47QMCB23N0007_Attachment E_ Security_Requirements_2023-09-18.pdf

Government Wide TDY Lodging 2.0 Security Requirements

FedRooms® and DoD Preferred® contract solution shall meet or exceed the following requirements for personnel and physical security:

Required Policies and Regulations for GSA Contracts

Federal Laws, Regulations, and Guidance:

The contractor shall comply with all applicable Federal Laws and Regulations.

● 40 U.S.C. 11331, “Responsibilities for Federal Information Systems Standards”

● Executive Order (EO) 13556, “Controlled Unclassified Information”

● FISMA of 2014, “The Federal Information Security Modernization Act of 2014”

● HSPD 12, “Homeland Security Presidential Directive 12 – Policy for a Common

Identification Standard for Federal Employees and Contractors”

● OMB Circular A-130, “Managing Information as a Strategic Resource”

● OMB M-08-23, “Securing the Federal Government’s Domain Name System

Infrastructure (Submission of Draft Agency Plans Due by September 5, 2008)”

● OMB M 14-03, “Enhancing the Security of Federal Information and Information Systems”

● OMB M-10-23, “Guidance for Agency Use of Third-Party Websites and Applications”

● OMB M-15-13, “Policy to Require Secure Connections across Federal Websites and

Web Services”

● OMB M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable

Information”

● Privacy Act of 1974, “5 USC, § 552a”

● National Archives and Records Administration (NARA) Controlled Unclassified

Information (CUI) Registry

● OMB Memoranda, location of current fiscal year guidance on Federal Information

Security and Privacy Management Requirements, including FISMA reporting

Federal Standards and Guidance:

The contractor shall comply with all applicable Federal Information Processing Standards (FIPS). NIST Special Publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

● FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems”

● FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems”

● FIPS PUB 140-2*, “Security Requirements for Cryptographic Modules”

● FIPS PUB 140-3, “Security Requirements for Cryptographic Modules”

● NIST SP 800-18, Revision 1, “Guide for Developing Security Plans for Federal

Information Systems”

● NIST SP 800-30, Revision 1, “Guide for Conducting Risk Assessments”

● NIST SP 800-34, Revision 1, “Contingency Planning Guide for Federal Information

Systems”

● NIST SP 800-37, Revision 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy”

● NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems”

● NIST SP 800-53, Revision 5, “Security and Privacy Controls for Federal Information

Systems and Organizations”

● NIST SP 800-53A, Revision 4**, “Assessing Security and Privacy Controls in Federal

Information Systems and Organizations: Building Effective Assessment Plans”

● NIST SP 800-63-3, “Digital Identity Guidelines”

● NIST SP 800-122, “Guide to Protecting the Confidentiality of Personally Identifiable

Information (PII)”

● NIST SP 800-137, “Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations”

● NIST SP 800-161, “Supply Chain Risk Management Practices for Federal Information

Systems and Organizations”

Note:

“*” NIST has issued FIPS 140-3, FIPS 140-2 modules are still being validated and will be accepted through September 22, 2026. For additional information see the NIST cryptographic module validation program webpage.

“**” When NIST SP 800-53A, Revision 5 is final, assessments shall be aligned to it.

GSA Policies:

The contractor shall comply with the following GSA Directives/Policies.

● GSA Order CIO 1878.3, “Developing and Maintaining Privacy Threshold Assessments, Privacy Impact Assessments, Privacy Act Notices, and System of Records Notices”

● GSA Order CIO 2100.1, “GSA Information Technology (IT) Security Policy”

● GSA Order CIO 2200.1, “GSA Privacy Act Program”

● GSA Order CIO 9297.2, “GSA Information Breach Notification Policy”

The GSA policies listed in this paragraph must be followed, if applicable.

● GSA Order CIO 2103.1, “Controlled Unclassified Information (CUI) Policy”

● GSA Order CIO 2104.1, “GSA Information Technology (IT) General Rules of Behavior”

● GSA Order CIO 2182.2, “Mandatory Use of Personal Identity Verification (PIV)

GSA Procedural Guides:

GSA IT Procedural Guides are guidance, unless required by a GSA Directive/Policy, in which case usage is mandatory.

