Attachment 13 OPM Cyber Language IT Acquisitions.docx

OFFICE OF PERSONNEL MANAGEMENT CYBERSECURITY AND PRIVACY LANGUAGE FOR IT ACQUISITIONS

November 3, 2022

Contents

Introduction and Organization The U.S. Office of Personnel Management (OPM) has determined that this acquisition involves the development, use, or maintenance of one or more Information Technology (IT) systems or services by the Contractor that fall within the purview of the Federal Information Security Modernization Act of 2014 (FISMA) and the Privacy Act of 1974 (both as amended).

As such, the Contractor shall be obligated to meet and align to all applicable requirements resulting from these statutes, subsequent directives and memoranda, National Institute of Standards and Technology (NIST) guidelines, and agency Cybersecurity and Privacy Policies, both throughout the life cycle of this acquisition and throughout the Systems Development Life Cycle (SDLC) of the IT systems and services being acquired through this solicitation.

It would be infeasible to attempt to reproduce every federal-level cybersecurity- or privacy-related requirement in the body of this appendix. Alternatively, this document calls out selected key controls and capabilities that must be in-place for the OPM to achieve its strategic goals and ensure the cybersecurity and privacy posture of the IT systems and services that safeguard its stakeholders’ data. Each control or capability is aligned to the NIST Special Publication (SP) 800-53 control catalog.

The Contractor shall at no time draw the conclusion that, just because a particular control or capability is not included in the body of this document, that the excluded control or capability is not a requirement.

This document is intended to supplement the requirements articulated in the solicitation requirements document (e.g., performance works statement, statement of work, statemen of objectives, task order request) but cannot replace nor compensate for a well-written solicitation requirements document.

The remainder of this document is separated into three sections:

· Section 2: Instructions to Offerors This section shall be completed in full by the Contractor and shall be submitted as part of the Contractor’s technical proposal. Failure to include this completed requirement as part of the Contractor’s technical proposal may negatively affect the Contractor’s evaluation and may result in disqualification from this award process.

· Section 3: Cybersecurity Language for IT Acquisitions This section contains each key control or capability, the respective NIST index, and the specific technical requirements as defined by the OPM. Some subsections include requirements for key integration points between the Contractor’s solution and the OPM’s enterprise cyber services and capabilities.

· Section 4: Schedule of Deliverables and Frequencies This section defines the frequency of delivery for each requirement in Section 3.

Instruction to Offerors

The responsibility for the completion of this attestation shall fall to the primary organization that chooses to pursue this solicitation (the Prime Contractor). However, this attestation must be completed for all software being utilized under this solicitation (e.g., commercial off the shelf, open source, third-party software, cloud services, embedded modules, packaged components, applications). Attestations shall be updated by the Prime Contractor, coordinating with its partners and subcontractors, when changes occur.

Software Provider Attestation The following information shall be provided by all software providers as determined by the OPM:

1. Please provide the name of the organization that has primary responsibility for producing this software.

2. Provide description of the product(s) that are being provided to the OPM. This description shall include the product line, brand name, and all components that are being provided.

3. Provide an attestation as to how the product(s) identified above align to the NIST Secure Software Development Framework and the NIST Software Supply Chain Security Guidance.

4. In the event of a confirmed compromise, as determined by the OPM, provide the contractually enforceable Service Level Agreement (SLA) by which the providing organization shall provide a full remediation to the OPM (e.g., patch, workaround, hotfix, upgrade, replacement components) that resolved the supply chain compromise.

Cybersecurity Language for IT Acquisitions

The following subsections provide the OPM requirements and guidance regarding the topic area. Each subsection aligns to the NIST SP 800-53-5 controls family.

Access Control

The Contractor shall implement logical access controls to authorize or restrict the activities of users and processes to authorized transactions and functions.

All accounts shall be managed for all IT systems and services, including establishing, activating, modifying, reviewing, disabling, and removing accounts. Reviews of all accounts and permissions shall be completed annually to ensure the continued need for system access.

The Contractor shall enforce the most restrictive set of rights or privileges needed by users or processes for the performance of specified tasks or functions and minimizing transitive trust to the degree practicable.

The Contractor shall utilize an attribute-based trust architecture, as applicable and in accordance with OPM guidance.

The Contractor shall disable inactive accounts of all types after not more than ninety (90) days, automating this process to the degree practicable. Historically, this presents a problem with public users who only have a need to access a web portal or application occasionally (e.g., once a year). In these cases, the Contractor shall construct a self-service mechanism where a public user whose account has been disabled may re-establish access (e.g., click here to re-enable your account). Re-established accounts shall undergo the full multifactor authentication process prior to regaining access to the resource.

