31310024R0055.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

CODE 16. ADMINISTERED BYCODE

X

X

541310

SIZE STANDARD:

100.00 % FOR:SET ASIDE:UNRESTRICTED ORNRCHQ

REQUEST FOR

PROPOSAL

(RFP)

INVITATION

FOR BID (IFB)

10. THIS ACQUISITION ISCODE

REQUEST FOR

QUOTE (RFQ)

14. METHOD OF SOLICITATION

13b. RATING

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS):

SMALL BUSINESS

04/18/2024 0900 ET

04/11/2024

301-415-3412Louis Gilden (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

31310024R0055

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 42 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

WASHINGTON DC 20555-0001

MAIL STOP TWFN-07B20M

ACQUISITION MANAGEMENT DIVISION

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$12.5

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS

BLOCK IS MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS THIS CONTRACT IS A RATED

ORDER UNDER THE DEFENSE

PRIORITIES AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

8(A)

X

US NRC - HQ

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Period of Performance: 05/01/2024 to 12/31/2024

00001 OWFN - 11th Floor Construction Administration

(FFP)

Anticipated Award Type: Firm-fixed-price

00002 OWFN - 13th Floor Construction Administration

(FFP)

Anticipated Award Type: Firm-fixed-price

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

DATED

Louis Gilden

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Government Use Only)

OFFER

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT: REFERENCE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 11/2021) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42 2 of

31310024R0055

B - Continuation Pages

B.1 BRIEF PROJECT TITLE AND WORK DESCRIPTION

B.2 TYPE OF CONTRACT (JULY 2020)

B.3 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS (AUG 2023)

B.4 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS – GENERAL

EXCEPTIONS (AUG 2023

B.5 IT SECURITY REQUIREMENTS – DEVELOPMENT AND OPERATIONS AND

MAINTENANCE REQUIREMENTS (AUG 2023)

B.6 IT SECURITY REQUIREMENTS – CERTIFICATION AND ACCREDITATION (AUG

2023)

B.7 IT SECURITY REQUIREMENTS – NRC AND CONTRACTOR (NON-NRC) FACILITIES

(AUG 2023)

C - Contract Clauses

C.1 PACKAGING AND MARKING

C.2 BRANDING

C.3 INSPECTION AND ACCEPTANCE BY THE NRC (SEP 2013)

C.4 PERIOD OF PERFORMANCE

C.5 REGISTRATION IN FEDCONNECT® (MAY 2021)

C.6 ELECTRONIC PAYMENT (DEC 2017)

C.7 ANNUAL AND FINAL CONTRACTOR PERFORMANCE EVALUATIONS

C.8 WHISTLEBLOWER PROTECTION FOR NRC CONTRACTOR AND SUBCONTRACTOR

EMPLOYEES

C.9 GREEN PURCHASING (SEP 2015 )

C.10 USE OF AUTOMATED CLEARING HOUSE (ACH) ELECTRONIC

PAYMENT/REMITTANCE ADDRESS

C.11 AWARD NOTIFICATION AND COMMITMENT OF PUBLIC FUNDS

C.18 52.217-8 OPTION TO EXTEND SERVICES. (NOV 1999)

D - Contract Documents, Exhibits and Attachments E - Instructions, Basis For Award, Evaluation Criteria

E.1 INSTRUCTIONS / BASIS FOR AWARD / EVALUATION CRITERIA

B - Continuation Pages

B.1 BRIEF PROJECT TITLE AND WORK DESCRIPTION

(a) The title of this project is: Architectural & Engineering (A&E) Contract Administration Services

(b) Summary work description: The contractor shall provide A&E Contract Administration services for the renovation of One White Flint North (OWFN) building floors 11 and 13.

B.2 TYPE OF CONTRACT (JULY 2020)

The contract type for this award is Firm-Fixed-Price

B.3 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS (AUG 2023)

All work under this contract and all devices used to store, process, or transmit NRC sensitive information shall comply with the current versions of the federally mandated and NRC defined policy, procedures, and standards, as applicable and as amended. This list includes but is not limited to the following:

National Institute of Standard and Technology (NIST) Federal Information Processing Standards

(FIPS):

▪ FIPS PUB 140-3, SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES

▪ FIPS PUB 180-4, Secure Hash Standard (SHS)

▪ FIPS PUB 186-4, Digital Signature Standard (DSS)

▪ FIPS PUB 197, Advanced Encryption Standard

▪ FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems

▪ FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems

▪ FIPS PUB 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors

▪ FIPS PUB 202, SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions

NIST Special Publications (SP):

▪ SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

▪ SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information

▪ SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171

Committee on National Security Systems (CNSS) Policies:

▪ CNSSP 1, National Policy for Safeguarding and Control of COMSEC Material

▪ CNSSP 3, National Policy for Granting Access to U.S. Classified Cryptographic Information

▪ CNSSP 7, Policy on the use of Commercial Solutions to Protect National Security Systems

▪ CNSSP 8, Release and Transfer of USG Cryptologic NSS Tec Sec Mat'l, Info, and Techniques to Foreign Govts

▪ CNSSP 10, NATIONAL POLICY GOVERNING USE OF APPROVED SECURITY

CONTAINERS IN INFORMATION SECURITY APPLICATIONS

▪ CNSSP 11, Acquisition of Information Assurance (IA) and IA-Enabled Information Technology (IT) Products