Note: GSA’s Procedural Guides are updated frequently; to make sure you have the most recent version of publicly available procedural guides, visit GSA.gov. If a non-publicly available guide is needed, contact the contracting officer who will coordinate with the GSA Office of the Chief Information Security Officer to determine if it can be made available.

GSA Security Compliance Requirements FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems,” is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Information systems supporting GSA must meet the minimum security and privacy requirements through the use of security controls in accordance with NIST Special Publication 800-53, Revision 5 (hereafter described as NIST 800-53), “Security and Privacy Controls for Federal Information Systems and Organizations.”

To comply with the Federal standard, GSA must determine the security category of the information and information system in accordance with FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems,” and then the contractor shall apply the appropriately tailored set of Low, Moderate, or High impact baseline security controls in NIST 800-53, as determined by GSA. NIST 800-53 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with GSA specifications. The GSA-specified control parameters and supplemental guidance defining more specifically the requirements per FIPS PUB 199 impact level are available in the GSA Control Tailoring Workbook.

Note: The GSA Control Tailoring Workbook contains GSA defined values for NIST SP 800-53 Security and Privacy Controls. The workbook is not publicly available; contact the contracting officer who will coordinate with the GSA Office of the Chief Information Security Officer to determine if it can be made available.

The Contractor shall use GSA technical guidelines, NIST guidelines, Center for Internet Security (CIS) guidelines (Level 1), or industry best practice guidelines in hardening their systems.

Essential Security Controls All NIST 800-53 controls must be implemented as per the applicable FIPS PUB 199 Low, Moderate, or High baseline. The Contractor shall make the proposed system and security architecture of the information system available to the Security Engineering Division, in the Office of the Chief Information Security Officer for review and approval before commencement of system build (architecture, infrastructure, and code).

Note: Privacy controls are not associated with a baseline. Controls are applicable/not applicable based on PII data being collected, stored, or transmitted.

Assessment and Authorization (A&A) Activities

The implementation of a new Federal Government IT system requires a formal approval process known as Assessment and Authorization (A&A). NIST Special Publication 800-37, Revision 2 (hereafter described as NIST 800-37) and GSA IT Security Procedural Guide 06-30, “Managing Enterprise Cybersecurity Risk,” provide guidelines for performing the A&A process.

The Contractor system/application must have a valid assessment and authorization, known as an Authority to Operate (ATO) (signed by the Federal government) before going into operation and processing GSA information. The failure to obtain and maintain a valid ATO will result in the termination of the contract. The system must have a new A&A conducted (signed by the Federal government) when significant changes are made to the system, and as specified in GSA IT Security Procedural Guide 06-30, “Managing Enterprise Cybersecurity Risk,” and the guides for GSA’s other A&A processes referenced therein.

Assessing the System

1. The Contractor shall comply with Assessment and Authorization (A&A) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the A&A is based on the System’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. Documents that contain CUI must be marked as such. Not all deliverables contain CUI. When in question, the contractor should use the NARA CUI Registry to help determine the appropriate designation for marking, handling or transmitting. The contractor shall create, maintain and update the following A&A documentation:

● System Security Privacy and Plan (SSPP) completed in agreement with NIST Special Publication 800-18, Revision 1, “Guide for Developing Security Plans for Federal Information Systems” and completed in accordance with GSA SSPP requirements and templates. The SSPP shall include as appendices required policies and procedures across 17 control families mandated per FIPS PUB 200, Rules of Behavior, and Interconnection Security Agreements (in agreement with NIST Special Publication 800- 47, “Security Guide for Interconnecting Information Technology Systems”). The SSPP shall include; as an appendix, a completed GSA Control Tailoring Workbook (CTW) identified in Appendix A of this guide. The column in the CTW titled “Vendor/Contractor Defined Values” shall be used to document all contractor implemented parameter settings that differ from the GSA Defined Value and the Vendor/Contractor defined value when the value is deferred to the Vendor/Contractor. GSA’s approval will be documented in the CTW column titled “GSA Approval of Vendor/Contractor Defined Values.”

● Contingency Plan completed in agreement with NIST Special Publication 800-34 and GSA IT Security Procedural Guide 06-29, “Contingency Planning.”

