Attachment_3_-_Quarterly_Report_Template[1].docx

Center for Tobacco Products

State/Territory: ____________ Agency/Department: ____________________________

Contract Number: __________________ Month: ______ Period Covered: ________ to _________

Attachment 3 – Monthly Report Template

Center for Tobacco Products

Monthly Report for FDA Tobacco Compliance Check Inspection Program

State/Territory: __________________________________ Agency/Department/Contractor:____________________

Contract Number: _________________ Month: ______

Period Covered: ______________ to _______________

Program Coordinator: ________________________________

Prepared By: ________________________________________

Program Overview

Total number of Retail Establishments in State

Number eliminated by pre-screening[footnoteRef:1] [1: Prescreening is identifying which retail outlets are closed or ineligible for inspection prior to an inspector attempting to conduct an inspection at the retail outlet.]

Total eligible for inspection after pre-screening

Total number of tobacco retail establishments assigned

Total number of FFA assignments

Total number of deliveries to retailers

As of _________, the retail outlet information contained in FDA’s TIMS contains the most current retail outlet information possessed by the Contractor.

Training Updates this Month

Follow-up Questions from FDA[footnoteRef:2] [2: A Follow-up Question from FDA is an inquiry from the jurisdiction’s trainer or COR regarding a specific inspection asking for a written response from the jurisdiction.]

Total answered

Total pending

Reason for pending questions:

Program Participants Added this Month

Program Participants Removed this Month

Retail Inspection Coverage Plan

Briefly describe the retail inspection coverage plan[footnoteRef:3] used during this month: [3: Retail inspection coverage plans outline how specific geographical areas of the state are divided and assigned for inspections, how each type of inspection is assigned, and the expected number of inspections to be completed.]

Briefly describe the retail inspection coverage plan to be used during the next month:

Program Coordination[footnoteRef:4] [4: If the Contractor does not coordinate inspections and/or results with Synar or state or local enforcement, simply answer N/A for the first 2 questions.]

Briefly describe how the Contractor coordinated with the State/Territory Synar Program during this month:

Briefly describe how the Contractor plans to coordinate with the State/Territory’s Synar Program during the next month:

Briefly describe how the Contractor coordinated with any other non-FDA tobacco control program(s) in the state, territory, or tribal area during this month:

Briefly describe how the Contractor plans to coordinate with any other non-FDA tobacco control program(s) in the state territory, or tribal area during the next month:

Youth Coverage Describe how retailers in areas that are in close proximity to where there is a high concentration of youth (e.g., schools, recreation centers, etc.) were inspected in this month.

Describe how retailers in areas that are in close proximity to where there is a high concentration of youth (e.g., schools, recreational centers, etc.), will be inspected in the next month:

Minority Coverage Describe how retailers in racial and ethnic minority communities were covered in this month.

Describe how retailers in racial and ethnic minority communities will be covered in the next month:

Media Coverage

Number of Media Coverage Events, Contact, and/or Inquiries, if any

Describe any media contact and/or inquiries during this month, including the points of contact:

Please provide name of the person contacted at FDA and the date/time this person was informed of the media contact/inquiry:

Feedback

Describe your experiences regarding the use of handheld devices and other hardware, hardcopy forms, TIMS, and the online compliance check inspection process:

Feedback regarding the FDA program in general:

Access to Government Property

In accordance with the Control of Property Section of the Contract (G.7), all accountable property should be reported annually. While not required to use the HHS Form 565, we have attached the form as a guide that you may use to track accountable property. Accountable property is nonexpendable personal property with an acquisition cost of $5,000 or more, and with a useful life of two years or more and sensitive items (regardless of acquisition value). Examples of sensitive items include computers, smartphones, and cameras. For a full list of sensitive items, please see the Sensitive Items Policy for Personal Property and Equipment attached below.

