47QPCA25RFI03_Draft-SOW_2025-03-05.pdf

DR

AF

T

General Services Administration Federal Acquisition Service

Technology Transformation Services 1800 F St NW | Washington, DC | 20006

Source Issuer Verification Service Solution

Draft Statement of Work

1.0 Program Information

Login.gov is a secure sign in service used by the public to access participating Government agencies. Participating agencies will ask individuals to create a Login.gov account to securely access their information on their website or application.

This document represents a requirement to provide a Source Issuer Verification Solution for the General Services Administration (GSA), Technology Transformation Services (TTS), Login.gov program.

2.0 Background

In 2017, TTS designed and developed Login.gov, a shared authentication platform, to provide citizens with simple, secure access to online government services. To achieve this, Login.gov utilizes a Source Issuer Verification service to electronically verify U.S. State-issued Driver’s License (DL) and Identity (ID) card data directly with the custodian of the record in real time at Login.gov’s request. This results in a government-provided “digital identity” for each user, established at National Institute of Standards and Technology (NIST) 800-63-3 (or its successors) Identity Assurance Levels (IAL) 1 or 2 and Authentication Assurance Level (AAL) 2. The resultant digital identity provides users the ability to sign in with a single set of credentials for all participating government programs.

https://pages.nist.gov/800-63-3/

2.1 Objectives

To continue to successfully achieve its mission, the Login.gov program requires a Source Issuer Verification Solution that:

● Has the ability to electronically verify U.S. State-issued Driver’s License (DL) and Identity (ID) card data directly with the custodian of the record in real time at Login.gov’s request.

● Has coverage of 100%, or at least 75%, of the U.S. population who have been issued a driver’s license, driver’s permit, or other state ID document.

● Will only verify personal information from Login.gov, it will not retain that PII nor use it for any commercial purposes.

● Meets GSA IT Security Policies.

2.2 Scope

The Contractor must provide a Source Issuer Verification Solution that queries data directly from the custodian of the record in real time at Login.gov’s request. As part of this solution, the Contractor must electronically verify U.S. State-issued Driver’s License (DL) and Identity (ID) card data submitted by Login.gov users.

2.2.1 Contract Type

GSA TTS contemplates a Firm Fixed Price (FFP) contract on a fixed-rate volume pricing basis.

2.2.2 Place of Performance

Performance will be at the Contractor’s facilities.

2.2.3 Period of Performance

The anticipated period of performance for this contract must be 12 months from date of award, with four, 12-month option periods.

● Base Period: 12-months

● Option Period 1: 12-months

● Option Period 2: 12-months

● Option Period 3: 12-months

● Option Period 4: 12-months

2.3 Definitions

The table below provides definitions for terms used in this SOW.

Term Definition Customer Data The info Login.gov will send DLDV via their API Custodian of Records The State/Jurisdiction agency who has responsibility for creating and maintaining a public system of records containing official DL and State ID card information.

Qualified States/Jurisdictions U.S. States and Jurisdictions (includes District of Columbia (D.C.) and U.S. territories) that are legally allowed to verify DL/ID data through an established service agreement directly with the Contractor to participate in the Login.gov program and make the State/Jurisdiction’s DL/ID data available for query to Login.gov.

Real Time The ability to process information and produce a response within the specified response time.

Response Time Response time is measured as the elapsed time between the receipt of a request at the Contractor system and when the Contractor system sends the response to GSA

Service Level Requirements A common understanding of the outside stakeholders’ expected level of service including priorities, availability, performance, responsibilities, hours of operations, etc.

State/Jurisdiction Enrollment The Contractor must procure and finalize any necessary agreements (i.e., service agreements) with the States/Jurisdictions in order for the States/Jurisdictions to participate in the Login.gov program and make the State/Jurisdiction data available for query to the agency. States/Jurisdictions must test and successfully implement the Contractor’s solution to be considered enrolled.

3.0 Specific Requirements

3.1 Task Description

The Contractor must provide a Source Issuer Verification Solution that queries data directly from the Custodian of the Record in real time at Login.gov’s request. As part of this solution, the Contractor must electronically verify U.S. State-issued Driver’s License (DL) and Identity (ID) card data submitted by Login.gov users.

