Draft_Attachment_B_-_Technical_Capabilities.xlsx
XLSX spreadsheet 356 KB Posted
- Attached to
- Draft NewPay Software as a Service (SaaS) Federal contract opportunity
- Solicitation number
- 47QTCA-18-Q-0001
- Issued by
- GSA Federal Acquisition Service
About this file
Technical Capabilities
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| NewPay_SaaS_Solution_Procurement_Question_and_Answers.pdf | ||
| Draft_Attachment_H_-_BPA_Pricing_Schedule.xlsx | XLSX spreadsheet | |
| Draft_Attachment_A_-_Business_Capabilities_and_Data_Standards.xlsx | XLSX spreadsheet | |
| Draft_Payroll_SaaS_RFQ.SOO.docx | DOCX document | |
| Draft_Attachment_D_-_RACI_Chart.xlsx | XLSX spreadsheet | |
| Draft_Attachment_F_-_VPAT_Assessment.doc | DOC document | |
| Draft_Attachment_G_-_Small_Business_Subcontracting_Plan.docx | DOCX document | |
| Draft_Attachment_E_-_Corporate_Experience_Statement_and_Past_Performance_Questionnaire.docx | DOCX document | |
| Draft_Attachment_C_-_FedRAMP-Self-Assessment-High-RAR-Template-v1.0-2.docx | DOCX document |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
: +sharon.aiken@gsa.gov -Raymond McCollum - QT2F1BA Instructions
The following tabs include the technical capabilities for Payroll and WSLM, and the authoritative source for each capability. The technical capabilities are segmented into six categories, as identified in Graphic 1 below. For each capability, Quoters should use the drop down box to explain the status of the capability within the Quoter's offering. An explanation of the drop down options is provided in Table 1 below.
| Table 1 | ||
| Field | Meaning | Action |
| Status of capability? | What is the status of the technical capability within the offered solution? | Select one of the following based on the description: |
"Existing" if the solution/Quoter can accommodate the capability as the solution stands today "Planned Development" if the existing system/practices cannot accommodate the capability, but it is planned to be incorporated into the base offering within the next 12 months "Not planned" if there is no plan to accommodate the capability as part of the base offering
Graphic 1
: Correct to SIN 132-40 from SIN 130-42. I cant change it because it's a picture. +stephanie.hrin@gsa.gov -Raymond McCollum - QT2F1BA
: Where are the instructions for completing this capabilities spreadsheet?
-Raymond McCollum - QT2F1BA +stephanie.hrin@gsa.gov -Raymond McCollum - QT2F1BA
: In agreeing with SSA's comment, we have to make sure that we allow the vendor to tell us all their capabilities, without us dragging it out for them via this spreadsheet. Can we match what we are looking for against their responses? Yes. But too much in these tabs. Also, why not combine Attachment A and B? I dont see why they need to be separate excel spreadsheets.
-Raymond McCollum - QT2F1BA
Security
| Procurement Sensitive/Pre-Decisional - Do Not Distribute | ||||||
| For Reference: | ||||||
| FedRAMP High Baseline Controls (Opens a new Excel) | ||||||
| Security Capabilities | ||||||
| ID | Capability Description | Capability | Authoritative Reference | Acquisition Team Recommendation | Status of capability? | Comments |
| SOO FedRAMP Requirements |
: Confused at if we have FEDRamp Assessment and a tab here for FEDRamp. Seems repetitive +stephanie.hrin@gsa.gov +peggy.martin@gsa.gov
| -Raymond McCollum - QT2F1BA | |||
| SC-01 | FedRAMP High Baseline | Obtains, within 1 year of award and continuously maintains throughout performance period as baseline changes occur, authorization through FedRAMP High and/or Medium baseline and complies with related requirements as mandated by Federal laws and policies, including availability of documentation, physical access, and logical access needed to support this requirement. |
FedRAMP High Baseline Controls https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2016/07/FedRAMP-High-HHH-Baseline-Controls-2016-05-18.xlsx
FedRAMP Moderate Baseline Controls
| https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2016/07/FedRAMP-Moderate-HHH-Baseline-Controls-2016-05-18.xlsx | FedRAMP Guidance | |||
| SC-03 | FedRAMP Contract Clauses | Complies with the FedRAMP standard contract clauses. |
https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/03/FedRAMP_Standard_Contractual_Clauses_062712_0.pdf FedRAMP Guidance Industry Best Practice/Gartner
| Other SOO Requirements | ||
| SC-05 | ||
| Compliance Reporting | Results of security assessments throughout full life cycle are available to the Authorizing Official for review and further action. (CA-2) | NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems |
| SC-06 | ||
| Gap Mitigation | Throughout performance lifecycle, where the Quoter does not currently meet included security services objectives, a Security Gap Mitigation Plan that contains the series of steps to adjust technologies and/or procedures to ensure a sufficiently secure environment. | NIST SP 800-30 Guide to Conducting Risk Assessments |
| SC-07 | ||
| Sub-Contractor Language | SaaS Quoter uses standard contract terms for addressing disciplinary action, consistent with the Federal Acquisition Regulations in all contracts that permit contractor employees access to information and information systems containing Federal data. | 3.1 Improper Business Practices and Personal Conflicts of Interest -- Safeguards |
3.11 Improper Business Practices and Personal Conflicts of Interest -- Preventing Personal Conflicts of Interest for Contractor Employees Performing Acquisition Functions
9.4 Contractor Qualifications -- Debarment, Suspension, and Ineligibility
| 52.2 Solicitation Provisions and Contract Clauses -- Text of Provisions and Clauses | Contract Dispute Act | ||
| SC-08 | |||
| Notification of Personnel Action | Provides notification to all appropriate Government personnel (e.g., Chief Counsel, Human Resources, Personnel) at Task Order issuing agencies within a period of time deemed appropriate at task order level if a formal employee sanctions process is initiated on staff with access to Federal data, identifying the individual sanctioned and the reason for the sanction. | NIST SP 800-61 Computer Incident Handling Guide | |
| SC-10 | |||
| Non-Disclosure Statements on Sub-Contracts | Ensures contracts with external companies for repair or recovery of data from systems, hard drives, or media require a non-disclosure statement. In cases where external companies provide non-local (e.g., external, remote access to SaaS Quoter systems, hard drives, or media) maintenance, repair, or data recovery, the contract with the external company shall also include provisions to require: (a.) cryptographic mechanisms to protect the integrity and confidentiality of communications; (b.) use of strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions; and, (c.) services are to be performed from an information system that implements a security capability comparable to the capability implemented on the system being serviced. |
: Do we need to put this one here, since we already stated that they must have the ability to obtain and maintain FedRamp?