▪ CNSSP 14, Rel of IA Products and Services to Auth U.S. Persons or Activities Not a Part of Fed. Govt

▪ CNSSP 15, Use of Public Standards for Secure Information Sharing

▪ CNSSP 16, National Policy for the Destruction of COMSEC Paper Material

▪ CNSSP 17, Policy on Wireless Systems

▪ CNSSP 18, National Policy on Classified Information Spillage

▪ CNSSP 19, National Policy Governing the Use of High Assurance Internet Protocol Encryptor (HAIPE) Products

▪ CNSSP 21, National Cybersecurity Policy on Enterprise Architecture Frameworks for National Security Systems

▪ CNSSP 22, Cybersecurity Risk Management Policy

▪ CNSSP 24, Policy on Assured Information Sharing (AIS) for National Security Systems (NSS)

▪ CNSSP 25, National Policy for Public Key Infrastructure in National Security Systems

▪ CNSSP 25, National Policy for Public Key Infrastructure in National Security Systems provides for a National Security Systems (NSS) Public Key Infrastructure (PKI) on Secret networks.

▪ CNSSP 26, National Policy on Reducing the Risk of Removable Media for National Security Systems

▪ CNSSP 28, Cybersecurity of Unmanned National Security Systems

▪ CNSSP 29, National Secret Enclave Connection Policy

▪ CNSSP 30, Cryptographic Key Protection

▪ CNSSP 300, National Policy on Control of Compromising Emanations

▪ NSTISSP 5, National Policy for Incident Response and Vulnerability Reporting for National Security Systems

▪ NSTISSP 101, National Policy on Securing Voice Communications

▪ NSTISSP 200, National Policy on Controlled Access Protection

CNSS Protection Directives:

▪ CNSSD 504, Directive on Protecting National Security Systems from Insider Threat

▪ CNSSD 500, Information Assurance (IA) Education, Training, and Awareness

▪ NSTISSD 501, National Training Program for Information Systems Security (INFOSEC) Professionals

▪ CNSSD 502, National Directive On Security of National Security Systems

▪ CNSSD 505, Supply Chain Risk Management (SCRM)

▪ CNSSD 506, NATIONAL DIRECTIVE TO IMPLEMENT PUBLIC KEY INFRASTRUCTURE ON

SECRET NETWORKS

▪ CNSSD 507, National Directive for Identity, Credential, and Access Mgmt. Capabilities on the U.S. Federal Secret Fabric

▪ CNSSD 510, Directive on the Use of Mobile Devices Within Secure Spaces

▪ CNSSD 520, The Use of Mobile Devices to Process National Security Information Outside of Secure Spaces

▪ NSTISSD 600, Communications Security Monitoring

▪ CNSSD 900, Governing Procedures of the Committee on National Security Systems (CNSS)

▪ CNSSD 901, National Security Telecommunications and Information Systems Security (CNSS) Issuance System

CNSS Instructions:

▪ CNSSI 1001, National Instruction On Classified Information Spillage

▪ CNSSI 1002, Management of Combined Secure Interoperability Requirements

▪ CNSSI 1010, Cyber Incident Response

▪ CNSSI 1011, Implementing Host-Based Security Capabilities on National Security Systems

▪ CNSSI 1013, Network Intrusion Detection Sys & Intrusion Prevention Sys (IDS/IPS) on NSS

▪ CNSSI 1015, Enterprise Audit Management Instruction for

▪ CNSSI 1100, Consistency and Synchronization During Classification and Declassification of Information Related to Cybersecurity of National Security Systems

▪ CNSSI 1200, Instruction for Space Systems Used to Support NSS

▪ CNSSI 1253, Security Categorization and Control Selection for National Security Systems

▪ CNSSI 1253F Attachment 1, Security Overlays Template

▪ CNSSI 1253F Attachment 2, Space Platform Overlay

▪ CNSSI 1253F Attachment 2, Space Platform Overlay

▪ CNSSI 1253F Attachment 3, Cross Domain Solution Overlay

▪ CNSSI 1253F Attachment 4, Intelligence Overlay

▪ CNSSI 1253F Attachment 4.1, IC CIO Signed Memo for Intelligence Overlay

▪ CNSSI 1253F, Attachment 5, Classified Information Overlay

▪ CNSSI 1012, Instruction for Network Mapping of National Security Systems (NSS)

▪ CNSSI 1253F Attachment 6, Privacy Overlay

▪ CNSSI 1254, Risk Management Framework Documentation, Data Element Standards, and Reciprocity Process for National Security Systems

▪ CNSSI 1300, Instruction for National Security Systems Public Key Infrastructure X.509 Certificate Policy Under CNSS Policy No. 25

▪ CNSSI 3006, Operational Security Doctrine for Global Positioning System Precise Positioning Service User Equipment

▪ NTISSI 3013, Operational Security Doctrine for the Secure Telephone Unit III (STU-III) Type 1 Terminal

▪ NSTISSI 3019, Operational Security Doctrine for the FASTLANE (KG-75 and KG-75A)

▪ CNSS-18-19, FASTLANE KG-75 and KG-75A Operational Systems Security Doctrine

▪ CNSSI 3021, Operational Security Doctrine for the AN/CYZ-10/10A Data Transfer Device

▪ NSTISSI 3022, OPSEC Doctrine for TEDs KG-81, KG-94, KG-95, KG-194, and KIV-19 in Stand Alone Applications

