16PBGC21R0010 Amendment 0001.pdf

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NUMBER

IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

Previous edition unusable

The purpose of this amendment is to provide the Government's responses to the questions received for this solicitation.

1 61

16PBGC21R00100001 MAY 27, 2021 RQ-32-21-000002

PD

PENSION BENEFIT GUARANTY CORP

PROCUREMENT DEPARTMENT

1200 K ST NW

WASHINGTON DC 20005-4026

PRAD

PENSION BENEFIT GUARANTY CORP

Policy, Research & Analysis Department

1200 K ST NW, STE. 240

WASHINGTON DC 20005-4026

16PBGC21R0010

MAY 12, 2021

See Schedule

Attachment Page

PAGE 2 OF 61 16PBGC21R00100001

Item Page # Solicitation Reference Offeror Question PBGC Response

1 N/A N/A Kindly provide us with Incumbent details i.e Value., Historical level of Efforts.

There is no incumbent for this contract.

This is a new contract to build a new system.

2 Key Personnel, Section 5.0

As you know, I work in current PIMS contract (#16PBGC20C0024) under the labor category “Project Manager” which is not a full-time engagement. But this labor category is marked as “Key Personnel”. Since we are going to participate into the TPIMS RFP (#16PBGC21R0010), can I be part of the proposed resource pool or another “Key Personnel”? I will appreciate your earliest response.

The PBGC welcomes interested parties to submit proposals in response to Solicitation 16PBGC21R0010 as it meets the intent of maximizing competition. PBGC, however, cannot comment nor will it provide input on what decisions a potential Offeror must make as part of its bid/no bid decisions.

Attachment 9, Section 5.0, Pages 28 - 30 and Attachment

1 and Attachment 10

Attachment 9, TOR Task Order 1 and Attachment 10, Proposed

TOR Staffing by Labor Category

The Key Personnel functions listed in Section 5.0 of Task Order 1 do not map directly to the labor categories in Attachment 1 and Attachment 10. Do Offerors have to map these specific categories to those in Attachment 1 and Attachment 10?

The Offeror shall map the Attachment 9 (Key Personnel) to Attachments 1 & 10 as they see fit and in accordance with their proposal.

Attachment 9,

2.3.5.2 (Sprint 1 and Beyond), Page 20 and

Attachment 9C

(TPIMS

Roadmap MVP)

Attachement 9, TOR Task Order 1 and Attachment 9C TPIMS

Transformation Roadmap

Task Order 1 indiciates that Sprint 1 will begin three months after contract award, with three months for component setup during Sprint 0. However, the TPIMS Transformation Roadmap indicates that Sprint 1 will begin two months after contract award. Can you please clarify which is correct?

Yes, Attachment 9C shows the baseline security configuration starts in Month 3, PBGC's preferred approach. However, if during Sprint 0, the Contractor is ready to begin this step early, they are encouraged to do so.

5 Page 1 Attachement 9, TOR Task Order

The table indicates that this Task Order 1 will not have any other direct costs associated with it. Can you please confirm that the Contractor would not be responsible for any infrastruture, materials, or other non-labor costs associated with this task order?

Correct.

6 Page 21 Attachement 9, TOR Task Order

Task Order 1 indicates that the "Contractor may also need to collaborate with parties outside of PBGC when setting up APIs for T-PIMS." Do you anticipate that the T-PIMS system would pull in data via third-party APIs, or would the system also be expected to expose T-PIMS data and results to parties outside PBGC via API?

The APIS that T-PIMS will consume is in the Blueprint (Attachment 9-B).

Third party data might be pulled in via API, from Form 5500s and economy scenarios for example. We are not anticipating to expose T-PIMS data or results to parties outside of PBGC via

API.

Page 23, Section C.4.2.1.3, Item A and Page 27

C.4.2.2.7

IDIQ

Can PBGC make available to bidders documentation on their Risk Management Framework (RMF) process and their Cybersecurity and Privacy Catalog?

Yes, attached please find the RMF.

Also attached is the PBGC's Information Security Directive. We recommend Offerors review NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. Due to senstivity, the CPC can be made available to the awardee. The awardee will have a PBGC Information System Security Manager made available for this project.

Section F.4, IDIQ

This section provides a physical address for the submission of deliverables to the COR. Will hard copies of deliverables be required or are electronic submissions of deliverables acceptable?

It is most likely that deliverables are submitted electronically to the COR within PBGC's network using emails, SharePoint, OneDrive, etc. provided by PBGC; however, exceptions will be determined by the COR in coordination with the Contractor at the appropriate time.

Solicitation No. 16PBGC21R0010

Pension Benefit Guaranty Corporation (PBGC) Transformational Pension Insurance Modeling System (T-PIMS)

Questions AND Answers to the above-referenced Solicitation

PAGE 3 OF 61 16PBGC21R00100001

Page 21, Section

C.4.1.3.1, Paragraph 1

IDIQ

Section C.4.1.3.1 specifies full Contractor support of the Transition In from the incumbent, while 4.1.3.2 specifies a Transition Out of 2 months. Should bidders assume a 2 month Transition In with the incumbent, and that the incumbent or PBGC will provide the TPIMS Contractor with a Transition Strategy?

