Attachment 07 USDA Sec Con Lang App B.pdf

Be sure you are using the most current copy of this document, available from the CIO Cybersecurity SecureCAP Website.

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

USER APPENDIX B – STANDARD FOREST SERVICE INFORMATION TECHNOLOGY

SECURITY LANGUAGE

1. CYBERSECURITY FOR CONTRACTS INVOLVING ACCESS TO GOVERNMENT

INFORMATION, OR THE ACQUISITION OF INFORMATION SYSTEMS OR INFORMATION

TECHNOLOGY (IT) SERVICES

1.1 By accepting this contract/agreement, the Contractor and other external organizations (hereafter called Contractor) providing Information Technology (IT) resources or services to the United States Forest Service (FS) agrees to comply with the applicable IT security policy as outlined in this document.

The Contractor and other external organizations will be responsible for IT security for all systems connected to the FS network or operated by the Contractor and other external organizations for the FS, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or logical access to FS information that directly support the mission of the FS. The term “information technology,” as used in this clause, means any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by Office of Management and Budget (OMB) Circular A-130.

1.2 The substance of this entire section shall be included in all subcontracts under this contract.

1.3 The contractor shall comply with all security-related Federal Acquisition Regulation (FAR) clauses incorporated by the Contracting Officer (CO) in other parts of the solicitation.

1.4 The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

4/11/2025

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

1.5 The Contractor or other external organization will not publish or disclose in any manner, without the FS Contracting Officer’s written consent, the details of any programs, documentation, data, or safeguards either designed or developed by the Contractor or other external organization under this Contract or otherwise provided by the Government. The Contractor may be required to sign non-disclosure or other appropriate security agreements. A written agreement between the FS and any contractors and other external organizations will be entered into before FS data and information otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The Contractor and other external organizations will agree to establish and follow security precautions considered by the FS to be necessary to ensure proper handling of data and information.

1.5.1 Data Rights. As may be identified elsewhere in this contract, the Contractor agrees that:

1.5.1.1 The draft and final deliverables and all associated working papers and other materials deemed relevant by the Contracting Officer’s Representative (COR) that have been generated by the Contractor in the performance of this contract are the property of the United States Government and must be submitted to the COR at the conclusion of the tasks.

1.5.1.2 All documents produced for this project are the property of the United States Government and cannot be reproduced or retained by the Contractor.

1.5.1.3 Any information provided to the contractor by FS or collected by the contractor on behalf of FS shall be used only for the purpose of carrying out the provisions of this contract, and shall not be made known to any persons except as may be necessary in the performance of the contract.

1.5.1.4 FS will retain unrestricted rights to all federally owned and/or federally managed data and/or metadata that FS either owns or manages that is handled under this contract.

Specifically, FS retains ownership of any user created/loaded data and applications collected, maintained, used, or operated on behalf of FS and hosted on contractor’s infrastructure, as well as maintains the right to request full copies of these at any time. If requested, data shall be available to FS within one (1) business day from request date or within the timeframe specified and provided using an encryption standard that meets FS requirements. In addition, the data shall be provided at no additional cost to FS.

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

1.5.1.5 As part of contract closeout and at expiration of the contract, the contractor shall provide all required documentation, as specified by the Program Office, to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of, and all devices and media are sanitized in accordance with NIST SP 800-88. Additionally, the contractor shall provide a certification that all government information has been properly sanitized and purged from contractor-owned systems, including backup systems and media used during contract performance, in accordance with FS and USDA policies. The contractor shall return all government information and IT resources (i.e., government information in nongovernment-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR.