▪ NSTISSI 3026, Operational Security Doctrine for the Motorola Network Encryption System

(NES)

▪ NSTISSI 3028, Operational Security Doctrine for the FORTEZZA User PCMCIA Card

▪ NSTISSI 3028, Operational Security Doctrine for the FORTEZZA User PCMCIA Card

▪ CNSSI 3029, Operational Systems Security Doctrine for TACLANE (KG-175)

▪ CNSSI 3029 2004 Amendment, Operational Systems Security Doctrine for TACLANE (KG- 175)

▪ CNSSI 3029 2006 Amendment, Operational Systems Security Doctrine for TACLANE (KG- 175)

▪ NSTISSI 3030, OPSEC Security Doctrine for the FORTEZZA PLUS (KOV-14) and Cryptographic Card and Associated STE

▪ NSTISSI 3030 2006 Amendment, Amendment to NSTISSI-3030

▪ CNSSI 3031, Operation Systems Security Doctrine for the Sectera In-Line Network Encryptor

(KG-235)

▪ CNSSI 3032, Operational Security Doctrine for the VIASAT Internet Protocol (VIP) Crypto Version 1 (KIV-21)

▪ CNSSI 3034, Operational Security Doctrine for the SECNET 11 Wireless Local Area Network Interface Card

▪ CNSSI 3035, OPERATIONAL SECURITY DOCTRINE FOR THE REDEAGLE KG-245 IN-

LINE NETWORK ENCRYPTOR (INE)

▪ CNSSI 4000, Maintenance of Communications Security (COMSEC) Equipment

▪ CNSSI 4001, Controlled Cryptographic Items

▪ NSTISSI 4002

▪ NTISSI 4002 2009 Amendment, Pen and Ink Changes for NTISSI 4002

▪ NTISSI 4002 2004 Amendment, Pen and Ink Changes for NTISSI 4002 9 Jul 2004

▪ CNSSI 4003, Reporting and Evaluating Communications Security (COMSEC) Incidents

▪ CNSSI 4004.1, Destruction and Emergency Protection Procedures for COMSEC and Classified Material

▪ CNSSI 4005, Safeguarding COMSEC Facilities and Materials

▪ CNSSI 4005 Amendment This document is designated FOUO

▪ CNSS-008-14 Amendment to CNSSI 4005

▪ CNSSI 4006, Controlling Authorities for Traditional COMSEC Keying Material

▪ CNSSI 4007, Communications Security (COMSEC) Utility Program

▪ CNSS-19-19, COMSEC Utility Program Reissue Date Memo

▪ CNSSI 4008, Program for the Management and Use of National Reserve Information Assurance Security Equipment

▪ CNSS-20-19, Equipment Material Reissue Memo

▪ CNSSI 4009, Committee on National Security Systems (CNSS) Glossary

▪ NSTISSI 4010, Keying Material Management

▪ NSTISSI 4011, National Training Standard for Information Systems Security (INFOSEC) Professionals

▪ CNSSI 4012, National Information Assurance Training Standard for Senior Systems Managers

▪ CNSSI 4013, National Information Assurance Training Standard For System Administrators

(SA)

▪ CNSSI 4014, Information Assurance Training Standard for Information Systems Security Officers

▪ NSTISSI 4015, National Training Standard for Systems Certifiers

▪ CNSSI 4016, National Information Assurance Training Standard For Risk Analysts

▪ CNSSI 4031, Cryptographic High Value Products (CHVP)

▪ CNSSI 4032, Management and Use of Secure Data Network Systems

▪ CNSSI 4033, Nomenclature for Communications Security Material

▪ CNSSI 5000, Voice Over Internet Protocol (VoIP) Telephony

▪ CNSSI 5000 ANNEX I, VOICE OVER SECURE INTERNET PROTOCOL (VoSIP)

▪ CNSSI 5000 Annex J, Softphone Security Requirements

▪ CNSSI 5001, Type-Acceptance Program for Voice Over Internet Protocol (VoIP) Telephones

▪ CNSSI 5002, Telephony Isolation Used for Unified Communications Implementations Within Physically Protected Spaces

▪ CNSSI 5006, National Instruction for Approved Telephone Equipment

▪ CNSSI 5007, Telephone and Security Equipment Submission and Evaluation Procedures

▪ NACSI 6002, National COMSEC Instruction

▪ CNSSI 7003, Protected Distribution Systems

Director of National Intelligence (DNI)

For guidance on processing and handling of information that falls under the purview of DNI, please consult the classified DNI network.

The NRC’s Bring Your Own Device (BYOD) program allows NRC employees and contractor personnel to conduct official business using personally owned smart phones and tablets, as long as:

• The smart phone or tablet uses a containerized solution whereby the Contractor or NRC controls activation, deactivation, and remote wiping of the container, and the container is isolated from personal applications and data.

• NRC sensitive information is only stored or processed within the container and any stored information is encrypted.

• The operating system on the smart phone or tablet is current within 2 versions of the currently deployed operating system for the type of device.

The Contractor shall not connect personally owned devices (e.g., mobile phones, tablets, and thumb drives) to a system (e.g., desktop, mobile desktop) used to process NRC sensitive information. All work performed by the Contractor shall be in facilities and on networks and computing devices that have been authorized by the COR for processing information at the sensitivity level of the information being processed.