The Contractor’s solution must be implemented and successfully tested a minimum of two weeks prior to the Government’s target date of implementation.

3.2 Service Agreements

The Contractor must obtain service agreements with Custodian of Records cumulatively representing at least 75% of the U.S. population who have been issued a drivers license, drivers permit, or other state ID document. The Contractor is required to maintain the 75% minimum throughout the period of this contract.

The Contractor must notify the COR of the status of new Custodian of Record(s) as they are onboarded with the following data:

a) The name of the qualified Custodian of Record(s)

b) Percentage of U.S. population

c) Date of implementation of service agreement

d) Date of testing and implementation of the Contractor solution with the

Custodian of Record

e) Outcome of the testing – successful or unsuccessful

f) Other issues of note that may assist the agency in decision-making regarding rollout to the Custodian of Record(s) (For example, if the Custodian of Record does not allow real-time verification of records, if the Custodian of Record does not have complete records, etc.)

3.3 Service Level Agreement

The Contractor must provide an existing Source Issuer Verification Solution that provides business-class response time outlined in this section and in the QASP. The Contractor’s solution must:

● Have the capacity to process 100 transactions per second

● Transaction response time less than 3000ms for 95% of API requests

● Provide documentation with emergency contact information and escalation paths for technical issues

● Perform constant monitoring of Contractor systems availability and alert

Login.gov (via a method mutually agreed by the COR and Contractor after contract award) in the event of service interruptions. Provide support within 15 minutes of service interruption:

o To the maximum extent practicable, alerts must include the start time of the outage; effect of the outage (i.e., are all Custodians of Records affected, or only some), the suspected cause of the problem (if known), and steps being taken to resolve the outage;

o Once the outage is resolved, the Contractor must send a closing alert to Login.gov; this communication must include the end time of the outage, the duration of the outage, the effect of the outage, the number of transactions affected by the outage (if known), the actual cause of the problem and the steps planned to prevent similar outages in the future.

o If the data described above is not available at the time of the outage, it must be included in a comprehensive monthly outage report.

o The Contractor must measure and report response times for the Custodian of Record and the Contractor’s own system on a monthly basis. In the event the SLA is not met, the Contractor must report to the Government where the issue is.

o Security incidents with potential impact to availability, confidentiality, or integrity must be immediately reported but not more than eight hours following confirmed detection to the GSA TTS CO, COR, and the GSA Incident Response Team. Maintain 24x7 monitoring with geographically dispersed disaster recovery capabilities.

● Provide notification of scheduled systems downtime to the COR one (1) month prior to the planned service interruption.

● Comply with the service level requirements defined in this section for availability, system response time, capacity, security, and incident reporting.

3.4 Data Matching

Serving as the authoritative source for the data, the Contractor will compare the data it receives from the State/Jurisdiction’s record (Custodian of the Record) to the data elements it receives from Login.gov. Login.gov is only providing information to the Contractor that the user consents to, and is available to the Contractor through its relationship with the Custodian of the Record.

The Contractor must return to Login.gov a “match” or “no match” response for each data element, as detailed in the chart below. The return response must adhere to the response time parameters specified in Section 3.3 Service Level Agreements.

The information that the Contractor relies upon for making its “match” or “no match” response to Login.gov must consist exclusively of unaltered data elements received directly from the custodian of the record and Login.gov. Neither the Contractor nor any Custodian of Records warrants the accuracy of Custodian of Record data used to generate match and no match responses.

o First name o Middle name o Last name o Name suffix o Date of birth (DOB) o State Driver License (DL) or ID number o State of issuance o Issue date (if provided by Custodian of Records) o Expiration date (if provided by Custodian of Records) o Eye Color o Height o Weight o Sex o Biometric Image / Image Data o Address

● Street address line 1

● Street address line 2 (if present)

● City

● State/Jurisdiction

● Zip code

At a minimum, the Login.gov platform must submit the following electronic data elements to the Contractor for verification: 1) State of issuance; and 2) State Driver License (DL) or ID number.

o Type of credential

The Contractor may not enhance their database with information such as "has

Login.gov account.”

