices that violate agency PII and PHI protection policies

[1] Federal Information Processing Standards Publication 1402, Security Requirements for Cryptographic Modules (NIST, December 2002)

GOVERNMENT PROVIDED INFORMATION :

As required and applicable, for each Task Order placed, the Contractor will be provided with a list of the names of all individuals affected who are eligible for identity theft services and a list of the names of affected individuals to whom notices must be mailed or emailed by the Contractor, with mailing addresses and/or email addresses provided, if known. The Ordering Office may require Contractor services to research missing point of contact information on impacted individuals as an additional service (Skip Tracing). The Ordering Office issuing the Task Order will define method of notification , content of notification , and additional PII or PHI about affected individuals whose addresses are not known or for whom notification by mail or email has failed .

A dditional notification by certified or registered mail will be made to affected individuals for which a PIN number has not been claimed within two weeks . A ny information that pertains to PII and PHI will be held to the same standards as Federally Mandated in the Privacy Act of 1974, the EGovernment Act of 2002, Federal Information Security Modernization Act (FISMA) of 2014, Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 and any other related Federal laws, regulations, and policies.

SPECIFIC REQUIREMENTS ASSOCIATED WITH RISK ASSESSMENT AND

MITIGATION SERVICES INCLUDE :

a) Addresses all program areas as ordered

b) Data is usable for analysis

SPECIFIC REQUIREMENTS ASSOCIATED WITH DATA BREACH ANALYSIS

SERVICES INCLUDE :

a) Addresses all program areas as ordered

b) Initial report provided 30 days after notification and quarterly thereafter

c) Review all information compromised by a data breach for trends and unusual patterns

d) Investigate the circumstances surrounding the breach to determine whether it appears to be incidental, accidental, or targeted

e) Analyze the breached data itself to determine if there is any current evidence of organized misuse

f) Provide reports to the Ordering Agency that include aggregate information about responses in order to allow the Ordering Agency the ability to quickly address questions from interested stakeholders

g) Conduct a review for evidence of compromise of protected information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing protected Contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been assessed as a result of the incident in order to identify compromised protected information, or that affect the Contractor’s ability to perform the requirements of the contract

SPECIFIC REQUIREMENTS ASSOCIATED WITH DATA BREACH RESPONSE AND

IDENTITY THEFT SERVICES INCLUDE :

The Contractor shall establish a dedicated, branded website for impacted individuals to enroll themselves and access all data breach recovery services. The Government may require the site to link with a .gov web page and must meet the following performance standards:

a) Must be 508compliant

b) Must be IAW NIST SP 80053 (latest revision) but have the capabilities to meet

NIST SP 800171 (latest revision) if required at the Task Order level. Website shall be accessible on major commercial browsers (i.e., Internet Explorer, Chrome, Firefox, Safari, and Opera)

c) Fully operational in advance of notification to impacted individuals

d) 99.99% operational

e) Multifactor authentication for impacted individuals such as Data at Rest

Encryption; Data in Transit Encryption; Data Loss Prevention; Database HIDS; etc.

SPECIFIC REQUIREMENTS ASSOCIATED WITH A CALL CENTER INCLUDE :

The Contractor shall establish call center services with qualified credit counselors and the call center shall meet the following performance standards:

a) Operational prior to notification of impacted individuals

b) Located in the U.S.

c) English and Spanish, or as otherwise indicated at the Task Order level

d) Dedicated U.S. tollfree telephone number

e) 508compliant free international telephone access

f) Use call center FAQs provided by the Federal Government

g) Updated FAQs shall be used upon receipt

The Contractor shall respond to queries, enrollments, and requests for use of provided services from impacted individuals and shall meet the following performance standards:

a) Wait times not to exceed 15 minutes before human assistance is rendered

b) Average wait time shall not exceed 10 minutes

c) Maintain daily call log

d) Call c enter hours 24 hours a day, 7 days a week

e) Provide call logs for review by O rdering A gency C ontracting O fficer or assigned designee (including number of calls, wait time, length, dropped calls)