If the effort includes use or processing of classified information, the Contractor shall notify the NRC CO and COR in writing before the contractor begins to process classified information.

All Contractor and subcontractor personnel must acknowledge and abide by the NRC Agency- Wide Rules of Behavior for Authorized Computer Use prior to being granted access to NRC computing resources (available in NRC’s Public Agencywide Documents Access and Management System (ADAMS), located at: https://adams.nrc.gov/wba/. Search for Accession Number ML2016A026).

1.1 Definitions: The following terms are defined through the reference sources below and are current as of the date of the clause. However, if those definitions are updated by those sources at a later date, the most recent definition applies.

Adequate security - As defined in Office of Management and Budget (OMB) Circular A-130.

Classified Information - As defined in Executive Order (E.O.) 13526 or any predecessor order

Cloud computing - As defined in NIST SP 800-145.

Compromise- As defined in NIST SP 800-32; CNSSI 4009.

Computing Device - Any electronic equipment that is controlled by a central processing unit (CPU). Examples include information systems, cellular phones, tablets, laptops, Fitbit, watches, and personal computers.

Cyber incident - As defined in CNSSI 4009.

Forensic analysis, or Forensics - As defined in CNSSI 4009.

Incident - As defined in FIPS Pub 200.

Information and Communications Technology (ICT) - As defined in CNSSI 4009.

Malware - As defined in CNSSI 4009, under Malicious Code.

Media - As defined in FIPS Pub 200.

Safeguards Information (CUI//SP-SGI) - As defined in 10 CFR § 73.2.

Supply Chain Risk - As defined in 10 U.S.C. 2339a.

1.2 Adequate security

The Contractor shall protect all information handled by, processed, stored, or transmitted by the Contractor in accordance with the sensitivity of the information as determined by the NRC. The Contractor shall provide adequate security on all covered Contractor devices and information systems. All cryptography used under this award shall use the current version of FIPS 140 validated cryptographic modules operated in FIPS mode. The Contractor shall ensure NRC sensitive information is removed from Contractor-owned system components prior to component disposal. A disposal plan will be submitted to the NRC and approved by the agency’s Chief Information Security Officer (CISO) before the purging or disposal of NRC sensitive information commences.

1.2.1 Classified Information

The Contractor shall implement, at a minimum, the following information security protections to provide adequate security for classified information:

1. The Contractor shall only process and handle classified information at facilities that have NRC approval in writing for this type of information.

2. The Contractor shall follow CNSS direction and specific requirements determined by the information owner when processing, storing, or transmitting classified information.

3. The Contractor shall follow DNI policy, standards, and guidance when processing, storing or transmitting classified information that falls under the purview of the DNI.

4. The Contractor shall not process, transmit, or store classified information on an unclassified system or network.

5. The Contractor shall only store, process, or transmit classified information using systems that have been provided in writing an NRC authority to operate for classified information processing.

6. The Contractor shall not use copiers, scanners, printers, or fax machines that are connected to an unclassified network for processing classified information.

7. The Contractor shall constantly monitor scanning, printing, and faxing of classified information via an individual properly authorized for access to the information, and the Contractor shall continuously attend the machines via a properly authorized individual until completion of the process.

8. When transmitting classified information using voice telecommunications (e.g., telephone, radio, or video teleconferencing), the Contractor shall only transmit the classified information over protected systems.

9. The Contractor shall only use cryptographic modules approved by the National Security Agency (NSA) and operated as directed by NSA for protecting classified information.

10. The Contractor shall only use cryptographic modules approved by the DNI and operated as directed by the DNI for protecting Sensitive Compartmented Information (SCI) information.

11. Where not superseded by requirements in this section, the Contractor shall implement adequate security as defined in Section 1.2.3.

1.2.2 Safeguards Information (CUI//SP-SGI)

The Contractor shall implement, at a minimum, the following information security protections to provide adequate security for CUI//SP-SGI:

1. The Contractor shall only process and handle CUI//SP-SGI information at facilities that have NRC approval in writing for this type of information.

2. The Contractor shall only store, process, or transmit CUI//SP-SGI using systems that have been provided in writing an NRC authority to operate for CUI//SP-SGI processing.

3. The Contractor shall only connect CUI//SP-SGI systems to other CUI//SP-SGI systems, except where using NRC authorizing official approved (in writing) encrypted connections that permit transmission over lower-level networks. The COR will coordinate this approval with NRC’s authorizing official.

4. The Contractor shall only connect CUI//SP-SGI laptops to CUI//SP-SGI systems using techniques and capabilities specifically approved by the NRC for connecting to the CUI//SP-SGI system.

5. The Contractor may not use copiers, scanners, printers, or fax machines that are connected to an unclassified, non-safeguards information network for processing CUI//SP-SGI.

6. The Contractor shall constantly monitor scanning, printing, and faxing of CUI//SP-SGI via an individual properly authorized for access to the information, and the Contractor shall continuously attend the machines via a properly authorized individual until completion of the process.

7. When transmitting CUI//SP-SGI using voice telecommunications (e.g., telephone, radio, or video teleconferencing), the Contractor shall only transmit the CUI//SP-SGI over protected systems.

8. The Contractor shall only use cryptographic modules that are operated in FIPS mode and are FIPS 140-2 validated to at least an overall level 2 with the validation subcategories of Roles, Services, and Authentication; electromagnetic interference/electromagnetic compatibility; and Design Assurance validated to at least level 3.