There is no incumbent for this contract.

This is a new contract to build a new system. Thus, there is no Transition in.

Page 99, Section L.2, Factor 3, 1st

Bullet

IDIQ and Attachment 9, TOR Task Order 1

Task Order 1 indicates that Section "4.2.2 Execution Services: Modernizations Services" from the IDIQ are covered under this task order. However, certain subtasks under 4.2.2 appear to cut across Modernization, Enhancement, and Maintenance. Can you provide additional guidance as to which subtasks under 4.2.2 should be included under Factor 3, as opposed to Factor 4?

Offerors shall propose their approach to the TO Modernization effort, and determine which parts of Execution Services apply to Modernization vs. to the Enhancement and Maintenance.

11 Page 109 Factor 5: Past Performance

On page 109, the past performance evaluation criteria states that the past performance factor will in part be evaluated on "information from references provided by the Offeror and from any other reliable source available to the PBGC such as an official past performance database and/or other government and local agencies (e.g. CPARS, FAPIIS, etc.)." Would the government please confirm that corporate, commercial past performances would be acceptable in addition to Government past performances as they would not be in the CPARS or FAPIIS systems?

Yes, Offerors may provide corporate past performance information with their proposals. Offerors must adhere to the Instructions to Offerors and Evaluation Criteria stated in the solicitation.

12 Page 28-29 TOR Section 5: Key Personnel

Microsoft has retired the AZ-300 and AZ-301 exams and replaced them with the AZ-303 and AZ-304 exams.

Would the Government please confirm that the AZ-303 exam would be acceptable in place of the AZ-300 and the AZ-304 exam would be acceptable in place of the AZ- 301?

Yes.

Page 6 & 7, Para 1 & 3 Page 102-103

B.5 IDIQ PRICING SCHEDULE;

Attachment 9 TOR Task Order 01;

Attachment 2 Price Schedule for Task Order 01 L.3.2 Task Order 01 Price Proposal

The Contractor shall use the labor categories, fixed fully burdened hourly rates for the Base and Option periods from the IDIQ Price Schedule to develop the task order business/price proposals.

For task orders designated as LH or T&M, and as specified in RFTOPs, the Contractor shall propose a total cost estimate using labor categories and fully burdened labor rates approved in the IDIQ Price Schedule with estimated total hours for each labor category and estimated material costs, if applicable.

Task Order 1 is a LH Task order with one 27-month base period. Attachment 2 provides for input of one rate for the full 27-month period of performance. In addition Section L.3.2 indicates the TOR proposed hourly rates shall not exceed the corresponding IDIQ rates identified in Attachment 1.

Q: Are offerors permitted to alter the Attachment 2 format to propose the IDIQ Base Year rates (with discounts as applicable) for the first 12 months, Option Year 1 rates for the second 12 months, and Option Year 2 rates for the additional 3 months?

No.

14 p. 109 IDIQ Factor 5: Past Performance

For commercial past performances, please confirm that the Government will accept a detailed corporate description with associated relevance to the project, with a sanitized company name due to privacy and contractual agreements?

Offerors may provide corporate past performance information with their proposals. Offerors must adhere to the Instructions to Offerors and Evaluation Criteria stated in the solicitation.

15 p. 103

20_Solicitation_TPIMS_IDIQ_an d_TO1_rev_05_11_2021 L.3 Volume II - Business / Price Proposal

Task Order 1 price proposal asks for hourly rate discounts, if applicable. Attachment 2 does not include a column for a discount. Please confirm that offerors shall place the discounted rate in Attachment 2, Column D ("Hourly Rate"), and do not need to show the IDIQ rate and discount offered within Attachment 2.

Attachment 2 may be modified to add a column to show the discount. PBGC wants to see both the IDIQ rate and the discounted rate, if discounts are being offered.

PAGE 4 OF 61 16PBGC21R00100001

16 All General

Who is the incumbent on this engagement? If no incumbent, who developed the framework?

There is no incumbent for this contract.

This is a new contract. The solicitation refers to two frameworks, the IT Solutions Lifecycle Management (ITSLCM) Framework (Attachment 6) and the Risk Management Framework.

These frameworks were developed by

PBGC.

17 All General

Would the organization who developed the framework be OCIed out of participating in this engagement given their unfair advantage to both the program and having shaped the implementation roadmap?

At the time of these question(s), the PBGC is not in a position to make a decision around OCI issues. The solicition is clear to potential Offerors on requirements for potential OCIs.

18 98 Solicitation section L.2 VOLUME

I - TECHNICAL PROPOSAL

Are letters of commitment required if the proposed personnel are full time employees of the prime contractor?

Yes. Letters of commitment are required for all Key Personnel even if employees.

19 104 Solicitation section L.4 Volume II Small Business Participation

For bidders who are other than small business, please confirm that the 23% for small business is inclusive of the 16% for the small business designations outline?