The Contractor shall create accounts only upon receipt of valid access requests in alignment with the OPM access request process.

Privileged accounts including but not limited to “administrator” or “root” shall be restricted to authorized individuals as approved by the OPM and be configured to the most restrictive manner practicable.

Privileged system access shall be implemented using distinct and separate accounts; where routine day-to-day functions are performed using an unprivileged “user” account, with exclusively privileged functions performed using the privileged account.

Service accounts, used for process-to-process communication, shall be configured to the most restrictive mode practicable. Service accounts shall be configured to disallow interactive logons to the greatest degree possible. Service accounts shall not be utilized by system administrators, developers, or other privileged users in lieu of their own privileged account or to accomplish routine privileged functions.

The Contractor shall configure the system or service to automatically terminate access connections and Internet accessible application sessions after not more than thirty (30) minutes of inactivity.

Warning banners for authentication points shall be consistent with OPM-approved language.

Remote access, which includes web portals, shall be encrypted, and use approved identification and authentication methods that provide detection of intrusion attempts and unauthorized access.

Awareness and Training

All Contractor personnel accessing OPM data and compute resources shall complete mandatory awareness course within thirty (30) days of entrance of employment and annually thereafter.

Audit and Accountability

Security-related event auditing capabilities shall be employed throughout the protocol stack and on all components of the Contractor’s solution. Event logging shall ensure event visibility, consistent with the OMB M-21-31 or successor directive, at the following levels:

RFP 24322623R0004 Postal Service Health Benefits System (PSHBS) Indefinite Delivery, Indefinite Quantity (IDIQ) Contract

(1) Attachment 13 Page 2 of 2

(2) Edge

(3) Server / Host

(4) Workstation / Laptop / Client

(5) Network

(6) Application

(7) Database

(8) Storage

(9) User

The Contractor’s solution shall have the ability to alert the OPM in the event of an audit event processing failure and take one of the following actions: shut down information system, overwrite oldest audit records, or stop generating audit records.

The Contractor’s solution shall be designed to produce audit event records that contain sufficient detail to establish what events occurred, the sources of the events, the outcomes of the events, and the time stamps when the activities occurred. Minimum requirements include successful and unsuccessful logon events, account management events, policy changes, privilege functions, process tracking, and system events; web applications should log all admin activity, authentication checks, data deletions, data access, data changes, and permission changes. Additional requirements, where possible, include (i) Session, connection, transaction, or activity duration; (ii) For client-server transactions, the number of bytes received and sent. This gives bidirectional transfer information that can be helpful during an investigation or inquiry; (iii) For client-server transactions, unique metadata or properties about the client initiating the transaction. This could include properties such as an IP address, username, session identifier or browser characteristics (e.g., a ‘User-Agent’ string); (iv) Details regarding the event ‘type’: the type of method (for HTTP: GET/POST/HEAD, etc.) or action (Database INSERT, UPDATE, DELETE); (v) Characteristics that describe or identify the object or resource being acted upon.

The Contractor’s solution shall retain event logs for a total of eighteen (18) months where the most recent twelve (12) months shall be continuously maintained via active or hot storage and an additional six (6) months (the least recent) shall be available via cold storage.Key Integration Requirement [NIST SP 800-53-5: AU-06] The Contractor’s solution shall be designed and be capable of integrating with the OPM’s event log aggregation or Security Information Event Management (SIEM) capability, sending event logs to the OPM in real-time continuously, via Application Programming Interface (API) feeds or other automated mechanism.

All event logs shall be exportable in comma-delineated electronic format (e.g., .csv) to support internal or external point-in-time audits or other requirements.

Assessment, Authorization, and Monitoring

The implementation of an IT system requires a formal approval process known as Assessment and Authorization (A&A). The NIST SP 800-37-2 provides guidelines for performing the A&A process. The Contractor’s solution must have a valid assessment and authorization, known as Authorization to Operate (ATO) (signed by the Federal government) before going into operation and processing OPM information. The failure to obtain and maintain a valid ATO may result in the termination of the contract. The system must have a new A&A conducted (signed by the Federal government) at least every three (3) years or at the discretion of the Authorizing Official when there is a significant change to the system’s security posture. All NIST 800-53 controls must be tested/assessed every three (3) years or as defined by OPM policy

Contractors leveraging cloud solutions must utilize a Cloud Service Provider (CSP) with an existing Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB) Provisional Authorization to Operate (ATO) or Agency ATO at all service models [Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)].

