DFC_OIT_CISO_Policy_SA-04_Security-and-Privacy-Requirements-for-Information-Technology-Procurements-04-25-2023.pdf

C

Office of Information Technology (OIT)

Security and Privacy Requirements for Information Technology Procurements

[SA-04]

April 25, 2023

Document History

Version Number

Release Date

Summary of Changes Section/ Page

Changes Made By

1.0 2/17/2023 Procedure drafted All Trevor Lowing

1.1 4/10/2023 Clerical updates. Incorporated Internet of Things (IoT) per OMB Memo M-23-03 43

Trevor Lowing

1.2 4/25/2023 Revised FIPS 140-2 references to include newer FIPS 140-* versions. Corrected document history.

2,10,12, 14,23, Trevor Lowing

Approval This policy has been approved and issued under the authority granted to the Vice President Office of Information Technology (OIT)/Chief Information Officer (CIO) in accordance with DFC Office Function Directives-IT, Directive OD-13 Other Internal Rules, Handbooks, Template; and the Federal Information Security Modernization Act (FISMA) of 2014.

DFC Chief Information Security Officer (CISO) Date https://opicgov.sharepoint.com/sites/Governance/Management/Forms/AllItems.aspx https://opicgov.sharepoint.com/sites/Governance/Management/Forms/AllItems.aspx

Table of Contents

1 INTRODUCTION

1.1 Purpose

1.2 Applicability

2 REQUIREMENTS

2.1 Safeguarding Information and Information Systems

2.2 Safeguarding Controlled Unclassified Information (CUI)

2.3 Safeguarding Sensitive Information

2.4 Confidentiality, Integrity, Availability, and Nondisclosure of Information

2.5 Internet Protocol Version 6 (IPv6)

2.6 Government Websites

2.7 Public-Facing Websites

2.8 Encryption

2.9 Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)

2.10 Training

2.11 Rules of Behavior

2.12 Incident Response

2.13 Contract Initiation and Expiration

2.14 Records Management and Retention

2.15 Government-Furnished Equipment

2.16 Non-Public Facing Websites

2.17 E-mail Security

2.18 Agency IT Security Checkpoints

2.19 Health Care Records and Data

2.20 Privacy Act Requirements

2.21 Security Requirements for Government-Owned/Contractor-Operated (GOCO) and Contractor-Owned/Contractor-Operated (COCO) Information Systems

a. Federal Policies

b. Security Assessment and Authorization (A&A)

c. A&A Package Deliverables

d. System Security Plans (SSP)

e. Security Assessment Plan/Report (SAP/SAR)

f. Independent Assessments

g. POA&Ms

h. Contingency Plans and Contingency Plan Testing

i. E-Authentication Questionnaire

j. Information Security Continuous Monitoring

2.22 Government Access for Security Assessment

2.23 End of Life Compliance

2.24 Desktops, Laptops, and Other Computing Devices

2.25 FedRAMP Privacy and Security Requirements

a. FedRAMP-Compliant ATO

Options for ATO Issuance

Contractor Responsibilities:

b. Data Jurisdiction

c. Service Level Agreements

d. Interconnection Agreements/Memorandum of Agreements

2.26 Protection of Information in a Cloud Environment

2.27 Security Assessment and Authorization

2.28 Reporting and Continuous Monitoring

2.29 Configuration Baseline

2.30 Media Transport

2.31 Card Readers

2.32 Other Requirements

2.33 Binding Operation Directives

2.34 Continuous Monitoring / Ongoing Security Assessment & Authorization

2.35 ICAM and PIV Systems

2.36 Zero Trust Architecture/Zero Trust Network

2.37 Internet of Things (IoT) Acquisition

2.38 Trusted Internet Connections

2.39 Transition to National Institute of Standards and Technology Special Publication 800-53, Rev. 5 from Rev. 4 – Security and Privacy Controls for Information Systems and Organizations

2.41 Use of Unauthorized External Email Systems

2.42 Office of Management and Budget (OMB) Executive Order Compliance

Security and Privacy Requirements for IT Procurements

1 INTRODUCTION

1.1 Purpose

This document establishes the security and privacy requirements for all U.S. International Development Finance Corporation (DFC) information technology (IT) procurements. In doing so, it supersedes any prior documentation establishing such requirements.