1.6 Government Access for Security Assessment. To the extent required to carry out a program of security assessment (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the availability, integrity, and confidentiality of Government data or information systems operated on behalf of FS, the Contractor, will, at any tier handling or accessing government information afford the Government access to the Contractor’s or other external organization’s facilities, installations, data centers, equipment (including but not limited to all servers, computing devices, and portable media), technical capabilities, operations, documentation (whether in electronic, paper, or other forms), records, and databases, and personnel used in performance of this contract, including, but not limited to:

1.6.1 The Government includes but is not limited to the U.S. Department of Justice, U.S.

Government Accountability Office, and the USDA Office of the Inspector General (OIG). The Contractor will cooperate with Federal Government agencies and their officially credentialed representatives, or an independent third party working at the Government’s direction, during official inspections or investigations concerning the protection of FS information and information systems.

1.6.2 Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements, and rendering other timely and complete assistance and disclosure as deemed necessary to facilitate performance inspections and reviews, security and compliance audits, forensic analysis, law enforcement investigations, and identifying the nature and extent of any criminal or fraudulent activity and the individuals responsible. Cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture.

1.6.3 Logical commingling of Government protected information and metadata with other information is prohibited. Inspectors, auditors, and investigators will not be precluded from having access to the sought information if sought information is commingled with other information.

1.7 Threats, Hazards and Incidents.

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

1.7.1 If new or unanticipated threats or hazards are discovered by either the Government or the Contractor or other external organization, or if existing safeguards have ceased to function, the discoverer will within no more than sixty (60) minutes of discovery, bring the situation to the attention of the other party.

1.7.2 The Contractor shall report all suspected and confirmed information security and privacy incidents, breaches or violations, including incidents involving PII, in any medium or form, including paper, oral, or electronic, within no more than sixty (60) minutes of discovery to the USDA Cyber Watch Branch (CWB), by e-mail, at cyber.incidents@usda.gov, and to the COR.

1.8 Privacy. When the design, development, operation, or use of a system of records on individuals is required to accomplish an agency function, the Contractor will be required to design, develop, or operate a system of records on individuals subject to the Privacy Act of 1974, Public Law 93-579, December 31,1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

1.8.1 The Contractor agrees to –

1.8.1.1 Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function.

1.8.1.2 Include the Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

1.8.1.3 Include this clause, including this paragraph (3), in all subcontracts awarded under this contract that requires the design, development, or operation of such a system of records.

1.8.2 In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

4/11/2025 mailto:cyber.incidents@usda.gov https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fuscode.house.gov%2Fbrowse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3&data=04%7C01%7C%7C7244ba25b77f4be12aa408d93bfaf14a%7Ced5b36e701ee4ebc867ee03cfa0d4697%7C0%7C0%7C637606771256949694%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=VbE6huKqM1L2ncIqqFcseWt5L6qsT1rL%2B1LJ50F%2B5mw%3D&reserved=0

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

1.8.3 The contractor shall comply with OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information,” and with the USDA incident response policies when handling PII breaches.

1.8.4 Definitions include:

1.8.4.1 “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

1.8.4.2 “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

1.8.4.3 “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

1.8.4.4 “Personally Identifiable Information", as used in this clause, means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A-130, Managing Federal Information as a Strategic Resource).

1.8.4.5 “Breach” or “Privacy Breach,” as used in this clause, a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for any other-than-authorized purpose.

1.8.5 The FS will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract. All contractor/employees assigned to work on this contract shall complete the applicable USDA Cybersecurity and Privacy Awareness training (provided upon contract award) before performing any work under this contract (this training is available to new contractors, even if they do not have a Personal Identity Verification (PIV) card). Thereafter, the employees shall complete the USDA Cybersecurity and Privacy

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

Awareness training at least annually, during the life of this contract. All provided training shall be compliant with FS/USDA training policies. The contractor must maintain records of course completion and provide them to the Contracting Officer or Contracting Officer Representative upon request.

1.8.6 The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

1.8.7 The substance of this clause, including this paragraph, shall be included in all subcontracts under this contract, when subcontractor employees will:

1.8.7.1 Have access to a system of records;

1.8.7.2 Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

1.8.7.3 Design, develop, maintain, or operate a system of records.

1.8.8 The contractors and other external organizations will ensure that the following banner is displayed on all FS systems that contain Privacy Act information operated by the contractors and other external organizations prior to allowing anyone access to the system:

“This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93-579). Any privacy information displayed on the screen or printed must be protected from unauthorized disclosure. Employees who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both.”