Therefore, the requirement to subcontract to small business is 23% and not 39%.

In Section L.4, the "23 percent of prime contracts for small businesses" referenced is inclusive of the subcategories of small businesses listed below that statement.

20 64

H.13 PBGC 52.237-7002

FITNESS DETERMINATION

(APR 2019)

Please confirm that personnel assigned to the contract are not required to be US citizens and can be US citizen, US residences (green card holders) or foreign nationals holding secondment US work visas.

Potential Offerors must adhere to all aspects of the clause at H.13 PBGC 52.237-7003 for all proposed personnel.

21 64

H.13 PBGC 52.237-7002

FITNESS DETERMINATION

(APR 2019)

Please confirm offshore resources can be utilized if the contractor provides evidence of proper and approved background checks performed at the contractor's own expense?

Potential Offerors must adhere to all aspects of the clause at H.13 PBGC 52.237-7003 for "offshore resources".

22 6 Attachment 9 Task Order 1

Does PBGC require the contractor to provide training in Agile methodologies? If so, what is the level of training expected?

The Federal Product Owner and Federal Product Manager are Scrum Alliance Certified. The contractor is to provide training in their specific use of Agile, per TO 1 Section 2.4.1.

PAGE 5 OF 61 16PBGC21R00100001

Information Security Risk Management Framework (RMF) Process

February 2021 Version 4.0

Prepared by:

PBGC Office of Information Technology (OIT) Enterprise Cybersecurity Department (ECD)

1200 K Street, NW Washington, DC 20005

PAGE 6 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 2 of 41

Approval

This Information Security Risk Management Framework (RMF) Process document is considered approved and ready for use at PBGC according to the undersigned.

Tim Hurr Date Chief Information Security Officer (CISO) Office of Information Technology

Shawn Hartley Date Chief Privacy Officer (CPO) Office of General Counsel

PAGE 7 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 3 of 41

Version History

This is the Version History Table

Version Number Date Author Description

Draft 1.0 Feb. 5, 2016 Initial draft.

Draft 1.1 April 8, 2016 Updates per comment adjudication.

Draft 1.2 April 18, 2016 Final draft.

Draft 2.0 May 23, 2017 Sue Schultz

Searcy Annual Update and Review (Update of Artifact Table with RMF Step and CSAM Location; Addition of RMC and RMO to tier structure; addition of IT Program and Project Managers to tier structure; Addition of language on security authorization extension and decommissioning of system/component or application.)

Draft 2.1 August 2017 Sue Schultz Searcy

Update to Figure 10 and Sections 3 and 4

Final 2.2 Sept. 2017 Sue Schultz Searcy

Added signature page

Draft 3.2 January 28, ECD Annual updates and inclusion of NIST SP 800-37 rev. 2 updates.

Draft 3.3 March 22, ECD Incorporated feedback to draft from ECD and Privacy Office

Final 3.4 May 2, 2019 ECD Incorporated Comments and Feedback from Cybersecurity and Privacy Council.

Final 3.5 February 20, ECD Updated the Responsibilities of Risk Executive to align to Responsibilities of Risk Executive outlined in IM-05-02.

Draft 4.0 Sept. 2020 ECD Updated formatting.

Final 4.0 February 2021 ECD Annual update and incorporation of comments and feedback from Cybersecurity and Privacy Council.

PAGE 8 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 4 of 41

Table of Contents

1. Introduction

1.1 Overview

1.2 Purpose

1.3 Scope

1.4 Reference Documents

1.5 Authority

2. Information System Level

3. PBGC’s Risk Management Framework Process

3.1 Step 0 – Prepare

3.2 Step 1 – Categorize

3.3 Step 2 – Select

3.4 Step 3 – Implement

3.5 Step 4 – Assess

3.6 Step 5 – Authorize

3.7 Step 6 – Monitor

3.8 Cloud Systems

4. Mission and Business Level

4.1 Cybersecurity and Privacy Council

4.2 Enterprise Architecture (EA)

4.3 Information Technology Portfolio Review Board (ITPRB)

4.3.1 ITPRB Briefings

5. Corporation Level

5.1 RMF Process

Appendix A: Roles and Responsibilities

Appendix B: PBGC Information Security RMF Acronyms

PAGE 9 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 5 of 41

1. Introduction

The Enterprise Cybersecurity Department (ECD) provides compliance oversight for PBGC’s cybersecurity program. The program is based on guidance provided in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 rev 2, Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems: A Security Life Cycle Approach; NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View; mandates identified in the Federal Information Processing Standards (FIPS) Publication (Pub)199, Standards for Security Categorization of Federal Information and Information Systems; FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems; and PBGC enhancements created to accommodate the Corporation’s environment. This document is used as a companion PBGC process document to the relevant NIST standards and guidance outlined in this document.

