Attachment_1-_SOW.pdf

U.S. Securities and Exchange Commision

OHR – Office of Human Resources SOW for Enterprise License for Live and On‐Demand Legal, Regulatory and Compliance Conferences and Training August 2019

C.1 Background

The mission of the Securities Exchange Commission (SEC) is to protect investors, maintain fair, orderly and effective markets, and facilities capital formation. In support of this mission, SEC University works to enhance SEC staff’s knowledge and understanding of securities laws and financial regulation in a way that better equips staff for their day‐to‐day responsibilities. SEC University does this by supporting staff participation in a wide range of internal and external courses, programs, conferences, and seminars. The SEC employs many attorneys who must satisfy Continuing Legal Education (CLE) requirements that vary by jurisdiction. The SEC also employs accountants, certified fraud examiners, and other financial professionals who require Continuing Professional Education (CPE) credits in accordance with requirements identified by the National Association of State Boards of Accountancy (NASBA). Additionally, the SEC hires other professionals who need to understand various aspects of securities laws, financial regulation and government regulation to fulfill their mission. The SEC seeks to provide access to legal and regulatory programs in a variety of formats on an array of substantive areas of law, federal regulation, professionalism and legal skills, including programs, materials and handbooks that offer CLE credit as permitted under varying bar requirements as well as CPE credit as recognized by

NASBA.

C.2 Scope This requirement is for the Contractor to provide the purchase of an annual enterprise membership to include an all‐access pass for all staff members of the US Securities and Exchange Commission to unlimited live day‐ long or multi‐day seminars as well as unlimited access to recorded versions of the live seminars, webcasts of the live programs, groupcasts of the live programs, and audio programs in downloadable versions which fulfill CLE and CPE requirements. The requirement is for live programs, seminars, and/or conferences and program materials and subject‐matter handbooks in substantive areas such as accounting, securities laws, corporate law, financial services, economic analysis, administrative law, antitrust, banking, ethics and professional responsibility, government regulation, government contracting, health care, insurance, intellectual property, litigation, municipal law, privacy, and tax as well as ethics, professionalism, and professional legal skills. The Contractor shall refer to and comply with all SEC OIT Security Policies and Procedures.

C.3 Business Requirements: The Contractor shall provide this requirement as follows:

C.3.1 ‐ The Contractor shall provide the following minimum functionalities:

C.3.2 – The Contractor shall provide SEC staff an enterprise membership through which they have access to programs in a variety of formats on substantive areas of law, federal regulation, professionalism and legal skills including program materials and handbooks. By virtue of the license, SEC staff will not pay registration or materials fees for all programs sponsored by the Contractor.

C.3.3 – The Contractor shall provide programs in‐person and on‐demand. The format for these programs may include: (a) live seminars, (b) web‐casts, (c) group casts, (d) audio download, (e) web segments, (f) video download, (g) on‐demand web, and (h) audio only web programs, and may include additional formats. The issues and topics covered by the programs span both the breadth of subject areas addressed by the SEC in pursuing its mission and the variety of businesses reviewed, regulated or affected by the work of the SEC such as accounting, securities laws, corporate law, financial services, economic analysis, administrative law, antitrust, banking, ethics and professional responsibility, government regulation, government contracting, health care, insurance, intellectual property, litigation, municipal law, privacy, and tax as well as ethics, professionalism, and professional legal skills.

C.3.4 – The Contractor shall provide over 100 live, day‐long or multi‐day programs to be held annually around the United States, including the following cities: New York, New York; Chicago, Illinois; San Francisco, California; and Washington, D.C. and should include live programs for securities industry participants and securities lawyers featuring speakers employed by financial industry entities, law firms and federal financial regulators, including the U.S. Securities and Exchange Commission (SEC). The contractor shall offer at least one annual conference focused primarily on the mission and initiatives of the SEC that includes staff from the

SEC.

C.3.5 – The Contractor shall provide program content to include recent legal updates that allow SEC staff to stay on top of industry trends as well as new legislation and regulatory changes. The Contractor shall provide programs, program materials and subject‐matter handbooks that offer in‐depth information and are archived on the Contractor’s website for delivery on‐demand and provide CLE credit as permitted under varying bar requirements and CPE credit as permitted by the NASBA. The Contractor shall provide the categories of CLE credit offered to include, but not be limited to, the following: a) Elimination of Bias, b) Ethics, c) General, d) Practice Management, e) Professionalism, f) Professional Practice, g) Skills, and h) Trial.