To align to the Federal standard, the OPM must determine the security category of the information and information system in accordance with FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems”, and then the contractor shall apply the appropriately tailored set of Privacy, Low, Moderate, or High impact baseline security controls in NIST 800-53, as determined by the OPM. All NIST 800-53 controls must be implemented as per the applicable FIPS 199 Privacy, Low, Moderate, or High baseline.

The Contractor shall use OPM and NIST guidelines, Defense Information Security Agency (DISA) Security Technical Implementation Guides (STIGs), or industry guidelines in securing their systems.

The Contractor shall submit to the OPM A&A package, along with the security assessment report and supporting documentation such as system and configuration scans from an independent assessor at least sixty (60) days prior to operation of the IT system for review and authorization by the OPM Authorizing Officials (AOs). Should the AOs not consider the signed package to meet OPM SA&A requirements for any reason, the AOs retain the right to not issue an ATO for the system. Should the AOs consider it possible for the Contractor to improve the compliance of the A&A package, the CO or COR may provide general or detailed information to the Contractor for possible modification to the package to improve compliance and resubmission to the CO or COR after modification. The CO or COR reserves the right to limit the number of re-submissions of a modified package before a final determination that a resubmitted package will not receive an ATO and no further resubmissions will be accepted. This may be grounds for contract termination. The OPM CIO is the final authority on the compliance of a submitted package with OPM SA&A requirements.

The Contractor’s A&A documentation package must be developed with the use of OPM Security Assessment and Authorization (A&A) documentation templates in accordance with the OPM cybersecurity policy based on the most current NIST Risk Management Framework (RMF), as adapted for Contractor IT systems supporting OPM. Templates are available for all required security documentation including, but not limited to, the System Security Plan, the Security Assessment Plan, the Security Assessment Report, Contingency Plan and Incident Response Plan. The SA&A process must be followed throughout the IT system lifecycle process to ensure proper oversight by OPM.

Assessments must be performed in accordance with NIST SP 800-30. All controls must be implemented in accordance with FIPS 200 and the current version of NIST SP 800-53. All controls must be documented in the System Security Plan (SSP) in accordance with NIST SP 800-18. All controls must be documented and evaluated in accordance with NIST SP 800-53A for IT system or services following a traditional A&A model. IT systems or services following an Ongoing Authorization (OA) model may bypass 800-53A-based evaluation in favor of continuous monitoring feeds and testing implementations approved by the Office of the CIO.

If the Contractor’s solution shares information with another IT system, that connection shall be implemented using a secure methodology that provides security commensurate with the acceptable level of risk as defined in the SSP and that limits access only to the information needed by the other system. All interconnections between the Contractor’s solution and external entities including off-site contractors or federal agency/departments must be approved by the OPM and reviewed on an annual basis.

The Contractor must ensure a plan of action and milestones (POA&M) is generated for each security finding and is remediated within a time frame commensurate with the level of risk, as follows, or as otherwise negotiated and approved in writing by the OPM

The Contractor shall comply with both OPM cybersecurity policies and continuous monitoring reporting requirements. The Contractor shall provide OPM with the requested information within the timeframes provided for each request. Failure to do so may result in the loss of OPM’s authorization to receive and process sensitive information or operate an IT system containing sensitive information. Reporting requirements may change each reporting period.

The Contractor shall ensure that information system or services provided to OPM adhere to all Office of Management and Budget executive orders and memoranda as well as all applicable Department of Homeland Security cybersecurity Binding Operational Directives and Emergency Directives requirements.

The Contractor shall ensure that all employees performing on the contract comply with the applicable OPM Rules of Behavior (RoB).

The Contractor’s solution shall undergo penetration testing conducted by the Office of the CIO, DHS, or third-party not greater than annually. The Contractor shall facilitate the execution of penetrating testing efforts by providing all architectural and logical addressing information needed.

The Contractor shall leverage all applicable enterprise IT services available from the Office of the CIO Cybersecurity Division and Office of Privacy and Information Management (OPIM). The goal of enterprise services is to maintain enterprise protection and visibility of all agency IT systems. The agency expects a lower cost of ownership, less complexity, lower level of maintenance effort and overall cost savings over the life of the contract. These services include but are not limited to:

· Event log collection and aggregation

· Continuous monitoring

· Incident response

· Incident response exercises

· Patch and configuration management

· Vulnerability scanning

· Penetration testing

· Cybersecurity risk management

· Cybersecurity controls assessment

· Cybersecurity and privacy awareness training

· Privacy controls assessment

· Privacy risk management

All requirements identified or referenced in this document shall be interpreted and implemented implicitly for all system components unless otherwise directed by the OPM.