1.9 Safeguarding Government Information

1.9.1 Records Management. The contractor shall maintain all information in accordance with National Archives and Records Administration (NARA) and FS records retention policies and schedules, and shall not dispose of any records unless authorized by FS. All contractors shall complete the applicable FS/USDA records management training at least annually during the life of this contract, in accordance with USDA and FS Records Management or Contracting policies and procedures.

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

1.9.2 The contractor shall be accountable and document all activities associated with the transport of government information, devices, and media transported outside controlled areas and/or facilities. These include information stored on digital media (e.g., CD- ROM, tapes, etc.), non-digital media (e.g., paper), and mobile/portable devices (e.g., USB (Universal Serial Bus) flash drives, external hard drives, and SD (Secure Digital) cards).

1.9.3 All information, devices and media shall be encrypted with FS-approved encryption mechanisms to protect the confidentiality, integrity, and availability of all government information transported outside of controlled facilities.

1.9.4 The contractor shall ensure all electronic and paper records are appropriately disposed of, and all devices and media are sanitized, in accordance with NIST SP 800-88 Rev 1, Guidelines for Media Sanitization.

1.9.5 Controlled Unclassified Information (CUI). The contractor shall comply with Executive Order 13556, and DR 3440-002, Controlled Unclassified Information Program, when handling Controlled Unclassified Information. The term “handling” refers to any use of CUI, including but not limited to marking, safeguarding, transporting, disclosing, disseminating, re- using, disposing, or destroying of the information. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

1.9.5.1 Marked appropriately;

1.9.5.2 Disclosed to authorized personnel on a “Need-To-Know” basis;

1.9.5.3 Protected in accordance with the current, finalized version of NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

1.9.5.4 Returned to FS/USDA control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

1.10 Desktops, Laptops, and Other Computing Devices. The contractor shall ensure that all IT equipment (e.g., laptops, desktops, servers, routers, mobile devices, peripheral devices, etc.) used to process information on behalf of FS are deployed and operated in accordance with approved security configurations and meet the following minimum requirements:

1.10.1 Maintain the latest operating system patch release and anti-virus software definitions;

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

1.10.2 Encrypt equipment and information stored and/or processed by such equipment in accordance with FS/USDA and FIPS 140-3, as amended, encryption standards;

1.10.3 Configure laptops and desktops in accordance with the latest applicable United States Government Configuration Baseline (USGCB), Program Office specific security configuration baseline, if any has been provided to the contractor, and USDA Minimum Security Configuration Standards;

1.10.4 Validate the configuration settings after hardware and software installation, operation, maintenance, update, and patching and ensure changes in hardware and software do not alter the approved configuration settings; and

1.10.5 Automate configuration settings and configuration management in accordance with FS/USDA security policies.

1.11 Encryption. The contractor shall:

1.11.1 Comply with Executive Order (EO) 14028, Improving the Nation’s Cybersecurity (May 12, 2021), Section 3(d)(iii) requirements for encrypting data at rest and data in transit as well as FS/USDA policies and procedures.

1.11.2 Encrypt all federal data and information (i.e., PII, proprietary information, Controlled Unclassified Information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-3, as amended, validated encryption solution.

1.11.3 Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process federally owned or federally managed information and ensure devices meet FS/USDA-specific encryption standard requirements.

1.11.4. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process government information (including

PII).

1.11.5 Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-3. The contractor shall provide a written copy of the validation documentation to the COR when required by the Program Office.

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

1.11.6 Use the Key Management system on the USDA personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the CO, COR, or to the Project Manager or Program Manager, upon request and at the conclusion of the contract.

1.12 Cyber Supply Chain Security

1.12.1 Cyber Supply Chain Risk Management Requirements. The Contractor shall comply with USDA Cyber Supply Chain Risk Management (C-SCRM) Contract Language (included in Section 9 of this appendix).

1.12.2 Notification of Supply Chain Compromises: The Contractor shall develop, propose, and implement procedures for notifying the CO, as well as FS/USDA Cybersecurity personnel, of any compromises of its supply chain (in accordance with the “Threats, Hazards and Incidents” paragraph above and the USDA Cyber Supply Chain Risk Management (C-SCRM) Contract Language). Such procedures are subject to approval by the CO prior to implementation. [SR-08]

1.12.3 Data, Documentation, Tools, Or System Components Disposal: The Contractor shall ensure any data, documentation, tools, or system components containing controlled unclassified information (CUI) or other non-publicly-available information is properly sanitized using the processes specified in NIST SP-800-88 Rev. 1, Guidelines for Media Sanitization, prior to disposal.

1.13 Foreign Sourcing

1.13.1. The Contractor will comply with all requirements related to “Country of Origin” in the USDA Cyber Supply Chain Risk Management (C-SCRM) Contract Language (see Section 9 of this appendix). This includes the provision that the Contractor shall not use any product or its components (including hardware, software, and firmware) that are on the Department of Commerce Entity List, including countries where the development, manufacturing, maintenance, and service for the product are provided.

1.13.2. The Contractor shall comply with any FAR provisions included by the Contracting Officer concerning the use/acquisition of products or services from prohibited entities/sources.

1.14 Non-U.S. Citizens. The Contractor shall comply with the provisions of the USDA Office of Homeland Security (OHS) November 15, 2023, memorandum entitled Hiring Non-United States (U.S.)

Citizens as Federal Employees or Federal Contractors, as directed and implemented by the FS program and Contracting Office officials.

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

2. SECURITY REQUIREMENTS FOR CONTRACTOR/COOPERATOR BUILDING

ACCESS AND/OR INFORMATION SYSTEM ACCESS

2.1 The Contractor shall insert these clauses in all subcontracts when the subcontractor is required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled system. Failure to comply with said requirements will constitute cause for termination.

2.2 IT Security Training:

2.2.1 Mandatory Training for All Contractor Staff. All contractor/employees assigned to work on this contract shall complete the applicable USDA Cybersecurity and Privacy Awareness training (provided upon contract award) before performing any work under this contract (this training is available to new contractors, even if they do not have a PIV card). Thereafter, the employees shall complete the USDA Cybersecurity and Privacy Awareness training at least annually, during the life of this contract. In accordance with the 1-Nov-2023 memorandum from the USDA Office of Contracting and Procurement (OCP), all contractor employees who will access USDA's IT systems/network will automatically have AgLearn access, and must complete the Information Security Awareness training courses in AgLearn. The contractor must ensure their employees (including subcontractor personnel) complete the training course(s) listed below in the frequency identified.

Course Name Frequency Method of Training

Length of Training Completion Date

Information Security Awareness

Annually AgLearn 60 minutes 1 year since last completion date

2.2.2 Role-based Training. All contractor employees with significant security responsibilities (as determined by the program manager or generally, any individual who has any security responsibilities that are more than the security responsibilities that any end-user would have, e.g., an Information System Security Officer, an Information System Security Manager, or any individual working within the Information Assurance Services division of the Office of the Chief Information Officer) must complete role-based training annually in accordance with FS/USDA policy.

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

2.2.3 Training Records. The contractor shall maintain training records for all its employees working under this contract in accordance with FS/USDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter, or upon request.

2.3 Rules of Behavior:

2.3.1 The contractor shall ensure that all employees performing on the contract sign and comply with the applicable FS/USDA Rules of Behavior (ROB) and any specific rules provided by the Program Office.

2.3.2 All contractor employees performing on the contract shall read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual USDA Cybersecurity and Privacy Awareness training.

2.3.3 Employees, contractors, and anyone assigned to a contract shall sign Rules of Behavior (RoB). Signed copies of RoB shall be kept on file by the Contractor’s program manager.

2.4 Background Investigations: All non-government employees with unescorted access to FS facilities, computer systems and/or FS information must have background investigations commensurate with the level of risk and magnitude of loss or harm. The FS will determine the level of background investigation and position classification needed.

2.5 Personal Identity Verification of Contractor Personnel: The Contractor shall be responsible for ensuring compliance by its employees with all applicable federal regulations, to include those of GSA, NIST, USDA, FS and HSPD-12. Contractors and their employees are subject to all Federal laws applicable to Government installations and are under the jurisdiction of the Federal Protective Service (FPS). The designated program/project officers, in conjunction with the FS HCM HSPD-12 staff, will assist the Contractor in processing the required Security Background Investigations/Clearances.

2.5.1 The Contractor shall comply with the personal identity verification (PIV) policies and procedures established by U.S. Department of Agriculture (USDA) Directives 3800 series.

2.5.2 Should the results of the PIV process require the exclusion of a Contractor’s employee;

the Contracting Officer will notify the Contractor in writing.

2.5.3 The Contractor must appoint a representative to manage this activity and to maintain a list of employees eligible for a USDA PIV ID Badge required for performance of the work.

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

2.5.4 The responsibility of maintaining a sufficient workforce remains with the Contractor.

Employees may be barred by the Government from performance of the work should they be found ineligible or to have lost eligibility for a USDA PIV ID Badge. Failure to maintain a sufficient workforce of employees eligible for a USDA PIV ID Badge may be grounds for termination of the contract.

2.5.5 The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have access to a federally controlled facility or system.

2.5.6 The PIV Sponsor for this contract is the Program Manager, or their delegated sponsor, unless otherwise specified in this contract. The PIV Sponsor will be available to receive contractor identity information from * (hours and days TBD) to * (hours and days TBD) at * (office address for registration TBD). The Government shall notify the Contractor if there is a change in the PIV Sponsor, the office address, or the office hours for registration.

2.5.7 At this time, the Government will pay for and process all required security investigations/clearances, except as identified differently within this clause.

2.5.8 The Contractor should be aware of any of its employees possibly having had a background investigation through another government agency. The investigation that was conducted, if verifiable by the FS HSPD-12 staff, and if it was completed within the last 5 years, can be accepted by the Government in lieu of a background check.

2.5.9 The Contractor shall comply with any facility badging requirements for the issuance of building access, badges, etc.:

2.5.9.1 Ensure that each of the Contractor’s employees has been issued either a temporary or permanent badge from the Government. A permanent badge will not be issued until the security questionnaire has been completed and favorably reviewed. Temporary or visitor badges will be provided for persons who are identified as having an infrequent or temporary legitimate business need for access to the site. As noted above, periods that exceed 180 days will require a permanent badge. The badge must be worn at all times while in the facility. It must be displayed above the waist. The individual will retain possession of the badge as long as continued admittance to the site is needed.

2.5.9.2 Ensure the safekeeping, wearing, and visibility of Government-furnished badges.

2.5.9.3 Immediately return all badges and permits to the Government when such need ceases to exist.

2.5.10 The Contractor shall comply with any facility security requirements for access to the facility.

2.5.11 The Contractor shall comply with all applicable rules governing parking at FS/USDA

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A locations.

3.0 SECURITY FOR DEVELOPING AND/OR IMPLEMENTING SOFTWARE

APPLICATIONS

3.1 The substance of this entire section shall be included in all subcontracts under this contract.

3.2 Best Practices: The contractor shall follow secure coding best practice requirements, as directed by the United States Cybersecurity and Infrastructure Security Agency (CISA) specified standards and the Open Web Application Security Project (OWASP) that will limit system software vulnerability exploits.

