Att__2_IT_Security.pdf

Attachment #2

Information Technology Security and Privacy

1. Information Security Requirements

1.1. Applicability.

This statement applies whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

1.1.1 Access (Physical or Logical) to Federal Information: A Contractor (and/or any subcontractor) employee will have, or the ability to have, physical or logical (electronic) access to federal information.

1.1.2. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal information technology system containing information that directly supports the CDC mission. In addition to the FAR Subpart 2.1 definition of “information technology” (IT), the term as used in this section, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This section does not apply to national security systems as defined by FISMA.

1.2. Contractor Responsibilities.

The Contractor (and/or any subcontractor) is responsible for the following:

1.2.1. Protecting federal information and information systems in order to ensure their:

1.2.1.1. Integrity

Which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity;

1.2.1.2. Confidentiality

Which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information;

1.2.1.3 Availability

Which means ensuring timely and reliable access to and use of information.

1.2.2. Providing security of any Contractor systems, and information contained therein, connected to a CDC network or operated by the Contractor on behalf of CDC regardless of location.

1.2.3. Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the CDC Information Security Program to ensure the integrity, confidentiality, and availability of federal information and federal information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. The CDC security requirements are outlined in the CDC Cyber Security Action Plan (CSAP), which is available on the CDC Office of the Chief Information Security Officer’s (OCISO) website.

1.3. Information Type(s).

The following information type(s) apply to this contract: Administrative, Management and Support Information and Information Systems:

• Budget Execution

• Workforce Planning

• Management Improvement

• Budgeting & Performance Integration

• Contingency Planning

• Continuity of Operations

• Service Recovery http://www.hhs.gov/ocio/policy/index.html

• Customer Services

• Official Information Dissemination

• Product Outreach

• Public Relations

• Facilities, Fleet, and Equipment Management

• Help Desk Services

• Security Management

• Travel

• Workplace Policy Development and Management

• Asset and Liability Management

• Reporting and Information

• Funds Control

• Accounting

• Cost Accounting/ Performance Measurement

• HR Strategy

• Staff Acquisition

• Organization and Position Management

• Compensation Management

• Benefits Management

• Employee Performance Management

• Employee Relations

• Labor Relations

• Separation Management

• Human Resources Development

• System Development

• Lifecycle/Change Management

• System Maintenance

• IT Infrastructure Maintenance

• Information System Security

• Record Retention

• Information Management

• System and Network Monitoring

• Information Sharing

1.4. Security Categories and Levels.

The following risk levels apply to this contract:

Security Categories and Levels

Confidentiality Level: [ ] Low [X] Moderate [ ] High Integrity Level: [ ] Low [X] Moderate [ ] High Availability Level: [ ] Low [X] Moderate [ ] High Overall Security Category: [ ] Low [X] Moderate [ ] High

1.5. Internet Protocol Version 6 (IPv6).

All acquisitions for information technology using Internet Protocol must comply with the Federal Acquisition Regulation (FAR).

1.6. Roster.

The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Contracting Officer’s Representative (COR), with a copy to the Contracting Officer, within 14 calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer will notify the Contractor of the appropriate level of investigation required for each staff member.

1.7. Document Information.

The Contractor shall contact the Contracting Officer and/or COR for any templates, policies, forms and other documents necessary to comply with the requirements of this section.

1.8. Standard for Encryption Language

1.8.1. If the Government has determined that CDC information under this contract is considered sensitive and/or the system is categorized “MODERATE or HIGH”, the Contractor (and/or any subcontractor) shall use Federal Information Processing Standard (FIPS) 140-2, Security Requirements for Cryptographic Module, as amended, compliant encryption to protect all instances of CDC sensitive information during storage and transmission (Note: The Government has determined that CDC information under this contract is considered sensitive in accordance with CDC Standard for the Definition of Sensitive Information, dated May 2009 or latest revision).

1.8.2. The Contractor (and/or any subcontractor) shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the COR.

1.8.3. The Contractor (and/or any subcontractor) shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the CDC personal identification verification (PIV) card; or alternatively, the Contractor (and/or any subcontractor) shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (See OMB Encryption Guidance (http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf) ). The Contractor shall notify the Contracting Officer and the COR of personnel authorized to decrypt and recover all encrypted information.

