RFI Attachment III FAR and HSAR matrix.pdf

(c) Background investigation

(e) CUI Training

(g) U.S. Citizenship

(b) Handling of Controlled Unclassified Information

(1) Compliance with DHS Policies and Procedures

(2) Not Use or Redistribute Any Sensitive Information

(3) Invoicing and Billing

(4) Bankruptcy Proceedings

(c) Incident Reporting Requirements

(1) Report known or suspected incidents

(3) Transmission of CUI

(5) Additional data elements

(d) Incident Response Requirements

(1) Notification in writing

(2) Full Access and Cooperation

(3) Incident Response

(4) Preserve and Protect

(5) Third-party Assistance

INSTRUCTIONS: Please complete this matrix and indicate your ability to meet each requirement of the DHS HSAR clauses. You may include additional information in your RFI written response for any Requires SIGNIFCANT resources/ enhancement and Unable to meet requirement response. Full clauses are available at acquisition.gov.

HSAR 3052.204-72 Safeguarding of Controlled Unclassified Infomation (JUL 2023) -- Alternate I (JUL 2023)

HSAR 3052.204-71 Contractor Employee Access (JUL 2023) -- Alternate II (JUL 2023)

(2) Within 1-hour of discovery for PII/SPII; and within 8-hour discovery for all other

RFI Attachment III CCSP SERVICES

Vendor:

DHS FAR and HSAR Security and Privacy Matrix

Cu rr en tly m ee ts re qu ire m en t

W ill in g to c om pl y;

ire s s om e re so ur ce s/ en ha nc em en t

W ill in g to c om pl y;

ire s s ig ni fic an t re so ur ce s/ e nh an ce m en t

U na bl e to m ee t re qu ire m en t https://www.acquisition.gov/hsar/3052.204-71-contractor-employee-access.

https://www.acquisition.gov/hsar/3052.204-71-contractor-employee-access.

https://www.acquisition.gov/hsar/3052.204-71-contractor-employee-access.

https://www.acquisition.gov/hsar/3052.204-71-contractor-employee-access.

https://www.acquisition.gov/hsar/3052.204-71-contractor-employee-access.

https://www.acquisition.gov/hsar/3052.204-71-contractor-employee-access.

https://www.acquisition.gov/hsar/part-3052%E2%80%94solicitation-provisions-and-contract-clauses#Section_3052_204_72_T48_7021551214 https://www.acquisition.gov/hsar/part-3052%E2%80%94solicitation-provisions-and-contract-clauses#Section_3052_204_72_T48_7021551214 https://www.acquisition.gov/hsar/part-3052%E2%80%94solicitation-provisions-and-contract-clauses#Section_3052_204_72_T48_7021551214 https://www.acquisition.gov/hsar/part-3052%E2%80%94solicitation-provisions-and-contract-clauses#Section_3052_204_72_T48_7021551214 https://www.acquisition.gov/hsar/part-3052%E2%80%94solicitation-provisions-and-contract-clauses#Section_3052_204_72_T48_7021551214 https://www.acquisition.gov/hsar/part-3052%E2%80%94solicitation-provisions-and-contract-clauses#Section_3052_204_72_T48_7021551214 https://www.acquisition.gov/hsar/part-3052%E2%80%94solicitation-provisions-and-contract-clauses#Section_3052_204_72_T48_7021551214 https://www.acquisition.gov/hsar/part-3052%E2%80%94solicitation-provisions-and-contract-clauses#Section_3052_204_72_T48_7021551214 https://www.acquisition.gov/hsar/3052.204-71-contractor-employee-access.

https://www.acquisition.gov/hsar/3052.204-71-contractor-employee-access.

(f) Other Reporting Requirements

(g) Subcontracts

(h) Authority to Operate

(1) Security Authorization Package

(2) Renewal of ATO

(3) Security Review

(b) PII and SPII Notification Requirements

(1) 5-day Notification

(2) Notification Method

(c) Credit Monitoring Requirements

(1) Notication

(2) Credit Monitoring Services

(3) Call Center

(b) Security Training Requirements

(1) Online Training

(2) Rules of Behavior

(c) Initial and Annual Privacy Training

(d) Documentation

(e) No Access Prior to Privacy Training Completion

(f) Subcontracts

DHS Special Clause - Information Technology Security Awareness Training (JUL 2023)

FAR 52.224-3 Privacy Training (JAN 2017)--Alternate I (JAN 2017) (Deviation) (JUL 2023)

(e) Certificate of Sanitization of Government and Government-Activity - Related Files and Information

(4) Federal Reporting and Continuous Monitoring Requirements

3052.204-73 Notification and Credit Monitoring Requirements for Personally Identifiable Information Incidents (JUL 2023) https://login.acquisition.gov/hsar/3052.204-73-notification-and-credit-monitoring-requirements-personally-identifiable-information-incidents.

https://login.acquisition.gov/hsar/3052.204-73-notification-and-credit-monitoring-requirements-personally-identifiable-information-incidents.

https://login.acquisition.gov/hsar/3052.204-73-notification-and-credit-monitoring-requirements-personally-identifiable-information-incidents.

https://login.acquisition.gov/hsar/3052.204-73-notification-and-credit-monitoring-requirements-personally-identifiable-information-incidents.

https://login.acquisition.gov/hsar/3052.204-73-notification-and-credit-monitoring-requirements-personally-identifiable-information-incidents.

https://login.acquisition.gov/hsar/3052.204-73-notification-and-credit-monitoring-requirements-personally-identifiable-information-incidents.

https://www.acquisition.gov/far/52.224-3 https://www.acquisition.gov/far/52.224-3 https://www.acquisition.gov/far/52.224-3 https://www.acquisition.gov/far/52.224-3 https://www.acquisition.gov/far/52.224-3 https://www.acquisition.gov/far/52.224-3 https://www.acquisition.gov/far/52.224-3 https://www.acquisition.gov/far/52.224-3 https://login.acquisition.gov/hsar/3052.204-73-notification-and-credit-monitoring-requirements-personally-identifiable-information-incidents.

https://login.acquisition.gov/hsar/3052.204-73-notification-and-credit-monitoring-requirements-personally-identifiable-information-incidents.

Sheet1