9. The Contractor shall provide all media that has been used to store or process CUI//SP-SGI to NRC COR for destruction.

10. Where not superseded by requirements in this section, the Contractor shall implement adequate security as defined in Section 1.2.3.

1.2.3 Sensitive Information that is Not Classified Information and Not CUI//SP-SGI

The Contractor shall implement, at a minimum, the following information security protections to provide adequate security for sensitive information:

1. The Contractor shall ensure any ICT used for sensitive information meets the requirements identified in NIST SP 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” unless otherwise authorized by the Contracting Officer.

2. The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for their coordination with and consideration by the NRC Chief Information Officer (CIO). The Contractor need not implement any security requirement adjudicated by an authorized representative of the NRC CIO to be nonapplicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

3. If the NRC CIO has previously adjudicated the Contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, the Contractor shall provide a copy of that approval to the Contracting Officer when requesting its recognition under this contract.

4. If the Contractor’s solution utilizes a third-party cloud service that deals with NRC sensitive information, those cloud offerings must be FedRAMP authorized at least at the moderate level.

If the cloud offering deals with non-sensitive information, the cloud offerings must be FedRAMP authorized. These cloud offerings can use any impact level that is deemed appropriate.

5. The Contractor shall apply other information system security measures when the Contractor reasonably determines that information system security measures, in addition to those identified in paragraphs in this clause, may be required to provide adequate security in a dynamic environment, to accommodate special circumstances (e.g., medical devices) and to address any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability.

The contractor must address these measures in a system security plan that is approved by the

NRC CIO.

6. The Contractor shall only use FIPS 140 validated cryptographic modules and algorithms configured in accordance with the cryptographic module’s security policy.

7. If the Contractor uses email to send and receive sensitive information, the Contractor shall use an NRC provided e-mail account. Otherwise, the Contractor shall transmit sensitive information using mechanisms to protect the information during transmission that have been approved by the NRC CIO.

1.3 Cyber Incident Reporting Requirement

When the Contractor discovers a cyber incident that affects Classified or Controlled Unclassified Information or that affects the Contractor’s ability to perform the requirements of the contract, the Contractor shall—

1. Rapidly report potential or confirmed cyber incidents to the NRC CO.

2. Upon direction from the NRC COR, conduct a review for evidence of compromise of Classified or Controlled Unclassified Information, including, but not limited to, identifying compromised devices, computers, servers, specific data, and user accounts.

1.4 Subcontracting

The Contractor shall flow this clause down to all subcontracts.

1.5 Supply Chain Risk

In order to manage supply chain risk, the Government may consider information, public and non-public, including all-source intelligence, relating to an offeror/Contractor and its supply chain.

The Contractor shall ensure all hardware and software vendors used to support NRC implementations and solutions have a valid National Defense Authorization Act (NDAA) Section 889 attestation.

1.6 Award Performance and Closeout

The Contractor shall ensure that the NRC data processed during the performance of this award is purged from all data storage components of the Contractor’s computing devices, and the Contractor shall not retain any NRC data within 30 calendar days after award is completed. Until the Contractor purges all of that data, the Contractor shall ensure that any NRC data remaining in any storage component is protected in accordance with its sensitivity to prevent unauthorized disclosure.

When a representative of the Contractor no longer requires access to an NRC system, the Contractor shall notify the COR in writing within 24 hours.

Upon contract completion, the Contractor shall provide a status list in writing to the COR of all Contractor personnel who were users of NRC systems and shall note if any users still require access to the system to perform work if a follow-on award issued by the NRC.

Before the purging of NRC sensitive information can begin, a disposal plan will be submitted to the NRC and approved by the agency’s CISO.

1.7 Control of Information and Data

The Contractor shall not publish or disclose in any manner, without the CO’s prior written consent, the details of any security controls or countermeasures either designed or developed by the Contractor under this award or otherwise provided by the NRC to the Contractor.

Any computing device used by the Contractor to store, process, or transmit NRC sensitive information shall:

• Include a mechanism to require users to uniquely identify and authenticate themselves to the system before beginning to perform any other actions that the system is expected to provide.

• Be able to authenticate data that includes information for verifying the claimed identity of individual users (e.g., passwords).

• Protect authentication data so that it cannot be accessed by any unauthorized user.

• Be able to enforce individual accountability by providing the capability to uniquely identify each individual computing device user.

• Report to appropriate security personnel when attempts are made to guess the authentication data whether inadvertently or deliberately.

1.8 Access Controls

Any computing device used by the Contractor to store, process, or transmit NRC data shall be able to define and enforce access privileges for individual users. The discretionary access control mechanisms shall be configurable to protect objects (e.g., files, folders) from unauthorized access.

A computing device used by the Contractor to store, process, or transmit NRC data shall provide only essential capabilities and specifically prohibit and/or restrict the use of functions, ports, protocols, and/or services, as specified in the contract/grant.

Contractor personnel that access a computing device that processes, stores, or transmits NRC sensitive information must meet personnel security requirements identified by federal law, federal regulation, and federal government policy, as applicable, for the type of information.

The Contractor shall ensure that the most restrictive set of rights/privileges or accesses needed by users (or processes acting on behalf of users) for the performance of specified tasks is enforced by the system through assigned access authorizations.

The Contractor shall ensure separation of duties for Contractor systems used to process NRC information and enforce them by the system through assigned access authorizations.