1.8.4. The Contractor (and/or any subcontractor) shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

1.8.5. The Contractor (and/or any subcontractor) shall ensure that this standard is incorporated into the Contractor’s property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive CDC information.

1.9. Contractor Responsibilities Upon Physical Completion of the Contract.

The Contractor shall return all CDC information and IT resources provided to the Contractor during contract performance and certify that all CDC information has been properly sanitized and purged, in accordance with the Department and/or WTCHP policies, from Contractor-owned (and/or any subcontractor) systems, including backup systems, used in contract performance.

1.10 Failure to Comply.

Failure on the part of the Contractor (and/or any subcontractor) to comply with the terms of this section shall be grounds for the Contracting Officer to terminate this contract.

2. Information Security and Privacy Training

2.1. Mandatory Training.

All Contractor (and/or any subcontractor) employees shall complete the applicable CDC Information Security Awareness, Privacy, and Records Management training (http://intranet.cdc.gov/ocio/information-systems-security/security-awareness/training/index.html) before performing any work under this contract.

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/index.html http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://intranet.cdc.gov/ocio/information-systems-security/security-awareness/training/index.html http://intranet.cdc.gov/ocio/information-systems-security/security-awareness/training/index.html

Thereafter, the employees shall complete CDC specified Information Security, Privacy and Records Management training annually, during the life of this contract.

2.2. Role-based Training

2.2.1. HHS requires role-based training when responsibilities associated with a given role or position, could, upon execution, have the potential to adversely impact the security posture of one or more HHS systems. Read further guidance at: HHS Memorandum, as amended, on Role-Based Training Requirement1.

The Contractor (and/or any subcontractor) shall maintain training records for all information security and privacy training completed by each employee working under this contract. The training records shall be provided to the COR and/or Contracting Officer in conjunction with contract award or upon request and WTCHP requires that the training recorded be submitted to the WTCHP Information Security Officer and the COR responsible for their contract annually.

2.2.2. The Contractor shall provide records of any applicable information security and privacy training completed outside of CDC to the COR responsible for their contract.

3. Rules of Behavior

The Contractor (and/or any subcontractor) shall ensure that all employees comply with the CDC Information Technology General Rules of Behavior (as amended), which are available at http://intranet.cdc.gov/ocio/docs/computers-software-equipment/policy90.pdf and http://intranet.cdc.gov/ocio/docs/computers-software-equipment/HHS%20Rules%20of%20Behavior.pdf and any CDC specific rules as applicable.

All Contractor employees much read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process CDC information and annually thereafter, which may be done as part of annual CDC Information Systems Security Awareness Training.

4. Personnel Security Responsibilities

4.1. Contractor New Employee.

The Contractor shall notify the Contracting Officer, COR, and designated WTCHP Point of Contact (POC) within five (5) business days before a new employee (including subcontractors) assumes a position that requires a suitability determination or when an employee with a suitability determination or security clearance stops working under this contract. The Agency will initiate a background investigation on new employees requiring suitability determination and will stop pending background investigations for employees that no longer work under this acquisition.

4.2. Contractor Requirement.

The Contractor shall provide the COR with the name, position title, e-mail address, and phone number of all contract employees (including subcontractors) working under the contract and provide the name, position title and suitability determination level held by the former incumbent. If the employee is filling a new position, the Contractor shall provide a position description and the Agency will determine the appropriate suitability level.

4.3. Contractor Separation.

The Contractor (and/or any subcontractor) shall perform and document the actions identified in the CDC In- and Out -Processing of CDC Employees, Non-employees, and Affiliates (http://masoapplications.cdc.gov/Policy/Doc/policy510.pdf) when a contractor (and/or any subcontractor)

1 HHS Memorandum on Role Based Training Requirement retrieved from:

http://intranet.hhs.gov/it/cybersecurity/policies/index.html http://intranet.cdc.gov/ocio/docs/computers-software-equipment/policy90.pdf http://intranet.cdc.gov/ocio/docs/computers-software-equipment/HHS%20Rules%20of%20Behavior.pdf http://masoapplications.cdc.gov/Policy/Doc/policy510.pdf employee terminates work under this contract. All documentation shall be made available to the COR and/or Contracting Officer upon request.