The call center services shall include:

a) Operational Status of the call center established for impacted individuals under the Task Order summarized in minutes (reporting period and cumulative)

b) Number of calls received (reporting period identified in order and cumulative)

c) Number of calls dropped (reporting period identified in order and cumulative)

d) Number of enrollments by call center (reporting period identified in order and cumulative)

e) Summary of performance against standards established for call center including remedy and plans to prevent future occurrence if standard is not met (reporting period only)

f) Customer feedback provided through call center (reporting period only)

The Contractor shall connect impacted individuals to designated identity restoration services and identity theft insurance services and which include meeting the following standards:

a) Ongoing basis

b) Initiation of the process for use of the Identity Restoration Service or Identity

Theft Insurance within 15 minutes of connection

The Contractor shall forward and present special requests or issues collected on a daily basis from impacted individuals to the Government for further consideration. Special requests or issues include those requests or issues from impacted individuals who have not been provided the necessary level of information from the Contractor. This list shall also include repeated questions from impacted individuals that are not covered in the FAQs.

SPECIFIC REQUIREMENTS ASSOCIATED WITH NOTIFICATION INCLUDE :

a) Delivery status of all Task Order Government Furnished Information

b) Status of data cleanse with estimated completion date

c) Status of deduplication of data with estimated/actual completion date

d) Estimated number of impacted individuals

e) Total number of notifications planned to be sent via mail

f) Total number of notifications mailed by Contractor

g) Total number of returned mail notifications

h) Total number of redistributed mail notifications after being returned

i) Total number of notifications sent via email (.gov email)

j) Total number of returned notifications via email (.gov email)

k) Total number of redistributed notifications via email after being returned

The Contractor shall intake, review, and data cleanse the PII and/or PHI Government furnished data set. This will include review of national change of address (NCOA).

The Contractor shall deduplicate the data cleansed list and provide duplicative data list and final notification list for approval by the Government. Deduplication of data is the removal of repetitive information for the same individual. The Contractor will be required to meet the following performance standards:

a) Ensure 99% of records are accurate

b) Ensure that the deduplication services are completed within seven (7) days calendar days in receipt of data

c) Will use the following format: XML or CSV

d) Provide both a duplicate and final list of data cleansed

The Contractor shall review Government furnished language and make recommendations to the Government. Government furnished language includes but is not limited to letters, emails, and FAQs. The Contractor's review shall provide recommendations in the same format provided by the Government within one (1) calendar day.

The Contractor shall prepare Government approved content and formatted mail and/or email notifications for presented to all impacted individuals upon approval of the Final List by the Government. The notification shall contain a unique .gov website link provided by the Government and the Contractor must have the ability to maintain or regenerate a copy of the notification distributed to impacted individuals. The .gov website will contain a direct link to the Contractor’s website established for the services required.

The Contractor shall distribute notifications to impacted individuals within five (5) calendar days (unless otherwise stated at the Task Order level). The Contractor shall distribute notification in alphabetical order. The Contractor shall establish a unique PO Box return address for distributed mail. The return address shall contain an OPM identifier. The Contractor shall use the U.S Mail or if also required by the Government, email from a .gov domain.

The Contractor shall provide a list of failed notifications to the Government within no less than 14 calendar days (unless otherwise stated at the Task Order level) after all notifications have been sent. This process must remain in effect in an ongoing basis.

The Contractor shall redistribute previously failed notifications to impacted individuals within five

(5) calendar days unless otherwise stated at the Task Order level, after receiving additional identifying information from the Government.

The Contractor shall respond to queries, enrollments, and requests for use of provided services from impacted individuals. The Contractor shall authenticate the identity of impacted individuals who desire to enroll using the data provided by the Government. Once authenticated, any impacted individuals may enroll themselves. Impacted individuals who opt to use the call center may be able to authenticate their eligibility via touch tone phone prior to advancing to a call center attendant. The Contractor shall have an automated recording protocol that accommodates all callers, including addressing instances where individuals are not eligible for the services.