3.5 Development, Validation, Integration, and

Production Requirements Login.gov requires ongoing Development, Validation, Integration, and Production support to ensure changing business requirements are met. To ensure that Login.gov continues to meet customer requirements and maintains access to relevant authoritative data, the Contractor must:

● Provide full lifecycle support and coordination of data for the following kinds of environments:

o Development o Validation o Integration o Production

● Synchronize test data with Login.gov for Development, Validation and Integration environment types.

● Provide a plan/procedure for what to do if there is downtime.

● Support integration and acceptance testing with Login.gov by:

o Ensuring environments are ready as specified in the schedule;

o Providing Login.gov with test data & test cases to be used during the calls to the Contractor’s verification software that covers all scenarios that could occur during production;

o Providing real-time support and subject matter experts during testing so that problems can be resolved as quickly as possible;

o Serving as the contact point for problems between its software and the Custodian of the Record;

o Participating in conference calls to discuss testing plans, efforts, progress and issues; and o GSA\Login.gov may need to perform testing to ensure a successful connection and receipt of the correct data response from the Contractor web service. The Contractor will create test data to cover all possible test case scenarios in accordance with Login.gov’s specification.

● Provide system management functions – security, audit, configuration management, and archiving. Ongoing system management functions are required to ensure ongoing security, reliability, and response of the software solution.

● Provide an Interface Control Document (ICD) – this document provides the connection criteria and requirements for the web service.

3.6 Technical Support

Login.gov requires ongoing technical support in the event of planned/unplanned system failures to resolve performance issues. The Contractor must:

● Provide Login.gov with a technical Help Desk Contact telephone number that can be accessed by Login.gov personnel in need of technical support;

● Provide support for any confirmed or suspected incident investigations

● Provide access to technical support personnel during configuration, validation, and testing of the web service as agreed to in the Implementation Plan. Technical support includes both the Contractor’s system as well as the Custodian of the Record systems that provide data. The Contractor is responsible for working with the Custodian of the Record and to provide findings to the COR within one week of the agency’s request

4.0 Deliverables and Reports

In addition to the applicable requirements, the Contractor must provide the following deliverables and reports:

Deliverable Name Frequency of Delivery Government Rights Format

The contractor shall deliver security assessment and usage authorization deliverables in GSA-defined format.

Upon written request

Limited Rights Data, per FAR 27.404-2 and 52.227-14, Alt II, Paragraph (g)(3)

Email to COR and IT Security

The contractor shall provide a Cyber-Supply Chain Risk Management (C-SCRM) Plan. See GSA C-SCRM Plan template.

The contractor must participate in GSA’s C-SCRM Program including maintenance of a SCRM Plan and monitoring via third-party vendor risk illumination tools (e.g. Interos and BitSight)

Within 60 days of award

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and IT Security

The contractor shall deliver a report detailing current Static Application Security Testing (SAST)

Within 30 days of award

Limited Rights Data, per FAR 27.404-2 and 52.227-14, Alt II, Paragraph (g)(3)

Email to COR and IT Security and Dynamic Application Security Testing Scans (DAST) results

The contractor shall deliver current Software Bill of Materials (SBOM)

Within 30 days of award

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and IT Security

The contractor shall provide a draft Privacy Impact Assessment (PIA)

Within 14 days of award.

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and Privacy

The contractor shall provide updated Privacy Assessments to Login.gov throughout the life of the contract.

Within 28 days of award

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and Privacy

The contractor shall provide a table of data (i.e.

Data Table) collected by the service, descriptions of each data field, and how each data field is used to provide the service

Within 28 days of award

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and Privacy

The contractor shall provide a detailing of all external services utilized to provide the services, the nature of the usage, data transmitted and received, and information received from the service.

Within 28 days award

Limited Rights Data, per FAR 27.404-2 and 52.227-14, Alt II, Paragraph (g)(3)

Email to COR and CO

The contractor shall provide meeting minutes for periodic stand-ups with Login.gov staff

Monthly or as requested

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Virtual Meeting

The contractor shall alert Login.gov in the event of service interruptions.

