B03 AMD 0001 Attachment B_Security Requirements.pdf

12314423Q0144, Amendment 0001, STRATUS Pool 3 SaaS Page 1 of 6 Attachment B: Security Requirements

Attachment B: Security Requirements

B.1. USDA STRATUS Blanket Ordering Agreement (BOA) Security

Requirements – Pool 3 SaaS The Contractor shall establish and maintain a security program and security controls per Federal Risk Authorization Management Program (FedRAMP) and Cloud Security and Privacy Requirements as specified as well as compliance with current Federal and United States Department of Agriculture (USDA) policies and directives.

B.1.1 Definitions B.1.1.1 Authorization and Evaluation Entity - An authorized assessment and evaluation entity is an explicitly identified government entity under this BOA, that is authorized to conduct and perform independent assessments and evaluations leveraging best practices and guidelines established by NIST and commercial standards.

a) United States Federal Government - The following US Federal Government agencies or subordinate agencies, components, and offices are authorized assessment and evaluation entities:

• Cybersecurity and Infrastructure Security Agency (CISA)

• Government Accounting Office (GAO)

• National Security Agency (NSA) / Central Security Service (CSS)

• Office of the Director of National Intelligence (ODNI)

b) United States Department of Defense - The following DoD agencies or subordinate agencies, components, and offices are authorized assessment and evaluation entities:

• Director Operational Test & Evaluation (DOT&E)

• Marine Corps Forces Cyberspace Command Sixteenth Air Force (AFCYBER)

• US Army Cyber Command (ARCYBER)

• US Cyber Command (USCC) 157

• US Fleet Cyber Command

• Department of Defense Cloud Authorization Services (DCAS)

c) United States Department of Agriculture (USDA) – The following USDA agencies or subordinate agencies, components, and offices are authorized assessment and evaluation entities:

• Office of the Chief Information Officer (OCIO)

• Digital Infrastructure Service Center (DISC)

12314423Q0144, Amendment 0001, STRATUS Pool 3 SaaS Page 2 of 6

B.1.1.2 Authorized Vendor - An authorized vendor is an entity that has been awarded a USDA BOA award by the BOA Administering function. An authorized vendor can be a Pool 1 – Cloud Service Provider (CSP); Pool 2 – Application Developer (AppDev), Operations & Maintenance (O&M), and/or System Integrator (SI); and/or Pool 3 – Software as a Service (SaaS) provider.

a) Software as a Service (SaaS) - Cloud services generally responsible for the O&M of the data center, network, storage, servers, virtualization, operating system, database, security, and applications (e.g., office productivity, accounting).

B.1.2 Responsibilities

B.1.2.1 Authorized Assessment and Evaluation Entity Responsibilities – Authorization and Evaluation Entities as defined in Section B.1.1 have the following responsibilities as related to all USDA Stratus Pool 3 Task Orders:

a) Cybersecurity Assessments and Evaluations - Authorized assessment and evaluation entities are responsible for conducting and performing announced and unannounced independent cybersecurity (e.g., OCIO, DISC, etc.) and operational (e.g., performance, SLAs) assessments and evaluations (e.g., OT&E) of the cloud services (i.e., IaaS, PaaS, SaaS, etc.) architectures (e.g., compute, networking, storage) and security domains involved in the processing, transporting, and / or storing authorized ordering entities data.

b) Coordination - Authorized assessment and evaluation entities are responsible for coordinating assessment and evaluation activities with the authorized vendors.

Coordination responsibilities shall include planning, execution, and post assessment and evaluation activities (e.g., remediations, Plan of Actions and Milestones (POA&Ms).

c) Cost - Authorized assessment and evaluation entities are responsible for their assessment and evaluation costs.

d) Findings and Recommendations - Authorized assessment and evaluation entities are responsible for documenting the assessment and evaluation findings and recommendations (e.g., reports).

e) Communication and Distribution - Authorized assessment and evaluation entities are responsible for communicating and distributing the assessment and evaluation findings and recommendations to the following:

• BOA Contracting Officer (CO)

• Task Order Contracting Officer Representative (TO COR)

• Authorized assessment and evaluation entities (e.g., OCIO, DISC, etc.)