| -Raymond McCollum - QT2F1BA | NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems |
| SC-12 | |
| Auditability | Able to identify staff and contractors of SaaS provider with access to audit logs, as requested by government. |
: We're asking for a document here. This should be removed. If we allow the quoters to have slides during the oral presentation, then this can be included. It's already a factor under oral presentations.
-Raymond McCollum - QT2F1BA : Confused at if we have FEDRamp Assessment and a tab here for FEDRamp. Seems repetitive +stephanie.hrin@gsa.gov +peggy.martin@gsa.gov
| -Raymond McCollum - QT2F1BA | NIST SP 800-53 Security and Privacy Controls for Federal Information Systems | |||
| SC-13 | RMF Requirements with External Partners | When forming agreements with entities outside the SaaS Provider for operation and maintenance of SaaS provider-owned IT systems, Quoters include in the agreement language addressing responsibility for Risk Management Framework activities and access to Security Assessment and Authorization documentation. | NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems | |
| SC-14 | Private Key Incident Reporting | Reporting to Government Contracting Officer and Government Authorizing Official of suspected loss or compromise of the private keys to the SaaS solution incident response team in accordance with reporting thresholds in task order requirements. | NIST SP 800-32 Introduction to Public Key Technology and the Federal PKI Infrastructure |
NIST 800-61 Computer Security Incident Handling Guide
| Security Operations Capabilities | ||
| SC-15 | ||
| Data Jurisdiction | Locate all data centers, all data and backup facilities in the United States of America. | FedRAMP Contract Clauses |
NIST SP 800-122
SC-16 CSP Interconnections Documents annually, interconnections between external networks, including third party providers, with an Interconnection Security Agreement (ISA) signed by both the SaaS Quoter and Agency Authorizing Officials. NIST SP 800-53 Security and Privacy Controls for Federal Information Systems NIST SP 800-47 Security Guide for Interconnecting Information Technology Systems
| SC-17 | ||||
| Continuous Monitoring and Cloud Service Gateway Integration | Uses continuous monitoring capabilities for traffic between the SaaS Quoter and a Federal agency that passes through one or more cloud service gateways or Cloud Access Service Broker (CASB). | NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations | ||
| SC-18 | ||||
| Data Destruction and Sanitization | Sanitizes data residing on all media being refreshed in accordance with NIST Special Publications 800-88'Guidelines for Media Sanitization, in the event of hardware refresh and replacement. | NIST SP 800-88 Guidelines for Media Sanitization | ||
| SC-19 | ||||
| Access to Administrative Access and Action Audit Logs | Maintains action logs available to government points of contacts for the SaaS solution. | NIST 800-92 Guide to Computer Security Log Management | ||
| SC-20 | ||||
| Government review and scanning | Performs manual or automated audits, scans, reviews, or other inspections. | NIST SP 800-115 Technical Guide to Information Security Testing and Assessment. | ||
| SC-21 | ||||
| Application layer vulnerability scanning permitted/conducted | Accomodates govt request to run application vulnerability scans within notification guidelines stipulated in Task Order requirements. | |||
| NIST SP 800-115 Technical Guide to Information Security Testing and Assessment. | ||||
| SC-22 | ||||
| Notification of Penetration Testing | Provides 48 hour notice of planned Quoter penetration testing to Task Order issuing agencies. | NIST SP 800-115 Technical Guide to Information Security Testing and Assessment. | ||
| SC-23 | Plan of Action and Milestone Tracking | Tracks and mitigates issues across functional, cybersecurity, accessibility, integration, service and other areas in coordination with the government. | NIST SP 800-61, Revision 2 Computer Security Incident Handling Guide" |
US-CERT Incident Notification Guidelines https://www.us-cert.gov/incident-notification-guidelines SC-24 Investigation Support Provides investigation support to government security personnel or third party investigative support services as part of the breach policy and process. NIST SP 800-61 Computer Security Incident Handling Guide Industry Best Practice/Gartner Recommendation SC-26 Secure Sockets Layer Uses SSL/TLS as the encryption mechanism of choice in user interface, API, batch import/export, and other secure connections and is able to comport to task order issuing agency requirements. M-15-13, Policy to Secure Connections Across Federal Web Sites and Web Services https://https.cio.gov/
| Systems and Services Acquisition Capabilities | |||
| SC-27 | Source Code Access | Access to source code available to vendor staff and contractors physically located in the U.S. who are U.S. Citizens or maintain lawful permanent resident status. | NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems |
| SC-28 | IP Connections - Least Privilege | When implementing IP connections on CSP perimeter firewalls, only services that are required shall be permitted (to pass through a firewall). For each permitted service, this information shall be documented: |
i. Service allowed (including TCP or UDP port number);
ii. Service description;
iii. Business case necessitating the service; and
| iv. Internal controls associated with the service. | NIS 800-53 Security and Privacy Controls for Federal Information Systems | ||||