1.2 Applicability

The requirements established in this document apply to all U.S. International Development Finance Corporation contractors. The requirements established herein apply to the entire contract or order (hereafter referred to as a “contract”), or any portion thereof and includes either or both of the following:

a. Access (Physical or Logical) to Government Information: Physical and Logical Access refers to when contractor personnel are expected to have (1) routine physical access to an DFC-controlled facility; (2) logical access to an DFC-controlled information system; (3) access to government information, whether in an DFC-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3) as per OMB M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors.

b. Operate a Federal System Containing Information: A Contractor/employee will operate a federal system and information technology containing data that supports the DFC mission. In addition to the Federal Acquisition Regulation (FAR) Subpart

2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2 REQUIREMENTS

2.1 Safeguarding Information and Information Systems

In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor shall:

a. Protect Government information and information systems in order to ensure:

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity.

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an DFC network or operated by the Contractor on behalf of DFC regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within sixty (60) minutes or less, bring the situation to the attention of the other party.

c. Adopt and implement policies, procedures, controls, and standards required by the DFC Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the DFC Information Security Program security requirements, outlined in the DFC Information System Security Policy (ISSP), and its subordinate Policy policies and procedures, based on the National Institute of Standards and Technology (NIST) “Framework for Improving Critical Infrastructure Cybersecurity.” The framework contains the five

(5) core functions to “Identify,” “Protect,” “Detect,” “Respond (to),” and “Recover (from)” any cybersecurity event.

d. Comply with the Privacy Act requirements and with the Federal Information Security Modernization Act (FISMA) and with the OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and with the Family Educational Rights and Privacy Act (FERPA) and with the

Per Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII) is “information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother’s maiden name, biometric records, etc.

Sensitive PII is PII that if released improperly could result in harm, embarrassment, inconvenience, or unfairness to the individual whose name or identity is linked to the information.

Context shall be accounted for in order to determine whether PII is sensitive. Some

PII is always sensitive, and some is only sensitive when it is used in a particular context. For example, a list of people subscribing to a government newsletter is generally not sensitive PII; a list of people receiving treatment for substance abuse would always be considered sensitive PII.

The list below is not exhaustive. Context shall be accounted for in order to determine whether PII is sensitive. The following types of information are always considered sensitive:

• Social Security Numbers (including using just the last 4 digits of the SSN)

• Date of birth

• Mother’s maiden name

• Biometric identifiers (e.g., fingerprint, iris scan, voice print)

• Personal financial information, credit card and purchase card account numbers

• Citizenship and immigration status

• Criminal history

• Computer access passwords and security questions

• Medical records

2.2 Safeguarding Controlled Unclassified Information (CUI)

CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The contractor shall comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) and DFC Controlled Unclassified Information Program when handling CUI. 32 CFR 2002.4(aa) as implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. Marked appropriately;

b. Disclosed to authorized personnel on a “Need-To-Know” basis;

c. Protected in accordance with the current, finalized version of NIST SP

800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. Returned to DFC control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

2.3 Safeguarding Sensitive Information

For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The contractor shall protect all government information that is or may be sensitive in accordance with FISMA by securing it with a FIPS 140-2 or newer version, validated solution.

2.4 Confidentiality, Integrity, Availability, and Nondisclosure of Information

Any information provided to the contractor by DFC or collected by the contractor on behalf of DFC shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract.

The Contractor assumes responsibility for protection of the confidentiality, integrity, and availability of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors at any level to whom any DFC records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with DFC policies and instructions. Unauthorized disclosure of information will be subject to the DFC sanction policies and/or governed by the following laws and regulations:

• 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

• 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

• 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act);

• 18 U.S.C. 1030 The Computer Fraud and Abuse Act (CFAA); and

• 44 U.S.C. 3301 Definition of Records.

2.5 Internet Protocol Version 6 (IPv6)

Any system hardware, software, firmware, or networked component (voice, video, or data) developed, procured, or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding, and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet protocol (IP) version 6 (IPv6) as set forth in Internet Engineering Task Force (IETF) Request for Comments (RFC) 2460 and associated IPv6-related IETF RFC standards.