● Business Impact Assessment completed in agreement with NIST Special Publication 800-34 and GSA IT Security Procedural Guide 06-29, “Contingency Planning.”

● Contingency Plan Test Report completed in agreement with GSA IT Security Procedural Guide 06-29, “Contingency Planning.”

● Incident Response Plan completed in agreement with NIST Special Publication 800-61, “Computer Security Incident Handling Guide” and GSA IT Security Procedural Guide 01- 02, “Incident Response.”

● Incident Response Test Report completed in agreement NIST Special Publication 800- 61, “Computer Security Incident Handling Guide” and GSA IT Security Procedural Guide 01-02, “Incident Response.”

● Configuration Management Plan completed in agreement with GSA IT Security Procedural Guide 01-05, “Configuration Management.”

● Plan of Action & Milestones completed in agreement with GSA IT Security Procedural Guide 09-44, “Plan of Action and Milestones (POA&M).”

● Penetration Test Reports documenting the results of vulnerability analysis and exploitability of identified vulnerabilities. Note: Penetration testing is required for all Internet accessible, all FIPS 199 High, and all High Value Asset (HVA) information systems. These systems are required to complete an independent penetration test and provide an Independent Penetration Test Report documenting the results of the exercise as part of the A&A package. Reference GSA IT Security Procedural Guide 06-30, “Managing Enterprise Cybersecurity Risk” and GSA IT Security Procedural Guide 11-51, “Conducting Penetration Test Exercises” for penetration testing guidance.

2. Information systems must be assessed and authorized every three (3) years or whenever there is a significant change to the system's security posture in accordance with NIST Special Publication 800-37, Revision 2, " Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," and CIO IT Security 06- 30, "Managing Enterprise Cybersecurity Risk" or via continuous monitoring based on GSA CIO IT Security 12-66, "Information Security Continuous Monitoring (ISCM) Strategy & Ongoing Authorization (OA) Program" that is reviewed and accepted by the GSA CISO.

3. At the Moderate impact level and higher, the contractor is responsible for providing an independent Security Assessment/Risk Assessment in accordance with GSA IT Security Procedural Guide 06-30, “Managing Enterprise Cybersecurity Risk.”

4. If the Government is responsible for providing a Security Assessment/Risk Assessment and Penetration Test, the Contractor shall allow GSA employees (or GSA designated third party contractors) to conduct A&A activities to include control reviews in accordance with NIST 800- 53/NIST 800-53A and GSA IT Security Procedural Guide 06-30, “Managing Enterprise Cybersecurity Risk.” Review activities include but are not limited to operating system vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, or security of GSA information. This includes the general support system infrastructure.

5. Identified gaps between required NIST 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document completed in accordance with GSA IT Security Procedural Guide 09-44, “Plan of Action and Milestones (POA&M).” Depending on the severity of the gaps, the Government may require them to be remediated before an Authorization to Operate is issued.

6. The Contractor is responsible for mitigating all security risks found during the A&A and continuous monitoring activities. Vulnerabilities must be mitigated as follows:

(1) For Internet-accessible IP addresses

(a) Any Critical (Very High) scan vulnerabilities must be remediated within 15 days.

(b) Any High scan vulnerabilities must be remediated within 30 days.

(c) Any Moderate scan vulnerabilities must be remediated within 90 days.

(2) For all other assets

(a) Any Critical (Very High) and High scan vulnerabilities must be remediated within 30 days.

(b) Any Moderate scan vulnerabilities must be remediated within 90 days.

7. The Government will determine the risk rating of vulnerabilities.

Authorization of the System

1. Upon receipt of the documentation (A&A Package) described in GSA IT Security Procedural Guide 06-30, “Managing Enterprise Cybersecurity Risk” and NIST Special Publication 800-37 as documented above, the GSA Authorizing Official (AO) for the system (in coordination with the GSA Chief Information Security Officer (CISO), System Owner, Information System Security Manager (ISSM), and Information System Security Officer (ISSO) will render an authorization decision to:

● Authorize system operation w/out any restrictions or limitations on its operation;

● Authorize system operation w/restriction or limitation on its operation, or;

● Not authorized for operation.

2. The Contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. At its option, the Government may choose to conduct on site surveys. The Contractor shall make appropriate personnel available for interviews and documentation during this review.

