Amendment_001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACTED CODE PAGE OF PAGES

1 2

1. AMtNUMtN [/MOUIHCAIION NO.

3. EFFECTIVE DATE

08/08/2013

4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. flfapplicble)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than Item 6) CODE

USDA Forest Service WO AQM IT Support Branch

PAN AMERICAN BLDG SUITE 200

101 B SUN AVE NE

ALBUQUERQUE NM 87109

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

CODE FACILITY CODE

(X) ]9A. AMENDMENT OF SOLICIATION NO.

AG-7604-S-13-0033

9B. DATED ITEM1ISEEI7

06/24/2013

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICI ATIONS

1*1 The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers 1*1 is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a)By completing items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED ATTHE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPIRATION DATA (Irrequired)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE

n n

A. THIS CHANGE ORDER IS ISSUED PURSUANTTO: (Specify authority} THE CHANGES SET FORTH IN ITEM

NO. INITEM10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES appropriation date, etc. ) SET FORTH IN ITEM 1 4, PURSUANT TO THE AUTHORITY OF FAR 43.1 03(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

1 4 ARE MADE IN THE CONTRACT ORDER

(such as changes in paying office.

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION ( Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to make the following changes to the RFP:

1. The date for receipt of proposals has been extended. The new date for receipt of proposals is September 6, 2013, 3:00 pm Mountain Standard Time.

2. The due date for receipt of questions concerning the RFP has been extended. The new due date for receipt of questions is August 16, 2013, 3:00 PM, Mountain Standard Time.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or IDA, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

1 5B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED

1 6A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

Liza S. Herrera

^(Soptfra c t jflicL^Of-̂ . c e r

~^^^/ £A^ (Signature ofT Tntractmg Officer)

16C DATE SIGNED

08/08/2013

NSN 7540-01-152-8070

Previous edition unusable

STANDARD FORM 30 (REV i o 83) Prescribed by GSA FAR (48 CFR) 53.243

CONTINUATION SHEET

REFERENCE NO OF DOCUMENT BEING CONTINUED

AG-7604-S-13-0033

'AGE

OF

NAME OF OFFEROR OR CONTRACTOR

ITEM NO.

(A)

SUPPLIES/SERVICES

(B)

QUANTITY

(C)

UNIT PRICE

(E)

AMOUNT

(F)

3. The vendor demos scheduled for August 20 to 22, 2013 in Washington DC have been canceled indefinitely. Once the new dates have been identified, an amendment will be forthcoming.

4. The questions/responses received during the pre-proposal conference are included with this amendment and are identified as Attachment 1 Questions & Answers, dated August 7, 2013.

i;. In the RFP, page 44, sub paragraph (i), the government allocation of funds on specific dates in year 200X has been changed to read 201X.

6. In the RFP, page 18, paragraph 3.2.9 Electronic Offers. The paragraph has been changed to reference email rather than CD ROM.

7. RFP page 64 is revised as attached to include SOO attachments K and L (Amendment 001, Attachment 2)

8. SOO Attachment C requirement IPS-26 through IPS-27 references USDA Incident Management olicy. The USDA Incident Management policy has seen included with this amendment, and becomes Attachment K to the SOO (Amendment 001, Attachment 3)

9. SOO Attachment C requirement IPS-7 indicates adherence to USDA web standards. The USDA web standards has been included with this amendment, and becomes Attachment L to the SOO (Amendment 001, Attachment 4)

10. In the RFP, page 5, paragraph 16, the word "mailing your proposal" has been changed to read "emailing your proposal".

11. If you should have any questions pertaining to any of the changes initiated in this amendment or any other issues, contact the contracting officer.

NSN 75-10-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53110

AG-7604-S-13-0033

Solicitation Amendment 001

Attachment 1

Questions and Answers August 7, 2013

1. Question: “It has been our experience from working on responding to efforts of similar size and scope that the time frame for a response of this size and complexity typically has a 1 month time frame. This RFP solicitation was released on the Fed Biz Opps website on August 1st, with a submission date of August 16th, which is only about two weeks’ time and half the time frame given for a typical response of this nature. To that end we would respectfully ask if it is possible to extend the submission time frame by two more weeks” [sic]

Answer: The President, through the Presidential Initiative, Protecting Our Workers and Ensuring

Reemployment (POWER), has tasked the US Department of Agriculture with streamlining the collection and management of Safety & Health incidents and Workers’ Compensation data to standardize processes, improve case management capabilities, streamline data integration and achieve compliance with Department of Labor (DOL) policy, interface, and reporting requirements. The FS, as they had already been working towards this goal, was identified as the lead Agency to accomplish this goal. With this oversight, the goal is to execute a contract and start transition in the very near future. As this is considered a commercial acquisition, and the products and service are readily available in the commercial marketplace, it has been determined that the FS will receive adequate competition and still be able to execute based upon a shortened acquisition timeline, but in order to achieve greater completion, we are extending the closing date to 06 September, 2013. Please see the Amendment.

2. Question: Will the integrated OSOH/WC SaaS solution procured through this contract completely replace the existing SHIPS system provided by IHS Global?

Answer: Yes that is what is currently anticipated.

3. Question: Does FS require the SaaS solution provider to use a single COTS tool to address both the OSOH incident tracking and reporting, and WC case management needs? Or will FS accept two separate SaaS tools, one for OSOH incident tracking and reporting, and one for WC

Case Management?