• Assessed and evaluated authorized vendor(s)

12314423Q0144, Amendment 0001, STRATUS Pool 3 SaaS Page 3 of 6

B.1.2.2. USDA Authorized Ordering Entity (Mission Owners) – Authorized Ordering Entities have the following responsibilities as related to all USDA Stratus Pool 3 Task Orders:

a) Cybersecurity Assessments and Evaluations

• Findings and Recommendations - Authorized ordering entities are responsible for receiving and reviewing authorized assessment and evaluation entities' assessment and evaluation findings and recommendations (e.g., reports).

• Suspension and Termination of Task Order(s) - Authorized ordering entities are responsible for evaluating and determining if the findings and recommendations of an assessment and evaluation warrants the suspension or termination (i.e., termination for cause, termination for convenience) of a TO(s) awarded under this BOA.

• USDA Authorization Management Program Reporting - Authorized USDA ordering entities are responsible for reporting and submitting issued ATO(s) to USDA OCIO and FedRAMP. Authorized USDA ordering entities are responsible for reporting and submitting any ATO Assessment & Authorization (A&A) identified inconsistencies (i.e., with FedRAMP authorization, with USDA OCIO authorization), concerns, or issues to OCIO and FedRAMP.

• Cybersecurity Incident Reporting - Authorized USDA ordering entities are responsible for reporting of cybersecurity incidents to the BOA Contracting Officer and to their TO(s) authorized vendors to ensure the authorized vendor can take appropriate mitigation actions.

B.1.2.3 Authorized Vendor – Pool 3 SaaS Services

a) Coordination - Authorized vendors shall be responsible for coordinating assessment and evaluation activities with the authorized assessment and evaluation entities.

Coordination responsibilities shall include planning, execution, and post assessment and evaluation activities (e.g., remediations, POA&Ms).

b) Findings and Recommendations - Authorized vendors shall be responsible for receiving and reviewing authorized assessment and evaluation entities' assessment and evaluation findings and recommendations (e.g., reports).

c) Mitigation and Remediation - Authorized vendors shall be responsible for evaluating, determining, and executing the appropriate mitigation and remediation activities (e.g., fixes, patches, updates) in response to the findings and recommendations of an assessment and evaluation. Findings shall be remediated within established USDA timeframes; 15 days for Critical, and 30 days for all others.

d) Public Disclosure and Release - Authorized vendors shall be responsible for reviewing the written notifications from authorized assessment and evaluation entities including the provided unclassified versions of the assessment and evaluation findings and recommendations and timely reply, within 30 calendar days, 12314423Q0144, Amendment 0001, STRATUS Pool 3 SaaS Page 4 of 6 to the authorized assessment and evaluation entities of any concerns or objections to the public disclosure or release.

B.1.2.4 Cybersecurity Authorization to Operate (ATO)

a) Notification of Terms and Conditions Discrepancies - Authorized vendors shall be responsible for immediately notifying the BOA Contracting Officer when a conflict, discrepancy, or issue is identified between the applicable laws, regulations, policies, and Terms & Conditions of the US, USDA STRATUS BOA, or their TO(s).

b) Performance Conflict Elevation - Authorized vendors shall be responsible for elevating unresolvable performance conflicts with authorized ordering entities to the BOA Contracting Officer for arbitration and resolution.

c) Department of Defense Cloud Authorization Services Authorization(s) - Vendors shall be responsible for obtaining and maintaining DCAS authorization(s) for their CSO(s) (i.e., IaaS, PaaS, SaaS, etc.) in accordance with DCAS regulations and policies.

d) Federal Risk and Authorization Management Program Authorization(s) - Vendors shall be responsible for obtaining and maintaining FedRAMP authorization(s) for their CSO(s) (i.e., IaaS, PaaS, SaaS, etc.) in accordance with FedRAMP regulations and policies.

e) Cybersecurity Incident Reporting - Authorized vendors are responsible for timely reporting cybersecurity incidents to the TO(s) Contracting Authority to ensure awareness of the incident and mitigating actions the authorized vendor is performing.

