Attachment 1 Performance Work Statement_Final.pdf

Performance Work Statement (PWS)

HUD Enterprise Talent Management System

1 General Information

1.1 Introduction

1.2 Background

1.3 Constraints

1.3.2 Project Planning and Management

1.4 Description of Services

1.5 Non-Personal Services

1.6 Period of Performance

1.7 Place of Performance

1.8 Hours of Operation

1.9 Special Qualifications

1.10 Post Award/Kickoff Conference

1.11 Status Meetings

1.12 Contractor Travel

1.13 Transition In

1.14 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Material

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

4.7 Quality Control

4.7.1 Quality Control Plan

5 Specific Tasks

5.1 Project Management

5.2 System Implementation

5.3 Documentation Support

5.4 Operational Support Services

5.5 Training Support

5.6 Development, Modernization, and Enhancements (DME) (OPTIONAL)

5.7 Transition-In

5.8 Transition-Out

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Performance Requirements Summary

8 Related Documents

Vision Statement

To obtain a talent management system that will assist in strategically managing HUD’s workforce and help continuously develop their skills and capabilities.

1 General Information

1.1 Introduction

The U. S. Department of Housing and Urban Development (HUD), Office of the Chief Information Officer (OCIO) in support of the Office of the Chief Human Capital Officer (OCHCO) requires a Contractor to provide Information technology (IT) Support Services to replace its existing Enterprise Talent Management System. Services shall include: (1) hosting the software; (2) providing enterprise/integrated software; (3) providing project management support; (4) providing system administration; (5) providing data conversion support; (6) providing change management support with a focus on marketing/communication; (7) providing sustainable training with sufficient job aides, interactive/innovative training approach that creates a self-sufficient environment; (8) delivering quality customer service and Tier II/Tier III help desk support; (9) providing implementation strategies for solution deployment that would limit disruption of day-to-day processing; and (10) providing a solution with bi-directional Application Programming Interface (API) compatibility to support a bi-directional interface with the Treasury's HR Connect system for personnel transactions, performance, award and an OPM Enterprise Human Resource Integration for transmittal of training data.

1.2 Background

OCHCO is responsible for developing and implementing policies and procedures associated with human capital management and the administrative management of the Department. The Chief Human Capital Officer advises the Secretary and senior management on administrative management and human resource matters.

Currently, HUD utilizes a federal Software as a Service (SaaS) from the U.S. Department of

Treasury. InCompass is a unified talent management system owned by Cornerstone on

Demand (CSOD) that supports automated cross-program collaboration for Human Resource

(HR) programs. HUD maintains the inCompass unified talent management software application through a Software as a Service (SaaS) licensing subscription with the U.S. Department of

Treasury. The current product suite consists of 4 modules: Performance Management, Learning

Management, Compensation Management, and Workforce and Succession Management.

HUD’s objective is to provide employees access to a single, robust, enterprise integrated suite of software modules to support the following functions: (1) Performance Management, (2)

Compensation Management,(3) Learning Management, (4) Workforce and Succession

Management, (5) Senior Executive Services/ Senior Level/Scientific or Professional OPM

Appraisal Process, (6) SF-182 Integration, (7) OPM Enterprise Human Resource Integration

(EHRI), and (8) Human Capital Dashboard Reporting at the enterprise level. The Current HUD infrastructure environment utilizes the Microsoft Azure Cloud services. HUD also provides access to Microsoft Office 365 subscription services to its community of approximately 8,000 users. HUD information technology employs a hybrid cloud Azure framework that supports a public and private cloud computing platform, which includes Infrastructure as a Service (IaaS) and Platform as a Service (PaaS). The environment enables the interface to be established with commercial SaaS/PaaS through interoperability with Open Source Application Programming

Interface (API) and Software Development Kits (SDK).

The current IT HUD Infrastructure diagrams can be viewed below:

Figure 1

Figure 2

Figure 3

1.3 Constraints

The services identified in this Performance Work Statement (PWS) will adhere to the rules, regulations, laws, standards, and conventions identified by HUD. Constraints include the following:

Document

Number

Title Released Mandatory

/Advisory

44 USC §3541 et seq.

Federal Information Security Management Act

(FISMA, supersedes the Computer Security Act of 1987)

2002 M

44 USC §3601 et seq.

E-Government Act of 2002 2002 M

Pub. L. 101-576, 31 USC §501 et seq.