Answer: We do not intend to dictate how you accomplish the requirements. Our expectation as expressed in the documentation is that we will have a mature tool that is fully-integrated between

OSOH and WC.

4. Question: The Forest Service 08-Nov-2012 RFI and Draft SOW referred to this requirement as SHIPSII. Is it significant that this RFP does not include any references to SHIPS II?

Answer: No, the fully integrated system will replace the current SHIPS system. This would be considered SHIPS II but it is not relevant that SHIPS II is not referenced in the solicitation.

5. Question: RFI WOAQMITRFI005 Q&A #5 posted on 15-Nov-2013 on FedBizOpps stated…“Currently, "RightNow" and "Remedy" platforms are used.”

a. Question: Do FS staff use RightNow and Remedy licenses to access both OSOH incident tracking and reporting, and WC case management?

Answer: No, we are not using either one of those products

b. Question: Does SHIPS currently require the use of any other COTS software licenses?

Answer: No, we are not using either one of those products

6. Question: The Government limits each reference in the Past Performance Information

Document to 1 page; however, the requirements themselves are 1 page long. Would the

Government consider extending the limit to 2 pages per reference?

Answer: One page is sufficient to provide the requested information.

7. Question: Please explain where in Volume II to place a description of our software solution.

Answer: This is at the offerors’ discretion.

8. Question: Are hard copy volumes required with submission or is it satisfactory to submit the entire proposal via email with attachments?

Answer: No hard copy volumes are required.

9. Question: If our employees have already signed NDAs with other USDA sub-agencies, will that meet the NDA requirement for this contract?

Answer: NDAs are specific to each acquisition and must be the NDA provided with this RFP.

10. Question: Under Section 1, “Supplies or Services and Prices,” the Government lists a range of users starting with 45,000 – 65,000. What is the estimated ratio/number of users processing claims/incidents compared to public users who will be electronically filing claims and checking on statuses?

Answer:

FS has 30 Full Time Equivalent (FTE) for WC Case Managers that would need full time access to the system. FS has up to 200 Safety Managers who would need access to the system but on a casual basis (e.g., to run reports, perform research, approximately 1-2 hours per day)

FS employees are roughly 45,000 FTE, casual/non-employee users may reach up to

100,000 users.

We have limited knowledge of the other USDA Agencies power user base; however we would assume they would have the same ratio to employees as FS.

11. Question: How many concurrent users are expected to need access from a user community of 45,000 – 65,000 named users?

Answer: See answer to question 10

12. Question: How many concurrent users are expected to need access from a potential user community of 65,000 – 85,000 named users?

13. Question: How many concurrent users are expected to need access from a potential user community of 85,000 – 105,000 named users?

14. Question: How many concurrent users are expected to need

15. Question: How many concurrent users are expected to need access from a potential user community of 105,000 – 125,000 named users?

16. Question: What type of hosting is required? At the offeror’s site or at USDA?

Answer: The solution will be assumed to be hosted by the USDA FS third party vendor at the third party vendor location in St. Louis MO and Omaha, NE.

17. Question: With regards to SaaS pricing, is the Government only entertaining Software as a

Service, or is the Government open to purchasing the software licenses?

Answer: We are only interested in Software as a Service.

18. Question: Will there be any small business subcontracting plans and reporting required of the contract awardee even if such contractor is a small disadvantaged business?

Answer: No additional specific goals are established for this requirement.

19. Question: Are there any other contractual terms and conditions to be included in a contract award not otherwise delineated in the RFP and PWS?

Answer: No other terms and conditions will be captured unless the proposed approach requires additions.

20. Question: Do you have a comprehensive document or system mapping that shows all the data/systems that you wish to be integrated into your selected solution. The type of system and frequency of refreshing of data (if not a one-time feed) would be very beneficial as well.

Answer: No we do not have this type of documentation. We have included all relevant information for the interfaces in the SOO Section 12, Attachment D and Attachment E.

21. Question: Can you please provide further information on type of access you require for each of your desired user types and quantity of each description you desire. (Number who just report new incidents vs. those who manage claims, etc.) This additional information will aid in development of the best possible pricing for USDA Forest Service’s userbase.

22. Question: The timeline from posting of the RFP to due date is approximately 2 weeks which is a rather aggressive timeline. Are there any factors contributing to this quick of a timeline?

Answer: See response to question one above.

23. Question: Regarding the reference letters from our clients. (Past Performance

Questionnaires – Att. 3) How many are required? They appear to be due 8/16/13. Would the

Department consider an extension of the timeline for our clients to submit these since the ability to get these in on time is out of each prospective vendor’s control?

Answer: We will evaluate all responses received that are recent and relevant and provide an assessment of the quality of effort provided.

24. Question: Page 18, 3.2.9 of the solicitation indicates that CD copies are required; however, page 14, item 2.2 indicates that responses can be submitted via email. Is just an email submission acceptable?

Answer: Good catch. CD rom will not be required to be mailed. Only e-mail files. Will issue an Amendment to the RFP. In addition, reference page 5, paragraph number 16 will be revised to delete “mailed”.

25. Question: Is a Section 508 VPAT required as part of a proposal response or at time of contract award? If required for the proposal, where should the VPAT be provided? And does it count against the stated page limits?

Answer: This is required as part of your proposed response. VPAT is a separate document and not included in the page count.

26. Question: The solicitation outlines bands of total potential users that could report injury, illness, and accidents via the portal. What are the total USDA case worker named users that would need access to the solution?

Answer: The bands are to reflect FTE as described in Attachment J, but this does not include casual, non-Employee, volunteer, etc. that may need to access the system to record Safety incidents. For additional information, refer to question 10.

27. Question: SOO Attachment C requirement IPS-24 indicates a SLA requirement of 99.9% uptime, however, requirement IPS-21 indicates 98%, what is the uptime requirement?

Answer: As stated in the requirements (e.g.,) means for example, the numbers provided are an example. However, we would like the vendors to propose their system uptime that they can meet.

28. Question: SOO Attachment C requirement IPS-8 and IPS-8.1 are both about Section 508 compliance. What does '(target center)' mean in IPS-8 requirement?

Answer: Target Center references the USDA Target Center that vendors will need to test the accessibility of the system. Target Center provides a certification of compliance.

29. Question: SOO Attachment C requirement IPS-7 indicates adherence to USDA web standards. Can FS provide vendors with a copy or link to these standards?

Answer: FS will issue an Amendment to include the USDA web standards.

30. Question: SOO Attachment C requirement IPS-26 through IPS-27 references USDA

Incident Management Policy. Can FS provide vendors with a copy or link to this policy?

Answer: FS will issue an Amendment to include the USDA Incident Management policy.

31. Question: Attachment 1 SOO page , Section 21 - Security Language for all

Contracts/Agreements states, "By accepting this contract/agreement, the contractor/cooperator and other external organizations (hereafter called contractor) providing IT services to the FS agrees to comply with the applicable IT security policy, as outlined in this document". Can FS provide vendors with a copy or link to this policy? We did not see an IT Security Policy outlined in this document other than Section 21.

Answer: See answer to question 30

32. Question: Is there a format for the text response besides the attachments that you would like us to use?

Answer: Please refer to paragraph 3.2.2. of the Instructions.

33. Question: Are the user licenses meant to be assigned by name, first and last, or would a site or group license with concurrent but anonymous access be an option?

Answer: Yes, our preference is for anonymous concurrent licensing.

34. Question: Can you provide (or direct me to) a list of locations/sites that would be the basis for user access and claims assignment?

Answer: FS has a workforce deployed on a global scale.

35. RFP_Attachment_1_FS_WC_OSOH_SOO. In page 5, "The means by which this claim is submitted and tracked is handled differently across the USDA Agencies. Some have limited tools to assist with this process; some use manual processes and other Agencies have outsourced"

a. Can you specify the entities the process is outsourced to?

b. Can you specify the tools used to assist with the process?

Answer: This was provided for informational purposes only. For the purpose of this proposal, this information is not relevant since the only data that would be migrated is incident data from the Safety and Health system.

36. RFP_Attachment_1_FS_WC_OSOH_SOO. In page 5, "This system would be used for reporting, tracking, invoicing and recordkeeping from the point of incident to the closure of any claim associated with the incident."

a. Are you referring to an internal invoice created within the Forest Service?

Answer: This refers to internal processes only.

37. RFP_Attachment_1_FS_WC_OSOH_SOO. In page 6, "A seamless transition from existing systems/processes to the contractor’s system"

a. Question: Can you specify the existing systems and technologies used within the

Forest Service to manage the WC claims that will be replaced by the new system?

Answer: There is no existing technology or system to manage WC claims

b. Question: Can you specify the existing processes used within the Forest Service that will be managed by the new system?

Answer: Please refer to Attachment B of the SOO.

38. RFP_Attachment_1_FS_WC_OSOH_SOO. In page 7, " the Department’s EDI with the

DOL"

a. Question: Is the EDI currently working in a production environment with the DOL?

Answer: No, it was developed and tested with the DOL, however not in a production environment.

39. RFP_Attachment_1_FS_WC_OSOH_SOO. In page 9, " Coordinate with the FS and current contractor to define transition activities"

a. Question: Is the current contractor GDCII ? IHS Global, Inc.?

Answer: The current contractor for SSO and hosting is GDCII and for SHIPS is IHS.

40. RFP_AG-7604-S-13-0033. In page 16, " The Offeror shall deliver their quote (one Softcopy sent via e-mail) " and in page 18 " 3.2.9 Electronic Offers: The Offeror shall submit all volumes in electronic format, using a virus free CD-ROM. "

a. Question: Can you specify which documents need to be emailed and which need to be submitted via CD-ROM?

Answer: All documents should be e-mailed to the Contracting Officer. An Amendment will be issued to remove reference to CD ROM and “mailed”.

41. RFP_AG-7604-S-13-0033. In page 18, " VOLUME I - PAST PERFORMANCE"

a. Do we need to send one past performance questionnaire and 3 summaries or do we need to send a questionnaire for each one of the clients identified in the past performance summaries.

Answer: The offeror does not provide past performance questionnaire’s as part of their proposal, only the past performance summary per RFP Instructions Table 3.1 and paragraphs 4.2.1.3.1. and

4.2.1.3.2.

42. Question: Would the FS consider a 2 week extension of the RFP response due date?

Answer: See response to question one above.

43. Question: Given the critical nature of including all the materials necessary for a compliant response – can USDA provide a checklist of all required response items?

Answer: No checklist will be provided.

44. Question: Is it an expectation that the prospective vendor’s pricing would include the ability for other USDA agencies to utilize the system or is the expectation that that additional pricing for these agencies would be contemplated at a later date as they determine their interest?

Answer: The CLIN pricing structure for Operations and Maintenance includes four pay bands based on number of users. As Agencies come on board and additional users are added, payment will be made under the appropriate pay band for number of users during that month.

45. Question: Due to the nature, size, scope and complexity of this RFP response will the

USDA entertain responses that do not meet 100% of the template requirements? For example:

Past Performance evaluations – Vendor cannot commit that these evaluations will be completed by our clients in a timely manner (vacation schedules, unavailability) are posing risk for completion in the time provided.

Answer: The FS will evaluate what information is received at time of closing to assess the offerors’ probability of performance.

46. Question: Do you suggest moving forward with a response if certain factors of the RFP are not answered 100%? Will this eliminate the vendor from making it to the demonstration stage of the project and ultimately being considered for the work?

Answer: If proposal is found to be non-responsive to all areas of the RFP, offeror may not be invited to provide a demonstration.

47. Question: Did we hear you correctly, did you say that the application and Oracle/SQL

Server database must be installed on site at USDA or on USDA’s private cloud? Meaning that totally external public facing SaaS offerings will not be accepted. Or will you accept proposals of both types of solutions?

Answer: We will accept proposals of both types; however the preference is that it be hosted with our third party vendor.

48. Question: Must we have our full team in place at this time?

Answer: Not clear what “time” is being referred to.

49. Question: Is there any reason why we are not considering MBE

Answer: Not sure what “MBE” you are referring to.

50. Question: What is secure maintenance of data - Page 5

Answer: See Response to question 30.

51. Question:

a. Is data housed with you or somewhere else?

Answer: Current data with our Safety and Health system is housed with our third party vendor. The expectation is that the new solution is hosted with our third party vendor and all data rights belong to the government.

b. Question: Where do you want it to migrate?

Answer: It is assumed that the hosted solution will be at our third party vendor.

c. Question: Do you want it in our data plan?

Answer: Yes

d. Question: DBA?

Answer: It is assumed that the vendor would require the services of a DBA to accomplish the data migration, at the very least.

52. Question: Will we turn software over to you or maintain cloud service?

Answer: Assuming the solution is hosted by the FS third party vendor, in general software would need to be pushed by the hosting engineers.

53. Question: Section 5.1 Incedent #'s - Will they generate through some external system?

Answer: It is assumed that it will be generated from the solution selected.

54. Question: We need some lead into user community. Can we contact the user community before contract is awarded?

Answer: All communications with USDA employees must be accomplished through the

Contracting Officer until an award is made.

55. Question: When must the Contacting Officer receive our "Responses to Past Performance

Questionnaires"? Before or after we submit our RFP's?

Answer: Responses to past performance questions are required at closing of the RFP, 06

September 2013.

56. Question: Will Forest Service release a list of attendees at the Pre-proposal conference?

Answer: No list of participants will be published.

57. Question: Is your intent to eliminate all paper processing? If so, is the data to resemble your current forms and documents?

Answer: Where feasible it is our intent to reduce dependency on paper processing. The data in the solution should be capable of producing the required forms.

58. We believe there to be advantages to the system solution being hosted by the Vendor. Can you please outline:

a) Question: your expectations on available options for hosting of the solution

Answer: See answer to question 47

b) Question: specifically whether USDA is willing to consider a vendor (proposer) hosted solution

Answer: See answer to question 47

59. Question: RFP. Page 44, sub paragraph (i) refers to government allocation of funds on specific dates in year 200X. Can we assume that applies to years 201X?

Answer: You are correct. This was a typo and will be corrected in the forthcoming amendment.

60. Question: The RFP references ORCA, however, the System for Award Management (SAM) states “The System for Award Management (SAM) is the Official U.S. Government system that consolidated the capabilities of CCR/FedReg, ORCA, and EPLS.” Therefore, is registration in

SAM sufficient?

Answer: Registration in SAM is sufficient if you have completed all of your reps and certs within SAM.

61. Question: Will USDA/FS incur all costs associated with GDC hosting the solution?

Answer: Yes

62. Question: Will FS/GDC provide a list of the NIST-800-53 Revision 4 Security Controls that are required to be met by the vendor’s software application for the Certification & Accreditation process?

Answer: For solution hosted by the third party vendor your responsibility would only extend to ensure the security standards are met per the software.

63. Question: Is GDC Integration, Inc. (GDCI) eligible to be a prime or subcontractor on this bid?

Answer: There are no known restrictions upon GDCI participating unless they are prevented due to an OCI IAW FAR Part 9.5.

64. Question: Is the incumbent IHS Global eligible to be a prime or subcontractor on this bid?

Answer: There are no known restrictions upon GDCI participating unless they are prevented due to an OCI IAW FAR Part 9.5.

65. Question: USDA has requested a Firm Fixed Price bid by CLIN. Attachment 6 requires burdened and unburdened rate detail for labor. Generally, this information is not required for

FFP bids. Did the Government intend for bidders to provide this for all labor CLINs or only for the “cost plus” CLIN?

Answer: Since your proposal will be in response to a SOO, and each offeror will propose a unique approach, the government will evaluate your proposed cost based upon your approach, and not in comparison with any other offerors approach. Therefor it is appropriate to request and evaluate this information.