If the OPM is responsible for providing the assessment service, the Contractor shall allow OPM employees (or OPM-designated third-party contractors) to conduct A&A activities to include control reviews in accordance with NIST 800-53/NIST 800-53A. Review activities include but are not limited to operating system vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, or security of OPM information. This includes the general support system infrastructure.

The Contractor shall provide access to the OPM, or their designee acting as their agent, when requested, to verify compliance with the requirements for an Information Technology security program, and in response to security incidents. At its option, the OPM may choose to conduct on site surveys. The Contractor shall make appropriate personnel available for interviews and documentation during this review. If documentation is considered proprietary or sensitive, these documents may be reviewed on-site under the hosting Contractor’s supervision.

Configuration Management

A Configuration Management Plan (CMP) shall be developed, implemented, and maintained by the Contractor for its solution. The CMP shall articulate an auditable process for cybersecurity- and privacy-related changes to the solution. The CMP and associated processes shall incorporate activities associated with IT system, service, or component maintenance.

The Contractor’s solution shall be securely configured, be running supported versions of firmware and software, and be patched with the most recent available updates before being put into operation and while in operation. Implemented configuration settings should be documented and enforced in all subsystems of the information system.

All components (e.g., on premises, contractor operated, cloud-based) shall be configured consistent with OPM security configuration baselines, implementation instructions, or other guidance. For technologies where no OPM, Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) Center for Internet Security (CIS) benchmarks, or NIST guidelines shall be used. If neither is available, manufacturer provided recommendations may be used with the approval of the OPM. The standard installation, operation, maintenance, updates, and/or patching of software must not alter the configuration settings from an approved OPM defined configuration baseline.

Component inventories shall be continuously maintained for all IT systems and services in accordance with OPM guidelines. Inventory requirements include but are not limited to:

· Endpoints (Server [including mainframe/minicomputers/midrange computers], Workstation, [desktops laptops, Tablet PCs])

· Mobile devices (Smartphone, Tablet, Pager)

· Networking devices (Modems/routers/switches, Gateways, bridges, wireless access points, firewalls, IDS/IPS, virtual load balancer, etc.)

· Other input/output devices (Industrial control system, Printers/plotters/copiers/multi-function devices, Fax portals, Scanners/camera, Accessible storage devices, VOIP phone, other information security monitoring devices or tools, other devices addressable on the network).

· Interfaces (customer portals and public URIs, admin portals, service provide portals, APIs, SFTP, etc.).

Key Integration Requirement [NIST SP 800-53-5: CM-08] The Contractor’s solution shall have the capability to export its inventory of all components in a comma-delineated electronic format (e.g., .csv), preferably via API or other automated method, into the OPM’s inventory tracking mechanism.

The Contractor shall provide to the OPM, on an ongoing basis, a one-to-one mapping of all identified vulnerabilities to individual assists or components of its solution.

The Contractor shall implement only commercial software that is approved by the OPM and is licensed and registered for OPM use. Software determined by the OPM to have demonstrative supply chain risk [e.g., concerns due to Foreign Ownership, Control, and Influence (FOCI)] shall not be approved for OPM use.

Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

Contingency Planning

An Information System Contingency Plans (ISCPs) must be developed, updated, and tested by the Contractor for its solution in accordance with OMB A-130 and NIST SP 800-34. The ISCP shall be developed to identify and address preventive controls, damage assessment procedures, plan testing and training procedures. The ISCP must include a Business Impact Assessment (BIA), recovery strategy and documented procedures to maintain the plan. The ISCP shall be updated annually to address system or organizational changes, or problems encountered during plan implementation, execution, or testing.

The ISCPs shall be functionally tested annually to include failover testing to ensure the target IT system or service’s operational capabilities from its alternate site. The ISCPs test results shall include measurable or quantifiable information to determine if the in-place recovery capabilities can be performed within the objectives identified in the BIA.

Identification and Authentication

Authentication designs shall be implemented in such a way that accounts uniquely identify all users (e.g., firstname.lastname) and are not default or generic. Authentication designs shall be implemented in such a way that accounts uniquely identify system processes Identification and authentication mechanisms for the Contractor’s solution used by OPM users shall be designed and implemented to leverage the PIV-based authentication, federated Single Sign On (SSO) capabilities, or other phishing-resistant authentication mechanism.

Identification and authentication mechanisms for the Contractor’s solution used by non-OPM users (e.g., public users) shall be designed and implemented to offer phishing-resistant multifactor authentication to the greatest degree possible

Key Integration Requirement [NIST SP 800-53-5: IA-02 (01, 02)] The Contractor’s solution shall at the time of award have the capability to integrate directly with the OPM’s identity provider and SSO mechanism; having the built-in ability to accept a Security Assertion Markup Language (SAML) assertion from a third-party software.