In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products.

Specifically, any new IP product or system developed, acquired, or produced must:

1. Interoperate with both IPv6 and IPv4 systems and products; and

2. Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

2.6 Government Websites

All new and existing government websites shall be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

2.7 Public-Facing Websites

The contractor shall implement controls to ensure that all publicly accessible Agency websites and web services only provide service through a secure connection, (such as the

HTTPS).

In accordance with Binding Operational Directive (BOD)-18-01: Enhance E-Mail and Web Security, any web services provided for or on behalf of DFC shall ensure all publicly accessible Federal websites and web services provide service through a secure connection (HTTPS-only, with HSTS); SSLv2 and SSLv3 are disabled on web servers, and DES and RC4 ciphers are disabled on web servers; and shall provide a list to DFC to provide to DHS of agency second-level domains that can be HSTS preloaded, for which HTTPS will be enforced for all sub-domains.

If an official public-facing website will be developed, modified, or maintained, then, in accordance with OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure and OMB Memorandum M-17-06, Policies and Requirements for Public Websites, the contractor shall use only an approved DFC.gov domain.

In accordance with OMB-M-17-06, for requirements involving web applications, web servers, and web services, the contractor shall follow the policies, principles, standards, and guidelines on information security and privacy, in accordance with FISMA, and implement security and privacy requirements as set forth in OMB Circular A-130 and current, final version of NIST Special Publication 800-44, Guidelines on Securing Public Web Servers.

The public expects Federal Government websites to be secure and their interactions with those websites to be private. The contractor shall comply with requirements specified in OMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services that requires that all publicly accessible Federal websites and web services only provide service through a secure connection (HTTPS with HSTS).

The contractor use of third-party websites and applications shall comply with all relevant privacy protection requirements and a careful analysis of privacy implications as specified in OMB Memorandum M-10-23, Guidance for Agency Use of Third-Party Websites.

2.8 Encryption

The contractor shall:

a. Comply with Executive Order (EO) 14028, Improving the Nation’s Cybersecurity (May 12, 2021), Section 3(d)(iii) requirements for encrypting data at rest and data in transit as well as DFC Information Technology (IT) System and Communications Protection (SC) Standard to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, proprietary information, Controlled Unclassified Information, etc.) in motion (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 version or newer, validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process federally owned or federally managed information and ensure devices meet DFC and IAS-specific encryption standard requirements.

d. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

e. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2 or newer version. The contractor shall provide a written copy of the validation documentation to the COR when required by the OIT CIO or CISO.

f. Use the Key Management system on the DFC personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR, or to CISO, or to the CIRT Coordinator, or to the SOC, or to the Project Manager or Program Manager, upon request and at the conclusion of the contract.

2.9 Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)

The contractor shall assist the DFC Senior Agency Official for Privacy (SAOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

If the results of the PTA show that a full PIA is needed, the contractor shall assist the DFC SAOP or designee with completing a PIA for the system or information within the timeframe required by the OIT CIO or CISO after completion of the PTA and in accordance with DFC policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The contractor shall assist the SAOP or designee in reviewing the PIA at least annually throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

2.10 Training

a. Mandatory Training for All Contractor Staff - All contractor/employees assigned to work on this contract shall complete the applicable DFC Cybersecurity and Privacy Awareness training (provided upon contract award) before performing any work under this contract (this training is available to new contractors, even if they do not have a PIV card). Thereafter, the employees shall complete the DFC Cybersecurity and Privacy Awareness training at least annually, during the life of this contract. All provided training shall be compliant with DFC training policies.

b. Role-based Training - All contractor employees with significant security responsibilities (as determined by the program manager or generally, any individual who has any security responsibilities that are more than the security responsibilities that any end-user would have, e.g., an Information System Security Officer, an Information System Security Manager, or any individual working within the Information Assurance Services division of the Office of the Chief Information Officer) must complete role-based training annually in accordance with DFC policy.

c. Training Records - The contractor shall maintain training records for all its employees working under this contract in accordance with DFC policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter, or upon request.