| SC-29 | IP Connections - Firewall Filtering | When implementing IP connections on SaaS solution perimeter firewalls, inbound filtering is performed to exclude or reject all data packets that have an internal host address. Inbound filtering is implemented in accordance with NIST SP 800-41, Section 4.2, Implementing a Firewall Rule Set. | NIST 800-41 Guidelines on Firewalls and Firewall Policy | ||
| SC-30 | Quoter Network Protocols | Network and system protocols running on Quoter's network are most recent version when they do not negatively impact availability. A risk based decision used to determine when it is appropriate to implement older protocols with notification to government. | NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems | ||
| SC-31 | Security of Emerging Products | Emerging technology products are assessed to determine potential threats when introduced into the SaaS infrastructure. As technology continues to evolve, SaaS Provider ensure these threats continue to be analyzed. | NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems | ||
| System and Information Integrity Capabilities | |||||
| SC-32 | Integrity | Integrity verification tools are employed to detect unauthorized changes to system kernels, drivers, firmware (e.g., BIOS), software (e.g., OS, applications, middleware) and security attributes. | NIST 800-53 Security and Privacy Controls for Federal Information Systems | ||
| SC-33 | Controlled Unclassified Information | Protects confidentiality of controlled unclassified information (CUI) at FIPS 140-2 Level 1. | Executive Order 13556 Controlled Unclassified Information |
NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations SC-34 Unauthorized configuration changes The SaaS solution shall incorporate the detection of the following into the SaaS solution’ incident response capability: (SI-7 CE7)
• Unauthorized changes to baseline configuration setting
• Unauthorized elevation of system privileges NIST SP 800-53 Security and Privacy Controls for Federal Information Systems NIST SP 800-32 Introduction to Public Key Technology and the Federal PKI Infrastructure SC-35 Configuraiton and Vulnerability Management Quoters will report data related to security configuration and vulnerability management, in accordance with processes and mechanisms as may be established by task order issuing agency. NIST SP 800-53 Security and Privacy Controls for Federal Information Systems
SC-36 Incident Response After Action Once the incident handling has been completed, the following actions shall be performed by the SaaS solution:
a) Notifying the affected Authorizing Official of actions taken and changes made to systems/applications affecting their SaaS instance.
b) Changes made to systems and applications are reviewed, in accordance with the agency's auditing and incident response procedures, to determine if they are still relevant.
c) Request any actions to undo changes through the existing configuration management processes.
| d) Document and control any changes remaining as part of normal configuration management processes. | NIST SP 800-184 Guide for Cybersecurity Event Recovery | ||||
| SC-37 | Key Management | Published plan for for key management. Should key escrow exist, applicable terms and conditions of escrow apply for retrieving encrypted information will be included in the key management plan | NIST SP 800-53 Security and Privacy Controls for Federal Information Systems |
NIST SP 800-152 A Profile for U.S. Federal Cryptographic Key Management Systems NIST SP 800-32 Introduction to Public Key Technology and the Federal PKI Infrastructure
| Privacy Controls Capabilities | |||
| SC-38 | Privacy Act of 1974 | The solution is compliant with the Privacy Act of 1974 and related PII requirements ensuring conformance to privacy information maintenance requirements, protecting against unauthorized disclosure, developing and maintaining an accounting of disclosures from any Privacy Act system operated by the SaaS Quoter. | Privacy Act of 1974 |
M-10-23: Guidance for Agency Use of Third-Party Websites and Applications NIST 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
| SC-39 | Privacy Impact Assessment | SaaS Provider coordinates with Federal agency in the development and updating of Privacy Impact Assessment and System of Record Notice in accordance with Section 208 of the e-government Act. | eGovernment Act 2002, Section 208 | |
| SC-40 | Privacy Controls | SaaS Provider regularly assesses and reports to task order issuing agencies effectiveness of management, operational and technical privacy controls to protect the assured, proper, and consistent collection, processing, communication, use and disposition of personal information (PI) and personally identifiable information (PII). | ||
| Related NIST 800-53 Privacy Controls: AR-1: Governance and Privacy Program, AR-2: Privacy Impact and Risk Assessment, AR-3: Privacy Requirements for Contractors and Service Providers, AR-4: Privacy Monitoring and Auditing, AR-6: Privacy Reporting, AR-8: Accounting of Disclosures. |
SC-41 Privacy Policy and Practices Privacy practices, policies and processes ensure obtainment of individuals’ consent prior to the collection or other use of their PII to the greatest extent practicable. NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations NIST SP 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
SC-42 Privacy Training An active corporate privacy program exists that uses information on Information Privacy training from the government for its personnel. NIST SP 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) NIST SP 800-50 Building an Information Technology Awareness and Training Program