Chief Financial Officers Act of 1990 http://www.fda.gov/oc/reform/cfoagmra2/cfoagm ra.htm

1990 M

Pub. L. 93-344, 2

USC §661

Federal Credit Reform Act of 1990 http://www.fms.treas.gov/ussgl/creditreform/fcrat oc.html

1990 M

Pub. L. 97-255, 31 USC §3512

Federal Managers’ Financial Integrity Act

(FMFIA)

http://www.whitehouse.gov/omb/financial/fmfia1

982.html

1982 M

Pub. L. 103-62, 31 USC 1101

Government Performance and Results Act

(GPRA)

http://www.whitehouse.gov/omb/mgmt-gpra/gplaw2m.html

1993 M

Pub. L. 103-356, 31 USC 3301

Federal Financial Management Act of 1994 http://www.whitehouse.gov/omb/financial/fm_sys tems.html

1994 M https://www.gpo.gov/fdsys/search/pagedetails.action?collectionCode=USCODE&browsePath=Title+44%2FChapter+35%2FSubchapter+III%2FSec.+3541&granuleId=USCODE-2003-title44-chap35-subchapIII-sec3541&packageId=USCODE-2003-title44&collapse=true&fromBrowse=true https://www.gpo.gov/fdsys/search/pagedetails.action?collectionCode=USCODE&browsePath=Title+44%2FChapter+35%2FSubchapter+III%2FSec.+3541&granuleId=USCODE-2003-title44-chap35-subchapIII-sec3541&packageId=USCODE-2003-title44&collapse=true&fromBrowse=true https://www.gpo.gov/fdsys/search/pagedetails.action?collectionCode=USCODE&browsePath=Title+44%2FChapter+35%2FSubchapter+III%2FSec.+3541&granuleId=USCODE-2003-title44-chap35-subchapIII-sec3541&packageId=USCODE-2003-title44&collapse=true&fromBrowse=true https://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf http://www.fda.gov/oc/reform/cfoagmra2/cfoagmra.htm http://www.fda.gov/oc/reform/cfoagmra2/cfoagmra.htm http://www.fms.treas.gov/ussgl/creditreform/fcratoc.html http://www.fms.treas.gov/ussgl/creditreform/fcratoc.html http://www.whitehouse.gov/omb/financial/fmfia1982.html http://www.whitehouse.gov/omb/financial/fmfia1982.html http://www.whitehouse.gov/omb/mgmt-gpra/gplaw2m.html http://www.whitehouse.gov/omb/mgmt-gpra/gplaw2m.html http://www.whitehouse.gov/omb/financial/fm_systems.html http://www.whitehouse.gov/omb/financial/fm_systems.html

Title Released Mandatory

/Advisory

Pub. L. 104-208, 31 USC 3512

Federal Financial Management Improvement

Act of 1996 http://www.whitehouse.gov/omb/financial/fm_sys tems.html

1996 M

Pub. L. 104-106, 40 USC §1401 et seq.

Information Technology Management Reform

Act of 1996 (Clinger-Cohen Act)

1996 M

31 USC § 9101 et seq.

Government Corporation Control Act 1948 M

Pub. L. 101-235, 12 USC 1709(f-

16)

HUD Reform Act, amending the National

Housing Act

1989 M

Pub. L. 105-277, 44 USC §3504

Government Paperwork Elimination Act http://www.whitehouse.gov/omb/fedreg/gpea2.ht ml

1998 M

Pub. L. 105-220, 29 USC 701 et seq.

Section 508 of the Rehabilitation Act of 1998 1998 M

Pub. L. 97-365, 31 USC §3301et seq

Debt Collection Act of 1982 1982 M

Pub. L. 104-134, 31 USC §3701 et seq.

Debt Collection Improvement Act of 1996 1996 M

Pub. L. 97-177, 31 USC §3901 et seq.

Prompt Payment Act 1982 M

Pub. L. 107-300, 31 USC §3321

Improper Payments Information Act of 2002 2002 M http://www.whitehouse.gov/omb/financial/fm_systems.html http://www.whitehouse.gov/omb/financial/fm_systems.html https://www.gpo.gov/fdsys/pkg/USCODE-1998-title40/pdf/USCODE-1998-title40-chap25-sec1401.pdf https://www.gpo.gov/fdsys/pkg/USCODE-1998-title40/pdf/USCODE-1998-title40-chap25-sec1401.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2011-title31/pdf/USCODE-2011-title31-subtitleVI-chap91-sec9101.pdf https://www.gpo.gov/fdsys/pkg/CFR-2017-title24-vol1/xml/CFR-2017-title24-vol1-part4.xml https://www.gpo.gov/fdsys/pkg/CFR-2017-title24-vol1/xml/CFR-2017-title24-vol1-part4.xml http://www.whitehouse.gov/omb/fedreg/gpea2.html http://www.whitehouse.gov/omb/fedreg/gpea2.html https://www.section508.gov/manage/laws-and-policies https://www.gpo.gov/fdsys/pkg/STATUTE-96/pdf/STATUTE-96-Pg1749.pdf https://www.gpo.gov/fdsys/granule/CFR-2011-title31-vol2/CFR-2011-title31-vol2-part285/content-detail.html https://www.gpo.gov/fdsys/granule/USCODE-2011-title31/USCODE-2011-title31-subtitleIII-chap39-sec3901 https://www.gpo.gov/fdsys/pkg/USCODE-2012-title31/pdf/USCODE-2012-title31-subtitleIII-chap33-subchapII-sec3321.pdf