Within 15 minutes of service interruption

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Machine readable data to be provided in an automated manner over authenticated channels (e.g.

REST API).

The contractor shall provide a system performance report for all environments. This report shall contain, at a minimum, By the 15th of each month

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR

● Service uptime in minutes and as a percentage of the total minutes in the reporting period

● A breakdown of outages in terms of the duration of the outage, whether the outage was planned or unplanned.

● Case by case analysis for anything unplanned and downtimes.

The contractor shall provide a service usage and success rate report for the production environment.

This report shall contain, at a minimum:

● The number of service calls in the reporting period

● The number of service calls per applicant in the reporting period

● The maximum transactions per second in the reporting period

● The number of those calls that were billed

● The result breakdown of those calls (e.g.

how many service called achieved a positive result for an applicant, how many were unsuccessful for the applicant, etc)

● The average time per service call

● All reports for services listed in SLAs

By the 15th of each month

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and mutually agreeable distribution list

The contractor shall provide ad hoc reports as requested by Login

Upon written request within 5 business days

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Mutual agreement

The contractor shall provide a roadmap or written milestones of upcoming changes or releases

Quarterly Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and mutually agreeable distribution list

The contractor shall deliver their Continuity of Operations plan

Within 14 days of award

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and mutually agreeable distribution list

The contractor shall deliver Recovery Plan Within 14 days of award

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and mutually agreeable distribution list

The contractor shall notify the COR of newly onboarded Custodian of Record(s)

Within 7 days of onboarding

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Email to COR and mutually agreeable distribution list

The contractor shall notify the COR of scheduled systems downtime.

One month prior to prior to the planned service interruption

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Machine readable data to be provided in an automated manner over authenticated channels (e.g.

REST API).

The Contractor must also provide the following supporting documents for the Source Issuer Verification information system within 30 days of the date of award, and updated as required by the COR or CO.

● Service Organization Control (SOC) 2/Statements on Standards for Attestation Engagements (SSAE) 16 audit report

● SysTrust/WebTrust (American Institute of Certified Public Accountants (AICPA)-sponsored) certification

● ISO/IEC 2700 certification

● PCI DSS certification

5.0 Technical Kickoff Meeting

The Government's team, consisting of the CO and COR (at minimum), will hold a kickoff meeting with the contractor within seven calendar days of the acquisition award, unless otherwise agreed upon by all parties in writing (email will be sufficient). This kickoff will include the contractor’s team and other relevant Government staff to review and clarify the project’s objectives, expectations from the Government, and address any questions the contractor may have. This meeting will be held via video-conference.

During this meeting, the Contractor must:

● Present key staff, their roles and responsibilities

● Verify understanding of contract requirements and deliverables

● Discuss the delivery approach and schedule

● Document new understanding and/or direction resulting from the meeting.

6.0 Security Considerations

Despite enhanced security controls and monitoring, incidents may occur that require immediate response from the Contractor. Incidents could include misuse, fraud, misappropriation, espionage, sabotage, and inadvertent or deliberate compromise of the shared authentication platform. The Contractor must identify proposed plans, communications and protocols for responding to security and privacy incidents in collaboration with the Government. The Contractor must comply with incident reporting requirements outlined in GSA IT Security Procedural Guide 01-02, Incident Response.

The software solution must:

● Provide a secure channel for real time data transmission between Login.gov and the Contractor.

● Integration testing must include review and validation of the web services connection including usage of secure protocols (e.g., TLS 1.2); Federal Information Processing Standards (FIPS)-approved algorithms; and, FIPS 140-3 validated encryption modules. As per Office of Management and Budget (OMB) Memorandum M-15-13, web site connections (if any) must use HTTPS-only.

o M-15-13 Compliance Guide

● Be in compliance with Federal standards and guidelines including:

● FIPS 140-3: Encryption for backend data verification calls

● Provide data exchange in compliance with NIST encryption standards including usage of FIPS-approved algorithms, secure Transport protocols, and secure key/certificate management.

● Does not store at rest, data the Government sends to be verified; such data shall only be processed in memory and discarded immediately following in-memory processing of the verification request.

