18R0012_FAS_IPCC_Attch_2.docx

Solicitation No. 60RRBH18R0012 Page 1 of 1 Attachment 2

FISMA Audit Services

Information Privacy Certification by RRB Contractor

I understand that while performing work for the Railroad Retirement Board (RRB) Office of Inspector General (OIG) I may encounter Federally Owned, Personally Identifiable Information, Sensitive Business Information, or Controlled Unclassified Information protected by the Privacy Act of 1974 as amended, the Internal Revenue Code, the Railroad Retirement Act, the Railroad Unemployment Insurance Act, and any other applicable laws, regulations, policies, and procedures.

I agree:

· That I have read and understand my safeguarding responsibilities as stated in the Safeguarding Controlled Unclassified Information (CUI) handout for any Federally Owned information that I may use in the performance of this contract.

· Any information made available by the RRB or RRB OIG, in any format, shall be used only for the purpose of carrying out the provisions of this contract. Information contained in such material will be treated as confidential CUI, and will not be divulged or made known in any manner to any person other than those persons with a need to know such information in carrying out their responsibilities under this contract. Disclosure to anyone other than an officer of employee of the RRB or RRB OIG is prohibited, except where such disclosure is required by law.

· All information provided by the RRB or RRB OIG will be accounted for upon receipt and properly secured and safeguarded before, during, and after processing, regardless of its media (print, electronic, microfiche, etc.). In addition, all related output will be given the same level of protection as required for the source material.

· All data processed, captured, printed, or stored in any media format during the performance of this contract will be completely purged from any non-RRB system and no output retained after the work is no longer needed or the contract is fulfilled, whichever comes first.

· I will dispose of CUI that is no longer needed in accordance with RRB Administrative Circular, IRM-5, Media Sanitization or as directed in the National Institute of Standards and Technology (NIST), Special Publication 800-88, Guidelines for Media Sanitization.

· I will provide a certificate stating that all RRB data was purged, when it was purged, and how it was purged to my RRB OIG Contracting Officer’s Representative (COR) prior to final completion of the contract.

· I will contact my RRB OIG COR immediately if there is a potential or actual loss of Sensitive Business Information or Personally Identifiable Information in any RRB information that is entrusted to my care, as required by IRM-15, Safeguarding Protected Information and Breach Notification Protocol.

Signature: ______________________________________________________ Date: _____________________

Print Name: ________________________________________________

E-mail Address: _____________________________________________ Telephone No.: __________________

Organization Name: _________________________________________ Contract No.: ____________________

For RRB OIG Use Only

Accepted by (Name & Signature):

Title and Date: