Revised_Section_C-2-2_rev_11-2-2018.pdf

19AQMM18R0311

(Revised 11-2-2018)

C.2.2 SECURITY

a. The Contractor shall develop, provide, implement, and maintain an Information Technology (IT) Security Plan, as detailed in Section F.5.1.1.

b. Included in the IT Security Plan and in accordance with Department standards set out in 5 FAH-11 H-400 and 5 FAM 1066.1-1(F), the Contractor shall develop a NIST 800-53 baseline system security plan for any systems used to process State Department information that are not Department owned (non-Government Furnished Equipment (GFE) systems) and submit the plan, as detailed in Section F.5.1.1.

c. In accordance with the global standards, detailed in Section F.5.1.1, the Contractor shall conduct all required Assessment and Authorization analysis (A&A), as outlined in 5

FAM 1066.

d. The Contractor shall implement network monitoring tools to ensure network security.

e. All proposed uses of Cloud technology that will include the processing of Controlled

Unclassified Information / Sensitive But Unclassified (CUI/SBU) shall be cleared by the Government in advance. Only FedRAMP-approved Cloud Service Providers (CSP) shall be used. Selection of an appropriate CSP shall be based on the level of a Government approved FIPS 199-derived data impact categorization, which will be designated as high.

f. The Contractor shall develop and implement a suitability vetting process plan, included in its proposal, for all Contractor personnel as required by the Government, as specified in Section H.8.4 The Contractor shall provide the Government on a monthly basis or upon request, applicable information regarding its Contractor personnel and the results of all required vetting, as detailed in Section F.6.1.5.

g. All subcontractors proposed by the Contractor shall be subject to review and approval by the Department, as specified in Section H.8.4, prior to engaging in any GSS activities.

h. The Contractor shall develop a fraud prevention approach that will prevent and detect cases of fraud, malfeasance, misfeasance, or other criminal or negligent activity. At the task order level, the Contractor shall develop, deliver, implement and maintain a robust, written Fraud Prevention Plan, as detailed in Section F.6.1.2.

i. The Contractor shall ensure all Contractor personnel are fully briefed and trained on fraud prevention and, where applicable, the contents of the appropriate Fraud Prevention Plan. Contractor personnel shall sign an attestation to their understanding of the Plan and agreement to adhere to the Plan. The Contractor shall provide compliance reports of fraud prevention training to the Government, as detailed in Section F.6.1.3.

j. The Contractor shall, upon suspicion of any Contractor personnel’s possible involvement in inappropriate, unethical, or illegal activities, and/or any other suspected or actual malfeasance or misfeasance, to include but not be limited to criminal, unauthorized, or negligent activity, notify the Government, including the Regional Security Office, within two (2) hours. The Contractor shall take appropriate investigatory action, with preliminary follow-up reporting to the Government within one (1) business day, as detailed in Section F.6.1.4.

k. Upon receiving a Government request to investigate any inappropriate, unethical, or illegal activities, and/or suspected or actual malfeasance or misfeasance, to include but not be limited to criminal, unauthorized, or negligent activity, on the part of Contractor