| SC-43 | PII Access | Access to PII is provided only to employees, contractors, and other entities which require specific PII for legitimate business functions in support of their official duties with personnel signing NDA where appropriate. | |
| NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations |
NIST SP 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
| SC-44 | HIPAA compliance with a signed BAA | SaaS Provider is HIPAA compliant to extent applicable by law within the context of payroll processing. | Health Insurance Portability and Accountability Act of 1996 |
| SC-45 | Maintains an accurate accounting of disclosures of PII including: date, nature, and purpose of each disclosure; and the name and address of the person or entity to which the disclosure was made | NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations |
NIST SP 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
| SC-46 | Includes Privacy Act Statements on the forms or pages that collect PII. | |
| NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations |
NIST SP 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
| SC-47 | Uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices. | |
| NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations |
NIST SP 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
| SC-48 | The system discloses PII externally only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes. | |
| NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations |
NIST SP 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
| SC-049 | Access to payroll and WSLM data available to staff and contractors physically located in the U.S. who are U.S. Citizens or maintain lawful permanent resident status. |
| SC-050 | SaaS Quoter provides visibility into 3rd party dependencies. |
-Inventorying active partnerships with partner Quoters with access to Federal data or builds services that would access to Federal data.
-Provides visibility to Task order issuing agency of contract terms/conditions with 3rd party partners providing system repair, recovery, and disposal services or any other system containing or accessing Federal data.
-Holds subscontractor and third party Quoters to equivalent staadards of compliance as held to by the government.
Technology
| Procurement Sensitive/Pre-Decisional - Do Not Distribute | |||||
| Technology Capabilities | |||||
| ID | Capability | Authoritative Reference | Additional Information | Status of capability? | Comments |
| Cloud Computing (132-40 SIN) | |||||
| Contract Requirements | |||||
| TR-000 | Credentials for all master accounts that can enable provisioning of agency users shall be held by task order issuing agency. |
-Reseller shall not hold access to master accounts as a vector for unauthorized access to agency private data.
-Resellers shall not have ability to access data operating within SaaS service at any time.
-All SaaS accounts can be transferred, at no charge, to another reseller or directly to task order issuing agency at the end of the contract term.
| -Resellers may not claim intellectual property rights to any account configurations established by reseller for agencies under the contract in any way that would prevent a seemless, no cost transfer of the SaaS accounts at end of term. | Agency feedback | Existing | ||||
| TR-001 | Establish the Quoter's SaaS product on the Schedule 70 Cloud Computing SIN (132-40), and in the SaaS Sub-Category by the time of Award. | Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40) | ||||
| https://www.gsa.gov/portal/getMediaData?mediaId=130366 | Quoters may submit a contract modification to add their service to Schedule 70, SIN 132-40, SaaS Sub-Category in parallel to the BPA proposal submission process. | Planned development | ||||
| Note: Items TR-002 through TR-009 are the evaluation criteria associated with the Cloud SIN (132-40), SaaS Sub-Category. |
Quoters will be required to submit their offering to and be accepted onto the Cloud SIN (132-40) before award. , but may do so in parallel to the BPA proposal submission process.
: Recommend deleting after the period. The services included in the solution must be apart of the IT Schedule 70 contract, before the proposal is submitted.
| -Raymond McCollum - QT2F1BA | ||
| TR-002 | Cloud Computing Services - Adherence to Essential Cloud Characteristics, Service Model Type, and Deployment Model |
Within a two page limitation for each cloud service submitted, provide a description of how the cloud computing service meets each of the five essential cloud computing characteristics as defined in National Institute of Standards and Technology (NIST) Special Publication 800-145 and subsequent versions of this publication. This standard specifies the definition of cloud computing for the use by Federal agencies. The cloud service must be capable of satisfying each of the five NIST essential Characteristics as follows:
1. NIST Characteristics -On-demand self-service -Broad network access -Resource Pooling -Rapid Elasticity -Measured Service
2. Service Model Type -SaaS Only
3. Deployment Model Type -Public -Private -Community -Hybrid
| Refer to the Terms and Conditions Document for Cloud SIN for specific guidance: https://www.gsa.gov/portal/getMediaData?mediaId=130366 | Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40) |
| https://www.gsa.gov/portal/getMediaData?mediaId=130366 | Quoters submitting to Cloud SIN (132-40) will be subject to an assessment of a responsive narrative that meets the following requirement: |
Provide a brief written description of how the cloud service proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how network access is provided. (Total of 2 pages to cover all 5 NIST characteristics in Section 1.)