2.11 Rules of Behavior

a. The contractor shall ensure that all employees performing on the contract comply with the applicable DFC Rules of Behavior and any specific rules provided by the OIT CIO or CISO.

b. All contractor employees performing on the contract shall read and adhere to the Rules of Behavior before accessing Agency data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual DFC Cybersecurity and Privacy Awareness training.

c. Employees, contractors, and anyone assigned to a contract shall sign Rules of Behavior (RoB). Signed copies of RoB shall be kept on file by the Contractor’s program manager.

2.12 Incident Response

• The contractor shall respond to all alerts/Indicators of Compromise (IOCs) provided by either the CIRT Coordinator, the SOC, the ISSM, the SO, the ISSO, the Project Manager, the Program Manager, the CO, the COR, the SAOP (or designee), or the CISO (or designee) within 24 hours, whether the response is positive or negative.

• The Federal Information Security Modernization Act of 2014 (FISMA) defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

• A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for any other-than-authorized purpose.

In the event of a suspected or confirmed incident or breach, the contractor shall:

a. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 or newer version, validated encryption.

b. NOT notify affected individuals unless so instructed by the contracting officer or designated representative. If instructed by the contracting officer or representative, the contractor shall send DFC and OIT CIO or CISO approved notifications to affected individuals within the timeframe established by the OIT CIO or CISO.

c. Report all suspected and confirmed information security and privacy incidents and breaches to the SOC, at SOC@dfc.gov, and to the COR, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, within no more than sixty

(60) minutes, and consistent with the applicable DFC policy and procedures, NIST standards and guidelines, as well as with US-CERT notification guidelines. The types of information required in an incident report shall include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised.

d. Cooperate and exchange any information, as determined by the agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

e. NOT include any sensitive information in the subject or body of any reporting e-mail; and

f. Encrypt sensitive information in attachments to email, media, etc.

g. Comply with OMB M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information,” and with the DFC incident response policies when handling PII breaches.

h. Provide full access and cooperate on all activities as determined by the United States Government, including DFC, any involved law enforcement or Department of Defense (DoD) agencies, such as The Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Central Intelligence Agency (CIA), the National Security Agency (NSA), the Defense Information Systems Agency (DISA), or the Office of Personnel Management (OPM) etc., to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

i. Implement scanning capabilities that assess for vulnerabilities using only Security Content Automation Protocol (SCAP) validated products

j. Perform penetration and regular vulnerability testing and scanning of systems, IT devices, and websites. Scanning shall be conducted with reports provided to the Agency. The contractor shall ensure authenticated Web Application and Data Base Application scans are conducted on a monthly basis (or as needed to be more frequent). In addition, authenticated Operating System (OS) scans are conducted at a minimum on a weekly basis.

Once the Information System is integrated with the CDM program, vulnerability information for all in-scope IT assets shall be updated at minimum every 72 hours.

k. Maintain the tools and capabilities to support asset discovery, to include passive network monitoring, active network monitoring, and automated network mapping

l. Maintain tools and capabilities to support behavior monitoring, to include NetFlow analysis and network traffic capture, which captures the Transmission Control Protocol/Internet Protocol (TCP/IP) stream, allowing for replay of activity to determine what happened during a breach or incident

m. Maintain tools and capabilities for intrusion prevention, to include host intrusion prevention systems (HIPS) and network intrusion prevention systems (NIPS)

n. Maintain a firewall system designed to prevent unauthorized access to or from any contractor systems and network

o. Maintain tool and capabilities to perform Security Incident/Event Management and Analysis, to include centralized logging, log correlation, and a Security Information and Event Management (SIEM) solution that provides centralized monitoring of security incidents; network behavior analytics to provide behavior-based detection to help protect against zero day attacks;

and a quarantine/sandbox environment that will isolate and analyze live traffic and/or suspected malware

p. Maintain tools and capabilities to perform vulnerability and risk management and analysis to include threat intelligence threat hunt capabilities, sharing platforms, risk management or trouble ticketing system, anti-malware and anti-phishing services