SPECIFIC REQUIREMENTS ASSOCIATED WITH CREDIT MONITORING SERVICES

INCLUDE :

Upon enrollment, the Contractor shall provide, at a minimum, credit monitoring of credit reports from Experian, Equifax, and TransUnion, however, an Ordering Agency may request inclusion of other Credit Reporting Agencies at the Task Order level. The Contractor will be required to meet the following performance standards:

a) Initial credit report for impacted individuals to be available within 48 hours of enrollment into credit monitoring services

b) Identify changes in credit reports

c) Identify and notify impacted individuals of any additional findings or changes no later than 24 hours after occurrence

d) Provide any subsequent reports in accordance with the Fair Credit Reporting Act

e) Be in accordance with Federal and applicable State Laws

A summary of all credit monitoring services will be provided (report period and cumulative) and will include:

a) Number of impacted individuals who enrolled in services

b) Number of impacted individuals enrolled

c) Number of individuals to whom credit reports from all three n ational credit reporting agencies have been made available

d) Number of individuals that were notified of suspicious activity

e) Number of individuals that confirmed activity was suspicious

SPECIFIC REQUIREMENTS ASSOCIATED WITH IDENTITY MONITORING

The Contractor shall provide identity monitoring services for enrolled individuals. Identity monitoring services includes, but is not limited to:

a) Monitoring of the Internet and the dark web

b) Monitoring of database sources including, but not limited to, criminal records, arrest records, court records, pay day loan, bank accounts, check databases, sex offender, change of address, and social security number trace

c) Monitoring will be 24 hours a day, 7 days a week

d) Contractor will identify and notify impacted individuals of findings or changes no later than 24 hours after occurrence

A summary of all identity monitoring services will be provided (report period and cumulative) and will include:

a) Number of impacted individuals enrolled

b) Number of individuals that were notified of suspicious activity. (The Contractor will be required to provide the location of suspicious activity (i.e., Internet or specific monitored database))

c) Number of individuals that confirmed activity was suspicious (The Contractor will be required to provide the location of suspicious activity (i.e., Internet or specific monitored database))

SPECIFIC REQUIREMENTS ASSOCIATED WITH IDENTITY THEFT INSURANCE

INCLUDE:

The Contractor shall provide identity theft insurance to impacted individuals regardless of their enrollment status in other services. The insurance shall cover any fraudulent misuse of an impacted individual’s PII and/or PHI. Coverage will include all claims submitted on or prior to:

(as defined in the Task Order). The terms of the insurance agreement agreed to at time of GSA Schedule award shall include up to $5,000,000.00 per impacted individual, with no deductible.

The benefits of this insurance shall include, at a minimum, coverage of:

a) Lost wages

b) Travel expenses

c) Elder care and child care

d) Initial legal consultation

e) Any other expenses specifically tied to identity restoration

A summary of all identity theft insurance will include :

a) Number of individuals requesting identity theft insurance services

b) Status of claims submitted to include the number of open claims

c) Number of closed claims, total value of insurance claims submitted by impacted individuals, total value of insurance expenses paid to impacted individuals (both open/closed claims), total amount of insurance payments to individuals with closed claims, types of claims submitted (e.g., lost wages, travel expenses), and a description of services rendered

SPECIFIC REQUIREMENTS ASSOCIATED WITH IDENTITY RESTORATION

SERVICES INCLUDE :

Identity restoration services will include, but are not limited, to the number of impacted individuals requesting identity restoration services.

The Contractor shall provide identity restoration services for all impacted individuals regardless of their enrollment status in other services. The scope of this coverage includes any identity theft claim submitted within the period of performance of the Task Order to restore the identity to the precompromised state.

The Contractor shall assign an individual case manager to work with the impacted individual requiring identity restoration services to restore the identity to the precompromised state.

The Contractor shall offer the option of working under the authority of a Limited Power of Attorney, when required. These services shall include, but not be limited to, counseling, investigation, and resolving identity theft issues and the following performance standards must be met:

a) Ongoing basis

b) Assign a case manager who will contact the impacted individual within the time specified at the Task Order level

The Contractor will provide a status of claims submitted to include:

a) Number of open identity restoration cases

b) Number of closed identity restoration cases

c) Type and quantity of services rendered to restore identity

d) A description of the services rendered

SPECIFIC REQUIREMENTS ASSOCIATED WITH REQUIRED REPORTS

The Contractor shall provide reporting as defined in the Task Order. An example reporting requirement is provided as follows: The Contractor shall provide a Status Report to accurately reflect the status of its website services, to include:

a) Operational Status of the website established for impacted individuals under the Task Order summarized in minutes (reporting period identified in order and cumulative);

b) Number of times accessed (reporting period identified in order and cumulative);

c) Number of enrollments in services by website (reporting period identified in order and cumulative);

d) Description of any events related to interoperability of website including remedy and plans to prevent future occurrence (reporting period only);

e) Customer feedback provided through website (reporting period only)

The Contractor generated format for any report provided at the Task Order level is subject to approval and feedback of Government and must be in either .XML or CSV format. All reports provided to the Government shall clearly state the period start and end date/time of data.

