Attachment 3.pdf
PDF 20 KB Posted
- Solicitation number
- HT001426RE008
- Issued by
-
Defense Health Agency
About this file
This is an attachment to a federal contract opportunity that specifies cybersecurity regulations and guidance requirements for vendors.
The vendor is required to use and comply with the most recent published versions of all referenced cybersecurity standards and regulations, along with any regulations or guidance referenced within those publications. The requirements span five major categories of federal guidance: United States Law (HIPAA, FISMA, and the E-Government Act of 2002); Office of Management and Budget publications (OMB Circular A-130 and Guidance M-05-24 regarding HSPD-12); National Institute of Standards and Technology publications (NIST SP 800-37, 800-39, 800-53, and 800-60); Federal Information Processing Standards (FIPS PUB 140-2, 199, 200, and 201-2); Department of Defense instructions covering personnel security, cybersecurity, public key infrastructure, risk management framework, ports/protocols/services management, and health information privacy; and Defense Health Agency publications addressing facility-related control systems security. These requirements indicate the contract involves handling federal information systems, potentially DoD or healthcare-related systems, and requires vendors to maintain compliance with current federal security standards across cryptography, access control, risk management, and facility systems protection.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment 2- questions - answers.docx | DOCX document | |
| Solicitation - HT001426RE008 SF 1449.pdf | ||
| Attachment 5 - questions - answers.docx | DOCX document | |
| Attachment 4 questions-answers.docx | DOCX document | |
| Attachment 1 - questions-answers.docx | DOCX document | |
| Attachment 6 questions- answers.docx | DOCX document | |
| Attachment 3 - questions - answers.docx | DOCX document | |
| LenelS2 and Milestone - Instructions to Offerors.docx | DOCX document | |
| New Employee Handbook.pdf | ||
| Attachment 5.pdf | ||
| Evaluation Factors.docx | DOCX document | |
| PWS_Lenel and Milestone On-Site Maintenance Support Services.docx | DOCX document | |
| DHA CAC Request Process.pdf | ||
| DHA Annual Training List.pdf | ||
| Attachment 4.pdf | ||
| Attachment 2.docx | DOCX document |
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Attachment 3
Cybersecurity Regulations and Guidance
The Vendor shall use and comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:
(a) United States Law
(i) The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
(ii) The Federal Information Security Management Act (FISMA)
(iii) The E-Government Act of 2002
(b) Office of Management and Budget (OMB)
The following publications are located at https://www.whitehouse.gov/omb/agency/default
(i) Circular A-130
(ii) Guidance M-05-24, Implementation of Homeland Security Presidential Directive
(HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors
(c) National Institute of Standards and Technology (NIST) The following publications are located at http://www.nist.gov/publication-portal.cfm
(i) NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management
Framework (RMF) to Federal Information Systems
(ii) NIST SP 800-39—Managing Information Security Risk: Organization, Mission and
Information System View
(iii) NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations
(iv) NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories
(d) Federal Information Processing Standards (FIPS) The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm
(i) FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic
Modules
(ii) FIPS PUB 199 – Standards for Security Categorization of Federal Information and
Information Systems
(iii) FIPS PUB 200: Minimum Security Requirements for Federal Information and
Information Systems
(iv) FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors
(e) Department of Defense (DoD)
The following publications are located at http://www.dtic.mil/whs/directives/
(i) DoD Instruction 5200.2, DoD Personnel Security Program (PSP)
(ii) DoD Instruction 8500.1, Cybersecurity https://www.whitehouse.gov/omb/agency/default http://www.nist.gov/publication-portal.cfm http://www.nist.gov/itl/fipscurrent.cfm http://www.dtic.mil/whs/directives/
(iii) DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling
(iv) DoD Instruction 8510.01, Risk Management Framework Process (RMF)
(v) DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)
(vi) DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs
(vii) DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in
DoD Health Care Programs
(viii) DoD Directive 5400.11, DoD Privacy Program
(f) The following publications are located at https://home.facilities.health.mil/low-voltage-system.
(i) DHA PM Standard Isolation Architecture for Cybersecurity of FRCS
(ii) Security Categorization for Facility-Related Control Systems (FRCS)
(iii) Facility-Related Control Systems (FRCS) Overlay
(iv) Standard Operating Procedure (SOP) for Facility-Related Control Systems (FRCS)
Assessments
(v) Guidance for Facility-Related Control Systems (FRCS) Continuous Monitoring https://home.facilities.health.mil/low-voltage-system
File details come from the government source that posted it. Updated .