Solicitation No. AG-7604-S-13- 0033

Amendment 001

Attachment 2

LIST OF ATTACHMENTS Pages

Statement of Objectives (SOO), Dated March 7, 2013 28

For Providing Software as a Service (SaaS) for

Reporting Incidents of Work Related Accidents, Injuries, Illnesses and Safety Stories and for

Performing Workers’ Compensation (WC) Case Management

And Attachments A through L

Attachment 2

Quality Assurance Surveillance Plan (QASP) 3

Attachment 3

Past Performance Questionnaire 4

Attachment 4

Authorization Letters for Past Performance Questionnaire 3

Attachment 5

Section 508 Government Product Accessibility Template (GPAT) 38

Attachment 6

Pricing Tables for Transition and Operations & Maintenance 5

Solicitation Amendment 1 Attachment 3 SOO Attachment K

6680-6682

FOREST SERVICE MANUAL

NATIONAL HEADQUARTERS (WO)

WASHINGTON, DC

FSM 6600 - SYSTEMS MANAGEMENT

CHAPTER 6680 - SECURITY OF INFORMATION, INFORMATION SYSTEMS,

AND INFORMATION TECHNOLOGY

Amendment No.: 6600-2010-2

Effective Date: May 11, 2010

Duration: This amendment is effective until superseded or removed.

Approved: THELMA J. STRONG Acting Associate Deputy Chief, OPS

Date Approved: 05/04/2010

Posting Instructions: Amendments are numbered consecutively by title and calendar year.

Post by document; remove the entire document and replace it with this amendment. Retain this transmittal as the first page(s) of this document. The last amendment to this title was

6600-2010-1 to FSM 6683-6684.

New Document

6680-6682 86 Pages

Superseded Document(s) by

Issuance Number and

Effective Date

6680-6682

(Amendment 6600-2008-1, 09/17/2008)

81 Pages

Digest:

6680.15 - Removes “Department Personnel Bulletin 735-1, Employee Responsibilities and

Conduct” and adds “USDA Incident Notification Plan”.

6680.15b - Adds reference to Departmental Regulation 4070-735-001, Employee

Responsibilities and Conduct.

6680.5 - Adds definitions for Anonymized Information, Audit Reduction, Collaborative

Computing, Computer, Cryptography, De-identified Information, Harm, Linkable Information, Linked Information, Management Security Controls, Media, Mobile Code, Obscured

WO AMENDMENT 6600-2010-2

EFFECTIVE DATE: 05/11/2010

DURATION: This amendment is effective until superseded or removed.

Information, Operational Security Controls, Personally Identifiable (PII) Information

Confidentiality Impact Level, Technical Security Controls.

DURATION: This amendment is effective until superseded or removed.

Digest:

6680.61a - Adds publication NIST SP 800-27 Revision A, NIST SP 800-58, NIST SP 800-95, and NIST SP 800-122 to Exhibit 01.

6682.02 - Revises the Objective statement.

6682.04 - 6682.04r - Adds requirements for protecting the confidentiality of personally identifiable information (PII) to the responsibilities for Chief Information Officer in paragraph

26, Agency Information Systems Security Program Manager (ISSPM) in paragraph 29, Privacy

Officer in paragraph 1, Information System Security Officer (ISSO) in paragraph 7, System

Owners in paragraph 4, Information System or Application Program Managers and Application

Developers in paragraph 1, Information Owners in paragraph 4, and Users in paragraph 4. Adds requirements for approving or denying requests for exceptions to FS policy to responsibilities for

ISSPM, ISSO, and System Owners.

6682.3 - Adds new policy statement and paragraph 1 that addresses PII issues.

6682.4 - Removes paragraph 2 under paragraph 3(1)(a) and direction on security.

6682.42 - Adds paragraph a. under paragraph 3 and direction on PII.

6682.47 - Removes code and direction and recodes caption and direction to 6682.51.

6682.51 - Establishes code and recodes to this section caption and direction previously found in

6682.47.

6682.8 - Establishes code, caption and sets forth new direction “Planning Security Related

Activity”.

6682.9 - Establishes code, caption and sets forth new direction “Protecting the Confidentiality of

Personally Identifiable Information (PII)”.

DURATION: This amendment is effective until superseded or removed.

Table of Contents

6680.1 - Authority

6680.11 - Laws

6680.12 - Executive Orders

6680.13 - Regulations

6680.14 - Government-wide Directives and Standards

6680.15 - U.S. Department of Agriculture Directives 6680.15a - Departmental Manuals

6680.15b - Departmental Regulations

6680.2 - Objectives

6680.3 - Policy

6680.4 - Responsibility [Reserved]

6680.5 - Definitions

6680.51 - Abbreviations and Acronyms

6680.6 - References

6680.61 - National Institute of Standards and Technology (NIST) Publications 6680.61a - National Institute of Standards and Technology (NIST) Special Publications... 41

6680.61b - National Institute of Standards and Technology (NIST) Federal Information

Processing Standards (FIPS) Publications

6681 - SECURITY PROGRAM MANAGEMENT [RESERVED]

6682 - SECURITY MANAGEMENT CONTROLS

6682.02 - Objective

6682.04 - Responsibility 6682.04a - Chief Information Officer

6682.04b - Line Officers 6682.04c - Agency Information System Security Program Manager (ISSPM)

6682.04d - Change Management Board Secretariat 6682.04e - Privacy Officer 6682.04f - Information System Security Officer (ISSO) 6682.04g - Accrediting Authority 6682.04h - Accrediting Authority’s Designated Representative

6682.04i - Certifying Official 6682.04j - System Owners

6682.04k - Information System or Application Program Managers and Application

Developers 6682.04l - Information Technology (IT) System Administrators 6682.04m - Acquisition Management Personnel 6682.04n - Information Owners

6682.04o - Law Enforcement and Investigations 6682.04p - Investment Manager 6682.04q - Contracting Officer

DURATION: This amendment is effective until superseded or removed.