Title Released Mandatory

/Advisory

OMB Circular A-

Preparation, Submission and Execution of the

Budget http://www.whitehouse.gov/omb/circulars/index.

html

Latest version

M

OMB Circular A-

11, Part 3

"Planning, Budgeting, and Acquisition of Capital

Assets" http://www.whitehouse.gov/omb/circulars/index.

html

Latest version

M

OMB Circular A-

Management Accountability and Control http://www.whitehouse.gov/omb/circulars/a127/a

127.html

Latest version

M

OMB Circular A-

OMB Circular A-125, Prompt Pay http://www.whitehouse.gov/omb/circulars/index.

html

Latest version

M

OMB Circular A-

Policies and Standards for Financial

Management Systems http://www.whitehouse.gov/omb/circulars/a127/a

127.html

Latest version

M

OMB Circular A-

"Security of Federal Automated Information

Resources" (Appendix III) http://www.whitehouse.gov/omb/circulars/index.

html

Latest version

M

OMB Circular A-

Management of Federal Information Resources http://www.whitehouse.gov/omb/circulars/index.

html

Latest version

M http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/index.html http://www.whitehouse.gov/omb/circulars/index.html http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/a127/a127.html

Title Released Mandatory

/Advisory

OMB Circular A-

"Security of Federal Automated Information

Resources" (Appendix III) (see also 34 FR

6428) http://www.whitehouse.gov/omb/circulars/index.

html

Latest version

M

OMB

Memorandum 99-

"Security of Federal Automated Information

Resources" http://www.whitehouse.gov/omb/memoranda/ind ex.html

1999 M

OMB

Memorandum 06-

“Safeguarding Personally identifiable

Information” http://www.whitehouse.gov/omb/memoranda/ind ex.html

2006 M

OMB

Memorandum 06-

“Protection of Sensitive Agency Information” http://www.whitehouse.gov/omb/memoranda/ind ex.html

2006 M

OMB

Memorandum 06-

“Reporting Incidents Involving PII” http://www.whitehouse.gov/omb/memoranda/ind ex.html

2006 M

OMB

Memorandum 06-

“Reporting Instructions for the Federal

Information Security Act and Agency Privacy

Management” http://www.whitehouse.gov/omb/memoranda/ind ex.html

2006 M

PDD-63 “Critical Infrastructure Protection,” Presidential

Decision Directive-63

1998 M

HSPD-12 “Policy for a Common Identification Standard for

Federal Employees and Contractors,” Home

Security Presidential Directive-12

2004 M http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/circulars/a127/a127.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html http://www.whitehouse.gov/omb/memoranda/index.html https://www.gpo.gov/fdsys/pkg/FR-1998-08-05/pdf/98-20865.pdf https://www.gpo.gov/fdsys/pkg/FR-1998-08-05/pdf/98-20865.pdf https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12

Title Released Mandatory

/Advisory

NIST Special

Publication 800-

"An Introduction to Computer Security: The

NIST Handbook"

June 2017 M

NIST Special

Publication 800-

"Generally Accepted Principles and Practices for

Securing Information Technology Systems"

Sep 1996 M

NIST Special

Publication 800-

"Guide for Developing Security Plans for

Federal Information Systems"

Dec 1998 A

NIST Special

Publication 800-

"Security Self-Assessment Guide for Information

Technology Systems"

Nov 2001 M

NIST Special

Publication 800-

26, Rev. 1

"Guide for Information System Assessments and Program Reporting "

Nov 2001 A

NIST Special

Publication 800-

"Risk Management Guide for Information

Technology Systems"

Sep 2012 M

NIST Special

Publication 800-

"Contingency Planning Guide for Federal

Information Technology Systems"

May 2010 M

NIST Special

Publication 800-

"Guide to Information Technology Security

Services"

Oct 2003 M

NIST Special

Publication 800-

"Guide for the Security Certification and

Accreditation of Federal Information Systems"

May 2004 M

NIST Special

Publication 800-

"Security Guide for Interconnecting Information

Technology Systems"

Aug 2002 A https://csrc.nist.gov/publications/detail/sp/800-12/archive/1995-10-02 https://csrc.nist.gov/publications/detail/sp/800-12/archive/1995-10-02 https://csrc.nist.gov/publications/detail/sp/800-14/archive/1996-09-03 https://csrc.nist.gov/publications/detail/sp/800-14/archive/1996-09-03 https://csrc.nist.gov/publications/detail/sp/800-18/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-18/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01 https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01 https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01 https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01 https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-35.pdf https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-35.pdf https://csrc.nist.gov/publications/detail/sp/800-37/archive/2004-05-20 https://csrc.nist.gov/publications/detail/sp/800-37/archive/2004-05-20 https://csrc.nist.gov/publications/detail/sp/800-47/final https://csrc.nist.gov/publications/detail/sp/800-47/final

