36C10E19R0003-0003001.docx

Additional Cloud-specific Security and Privacy Requirements

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The contractor shall create, maintain and update the following documentation using FedRAMP requirements and templates, which are available at www.FedRAMP.gov. The FedRAMP ATO package is comprised of this documentation:

· Privacy Impact Assessment (PIA)

· FedRAMP Test Procedures and Results

· Security Assessment Report (SAR)

· System Security Plan (SSP)

· IT System Contingency Plan (CP)

· IT System Contingency Plan (CP) Test Results

· Plan of Action and Milestones (POA&M)

· Continuous Monitoring Plan (CMP)

· FedRAMP Control Tailoring Workbook

· Control Implementation Summary Table

· Results of Penetration Testing

· Software Code Review

· Interconnection Agreements/Service Level Agreements/Memorandum of Agreements

3. The information system must be assessed by an accredited 3PAO to support initial authorization and whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

4. The Contractor shall apply the appropriate set of baseline controls in accordance with VA’s categorization of the system (as defined in FIPS 199), as required in the FedRAMP Security Requirements Baseline document to ensure compliance to security standards.

5. The Contractor shall, where applicable, assist with the VA Authority to Operate (ATO) Process to help achieve agency authorization of a cloud service or migrated application.

6. The Contractor shall maintain a security management continuous monitoring environment based upon the latest edition of FedRAMP Security Controls Baseline and FedRAMP Continuous Monitoring Strategy Plan.

7. Information systems must be assessed by an accredited 3PAO to support initial authorization and whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

8. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public VA data collected and stored by the Contractor, the Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the SLA and security appendix B.

10. The Contractor shall comply with all VA and FedRAMP privacy requirements.

11. VA has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the VA.

12. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor’s implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Department may require them to be remediated before a provisional authorization is issued.

13. No data shall be released by the Contractor without the consent of VA in writing. All requests for release must be submitted in writing to the COR/CO.

14. VA may choose to cancel the Contract and terminate any outstanding orders if the contractor has its ATO revoked and the deficiencies are greater than VA risk tolerance thresholds.

15. VA reserves the right to perform Penetration Testing. If VA exercises this right, the contractor shall allow VA employees (or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with FedRAMP requirements.

16. FedRAMP deliverables shall be labeled “CONTROLLED UNCLASSIFIED INFORMATION” (CUI) or contractor selected designation per document sensitivity. External transmission/dissemination of FOUO and CUI to or from a VA computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security requirements for Cryptographic Modules.”

Deliverables:

A. FedRAMP ATO Package (as decribed in 2 above)

FedRAMP References:

https://www.fedramp.gov/resources/documents/