TR-003 Unilateral provisioning of computing capabilities by customers, such as (but not limited to) [user accounts, functionality], server time and network storage, as needed automatically without requiring human interaction with each service provider. NIST Special Publication 800-145, “Definition of Cloud Computing” Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40) https://www.gsa.gov/portal/getMediaData?mediaId=130366 Quoters submitting to Cloud SIN (132-40) will be subject to an assessment of a responsive narrative that meets the following requirement:
Provide a brief written description of how the cloud service proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met. (Total of 2 pages to cover all 5 NIST characteristics in Section 1.)
TR-004 Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations). NIST Special Publication 800-145, “Definition of Cloud Computing” Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40) https://www.gsa.gov/portal/getMediaData?mediaId=130366 Quoters submitting to Cloud SIN (132-40) will be subject to an assessment of a responsive narrative that meets the following requirement:
Provide a brief written description of how the cloud service proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met. (Total of 2 pages to cover all 5 NIST characteristics in Section 1.)
| TR-005 | Computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth. | |
| NIST Special Publication 800-145, “Definition of Cloud Computing” |
Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40) https://www.gsa.gov/portal/getMediaData?mediaId=130366 Quoters submitting to Cloud SIN (132-40) will be subject to an assessment of a responsive narrative that meets the following requirement:
Provide a brief written description of how the cloud service proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met. (Total of 2 pages to cover all 5 NIST characteristics in Section 1.)
TR-006 Elastic provisioning and release of capabilities, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time. NIST Special Publication 800-145, “Definition of Cloud Computing" Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40) https://www.gsa.gov/portal/getMediaData?mediaId=130366 Quoters submitting to Cloud SIN (132-40) will be subject to an assessment of a responsive narrative that meets the following requirement:
Provide a brief written description of how the cloud service proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met. (Total of 2 pages to cover all 5 NIST characteristics in Section 1.)
TR-007 The system automatically controls and optimizes resource use by leveraging a metering capability at some level of abstraction (typically done on a pay-per-use or charge-per-use basis) appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service. NIST Special Publication 800-145, “Definition of Cloud Computing" Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40) https://www.gsa.gov/portal/getMediaData?mediaId=130366 Quoters submitting to Cloud SIN (132-40) will be subject to an assessment of a responsive narrative that meets the following requirement:
Provide a brief written description of how the cloud service proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met. (Total of 2 pages to cover all 5 NIST characteristics in Section 1.)
TR-008 The service delivery model for the SaaS solution meets one of the following NIST criteria for SaaS.
• SaaS services are typically consumed by business or subject-matter staff who would interact directly with the application in a non-cloud setting
• The principal customer interaction with a SaaS service is actual operation and consumption of the application services the SaaS service provides.
NIST Special Publication 800-145, “Definition of Cloud Computing" Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40) https://www.gsa.gov/portal/getMediaData?mediaId=1303 Quoters submitting to Cloud SIN (132-40) will be subject to an assessment of a responsive narrative that meets the following requirement:
Provide a brief written description of how the cloud service proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met. (Total of 2 pages to cover all 5 NIST characteristics in Section 1.)
TR-009 For each cloud service submitted, provide a written description of how the proposed service meets the NIST definition of a particular deployment model (Public, Private, Community, or Hybrid). Multiple deployment model selection is permitted, but at least one model must be indicated. Refer to the ‘Guidance for Contractors’ section of the Terms & Conditions for the Cloud Computing Services SIN for guidance on identifying the appropriate deployment model according to the NIST service model definitions. https://www.gsa.gov/portal/getMediaData?mediaId=130366 NIST Special Publication 800-145, “Definition of Cloud Computing" Response Guidance and Checklist for IT Schedule 70 Holders to Add Cloud Computing Services SIN (132-40)
| https://www.gsa.gov/portal/getMediaData?mediaId=130366 | For each cloud service submitted, provide a written description of how the proposed service meets the NIST definition of a particular deployment model (Public, Private, Community, or Hybrid). Multiple deployment model selection is permitted, but at least one model must be indicated. Refer to the ‘Guidance for Contractors’ section of the Terms & Conditions for the Cloud Computing Services SIN for guidance on identifying the appropriate deployment model according to the NIST service model definitions. https://www.gsa.gov/portal/getMediaData?mediaId=130366 | ||||
| Other SOO Requirements | Not Planned | ||||
| TR-002 | Coordinates with customer community at appropriate stages for releases of new software versions including testing integration and usability. | NIST SP 800-128 Guide for Security-Focused Configuration Management of Information Systems |
NIST SP 800-64 Security Considerations in the System Development Life Cycle TR-003 Continuously modernizes capabilities over time as technology advances in the marketplace.
Examples of emerging capabilities range from but are not limited to robotic process automation, artificial intelligence, analytics and machine learning to routine advances in browser capability, responsive design, mobility, and progress made in cybersecurity and cloud computing technologies
| Industry Best Practice | |||
| TR-004 | Solution is extensible through methods such as configuration, add-ons, etc. | Industry Best Practice / Gartner Recommendation |
: You have two requirements in cell c20. Break apart. Keep Garnter rec. Compliance w/ NIST def of cloud takes care of the other req.