Title Released Mandatory

/Advisory

NIST Special

Publication 800-

"Recommended Security Controls for Federal

Information Systems"

Feb 2005 A

NIST Special

Publication 800-

53, Rev. 4

"Recommended Security Controls for Federal

Information Systems"

Apr 2013 A

NIST Special

Publication 800-

"Security Metrics Guide for Information

Technology Systems"

Jul 2003 A

NIST Special

Publication 800-

"Guide for Mapping Types of Information and

Information Systems to Security Categories"

Jun 2004 A

NIST Special

Publication 800-

64 Rev 2

"Security Considerations in the Information

System Development Life Cycle"

Oct 2008 A

NIST Special

Publication 800-

"Integrating IT Security into the Capital Planning and Investment Control Process"

Jan 2005 A

NIST Draft

Special

Publication 800-

"Guide for Developing Performance Metrics for

Information Security"

May 2006 A

NIST Draft

Special

Publication 800-

82 Rev 2

"Guide to Industrial Control Systems (ICS)

Security"

May 2015 A

NIST Special

Publication 800-

"Guide to Test, Training and Exercise Programs for IT Plans and Capabilities"

Sep 2006 M

NIST Special

Publication 800-

"Information Security Handbook: A Guide for

Managers”

Oct 2006 A https://nvd.nist.gov/800-53 https://nvd.nist.gov/800-53 https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final https://csrc.nist.gov/publications/detail/sp/800-55/archive/2003-08-01 https://csrc.nist.gov/publications/detail/sp/800-55/archive/2003-08-01 https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-65/archive/2005-01-01 https://csrc.nist.gov/publications/detail/sp/800-65/archive/2005-01-01 file:///C:/Users/H49058/AppData/Local/Microsoft/Windows/INetCache/AppData/Local/Microsoft/Windows/INetCache/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/V6L05APL/NIST%20Draft%20Special%20Publication%20800-80 file:///C:/Users/H49058/AppData/Local/Microsoft/Windows/INetCache/AppData/Local/Microsoft/Windows/INetCache/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/V6L05APL/NIST%20Draft%20Special%20Publication%20800-80 https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-84/final https://csrc.nist.gov/publications/detail/sp/800-84/final https://csrc.nist.gov/publications/detail/sp/800-100/final https://csrc.nist.gov/publications/detail/sp/800-100/final

Title Released Mandatory

/Advisory

US SGL United States Standard General Ledger http://www.fms.treas.gov

Fed-GAAP Federal-based GAAP Compliant Summary

Transactions www.fasab.gov/concepts.htm

M

SF-224 Statement of Transactions Report www.fms.treas.gov

General

Accounting

Office, GAO-02-

HUD MANAGEMENT: Progress Made on

Management Reforms, but Challenges Remain

October

A

GAO/AIMD-00-33 "Information Security Risk Assessment

Practices of Leading Organizations"

Nov 1999 A

FedRAMP

Security

Assessment

Framework, Version 2.4 https://www.fedramp.gov/documents/ Jun 2017 M

HUD Handbook

2400.25, Rev. 4.1

(or latest revision)

Information Technology Security Policy Nov 2018 M

HUD Handbook

1325.01, REV-01

Privacy Act Handbook

Sept 1995 M

HUD Enterprise

Architecture

HUD Enterprise Architecture Policy www.hud.gov/offices/cio/ea/index.cfm

Current version

M

HUD Project

Planning and

Management

(PPM)

Project Planning and Management (PPM)

Framework https://www.hud.gov/program_offices/cio/ppm

Current version

M http://www.fms.treas.gov/ http://www.fasab.gov/concepts.htm http://www.fms.treas.gov/ https://www.gao.gov/products/GAO-02-45 https://www.gao.gov/products/GAO-02-45 https://www.gao.gov/products/AIMD-00-33 https://www.gao.gov/products/AIMD-00-33 https://www.fedramp.gov/documents/ https://www.hud.gov/sites/dfiles/OCHCO/documents/240025CIOH.pdf http://portal.hud.gov/hudportal/HUD?src=/program_offices/administration/hudclips/handbooks/admh/1325.1 http://www.hud.gov/offices/cio/ea/index.cfm https://www.hud.gov/program_offices/cio/ppm https://www.hud.gov/program_offices/cio/ppm

Title Released Mandatory

/Advisory

HUD Project

Planning and

Management

(PPM)

‘Project Leader Help Guide’ http://hudatwork.hud.gov/po/i/it/sd/guide/guide.cf m

Current version

A

HUD Application

Release Tracking

System (HARTS)

HUD Application Release Tracking System http://hudatwork.hud.gov/HUD/cio/po/i/it/sd/devlif e/bld/testcenter/harts/harts_main_pg

Latest

Version M

HUD Enterprise

Test Center

HUD Enterprise Test Center Policy http://hudatwork.hud.gov/HUD/cio/po/i/it/sd/devlif e/bld/testcenter/tcpolicy_toc

Latest

Version

1.3.1 At a minimum, the new HUD ETMS must provide coverage of the following scope:

Performance Management, Learning Management, Compensation Management, Strategic

Workforce and Succession Management, and Human Capital Dashboard Reporting at the

Enterprise Level.