5. Commitment to Protect Non-Public Departmental Information and Data (see Appendices A & B)

5.1. Unauthorized Disclosure.

The Contractor (and/or any subcontractor) shall protect information that is deemed sensitive from unauthorized disclosure to persons, organizations or subcontractors who do not have a need to know the information. Information which, either alone or in aggregate, is deemed sensitive or proprietary by the Government shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all subcontractors that are performing under this contract.

5.2. Contractor Agreement.

The Contractor (and/or any subcontractor), performing under this contract, shall not release, publish, or disclose non-public CDC information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations (as amended) governing the confidentiality of such information:

• 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

• 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

• Public Law 96-511 (Paperwork Reduction Act)

5.3. Contractor Employee Non-Disclosure Agreement (NDA).

Each Contractor (and/or any subcontractor) employee having access to non-public federal information under this contract shall complete the CDC Commitment to Protect Non-Public Information – Contractor Employee Agreement. A copy of each signed and witnessed NDA shall be submitted to the COR prior to performing any work under this acquisition.

6. Incident Response

FISMA requires that agencies report all cyber security incidents to the United States Computer Emergency Readiness Team (US-CERT). All information security and privacy incidents, which include cyber and non-cyber (paper-based) incidents shall be reported to the WTCP Information System Security Officer (ISSO).

WTCHP users should report all suspected computer security incidents to their local WTCHP ISSO. The WTCHP ISSO will notify the CDC CSIRT after assessing the situation, responding to any immediate requirements, and collecting essential information about the incident. Please note OMB 06-19 (as amended) requires HHS to report "all incidents involving personally identifiable information (PII) in electronic or physical form" to US-CERT within one (1) hour, and that we "should not distinguish between suspected and confirmed breaches". This means that from discovery WTCHP ISSO, CDC CSIRT, HHS CSIRC, and US-CERT need to be notified within that hour. Moreover, the WTCHP shall report all privacy breaches involving the loss or unauthorized disclosure of PII, including paper-based incidents, to the CDC Privacy Incident Response Team

(PIRT).

(Note: CSIRT manages cyber-related incidents and reports them to US-CERT; however, PII incidents are generally managed by the WTCHP and CDC Privacy Programs and must be reported to the CDC PIRT.) For more information, please refer to the CDC - IT Security and Privacy Incident Reporting and Response Policy , as amended as well as WTCHPs incident response guidance please see Appendix C)

6.1. The Contractor (and/or any subcontractor) shall report all suspected and confirmed information security and privacy incidents to the WTCHP ISSO, including incidents involving PII in electronic or physical form, within 1 hour. The types of information required in a cyber incident report must include at a minimum: company and point of contact information, contract information, and the type of information compromised.

http://intranet.cdc.gov/ocio/information-systems-security/privacy-information-security/index.html

6.2. In the event of a sensitive information incident, the Government may suspend or revoke an existing authority to operate (ATO) (either in part or in whole). If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the Contractor (and/or any subcontractor) to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor (and/or any subcontractor) IT system under this contract.

Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

7. Privacy Requirements

7.1. Privacy Act.

The Contractor (and/or any subcontractor) agrees to comply with the Privacy Act of 1974 (the Act) and WTCHP rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

7.1.1. The systems of records; and

7.1.2. The design, development, or operation work that the Contractor is to perform.

7.2. In the event of violations of the Act, a civil action may be brought against the CDC when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an CDC function, and criminal penalties may be imposed upon the officers or employees of CDC when the violation concerns the operation of a system of records on individuals to accomplish an CDC function per 5 USC 552a (i), as amended. For purposes of the criminal penalties provisions of the Act, when the contract is for the operation of a system of records on individuals to accomplish an CDC function, the Contractor (and/or any subcontractor) is considered to be an employee of CDC per 5 USC 552a(m)(1), as amended.