The Contractor shall continuously protect mechanisms within the Contractor system or application that enforces access control and other security features s against tampering and/or unauthorized changes.

1.9 Media Handling

The Contractor shall control all media used by the Contractor to store or process NRC information in accordance with the information sensitivity level.

The Contractor shall not sanitize or destroy media approved for processing NRC information designated as CUI//SP-SGI or Classified. The Contractor must provide the media to the COR for destruction.

1.10 Vulnerability Management

The Contractor shall install security-relevant software and firmware updates (e.g., patches, service packs, hot fixes) in accordance with the following:

• Within 14 calendar days for vulnerabilities that have been assigned Common Vulnerabilities and Exposures (CVE) ID after January 1, 2021 and added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabliities Catalog.

• Within 30 calendar days for vulnerabilities deemed to be Critical according to the Common Vulnerability Scoring System (CVSS), as described in NRC CSO-STD-0020, Organization- Defined Values for System Security and Privacy Controls (available in NRC’s Public Agencywide Documents Access and Management System (ADAMS), located at:

https://adams.nrc.gov/wba/. Search for Accession Number ML22101A241)

• Within 30 calendar days for vulnerabilities deemed to be High according to the CVSS

• Within 90 calendar days for vulnerabilities deemed to be Moderate according to the CVSS

• Within 120 calendar days for vulnerabilities deemed to be Low according to the CVSS

If federally mandated requirements (e.g., CISA emergency directives) specify a shorter timeframe, then the contractor would be required to meet those timeframes. Examples include, but are not restricted to, CISA Emergency Directives, Binding Operational Directives and required patching/remediation for vulnerabilities within the CISA Known Exploited Vulnerabilities Catalog.

Bullets two through five are specified in NRC Computer Security Organization (CSO) Standard (STD) 0020 “System Security and Privacy Controls Standard” and are subject to change as the standard is amended.

The Contractor shall provide patch Management reports to the COR upon Contractor receipt of a written request from the COR in accordance with the following reporting timeframes:

• 5 calendar days after being requested for a classified, CUI//SP-SGI, or high sensitivity system as determined using FIPS Pub 199

• 10 calendar days after being requested for a moderate sensitivity system as determined using FIPS Pub 199

• 15 calendar days after being requested for a low sensitivity system as determined using FIPS Pub 199

The Contractor shall incorporate anti-malware solutions into all systems used to process NRC information. For any Contractor system used to process NRC information, the Contractor must ensure that:

• All information is scanned for viruses prior to allowing the system to access the information

• Servers are scanned for malware, including viruses, adware, and spyware.

• Anti-malware information is updated at least at the following frequency:

1 calendar day for a high sensitivity system

3 calendar days for a moderate sensitivity system

7 calendar days for a low sensitivity system

For any Contractor deliverables or information loaded on external hard drives or other electronic devices, the Contractor must ensure that, prior to delivery to the NRC, the device, including software and files, is free of malware, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, browser hijacking software, mobile code, or other malicious code.

B.4 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS – GENERAL

EXCEPTIONS (AUG 2023

All purchases shall comply with the latest version of policy, procedures, and standards.

Individual task orders will reference latest versions of policy, procedures, standards, or exceptions as necessary. These policy, procedures and standards include: NRC Management Directive (MD) volume 12 Security, Information Security Directorate policies, NRC processes, NRC procedures, NRC guidance, and NRC standards, National Institute of Standards and Technology (NIST) guidance and Federal Information Processing Standards (FIPS), and Committee on National Security Systems (CNSS) policy, directives, instructions, and guidance.

The applicable management directives can be found on NRC’s website here:

https://www.nrc.gov/reading-rm/doc-collections/management-directives/volumes/vol-12.html.

All procurements must be certified and accredited prior to being placed into an operational state.

All cloud services must be FedRAMP authorized. Deviations can only be approved by the NRC Chief Information Security Officer (CISO).

All electronic processing of NRC sensitive information, including all system development and operations and maintenance activities performed at non-NRC facilities shall be in facilities, networks, and computers that have been accredited by NRC for processing information at the highest sensitivity of the information that is processed, stored, or transmitted.

Exceptions to or deviations from MD 12.5 may be granted by the NRC Chief Information Officer (CIO), except for those areas in which the responsibility or authority is vested solely with the Executive Director of Operations (EDO) or Director, Office of Administration (ADM) and cannot be delegated, or for matters specifically required by law, Executive Order, or directive to be referred to other management officials.

For national security systems, nothing in MD 12.5 shall supersede any authority of the Director of National Intelligence (DNI), National Security Agency (NSA), Secretary of Defense, or other agency head, as authorized by law and as directed by the President, with regard to the operation, control, or management of national security systems. Nothing in this directive or handbook shall supersede any requirement made by or under the Atomic Energy Act of 1954.

Restricted data or formerly restricted data shall be handled, protected, classified, downgraded, and declassified in conformity with the Atomic Energy Act of 1954.

B.5 IT SECURITY REQUIREMENTS – DEVELOPMENT AND OPERATIONS AND

MAINTENANCE REQUIREMENTS (AUG 2023)

Requirements in this clause supersede less restrictive requirements in NRCAR clause Information Technology (IT) Security Requirements (May 2022) https://www.nrc.gov/about-nrc/contracting/48cfr-ch20.html.