Reporting and Continuous Monitoring Maintenance of the security authorization to operate will be through continuous monitoring of security controls of the external system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to GSA per the schedules below. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. They allow GSA AOs to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur.

Vendor deliverables as identified below will be reviewed and accepted or rejected by the process described in GSA CIO IT Security Procedural Guide 19-101, “External Information System Monitoring.”

Deliverables to be provided Quarterly to the GSA ISSO, ISSM, and/or COR

1. Vulnerability Scanning

Reference: NIST 800-53 control RA-5 Provide the most recent Web Application and Operating System vulnerability scan reports. GSA’s control parameter for RA-5, Vulnerability Scanning, specifies the following type and frequency of scans; weekly authenticated scans of operating systems (OS)-including databases, monthly unauthenticated scans of web applications, annual authenticated scans of web applications

2. Plan of Action & Milestones (POA&M) Update Reference: NIST 800-53 control CA-5 Provide POA&M updates in accordance with requirements and the schedule set forth in GSA CIO IT Security Procedural Guide 09- 44, “Plan of Action and Milestones (POA&M).”

Deliverables to be provided Annually or when there is a major change to the GSA ISSO, ISSM, and/or COR

Note: Deliverables annotated with a “*” below may be attested to via an attestation letter as described in GSA CIO-IT Security-19-101, “External Information System Monitoring.”

1. Updated A&A documentation including the System Security Privacy and Plan, Contingency Plan, and Business Impact Analysis

a. System Security Privacy and Plan Reference: NIST 800-53 control PL-2 Review and update the System Security Privacy and Plan annually to ensure the plan is current and accurately describes implemented system controls and reflects changes to the contractor system and its environment of operation. The System Security Privacy and Plan must be in accordance with NIST 800-18, Revision 1, “Guide for Developing Security Plans.”

b. Contingency Plan Reference: NIST 800-53 control CP-2 Provide an annual update to the contingency plan completed in accordance with NIST 800-34, “Contingency Planning Guide for Federal Information Systems”, and GSA IT Security Procedural Guide 06-29, “Contingency Planning.”

c. Business Impact Analysis

Reference: NIST 800-53 control CP-2 Provide an annual update to the business impact analysis completed in accordance with NIST 800-34, “Contingency Planning Guide for Federal Information Systems”, and GSA IT Security Procedural Guide 06-29, “Contingency Planning.”

2. User Certification/Authorization Review Documents

Reference: NIST 800-53 control AC-2 Provide the results of the annual review and validation of system users’ accounts to ensure the continued need for system access.

The user certification and authorization documents will illustrate how the organization establishes, activates, modifies, reviews, disables, and removes information system accounts in accordance with documented account management procedures.

3. *Separation of Duties Document/Matrix

Reference: NIST 800-53 control AC-5 Develop and furnish a separation of duties matrix reflecting proper segregation of duties for IT system maintenance, management, and development processes. The separation of duties matrix will be updated or reviewed on an annual basis.

4. *Information Security Awareness and Training Records

Reference: NIST 800-53 control AT-4 Provide the results of security awareness (AT-2) and role-based information security technical training (AT-3). AT-2 requires basic security awareness training for employees and contractors that support the operation of the contractor system. AT-3 requires information security technical training to information system security roles. Training shall be consistent with the requirements contained in C.F.R. Part 5 Subpart C (5 C.F.R 930.301) and conducted at least annually.

5. Annual FISMA Self-Assessment Reference: NIST 800-53 control CA-2 Deliver the results of the annual FISMA self-assessment conducted per GSA IT Security Procedural Guide 04-26, “Federal Information Security Modernization Act (FISMA) Implementation.” Based on the controls selected for self-assessment, the GSA OCISO will provide the appropriate test cases for completion.

6. *System(s) Baseline Configuration Standard Document

Reference: NIST 800-53 control CM-2/CM-2(1) Provide a well-defined, documented, and up-to-date specification to which the information system is built.

7. System Configuration Settings Verification

Reference: NIST 800-53 control CM-6/CM-6(1) Establish and document mandatory configuration settings for information technology products employed within the information system that reflect the most restrictive mode consistent with operational requirements. Configuration settings are the configurable security-related parameters of information technology products that compose the information system. Systems should be configured in agreement with GSA technical guidelines, NIST guidelines, Center for

Internet Security guidelines (Level 1), or industry best practice guidelines in hardening systems, as reviewed and accepted by the GSA AO.