7.2.1. “Operation of a system of records,” As used in this document, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

7.2.2. “Record,” As used in this document, means any item, collection, or grouping of information about an individual that is maintained by CDC including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

7.2.3. “System of records on individuals,” As used in this document, means a group of any records under the control of CDC from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

7.2.4. The Contractor (and/or any subcontractor) shall report all suspected and confirmed security and privacy incidents, including breaches involving the loss and/or disclosure of PII in electronic or physical form, to the WTCHP ISSO within one hour of discovering the incident. The Contractor shall not include any sensitive information in the subject or body of any e-mail. To transmit sensitive information, the Contractor shall attach a document to email and use a FIPS 140-2 compliant encryption solution to protect the sensitive information in attachments to email. The Contractor shall follow-up with the WTCHP ISSO within two (2) business days to verify the status of the incident.

7.2.5. The Contractor (and/or any subcontractor) shall obtain notification instructions and approval from the Contracting Officer prior to notifying individuals whose PII resided in the Contractor (and/or any subcontractor) IT system at the time of the incident. The method and content of any notification by the Contractor shall be compliant with CDC Privacy Officer Standard Operating Procedures (SOP)2 and WTCHP Guidance as well as coordinated and approved by CDC Privacy Officer in consultation with the Contracting Officer, the WTCHP Privacy Officer and/or WTCHP ISSO. Upon receiving notification and approval from the agency Contracting Officer, the Contractor shall send notifications to affected individuals within five (5) business days.

(Note: The Contractor (and/or any subcontractor) shall not proceed with any notification to individuals unless the Contracting Officer, in consultation with the CDC PIRT and WTCHP Privacy Officer, has determined in writing that the Contractor notification is appropriate.)

7.2.6. All determinations related to sensitive information incidents, including response activities, notifications to affected individuals and/or federal agencies, and related services (e.g., credit monitoring and identity protection) will be made in writing by the Contracting Officer in consultation with the CDC PIRT, CDC CIO and Privacy Officer and in compliance with CDC and/or WTCHP Guidance.

7.2.6.1. The Contractor (and/or any subcontractor) shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Incident response activities determined to be required by the Government may include, but are not limited to, the following:

7.2.6.1.1. Inspections,

7.2.6.1.2. Investigations,

7.2.6.1.3. Forensic reviews, and

7.2.6.1.4. Data analyses and processing.

7.3. PII Security Plan (draft to be submitted with offeror’s proposal)

7.3.1. The Contractor shall submit a draft PII Security Plan with its proposal that addresses each of the following items:

7.3.1.1. Verify the information categorization to ensure the identification of the PII requiring protection.

7.3.1.2. Verify the existing risk assessment.

7.3.1.3. Identify the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

7.3.1.4. Verify the adequacy of the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

7.3.1.5. Identify any revisions, or development, of an internal corporate policy to adequately address the information protection requirements of the SOW.

7.3.1.6. For PII to be physically transported to or stored at a remote site, verify that the security and privacy controls of NIST Special Publication 800-53, latest version, involving the encryption of transported information will be implemented.

7.3.1.7. When applicable, verify how the NIST Special Publication 800-53, latest version, security and privacy controls requiring authentication, virtual private network (VPN) connections and other technical safeguards will be implemented.

7.3.1.8. When applicable, verify how the NIST Special Publication 800-53, latest version, security controls enforcing allowed downloading of PII will be implemented.

7.3.1.9. Identify measures to ensure subcontractor compliance with safeguarding PII and security and privacy controls in the NIST 800-53, as amended.

7.3.2. The details contained in the Contractor’s PII Security Plan must be commensurate with the size and complexity of the contract requirements based on the System Categorization specified above in the subparagraph entitled Security Categories and Levels. The Contractor’s PII Security Plan will be evaluated by the Government for appropriateness and adequacy.

7.3.3. Privacy Threshold Analysis/Privacy Impact Assessment (PTA/PIA) – due within 30 days after contract award. The Contractor shall assist the Agency Privacy Officer with conducting a PTA/PIA for the information system and/or information collection project.

8. Position Sensitivity Designations

8.1. The following position sensitivity designations apply to this contract:

[ ] Level 6: Public Trust - High Risk. Contractor (and/or any subcontractor) employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (BI).