The Contractor must provide a FEDRAMP certified cloud-based hosting solution based on current and evolving industry standards and best practices over the course of the contract duration. The cloud-based hosting solution will provide the best value to the Government while at the same time allowing HUD the flexibility to meet current and future requirements.

The Vendor Hosted Cloud environment must be dedicated (non-shared with other agencies/clients) and allow for development, testing, staging and production. The proposed environments will consist of integrated environments designated as Development/Testing and

Production that support development, integration, acceptance testing, training, staging, troubleshooting and all pre-production, as well as production, activities. The Vendor Hosted

Cloud environment will contain all required security, service delivery and hosting capabilities necessary to effectively support the development, testing, quality assurance, and production needs.

The Software-as-a-Service (SaaS) must be designed and delivered as a Contractor-based solution that shall support the following objectives:

The Contractor must:

• Provide a trusted secure communication channel to support the Governments PIV Card authentication (dual factor method) of remote access in accordance with OMB M-11-11.

http://hudatwork.hud.gov/po/i/it/sd/guide/guide.cfm http://hudatwork.hud.gov/po/i/it/sd/guide/guide.cfm http://hudatwork.hud.gov/HUD/cio/po/i/it/sd/devlife/bld/testcenter/harts/harts_main_pg http://hudatwork.hud.gov/HUD/cio/po/i/it/sd/devlife/bld/testcenter/harts/harts_main_pg http://hudatwork.hud.gov/HUD/cio/po/i/it/sd/devlife/bld/testcenter/tcpolicy_toc http://hudatwork.hud.gov/HUD/cio/po/i/it/sd/devlife/bld/testcenter/tcpolicy_toc

• Provide network storage, server and virtualization layer management plan to include performance of internal technology and refresh cycles applicable to the environment.

• Provide and document patch management appropriate to all components within the providers boundary and to adhere to HUD OCIO standards.

• Provide automated monitoring of performance, resource utilization and other events such as failure of service, degraded service, availability of the network, storage, database systems, operating Systems, applications, including Application Program Interface (API) access within the providers boundary and Security Content Automation Protocol (SCAP) automation capabilities via a service dashboard or by other electronic methods.

• Comply with technology refresh requirements as required by HUD to ensure security requirements and Acceptable Quality Levels (AQLs) are met.

• Comply with the HUD requirements that software operating on the vendor’s computer system within the Providers Boundary will never be more than two versions behind.

1.3.1.1.2 FIPS 140-2 Validated Cryptography for Secure Communications

The Contractor must use only cryptographic mechanisms that comply with FIPS 140-2 level 4.

All deliverables shall be labeled "HUD Controlled Unclassified Information (HCUI). External transmission/dissemination of labeled deliverables to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2 (as amended), "Security requirements for Cryptographic Modules”:

http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf

1.3.1.1.3 Non-Repudiation

The Contractor must provide a system that implements HUD encryption standards that provides for origin authentication, data integrity, and signer non-repudiation.

1.3.1.1.4 Audit Record Retention

The Contractor must support a system in accordance with the requirement for Federal agencies to manage their electronic records in accordance with 36 CFR 1236.20 & 1236.22 (ref. a), including capabilities such as those identified in:

• NARA Bulletin 2008-05, July 31, 2008, Guidance concerning the use of e-mail archiving applications to store e-mail (ref. C),

• NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing Records in Cloud Computing Environments (ref 8).

These capabilities provide requirements for maintaining records to retain functionality and integrity throughout the records full lifecycle including:

• Maintenance of links between records and metadata, and http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf

• Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules

1.3.1.1.5 Identification and Authentication (Organizational Users) Multifactor

Authentication

The Contractor must support a secure, multi-factor method of remote authentication and authorization to identified Government Administrators that will allow Government designated personnel the ability to perform management duties on the system.

The Contractor must support HUD approved multi-factor authentication methods.

1.3.1.1.6 Identification and Authentication (Nonorganizational Users)

The Contractor must support a secure, multi-factor method of remote authentication and authorization to identified Vendor Administrators that will allow vendor designated personnel the ability to perform management duties on the system.