6682.04r - Users

6682.07 - Team, Committee, and Group Roles

6682.07a - Certification Team 6682.07b - Security Test and Evaluation Team 6682.07c - Change Management Board 6682.07d - Risk Assessment Team

6682.1 - Risk Assessment and Update

6682.2 - Security Controls Review [Reserved]

6682.3 - System Development Life Cycle Security Planning (SDLC)

6682.4 - Certification, Accreditation, and Security Assessments Policies and Procedures

6682.41 - Security Assessments

6682.42 - Information System Interconnections

6682.43 - Security Certification

6682.44 - Plan of Action and Milestones

6682.45 - Security Accreditation

6682.46 - Continuous Monitoring

6682.5 - System Security Plan and Update

6682.51 - Privacy Impact Assessment

6682.6 - Configuration Management

6682.61 - Baseline Configuration

6682.62 - Configuration Change Control

6682.63 - Monitoring Configuration Changes

6682.64 - Access Restrictions for Change

6682.65 - Configuration Settings

6682.66 - Least Functionality

6682.67 - Information System Component Inventory

6682.7 - Information System Documentation

6682.8 - Planning Security Related Activity

6682.9 - Protecting the Confidentiality of Personally Identifiable Information (PII)

DURATION: This amendment is effective until superseded or removed.

6680.1 - Authority

6680.11 - Laws

Title 5, United States Code, section 301 (5 U.S.C. 301), provides that the head of an executive department or military department may prescribe regulations for the use of its property.

Title 18, United States Code, section 1030 (18 U.S.C. 1030), prohibits unauthorized access to and use of Government computer systems.

Federal Managers’ Financial Integrity Act of 1982 (Pub. L. 97-255; 96 Stat. 814), requires that the Office of Management and Budget (OMB) evaluate agencies' accounting and administrative control systems and that agencies self-evaluate those systems.

Chief Financial Officers (CFO) Act of 1990 (Pub. L. 101-576; 31 U.S.C. 501; 104 Stat.

2838), requires that Forest Service Chief Financial Officers comply with applicable accounting principles, standards, and requirements and with internal control standards; to provide complete, reliable, consistent, and timely information.

The Paperwork Reduction Act of 1995 (44 U.S.C. 3501), mandates promoting the use of information technology to improve the productivity, efficiency, and effectiveness of

Forest Service programs, and requires development and implementation of policies, principles, standards, and guidelines for information technology functions and activities.

Federal Information Security Management Act (FISMA) of 2002 (Pub. L. 107-347, Title

3; 44 U.S.C. 3541-3549), sets minimum information security requirements, requires agencies to implement information security protections commensurate with the magnitude of harm that could result from a security incident, and requires sufficient training for all personnel.

Clinger-Cohen Act, formerly known as the Information Technology Management Reform

Act (ITMRA) of 1996 (41 U.S.C. 251), repeals the Brooks Act (40 U.S.C. 759) and abolishes the Federal Information Resources Management Regulation (FIRMR).

Rehabilitation Act of 1973 (21 U.S.C. 812), prohibits discrimination against people with disabilities, applies to programs conducted by Federal agencies; those receiving Federal funds, such as colleges participating in Federal student loan programs; Federal employment; and employment practices of businesses with Federal contracts. The standards for determining employment discrimination under the Rehabilitation Act are the same as those used in Title I of the Americans with Disabilities Act.

http://www.access.gpo.gov/uscode/uscmain.html http://www.access.gpo.gov/uscode/uscmain.html http://www.whitehouse.gov/omb/financial/fmfia1982.html http://www.gao.gov/special.pubs/af12194.pdf http://www.archives.gov/federal-register/laws/paperwork-reduction/ http://csrc.nist.gov/policies/FISMA-final.pdf

DURATION: This amendment is effective until superseded or removed.

Title 7, Code of Federal Regulations, section 2.60 (a)(27) (7 CFR 2.60 (a)(27)), sets out the delegation to the Forest Service to administer radio spectrum management for U.S.

Department of Agriculture (USDA).

Computer Security Act of 1987 (15 U.S.C. 271), provides for IT security in Federal agencies and establishes the framework for Federal agencies to improve the security of their computer systems.

Children’s Online Privacy Protection Act (COPPA) of 1998 (15 U.S.C. 6501-6506), applies to the online collection of personal information by persons or entities under U.S.

jurisdiction from children under 13 years of age. It details what a web site operator shall include, in a privacy policy, when and how to seek verifiable consent from a parent or guardian, and what responsibilities an operator has to protect for children's privacy and safety online, including restrictions on marketing to children under 13 years of age. The

Federal Trade Commission (FTC) has the authority to issue regulations and enforce

COPPA.

Privacy Act of 1974 (5 U.S.C. 552), states in part, “No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains....”

6680.12 - Executive Orders

Executive Order 10450, Security Requirements For Government Employment, issued

April 27, 1953, specifies particular criteria and responsibilities for investigating the background and character of individuals employed or seeking employment in the Federal government to ensure that the interests of national security are met.

Executive Order 12968, Access to Classified Information, issued August 2, 1995, establishes a uniform Federal personnel security program for employees who will be considered for initial or continued access to classified information.