[X] Level 5: Public Trust - Moderate Risk. Contractor (and/or any subcontractor) employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level 4: Special Sensitive. Contractor (and/or any subcontractor) employees assigned to Level 4 positions with no previous investigation and approval shall undergo a Suitability Determination and a Single Scope Background Investigation (SSBI), [ ] Level 3: Top Secret – Critical Sensitive. Contractor (and/or any subcontractor) employees assigned to Level 3 positions with no previous investigation and approval shall undergo a Suitability Determination and Single Scope Background Investigation (SSBI), [ ] Level 2: Confidential or Secret – Noncritical Sensitive. Contractor (and/or any subcontractor) employees assigned to Level 2 positions with no previous investigation and approval shall undergo a Suitability Determination and a Access National Agency Check, Inquiries (ANACI)

[X] Level 1: Non-Sensitive Contractor (and/or any subcontractor) employees assigned to Level 1 positions shall undergo a Suitability Determination and National Agency Check and Inquiry Investigation

(NACI).

All Contractor (and/or any subcontractor) employees shall comply with the conditions established for their designated position sensitivity levels prior to performing any work under this contract.

Suitability Investigations are required for contractors (and/or any subcontractor) who will need access to federal information systems and/or to federally controlled physical space.

9. Access to HHS-Controlled Facilities, Systems, and Information (including HHS non-public data)

9.1. Applicability.

This section applies when contractor personnel (and/or any subcontractor) are expected to have (1) routine physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system;

(3) access to sensitive HHS data or information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

9.2. As part of the acquisition planning process, the COR shall determine whether, based on the nature of the requirement, Contractor personnel may require access to CDC-controlled facilities and/or information systems, including sensitive data/information, in order to perform the contract/order Statement of Work (SOW)/ Performance Work Statement (PWS). If Contractor access is required, the COR must assess, based on information available at that point in the process, the type, frequency, and duration of such access.

Following that determination, the COR shall consult with WTCHP and/or local building and IT security officials/staff, and officials/staff involved with personnel security, including the designated personnel security representative, to determine appropriate security requirements and, as necessary, adjust project requirements to minimize security and access issues. The COR shall comply with HSPD-12 and the following implementing guidance in making these judgments and determinations.

9.3. Definitions.

The following definitions apply to this subpart:

9.3.1. Physical Access: “Physical” entry to and/or exit from a federally controlled facility.

9.3.2. Logical Access: Access to a federal information system that requires the Contractor (and/or any subcontractor) to logon with a CDC Windows Active Directory account or some other CDC authorized network operating system account. This does not include access to a public web site, whether by a CDC Contractor or member of the public, because such web sites do not require permission to access.

In the case of sensitive data/information that exists in hard copy, “access” means providing a Contractor (and/or any subcontractor) the right to view or use written/typed data or information for the purpose described in a contract.

9.3.3. Routine Access: On a regular, non-intermittent basis, which is at least once per week during the contract or order period of performance.

9.3.4. Long-term Access: For a period exceeding six months or more than 1,040 hours in any one year.

9.3.5. Sensitive data/information: As defined by the Computer Security Act of 1987, any data/information, “the loss, misuse, or unauthorized access to or modification of which, could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under section 552a of the Title 5 of USC (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy.” Examples include individuals’ social security numbers; other personal identification information, such as individuals’ health, medical, or psychological information; proprietary research data; and confidential legal data.

9.3.6. Foreign Nationals: An alien, i.e., any person not a citizen of the United States or any person who was born outside the jurisdiction of the United States, is a citizen of a foreign country, and has not become a naturalized U.S. citizen under U.S. law. This includes legal permanent residents, also known as permanent resident aliens (22 U.S.C. § 6023(8), as amended, and 8 U.S.C. § 1101(a)(3)), as amended.

10. Personnel Security Responsibilities

10.1. The Contractor, within five (5) business days before an employee begins working on this contract, shall provide the Contracting Officer, COR, and Information System Security Officer (ISSO) the name, position title, e-mail address, and phone number of all contract employees working under the contract.

10.1.1. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

10.1.2. If the employee is filling an existing position, the Contractor shall provide the name, position title and suitability determination level held by the former incumbent.

10.2. The Contractor shall notify the Contracting Officer, COR, and system ISSO within five (5) business days before an employee stops working under this contract.

10.2.1. The Contractor shall provide the name, position title, and suitability determination level held by or pending for departing employees.

10.2.2. The Government will stop pending background investigations for employees that no longer work under this acquisition.