All work under this contract and all devices used to process NRC sensitive information shall comply with the following special publications (SP), management directives, standards, and processes, as amended:

National Institute of Standard and Technology (NIST) Special Publications (SP) as amended:

▪ SP 800-12 Rev. 1, An Introduction to Information Security

▪ SP 800-15, MISPC Minimum Interoperability Specification for PKI Components, Version 1

▪ SP 800-16, Information Technology Security Training Requirements: a Role-and Performance- Based Model

▪ SP 800-18 Rev. 1, Guide for Developing Security Plans for Federal Information Systems

▪ SP 800-22 Rev. 1a, A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications

▪ SP 800-25, Federal Agency Use of Public Key Technology for Digital Signatures and Authentication

▪ SP 800-28 Version 2, Guidelines on Active Content and Mobile Code

▪ SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

▪ SP 800-32, Introduction to Public Key Technology and the Federal PKI Infrastructure

▪ SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems

▪ SP 800-35, Guide to Information Technology Security Services

▪ SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations:

A System Life Cycle Approach for Security and Privacy

▪ SP 800-38A, Recommendation for Block Cipher Modes of Operation: Methods and Techniques

▪ SP 800-38A Addendum, Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode

▪ SP 800-38B, Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication

▪ SP 800-38C, Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality

▪ SP 800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC

▪ SP 800-38E, Recommendation for Block Cipher Modes of Operation: the XTS-AES Mode for Confidentiality on Storage Devices

▪ SP 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping

▪ SP 800-38G, Recommendation for Block Cipher Modes of Operation: Methods for Format- Preserving Encryption

▪ SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View

▪ SP 800-40 Rev. 3, Guide to Enterprise Patch Management Technologies

▪ SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy

▪ SP 800-44 Version 2, Guidelines on Securing Public Web Servers

▪ SP 800-45 Version 2, Guidelines on Electronic Mail Security

▪ SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security

▪ SP 800-47, Security Guide for Interconnecting Information Technology Systems

▪ SP 800-49, Federal S/MIME V3 Client Profile

▪ SP 800-50, Building an Information Technology Security Awareness and Training Program

▪ SP 800-51 Rev. 1, Guide to Using Vulnerability Naming Schemes

▪ SP 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

▪ SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations

▪ SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

▪ SP 800-53A Rev. 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans

▪ SP 800-53B, Control Baselines for Information Systems and Organizations

▪ SP 800-55 Rev. 1, Performance Measurement Guide for Information Security

▪ SP 800-56A Rev. 3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography

▪ SP 800-56B Rev. 2, Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography

▪ SP 800-56C Rev. 2, Recommendation for Key-Derivation Methods in Key-Establishment Schemes

▪ SP 800-57 Part 1 Rev. 5, Recommendation for Key Management: Part 1 – General

▪ SP 800-57 Part 2 Rev. 1, Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations

▪ SP 800-57 Part 3 Rev. 1, Recommendation for Key Management, Part 3: Application-Specific Key Management Guidance

▪ SP 800-58, Security Considerations for Voice Over IP Systems

▪ SP 800-59, Guideline for Identifying an Information System as a National Security System

▪ SP 800-60 Vol. 1 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories

▪ SP 800-60 Vol. 2 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices

▪ SP 800-61 Rev. 2, Computer Security Incident Handling Guide

▪ SP 800-63-3, Digital Identity Guidelines

▪ SP 800-63A, Digital Identity Guidelines: Enrollment and Identity Proofing

▪ SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management

▪ SP 800-63C, Digital Identity Guidelines: Federation and Assertions

▪ SP 800-66 Rev. 1, An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

▪ SP 800-67 Rev. 2, Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher

▪ SP 800-70 Rev. 4, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers

▪ SP 800-72, Guidelines on PDA Forensics

▪ SP 800-73-4, Interfaces for Personal Identity Verification

▪ SP 800-76-2, Biometric Specifications for Personal Identity Verification

▪ SP 800-77 Rev. 1, Guide to IPsec VPNs

▪ SP 800-78-4, Cryptographic Algorithms and Key Sizes for Personal Identity Verification

▪ SP 800-79-2, Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)

▪ SP 800-81-2, Secure Domain Name System (DNS) Deployment Guide

▪ SP 800-82 Rev. 2, Guide to Industrial Control Systems (ICS) Security

▪ SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops

▪ SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

▪ SP 800-85A-4, PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)

▪ SP 800-85B, PIV Data Model Test Guidelines

▪ SP 800-86, Guide to Integrating Forensic Techniques into Incident Response

▪ SP 800-87 Rev. 2, Codes for Identification of Federal and Federally-Assisted Organizations

▪ SP 800-88 Rev. 1, Guidelines for Media Sanitization

▪ SP 800-89, Recommendation for Obtaining Assurances for Digital Signature Applications

▪ SP 800-90A Rev. 1, Recommendation for Random Number Generation Using Deterministic Random Bit Generators

▪ SP 800-90B, Recommendation for the Entropy Sources Used for Random Bit Generation

▪ SP 800-92, Guide to Computer Security Log Management

▪ SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)

▪ SP 800-95, Guide to Secure Web Services

▪ SP 800-96, PIV Card to Reader Interoperability Guidelines

▪ SP 800-97, Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i

▪ SP 800-98, Guidelines for Securing Radio Frequency Identification (RFID) Systems