-Kermit McKelvy - QT3KAB
: Recommend deleting after the period. The services included in the solution must be apart of the IT Schedule 70 contract, before the proposal is submitted.
| -Raymond McCollum - QT2F1BA | TR-005 | Capability to provide developers programs that build skills and validate expertise in the labor market through learning opportunities, testing, and/or certification of developers, administrators, or business users. | Industry Best Practice / Gartner Recommendation |
| Other Technical Capabilities | |||
| Hosting Capabilities | |||
| TR-006 | Distributes all data center locations within the United States of America, ensures independence and/or interdependence sufficiently meet full spectrum of natural and man-made continuity of operations (COOP) scenarios. |
| NIST SP 800-34 Contingency Planning Guide for Federal Information Systems | |||
| TR-007 | Publishes usage metrics so customers understand key information such as standard performance and usage information or that may affect billing such as users, storage, transactions processed, etc. | Industry Best Practice / Gartner Recommendation | |
| TR-008 | Ensures system failover is transparent to end users and maintains full functionality. | Industry Best Practice / Gartner Recommendation | |
| TR-009 | Availability of development, test, and/or staging instances for purposes included but not limited to pre-release testing, microservice, integration, and API development, training, & feedback. | NIST SP 800-64 Security Considerations in the System Development Life Cycle |
NIST Publication "The System Development Life Cycle" http://ws680.nist.gov/publication/get_pdf.cfm?pub_id=902622
| TR-010 | Enables government to perform latency testing of SaaS from government connection with appropriate notification and provides customer-facing version of internal performance testing results. Performance and latency testing shall include both user interface, business logic, mobile apps, plug-ins, and API functionality. | Industry Best Practice / Gartner Recommendation |
| TR-011 | Offers availability of SaaS 99.9% of time to Federal agencies, notwithstanding planned outages. |
: This is part of the FedRAMP requirement.
| -Kermit McKelvy - QT3KAB | NIST SP 800-145 Cloud Computing Synopsis and Recommendations | Acceptable downtime as a result of planned outages shall be determined on a task order basis. | |
| TR-012 | Monitors real time performance of the SaaS solution and with customer defined alerting thresholds as specified in task order requirements. | NIST SP 800-14 Generally Accepted Principles and Practices for Securing Information Technology Systems | |
| TR-013 | Is compatible with desktop and mobile web browsers including at least three but not necessarily limited to the following options: |
-Microsoft Internet Explorer -Google Chrome -Apple Safari -Mozilla Firefox (+ESR) -Microsoft Edge
Continue SaaS compatibility for these browser variations through their supportable lifespan as defined by OEM Quoters (Microsoft, Google, Apple, etc.). United States Government Configuration Baseline https://usgcb.nist.gov/index.html
| TR-014 | Enhances software functionality at least semi-annually and in response to directives flagged and agreed to by overall customer community as requiring more responsive releases that improve functionality, address issues, and increase usability. | Industry Best Practice / Gartner Recommendation |
| TR-015 | Generates documents in standards based formats with a preference for PDF, HTML, and formats specified by task order issuing agencies. | Industry Best Practice / Gartner Recommendation |
| TR-016 | Secure email messages sent from the system, and provide formatting compatible with email clients in use by Federal government (plain text, HTML, etc.) | NIST SP 800-45 Guidelines on Electronic Mail Security |
| Mobile Computing Capabilities | ||
| TR-017 | Provides SaaS solution functions on mobile devices such as smart phones and tablets through either a browser or native mobile app in a manner that comports to FIPS 140-2 requirements. | NIST SP 500-316 Framework for Cloud Usability |
Government Use of Mobile Technology https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/1151/2016/10/Government_Mobile_Technology_Barriers_Opportunities_and_Gaps.pdf TR-018 Renders Mobile versions of web interface through a responsive design appropriate to mobile phones and tablets. NIST SP 500-316 Framework for Cloud Usability Government Use of Mobile Technology https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/1151/2016/10/Government_Mobile_Technology_Barriers_Opportunities_and_Gaps.pdf TR-019 Enables end user, self-service, and, optionally, administrative aspects of its mobile experiences featureset. NIST SP 500-316 Framework for Cloud Usability Government Use of Mobile Technology https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/1151/2016/10/Government_Mobile_Technology_Barriers_Opportunities_and_Gaps.pdf TR-020 Compatible mobile apps available for the provider's SaaS function with major Mobile Device Management platforms. NIST SP 500-316 Framework for Cloud Usability NIST SP 800-124 Guidelines for Managing the Security of Mobile Devices in the Enterprise Government Use of Mobile Technology https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/1151/2016/10/Government_Mobile_Technology_Barriers_Opportunities_and_Gaps.pdf
| User Experience Capabilities | ||
| TR-021 | Provides human-centered design, focused on positive user experience. | See usability.gov for guidelines and standards |
: Can I delete this? I'm planning to delete this column -stephanie.hrin Yes - deleting now across all the sheets. Thanks -Robert Wuhrman - M1Z : This is part of the FedRAMP requirement.