q. Maintain tools and capabilities to provide security situational awareness and visibility throughout the enterprise; this includes capabilities for full packet capture that collects detailed network information at the gateway and makes capture data available to analysts; endpoint incident response that enables searches all endpoints for Indicators of Compromise (IOCs) in a rapid fashion;

and encrypted traffic inspection

r. If working as a SOC contractor, will provide a Daily Morning Report, 7 days per week, that summarizes the noteworthy daily security activities. Examples include activities such as the daily count of security incidents detected (viruses, malware, etc.), email traffic analysis for spam and phishing attempts, vulnerability scan results and progress in closing open weaknesses from scan results. The contractor is encouraged to propose a world class daily security morning report format, with the most noteworthy performance measures, to include any graphic displays, and charts to enhance reporting

s. Provide and maintain automated means of discovering, monitoring, and protecting sensitive data to ensure protection of data in motion, at rest, and in use

t. Provide and maintain an automated means of preventing unauthorized users and computing devices from accessing contractor hosted environments, including access via remote access, wired and wireless technologies

u. Provide and maintain externally facing web application firewall capabilities providing inbound and outbound traffic filtering

v. Provide and maintain an Out of Band network device management solution

w. Administer, operate, maintain, configure and tune cybersecurity software and hardware

x. Provide full government visibility of continuous monitoring tool configurations and output on a real-time basis as well as historical data/logs

y. Maintain the capability to perform periodic penetration testing, and also support for external agency red team testing, penetration testing, cyber hygiene web site vulnerability scanning tests and vulnerability assessments that the Agency may need to conduct.

2.13 Contract Initiation and Expiration

The contractor shall comply with the following contract initiation and expiration requirements:

a. System Documentation. Contractors shall follow and adhere to current, final version of NIST SP 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the SDLC that require artifact review and approval.

b. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the contractor shall provide all required documentation, as specified by the OIT CIO or CISO, to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

c. Notification. The contractor shall notify the CO and/or COR and system ISSO within 5 calendar days (or as otherwise specified by the OIT CIO or CISO) when an employee stops working under this contract, or immediately upon an employee’s termination or vacancy if prior-to-departure notice is not possible.

d. Contractor Responsibilities Upon Physical Completion of the Contract The contractor shall return all government information and IT resources (i.e., government information in nongovernment-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the contractor shall provide a certification that all government information has been properly sanitized and purged from contractor-owned systems, including backup systems and media used during contract performance, in accordance with DFC and OIT CIO or CISO policies.

Further, the Contractor shall perform and document the actions identified in the Agency’s Contractor Employee Separation Checklist when an employee terminates work under this contract within 5 calendar days (or as otherwise specified by the OIT CIO or CISO) of the employee’s exit from the contract.

All documentation shall be made available to the CO and/or COR upon request.

2.14 Records Management and Retention

The contractor shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and DFC and policies and shall not dispose of any records unless authorized by DFC.

In the event that a contractor accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with DFC policies. Per OM: 6103, “Records and Information Management Program,” records include all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations or other activities of the United States Government or because of the informational value of data in them. (44 USC 3101, Definition of Records).

2.15 Government-Furnished Equipment

The contractor shall:

• Implement capabilities to ensure that GFE endpoints are covered by an intrusion prevention system, and by an antivirus (AV) solution using file reputation services, checking files against cloud-hosted, continuously updated malware information

• Implement capabilities to ensure that GFE endpoints are covered by an anti-exploitation tool

• Implement capabilities to ensure that GFE endpoints are protected by a browser-based or enterprise-based tool to block known phishing websites and IP addresses. Per DHS BOD 17-01, “Removal of Kaspersky- Branded Products,” all Kaspersky-Branded products shall be fully removed, and discontinued

2.16 Non-Public Facing Websites

The contractor shall:

• Implement capabilities for all inbound network traffic to pass through a web content filter, which provides anti-phishing, anti-malware, and blocking of malicious websites (e.g., fake software updates, fake antivirus offers, and phishing offers).