▪ SP 800-100, Information Security Handbook: A Guide for Managers

▪ SP 800-101 Rev. 1, Guidelines on Mobile Device Forensics

▪ SP 800-102, Recommendation for Digital Signature Timeliness

▪ SP 800-106, Randomized Hashing for Digital Signatures

▪ SP 800-107 Rev. 1, Recommendation for Applications Using Approved Hash Algorithms

▪ SP 800-108, Recommendation for Key Derivation Using Pseudorandom Functions (Revised)

▪ SP 800-111, Guide to Storage Encryption Technologies for End User Devices

▪ SP 800-113, Guide to SSL VPNs

▪ SP 800-114 Rev. 1, User's Guide to Telework and Bring Your Own Device (BYOD) Security

▪ SP 800-115, Technical Guide to Information Security Testing and Assessment

▪ SP 800-116 Rev. 1, Guidelines for the Use of PIV Credentials in Facility Access

▪ SP 800-119, Guidelines for the Secure Deployment of IPv6

▪ SP 800-121 Rev. 2, Guide to Bluetooth Security

▪ SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

▪ SP 800-123, Guide to General Server Security

▪ SP 800-124 Rev. 1, Guidelines for Managing the Security of Mobile Devices in the Enterprise

▪ SP 800-125, Guide to Security for Full Virtualization Technologies

▪ SP 800-125A Rev. 1, Security Recommendations for Server-based Hypervisor Platforms

▪ SP 800-125B, Secure Virtual Network Configuration for Virtual Machine (VM) Protection

▪ SP 800-126 Rev. 1, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1

▪ SP 800-126 Rev. 2, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2

▪ SP 800-126 Rev. 3, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.3

▪ SP 800-126A, SCAP 1.3 Component Specification Version Updates: An Annex to NIST Special Publication 800-126 Revision 3

▪ SP 800-128, Guide for Security-Focused Configuration Management of Information Systems

▪ SP 800-130, A Framework for Designing Cryptographic Key Management Systems

▪ SP 800-131A Rev. 2, Transitioning the Use of Cryptographic Algorithms and Key Lengths

▪ SP 800-132, Recommendation for Password-Based Key Derivation: Part 1: Storage Applications

▪ SP 800-133 Rev. 2, Recommendation for Cryptographic Key Generation

▪ SP 800-135 Rev. 1, Recommendation for Existing Application-Specific Key Derivation Functions

▪ SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

▪ SP 800-137A, Assessing Information Security Continuous Monitoring (ISCM) Programs:

Developing an ISCM Program Assessment

▪ SP 800-140, FIPS 140-3 Derived Test Requirements (DTR): CMVP Validation Authority Updates to ISO/IEC 24759

▪ SP 800-140A, CMVP Documentation Requirements: CMVP Validation Authority Updates to

ISO/IEC 24759

▪ SP 800-140B, CMVP Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B

▪ SP 800-140C, CMVP Approved Security Functions: CMVP Validation Authority Updates to

ISO/IEC 24759

▪ SP 800-140D, CMVP Approved Sensitive Parameter Generation and Establishment Methods:

CMVP Validation Authority Updates to ISO/IEC 24759

▪ SP 800-140E, CMVP Approved Authentication Mechanisms: CMVP Validation Authority Requirements for ISO/IEC 19790 Annex E and ISO/IEC 24579 Section 6.17

▪ SP 800-140F, CMVP Approved Non-Invasive Attack Mitigation Test Metrics: CMVP Validation Authority Updates to ISO/IEC 24759

▪ SP 800-142, Practical Combinatorial Testing

▪ SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing

▪ SP 800-145, The NIST Definition of Cloud Computing

▪ SP 800-146, Cloud Computing Synopsis and Recommendations

▪ SP 800-147, BIOS Protection Guidelines

▪ SP 800-147B, BIOS Protection Guidelines for Servers

▪ SP 800-150, Guide to Cyber Threat Information Sharing

▪ SP 800-152, A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)

▪ SP 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs)

▪ SP 800-156, Representation of PIV Chain-of-Trust for Import and Export

▪ SP 800-160 Vol. 1, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

▪ SP 800-160 Vol. 2, Developing Cyber Resilient Systems: A Systems Security Engineering Approach

▪ SP 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations

▪ SP 800-162, Guide to Attribute Based Access Control (ABAC) Definition and Considerations

▪ SP 800-163 Rev. 1, Vetting the Security of Mobile Applications

▪ SP 800-166, Derived PIV Application and Data Model Test Guidelines

▪ SP 800-167, Guide to Application Whitelisting

▪ SP 800-168, Approximate Matching: Definition and Terminology

▪ SP 800-175A, Guideline for Using Cryptographic Standards in the Federal Government:

Directives, Mandates and Policies

▪ SP 800-175B Rev. 1, Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms

▪ SP 800-177 Rev. 1, Trustworthy Email

▪ SP 800-179, Guide to Securing Apple OS X 10.10 Systems for IT Professionals: A NIST Security Configuration Checklist

▪ SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework)

▪ SP 800-183, Networks of 'Things'

▪ SP 800-184, Guide for Cybersecurity Event Recovery

▪ SP 800-185, SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash, and ParallelHash

▪ SP 800-187, Guide to LTE Security

▪ SP 800-189, Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation

▪ SP 800-190, Application Container Security Guide

▪ SP 800-192, Verification and Test Methods for Access Control…