Executive Order 13011, Federal Information Technology (IT), issued July 16, 1996, requires that agencies significantly improve the management of their information systems, including the acquisition of IT, by implementing the provisions of the

Paperwork Reduction Act of 1995 (Pub. L.104-13; 44 U.S.C. 3501), the Information

Technology Management Reform Act of 1996 (Pub. L. 104-106; 41 U.S.C. 251), and the

Government Performance and Results Act of 1993 (Pub.L.103-62; 107 Stat. 285).

http://www.archives.gov/federal-register/codification/executive-order/10450.html http://www.opm.gov/extra/investigate/eo12968.asp

DURATION: This amendment is effective until superseded or removed.

6680.13 - Regulations

Title 5, Code of Federal Regulations, Part 731, Office of Personnel Management -

Suitability. Requires that every competitive service position have a risk determination and requires some specific procedural strategies, such as background investigations.

Title 5, Code of Federal Regulations, Part 732, Office of Personnel Management -

National Security Positions. Defines sensitivity level designations and investigative requirements for positions determined to be sensitive to national security.

Title 5, Code of Federal Regulations, Part 736, Personnel Investigations. Describes investigation process for Federal employees.

Title 5, Code of Federal Regulations, Part 930, subpart C (5 CFR part 930, subpart C), Information Security Responsibilities for Employees Who Manage or Use Federal

Information Systems. Requires initial, continued and refresher security training for

Forest Service employees responsible for the management or use of computer systems that process sensitive information.

Title 5, Code of Federal Regulations, Part 2635, Standards of Ethical Conduct for

Employees of the Executive Branch, section 2635.702. Prohibits use of public office for private gain.

6680.14 - Government-wide Directives and Standards

General Accounting Office, Federal Information Systems Controls Audit Manual.

Describes the control activities, control techniques, and audit procedures for evaluating the separation of duties principles used in Federal agencies.

Office of Management and Budget Circular A-123, Management Accountability and

Control. Provides guidance to Federal managers on improving the accountability and effectiveness of Federal programs and operations by establishing, assessing, correcting, and reporting on management controls.

Office of Management and Budget Circular A-130, Security of Federal Automated

Information Resources. Establishes minimum controls to be included in Federal automated information security programs and assigns responsibilities for the security of automated information.

http://www.access.gpo.gov/nara/cfr/waisidx_99/5cfrv2_99.html http://www.access.gpo.gov/nara/cfr/waisidx_99/5cfrv2_99.html http://www.access.gpo.gov/nara/cfr/waisidx_99/5cfrv2_99.html http://www.access.gpo.gov/nara/cfr/waisidx_99/5cfrv2_99.html http://www.access.gpo.gov/nara/cfr/waisidx_99/5cfrv2_99.html http://www.access.gpo.gov/nara/cfr/waisidx_99/5cfrv2_99.html http://www.access.gpo.gov/nara/cfr/waisidx_99/5cfrv2_99.html http://www.access.gpo.gov/nara/cfr/waisidx_99/5cfrv2_99.html http://frwebgate.access.gpo.gov/cgi-bin/get-cfr.cgi?YEAR=current&TITLE=5&PART=2635&SECTION=702&SUBPART=&TYPE=TEXT http://frwebgate.access.gpo.gov/cgi-bin/get-cfr.cgi?YEAR=current&TITLE=5&PART=2635&SECTION=702&SUBPART=&TYPE=TEXT http://www.gao.gov/special.pubs/ai12.19.6.pdf http://www.whitehouse.gov/omb/circulars/a123/a123.html http://www.whitehouse.gov/omb/circulars/a123/a123.html http://www.whitehouse.gov/omb/circulars/a130/a130.html http://www.whitehouse.gov/omb/circulars/a130/a130.html

DURATION: This amendment is effective until superseded or removed.

Office of Management and Budget Memorandum 07-16, Safeguarding Against and

Responding to the Breach of Personally Identifiable Information. Establishes requirements to safeguard PII, to develop rules of conduct for handling PII, and to develop procedures for responding to and reporting PII breaches, and for external breach notification procedures.

Presidential Decision Directive 67, Enduring Constitutional Government and Continuity of Government. Requires Federal agencies to develop Continuity of Operations Plans for

Essential Operations.

Federal Information System Controls Audit Manual. Provides guidance to auditors in evaluating internal controls over the integrity, confidentiality, and availability of maintained data.

Homeland Security Presidential Directive 7, Critical Infrastructure Identification, Prioritization, and Protection. Establishes a national policy for Federal departments and agencies to identify and prioritize United States critical infrastructure, key resources, and to protect them from terrorist attacks.

Homeland Security Presidential Directive 12, Policy for a Common Identification

Standard for Federal Employees and Contractors. Requires the establishment of a mandatory, government-wide standard for secure and reliable forms of identification issued by the Federal government to its employees and contractors (including contractor employees).

6680.15 - U.S. Department of Agriculture Directives

Department Personnel Manual, Chapter 751, Discipline. Provides guidelines for disciplinary action.

USDA Interim Guidance Memo, CS-010, Peer-to-Peer Networking and Copyright

Protection. Defines conditions for the authorized use of the Internet and protection of

USDA information technology resources.

Departmental Notice 3300-012, Commercial Wireless Technologies in USDA -

Unclassified Security Requirements for Wireless Networks in Unlicensed Frequencies.

Provides direction for the secure use of wireless network technologies.