SPECIFIC REQUIREMENTS ASSOCIATED WITH DATA SAFEGUARDS AND

DISPOSAL SAFETY INCLUDE :

The Contractor shall:

a) Store and protect all data collected for the affected individuals during the designated time frame from unauthorized disclosure and destruction, either direct or as a result of negligence.

b) Purge all PII/PHI data (data sanitization) provided by the Ordering Agency in accordance with DoD 522022M, National Industrial Security Program Operating Manual, and NIST SP80088 (latest revision), including any backedup data and any other PII or PHI held by the Contractor pursuant to this agreement and safely dispose as agreed to by the Ordering Agency at the conclusion of the last enrollee’s period of monitoring.

c) Within 30 days after the end of the performance period, the Contractor shall provide notification to the Contracting Officer. The notification shall include a description of the information that will be destroyed, as well as, a description of the information required for completion of pending/ongoing restoration claims. The Contractor shall not destroy any information without written approval from the Contracting Officer. The Contractor shall certify to the destruction of all protected information no more than 30 days after receiving written approval from the Contracting Officer, with the exception of information needed for pending and ongoing restoration claims. The Contractor shall certify in writing the date information was deleted and method used for deletion.

d) All PII or PHI will be maintained, handled, disclosed, and disposed of in accordance with the Privacy Act of 1974, 5 U.S.C. 552a, Public Law 107347 titled EGovernment Act of 2002, the Federal Records Act, and the Health Insurance Portability and Accountability Act of 1996 as amended by the Health Information Technology for Economic and Clinical Health Act of 2009.

e) The Contractor shall guarantee strict confidentiality of the information/data that is provided by the Government during the performance of any Task Order.

f) The Contractor, in whole or in part, can only disclose or disseminate the information/data, after they have received written approval from the Ordering Agency Contracting Officer.

g) Contractor personnel assigned to the performance work are required to certify that all employees hired for the resultant task have employment background checks in compliance with the Fair Credit Reporting Act (FCRA) 15 U.S.C. § 1681 dated September 2012. If at any time during performance of any Task Orders awarded against this GSA Schedule contract, the Contractor personnel are deemed a security risk, the Contractor will be responsible for immediate removal from performance under the Task Order and replacement of acceptable personnel with notification immediately provided to the Ordering Agency. Upon removal or completion, Contractor personnel shall immediately return any facility access materials/passes to the Ordering Agency Contracting Officer.

h) The Contractor agrees to assume responsibility for protecting the confidentiality of Government records, which are not public information.

i) The Contractor, employee of the Contractor, Contractor subcontractor, or partner to whom information may be made available or disclosed shall be notified in writing by the Contractor that such information may be disclosed or disseminated only for a purpose and to the extent authorized herein. Any request for interagency sharing of information about individuals shall comply with OMB Memorandum M0105, “Guidance on InterAgency Sharing of Personal Data Protecting Personal Privacy.” The Contractor shall keep the information confidential and use appropriate safeguards to maintain its security in accordance with minimum Federal standards.

j) The Contractor must also explain and certify that its subcontractor(s) or partners will adhere to the same minimum Federal standards when working with sensitive data.

k) The Contractor shall not use the information for any purpose other than contacting the affected individual. Any type of marketing, upselling, after marketing, or soliciting of any individuals is prohibited. Services provided shall be performed in accordance with applicable Federal laws and policies including the Identity Theft and Assumption Deterrence Act, as amended by Public Law 105318, 112 Statute 3007 (Oct. 30, 1998), and implemented by 18 U.S.C. § 1028.

l) The Contractor is required to adhere to Federal Information Security Modernization Act (FISMA) of 2014 and all applicable OMB policies, including any policies issued during the term of its Schedule contract. This includes any updates to OMB Memorandum M0716, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information” and OMB Memorandum M0619, “ “Reporting Instructions Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments.”

m) The Contractor will provide recommendations to prevent similar situations in the future, including whether the security plan needs to be modified in any way and whether additional training may be required.

n) The Contractor must cooperate with the designated Ordering Agency or other designated Government Agency inquiries into the suspected loss or compromise of PII and PHI. This includes meeting the designated Agency's data breach incident reporting requirements.