The PBGC Information Security Risk Management Framework (RMF) Process provides guidance necessary for determining, documenting, tracking, and reporting: an information system’s mission areas, and the overall agency’s security and privacy risks, thereby improving cybersecurity and privacy risk management within PBGC. The intent of supporting these activities is to evaluate information systems against documented information security and privacy requirements, verify information security and privacy control test results, summarize the residual risk, and involve the agency’s information owners (IOs), information system owners (ISOs) and authorizing officials (AOs) in making risk-based decisions as part of the security lifecycle of information systems.

This document relies on additional resources, such as templates and guides that can be retrieved from the ECD intranet site. The information and instructions in this process will support authorizing officials in making informed, risk-based decisions. This RMF process will also help assess for the viability of a system to operate in the PBGC production environment without causing undue harm to people, data or the environment.

1.1 Overview

Cybersecurity and Privacy risk to information and information systems is managed at three different levels within PBGC: (1) corporation-wide; (2) business/mission function, and (3) information system. These three levels form the PBGC Information Security RMF. The document references risk managed at all three levels but focuses its guidance on the third level. Management of cybersecurity and privacy risks, includes (a) building information security capabilities into federal information systems through the application of security controls; (ii) integrating privacy requirements and capabilities into federal information systems (iii) maintaining awareness of the security and privacy state of information systems on an ongoing basis though enhanced monitoring processes; and (iv) providing essential information to senior leaders to facilitate decisions regarding the acceptance of risk to organizational operations and assets, individuals, and other organizations arising from the operation and use of information systems. To comply with the Federal Information Security Modernization Act (FISMA) of 2014, PBGC information systems must have an authorization-to-operate (ATO) prior to being utilized in the production environment.

1.2 Purpose

This guide establishes the Information Security RMF process to:

• Promote the concept of near real-time risk management and ongoing information system authorization through the implementation of robust continuous monitoring processes.

PAGE 10 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 6 of 41

• Provide guidance on utilizing the Cybersecurity Assessment and Management (CSAM) tool, PBGC’s system of record, for categorization, selection, implementation, assessment, and monitoring of security and privacy controls, and the authorization of information systems.

• Establish responsibility and accountability for security and privacy controls deployed within organizational information systems and inherited by those systems (i.e., common controls).

• Establish the methods for communicating risk management governance from a higher level to a lower level and for communicating any cybersecurity and privacy risk from a lower level to a higher level within the RMF.

• Align the RMF steps and process to the NIST Framework for Improving Critical Infrastructure Cybersecurity (i.e. Cybersecurity Framework.)

PBGC ISOs, IOs, Information System Security and Privacy Officers (ISSPOs), Information System Security Managers (ISSMs), Common Control Providers (CCPs); CCP POCs and AOs are required to utilize this process to facilitate:

• The establishment of required security and privacy-related documentation within the CSAM tool.

• Utilizing CSAM:

o Categorization of the information systems.

o Selection and tailoring of security controls that mitigate the risk associated with the confidentiality, integrity, and availability of information processed, stored, or transmitted by PBGC or third party owned and operated systems.

o Selection and tailoring of privacy controls that mitigate the risk associated with the predictability, manageability, and disassociability of PII information processed, stored, or transmitted by PBGC or third party owned and operated systems.

o Assessments of the security and privacy controls to validate the controls are operating as intended; and Remediation actions for security and privacy weaknesses identified within the information system (i.e. POA&M management and documentation of Risk Acceptance).

1.3 Scope

This process applies to all PBGC FISMA reportable information systems, including contractor and cloud-based information systems owned by or operated on behalf of PBGC. All ISOs, IOs, ISSMs, ISSPOs, CCPs, CCP POCs and AOs are required to follow the steps identified in this process to successfully complete security and privacy authorization or reauthorization of their systems and major applications, input the information and results in CSAM, and authorize the system/application for operation.

1.4 Reference Documents

The PBGC IT Security RMF Process meets the requirements prescribed by the Office of Management and Budget OMB and National Institute of Standards and Technology (NIST) Special Publications (SP), by following the guidance provided in them. Specifically

• FISMA Act of 2014, Office of Management and Budget in Circular A-130, Appendix III, Security of Federal Automated Information Resources

• Office of Management and Budget in M-14-04, FY 2013 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management.

• Office of Management and Budget Memorandum M-17-25 Reporting Guidance for Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.

PAGE 11 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 7 of 41

NIST Special Publications mentioned in this document include but are not limited to NIST SP 800-37 rev. 2; NIST SP 800-39; NIST SP 800-18; NIST SP 800-34 rev.1; NIST SP 800-53; NIST SP 800-53B; NIST SP 800-53A;

NIST SP 800-63-3; NIST SP 800-60 Vol. I and II; NIST SP 800-115; NIST SP 800-137; NIST SP 800-145; NIST SP 800-171; and NISTIR 8062. In addition, current PBGC documentation uploaded to the PBGC Directives page and the PBGC OIT Process and Procedures Library (PPL) are also referenced in the document.