-Kermit McKelvy - QT3KAB TR-022 Allows for re-labeling of fieldnames in user interface to provide for meaningful and descriptive labels. Usability.gov, Chapter 9, Headings, Titles, and Labels
Data and Interoperability
| Procurement Sensitive/Pre-Decisional - Do Not Distribute | |||||
| Data and Interoperability Capabilities | |||||
| ID | Capability Requirement | Capability | Authoritative Reference | Status of capability? | Comments |
| SOO Requirements | |||||
| DI-001 | Electronic Discovery | Compatible with capabilities that enable Federal agencies manage their electronic records in accordance with directives for Payroll and WSLM Data and that enable full life cycle of Capture, Maintenance and Use, Disposal, Transfer, Metadata, Reporting. | M-12-18, Records Management Directive |
General Records Schedule 2.4 Employee Compensation and Benefits Records (https://www.archives.gov/files/records-mgmt/grs/grs02-4.pdf) NARA Universal Electronic Records management Requirements (https://www.archives.gov/records-mgmt/policy/universalermrequirements) Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33) NARA regulations at 36 CFR Chapter XII Subchapter B DoD STD-5015.2 V3 (ref. b) Electronic Records Management Software Applications Design Criteria Standard NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing Records in Cloud Computing Environments (ref 8).
| DI-002 | |
| Data Migration | The Government retains ownership of all data, government created scripts/applications specific to integration, and any government provided resources including hardware or virtual machines created with individual task orders. |
| The contractor shall transfer data to the government either on demand or in case of order termination and for any reason. Delivered data shall conform to an industry standard format acceptable to the government and that is capable of being transported to other systems. The contractor shall specify the format(s) data will be provided in. The data must be available to the Government upon request within one business day or within the timeframe negotiated with the Contractor, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government. | NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems | |||
| DI-003 | ||||
| Hybrid Deployment Support | The Quoter shall identify its support interoperability through hybrid deployments wherein interfaces are required into or from on-premise or partner systems to enable a comprehensive solution to be delivered that completes the full payroll lifecycle. | Industry Best Practice (Gartner) | ||
| DI-004 | Interface Capability | Interfaces both inbound and outbound with a heterogeneous system set comprising the lifecycle of Federal payroll and work schedule leave management. | M-13-13, Open Data Policy, Managing Information as an Asset | |
| DI-005 | Availability of software development kits in a leading range of programming language including but not limited to Java, .Net, Python, and Ruby. Such kits shall include service functions, code wrapper libraries, and sample code. | Industry Best Practice / Gartner Recommendation | ||
| Data Capabilities | ||||
| DI-006 | Data Mobility | Enables data mobility to other payroll and work schedule leave management solutions, analytics systems, data warehouse and related external data management technologies through API and Data Export. | M-14-06, Guidance for Providing and Using Administrative Data for Statistical Purposes |
M-13-13, Open Data Policy, Managing Information as an Asset
| DI-007 | Data Residency | The solution backs-up and restores data with a recovery point objective (RPO) and recovery time objectove (RTO) of no greater than 4 hours or as prescribed in Task Order requirements. Recovery point objectitve includes but not limited to payroll and time/attendance data as well as accounts, permissions, audit logs, and configurations. | NIST SP 800-34 Contingency Planning Guide for Federal Information Systems |
| DI-008 | Backup and Restore | Compatible with tools and capabilities that enable efficient and effective electronic discovery to locate, preserve, collect, process, review, and produce data as appropriate; as would occur in investigations, audits, litigation, court orders, FOIA, and related forensic efforts related to Payroll and Work Schedule Leave Management. data | Federal Rules of Civil Procedure |
SP 800-86 Guide to Integrating Forensic Techniques into Incident Response
36 CFR 1222.32
44 U.S.C. chapters 21, 29, 31, and 33 Freedom of Information Act (FOIA) (5 U.S.C. 552)
| DI-009 | Maintains records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government must be managed in accordance with Federal law. Electronic records and associated metadata are accompanied by sufficient technical documentation to permit understanding and use of the records and data. | 36 CFR 1222.32 | |
| DI-010 | Employs capabilities that enable data quality management. | M-13-13, Open Data Policy, Managing Information as an Asset | |
| Interoperability Capabilities | |||
| DI-011 | Data Quality and Master Data Management | Maps data to and receives from FIBF data schema associated with Federal Payroll and Work Schedule Leave Management | M-13-13, Open Data Policy, Managing Information as an Asset |
| DI-012 | Interfaces book transactions to a standard data format established by Treasury FIT for receipt into Federal Financial Management systems. | M-13-13, Open Data Policy, Managing Information as an Asset | |
| DI-013 | Data Schema | Securely organizes and exchanges data with emerging data management constructs directly or through data translation and transformation capabilities. | OPM EOPF/EHRI Requirement |
| DI-014 | Business Functional API | Enable automation and interoperability with business process functionality into and out from the solution in agency process through business functional API. | M-13-13, Open Data Policy, Managing Information as an Asset |
Secure Restful API Standards http://secure-restful-interface-profile.github.io/pages/
| DI-015 | Operation/Administrative API | Enable automation of basic operational/administrative tasks, event notification within the solution through Administrative/Operational API. |
| Industry Best Practice (Gartner) |