Provide the most recent operating system Configuration Settings Compliance scan report.

8. Configuration Management Plan

Reference: NIST 800-53 control CM-9 Provide an annual update to the Configuration Management Plan for the information system.

9. Contingency Plan Test Report

Reference: NIST 800-53 control CP-4 Provide a contingency plan test report completed in accordance with GSA IT Security Procedural Guide 06-29, “Contingency Planning.” A continuity test shall be conducted annually prior to mid-July of each year. The continuity test can be a tabletop test while the system is at the FIPS PUB 199 Low Impact level.

The tabletop test must include Federal and hosting Contractor representatives.

Functional exercises must be completed once every three years for FIPS PUB 199 Moderate impact systems and annually for FIPS PUB 199 High impact systems.

10. Incident Response Test Report

Reference: NIST 800-53 control IR-3 Provide an incident response plan test report documenting results of incident reporting process per GSA IT Security Procedural Guide 01-02, “Incident Response.”

11. Information System Interconnection Security Agreements (if applicable)

Reference: NIST 800-53 control CA-3 Provide Interconnection Security Agreements (ISA) and supporting Memorandum of Agreement/Understanding (MOA/U), completed in accordance with NIST 800-47, “Security Guide for Connecting Information Technology Systems,” if there are existing or new interconnections. Per NIST 800-47, an interconnection is the direct connection of two or more IT systems for the purpose of sharing data and other information resources through a pipe, such as ISDN, T1, T3, DS3, VPN, etc. ISAs shall be submitted as appendices as part of the annual System Security Privacy and Plan submission. ISAs shall include, if applicable, any changes since the last submission; updated ISAs are required at least every three years.

12. *Rules of Behavior

Reference: NIST 800-53 control PL-4 Define and establish Rules of Behavior for information system users. Rules of Behavior shall be submitted as an appendix to the System Security Privacy and Plan.

13. Penetration Testing Report

Reference: NIST 800-53 control CA-8 All Internet accessible systems, and all FIPS PUB 199 High impact systems are required to complete an independent penetration test and provide a Penetration Test Report documenting the results of the exercise as part of their A&A package. Annual penetration tests are required for these same systems in accordance with GSA Order CIO 2100.1 and CIO-IT Security-11-51, “Conducting Penetration Test Exercises.”

14. *Personnel Screening and Security

Reference: NIST 800-53 control PS-3, NIST 800-53 control PS-7 Furnish documentation reflecting favorable adjudication of background investigations for all personnel (including subcontractors) supporting the system. Contractors shall comply with GSA Order CIO 2100.1, “GSA Information Technology (IT) Security Policy” and GSA Order ADM 2181.1, “Homeland Security Presidential Directive-12, Personal Identity Verification and Credentialing, and Background Investigations for Contractors.” GSA separates the risk levels for personnel working on Federal computer systems as follows:

● A favorable initial fitness/suitability determination must be granted, and a Tier 1 or higher background investigation initiated before access to the GSA network or any GSA IT system. There shall be no waivers to this requirement for GSA network and IT system access for GSA employees or contractors.

● A favorable initial fitness/suitability determination must be granted, and a Tier 2 or higher background investigation initiated before access to PII/CUI is granted.

The authority and access shall be determined by the appropriate GSA Supervisor (for GSA employees) or CO (for contract personnel), Data Owner, and the System's AO. Each System's AO, with the request of the GSA Supervisor, Data Owner or CO, shall evaluate the risks associated with each such request.

● A favorable suitability determination must be completed at a Tier 2 or higher background investigation before privileged access to the GSA network or IT systems is granted. A waiver may be requested in order to maintain GSA business operations; however, such requests should be used judiciously and not incur unnecessary risks to GSA.

If final adjudication of a background investigation is unfavorable, GSA network and IT system access must be revoked, and any GFE, including the GSA PIV card, must be retrieved and returned to OMA.

Deliverables to be provided Biennially to the GSA ISSO, ISSM, and/or COR

Note: Deliverables annotated with a “*” below may be attested to via an attestation letter as described in GSA CIO IT Security Procedural Guide 19-101, “External Information System Monitoring.”