3.3 Secure Coding Skills: Contractor certifies that at least one member of each programming team working on any code (including C, Java, .Net, ASP.NET, Visual Basic) to be delivered to the Forest Service has earned the Global Information Assurance Certification for Secured Software Programming or equivalent.

3.4 Source code testing, binary code testing, application scanning, and penetration testing: At least one week prior to delivery of any code due under this contract, Contractor will deliver to the FS Program Manager, or delegated sponsor, the following reports covering all code that will be delivered:

3.4.1 Source code testing results showing all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.” The Contractor must then correct the vulnerabilities, resend the code, and ensure the health of delivered source code.

3.4.2 For web applications, web application scanning test results showing all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.”

3.4.3 For all applications: application penetration results.

3.5 End of Life Compliance: The contractor shall use Commercial off the Shelf (COTS) software or other software that is supported by the manufacturer. In addition, the COTS/other software needs to be within one major version of the current version. Deviation from this requirement will only be allowed via the FS/USDA Risk-Based Decision (RBD) process. The contractor shall retire and/or upgrade all software/systems that have reached end-of-service-life. Under no circumstances will the Department allow contractors to utilize unsupported COTS applications, systems, components, programs or utilities without a specific written exception, signed and authorized by the CIO.

3.6 The contractor shall ensure IT applications designed and developed for end users (including

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges.

3.7 Copyright Management and Responsibility: By delivering applications or programming code to the Federal Government, the vendor or Contractor certifies that they have the proper authority to transfer the property and will defend the Government against copyright or other lawsuit resulting from the application or programming delivered.

3.8 The contractor shall ensure that computer software developed on behalf of FS or tailored from an open-source product, is fully functional and operates correctly with least privilege on systems configured in accordance with government policy and federal configuration standards. The contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the FS/USDA environment. No sensitive data shall be used during software testing.

3.9 Multifactor Authentication. In accordance with Executive Order (EO) 14028, OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, and OMB M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, the contractor shall ensure applications support multifactor authentication (MFA), including phishing resistant solutions, as appropriate.

3.10 Vulnerability Identification and Remediation.

3.10.1 The contractor shall remediate security risks for which they are responsible, including those identified during their own development, included third party open-source software packages, scanning and testing activities, as well as those identified during testing, A&A and continuous monitoring activities by the government or its designated representatives. The Contractor shall report vulnerabilities identified in any component through scans or other methods.

The FS shall determine the risk rating of all identified vulnerabilities.

3.10.2 In providing the products and services described in this Agreement the Contractor shall provide, at no additional cost to the government, appropriate software and firmware updates to remediate newly discovered vulnerabilities or weaknesses within the prescribed timelines: Critical vulnerabilities shall be remediated within 14 days from discovery; and all High, Medium, and Low vulnerabilities shall be mitigated within 30 days from discovery. A shorter timeframe may be required by CISA in a Binding Operational Directive or Emergency Directive. In the event that a specific vulnerability or other risk finding cannot be remediated within the prescribed timelines above, variance from the timeline must be approved by FS in accordance with the USDA Plan of Action and Milestones (POA&M) Standard Operating Procedures (SOP), and shall be added to the designated POA&M and remediated within the newly designated timelines specified by the Program Office.

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

4.0 SECURITY FOR EXTERNAL IT SERVICES (PROCESSING, STORING, OR

TRANSMITTING FS DATA ON A NON-FS SYSTEM)

Note: An external service is an external entity that provides a service that requires access to FS information.

4.1 The substance of this entire section shall be included in all subcontracts under this contract.

4.2 The Contractor or other external organizations will develop, provide, implement, and maintain an IT System Security Plan for any system that includes acquisition, transmission or analysis of data owned by FS with significant replacement cost should the Contractor’s and other external organization’s copy be corrupted. This plan will describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan will describe those parts of the contract to which this clause applies. The Contractor or other external organization’s IT System Security Plan will be compliant with applicable Federal laws that include, but are not limited to: the Clinger-Cohen Act of 1996, the Federal Information Security Management Act of 2002 (FISMA 2002), and the Federal Information Security Modernization Act of 2014 (FISMA 2014.