The Contractor’s solution shall utilize multifactor authentication for all access. Phishing-resistant multifactor authentication shall be enforced for OPM users and made available to public users. Corresponding passphrases shall align to the OPM cybersecurity policy requirements.

Incident Response

The Contractor shall report all suspected incidents involving OPM information to the OPM Security Operations Center (SOC) at CyberSolutions@opm.gov, 844-377-6109. The SOC is available 24 hours per day, 365 days per year.

The Contractors shall report all incidents involving information technology (IT) systems or Controlled Unclassified Information (CUI) immediately upon becoming aware of the potential incident but no later than 30 minutes after becoming aware of the potential incident, regardless of day or time; regardless of internal investigation, evaluation, or confirmation of procedures or activities; and regardless of whether the incident is suspected, known, or determined to involve IT systems operated in support of this contract.

Contractors reporting an incident to the SOC by email or phone must copy the Contracting Officer (CO) or Contracting Officer’s Representative (COR) if possible; but if not, must notify the CO or COR immediately after reporting to the SOC.

When reporting an incident to the SOC by email: the Contractor shall not include any CUI in the subject or body of any email; the Contractor shall use FIPS 140-3 compliant encryption methods to protect CUI to be included as an email attachment, and do not include passwords in the same email as the encrypted attachment; and the Contractor shall provide any supplementary information or reports related to a previously reported incident directly to the OPM SOC with the following text in the subject line of the email: “Supplementary Information / Report related to previously reported incident # [insert number].”

The Contractor shall provide the OPM full access and cooperation for all activities determined by the COR to be required to perform inspection and forensic analysis in the event of an incident.

The Contractor shall promptly respond to all requests by the COR for incident and system-related information, including but not limited to disk images, log files, event information, and any other information determined by the OPM to be required for a rapid but comprehensive technical and forensic review.

The OPM, at its sole discretion, may obtain the assistance of Federal agencies and/or third-party firms to aid in incident response activities.

The Contractor shall not make any determinations related to an incident associated with the solution maintained by the Contractor in support of the activities authorized by this contract, including determinations related to notification of affected individuals and/or Federal agencies (except reporting criminal activity to law enforcement and offering of services, such as credit monitoring.

The Contractor shall not conduct any internal incident-related review or response activities that could modify or eliminate any existing technical configuration or information or forensic technical evidence existing at the time of the incident without approval from the OPM.

All determinations related to an incident associated with the Contractor’s solution shall be made only by the OPM through the CO or COR.

Maintenance

Maintenance activities for the Contractor’s solution shall be incorporated into the CMP and configuration or change management activities.

The Contractor shall plan for, communicate, and hold maintenance windows occurring not less than monthly for its solution to accommodate system, service, or component maintenance (e.g., upgrades, changes, patching).

Hardware or component disposal shall be conducted in accordance with NIST SP-800-88.

Media Protection

All OPM data from information system media, both digital and non-digital must be sanitized in accordance with NIST SP 800-88, before disposal or transfer outside of OPM control.

All media (e.g., backup media) utilized by the Contractor in support of its solution shall be protected during transport outside of controlled areas using a certified FIPS 140-3 encryption module.

Data stored on media (including documentation) must be protected against unauthorized access, tampering, alteration, loss, and destruction during production, input, output, handling, and storage. Prior to removing CUI from any approved location, electronic device, removable media, or storage container, approval must be received in writing from the OPM.

Physical and Environmental Protection

Physical and environmental security controls shall be commensurate with the level of risk and must be enough to safeguard IT resources against possible loss, theft, destruction, accidental damage, hazardous conditions, fire, malicious actions, and natural disasters.

Servers, routers, and other communication or internetworking hardware essential for maintaining the operability of OPM systems and their connectivity to the OPM infrastructure shall be placed in controlled-access locations.

Visitor access records shall be maintained by the Contractor for facilities containing information systems except for those areas within the facility officially designated as publicly accessible. Visitor access records include: (i) name and organization of the person visiting; (ii) signature of the visitor; (iii) form of identification; (iv) date of access; (v) time of entry and departure; (vi) purpose of visit; (vii) name and organization of person visited, and (viii) signature and name of individual verifying the visitor’s credentials.

IT systems and networks shall be located in areas not in danger of water damage due to leakage from building plumbing lines, shut-off valves, and other similar equipment to support meeting federal and local building codes.