1.5 Authority

The PBGC Chief Information Officer (CIO) has the authority to develop, implement, and manage IT security processes and procedures to protect the availability, confidentiality, and integrity of PBGC IT resources. The PBGC Senior Agency Official for Privacy (SAOP) has the authority to develop, implement, and manage PBGC privacy policies, processes, and procedures to protect the predictability, manageability, and disassociability of Personally Identifiable Information (PII). The PBGC Chief Information Security Officer (CISO) and SAOP/CPO shall ensure Information Security & Privacy policy and requirements are developed consistent with applicable regulations including the Clinger-Cohen Act, FISMA; OMB policy, Executive Orders, FIPS, NIST publications;

and internal policies and directives.

PAGE 12 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 8 of 41

NIST-Defined Risk Management Framework

NIST SPs 800-37 rev. 2 and 800-39 define the levels of the organization-wide Risk Management Framework.

The RMF promotes the concept of near real-time risk management that sustains the risk posture achieved through effective categorization, control selection, implementation, and baseline assessments through ongoing information system authorization and a robust continuous monitoring program. The RMF encourages the use of automation to provide stakeholders with the information to make cost-effective, risk-based decisions.

The RMF (Figure 1) provides an integrated organization-wide approach at the following levels: Information System level; Mission and Business level, and Corporation level.

Information System Level

All information systems, including operational systems, systems under development, and systems undergoing modification, are in some phase of the IT Solutions Life Cycle Management (ITSLCM). Risk management activities take place at every phase in the system development life cycle with outputs at each phase influencing subsequent phases.

Cybersecurity and privacy risks are managed at the Information System level of the RMF through the Risk Management process. The Information System level implementation process is detailed in Section 2 of this process document.

Figure 1 NIST-Defined RMF

PAGE 13 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 9 of 41

Mission and Business Process Level

The Mission and Business Process level addresses risk from a mission/business process perspective by designing, developing, and implementing mission/business processes that support the missions/business functions defined at that level.

The CIO Programs are essential to the CIO Operations and contribute to the OIT’s Mission objectives. The core CIO IT Program Areas are Policy and Compliance, Enterprise Architecture, IT Portfolio Management, the Program Management Office, the Information Technology Infrastructure Operations Department and the operational side of Enterprise Cybersecurity. IT Programs in the PBGC IT Portfolio are Information Systems that enable PBGC to perform their operations in an automated manner, typically managed collectively by both IT and Business Program Managers. IT and Business Program Managers are supported by IT and Business Project Managers. More information regarding these programs can be found in the IT Risk Management Strategy and Process1 document.

PBGC implements the Mission and Business level of the RMF through the Cybersecurity and Privacy Council, Enterprise Architecture, and the Information Technology Portfolio Review Board (ITPRB). The Mission and Business level implementation is detailed in Section 4 of this process document.

Corporation Level

The Corporation level addresses risk from an organizational perspective by establishing and implementing governance structures that are consistent with the strategic goals and objectives of organizations and the requirements defined by federal laws, directives, policies, regulations, standards, and mission/business functions. Governance structures provide the oversight for the risk management activities conducted by PBGC and include (i) the establishment of a risk executive (function)2; (ii) the establishment of the organization’s risk management strategy including the determination of risk tolerance; and (iii) the development and execution of organization-wide investment strategies for information resources, information security, and privacy.

PBGC implements the Corporation level of the RMF through its risk management, executive management and budget planning process, consisting of the Budget Planning Integration Team (BPIT), Executive Management Council (EMC), the Risk Management Council (RMC) and Risk Management Officer (RMO), which are responsible for coordination of PBGC-wide Enterprise Risk Management (ERM) program. Information security governance and oversight is provided by ECD and the Privacy Office. The Corporation level implementation is detailed in Section 5 of this process document.

2. Information System Level

At the Information System level, security professionals identify, assess, manage, mitigate and accept cybersecurity risk and privacy risk at the information system level. The Information System level of the RMF consists of seven different steps. These seven steps integrate with the PBGC IT Solutions Life Cycle Management (ITSLCM) framework, align to the NIST Cybersecurity Framework (CSF), and ensures PBGC’s IT systems and technology operate with an acceptable level of risk, as prescribed in Federal laws, regulations, and mandates and guidance.

1https://pbgcgov.sharepoint.com/EGD/PCD/Pages/PPL_Home.aspx 2 The roles and responsibilities of the risk executive (function) are described in Special Publication 800-37R2, Appendix D, Pg. D-2.

PAGE 14 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 10 of 41

Figure 2: Security and Privacy Assessment and Authorization Process

The authorization package consists of the System Security Plan (SSP); Security Assessment Report (SAR); and the Plan of Action and Milestones (POA&Ms). Additional documents are also required to provide additional information regarding risk management for the system. The table below is a guide for the required documents and aligns them to the seven step RMF process identified in Figure 2. These documents are required for Authorization to Operate;

Migration to Ongoing Authorization and Continuance in Ongoing Authorization reviews. These documents are required to be uploaded in the Cyber Security Assessment Management (CSAM) tool, as CSAM is PBGC’s official and authoritative repository for system authorizations (see section 3.1 for more information). Virtual containers for each artifact are provided under the “Status and Archive” page within CSAM. Authorization document templates may be found on the ECD Intranet site3.