At the G overnment’s discretion, the Contractor’s employees (or affiliated partners or subcontractors) may be identified as no longer eligible to access PII and PHI or to work on that contract based on their actions related to the loss or compromise of PII and PHI.

The Government has determined that the information/data that the Contractor will be provided during the performance of any effort associated with SIN 52020 is of a sensitive nature and the Contractor is explicitly required to notify the agency of any subpoena, court order or other third party request for the Government’s records (e.g., any individual email addresses or other nonpublic information that may have been given to or generated by the Contractor in performing work under any Task Order). Failure to comply with this requirement may result in legal and or criminal infraction.

Whenever the Contractor is uncertain with regard to the proper handling of information/data under any effort associated with SIN 52020, the Contractor shall obtain a written determination from the Ordering Agency Contracting Officer.

SECTION II ADDITIONAL SERVICES

Additional services are customized solutions needed that can only be ordered in addition to IPS Requirements Document 1A Section I services. These additional services may utilize the services found under SINs 520 16 , Business Information Services, and 520 17 , Risk Assessment and Mitigation Services. Section II additional services shall not be ordered as a stand alone service for Task Orders under SIN 52020.

IPS Document 1B

ADDITIONAL PROPOSAL INSTRUCTIONS

Reference IPS Requirements Document 1A In addition to the standard solicitation proposal requirements, Contractors will be required to meet the following requirements with their GSA Schedule contract submittal (or modification to add SIN 52020) that include:

SECTION I TECHNICAL PROPOSAL

A narrative detailing the following :

● Firm’s general management approach to providing each of the required services described in IPS Requirements Document 1A, Section I.

● Demonstration of how firm will provide services required, including compliance with all required standards throughout the period of performance.

● A detailed System Security Plan will be submitted in accordance with NIST SP 80053 (latest revision) using the attached template. The firm’s responses will be required to be complete and clear with each element addressed. Failure to follow the plan or complete any segment of the plan will result in rejection of a firm’s offer. It is noted that if a specific plan is not requested at the Task Order level, the firm will be required to utilize the same template awarded at the GSA contract level.

NOTE 1 : In addition to the required System Security Plan, ancillary documents may also be required by the Ordering Agency which will be validated at the Task Order level.

NOTE 2 : Plans that do not follow the attached guidance will be rejected as unacceptable. Plans that simply parrot back the security requirements of NIST SP 80053 (latest revision) are not acceptable and will result in rejection of offer.

NOTE 3 : If any changes/updates are required to the approved Systems Security Plan at the Task Order level, the Contractor will be required to submit an updated plan to the Ordering Agency and provide a copy of that revised plan to the GSA IPS Program Manager upon approval by the Ordering Agency for review and incorporation.

IPS Requirements Document 1B (continued) in Support of SIN 52020

SECTION II TECHNICAL PROPOSAL FOR ADDITIONAL SERVICES

Firms shall indicate in their proposal whether or not they are proposing to provide services under IPS Pricing Document 2, Section II Additional Services. There are no additional technical proposal requirements to be considered for these additional services. Follow the standard solicitation proposal requirements. In order to provide services under SIN 52020 Section II Additional Services, a firm must qualify and be awarded SINs 52016 and 52017 in its Schedule contract.

IPS Requirements Document 1C

[ Company SYSTEM NAME] [ACRONYM]

System Security Plan

[Date]

Document Prepared By

OrganizaÖon Name

Address Line 1

Address Line 2

City, State Zip

Document Revision History

Date Comments Version Author

[Date] IniÖal Version 1.0 [Name]