Fire suppression devices, such as fire extinguishers and sprinkler systems, and detection devices, such as smoke and water detectors, shall be installed and operating in all areas where agency IT systems and services are maintained (this includes server rooms, tape libraries, and data centers) to meet federal and local building codes.

Air control devices, such as air-conditioners and humidity controls, shall be installed and operating in all areas where agency IT systems and services are maintained (this includes server rooms, tape libraries, and data centers) to meet federal and local building codes.

Planning

The Contractor shall describe all applicable cybersecurity and privacy controls within a SSP in accordance with OPM guidance.

All controls and enhancements must be described in detail, focusing on how each control or enhancement is implemented. High level general statements or simple repetition of NIST control requirements will not be accepted. For example, if the NIST control requirement reads “The system must uniquely identify all organizational users,” a control implementation description reading “XYZ system uniquely identifies all organizational users” is not acceptable. The Contractor shall explain the specific unique naming convention(s) used throughout the stack, for example “XYZ system uniquely identifies application users by a FirstName.LastName naming convention.”

All technically focused controls must be described by the Contractor for all technologies included in the system boundary. For example, if the target IT system or service contains routers, switches, servers, and web applications, the control implementation descriptions must address each of these four areas. If there is a mix of severs with different operating systems, each operating system type must be addressed.

The Contractor’s SSP shall include:

· Location of system data (all data center names and locations, name of CSP)

· Purpose, functions, and capabilities of the system and business processes supported

· Detailed security architecture, OV-1, and SV-1 equivalent network diagram indicating the system boundary

· Complete listing of all system assets (virtual and physical) including device name and network address

· Complete listing of all system software (operating system, database application, web application, other)

· Internal information data flows and paths within the information system

· Internal Data Dictionary

· Interconnections with external information systems as defined in NIST SP 800-47 and interfaces with external information systems not considered interconnections as defined in NIST SP 800-47-1; periodic or scheduled data transfers (SFTP, API, batch processes, manual data inputs, etc.).

The Contractor’s SSPs shall include architectural details sufficient to understand the network topology, how data flows within and outside the environment, direct and indirect trust relationships where applicable, and operating boundary.

Program Management

The Contractor shall, throughout the lifecycle of this acquisition, maintain all OPM data in a format that is exportable to a comma-delineated format (e.g., .csv). At no time shall the Contractor retain or store OPM data in a proprietary format.

Secure Destruction of All OPM and OPM-Activity-Related Information

As applicable, within sixty (60) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, BUT ONLY after the Contracting Officer (CO) or Contracting Officer’s Representative (COR) has accepted and approved the Contractor’s compliance with the Certification of Verified Return, the Contractor must execute secure destruction of all copies of all OPM and OPM-activity-related files and information (including but not limited to all records, files, and metadata in electronic or hardcopy format) not returned to the OPM and held in possession by the Contractor, by procedures approved by the CO or COR in advance and in accordance with applicable OPM IT Security Policy Requirements, including but not limited to the following:

· provided by the OPM;

· obtained by the Contractor while conducting activities in accordance with the contract;

· distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or

· received from the Contractor by any other related organization and/or any other component or separate business entity.

Within seventy-five (75) days after the end of the contract performance period or after the contract is suspended or terminated by the CO, BUT ONLY after the CO or COR has accepted and approved the Contractor’s compliance with the Certification of Verified Return, the Contractor must provide the CO or COR with Certification of Secure Destruction of all existing active and archived originals and/or copies of all OPM and OPM-activity-related files and information, (including but not limited to all records, files, and metadata in electronic or hardcopy format); by procedures approved by the OPM in advance and in accordance with applicable OPM IT Security Policy Requirements; including but not limited to the following:

· provided by the OPM;

· obtained by the Contractor while conducting activities in accordance with the contract;

· distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or

· received from the Contractor by any other related organization and/or any other component or separate business entity.

Mandatory Requirement for Contractor Return of all OPM-Owned and Leased Computing and Information Storage Equipment

As applicable, within sixty (60) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, or within a time period approved by the Contracting Officer or Contracting Officer’s Representative (COR), the Contractor must return all OPM-owned and leased computing and information storage equipment.

As applicable, within seventy-five (75) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, the Contractor must provide the OPM with Certified Verification of Return of all OPM-Owned and Leased Computing and Information Storage Equipment.

Section 508 Standards

All information technology (IT) procured through this contract must meet the applicable accessibility standards at 36 CFR 1194, unless an OPM exception to this requirement exists. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at https://www.federalregister.gov.