3 The ECD intranet site is at https://pbgcgov.sharepoint.com/CIO/ECD/pages/Default.aspx.

PAGE 15 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 11 of 41

Table 1 – Assessment and Authorization Required Documentation

Required Documentation RMF Step CSAM Artifact Location

FIPS-199 (Mandatory template required)

Categorize (Annual review by ISSPO required. Signatures of AO, CISO, and

SAOP only required if change in categorization)

Status and Archive Page: FIPS 199

Privacy Threshold Analysis (PTA) (Mandatory template required)

Categorize (PTA: Annual review by Privacy Office to be completed)

Privacy Page: PTA Date Completed Field Required.

Privacy Impact Assessment (PIA) (Mandatory template required)

Categorize (PIA: Only required for PII systems;

Annual review by ISSPO required.

Privacy Office to review; Signatures of ISO/IO and AO required.)

Privacy Page: PIA Date Completed Field Required.

System of Records Notice (SORN) – if applicable Categorize

These documents are stored on the Privacy Intranet Page to include SORN

ID and the latest date Published in Federal Register. These documents are not stored in CSAM, however should be referenced in the PIA.

Authorizing Official (AO) Appointment Letter (Mandatory template required)

Categorize (Review and update as needed, i.e. new individual or change in template)

Status & Archive Page: Appointment Letters

Information System/Information Owner (ISO/IO) Appointment Letter

(Mandatory template required)

Categorize (Review and update as needed, i.e. new individual or change in template)

Status & Archive Page: Appointment Letters

Information System Security and Privacy Officer (ISSPO) Appointment Letter

(Mandatory template required)

Categorize (Review and update as needed, i.e. new individual or change in template)

Status & Archive Page: Appointment Letters

Information System Security Manager (ISSM) Appointment Letter (if applicable to the system) (Mandatory template required)

Categorize (Review and update as needed, i.e. new individual or change in template)

Status & Archive Page: Appointment Letters

Risk Assessment (This will include both security and privacy risks)

Prepare (Annual review by ISSPO required. Signatures of ISO/IOs and

AOs required only for new systems or if change to system occurs.)

Status & Archive Page: Risk Assessment; Date Completed and Next

Due Date Fields Required.

System Security Plan (SSP) – generated from CSAM (This document also serves as the System Privacy Plan) (CSAM generated SSP required)

Implement (Annual review and signature of ISSPO, ISO/IO and AO required)

Status & Archive Page: System Security Plan; Date Completed and

Next Due Date Fields Required

Completed SSP Signature Page (ISO/IO, ISSPO, AO signatures) (This document serves as the System Privacy Plan Signature Page)

Implement Status & Archive Page: System Security Plan

Interconnection Security Agreement (ISA) – if applicable

Implement (Annually review required and upload checklist to CSAM; if ISA is not applicable but connections exist, document connections in CSAM)

System Information: Relationships Page: Artifacts

Information Security Continuous Monitoring (ISCM) Plan (This document

Implement (Annual review by ISSPO required and update as needed. Status and Archive Page: ISCM

PAGE 16 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 12 of 41 serves as the System Privacy Continuous Monitoring Plan)

Signatures of ISSPO, ISO/IOs, and AOs required for all new and updated documentation)

System Incident Response Plan (IRP) (Mandatory template required for on premise information systems)

Implement (Annual review by ISSPO required and update as needed.

Signatures of ISSPO, ISO/IO, and AO required for new and updated documents.)

Continuity and Incident Response Page: Incident Response Plan: Date Completed and Next Due Date Fields

Required

System Incident Response Test Implement (Test required annually)

Continuity and Incident Response Page: Incident Response Test: Date Completed and Next Due Date Fields

Required System Contingency Plan (Should include the system BIA either as an appendix to System Contingency Plan or as a separate document under the BIA container in CSAM)

Implement (Annual review by ISSPO required and update as needed.

Signatures of ISSPO, ISO/IOs and AOs required for new and updated documents.)

Continuity and Incident Response Page: Contingency Plan; Date

Completed and Next Due Date Fields Required

System Contingency Plan Test Monitor (Test required annually)

Continuity and Incident Response Page: Contingency Plan Test; Date Completed and Next Due Date Fields

Required

System Configuration Management Plan

Implement (Annual review by ISSPO required and update as needed.

Signatures of ISO/IOs and AOs required for new and updated documents.)

Status & Archive: Configuration Management; Date Completed and

Next Due Date Fields Required

Security Assessment Report (SAR) (This document will serve as the Privacy Assessment Report) (CSAM generated

SAR required)

Monitor (Internal Systems: SAR Report should be generated following

Assessment step and uploaded at least annually in CSAM.

External Systems: Systems can use the annual reviews of contractor systems’ authorization packages or documentation or annual reviews of the

Cloud Service Provider’s FedRAMP Portal as evidence of review of the external SAR.