Secure Restful API Standards http://secure-restful-interface-profile.github.io/pages/ DI-016 Bulk/Import Export API Provides bulk import/export of data to/from the system. Such data may include but not be limited to payroll, WSLM, audit log, and user/permissions data and come in formats such as CSV, Tab-Deliminted, XML, REST/SOAP., and other industry standard formats. Industry Best Practice (Gartner) Secure Restful API Standards http://secure-restful-interface-profile.github.io/pages/
| DI-017 | Platform Initiated Events and Notifications | Capable of event and notification functionality that would enable process interoperability notifications to external systems. | Industry Best Practice / Gartner Recommendation |
| DI-018 | Availability of Native Application Connectors | Integration with financial systems in use in the Federal government, directory management systems, scheduling, CRM, analytics, and integration/ETL platforms through compatible application connectors. | Industry Best Practice (Gartner) |
| DI-019 | Interface Frequency | Exchange data across multiple periodicity based on customer and task order requirements will include: |
-real time and near real time -hourly -daily -weekly and bi-weekly -monthly -quarterly -annual
| -on demand | Current interface cadence based on Provider Feedback | ||
| DI-020 | Interface formats | Interfaces through a variety of formats including, but not limited to: |
-Comma and Tab Delimited -Excel
-REST/SOAP
-JSON
-XML
M-13-13: Open Data Policy—Managing Information as an Asset Secure Restful API Standards http://secure-restful-interface-profile.github.io/pages/ DI-021 Transmission Mechanisms Secure transmission mechanisms for bidirectional content/data exchange, including but not limited to:
-SFTP
-Website Upload and download -Secure E-Mail
-REST/SOAP
-URL (https) and meeting the capabilities of id-001 Current interface cadence based on Provider Feedback Secure Restful API Standards http://secure-restful-interface-profile.github.io/pages/ DI-022 Interface Entities Securely integrates with Federal systems through mechanisms such as API, broker architectures including, but not limited to:
Federal Financial Systems
Federal Personnel Systems
Electronic Funds Transfer Transmission
Retirement Systems -401k
-TSP
-OPM1351
Employee Benefits
-BENEFEDS (FEHB/FEDVIP)
-Relocation Transaction Systems -Transit and Childcare Subsidies
Reporting -Child Support Enforcement Files -Union Dues File
-OPM EHRI
-Bureau Labor/Statistics Unemployment File
Taxes -IRS Tax Payments -State Witholding -Treasury Offset Program
-DataWarehouse and Analytics Systems and meeting the capabilities of id-001 Current state based on Provider Feedback Secure Restful API Standards http://secure-restful-interface-profile.github.io/pages/ DI-023 Provides secure business, data, and operational API that faciliate process integration, data access, and automation of operations/administrative activities through a service oriented architecture. and meeting capabilities of id-001. M-13-13, Open Data Policy, Managing Information as an Asset Secure Restful API Standards http://secure-restful-interface-profile.github.io/pages/
| DI-024 | Imports and exports data to and from the system into and from industry accepted formats including, but not limited to CSV, Tab-delimited, XML, REST/JSON, etc. | M-13-13, Open Data Policy, Managing Information as an Asset |
| DI-025 | Provides secure integration of user interface elements into or from other systems (mash-ups). | Industry Best Practice / Gartner Recommendation |
| DI-026 | Documents intended for data consumption shall be in CSV, Tab-Delimited, Excel and/or other standard, portable formats for data extracts. |
: EDUCATION: added by Ed -Robert Wuhrman - M1Z
Identity Management
| Procurement Sensitive/Pre-Decisional - Do Not Distribute | |||||
| Identity Management Capabilities | |||||
| ID | Capability Requirement | Capability | Authoritative Reference | Status of capability? | Comments |
| SOO Requirements | |||||
| Identity Management Capabilities | |||||
| ID-001 | HSPD-12 compatibility | Authenticates users using PIV, CAC , derived credentials, alternate forms of multi-factor authentication meeting AAL2 requirements for general users and AAL3 requirements for privileged users, and support federated identity assertion protocols including SAML and OIDC. " | NIST SP 800-63 Digital Identity Guidelines |
M-05-24 Implementation of Homeland Security Presidential Directive (HSPD) 12 NIST 800-53 Security and Privacy Controls in Federal Information Systems
| ID-002 | Compatibility with Authorized Identity Verification Systems | Solution shall support integrations with government wide authentication services such as Max.gov and Treasury Identity Verification Service, | ||
| and agency level federation services, on a global govt configuration level and an individual agency account level. | NIST SP 800-63 Digital Identity Guidelines | |||
| ID-003 | Auditing and Reporting | Logs authentication events and access events in SaaS and supporting infrastructure systems, ensuring availability to authorized representatives as determined by the contracting officer. The solution shall include options for extracting log information for continuous monitoring solutions, extracting log information as raw data for forensics, and archiving information for records retention capabilities in conformance with NARA policy. | NIST SP-800-63 Digital Identity Guidelines |
NIST 800-53 Security and Privacy Controls in Federal Information Systems
| ID-004 | Control Access to Protected Resource | Uses user based or role based entitlements configurable to permit or deny 1) view, 2) create and 3) update actions. Solution shall define and manage entitlements based on the method of authentication (authentication assurance level) used by the user for the session. Solution shall support Agency immutable identifiers for identity mapping purposes. | NIST SP 800-63 Digital Identity Guidelines | |
| ID-005 | Password Authentication | Authorizes users through mechanisms alternative to PIV/CAC in the event 2-factor mechanism such as PIV/CAC card is not available from customer. In such |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it.