The following standards have been determined to be applicable to this contract:

The OPM is required by Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d), to offer access to IT for disabled individuals within its employment, and for disabled members of the public seeking information and services. This access must be comparable to that which is offered to similar individuals who do not have disabilities. Standards for complying with this law are prescribed by the Architectural and Transportation Barriers Compliance Board.

The final work product must include documentation that the deliverable conforms to the Section 508 Standards promulgated by the US Access Board.

The OPM’s assessment of the Section 508 compliance will control. In the event that additional changes are needed to conform with the OPM’s assessment, the Contractor shall make these changes at no additional charge to the OPM.

Personnel Security

All Contactor employees must consent to screening and sign an access agreement prior to being authorized access to OPM IT systems or Controlled Unclassified Information (CUI); and rescreening according to change in position risk designation or other requirements according to HSPD-12 requirements.

The Contracting Officer (CO) or Contracting Officer’s Representative (COR) approval is required prior to contractor personnel accessing OPM IT systems and CUI.

Procurements for services and products involving facility or system access control must be in accordance with HSPD-12 policy and other applicable Federal regulations.

The Contractor shall inform the OPM of all contractor separations, accessions, transfers, and position changes such that all contractors with network access may be correctly reflected in the agency organizational structure.

The Contractor shall maintain an accurate and up-to-date roster of all contractors with access to the OPM’s enterprise infrastructure, applicable IT system, or service.

All Contractor staff shall be physically present in the United States while logically connecting to OPM compute resources including the Contractor’s solution.

Personally Identifiable Information Processing and Transparency

The Contractor shall obtain explicit approval from the OPM prior to collecting, storing, or processing PII.

The Contractor shall implement mechanisms to monitor the use of PII on a continual basis.

The Contractor shall adhere to privacy guidance, policies, and procedures that govern OPM IT systems, programs or technologies involving PII.

The Contractor shall take reasonable steps to confirm the accuracy and relevance of PII. Such steps may include verifying, editing, and validating PII as it is collected or entered into information systems using automated address verification look-up via Application Programming Interfaces (APIs), checking for typographical errors from manual input, comparison against another source system, and validation from the individual or authorized representative of the individual.

The Contractor shall take reasonable steps to ensure that the collection of PII is consistent with a purpose authorized by law or regulation.

The Contractor shall collect, store, and process the minimum set of PII elements required to support the organizational business process. This may be a subset of the PII the organization is authorized to collect. The Contractor shall further reduce its privacy and security risks by also reducing its inventory of PII, where possible and appropriate.

Where possible, the Contractor shall obtain consent through opt-in, opt-out, or implied consent. Opt-in consent is the preferred method, but it is not always feasible. Opt-in requires that individuals take affirmative action to allow organizations to collect or use PII. Opt-out requires individuals to take action to prevent the new or continued collection or use of such PII.

The Contractor shall ensure that notices including Privacy Act Statements, privacy document postings, and privacy webpage are reviewed and current.

The Contractor shall assist the OPM to ensure the use of PII only for legally authorized purposes and in a manner compatible with uses identified in the Privacy Act and/or in public notices.

The Contractor shall at no time store or process PII in non-production environments for the purpose of test, development, modeling, training, or research. Sanitized or simulated PII may be used per SO approval with review by the agency OPM.

PII shall be stored on network drives and/or in application databases with access controls and shall be made available only to those individuals with a valid need to know.

Risk Assessment

The Contractor shall support cybersecurity and privacy and risk assessments activities before their solution is placed into production, when significant changes are made to the system and every three years, to be reviewed and concurred by the OPM.

The Contractor shall facilitate weekly vulnerability scanning for all components of the Contractor’s solution (physical and virtual, production and non-production environments) using local admin or root equivalent privileges, continuing a continual basis. All critical impact vulnerabilities [Common Vulnerabilities Scoring System (CVSS) version 3.0 Base Score = 10.0] identified must be mitigated within fifteen (15) calendar days from first discovery. All high impact vulnerabilities [7.0 ≤ CVSS Base Score ≤ 9.9] must be mitigated within thirty (30) calendar days from first discovery. All other vulnerabilities [CVSS Base Score < 7.0] must be mitigated within ninety (90) calendar days from first discovery. Vulnerability scanning and remediation processes shall be measurable.

Key Integration Requirement [NIST SP 800-53-5: RA-05, RA-05 (05)] The Contractor’s solution shall have the capability to export its inventory of all components in a comma-delineated electronic format (e.g., .csv), preferably via API or other automated method, into the OPM’s inventory tracking mechanism.

The Contractor shall provide to the OPM, on an ongoing basis, a one-to-one mapping of all identified vulnerabilities to individual assists or components of its solution.