Status & Archive Page: Security Assessment Report (SAR)

Risk Acceptance Form – if applicable (only requires CISO signature for

Enterprise Risk not system-level risk;

SAOP signature required for all risk acceptances on PII systems)

Assessment/Monitor (Annual review by ISSPO required and updated as needed.

Signatures of ISSPO, ISO/IOs and AO required for new and updated documents.)

Status & Archive Page: Risk Acceptance Memos

Plan of Action and Milestones (POA&M)

Internal Systems: POA&M Report required to be generated prior to

Authorization and uploaded annually in

CSAM.

External Systems: Systems can use the annual reviews of contractor systems’ authorization packages or documentation or annual reviews of the

Cloud Service Provider’s FedRAMP Portal as evidence of review of the

Status & Archive Page: POA&M Report

PAGE 17 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 13 of 41 external POA&Ms or remediation activities. (Monitor Step).

SAOP and CISO Certification Letter – provided by Privacy and ECD (Mandatory template required)

Authorization (Prior to AO Signature of ATO or ongoing authorization memo)

Status & Archive Page: Certification Letter

Authority to Operate (ATO) or Ongoing Authorization Letter or Authorization to

Use (ATU) (Mandatory templates required)

ATO or ATU: (Required review and signature upon expiration; Ongoing Authorization: Annual review and signature required)

Security Authorization Page; Initial Authorization; Last Authorization; Next Due Date and Expiration Date Fields

Required.

Table 1.0 Assessment and Authorization Required Documentation

ECD and the Privacy Office provide a Security and Privacy Assessment & Authorization (SPAA) review to certify the accuracy of the documents.

PAGE 18 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 14 of 41

3. PBGC’s Risk Management Framework Process

3.1 Step 0 – Prepare

The purpose of the Prepare step is to perform tasks at the organization, mission and business and system levels to help prepare the organization to manage cybersecurity and privacy risks using the Risk Management Framework Process.

Tasks within the Prepare step map to the NIST CSF and include: Identify function area: Asset Management, Business Environment, Risk Assessment, Governance, and the Protect function area: Information Protection Processes and Procedures and the Detect function area: Continuous Monitoring.

There are several tasks that are defined under the Prepare step. Some tasks are completed by the organization, such as establishment of Organizationally Defined Parameters (ODPs). Other tasks, such as inheritance of Offered Common Controls are executed at the system level.

At the organization level, Risk Management roles, Risk Management Strategy and Organizational Risk Assessment, are performed by the Risk Executive function. The Risk Executive function is carried out by the Risk Management Council with input from PBGC’s Chief Information Officer, Chief Information Security Officer, Senior Agency Official for Privacy and Chief Privacy Officer (see Appendix A for a full list of roles and responsibilities regarding the risk executive function.)

The individuals involved with the Risk Executive function are also involved in the identification and appointment of Risk Management roles at the system level. The CIO, CISO and SAOP have obligations to appoint Authorizing Officials (AOs); Information System Security and Privacy Officers (ISSPOs) and Information System Security Managers (ISSMs) for information systems.

The Cybersecurity and Privacy Council, chaired by the CISO and Chief Privacy Officer (CPO), work to develop and approve cybersecurity and privacy policies4, process, procedures and guidance as needed. The Council also serves to approve Organizationally Defined Parameters (ODPs) in security and privacy controls, offered Common Controls, and the Enterprise Continuous Monitoring Strategy.

Enterprise level tasks to be completed within the Prepare Step, which include:

Organizationally Defined Parameters (ODPs)

The Cybersecurity and Privacy Council is responsible for the development, maintenance, and approval of the Cybersecurity and Privacy Catalog (CPC), which includes a minimum baseline of security and privacy controls and the Organizationally Defined Parameters (ODPs).5 The ODPs apply to all PBGC information systems. The Council reviews and updates the ODPs as necessary.

Enterprise Common Controls (ECCs)

4 IM-05-02 PBGC Information Security Policy is available through the PBGC Directives page at https://pbgcgov.sharepoint.com/Directives/PBGC_Directives/IM%2005-02.pdf 5 The Cybersecurity and Privacy Catalog (CPC) is available through the OIT PPL:

https://pbgcgov.sharepoint.com/EGD/PCD/Pages/PPL_Home.aspx

PAGE 19 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 15 of 41

The Enterprise Common Control (ECC) program promotes cost-effective security across PBGC Federal Information Systems Management Act (FISMA) reportable systems. The ECC program provides visibility into the protection capabilities that can be inherited from a Common Control Provider (CCP), thus centralizing overall controls and reducing the cost of implementing and assessing controls. Allocating common controls in alignment with the NIST CSF and continuous monitoring promotes a level of continuity for PBGC’s information system protection needs.

The ECC program is managed through the Office of the Chief Information Security Officer and controls under the enterprise offerings are documented in CSAM. Changes to the enterprise common controls are managed through the ECC Change Request Process6. Performance measures are monitored and reported to support the PBGC’s organizational risk management efforts through the PBGC IT Risk Management Process and Procedures.