USDA Incident Notification Plan, September, 2007. Provides requirements and procedures for notification of officials, individuals, and the press when a breach of personally identifiable information has occurred.

http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf http://www.fas.org/irp/offdocs/pdd/pdd-67.htm http://www.fas.org/irp/offdocs/pdd/pdd-67.htm http://www.gao.gov/special.pubs/ai12.19.6.pdf http://csrc.nist.gov/policies/Directive-hspd-7.html http://csrc.nist.gov/policies/Presidential-Directive-Hspd-12.html http://www.usda.gov/da/employ/apsd/DPMcht7511w2.htm http://www.usda.gov/da/IRD/CS-010.htm http://www.usda.gov/da/IRD/CS-010.htm http://www.ocio.usda.gov/directives/doc/DN3300-012.htm http://www.ocio.usda.gov/directives/doc/DN3300-012.htm

DURATION: This amendment is effective until superseded or removed.

6680.15a - Departmental Manuals

Departmental Manual 3140-001, Management Automated Data Processing (ADP)

Security Manual. Requires all U. S. Department of Agriculture (USDA) agencies to use individual user identifications and passwords to control access to any computing systems that process personal, financial, market–related, or other sensitive data.

Departmental Manual 3300-001, Telecommunications & Internet Services and Use.

Provides authority for information resource management and provides guidelines for electronic mail and Internet use.

Departmental Manual 3505-000, USDA Computer Incident Response Procedures

Manual. Identifies different types of computer incidents and establishes procedures for reporting and handling them.

Departmental Manual 3510-001, Chapter 2, Part I, Physical Security Standards for

Information Technology (IT) Restricted Space. Directs that information technology restricted space be considered part of the Forest Service’s critical infrastructure and provides detailed guidance for physically securing facilities containing critical information technology infrastructure and for identifying, reporting, mitigating, and correcting deficiencies.

Departmental Manual 3515-001, Collection of Web Page Cookies & Privacy

Requirements Manual. Requires all USDA agencies collect or create only that information necessary for the proper performance of agency functions and which has practical utility.

Departmental Manual 3515-002, Privacy Impact Assessment (PIA) Manual. Requires all USDA agencies to initiate a PIA in the early stages of the development of a system and to ensure that the PIA is completed as part of the required system life cycle reviews.

Departmental Manual 3555-001, USDA Certification and Accreditation Manual.

Provides direction for security certification and accreditation of information technology systems.

Departmental Manual 3505-001, Incident Response Procedures. Requires all agencies to establish and implement an internal incident response capability and to have computer security incident response procedures in place that can be activated immediately.

Departmental Manual 3520-001, Configuration Management Policy and Responsibilities.

Sets requirements for system and product configuration and change management, including documentation and tracking.

http://www.ocio.usda.gov/directives/doc/DM3140-001.html http://www.ocio.usda.gov/directives/doc/DM3140-001.html http://www.ocio.usda.gov/directives/doc/DR3300-001.htm http://www.ocio.usda.gov/directives/doc/DM3505-000.htm http://www.ocio.usda.gov/directives/doc/DM3505-000.htm http://www.ocio.usda.gov/directives/doc/DM3510-001.htm http://www.ocio.usda.gov/directives/doc/DM3510-001.htm http://www.ocio.usda.gov/directives/doc/DM3505-000.htm http://www.ocio.usda.gov/directives/doc/DM3505-000.htm http://www.ocio.usda.gov/directives/doc/DM3505-000.htm http://www.ocio.usda.gov/directives/doc/DM3555-001.htm http://www.ocionet.usda.gov/ocio/security/docs/DM3505-001.pdf http://www.ocionet.usda.gov/ocio/security/docs/DM3520-001.pdf

DURATION: This amendment is effective until superseded or removed.

Departmental Manual 3525-001, USDA Internet Access Security for Private Internet

Service Providers. Requires use of only the USDA Internet Access Network for entry to the Internet and specifies terms and conditions of exceptions to that requirement.

Departmental Manual 3525-002, USDA Internet Use and Copyright Restrictions.

Establishes policy on the use of government computers or networks for unauthorized purposes.

Departmental Manual 3525-003, Telework and Remote Access Security. Requires that remote access be through secure firewalls/gateways using robust authentication and also requires agencies to centrally manage their remote access and dialup connections.

Departmental Manual 3530-001, Vulnerability Scan Procedures. Requires vulnerability scanning of all Forest Service networks, systems, servers, and desktops, and establishes scanning procedures and responsibilities.

Departmental Manual 3530-004, Firewall Technical Security Standards. Requires the use of firewalls between Forest Service and USDA networks and the use of secure Internet protocol (IP) connectivity from the Internet to USDA networks. This policy also details procedures, including equipment and services, for meeting those requirements.

Departmental Manual 3530-005, Encryption Security Standards. Provides direction to all

USDA agencies and staff offices to use the Approved Protocols and Protection

Techniques.

Departmental Manual 3535-001, USDA’s C2 Level of Trust. Requires that all USDA servers that store, process, or maintain mission-critical or sensitive information must be secured according to the Departmental Manual (DM) standards, including the DM minimum password management requirements.

Departmental Manual 3540-001, Risk Assessment Methodology. Provides direction and requirements for risk assessment and provides Forest Service information system security program manager (ISSPM) responsibilities.

Departmental Manual 3540-002, Risk Assessment and Security Checklists. Provides direction on use of security program assessment checklists and provides Forest Service

Chief Information Officer and ISSPM responsibilities.

Departmental Manual 3545-001, Security Awareness and Training. Requires agencies to develop, implement, and maintain an information technology security awareness and training program to ensure the security…