● Detail Contact information for GSA security POCs in the Login.gov incident response plan.

● Be located in the United States. “United States” means the 50 States, the https://www.gsa.gov/system/files/Incident-Response-%5BCIO-IT-Security-01-02-Rev-19%5D-09-08-2022docx.pdf https://www.gsa.gov/system/files/Incident-Response-%5BCIO-IT-Security-01-02-Rev-19%5D-09-08-2022docx.pdf https://csrc.nist.gov/pubs/fips/140-3/final https://csrc.nist.gov/pubs/fips/140-3/final https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2015/m-15-13.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2015/m-15-13.pdf https://https.cio.gov/guide/

District of Columbia, Puerto Rico, the Northern Mariana Islands, American Samoa, Guam, the U.S. Virgin Islands, Johnston Island, Wake Island, and Outer Continental Shelf Lands as defined in the Outer Continental Shelf Lands Act (43 U.S.C. 1331, et seq.), but does not include any other place subject to U.S.

jurisdiction or any U.S. base or possession within a foreign country (29 CFR 4.112).

6.1 Reporting and Continuous Monitoring

In support of continuous monitoring, the Contractor must maintain its audit report/certification, perform web application and operating system scans, and remediate flaws per the Contractor’s flaw remediation process. The Contractor must report if its audit report/certification renews or expires and if any of the other required activities cannot be supported.

7.0 Quality Assurance

7.1 Performance Metrics

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the Contract to ensure that the Contractor is performing services required by the SOW in an acceptable level of performance.

The QASP will provide an effective surveillance method of monitoring Contractor performance for each listed objective on the project tasks in the contract. It will also provide a systematic method to evaluate the services the Contractor is required to furnish. The Government reserves the right to alter or change the QASP at its own direction.

7.2 Inspection and Acceptance of Deliverables

The inspection and acceptance of deliverables will be conducted in accordance with FAR clause 52.212-4, paragraph (a) Inspection and Acceptance. In addition, the designated Contracting Officer’s Representative (COR) or GSA PM will provide consolidated comments or action items within five (5) business days of receipt of deliverables. The contractor will address comments or actions items and resubmit the deliverable to the COR and GSA PM within three (3) business days. The COR will approve the remediated deliverable within two (2) business days of receipt.

8.0 Transition-Out Period

The Contractor must establish and implement plans for an orderly phase out of operations at the expiration or termination of this contract that ensures data security and integrity while data is in transit.

9.0 Data Management

9.1 Data Ownership and Unlimited Rights to Data

The Government will retain unlimited rights to all Government data collected by the system.

Government data rights must be in accordance with FAR 52. 227-14 Rights in Data - General. The Government must have unlimited rights in all data entered into any and all systems, system documentation, all deliverables produced in the performance of this contract, and other related system information.

Upon termination or expiration of the contract and upon request, once all data is provided back to the Federal Government the Contractor must discard all Government data within 7 years, and must certify no Government data has been retained unless otherwise authorized.

9.2 Data Availability

Notwithstanding anything to the contrary in any applicable commercial terms and conditions (e.g., those referred to in section 17.3, Terms of Service), any data derived from the Government’s use of the service must be delivered to the Government within one (1) business day of the CO’s request (unless a different timeframe has been agreed to by the CO), and must not be used for any other purpose other than that specified herein. The requested data must be provided at no additional cost to the Government and in a format satisfactory to the Government.

9.3 Data Release

The Contractor will not disclose Customer Data to any government or third party, or access or use Customer Data; except in each case as necessary to maintain the solution or to provide the solution to Customer in accordance with this contract, or as necessary to comply with the law or a valid and binding order of a governmental or regulatory body (such as a subpoena or court order). Unless it would be in violation of a court order or other legal requirement, the Contractor will give the Government reasonable notice of any such legal requirement or order, to allow the https://www.acquisition.gov/far/52.227-14

Government to seek a protective order or other appropriate remedy.

10.0 Personnel

10.1 Program Management

The Contractor must identify a Program Manager who will be responsible for all services provided under this contract and have full management authority for all Contractor personnel assigned to work on this project, within 3 days of the Date of Award. The Program Manager must serve as the primary point of contact for the Contractor Officer Representative (COR) or his/her designee in matters concerning this contract and will interact with other government employees as instructed by Login.gov.