Table of Contents

1 Information System Name

2 Information System Categorization

2.1 InformaÖon Types

2.2 PotenÖal Impacts of Security ObjecÖves

2.3 E‐AuthenÖcaÖon DeterminaÖon (E‐Auth)

3 Information System Owner

4 Authorizing Official

5 Other Designated Contacts

6 Assignment of Security Responsibility

7 Information System Operational Status

8 Information System Type

8.1 Systems Providing Controls to [ACRONYM]

8.2 Systems Receiving Controls from [ACRONYM]

9 General System Description

9.1 InformaÖon System LocaÖons

9.2 InformaÖon System Components and Boundaries

9.3 Types of Users

9.4 Network Architecture

10 System Environment

10.1 Asset Inventory

10.2 So�ware Inventory

10.3 Data Flow

10.4 Ports, Protocols and Services

11 System Interconnections

12 Applicable Laws and Regulations

13 Minimum Security Controls

13.1 Access Control

13.1.1 AC1: Access Control Policy and Procedures

13.1.2 AC2: Account Management

13.1.3 AC2 (1): Account Management | Automated System Account Management

13.1.4 AC2 (2): Account Management | Removal of Temporary/Emergency Accounts

13.1.5 AC2 (3): Account Management | Disable Inactive Accounts

13.1.6 AC2 (4): Account Management | Automated Audit Actions

13.1.7 AC3: Access Enforcement

13.1.8 AC4: Information Flow Enforcement

13.1.9 AC5: Separation of Duties

13.1.10 AC6: Least Privilege

13.1.11 AC6 (1): Least Privilege | Authorize Access to Security Functions

13.1.12 AC6 (2): Least Privilege | NonPrivileged Access for Nonsecurity Functions

13.1.13 AC6 (5): Least Privilege | Privileged Accounts

13.1.14 AC6 (9): Least Privilege | Auditing Use of Privileged Functions

13.1.15 AC6 (10): Least Privilege | Prohibit NonPrivileged Users from Executing Privileged

Functions

13.1.16 AC7: Unsuccessful Login Attempts

13.1.17 AC8: System Use Notification

13.1.18 AC11: Session Lock

13.1.19 AC11 (1): Session Lock | Pattern Hiding Displays

13.1.20 AC12: Session Termination

13.1.21 AC14: Permitted Actions Without Identification or Authentication

13.1.22 AC17: Remote Access

13.1.23 AC17 (1): Remote Access | Automated Monitoring/Control

13.1.24 AC17 (2): Remote Access | Protection of Confidentiality/Integrity Using Encryption

13.1.25 AC17 (3): Remote Access | Managed Access Control Points

13.1.26 AC17 (4): Remote Access | Privileged Commands/Access

13.1.27 AC18: Wireless Access

13.1.28 AC18 (1): Wireless Access | Authentication and Encryption

13.1.29 AC19: Access Control for Mobile Devices

13.1.30 AC19 (5): Access Control for Wireless Devices | Full Device / Container Based Encryption

13.1.31 AC20: Use of External Information Systems

13.1.32 AC20 (1): Use of External Information Systems | Limits on Authorized Use

13.1.33 AC20 (2): Use of External Information Systems | Portable Storage Devices

13.1.34 AC21: Information Sharing

13.1.35 AC22: Publicly Accessible Content

13.2 Awareness and Training

13.2.1 AT1: Security Awareness and Training Policy and Procedures

13.2.2 AT2: Security Awareness Training

13.2.3 AT2 (2): Security Awareness Training | Insider Threat

13.2.4 AT3: RoleBased Security Training

13.2.5 AT4: Security Training Records

13.3 Audit and Accountability

13.3.1 AU1: Audit and Accountability Policy and Procedures

13.3.2 AU2: Audit Events

13.3.3 AU2 (3): Auditable Events | Reviews and Updates

13.3.4 AU3: Content of Audit Records

13.3.5 AU3 (1): Content of Audit Records | Additional Audit Information

13.3.6 AU4: Audit Storage Capacity

13.3.7 AU5: Response to Audit Processing Failures

13.3.8 AU6: Audit Review, Analysis, and Reporting

13.3.9 AU6 (1): Audit Review, Analysis, and Reporting | Process Integration

13.3.10 AU6 (3): Audit Review, Analysis, and Reporting | Correlate Audit Repositories

13.3.11 AU7: Audit Reduction and Report Generation

