Statement of Work Page 29 - Revised Amendment 0001.pdf
PDF 111 KB Posted
- Attached to
- Removal, Purchase and Install Video Surveillance System (VSS) - James Byrne Courthouse, Philadelphia, PA
- Solicitation number
- 70RFP325QE3000027
About this file
This Request for Quote (RFQ) 70RFP325QE3000027 (Amendment 0001) details extensive cybersecurity and system access requirements for a federal contract, specifically focusing on password management, data protection, and user account controls. The document outlines strict technical specifications including password complexity requirements (12-character minimum, no dictionary words, mandatory special characters), password expiration after 90 days, encrypted password storage, and role-based access controls. Additional security mandates include using FIPS 197 (AES-256) compliant cryptographic modules, implementing least privileged permission schemes, and ensuring complete data purging at contract completion. The contractor must provide configurable user accounts, recommend account status changes, and obtain written approval from the Federal Protective Service Contracting Officer Representative (FPS COR/TPOC) for account modifications.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFQ: 70RFP325QE3000027
Amendment 0001
E.15.4 Systems shall enforce password composition and complexity requirements:
a) Are at least 12 characters in length
b) Are not the same as any of the user’s previous 8 passwords
c) Do not contain any dictionary word
d) Are not the same as the User ID
e) Contains at least one number (e.g., 1, 2, 3) and one special character (e.g., @, #, $, E.15.5 Systems shall enforce passwords that expire after ninety (90) days.
E.15.6 Systems shall store all passwords in encrypted form.
E.15.7 Systems shall provide role-based accesses that allow different levels of privilege. For example, administrators, general users, etc.
E.15.8 All default vendor or factory-set administrator accounts or passwords shall be changed before installation or use.
E.16 Data Protection
E.16.1 Cryptographic functions provided by any system component shall use only cryptographic modules that are Federal Information Processing Standard (FIPS) 197 (AES-256) compliant and have received FIPS 140-3 validation at the level appropriate to their use.
E.16.2 The Contractor shall provide configuration specifications for implementing encryption and authentication between the cameras and the network and specifically note all security measures associated with the system.
E.16.3 When the contract ends, the contractor shall return all information and information resources provided during the life of the contract and certify that all DHS information has been purged from any contractor-owned system(s) that have been used to process DHS information.
E.17 User Accounts
E.17.1 The Contractor shall provide user accounts with configurable access and permissions associated with the defined user role.
E.17.2 The Contractor shall adhere to least privileged permission schemes for all user accounts, and application-to-application communications.
E.17.3 The Contractor shall recommend which accounts need to be active and those that can be disabled, removed, or modified. The FPS COR/TPOC shall approve in writing the Contractor’s recommendation.
| E.16 Data Protection |
| E.17 User Accounts |
File details come from the government source that posted it. Updated .