C.3.6 – The Contractor shall provide information regarding available programs, materials and subject‐matter handbooks on a website that offers a user the ability to search for programs, materials and handbooks by a variety of means including but not limited to program format, date, topic, location and CLE or CPE credit. The Contractor shall issue CLE certificates, in accordance with varying CLE regulations.. The Contractor shall also issue CPE credits in accordance with the requirements of NASBA.

C.3.7 – The Contractor shall maintain and make accessible all training records for staff for a five (5) year period. Training records include correspondence, reports, attendance records, CLE certificates, CPE Certificates and other records relating to staff’s participation in the Contractor’s training programs

C.3.8 – The Contractor shall provide a customer service representative during normal business hours as defined under “Hours of Performance” who will be available to assist SEC University staff in resolving issues in resetting passwords, designing reports and any other assistance that may be required during the life of the contract. Also, the Contractor shall provide usages reports and additional information as may be reasonably requested by SEC University staff.

C.3.9 – The Contractor shall provide membership licenses for programs, materials and subject‐matter handbooks for all SEC staff throughout the SEC who need to understand various aspects of securities laws, financial regulation and government regulation to fulfill their mission, regardless of whether they are seeking CLE or CPE credit.

C.4 Federal Requirements & SEC Regulations

C.4.1 – Federal Requirements. The following is a sample list of federal requirements consisting of laws, policies, standards and guidance required for information protection. The Contractor will be subject to the same information protection requirements as the SEC under the E‐Government Act of 2002. The list that follows is not all‐inclusive and the Contractor shall follow the same requirements as the Commission.

Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) for system accessibility requirements

Office of Management and Budget (OMB) Circular A‐11, Revised, “Preparation, Submission and Execution of the Budget” (July 2003)

OMB Circular A‐130, Revised, “Management of Federal Information Resources” (November 2000)

OMB Federal Enterprise Architecture Program Management Office (FEAPMO) Reference Models and Circular A‐11 Guidance. www.feapmo.gov.

Privacy Act of 1974, Public Law 93‐579 (5 U.S.C. 552a)

The E‐Government Act of 2002, Public Law 107‐347

Office of Management and Budget (OMB) Memorandum M‐12‐20, FY 2012 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management

OMB Memorandum M‐03‐22, OMB Guidance for Implementing the Privacy Provisions 1 of the E‐ Government Act of 2002, September 30,2003

Federal Information Processing Standard (FIPS) Publication (PUB) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, March 2006

FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

FIPS PUB 197, Advanced Encryption Standard, November 2001

National Institute for Standards and Technology (NIST), Special Publication (SP) 800‐122, Guide for Protecting the Confidentiality of Personally Identifiable Information (PII), April 2010

NIST SP 800‐37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, February 2010

NIST SP 800‐115, Technical Guide to Information Security Testing and Assessment Sept 2008

NIST SP 800‐100, Information Security Handbook: A Guide for Managers, Oct 2006

NIST SP 800‐95, Guide to Secure Web Services, Aug 2007

NIST SP 800‐92, Guide to Computer Security Log Management, Sep 2006

NIST SP 800‐88, Guidelines for Media Sanitization, Sep 2006

NIST SP 800‐61 Rev. 2, Computer Security Incident Handling Guide, August 2012

NIST SP 800‐53 Rev. 3, Recommended Security Controls for Federal Information Systems and Organizations, Aug 2009

NIST SP 800‐53A, Revision 1, Guide for Assessing the Security Controls in Federal Information Systems, June 2010

NIST SP 800‐44 Version 2, Guidelines on Securing Public Web Servers, Sep 2007

NIST SP 800‐30, Revision 1, Guide for Conducting Risk Assessments, September 2012

NIST SP 800‐70, Revision 2, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, February 2011

C.4.2 – SEC Regulations

Information Technology Security Program, SECR 24‐2, approved December 8, 1998

IT Security Program Technical Bulletin: Identification, Authentication and Passwords, SECR 24‐2.1, April 4, 2001

Safeguarding Non‐Public Information, SECR 23‐2A, approved January 21, 2000

Use of SEC Office Equipment SECR 24‐4.3, approved 03/08/2002

Use of Personal Digital Assistant (PDA) Devices SECR 24‐5.2, approved 11/02/2002

Enterprise Architecture SECR 24‐1.6, approved 11/02/2002

Certification and Accreditation SECR 24‐2.4, approved 07/18/2002

Network Security SECR 24‐2‐7, approved 09/11/2002

Electronic Mail SECR 5‐10, approved 05/20/1996

Enterprise Backup of Electronic Data SECR 24‐2.6

Virus and Malicious Software Detection and Prevention SECR 24‐2.2

Use of Internet Browsers and Access to the World Wide Web SECR24‐3, approved 12/30/1998

Information Technology Security Program, SECR 24‐04, approved 10/4/2005

Information Collection Program, SECR 24‐09, approved 07/29/2009

C.4.3 – Security Requirements. The Contractor shall meet all the requirements listed below.

C.4.3.1 – Requirements Management. The Contractor shall provide all necessary personnel, administrative, financial, and managerial resources necessary to perform all tasks described in this Statement of Work (SOW).

C.4.3.2 – Security Issue Review. The Contractor shall remediate problems identified during security testing. All significant issues (typically those rated as HIGH and often those rated as MEDIUM) should be resolved before the system is allowed to go into production. The Contractor shall resolve as many security audit‐related Plan of Action and Milestones (POA&M) items as possible and within a reasonable timeframe. The Contractor shall document the resolution and provide supporting evidence of changes. The Contractor shall schedule a conference meeting with the COR, OIT Security Group staff, and relevant SEC staff to review the state of the POA&M resolutions. The Contractor shall provide the SEC with the number and description of resolved POA&M items identified in the security review.

C.4.3.3 – Security Assessment. OIT Security Team performs Security Assessment and Authorization (SA&A) for a product to be deployed. This process is designed to allow the SEC to identify any risks associated with the system and either mitigate them or formally accept any residual risk. This requirement is based on the NIST 800 family of documents and includes:

Enumeration ‐ activity aimed at identifying devices and components and cross‐referencing with provided inventory lists

Vulnerability Scanning ‐ performs network‐based vulnerability assessment of customer’s servers, workstations, and any other network device or appliance in scope. The assessment will identify vulnerabilities associated with network services, operating systems, and devices that are un‐patched or have out‐of‐date software security patches;

Penetration Testing ‐ attempts to exploit weaknesses identified from vulnerability scanning to verify legitimate findings, eliminate false‐positives, and determine the extent of the vulnerability and potential remediation steps that may be taken; and

Functional Testing ‐ Perform specific tests, examinations, and inspections against NIST 800‐53 controls not tested by the other activities.

The Contractor shall provide the Security Team with: (1) a system demonstration; (2) test user IDs; (3) Access to the system; and (4) System Security Plan (SSP) (5) additional documents as required under the NIST 800 series for Security Assessment & Authorization. The Contractor shall provide ongoing support to update the required SA&documentation. The OIT Security Team provides the test reports.

C.5 Requirements Management

The Contractor shall provide all necessary personnel, administrative, financial, and managerial resources necessary to perform all tasks issued against this contract.

C.6 Documentation Updates The Contractor shall maintain and update system specifications and/or documentation to reflect changes made during maintenance or update. The Contractor shall maintain system documentation to reflect the configuration of software releases and COTS products. The Contractor shall maintain documents and specifications in compliance with standards for formatting and content and produce standardized documentation, i.e., User Guides, Requirements Documents, On‐line Help, Standard Operating Procedures (SOP), system specifications, audit documentation practices and procedures, and other documentation. The documentation shall be available to the COR for review and inspections throughout the SDLC; updates shall be submitted to the COR for review and approval.

SECTION F ‐ DELIVERIES OR PERFORMANCE

F.1 Place of Performance. The Contractor shall perform development work at the Contractor’s work site location (off‐site). Desk, phone, and computer will be made available to Contractor personnel at the SEC for temporary use in the performance of this contract if needed.

F.2 Schedule of Deliverables. The Contractor shall prepare and provide deliverables in electronic format to the COR. The COR will review all deliverables and provide comments and/or approvals/disapprovals in a timely manner so as not to adversely impact the project schedule. Deliverable schedules may include, but will not be limited to, the following:

Section Deliverable Due Date Schedule

C.1 Initial Kickoff Conference Call/Meeting

10 calendar days ACA Per approved project schedule

C.3 Business Requirements 30 calendar days ACA Per approved project schedule

C.4 Section 508 compliant course files

60 calendar days ACA Per approved project schedule

C.4.3. Security Issue Review Quarterly Per approved project schedule

C.4.3. Security Penetration Quarterly Per approved project schedule

C.5 Requirements Management Quarterly Per approved project schedule

Section Deliverable Due Date Schedule

C.6 Documentation Updates Monthly Per approved project schedule