Describe your program for the protection, preservation and maintenance of all Government property, procedures to educate your employees concerning individual responsibilities for Government property, and efforts to monitor and assess your property control system:

If Contractor disposed of any equipment or Government Property, describe the means by which this was done and who was consulted prior to such action:

Sensitive Items Policy.pdf

HHS Standard 2009-0001.001S January 30, 2009

HHS-OCIO Standard for Security Configurations Language in HHS Contracts

To implement Federal Acquisition Regulation (FAR) 39.101(d) regarding Common Security Configurations, and Department of Health and Human Services (HHS) information security requirements, the following standard language shall be incorporated in solicitations and new contracts for the operation or acquisition of information technology systems. This document supersedes HHS Standard 2008-0004.001S, HHS-OCIO Standard for Security Configurations Language in HHS Contracts (dated September 11, 2008), and is effective immediately.1 An approved HHS Department Information Security Policy/Standard Waiver2 is required to deviate from the technical standard set forth below.

1. Contractor computers containing HHS data shall be configured with the applicable Federal Desktop Core Configuration (FDCC) (http://nvd.nist.gov/fdcc/index.cfm),3 and shall have and maintain the latest operating system patch level and anti-virus software level.

2. The Contractor shall apply approved security configurations to information technology that is used to process information on behalf of the Department, its Operating Divisions (OPDIVs) and Staff Divisions (STAFFDIVs).

Such approved security configurations shall be identified jointly by the OPDIV/STAFFDIV Contracting Officer’s Technical Representative (COTR) and Chief Information Security Officer (CISO). Approved security configurations include, but are not limited to, those published by the Department,4 by the OPDIV/STAFFDIV, and by the National Institute of Standards and Technology (NIST) at http://checklist.nist.gov. OPDIVs/STAFFDIVs may have security configurations that are more stringent than the minimum baseline set by the Department or NIST.

When incorporating such security configuration requirements in solicitations and contracts, the OPDIV CISO shall be consulted to determine the appropriate configuration reference for a particular system or services acquisition.

3. The Contractor shall ensure applications operated on behalf of the Department or OPDIV/STAFFDIV are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings.5 The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The contractor shall ensure currently supported versions of information technology (IT) products meet the latest FDCC major version and subsequent major versions.6

4. The Contractor shall ensure applications designed for end users run in the standard user context without requiring elevated administrative privileges.

5. The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above

6. Federal Information Processing Standard 201 (FIPS-201)7 compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

7. The Contractor shall ensure all its subcontractors which perform work under this contract (at all tiers) comply with the above requirements.

http://nvd.nist.gov/fdcc/index.cfm http://checklist.nist.gov/

HHS Standard 2009-0001.001S

HHS-OCIO Standard for Security Configurations Language in HHS Contracts

APPROVED BY & EFFECTIVE ON:

/s/ January 30, 2009 Michael W. Carleton Date HHS Chief Information Officer and Deputy Assistant Secretary for Information Technology

Martin J. Brown Date HHS Senior Procurement Executive and Deputy Assistant Secretary for Acquisition Management and Policy

1 This requirement will be incorporated into the HHS Acquisition Regulation and the HHS Acquisition Plan.

2 The HHS Departmental Information Security Policy/Standard Waiver form and process is available at http://intranet.hhs.gov/infosec/policies_memos.html.

FDCC is applicable to all computing systems using Windows XP™ and Windows Vista™, including desktops and laptops— regardless of function—but not including servers. The Department has developed an HHS version of FDCC (henceforth HHS FDCC) for Windows XP™ and Vista™ to accommodate business and operational needs in the HHS environment. These settings are available at http://intranet.hhs.gov/infosec/guidance.html. When there is a compelling business or operational need to deviate from the FDCC, Operating Divisions (OPDIVs) and Staff Divisions (STAFFDIVs) may use the HHS FDCC settings instead of the government-wide FDCC settings.

See HHS Minimum Security Configuration Standards for Departmental Operating Systems and Applications (as amended) at http://intranet.hhs.gov/infosec/guidance.html.

See http://nvd.nist.gov/validation.cfm, as required by the Office of Management and Budget (OMB) Memorandum (M) 08-22, Guidance on the Federal Desktop Core Configuration (FDCC), released August 11, 2008.

This meets the self-assertion requirement under OMB M-08-22. Future FDCC changes having minimal security impact may be released as minor versions to FDCC. Self-assertion is not required for minor releases.