1. Policies and Procedures

Develop and maintain current the following policies and procedures:

a. *Access Control Policy and Procedures (NIST 800-53 AC-1)

b. *Awareness and Training Policy and Procedures (NIST 800-53 AT-1)

c. *Audit and Accountability Policy and Procedures (NIST 800-53 AU-1)

d. *Identification and Authentication Policy and Procedures (NIST 800-53 IA-1)

e. *Incident Response Policy and Procedures (NIST 800-53 IR-1, reporting timeframes are documented in GSA IT Security Procedural Guide 01-02, “Incident Response”

f. *System Maintenance Policy and Procedures (NIST 800-53 MA-1)

g. *Media Protection Policy and Procedures (NIST 800-53 MP-1)

h. *Physical and Environmental Protection Policy and Procedures (NIST 800-53

PE-1)

i. *Personnel Security Policy and Procedures (NIST 800-53 PS-1)

j. *PII Processing and Transparency (NIST 800-53 PT-1 Policy and Procedures) (if applicable)

k. *System and Information Integrity Policy and Procedures (NIST 800-53 SI-1)

l. *System and Communication Protection Policy and Procedures (NIST 800-53

SC-1)

m. *Key Management Policy (NIST 800-53 SC-12 Cryptographic Key Establishment and Management)

n. *Supply Chain Risk Management (NIST 800-53 SR-1 Policy and Procedures)

GSA Privacy Requirements Personally identifiable information (PII) <SELECT: is or is not> in the scope of the acquisition and PII <SELECT: is or is not> expected to be stored, processed, or transmitted in the vendor's information system. The collection, maintenance or dissemination of any PII that is subject to the Privacy Act and/or the E-Government Act will be handled in full accordance with all GSA rules of conduct and in accordance with GSA Privacy Program requirements.

The contractor shall work with GSA to prepare a Privacy Threshold Assessment (PTA) to confirm and document PII is not in scope, or to determine which categories of information will be stored, processed, or transmitted by the system. The PTA must be completed before development begins and whenever a change with a privacy impact (e.g., a new category of information is collected) is made to an existing system. PTAs are required as part of GSA’s process to determine whether a Privacy Impact Assessment (PIA) and/or a System of Records Notice (SORN) is required, and if any other privacy requirements apply to the information system. Information regarding PIAs can be found at GSA’s PIA webpage.

PII (should it come into scope) will require the following guidelines be adhered to.

● The vendor’s information system must be authorized at least at the FIPS PUB 199 Moderate level.

● For any system that collects, maintains or disseminates PII, a PIA must be completed by the contractor and provided to the GSA Privacy Office for review along with the other authorization to operate (ATO) documents.

● If the system retrieves information using PII, the Privacy Act applies and it must have a System of Records Notice (SORN) published in the Federal Register.

● If PII is collected from individuals by the system, a Privacy Act Statement (i.e., Privacy Notice) must be provided to users prior to their use of the application on what data is being collected and why, as well as the authority for the collection and the impact of not providing some or all of it. The Privacy Act Statement must be available to the individual directly on the form used to collect the information. Providing a link back to the Statement from the form is acceptable.

Per OMB A-130 Privacy Act Statements must include:

(1) the authority (whether granted by statute or executive order) that authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary;

(2) the principal purpose(s) for which the information is intended to be used;

(3) the published routine uses to which the information is subject;

(4) the effects on the individual, if any, of not providing all or any part of the requested information; and

(5) an appropriate citation (and, if practicable, a link) to the relevant SORN(s).

Note: Systems that access data a user creates must assume a user may include privacy data/PII in the system unless the data creation is restricted to data controlled by the system.

All contractor staff who have significant privacy information responsibilities must complete GSA’s mandatory privacy awareness and role-based training courses. This includes contractors who work with PII as part of their work duties (e.g., Human Resource staff, Finance staff, and managers/supervisors).

Additional Stipulations

1. When containing sensitive information, deliverables shall be labeled Controlled Unclassified Information (CUI) or contractor selected designation per document sensitivity. Not all deliverables contain CUI. When in question, the contractor should use the National Archives and Records Administration (NARA) CUI Registry to help determine the appropriate designation for marking. External transmission/dissemination of CUI to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140- 2, “Security Requirements for Cryptographic Modules.”