The Contractor shall support all independent vulnerability testing, penetration testing, port scanning, red/blue/purple team exercises, and offensive testing conducted by third parties or other external organizations as specified by the OPM.

Vulnerabilities identified in response to active or suspected exploits, reliable threat intelligence, or other exigent advisories shall be mitigated as rapidly as possible as directed by the OPM.

System and Service Acquisition

The Contractor shall continually implement appropriate safeguards to protect OPM information and information systems from un-authorized access throughout all phases of a contract in accordance with this policy, federal statutes, and directives, and NIST guidance.

The Contractor shall conduct code testing (e.g., static code analysis, dynamic code analysis) on a continual basis and when security- or privacy-related changes occur, incorporating code testing into its Continual Integration/Continual Development (CI/CD) process to the degree possible.

The Contractor notify the OPM immediately upon confirmation of compromised components that are supplied to the OPM.

The Contractor’s solution shall be composed of components (software, hardware, firmware) that are supported by the manufacturer, reseller, community of practice, or by the Contractor itself.

The Contractor shall monitor the supportability of all components and identify possible components that are nearing end-of-life or end-of-support and identify cost-effective and supportable alternatives.

System And Communication Protection

The Contractor shall be enforced for all OPM data at rest and in transit. This includes on premises, virtual and cloud-based implementations, backup media, removable media, authentication channels and authenticators, information exchanges (e.g., interconnections), web portals, and remote access implementations. Encryption shall adhere to FIPS standards and recommendations.

The Contractor shall enforce Transport Layer Security (TLS) encryption for all web-based content and enable Hyper Text Transfer Protocol Strict Transport Security (HSTS). TLS versions shall be evaluated periodically to support the more recent versions of TLS and disable weak or deprecated versions as identified by the OPM.

For system and service perimeter protection mechanisms the Contractor shall implement a deny-by-default allow-by-exception configuration such that transitive trust is minimized where practicable. Micro and macro segmentation shall be implemented to the extent practicable. Resources intended for public accessibility are exempt from this requirement.

All information technology (IT) functionality, capabilities, and features must be supported and operational in both a dual-stack IPv4/IPv6 environment and an IPv6 only environment. Furthermore, all management, user interfaces, configuration options, reports, and other administrative capabilities that support IPv4 functionality will support comparable IPv6 functionality. The Contractor is required to certify that its products have been tested to meet the requirements for both a dual-stack IPv4/IPv6 and IPv6 only environment. The Contracting Officer (CO) or Contracting Officer’s Representative (COR) reserves the right to require the Contractor’s products to be tested within an OPM or third-party test facility to show compliance with this requirement. All costs and resource allocations required for this third-party service must be the sole responsibility of the Contractor. Compliance certification shall be provided in writing to the CO or COR.

System and Information Integrity

Data integrity and validation controls shall be implemented on all components of the Contractor’s solution.

The Contractor’s solution shall have up-to-date malware and end-point protection software.

Key Integration Requirement [NIST SP 800-53-5: SI-03] The Contractor’s solution shall be designed and have the capability to integrate with the OPM’s existing SIEM capabilities, providing continuous visibility into the anti-malware status, activity, and management for all components of the solution.

The Contractor shall implement controls to monitor or detect changes or updates to systems that are outside the parameters of a system’s baseline operating characteristics. This includes the ability to monitor resource usage, allocation, user activity, indications of fraud, misconduct, or other irregularities.

Key Integration Requirement [NIST SP 800-53-5: SI-04] The Contractor shall facilitate continuous real-time feeds to the OPM SIEM, preferably via encrypted API, for all monitoring activities across the Contractor’s solution.

Patch management for all IT systems and services shall be conducted not less than monthly. Patch management and remediation processes shall be measurable.

Key Integration Requirement [NIST SP 800-53-5: SI-02] The Contractor shall facilitate weekly feeds to the OPM, preferably via encrypted API, for all patch and vulnerability management activities across the Contractor’s solution.

The Contractor’s patch management capabilities shall have the ability to aggressively respond to exigent circumstances such as active exploits, binding operational directives, emergency directives, as directed by the OPM.

Supply Chain Risk Management

Supply chain risk management techniques shall be implemented by the Contractor for the inspection of components, determination of component authenticity, and change controls for component repair or service in alignment with guidance from the OPM.

The Contractor shall immediately notify the OPM upon confirmation of compromised components that are supplied to the OPM.

Schedule of Deliverables and Frequencies

Maintenance of the security authorization will be through continuous monitoring of cybersecurity controls of the Contractor’s solution to determine if the cybersecurity controls continue to…