10.2 Identification of Key Personnel

If necessary, the Contractor must identify key personnel regardless of the type of task. NOTE: Key personnel may not be removed from the task without notification to the Contracting Officer (CO). The CO will attach a copy of the request and determination to the project files.

10.2.1 Key Personnel Changes

If any individual proposed as Key Personnel becomes unavailable during the course of the solicitation, evaluation process or period of performance, the contractor must notify the CO immediately. Any Key Personnel proposed who are not currently employed by the contractor must be identified as such and an additional letter of intent signed by the proposed Key Personnel must be provided that indicates that person's intent to be employed by the contractor if awarded this call order.

All requests for substitutions/additions of Key Personnel must include a detailed explanation of the circumstances necessitating the proposed substitution or addition. As determined by the CO, all proposed substitutes/additions must have qualifications that meet or exceed the qualifications of the person to be replaced or supplemented.

The CO, with input from the COR, will evaluate the request(s) for substitutions/additions of Key Personnel and the CO will notify the contractor, in writing, of approval or disapproval. Disapproval of the proposed individual(s) must not provide grounds for non-performance by the contractor or form the basis of any claim for monies, delivery schedule extension, or any other equitable adjustment.

11.0 Government Furnished Equipment

The Government does not anticipate providing Government Furnished Equipment in support of this contract.

12. Contract Administration This acquisition will be administered by the following individuals, who will also monitor the selected contractor’s performance:

1. GSA TTS Contracting Officer (CO)

2. Login.gov Contracting Officer Representative (COR)

3. Login.gov Technical Point of Contact

13.0 Indemnification

The Contractor agrees to purchase and maintain throughout the term of this contract a technology/professional liability insurance policy, including coverage for network security/data protection liability insurance (also called “cyber liability”) covering liabilities for financial loss resulting or arising from acts, errors, or omissions, in rendering technology/professional services under this Contract or in connection with the specific services described in this Contract. The insurance policy will include coverage for:

● Violation or infringement of any right of privacy, including breach of security and breach of security/privacy laws, rules or regulations, now or hereinafter constituted or amended;

● Data theft, damage, unauthorized disclosure, destruction, or corruption, including without limitation, unauthorized access, unauthorized use, identity theft, theft of personally identifiable information or confidential corporate information in whatever form, transmission of a computer virus or other type of malicious code; and participation in a denial of service attack on third party computer systems;

● Loss or denial of service; with a minimum limit of $5,000,000 for each and every claim and in the aggregate. Such coverage must include technology/professional liability including breach of contract, privacy and security liability, privacy regulatory defense and payment of civil fines, payment of credit card provider penalties, and breach response costs (including without limitation, notification costs, forensics, credit protection services, call center services, identity theft protection services, and crisis management/public relations services).

Such insurance must explicitly address all of the foregoing without limitation if caused by an employee of the chosen Contractor performing services under this Contract, or an independent contractor working on behalf of the chosen Contractor in performing services under this Contract, when prior to the commission of the act, error, or omission giving rise to liability, the chosen Contractor has expressly agreed in writing to indemnify and defend the independent contractor against liability. The insurance policy will not include an exclusion for cyber terrorism.

14.0 Inspection

The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the Contractor’s IT environment being used to provide or facilitate services for the Government. The Contractor must be responsible for the following privacy and security safeguards:

● To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor must afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within (5) business days of the request.

● Access to support incident investigations, must be provided as soon as possible but not longer than (5) business days after request.

● Physical Access Considerations – If the provider is operated within an IaaS that is FedRAMP authorized (e. g., AWS); physical access to the physical datacenter environment will be governed by the terms of access allowed by the underlying infrastructure provider as defined in the FedRAMP A&A authorization package.

The program of inspection must include, but is not limited to:

● Authenticated and unauthenticated operating system/network vulnerability scans.

● Authenticated and unauthenticated web application vulnerability scans.

● Authenticated and unauthenticated database application vulnerability scans.

● Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools. If the Contractor chooses to run its own automated scans or audits, results from these scans may at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans.

In these cases, scanning tools and their configuration must be approved by the Government. In addition, the results of the Contractor scans must be provided in full to the Government.

If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer must immediately bring the situation to the attention of the other party.

Upon request from the CO or COR, the Contractor must allow Login.gov to conduct operational and security audits to verify the Contractor's compliance with our SLAs and security standards. The audits will be conducted following these guidelines:

● Login.gov may perform one audit yearly, and may conduct additional audits after a confirmed security breach (one audit per breach). The Contractor must accommodate assessments by Login.gov when requested. Unannounced assessments are required to occur within thirty (30) business days or an agreed upon time from initial notification.

● The Contractor must make a good-faith effort to answer any questions Login.gov has, and to give access to requested information (under suitable non-disclosure agreements (NDAs), if necessary). The Contractor must provide up to 40 hours of staff time per audit.

● Any issues discovered by the audit must be remediated by the Contractor in a mutually-agreed-upon timeframe. High risk findings must be remediated within 30 days, moderate risk findings within 90 days, and low risk findings no longer than 180 days; risk levels are derived from the automated vulnerability scan tools based on CVSS base scores.

The Contractor must provide Login.gov with any applicable documentation of their security stance and compliance achievements. Examples include:

● Internal security architecture documentation

● Internal security policies and procedure documentation

● Security compliance reports, such as PCI, ISO 27001, ISO 27002, SOC 2/3, SIG, CSA CSQ, etc.

Login.gov will use these documents to assist in evaluating the organization’s security stance. As such, Login.gov will give higher weight to those reports produced by independent auditors.

https://nvd.nist.gov/vuln-metrics/cvss

15.0 Security of Data Including

Personally Identifiable Information (PII)

By acceptance of, or performance on, this contract, the Contractor agrees that in the event of any actual or suspected breach (defined as loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users with an authorized purpose have access or potential access to Personally Identifiable Information (PII), whether physical or electronic) the Contractor must immediately (and no later than within eight (8) hours following confirmed discovery) report the breach to the GSA TTS Contracting Officer (CO), or the Contracting Officer’s Representative (COR), and the General Services Administration Incident Response Team. If the breach occurs outside of regular business hours and/or neither the CO nor the COR can be reached, the Contractor must contact the POCs as specified by the CO or the COR for emergency contacts outside of business hours to the same reporting standard defined above (within eight (8) hours of confirmed discovery of the breach). The Contractor must also notify the CO, and COR, and the General Services Administration Incident Response Team as soon as possible during regular business hours. Data breaches must follow reporting and response procedures as defined in GSA IT Security Procedural Guide 01-2, Incident Response and GSA Order CIO 9297.2C, GSA Information Breach Notification Policy.

The Contractor must have a security policy in place that contains procedures to promptly notify any individual whose PII (as defined by OMB) was, or is reasonably believed to have been, breached. Any notification to end consumers as a result of a breach must be coordinated with GSA TTS. The method and content of any notification by the Contractor as a result of a breach must be subject to the approval of GSA TTS. In the event of a breach, the Contractor assumes full responsibility for taking corrective action consistent with GSA Data Breach Notification Procedures (linked above). (http://www.gsa.gov/portal/directive/d0/content/675850). Breach notifications involving PII are defined in section “Personally Identifiable Information Notification Requirement.”

The Contractor also agrees to cooperate fully with the CO, the GSA Inspector General, and any other authorized Government investigator during any investigation regarding a breach or suspected breach involving PII. This cooperation includes providing access to documents and systems for a forensic investigation such as systems logs and server images, to determine how or why the breach occurred, and https://www.gsa.gov/system/files/Incident-Response-%5BCIO-IT-Security-01-02-Rev-19%5D-09-08-2022docx.pdf https://www.gsa.gov/directives-library/gsa-information-breach-notification-policy-5 https://www.gsa.gov/directives-library/gsa-information-breach-notification-policy-5 how to prevent a similar occurrence in the future. The Contractor must also correct, at its own cost, the system or protocol to prevent any future similar breach.