10.3. The Contractor (and/or any subcontractor) shall perform and document the actions identified in the CDC In- and Out -Processing of CDC Employees, Non-employees, and Affiliates http://masoapplications.cdc.gov/Policy/Doc/policy510.pdf when a Contractor (and/or any subcontractor) employee terminates work under this contract. All documentation shall be made available to the COR and/or Contracting Officer upon request.

10.4. Within 7 calendar days after the Government’s final acceptance of the work under this contract, or upon termination of the contract, the Contractor shall return all identification badges to the Contracting Officer or designee.

11. Homeland Security Presidential Directive (HSPD)-12

11.1. To gain routine physical access to an HHS facility, logical access to an HHS-controlled information system, and/or access to sensitive data or information, the Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors, as amended; Office of Management and Budget memorandum (M-05-24), as amended; and Federal Information Processing Standards Publication (FIPS PUB) Number 201; and with the personal identity verification and investigation procedures contained in the following documents:

11.1.1. HHS Information Security and Privacy Policy (IS2P) as amended.

11.1.2. HHS Personnel Security and Suitability Policy, as amended.

11.1.3. HSPD-12 Implementation Policy for the Use of the Personal Identity Verification (PIV) Card for Strong Authentication, as amended.

http://masoapplications.cdc.gov/Policy/Doc/policy510.pdf

11.2. When foreign national Contractor/subcontractor employees perform work under this acquisition, the provisions of HSPD-12 do NOT apply per OSSI requirements.

12. Fingerprinting

12.1. To gain logical access to HHS-controlled information systems, contract employees working under the contract are subject to a fingerprint check with favorable results.

12.2. Where Contractor (and/or any subcontractor) staff must appear at an HHS facility to be fingerprinted, any costs associated with getting to that facility are to be borne by the Contractor.

13. Background Investigations

13.1. Based upon information provided by the COR, the Contracting Officer shall insert references to CDC and/or local procedural guideline(s), if any; indicate if they are readily accessible to the public; and, if so, specify where they may be found. If they are not readily accessible, the Contracting Officer shall attach a copy to the solicitation and contract and reference the guideline(s) here.

13.2. At the time of solicitation, based upon information provided by the COR, the Contracting Officer shall specify all known levels. If the position sensitivity levels are not known at that time, the Contracting Officer shall insert the words “To Be Determined at the Time of Award.” However, the Contracting Officer must include the definitive position sensitivity levels in the awarded contract/order.

13.3. The personnel investigation procedures for Contractor personnel (and/or any subcontractor) require that the Contractor (and/or any subcontractor) prepare and submit background check/investigation forms based on the type of investigation required. The minimum Government investigation for a non-sensitive position is a National Agency Check and Inquiries (NACI) with fingerprinting. More restricted positions – i.e., those above non-sensitive, require more extensive documentation and investigation.

13.4. Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR section, Excusable Delays – see FAR 52.249-14.

13.5. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer’s discretion, justify reduction(s) in the contract price of no more than the cost of the additional investigation(s).

14. Contract Close Out

14.1. General Security Requirements.

IT security requirements must be incorporated into all phases of program planning and execution, from budgeting to close-out and the implementation of those requirements should align with the CDC Enterprise Performance Life Cycle (EPLC). The Contractor (and/or any subcontractor) shall comply with security requirements, EPLC processes, and Enterprise Architecture, to ensure proper and confidential handling of data and information.

14.2. Certification of Sanitization of Government and Government-Activity-Related Files and Information.

As part of contract closeout, the Contractor shall submit the certification to the COR and the Contracting Officer following the template provided in NIST Special Publication 800-88, Guidelines for Media Sanitization.

14.2.1. The Contractor (and/or any subcontractor) shall refer to the HHS-OCIO Policy for Information Systems Security and Privacy (IS2P). The Contractor (and/or any subcontractor) shall comply with the HHS Departmental Information Security Policies. The HHS Cybersecurity Program develops policies, http://www.hhs.gov/ocio/policy/index.html#Security http://www.hhs.gov/ocio/policy/index.html#Security http://www.hhs.gov/ocio/policy/ procedures, and guidance to serve as a foundation for the HHS information security program. These documents implement relevant federal laws, regulations, standards, and guidelines that provide a basis for the information security program at the Department. The Contractor (and/or any subcontractor) must comply with Cybersecurity Program guidelines (http://www.hhs.gov/ocio/policy/). At minimum, the Contractor (and/or any subcontractor) shall comply with all configuration, patching, and maintenance requirements as defined in the IS2P and hold an open source product to the same or greater standard as a non-open source product. As with all software, maintenance cost planning should be included in the terms of the contract, with specific service level agreements for remediation of software vulnerabilities discovered in the software.