• In accordance with OMB Memorandums M-17-06, and M-15-13, and M08- 23, M-10-23, and with DHS BOD-1801, and with the NIST SP 800-52 and with the NIST SP 800-44, all Federal websites and web services shall be accessible through a secure connection (HTTPS only, with HSTS), and e-mail applications shall have SMTP enabled. The use of HTTPS is encouraged on intranets, but not explicitly required.

• In accordance with BOD18-01: In accordance with OMB Memorandum M- 08-23, in order to ensure Domain Name System Security (DNSSEC), all Agency websites must use an DFC.gov domain. All websites that disseminate and/or do business on the Agency’s behalf must adhere to this OMB Memorandum.

2.17 E-mail Security

The Contractor shall:

• Configure all internet-facing mail servers to offer STARTTLS, and all second-level agency domains to have valid SPF/DMARC records. Additionally, the contractor shall ensure Secure Sockets Layer (SSL) v2 and SSLv3 are disabled on mail servers, and 3DES and RC4 ciphers are disabled on mail servers.

• Ensure that the requirement is met to set a DMARC policy of “reject” for all second-level domains and mail-sending hosts.

• Enable SMTP for all e-mail applications, in accordance with OMB Memoranda M-17-06, M-15-13, M-0823, M-10-23; DHS BOD 18-01;

and NIST SP 800-52 and SP 800-44.

• Abide by Agency guidelines concerning auto-forwarding of Agency email to non- Agency accounts by not configuring Agency email accounts to auto-forward to non-DFC.gov email addresses as this is explicitly prohibited unless specifically authorized through the Agency Risk Acceptance process.

2.18 Agency IT Security Checkpoints

The Contractor shall:

a. Complete/update the appropriate level of Security Accreditation (SA) documentation per NIST Risk Management Framework guidance, security controls testing, interagency security agreements (ISAs), and risk assessments in support of government issuance of security assessment and authorization to operate (ATO) decisions.

b. Ensure that systems/products/applications have the ability to facilitate single- sign-on capabilities and required support for HSPD 12 Personal Identity Verification (PIV) enablement and integration.

c. Include the capability for network traffic that flows between externally hosted systems and networks, to/from Agency systems and networks, to be routed through one of the Agency’s Trusted Internet Connections (TIC) gateways as part of the solution configuration. Implement controls to ensuring all possible traffic, including mobile and cloud, goes through a TIC. Implement connections between Agency systems and networks with externally hosted systems that comply with the requirements of the Trusted Internet Connections (TIC) initiative.

d. Architect contractor hosting environments to use security isolation and network segmentation principles in order to ensure that the environments are properly protected against an unauthorized access and threat from adversaries who may strive to move laterally across internal Agency or contractor hosted systems and network segments.

e. Provide an automated capability and process to scan and assess all systems and assets, and associated logs for malicious indicators of compromise (IOCs) identified by the Agency regarding priority threat-actor Techniques, Tactics, and Procedures (TTPs); the contractor is required to have the capability to scan for indicators of compromise within 24 hours of receipt of the indicators provided by the U.S. International Development Finance Corporation from the Department of Homeland Security.

f. Implement and maintain capabilities and processes to support the timely detection of, reporting, and rapid response and recovery to cyber incidents in accordance with timelines and requirements specified in Federal guidance and Agency cybersecurity incident reporting policy guidance.

g. In support of cybersecurity performance measure reporting, the contractor shall implement and maintain an automated software asset management/inventory and hardware asset inventory capability (e.g.

scans/device discovery processes) at the enterprise-level.

h. Implement capabilities to rapidly deploy emergency security patches and implement specific security control enhancements as directed by the Department of Homeland Security to all Federal Agencies via mechanisms such as the DHS Cybersecurity Coordination, Assessment, and Response (C- CAR) action items, and DHS BODs.

i. Implement capabilities and processes to patch all critical vulnerabilities identified to the U.S. International Development Finance Corporation by DHS immediately or in accordance with DHS BOD 19-02.

j. Ensure robust physical and cybersecurity protections are in place for all of the Agency’s high value assets (HVAs). The identification of HVAs by the Agency will be an ongoing activity due to the dynamic nature of cybersecurity risks.

k. Implement remote access solutions that only use phishing resistant multi- factor authentication solutions and that prohibit the use of split tunneling and/or dual-connected remote hosts where the connecting device has two active connections.