13.3.12 AU7 (1): Audit Reduction and Report Generation | Automatic Processing

13.3.13 AU8: Time Stamps

13.3.14 AU8 (1): Time Stamps | Synchronization with Authoritative Time Source

13.3.15 AU9: Protection of Audit Information

13.3.16 AU9 (4): Protection of Audit Information | Access by Subset of Privileged Users

13.3.17 AU11: Audit Record Retention

13.3.18 AU12: Audit Generation

13.4 Security Assessment and AuthorizaÖon

13.4.1 CA1: Security Assessment and Authorization Policy and Procedures

13.4.2 CA2: Security Assessments

13.4.3 CA2 (1): Security Assessments | Independent Assessors

13.4.4 CA3: System Interconnections

13.4.5 CA3 (5): System Interconnections | Restrictions on External System Connections

13.4.6 CA5: Plan of Action and Milestones

13.4.7 CA6: Security Authorization

13.4.8 CA7: Continuous Monitoring

13.4.9 CA7 (1): Continuous Monitoring | Independent Assessment

13.4.10 CA8: Penetration Testing

13.4.11 CA8 (1): Penetration Testing | Independent Penetration Agent or Team

13.4.12 CA9: Internal System Connections

13.5 ConfiguraÖon Management

13.5.1 CM1: Configuration Management Policy and Procedures

13.5.2 CM2: Baseline Configuration

13.5.3 CM2 (1): Baseline Configuration | Reviews and Updates

13.5.4 CM2 (2): Baseline Configuration | Automation Support for Accuracy / Currency

13.5.5 CM2 (3): Baseline Configuration | Retention of Previous Configurations

13.5.6 CM2 (7): Baseline Configuration | Configure Systems, Components, or Devices for HighRisk

Areas

13.5.7 CM3: Configuration Change Control

13.5.8 CM3 (2): Configuration Change Control | Test/Validate/Document Changes

13.5.9 CM4: Security Impact Analysis

13.5.10 CM5: Access Restrictions for Change

13.5.11 CM6: Configuration Settings

13.5.12 CM6 (1): Configuration Settings | Automated Central Management / Application /

Verification

13.5.13 CM7: Least Functionality

13.5.14 CM7 (1): Least Functionality | Periodic Review

13.5.15 CM7 (2): Least Functionality | Prevent Program Execution

13.5.16 CM7 (4): Least Functionality | Unauthorized Software/Blacklisting

13.5.17 CM8: Information System Component Inventory

13.5.18 CM8 (1): Information System Component Inventory | Updates During Installations /

Removals

13.5.19 CM8 (2): Information System Component Inventory | Automated Maintenance

13.5.20 CM8 (3): Information System Component Inventory | Automated Unauthorized Component

Detection

13.5.21 CM8 (5): Information System Component Inventory | No Duplicate Accounting of

Components

13.5.22 CM8 (6): Information System Component Inventory | Assessed Configurations / Approved

Deviations

13.5.23 CM9: Configuration Management Plan

13.5.24 CM10: Software Usage Restrictions

13.5.25 CM11: UserInstalled Software

13.6 ConÖngency Planning

13.6.1 CP1: Contingency Planning Policy and Procedures

13.6.2 CP2: Contingency Plan

13.6.3 CP2 (1): Contingency Plan | Coordinate With Related Plans

13.6.4 CP2 (3): Contingency Plan | Resume Essential Missions/Business Functions

13.6.5 CP2 (8): Contingency Plan | Identify Critical Assets

13.6.6 CP3: Contingency Training

13.6.7 CP4: Contingency Plan Testing

13.6.8 CP4 (1): Contingency Plan Testing | Coordinate With Related Plans

13.6.9 CP6: Alternate Storage Site

13.6.10 CP6 (1): Alternate Storage Site | Separation from Primary Site

13.6.11 CP6 (3): Alternate Storage Site | Accessibility

13.6.12 CP7: Alternate Processing Site

13.6.13 CP7 (1): Alternate Processing Site | Separation from Primary Site

13.6.14 CP7 (2): Alternate Processing Site | Accessibility

13.6.15 CP7 (3): Alternate Processing Site | Priority of Service

13.6.16 CP8: Telecommunication Services

13.6.17 CP8 (1): Telecommunication Services | Priority of Service Provisions

13.6.18 CP8 (2): Telecommunication Services | Single Points of Failure

13.6.19 CP9: Information System Backup