14.2.2. Contractors (and/or any subcontractors) must follow and adhere to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-64 Security Considerations in the System Development Life Cycle (latest revision) , at a minimum, for system development. This requirement may include providing system documentation at designated intervals within the EPLC that require artifact review.

15. Audit Record Retention

15.1. The vendor shall support a system in accordance with the requirement for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to capabilities such as those identified in:

15.1.1. NARA Bulletin 20013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records,

15.1.2. NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing Records in Cloud Computing Environments (ref 8).

15.2. These provide requirements for maintaining records to retain functionality and integrity throughout the records’ full lifecycle including:

15.2.1. Maintenance of links between records and metadata, and

15.2.2. Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

16. Subcontractor Section

16.1. The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this contract.

16.2. The Contractor shall incorporate the substance of the sections in this contract in all subcontracts that require protection of federal information and information systems, including those subcontracts that:

16.2.1. Have physical or electronic access to CDC computer systems, networks, or IT infrastructure; or

16.2.2. Use information systems to generate, store, process, or exchange data with CDC or on behalf of CDC, regardless of whether the data resides on a CDC or the Contractor’s information system.

http://www.hhs.gov/ocio/policy/).

16.3. The Contractor is prohibited from subcontracting to companies in which foreign governments that support international terrorism have a “significant interest” per 10 U.S.C. § 2327 (as amended).

17 Security and Privacy Requirements for Federal Information Technology (IT) Resources

17.1. Applicability.

The COR will include the following sections on all contracts for Contractor-owned/Contractor-operated information systems that process, store, or transmit federal information. Confer with the System Owner, ISSO, and/or CDC Office of the Chief Information Security Officer to ensure that all applicable sections are included.

17.2. Contractor Security Deliverables.

In accordance with the timeframes specified, the Contractor shall prepare and submit the following security requirements to the Contracting Officer, COR and System Owner or designated representative for review, comment, and acceptance, when applicable and identified in the deliverables section of the contract. All deliverable shall comply with applicable federal laws that include, but are not limited to, the Federal Information Security Modernization Act (FISMA) of 2014 as amended, (Title III of the E-Government Act of 2002, Public Law 107-347), Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources, and other applicable federal laws, regulations, NIST guidance and Departmental policies.

17.3. FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment as amended) Due within 45 days after contract award. The FIPS 199 Assessment shall comply with FIPS 199 and NIST SP 800-60, latest revision, Guide for Mapping Types of Information and Information Systems to Security Categories. After resolution of any comments by the Agency, the Contractor will finalize the FIPS 199 Assessment and submit the final versions to the Contracting Officer for acceptance and inclusion into the contract file.

17.4. Security Assessment and Authorization (SA&A)

Due within 45 days after contract award. The Contractor shall submit written proof to the Contracting Officer that a SA&A was performed for the applicable information system and the system has a valid authority to operate (ATO). If a SA&A has not been performed, the Contractor (and/or any subcontractor) shall perform the SA&A in accordance with the Office of the Chief Information Officer (OCISO), CDC- OCIO Policy for Information Systems Security and Privacy Policy (IS2P); NIST SP 800-37, latest revision, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, and other applicable guidance. The Agency System Owner or designated representative shall review the draft SA&A deliverables and provide comments to the Contractor for resolution. After resolution of any comments, the Contractor shall submit a final SA&A package to the System Owner for acceptance and approval by the Agency Authorizing Official (AO), or designee, at least thirty (30) days prior to the date of operation of the information system. Only after obtaining a valid ATO for the information system, will the Contractor implement and deploy the system into production. Once the ATO package has been approved by the Agency AO, or designee, the Contracting Officer shall incorporate the ATO letter into the contract as a compliance document. The Agency’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

17.5. SA&A Package Deliverables

The Contractor shall include at a minimum the following SA&A deliverables:

17.5.1. System Security Plan (SSP)

Due within 45 days after contract award. The SSP shall be compliant with the NIST SP 800-18 , Guide for Developing Security Plans for Federal Information Systems, the Federal Information http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800-53 (latest revision), Security and Privacy Controls for Federal Information Systems and Organizations and other applicable NIST guidance. The SSP shall be consistent with and further detail the approach to IT security contained in the Contractor’s bid or proposal that resulted in the award of this contract. The SSP shall provide an overview of the system environment and security requirements to protect the information system as well as describe the security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor shall update the SSP annually thereafter.