The IT System Security Plan will meet IT security and privacy requirements in accordance with Federal and FS policies and procedures that include but are not limited to: National Institute of Standards and Technology (NIST) SP 800-53 Guidelines.

4.3 The Contractor and other external organizations will ensure that the appropriate security banners are displayed on all FS systems (both public and private) operated by the contractors and other external organizations prior to allowing anyone access to the system.

5.0 SECURITY REQUIREMENTS FOR GOVERNMENT-OWNED/CONTRACTOR-

OPERATED AND CONTRACTOR-OWNED/CONTRACTOR-OPERATED INFORMATION

SYSTEMS (I.E., EXTERNAL SYSTEMS)

Note: An external system is a system that is implemented outside of the authorization boundary of the FS system (i.e., a service that is used by, but not part of, the FS system) and for which the FS typically has no direct control over the application of required security and privacy controls, supply chain, or the assessment of security and privacy control effectiveness. Examples of external systems are service-oriented architectures (SOAs), a cloud-based system, or data center operations. A cloud-based system is software, infrastructure, or platform made available to users on demand via the Internet from a cloud service provider (CSP).

5.1 The substance of this entire section shall be included in all subcontracts under this contract.

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

5.2 The Contractor shall comply with all applicable directives to protect the confidentiality, integrity and availability of information systems owned or operated by a contractor that processes, stores, or transmits Forest Service (FS) information, including: the Federal Information Security Modernization Act of 2014 (FISMA); Executive Orders (EO); Office of Management and Budget (OMB); Cybersecurity and Infrastructure Security Agency (CISA); National Institute of Science and Technology (NIST); General Services Administration (GSA); United States Department of Agriculture (USDA); FS; and other applicable laws, regulations, guidance and policies.

5.3 The Contractor shall apply the basic safeguarding requirements and procedures to protect covered contractor information systems defined in FAR 52.239.1, as well as those described in the rest of this section (subparagraphs 5.4 through 5.19).

5.4 Security Assessment and Authorization (A&A). The Contractor shall support the Assessment & Authorization (A&A) for the Authority to Operate (ATO) of the system, based on its NIST categorization, in accordance with NIST Special Publication (SP) 800-53, NIST SP 800- 37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, and the current USDA Risk Management Framework (RMF) process documentation.

5.4.1 The Contractor must work with the FS and supply deliverables and support activities to support the A&A for the system, including the System Security and Privacy Plan (SSP);

Contingency Plan (CP); Configuration Management Plan (CMP); Incident Response Plan (IRP);

Disaster Recovery Plan (DRP); E-Authentication Threshold / Risk Assessment(s) or Questionnaire, if required; Privacy Threshold / Impact Assessment(s); CP and DRP Tests; and any other required documents to ensure the system shall receive an ATO.

5.4.2 Contractor must work with the FS to complete a security assessment / risk assessment of the system by the Forest Service’s independent assessor, which is documented in a Security Assessment Report (SAR).

5.4.3 Gaps between required controls and Contractor’s implementation identified in the SAR shall be documented, approved, and tracked for mitigation in a Plan of Action and Milestones (POA&M) document completed in accordance with USDA Plan of Action and Milestones (POA&M) Standard Operating Procedures (SOP). The Contractor shall provide initial and periodic technical input to FS in responding to POA&M items by identifying the intended mitigations, estimated costs, and expected timelines that may be required to address security weaknesses.

5.5 Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA).