7 http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf

HHS Standard 2009-0002.001S

HHS-OCIO Standard for Encryption Language in HHS Contracts

The Department of Health and Human Services (HHS) requires incorporation of the following standard language in solicitations and new contracts that either purchase or require the use of desktop or laptop computers, mobile devices, or portable media to store or process HHS sensitive information that is categorized as Moderate or High under Federal Information Processing Standard 199 (FIPS 199).1 An approved HHS Department Information Security Policy/Standard Waiver2 is required to deviate from these technical standards. This standard is effective immediately.3

1. The Contractor shall use FIPS 140-2 (as amended) compliant encryption4 to protect all instances of HHS sensitive information5 during storage and transmission.

2. The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to both the Contracting Officer and the Contracting Officer’s Technical Representative (COTR).

3. The Contractor shall use the Key Management Key on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information.6

4. The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information, in accordance with FIPS 140-2 (as amended).

5. The Contractor shall: ensure that this standard is incorporated into the Contractor’s property management/control system; or establish a procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

6. The Contractor shall ensure that all of its employees, subcontractors (at all tiers), and employees of each subcontractor, who perform work under this contract/subcontract, comply with the above requirements.

APPROVED BY & EFFECTIVE ON:

Michael W. Carleton Date HHS Chief Information Officer and Deputy Assistant Secretary for Information Technology

Martin J. Brown Date HHS Senior Procurement Executive and Deputy Assistant Secretary for Acquisition Management and Policy http://csrc.nist.gov/cryptval/ http://csrc.nist.gov/cryptval/

HHS Standard 2009-0002.001S

HHS-OCIO Standard for Encryption Language in HHS Contracts

FIPS-199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.

The HHS Departmental Information Security Policy/Standard Waiver form and process is available at http://intranet.hhs.gov/infosec/policies_memos.html.

This requirement will be incorporated into the HHS Acquisition Regulation and the HHS Acquisition Plan.

The Office of Management and Budget (OMB) Memorandum (M) 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (released May 22, 2007) requires the use of FIPS 140-2, Security Requirements for Cryptographic Module, compliant encryption technologies on laptop computers and all other mobile computers and devices containing sensitive information. The HHS memorandum Mandatory Protection of Sensitive Information on Computers, Mobile Devices, and Portable Media (henceforth called the Protection of Sensitive Information Memo), signed by the HHS Chief of Staff on May 19, 2008, directs expansion of the current HHS Encryption Standard for Mobile Devices and Portable Media to “all government and non-government-furnished desktops used on behalf of the government that store sensitive information.”

5 For the purposes of this contract, information is considered sensitive if the FIPS 199 Confidentiality or Integrity security objective is rated Moderate or High by the OPDIV Chief Information Security Officer (CISO) or HHS Chief Information Security Officer (CISO), as appropriate.

Key recovery is required by OMB Guidance to Federal Agencies on Data Availability and Encryption, November 26, 2001, http://csrc.nist.gov/policies/ombencryption-guidance.pdf. Authorized personnel to decrypt and recover all encrypted information shall be identified by contract.

Appendix B_Pt1_SensitiveItems Policy_Jan2009Rev1

Appendix B_Pt2_HHS-OCIO-2009-0001 001S Standard Security Configurations Language in HHS Contracts 1-30-2009

Appendix B_Pt3_HHS-OCIO-2009-0002 001S Standard Security Encryption Language in HHS Contracts 1-30-2009 image4.emf

HHS Form 565.pdf

OMB No. 0990-0015 Expiration Date: 12/31/99

DEPARTMENT OF

HEALTH AND HUMAN SERVICES

1. DATE

3. CONTRACT NUMBER

2. PUBLIC VOUCHER NO.

4. REPORT NO. PAGE

NO.

PAGESREPORT OF ACCOUNTABLE PERSONAL PROPERTY

NOTE: Complete this form in accordance with instructions on reverse side of copy No. 1.