16.0 PII Notification Requirement

Subject to GSA analysis of the breach and the terms of its instructions to the Contractor regarding any resulting breach notification, a method of notification may include letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by GSA.

At minimum, a notification should include:

● A brief description of how the breach occurred

● A description of the types of personal information involved in the breach

● A statement as to whether the information was encrypted or protected by other means

● Steps an individual may take to protect themselves

● What the Contractor and/or agency is doing, if anything, to investigate the breach, to mitigate losses, and to protect against any further breaches

● Point of contact information identifying who affected individuals may contact for further information.

The Contractor agrees to assist in and comply with PII/Sensitive PII incident remediation and/or mitigation efforts and instructions, including those breaches that are not a result of the Contractor or employee actions, but the Contractor is an unintentional recipient of privacy data.

Actions may include:

● Allowing GSA incident response personnel to have access to computing equipment or storage devices

● Complying with instructions to remove emails or files from local or network drives, mobile devices (BlackBerry, Smart Phone, iPad, USB thumb drives, etc...).

In the event that a PII/Sensitive PII breach occurs as a result of the violation of a term of this contract by the Contractor or its employees, the Contractor must, as directed by the contracting officer and at no cost to GSA, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected individuals for a period not to exceed 24 months from discovery of the breach. Should GSA elect to provide and/or procure notification or identity protection services in response to a breach, the

Contractor must be responsible for reimbursing GSA for those expenses. To ensure continuity with existing Government identity protection and credit monitoring efforts, the Contractor must use the identity protection service provider specified by

GSA.

17.0 TTS Transparency Policy

GSA TTS reserves the right to publish documents associated with this acquisition on a publicly-available website, including any Requests for Quotation or their amendments, as well as question and answer exchanges with vendors with source-identifying information removed. GSA TTS reserves the right to publish any other relevant information that is not confidential or proprietary in nature, but will not publish any source-selection sensitive information that would otherwise implicate procurement integrity concerns.

Upon award of the acquisition, GSA TTS may publish the total price of the selected quote and certain non-source-identifying data (e.g. the number of bids, the mean price, the median, and the standard deviation of price). During the performance of this contract, GSA TTS may similarly publish data related to project management (e.g. user stories, milestones, and performance metrics) and top-line spending data.

17.1 Section 508 Compliance

The Contractor must support the Government in its compliance with Section 508 of the Rehabilitation Act of 1973 (29 U. S. C. 794d) throughout the development and implementation of the work to be performed.

Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) requires that when Federal agencies develop, procure, maintain, or use electronic IT, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

All electronic and information technology (EIT) procured through this contract must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. The 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. All deliverables will be Section 508 compliant, and will be reviewed for compliance by the government which reserves the right to reject the deliverable(s) until remediation of deficiencies has been successfully completed by the Contractor. Complete technical descriptions are provided on the following website: http://www.section508.gov.

Where appropriate, the Contractor must indicate whether each product or service is compliant, noncompliant, or not applicable with the accessibility standards at 36 CFR 1194. Further, the quote must indicate where full details of compliance can be found (e. g., Contractor’s website or other exact location).

The contractor should review the following websites for additional 508 information:

https://www.section508.gov/buy/standards-exceptions/ https://www.access-board.gov/ict/ http://www.w3.org/WAI/Resources

The Government does not anticipate Section 508 of the Rehabilitation Act being applicable to the services included in the scope of this SOW.

17.2 Privacy Act

Work on this contract may require that personnel have access to Privacy Information. Personnel must adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

17.3 Terms of Service

Many terms found in commercial Terms of Service (ToS) or End User License Agreements (EULA) are not acceptable when the Government is the end user. The Office of Chief Information Officer (OCIO) requires that software and services within the GSA Enterprise have approved ToS or EULA.

The Contractor’s terms and conditions will undergo a formal review by GSA Counsel as part of the pre-award process. The Contractor’s ToS must be found to be acceptable to the Government or a modified ToS negotiated as part of the approval review, prior to final authorization.

https://www.ecfr.gov/current/title-36/chapter-XI/part-1194 http://www.section508.gov http://www.w3.org/WAI/Resources