2. The Contractor shall certify applications are fully functional and operate correctly as intended on systems using benchmarks from GSA technical guidelines, NIST guidelines, Center for Internet Security guidelines, or industry best practice guidelines, as reviewed and accepted by the GSA AO. The standard installation, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the approved benchmark configuration.

Information technology for Windows systems should use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The contractor shall use tools to verify their products operate correctly with the approved benchmark configurations and do not alter the benchmark settings.

3. The Contractor shall cooperate in good faith in defining non-disclosure agreements (NDAs) that other third parties must sign when acting as the Federal government’s agent.

Note: GSA’s Office of the General Counsel (OGC) is available to coordinate on defining NDA requirements. Upon request, GSA OGC can advise on NDA development.

4. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. The Contractor shall be responsible for the following privacy and security safeguards:

a. The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification or to the MAX.Gov portal. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of the request. Access to support incident investigations, shall be provided as soon as possible but not longer than 72 hours after request.

The program of inspection shall include, but is not limited to:

● Authenticated and unauthenticated operating system/network vulnerability scans

● Authenticated and unauthenticated web application vulnerability scans

● Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools. If the vendor chooses to run its own automated scans or audits, results from these scans may at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor-conducted scans shall be provided in full to the Government.

b. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

5. The Contractor shall comply with Section 1634 of Public Law 115-91 that prohibits use of any hardware, software, or services developed or provided, in whole or in part, by— (1) Kaspersky Lab (or any successor entity); (2) any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or (3) any entity of which Kaspersky Lab has majority ownership.

6. The Contractor shall comply with 52.204-25 of the Federal Acquisition Regulation (FAR). It prohibits, under Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232), contractors from providing to the Government any equipment, system, or service that uses telecommunications equipment or video surveillance services from certain named companies as a substantial or essential component of any system, or as critical technology as part of any system , unless an exception or waiver is granted per the FAR. It also prohibits, under Section 889(a)(1)(B), contractors from using any equipment, system, or service that uses telecommunications or video surveillance equipment or services from certain named companies as a substantial or essential component of any system or as critical technology as part of any system, unless an exception or waiver is granted per the FAR.

The proscribed companies are Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company and their subsidiaries and affiliates.

H.10 PERSONNEL SECURITY REQUIREMENTS

Contractor shall furnish documentation reflecting favorable adjudication of background investigations for all personnel (including subcontractors) supporting the system. Contractors shall comply with GSA Order CIO 2100.1, “GSA Information Technology (IT) Security Policy,” and GSA Order ADM 2181.1, “Homeland Security Presidential Directive-12, Personal Identity Verification and Credentialing, and Background Investigations for Contractors.” GSA separates the risk levels for personnel working on Federal computer systems as follows:

● A favorable initial fitness/suitability determination must be granted, and a Tier 1 or higher background investigation initiated before access to the GSA network or any GSA IT system. There shall be no waivers to this requirement for GSA network and IT system access for GSA employees or contractors.

● A favorable initial fitness/suitability determination must be granted, and a Tier 2 or higher background investigation initiated before access to PII/CUI is granted. The authority and access shall be determined by the appropriate GSA Supervisor (for GSA employees) or CO (for contract personnel), Data Owner, and the System's AO. Each System's AO, with the request of the GSA Supervisor, Data Owner or CO, shall evaluate the risks associated with each such request.

● A favorable suitability determination must be completed at a Tier 2 or higher background investigation before privileged access to the GSA network or IT systems is granted. A waiver may be requested in order to maintain GSA business operations; however such requests should be used judiciously and not incur unnecessary risks to GSA.

If final adjudication of a background investigation is unfavorable, GSA network and IT system access must be revoked, and any GFE, including the GSA PIV card, must be retrieved and returned to OMA.

GSA shall sponsor the investigation when deemed necessary. No access shall be given to government computer information systems and government sensitive information without a background investigation being verified or in process. If results of background investigation are not acceptable, then access shall be terminated.

The Contractor shall provide a report of separated staff on a monthly basis, beginning 60 days after execution of the option period.