5. NAME OF PERSON RESPONSIBLE FOR THIS REPORT 6. TYPE OF REPORT

ACQUISITION - GOV. TITLED

ACQUISITION - CONTR. TITLED

ANNUAL INVENTORY

FINAL INVENTORY

7. NAME AND ADDRESS OF CONTRACTOR 8.

FOR GOV

USE ONLY

9.

ITEM

10.

DESCRIPTION & NSN

11.

GFP

OR CAP

12.

MFR.

13.

MODEL OR

TYPE

14.

MFR. SERIAL

15.

UNIT ACQUISITION

COST

16.

GOV

ID NO.

17.

ACQ.

AUTH.

18. DATE

REC’D.

MO/YR

TELEPHONE: AREA CODE NO.

19. AUTHORIZATION BY CONTRACTOR’S SUPERVISORY ACCOUNTING OFFICIAL

SIGNATURE DATE

NAME (TYPED) TITLE

20.

ACCEPTED BY AUTHORIZATION GOVERNMENT

REPRESENTATIVE

SIGNATURE AND TITLE

VOUCHER NO.

DATE

HHS 565 (9/98)

INSTRUCTIONS FOR PREPARATION OF HHS FORM 565

REPORT OF ACCOUNTABLE PERSONAL PROPERTY

This report shall be submitted in an original and 2 copies by the contractor and included with his Public Voucher (or invoice) under which reimbursement for the acquisition of authorized accountable personal property is requested. When utilizing this form for inventory reporting, two copies shall be forwarded to the cognizant Property Administrator. Final inventories must include the Certification required by HHS Contractor’s Guide for Control of Government Property.

Item No.

1. Enter date prepared.

2. Enter Public Voucher (or Invoice) Number.

3. Enter complete contract number.

4. Enter number of this report. (Reports will be numbered serially beginning with No. 1 for each contract.) Enter page number of pages.

5. Enter name and telephone number of contractor’s representative responsible for report.

6. Indicate type of Report.

7. Enter name and address of contractor exactly as it appears on the contract.

8. Leave blank. For Contracting Agency use only.

9. Enter line item number. Each report shall begin with number “1”.

10-14. Identify fully the property being reported, including manufac-turer, model, type, capacity, size and serial number. When this form is used for inventory reporting, include condition code in item 10 and indicate GFP or CAP in item 11.

15. Enter unit acquisition cost of the item. (List all taxes, discounts, shipping and installation costs as separate items immediately following each item being reported.)

16. For Government owned property, enter the Government identification number (decal) affixed. For Contractor owned property, enter contractor’s identification number affixed.

17. Enter authorization for acquisition e.g., contract schedule number, contracting officer’s authorization letter number, etc.

18. Enter month and year property was received by contractor as reflected on receiving report.

19. Enter signature and title of person authorized to certify to the accuracy of report.

20. Leave blank. For Contracting Agency use only.

This Form may be reproduced by Contractors in size 8-1/2” X 11” only.

Burden Estimate Statement A federal agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. Public reporting burden for this collection of information is estimated to vary from thirty (30) minutes to one hour per response, including time for reviewing instructions, searching existing data sources, gathering and maintaining the necessary data, and completing and reviewing the collection of information. Send comments regarding the burden of estimate or any other aspect of this collection of information to the OS Reports Clearance Officer, ASMB/Budget/DIOR, Room 503H, HHH Building, 200 Independence Avenue, S.W., Washington, D.C. 20201.

Dt:

PubVouchNo:

CntrNo:

RptNo:

Pg:

Of:

Nm:

ArCd:

OffPh:

GovtTtl:

AnnInven:

FinInven:

CntrNm:

CntrAdd:

Item:

Desc:

GFP:

Manuf:

Model:

SerNo:

AcqCost:

IDNo:

AcqAuth:

RcvdDt:

CntrOfflNm:

CntrTtl:

CntrOflTtl:

AuthOflTtl:

VouchNo:

AuthOfflDt:

GovtUse1:

GovtUse2:

GovtUse3:

GovtUse4:

Header: Released 5/26/00.

Footer: Print back-to-back.

Header1:

Footer1:

image1.png image2.png image3.emf