1.3.1.1.7 Incident Reporting Timeframes

The Contractor must report all computer security incidents to the United States Computer

Emergency Readiness Team (US-CERT) in accordance with US-CERT "Incident Categories and Reporting Timeframes in, Appendix J, Table J-1 of NIST SP 800-61 (as amended). Any incident that involves compromised Personally Identifiable Information (PII) must be reported to

US-CERT within 1 hour of detection regardless of the incident category reporting timeframe. For further information, NIST published SP800-86 Guide to Integrating Forensic Techniques into

Incident Response. SP800-86 defines in a much more precise and specific way the procedures, issues and technologies required to move an incident from the point of discovery all the way through to resolution.

1.3.1.1.8 Media Transport

The Contractor must document activities associated with the transport of Federal agency information stored on digital and non-digital media and employ cryptographic mechanisms to protect the confidentiality and integrity of this information during transport outside of controlled areas.

Digital media, containing Federal agency information, that is transported outside of controlled areas must be encrypted using FIPS 140-2 level 4; non-digital media including CD-ROM, floppy disks, etc., must be secured using the same policies and procedures as paper.

Media, containing Federal agency information that is transported outside of controlled areas must ensure accountability. This can be accomplished through appropriate actions such as logging and a documented chain of custody form.

Federal agency data that resides on mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards) must be encrypted using HUD Standard encryption regulations. All

Federal agency data residing on laptop computing devices must be protected with NIST-approved encryption software.

1.3.1.1.9 Personnel Screening

The Contractor must provide support personnel who are U.S. citizens maintaining a Moderate

Risk (Tier 2) investigation or greater, due to exposure to PII and sensitive HUD systems. The

Contractor must furnish documentation reflecting favorable adjudication of background investigations for all personnel supporting the new HUD ETMS. The Contractor must comply with the requirements outlined in HSPD-12, Policy for a Common Identification Standard for

Federal Employees and Contractors. HUD separates the risk levels for personnel working on

Federal computer systems into two categories: Moderate Risk and High Risk. In accordance with HUD directive on personnel screening, the cost of meeting all security requirements and maintaining assessment and authorization shall be the responsibility of the Contractor.

Those Contractor personnel determined to be in a Moderate Risk position will require the Tier 2 investigation (or higher).

Those Contractor personnel determined to be in a High-Risk position will require a Tier 4 investigation (or higher). Contractor personnel requiring a Moderate Risk investigation will not require an investigation, when there is a current (within 5-years) and favorably adjudicated investigation that meets or exceeds the Moderate Risk, Tier 2, investigation. Contractor personnel requiring a High-Risk investigation will not require an investigation, when there is a current (within 5-years) and favorably adjudicated investigation that meets or exceeds the High

Risk, Tier 4, investigation. If there is a break in service from a federal contract, it can be no longer than one-year, and the Personnel Security Division will need to approve it regardless of the break in service time. Once a favorable FBI Criminal History Check (Fingerprint Check) is returned and a current investigation meeting the scope is identified, applicants may receive a

HUD identity credential and initial access to HUD information systems (if required). HUD recognizes and follows HSPD-12 requirements and will issue and restrict credentials as necessary.

1.3.1.1.10 Boundary Protection (TIC)

The Contractor must ensure that Federal information, other than unrestricted information, being transmitted from Federal government entities to external entities, using cloud services, is inspected by Trusted Internet Connections (TIC) processes.

1.3.1.1.11 Security Alerts, Advisories and Directive

The Contractor must provide a list of their personnel, identified by name and role, with system administration, monitoring, and/or security responsibilities that are to receive security alerts, advisories, and directives.

1.3.1.1.12 Required FEDRAMP Policies and Regulations Compliance FEDRAMP

Information Technology Systems Security Requirements

On December 8, 2011, the Federal Chief Information Officer (CIO) signed a memorandum titled

"Security Authorization of Information Systems in Cloud Computing Environments for the protection of Federal information in cloud services under the Federal Risk and Authorization

Management Program (FedRAMP). Under the FedRAMP policy, agencies that are leveraging existing cloud-based -services or acquiring cloud-based services (other than private cloud-based services) must initiate an authorization and use the FedRAMP information security and privacy requirements (including security and privacy controls, and controls selected for continuous monitoring) for cloud services to support authorization decisions.

Agencies can leverage cloud services assessed and granted provisional authorization through the FedRAMP process to increase efficiency and ensuring security compliance. The following security requirements apply to the services provided in the new HUD ETMS contract.

The Federal agency will determine the security category for the cloud system in accordance with Federal Information Processing Standard 199; then, the Contractor shall apply the appropriate set of impact baseline controls as required in the FedRAMP Cloud Computing

Security Requirements Baseline document to ensure compliance to security standards. The

FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4, Recommended Security Controls for Federal Information Systems and Organizations (as amended) and includes a set of additional controls for use within systems providing cloud services to the federal government.

The Contractor shall maintain a security management continuous monitoring environment that meets or exceeds the requirements in the Reporting and Continuous Monitoring section based upon the latest edition of FedRAMP Cloud Computing Security Requirements Baseline and

FedRAMP Continuous Monitoring Requirements.

1.3.1.1.13 FedRAMP Privacy Requirements:

The Contractor shall be responsible for the following privacy and security safeguards:

• To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractors facilities, installations, technical capabilities, operations, documentation, records, and databases.

• If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

• The Contractor shall also comply with any additional FedRAMP privacy requirements.

• The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the Contractor's IT environment being used to provide or facilitate services for the Government. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, Contractor shall be responsible for the following privacy and security safeguards:

• The Contractor shall not publish or disclose in any manner, without the Contracting Officers written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of C&A verification.

• To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractors facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours. The program of inspection shall include:

▪ Authenticated and unauthenticated operating system/network vulnerability scans

▪ Authenticated and unauthenticated web application vulnerability scans

▪ Authenticated and unauthenticated database application vulnerability scans

▪ Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools

▪ If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

▪ If the Contractor chooses to run its own automated scans or audits, results from these scans may, at the Governments discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of Contractor-conducted scans shall be provided, in full, to the Government.

1.3.1.1.14 Sensitive Information Storage

Sensitive But Unclassified (SBU) information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The Contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, Guidelines for Media Sanitization.

The disposition of all data will be at the written direction of the COR/, this may include documents returned to Government control; destroyed; or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the

COR/.

1.3.1.1.15 Protection of Information

The Contractor must provide security mechanisms for handling data at rest and in transit in accordance with HUD encryption standards.

The Contractor must be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The Contractor shall also protect all

Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as SBU information.

It is anticipated that this information will be gathered, created, and stored within the primary work location. If Contractor personnel must remove any information from the primary work area, they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to:

1.3.1.1.16 Privacy Act Information

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on Contractors infrastructure, as well as maintains the right to request full copies of these at any time.

The data that is processed and stored by the various applications within the network infrastructure contains financial data as well as personally identifiable information (PII). This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The Contractor shall ensure that the facilities that house the network infrastructure are physically secure.

The data must be available to the Government upon request within one business day or within the timeframe specified otherwise and shall not be used for any other purpose other than that specified herein. The Contractor shall provide requested data at no additional cost to the government.

No data shall be released by the Contractor without the consent of the Government in writing.

All requests for release must be submitted in writing to the COR.

1.3.1.1.17 Misuse of Government Data and Metadata

The Contractor must not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order issued hereunder. If authorized by the terms of this contract issued hereunder, any access to, or use or disclosure of, Government data shall only be for purposes specified in this contract. Contractor shall ensure that each of its employees and representatives, and any others (e.g., subcontractor employees) performing duties hereunder, shall, prior to obtaining access to any Government data, sign a contract specific nondisclosure agreement/rules of behavior.

The Contractor must use Government-related data only to manage the operational environment that supports the government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting Officer.

1.3.1.1.18 Confidentiality and Nondisclosure

The preliminary and final deliverables and all associated working papers and other material deemed relevant by the agency that have been generated by the Contractor in the performance of this contract, are the property of the U.S. Government and must be submitted to the COR at the conclusion of the contract. The U.S. Government has unlimited data rights to all deliverables and associated working papers and materials in accordance with FAR 52.227-14, Rights in Data

General.

All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor. All appropriate project documentation will be given to the agency during and at the end of this contract. The Contractor shall not release any information without the written consent of the Contracting Officer.

Personnel working on any of the described tasks may, at Government request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents. The Contractor shall have employees with access to government data and other government sensitive information to sign a non-disclosure/rules of behavior agreement that legally prevents the disclosing of non-public government information.

1.3.1.1.19 Security Requirements

1.3.1.1.19.1 FedRAMP Security Requirements Overview

The minimum requirements for moderate impact cloud systems are contained within the

FedRAMP Cloud Computing Security Requirements Baseline. The Contractor and Federal

Government Agency share responsibility to ensure compliance with security requirements. The implementation of a new Federal Government cloud system requires a formal process, known as Assessment and Authorization, which provides guidelines for performing the assessment.

FedRAMP requires cloud service providers to utilize a Third-Party Assessment Organization

(3PAO) to perform an assessment of the cloud service providers security controls to determine the extent to which security controls are implemented correctly, operate as intended, and produce the desired outcome with respect to meeting security requirements.

The FedRAMP PMO security staff will be available for consultation during the process. Both the

FedRAMP PMO staff and Joint Authorization Board (JAB) will review the results before issuing a Provisional Authorization decision. The Government reserves the right to verify the infrastructure and security test results before issuing an Authorization decision.

Federal agencies will be able to leverage the provisional Authorization granted by FedRAMP and any documentation prepared by the Contractor to issue their own authority to operate.