l. Implement remote access solutions that scan for malware before allowing full connections and that time out in accordance with Agency Standard and require re-authentication to re-establish a session.

m. Implement capabilities for all incoming email traffic to pass through anti-phishing and anti-spam filtration at the outermost border mail agent or server.

n. Implement capabilities for all incoming email traffic to be analyzed using sender authentication protocols (e.g., DKIM, DMARC, VBR, SPF, iprev, etc.).

o. Implement capabilities that ensure that incoming email traffic is analyzed using a reputation filter (to perform threat assessment of sender).

p. Implement capabilities that ensure that incoming email traffic is analyzed for detection of clickable URLs, embedded content, and attachments; and incoming email traffic is first analyzed for suspicious or potentially nefarious attachments and opened in a sandboxed environment or detonation chamber.

q. Implement capabilities for all outbound communications traffic to be checked at the external boundaries to detect encrypted exfiltration of information (i.e. capability to decrypt/interrogate and re-encrypt).

r. Implement effective network segmentation design and security solutions to limit potential threats from adversaries attempting lateral movement across systems on the Agency’s (or contractor’s networks), and also to better protect and securely isolate the Agency’s HVAs.

s. Implement and maintain Information Security Continuous Monitoring (ISCM) and Continuous Diagnostics and Mitigation (CDM) capabilities for all IT assets to be subject to an automated inventory, configuration, and vulnerability management capability, with real time reporting.

t. Implement and maintain strong authentication capabilities requiring the technical enforcement of all users being required to use a PIV card to authenticate to the network, (with exceptions for a very limited set of users specifically approved by the Agency).

u. Develop and maintain (or update existing) System Security Plans (SSP) and security controls assessment (SCA) test plans for the network general support system (GSS), and infrastructure systems.

v. Provide support to creating the security assessment and authorization (or accreditation) (A&A) packages and documentation in accordance with the Risk Management Framework guidance and processes specified by NIST and Agency guidance.

w. Implement security configurations on all IT assets and systems using DISA STIGs and other industry recognized best practices or guidance.

x. Perform security configuration management to include configuring all Windows based systems with the latest United States Government Configuration Baseline (USGCB) security settings available from the NIST website.

y. Support annual or emergent security audits and security scans that may be performed by the Office of Inspector General (OIG), the General Accountability Office (GAO), or the Department of Homeland Security

(DHS).

z. Provide availability and accessibility to the Agency, to the OIG, and to any third-party vendors designated by the Agency to: 1) Review audit findings;

2) Determine if corrective actions were properly implemented and the associated audit findings were properly closed; 3) Support cybersecurity incident analysis and forensics activities.

aa. Produce scheduled Monthly/Quarterly/Annual security performance measure reports that align to the Agency’s cybersecurity performance measure reporting requirements specified by OMB for FISMA, the President’s cybersecurity Cross Agency Priority (CAP) goals and targets, and CyberScope reporting. Security performance measure reports shall use the format and template specified in the Annual CIO FISMA metrics specified by OMB and

DHS.

bb. Provide for the encryption for PII, CUI, Data at Rest and data in transit.

Encryption solutions applied shall be FIPS 140-2 or newer version, validated.

cc. Document and track contractor personnel cyber training based on roles Develop, maintain, and publish a listing of Contractor-provided security controls, hybrid security controls, contractor common controls, and “customer”-provided security controls, in support of systems security assessments and authorizations, and the issuance of ATO decisions by the Agency.

dd. Provide security audit support (e.g., A-123), including scheduled and event driven audits.

ee. Capture and provide forensic disk images to support security incident analysis, malware analysis, or other investigative requirements (such as specific requests from the OIG or law enforcement).

ff. Provide support for threat monitoring and analysis, incident response, vulnerability management, risk management, continuous monitoring and reporting and other traditional security operations center activities.

gg. Provide and maintain multi-factor authentication solutions utilizing the Personal Identity Verification (PIV) card (or a Agency- approved Level of Authentication -4 (or equivalent AAL or FAL or IAL) solution, or Level of Authentication -3 (or equivalent AAL or FAL or IAL) solution, such as currently utilized soft tokens); and utilize FIPS 140-2 or newer version, approved encryption for all remote access requirements.