17.5.2. Security Assessment Report (SAR)

Due within 45 days after contract award. The SAR shall be conducted by an independent assessor and be consistent with NIST SP 800-53A, NIST SP 800-30, latest revision, and any additions or augmentations described in the CDC OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft SAR, the Contracting Officer shall accept the SAR and incorporate the Contractor’s final version into the contract for Contractor implementation and maintenance. The Contractor shall update the SAR annually thereafter.

17.5.3. Plan of Actions and Milestones (POA&M)

Due within 45 days after contract award. The Contractor is responsible for mitigating all security risks found during assessment and authorization and continuous monitoring activities. For POA&M items only, all high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. These timeframes are the outside limits. All mitigation should take place as soon as applicable. CDC will determine the risk rating of vulnerabilities.

17.5.3.1. Identified gaps between required security control baselines, continuous monitoring controls, and the Contractor’s implementation, as documented in the SAR, shall be tracked by the Contractor for mitigation in the POA&M document. Depending on the severity of the gaps, CDC may require them to be remediated before an Authorization is issued, as applicable.

17.5.4. Contingency Plan

Due within 45 days after contract award. The Contractor shall develop a Contingency Plan in accordance with NIST SP 800-34, latest revision, and CDC policy. Upon acceptance by the System Owner, the Contractor shall test the Contingency Plan and prepare a Contingency Plan Test Report that includes the test results. The Contractor shall update and test the Contingency Plan annually thereafter.

17.5.5. Security Review

The Contractor shall also perform an independent annual security control assessment and provide to the Contracting Officer verification that the system ATO remains valid. Evidence of a valid system security authorization includes written results of (A) annual testing of the system contingency plan and

(B) the performance of a security control assessment. Upon the ATO award, Contractor-operated systems that input, store, process, output, and/or transmit shall meet or exceed the continuous monitoring requirements identified below.

17.6. Government Access for IT Inspection.

The Contractor (and/or any subcontractor) shall afford the Government access to the Contractor’s and subcontractors’ facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of federal data or to the protection of information systems operated on behalf of CDC.

18. Information Security Continuous Monitoring.

All Contractor/subcontractor-owned/operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the information security continuous monitoring requirements identified in FISMA (as amended). The Contractor (and/or any subcontractor) shall also store monthly information security continuous monitoring data at its location for a period not less than one year from the date the data is created. The monthly continuous monitoring data shall be encrypted in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities. The Government may elect to perform information security continuous monitoring and IT security scanning of Contractor (and/or any subcontractor) systems from Government tools and infrastructure.

18.1 Asset Management.

The contractor (and/or any subcontractor) shall use any available Security Content Automation Protocol (SCAP)-compliant automated tools for active/passive scans to provide an inventory of all information technology (IT) assets for both hardware and software, (computers, servers, routers, databases, operating systems, etc.) that are processing government owned information/data. It is anticipated that this inventory information will be required to be produced at least monthly. The contractor (and/or any subcontractor) shall be capable of providing detailed IT asset inventory information, to include IP address, machine name, operating system level, security patch level, and SCAP-compliant format information. The contractor (and/or any subcontractor) shall work towards ultimately maintaining a capability to provide an inventory of 100% of its IT assets using SCAP-compliant automated tools.

18.2. Configuration Management.

The contractor (and/or any subcontractor) shall use available SCAP-compliant automated tools for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that are processing government owned information/data. Compliance will be measured using IT asset and system security configuration guidance provided by the government, for all IT assets. The SCAP-compliant automated tools will compare the installed configuration to the government specific security configuration guidance; contractor may reflect the most restrictive security configuration mode consistent with operational requirements. It is anticipated that this IT asset security configuration information will be required to be produced at least monthly.