B.1.3 Applicable Security Controls, Compliance, and Policies Authorized Vendors under the USDA STRATUS BOA for ordering Pool 3 – SaaS Providers shall comply with USDA high level security policy/guidelines, to include:

B.1.3.1 Ensure ongoing Assessment and Authorization (A&A) of the cloud service tenant according to the appropriate level and conform with the Federal Information Security Modernization Act (FISMA), the Federal Information Processing Standards (FIPS) 199 Categorization (Low, Moderate, High), and Office of Management and Budget (OMB) Circular A-130, and Federal Risk Management Program (FedRAMP) standards.

B.1.3.2 Comply and meet thresholds set in the National Institute of Standards and Technology (NIST) SP 800-53 Risk Management Framework “Security and Privacy Controls for Federal Information Systems and Organizations.”

a) CA-1 Security Assessment and Authorization Policies and Procedures - Formal, documented security assessment and authorization policies that address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to

12314423Q0144, Amendment 0001, STRATUS Pool 3 SaaS Page 5 of 6 facilitate the implementation of the security assessment and authorization policies and associated security assessment and authorization controls.

b) CA-7 Continuous Monitoring – The organization establishes a continuous monitoring strategy and implements a continuous monitoring program that includes: a configuration management process for the information system and its constituent components; a determination of the security impact of changes to the information system and environment of operation; Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; and Reporting the security state of the information system to the Authorizing Official at least quarterly.

B.1.3.3 Information and data management shall comply with Executive Order 13556 regarding Controlled Unclassified Information (CUI), Personally Identifiable Information (PII) a subset of CUI, and Sensitive PII a subset of PII that requires additional controls and safeguards.

B.1.3.4 Maintain strong physical security controls, managed access to the virtual environment, and maintain strong separation between virtual workloads and environments. Provide clear segregation of data unless otherwise specified, at the application level, and storage level.

B.1.3.5 Fortified Security – Security that enables cyber defenses from the “root” level of systems through the application layer and down to the data layer with improved capabilities including continuous monitoring and auditing; automated threat detection; resiliency against persistent adversarial threat; encryption at rest and in transits; and an operating environment that meets or exceeds USDA information security requirements.

B.1.3.6 Cybersecurity and Infrastructure Security Agency (CISA) Cybersecurity Division Trusted Internet Connections (TIC) Reference Architecture Document Version 2.0 - TIC is a federal cybersecurity initiative intended to enhance network and boundary security across the Federal Government. The Office of Management and Budget (OMB), the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), and the General Services Administration (GSA) oversee the TIC initiative through a robust program that sets guidance and an execution framework for agencies to implement a baseline boundary security standard.

B.1.3.7 USDA Specific Guidance - The Contractor shall comply with cloud security and privacy requirements specified below including with directed mandates to protect and defend information systems from recurring security threats or in response to real-time vulnerabilities.

a) USDA Department Regulation DR-3650-001 Cloud Computing - This Departmental Regulation (DR) updates the United States Department of Agriculture (USDA) policy for implementing the Office of Management and Budget’s (OMB) Federal Cloud Computing Strategy (Cloud Smart) across the USDA’s information technology (IT) portfolio of information and information systems. Link - https://www.usda.gov/directives/dr-3650-001 https://www.usda.gov/directives/dr-3650-001

12314423Q0144, Amendment 0001, STRATUS Pool 3 SaaS Page 6 of 6

b) FedRAMP compliant as assessed by a third-party assessment organization (as defined in Section 1.1.1 “Authorization and Evaluation Entity”) authorized and accredited for this purpose by the USDA and FedRAMP.

c) Compliant with all FedRAMP controls required for the FISMA Low and Moderate Level of Risk Categorization.

d) At all times be operating under a valid Authority to Operate (ATO) granted by USDA for at least the FISMA Low Level of Risk Categorization.

e) Determined by USDA to effectively meet the controls required by FedRAMP after a pre-award review of the security control test results used to authorize the service. USDA will conduct the pre-award review of the security control test results used to authorize the service within a 2-week window after the technical evaluation is completed but before the award executed. USDA will be responsible for conducting the pre-award review and is solely responsible for making the decision as it pertains to issuance of the ATO.