Enterprise Continuous Monitoring (ECM) Strategy

The ECM program defines the process for implementing continuous monitoring to provide situational awareness of threats and vulnerabilities, and insight into the effectiveness of deployed security controls through implementation of the ECM Core Controls. Core Controls are defined and reviewed annually by the ECM program to allow visibility into control status at the system-level for better informed cybersecurity decisions. The ECM program provides integral support to securing PBGC’s IT to ensure confidentiality, availability, and integrity of systems and data. The ECM Strategy and Plan can be found under the Enterprise Continuous Monitoring site.

There are also several System level tasks to be completed within the Prepare Step, which include:

System Boundary Determination

The business should review and determine the business functions and missions and business processes that the system is intended to support. The business should also identify all assets and components that will be included within the information system and prioritize their development, maintenance and use within the information system. The business should also begin to identify the types of information being processed, stored and transmitted by the information system a more complete categorization will be done using FIPS 199 during the Categorization step of the RMF Process.

The business should refer to the PBGC System Authorization Boundary Determination, Registration and Decommissioning Guidance 7 document for further guidance on creation and structure of information systems.

Appointment Letters

For a new system boundary, the system roles must be appointed. The Authorizing Official (AO) will be appointed by the PBGC CIO. The Information System Owner (ISO) or Information Owner (IO) will be appointed by the Authorizing Official. The Information System Security and Privacy Officer (ISSPO) will be appointed by the CISO and SAOP; and the Information System Security Manager (ISSM) will be appointed by the CISO and SAOP.

The Common Control Providers (CCPs) will be appointed by the CISO.

6 The ECC Change Request Process is available through the OIT PPL.

7 Security Authorization Boundary Determination, Registration and Decommissioning Guidance is available through the OIT PPL.

PAGE 20 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 16 of 41

All appointments utilize an appointment letter signed by the individual accepting the position and its associated responsibilities. A key element of the appointment letter shall be the annual role-based training requirement specific to that role. This requirement shall be included in every appointment letter. All appointment letters shall be uploaded in CSAM on the Status and Archive Page under Appointment Letters. All System Points of Contact (AO, ISO/IO, ISSPO and ISSM) shall be reviewed periodically by the ISSPO on the CSAM Points of Contact page to ensure the POC’s align with the applicable appointment letters.

Use of CSAM

CSAM is the PBGC system of record for system authorizations. All security and privacy control implementation statements and control assessments are to be completed and maintained in CSAM. When a system is added, CSAM will automatically apply the baseline controls from NIST SP 800-53 based on the system’s categorization.

CSAM shall be used for the documentation of control inheritance from the PBGC Enterprise Common Controls (ECCs). ECCs can be fully or partially inherited by a system. The inheritance decisions are based on analysis of the system-level control requirements and the ability of the inheriting system to satisfy the conditions of inheritance imposed by the Common Control Provider (CCP). ECCs are owned by a CCP, which will be responsible for performing Continuous Monitoring activities for the controls being provided. PBGC ECCs are identified through the ECC program and are available for inheritance through CSAM. CSAM shall be used to develop the System Security Plan (SSP) and shall be maintained in CSAM.

System Level Risk Assessment

Risk management is the ongoing process of managing risks to PBGC operations (including mission, functions, image, or reputation), PBGC assets, or individuals resulting from operating an information system (general support system (GSS) or major application).

Proper risk management requires steps to be taken to reduce the risk level to an acceptable level. A team led by the ISSPO and the ISO/IO or ISO/IO designee should perform a risk assessment for all new systems and systems undergoing major modification. For existing information systems that have not undergone any significant changes, an annual review of the system level risk assessment is required.

A risk assessment is the methodical identification of: (i) threats to a system or information processed or stored by the system; (ii) vulnerability of the system to threats; (iii) probability, or risk, a given threat could exploit the vulnerabilities; and (iv) the effectiveness of current or proposed safeguards/controls.

The risk assessment team identifies the controls in place and additional controls needed to provide adequate security for the system and reduces the risk level to one acceptable to the ISO/IO or delegate. The ISO/IO or delegate then performs periodic testing of the controls to monitor the continued adequacy of system. The system shall document the system level Risk Assessment or the annual review of the system level Risk Assessment and upload documentation to CSAM.

3.2 Step 1 – Categorize

The purpose of the Categorize step is to inform organizational risk management processes and tasks by determining the adverse impact to organizational operations, assets, individuals, other organizations, and the National with respect to the loss of confidentiality, integrity and availability of organizational systems and the information processed, stored and transmitted by those systems.

PAGE 21 OF 61 16PBGC21R00100001

Information Security Risk Management Framework Process

SE-PRO-09-01 Page 17 of 41

Tasks in the Categorize step map to the NIST CSF including: Identify function area: Asset Management

The ISO/IO should take into consideration the enterprise architecture, the sensitivity of the data, and the information security architecture to ensure individual systems are categorized based on the mission and business objectives of the organization. This step is accomplished through a FIPS 1998, Privacy Threshold Analysis, Privacy Impact Analysis (if necessary), and System of Records Notice (if necessary).

FIPS 199

The FIPS 199 is used to…