The Contractor must to review the FedRAMP guidance documents (see References below) to determine the level of effort that will be necessary to complete the requirements. All FedRAMP documents and templates are available at http://FedRAMP.gov.

1.3.1.1.19.2 FedRAMP Security Compliance Requirements

The Contractor must implement the controls contained within the FedRAMP Cloud Computing

Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for low and moderate impact system (as defined in FIPS 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems. While the FedRAMP baseline controls are based on NIST

Special Publication 800-53, Revision 4.

The Contractor must substantially, and in good faith follow FedRAMP guidelines and Security guidance. In situations where there are no procedural guides, the Contractor shall use generally accepted industry best practices for HUD IT security.

1.3.1.1.19.3 Required FedRAMP Policies and Regulations: OMB Memo: Security

Authorization of Information Systems in Cloud Computing Environments

Assessment and Authorization: HUD may choose to cancel the Enterprise Talent Management

System contract and terminate any outstanding orders if the Contractor has its provisional authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

1.3.1.1.19.4 Assessment of the System

The Contractor must comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the Assessment and Authorization

(A&A) is based on the Systems NIST Federal Information Processing Standard (FIPS)

Publication 199 categorization. The Contractor shall create, maintain and update the following documentation using FedRAMP requirements and templates, which are available at http://FedRAMP.gov:

• Privacy Impact Assessment (PIA)

• FedRAMP Test Procedures and Results

• Security Assessment Report (SAR)

• System Security Plan (SSP)

• IT System Contingency Plan (CP)

• IT System Contingency Plan (CP) Test Results

• Plan of Action and Milestones (POA&M)

• Continuous Monitoring Plan (CMP)

• FedRAMP Control Tailoring Workbook

• Control Implementation Summary Table

• Results of Penetration Testing

• Software Code Review

• Interconnection Agreements/Service Level Agreements/Memorandum of Agreements

Information systems must be assessed by an accredited 3PAO whenever there is a significant change to the systems security posture in accordance with the FedRAMP Continuous

Monitoring Plan.

The Government reserves the right to perform Penetration Testing. If the Government exercises this right, the Contractor shall allow Government employees (or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with FedRAMP requirements. Review activities include scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and Intrusion

Detection System (IDS)/Intrusion Prevention System (IPS); databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

Identify gaps between required FedRAMP Security Control Baselines and Continuous

Monitoring controls and the Contractor's implementation as documented in the Security

Assessment Report shall be tracked by the Contractor for mitigation in a Plan of Action and

Milestones (POA&M) document. Depending on the severity of the gaps, the Government may require them to be remediated before a provisional authorization is issued.

The Contractor is responsible for mitigating all security risks found during A&A and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 30 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

1.3.1.1.19.5 Authorization of System

The Contractor must provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an

Information Technology security program. The Government reserves the right to conduct onsite inspections. The Contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

1.3.1.1.19.6 Reporting and Continuous Monitoring

Maintenance of the FedRAMP Provisional Authorization will be through continuous monitoring and periodic audit of the operational controls within a Contractors system, environment, and processes to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to the

FedRAMP PMO as required by FedRAMP Requirements. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. The deliverables will allow the FedRAMP JAB to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur. Contractors will be required to provide updated deliverables and automated data feeds as defined in the FedRAMP Continuous Monitoring

Plan.

1.3.1.1.19.7 Additional Stipulations

The FedRAMP deliverables shall be labeled "HUD CONTROLLED UNCLASSIFIED

INFORMATION (HCUI) or Contractor selected designation per document sensitivity. External transmission/dissemination of For Official Use Only (FOUO) and HCUI to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with

FIPS PUB 140-2, "Security requirements for Cryptographic Modules.

Federal Desktop Core Configuration & US Government Configuration Baseline: The Contractor shall certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC) and US Government Configuration Baseline

(USGCB). The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved FDCC/USGCB configuration. Offerings that require installation should follow OMB memorandum 07-18.

Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The Contractor shall use Security Content

Automation Protocol (SCAP) validated tools with FDCC/USGCB Scanner capability to certify their products operate correctly with FDCC/USGCB configurations and do not alter

FDCC/USGCB settings.

As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104, if the system involves the design, development, or operation of a system of records on individuals, the Contractor shall implement requirements in FAR clause 52.224-1, "Privacy Act Notification and FAR clause

52.224-2, "Privacy Act.

The Contractor must cooperate in good faith in defining non-disclosure agreements that other third parties must sign when acting as the Federal government’s agent.

1.3.1.1.20 Salient Characteristics for the new HUD Enterprise Talent Management

System (ETMS)

The system must have the capabilities to support the following salient characteristics. The new

HUD ETMS must provide:

1. Support to Single Sign-on

2. Proven multiplatform accessibility from at least 4 different devices i.e. smart phone, tablets, desktops.

3. Verification of having had successful implementation of an integrated performance management and learning management module that is currently operational in two or more federal…