hh. Provide robust encryption capabilities to include services such as digitally signed and encrypted email, and default encryption for sensitive information held by the Agency. Solutions should be available to enable encryption of as much data at rest and data in transit as possible.

ii. Identify, perform, track, and report vulnerability and security weakness remediation and mitigation activities through the Agency’s Plan of Action and Milestones process (POA&M) in accordance with Agency information security policy.

jj. Establish, maintain, and execute standard configuration management processes for all cybersecurity software and hardware.

kk. Implement and maintain a Privileged Account Management Solution to improve the identity and access management of user accounts, while also meeting Agency targets to tightly control and limit the number of users with elevated privileges.

ll. Implement and maintain tightened processes for managing privileged user accounts, to include implementation of capabilities to limit functions that can be performed when using privileged accounts; limit the duration that privileged users can be logged in; limit the privileged functions that can be performed using remote access; prohibit Internet access when privileged users are performing systems administrations tasks; and ensure that privileged user activities are logged and regularly reviewed.

mm. Document and maintain system security boundaries, system configuration details, and network diagrams, in support of security assessment and ATO processes.

nn. Develop and implement processes for revising system security documentation on a scheduled and event-driven basis.

oo. Provide support for maintaining system security documentation in support of FISMA reporting requirements and security compliance status in the Agency’s Cyber Security Assessment and Management (CSAM) system.

pp. Develop and submit system security documentation, risk assessments, security controls testing reports, and any required privacy impact analysis (PIA) to the Agency in support of the Risk Management Framework processes and ATO decisions for IT environment components.

qq. Develop corrective/remediation POA&Ms and strategies to address security audit and assessment findings, and other reports of system security weaknesses or non-compliance.

rr. Develop and maintain a system security architecture; the contractor’s solution shall include effective network segmentation design and solutions to limit lateral movement across systems on the Agency’s networks, and also better protect the Agency’s HVAs.

ss. Utilize PIV or other approved Level of Assurance 4, as defined in NIST SP 800- 63-3 Electronic Authentication Guidelines, compliant Identity and Access Control mechanisms for network/domain administrative enterprise access.

tt. Maintain near real-time security monitoring and intrusion detection capabilities to enable the contractor and the Agency to know the security risk posture of the network at any given time.

uu. Configure all Windows based systems with the latest United States Government Configuration Baseline (USGCB) security settings available from the NIST website.

vv. Utilize multi-factor authentication, including integration and compliance with HSPD-12 PIV requirements, for all remote access solutions for the Agency’s sensitive information systems.

ww. Provide a multi-tier disaster recovery capability that provides the infrastructure and process to meet the recovery requirements of all of its HVAs, and applications (Mission-Critical, Decision Support, Other).

xx. Provide IT Disaster Recovery Planning and Management capabilities and support.

yy. Define business risk and risk assessment to Develop disaster recovery strategies to Develop disaster recovery plans to Develop IT system contingency plans to Conduct disaster recovery exercises, training and awareness.

zz. Provide Disaster Recovery Operational Services, including contractor support to the Agency in the planning, preparation, implementation, and documentation of a Disaster Recovery Program that includes the capabilities described below:

i. The contractor shall comply with the U.S. International Development Finance Corporation’s IT security policy requirements, and other applicable procedures and guidance. The contractor shall develop and implement management, operational and technical security controls to assure required levels of protection for information systems. The contractor shall further comply with all applicable Federal IT security requirements including, but not limited to, the FISMA of 2014, OMB Circular A-130, Homeland Security Presidential Directives, including HSPD-12, PIV Enablement and Integration, and single sign-on, the most recent NIST special publications, standards and guidance, and the Federal Risk and Authorization Management Program (FedRAMP) requirements and guidance.

ii. These security requirements include, but are not limited to, the successful Security Assessment and Authorization (A&A) of the system (includes commercially owned and operated systems managed by the commercial vendor and its sub-contractors, and commercial systems that are connected to commercial or other systems that…