13.6.20 CP9 (1): Information System Backup | Testing for Reliability/Integrity

13.6.21 CP10: Information System Recovery and Reconstitution

13.6.22 CP10 (2): Information System Recovery and Reconstitution | Transaction Recovery

13.7 IdenÖficaÖon and AuthenÖcaÖon

13.7.1 IA1: Identification and Authentication Policy and Procedures

13.7.2 IA2: Identification and Authentication (Organizational Users)

13.7.3 IA2 (1): Identification and Authentication (Organizational Users) | Network Access to

Privileged Accounts

13.7.4 IA2 (2): Identification and Authentication (Organizational Users) | Network Access to

NonPrivileged Accounts

13.7.5 IA2 (3): Identification and Authentication (Organizational Users) | Local Access to

Privileged Accounts

13.7.6 IA2 (8): Identification and Authentication (Organizational Users) |Network Access to

Privileged Accounts – Replay Resistant

13.7.7 IA2 (11): Identification and Authentication (Organizational Users) | Remote Access –

Separate Device

13.7.8 IA2 (12): Identification and Authentication (Organizational Users) | Acceptance of PIV

Credentials

13.7.9 IA3: Device Identification and Authentication

13.7.10 IA4: Identifier Management

13.7.11 IA5: Authenticator Management

13.7.12 IA5 (1): Authenticator Management | PasswordBased Authentication

13.7.13 IA5 (2): Authenticator Management | PKIBased Authentication

13.7.14 IA5 (3): Authenticator Management | InPerson or Trusted ThirdParty Registration

13.7.15 IA5 (11): Authenticator Management | Hardware TokenBased Authentication

13.7.16 IA6: Authenticator Feedback

13.7.17 IA7: Cryptographic Module Authentication

13.7.18 IA8: Identification and Authentication (NonOrganizational Users)

13.7.19 IA8 (1): Identification and Authentication (NonOrganizational Users) | Acceptance of PIV

Credentials from Other Agencies

13.7.20 IA8 (2): Identification and Authentication (NonOrganizational Users) | Acceptance of

ThirdParty Credentials

13.7.21 IA8 (3): Identification and Authentication (NonOrganizational Users) | Use of

FICAMApproved Products

13.7.22 IA8 (4): Identification and Authentication (NonOrganizational Users) | Use of

FICAMIssued Profiles

13.8 Incident Response

13.8.1 IR1: Incident Response Policy and Procedures

13.8.2 IR2: Incident Response Training

13.8.3 IR3: Incident Response Testing

13.8.4 IR3 (2): Incident Response Testing | Coordination with Related Plans

13.8.5 IR4: Incident Handling

13.8.6 IR4 (1): Incident Handling | Automated Incident Handling Processes

13.8.7 IR5: Incident Monitoring

13.8.8 IR6: Incident Reporting

13.8.9 IR6 (1): Incident Reporting | Automated Reporting

13.8.10 IR7: Incident Response Assistance

13.8.11 IR7 (1): Incident Response Assistance | Automation Support for Availability of

Information/Support

13.8.12 IR8: Incident Response Plan

13.9 Maintenance

13.9.1 MA1: System Maintenance Policy and Procedures

13.9.2 MA2: Controlled Maintenance

13.9.3 MA3: Maintenance Tools

13.9.4 MA3 (1): Maintenance Tools | Inspect Tools

13.9.5 MA3 (2): Maintenance Tools | Inspect Media

13.9.6 MA4: Nonlocal Maintenance

13.9.7 MA4 (2): Nonlocal Maintenance | Document Nonlocal Maintenance

13.9.8 MA5: Maintenance Personnel

13.9.9 MA6: Timely Maintenance

13.10 Media ProtecÖon

13.10.1 MP1: Media Protection Policy and Procedures

13.10.2 MP2: Media Access

13.10.3 MP3: Media Marking

13.10.4 MP4: Media Storage

13.10.5 MP5: Media Transport

13.10.6 MP5 (4): Media Transport | Cryptographic Protection

13.10.7 MP6: Media Sanitization

13.10.8 MP7: Media Use

13.10.9 MP7 (1): Media Use | Prohibit Use Without Owner

13.11 Physical and Environmental ProtecÖon

13.11.1 PE1: Physical and Environmental Protection Policy and Procedures

13.11.2 PE2: Physical Access Authorizations

13.11.3 PE3: Physical Access Control

13…