United States Department of Agriculture

April 18, 2023

MEMORANDUM FOR MISSION AREAS, AGENCIES AND STAFF OFFICES

THROUGH: Anita R. Adkins

Director, Office of Human Resources Management (OHRM)

Donald W. Baker Jr.

Director, Office of Contracting and Procurement (OCP) (Acting)

FROM: Matt Allen

Director, Office of Homeland Security (OHS)

SUBJECT: Hiring of Non-United States Citizens

Effective Date: Upon Release of this Memorandum

Expiration Date: Effective until canceled, superseded or incorporated in Departmental Regulation

BACKGROUND: Executive Order 11935, Citizenship Requirements for Federal Employment (September 2, 1976) restricts appointing non-citizens in competitive service positions covered by Title 5, United States Code (U.S.C.). Since the passage of the Immigration Reform and Control Act of 1986, employers have been responsible for ensuring that the people they hire are eligible to work in the United States (U.S). The Immigration and Nationality Act of 1990 added other requirements, one of which is that employers may not discriminate against employees by requesting more or different documents than those that are required. The Immigration and Nationality Act, as modified, provides at 8 U.S.C. 1324(a), that it is unlawful for a person or other entity to employ an undocumented noncitizen. In 1996, Public Law (P.L.) 104-208 stated that the term “entity” includes an entry in any branch of the Federal Government. Regulations that implement immigration laws are published in Title 8, Code of Federal Regulations (CFR).

48 CFR 3052.204-71 requires that each individual employed under a Federal contract shall be a citizen of the United States of America, or a non-U.S. citizen who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I- 551). Any exceptions must be approved by the Director, Office of Homeland Security (OHS) or designee.

Contractors shall identify in their proposals, the names and citizenship of all non-U.S.

citizens proposed to work under the contract. Any additions or deletions of non-U.S.

citizens after contract award shall also be reported to the CO or COR.

Departmental Administration

Office of the Assistant Secretary for Administration

Independence Avenue, SW Washington, DC 20250-9600

MATTHEW ALLEN Digitally signed by MATTHEW ALLEN Date: 2023.04.18 07:57:48 -04'00'

DONALD BAKER Digitally signed by DONALD BAKER Date: 2023.04.18 11:52:41 -04'00'

ANITA ADKINS

Digitally signed by ANITA

ADKINS

Date: 2023.04.18 19:29:10 -04'00'

PURPOSE: The purpose of this memorandum is to reiterate 5 CFR 7.3, §213.3102(bb), and §338.101, in conjunction with the Immigration Reform and Control Act of 1986, Immigration and Nationality Act of 1990, P.L. 104-208, 8 U.S.C. 13249(a), 8, CFR 274(a), the Consolidated Appropriations Act (Fiscal Year 2022, Division E, Section 704) ban on paying certain non-citizen, general statutory restrictions that may be applicable to Mission Areas, Agencies and Staff Offices, and general statutory restrictions on the expenditure of funds.

APPLICABILITY: This memorandum applies to all positions with the Department of Agriculture (USDA) and its Mission Areas, Agencies and Staff Offices.

POLICY: It is the policy of the Federal Government to employ only U.S. citizens or persons owing permanent allegiance to the U.S. Under 5 CFR 213.3102.31(bb), a non-citizen may be hired in the absence of a qualified citizen when authorized by the Office of Personnel Management (OPM). §7.3(c) grants OPM the authority, as an exception to this rule and to the extent permitted by law, to authorize the appointment of noncitizens to positions in the competitive service when necessary to promote the efficiency of the service in specific cases or for temporary appointments.

Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories who require access to USDA Mission Areas, Agencies and Staff Offices or controlled facilities, Information Technology (IT) systems or security items or products, must be either U.S. citizens or Lawful Permanent Residents, also known as “green card” holders.

Mission Areas, Agencies and Staff Offices shall adhere to the below standard when allowing Federal employees, and any category of non-Federal persons who perform duties in partnership with or on behalf of USDA, to maintain positions designated as the following:

1. Low Risk duties may be performed by a U.S. Citizen or lawful Permanent Resident Alien.

2. Moderate Risk duties may be performed by U.S. Citizen or lawful Permanent Resident

Alien with at least three or more years of U.S. residency from the date of legal entry to the U.S.

3. High Risk duties may be performed only by U.S. Citizens.

4. National Security Positions may be performed only by U.S. Citizens.

Only under exceptional circumstances should a waiver be requested when a prospective Federal employee, contractor, subcontractor, expert, consultant, and paid/unpaid intern does not meet the citizenship or lawful permanent resident alien status requirement. Requests for waivers to the citizenship requirement must be submitted in writing. Non-U.S. citizens employed as Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns shall not be allowed access to USDA Mission Areas, Agencies and Staff Offices or controlled facilities, IT systems, or security items or products prior to the issuance of a waiver.

Non-U.S. citizens must have the appropriate fully adjudicated background investigation before the establishment of a work start date.

Current non-U.S. citizens in a position with higher risker than allowed per this memorandum may be reviewed on a case by case basis in while they continue working in the current position.

If the employee moves positions, they are subject to the security level restrictions.

WAIVER PROCESS: Waivers for non-U.S. citizens performing in low risk/non-sensitive positions are to be requested in writing by the CO or COR through the Mission Area, Agency or Staff Office Security Officer to the Director, OHS for determination.

Waivers for non-US citizen performing in moderate-risk positions are to be requested in writing by the COR, to the CO through a senior executive-level (SES) manager in the business unit that has the contract or through the Mission Area, Agency or Staff Office Administrator (or designee), to the Director, OHS for determination.

Waivers for access to high-risk positions will not be considered for non-U.S. citizens.

Waivers for non-U.S. citizens for positions working in IT positions involving the development of USDA hardware or software products will not be considered if the position involves the design of security models, application integration, customization of software or hardware, or configuration of servers or networks. Waivers will not be allowed if the position has the ability to manipulate, alter or affect the integrity, accessibility or availability of IT maintained information or records.

All waivers involving IT systems must also be routed though USDA’s Chief Information Officer for review prior to Director, OHS approval consideration and final determination.

All waiver requests must include the following1:

1. The full name, date of birth, place of birth, and current citizenship of the applicant.

2. A completed Personnel Vetting Questionnaire (PVQ) commonly referred to as Electronic

Questionnaires for Investigations Processing (e-QIP).2 Note: Applicants can only access the e-QIP system if they have been invited to do so by an appropriate official at their sponsoring agency. Individuals cannot pre-apply for a security clearance, nor update their security questionnaire unless granted access by an appropriate agency official.

3. A position description of the job/duty to be performed.

4. Justification as to why there is no qualifying U.S. citizen or lawful permanent resident alien available or capable of performing the task.

1 The USDA Privacy Program affirms that the privacy of an individual is a personal and fundamental right that should be respected and protected. USDA’s privacy policy is located at https://www.usda.gov/privacy.

2 In June 2023, the National Background Investigation Services (NBIS), eApp (electronic application) is replacing eQIP as the system for initiating investigations.

5. A business case necessitating the waiver.

6. An assessment of the risk associated with granting the waiver.

7. All security countermeasures and actions taken to mitigate the risks associated with the requested waiver.

Points of contact are:

OHRM: Michael Rafferty, Director, Human Resources Policy Division at Michael.Rafferty@usda.gov

OCP: Chief, Procurement Policy Division (PPD) at Procurement.Policy@usda.gov

OHS: Camellia Murdock, Chief, Personnel and Document Security (PDSD) at camellia.murdock@usda.gov