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B https://www.acquisition.gov/far/part-52#FAR_52_239_1

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

5.5.1 The contractor shall assist the FS and USDA privacy officials or designee in reviewing the PTA and PIA annually for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed. If the results of the PTA show that a full PIA is needed, the contractor shall assist the FS and USDA privacy officials or designee with completing a PIA for the system or information within the timeframe required by the Program Office after completion of the PTA and in accordance with FS and USDA policy and OMB M-03- 22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The contractor shall assist the FS and USDA privacy officials in reviewing the PIA at least annually throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

5.5.2 For contracts subject to the Privacy Act of 1974, the contractor shall support a system of records and any applicable System or Record Notices (SORNs), in conjunction with the judgment of the Senior Agency Official for Privacy (SAOP), and NARA-approved records schedule(s) and protection requirements for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to maintenance of links between records and metadata, and categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA- approved retention schedules.

5.6 The Contractor shall work with the FS and provide appropriate solutions and controls to implement the provisions of Executive Order (EO) 14028, Improving the Nation’s Cybersecurity and other related directives and guidance from OMB, the Cybersecurity and Infrastructure Security Agency (CISA), USDA, FS, and the information system owner. This includes, but is not limited to:

5.6.1 Audit logging, in accordance with OMB M-21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents. The Contractor shall collect and preserve data, information, and reporting relevant to cybersecurity event prevention, detection, response, and investigation on all information systems over which they have control, including systems operated on behalf of government. The Contractor shall share such data, information, and reporting, as they relate to cyber incidents or potential incidents relevant to FS.

5.6.2 Zero Trust Architecture (ZTA), in accordance OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles; and

5.6.3 Identification and Authentication. The contractor shall:

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

5.6.3.1 Comply with EO 14028 Section 3(d) requirements for implementing multi-factor authentication (MFA), as well as FS/USDA Identification and Authentication (IA) standards to prevent unauthorized access to government information.

5.6.3.2 Require MFA--including phishing resistant solutions as appropriate--in accordance with OMB M-22-09 and OMB M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management.

5.7 The Contractor shall conduct and document ongoing Asset Management and Configuration Management for all hardware and software components, to include:

5.7.1 Using any available Security Content Automation Protocol (SCAP)-compliant automated tools for active/passive scans, provide an inventory of all information technology (IT) assets for hardware and software (computers, servers, routers, databases, operating systems, application, etc.) that are processing FS/USDA-owned information/data.

5.7.2 Using available SCAP-compliant automated tools for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that store and process government information.

5.7.3 Maintaining the tools and capabilities to support asset discovery, to include passive network monitoring, active network monitoring, and automated network mapping.

5.8 The Contractor shall conduct and document an ongoing Vulnerability Management program, including vulnerability scans, penetration testing, installation of vendor-released security patches, or other vulnerability remediations for the information system and its components.

The contractor shall use automated tools to perform authenticated scans that detect any security vulnerabilities in 100% of IT assets (computers, servers, routers, websites, web applications, databases, operating systems, etc.) that store and process government information. Vulnerability scans shall occur at least every 72 hours in accordance with CISA Continuous Diagnostics and Mitigation (CDM) guidance.

The Contractor shall actively manage system vulnerabilities using SCAP-compliant automated tools and technologies where practicable and in accordance with FS/USDA policy & Federal Directives. The Contractor shall report vulnerabilities identified in any component through scans or other methods. The Contractor shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets and report to FS at least weekly, or more frequently as required by Department Policy.

SA-4/9/AU-16/SR-5-8-12 V7.2A

Appendix B

INFORMATION TECHNOLOGY PROCEDURE

SA-4/9/AU-16/SR-5/8/12 ACQUISITION PROCESS AND EXTERNAL SYSTEM

SERVICES

Version: 7.2A

The FS shall determine the risk rating of all identified vulnerabilities. All critical vulnerabilities must be remediated within 14 days and all High, Medium, and Low vulnerabilities must be remediated within 30 days from the date vulnerabilities are identified. A shorter timeframe may be required by CISA in a Binding Operational Directive or Emergency Directive. Variance from approved mitigation must be approved in accordance with USDA POA&M SOP.

5.9 The Contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government…