ATTACHMENT 4 - DRAFT OIT Security Questionnaire for eFeeds Offerors.pdf

Office of Information Technology

Attachment to Solicitations: Information Technology Security Proposal Questions for All Contractors/Offerors

The following Information Technology checklist must be completed as part of any proposal or other offer.

All offerors must respond to the questionnaire fully in order to submit a complete proposal or offeror or bid. Incomplete or missing checklists shall render a proposal incomplete and shall disqualify it from further consideration by the Agency.

In completing the checklist, you can assume that if the answer to a question does not redirect you to a new question further down the checklist, you should proceed to the next question until you obtain the final concurrence signatures.

“Solution” is the Proposal’s response to the requirements in the solicitation.

[Instructions: Please ensure all applicable questions are completed and remove all instructions in [brackets] before submitting to include this information]

1. Does the solution provide IT products or services? Yes ☐ No ☐ If response to this question is “Yes”, please provide responses for 1a – 1f and then continue to question 2.

If response to this question is “No”, this IT Questionnaire is complete - no further answers are needed at this time - and it is ready for submission.

R e s p o n s e

a. Describe the IT products or services, including whether this a purchase of an existing off the shelf (commercial purchase) or GSA scheduled item or service. Afterward, continue answering subparts b through f of this question.

b. What is the intended use of these products or services in the proposal?

c. Will the proposal involve storing, transmitting, or processing non-public SEC information including information subject to the Privacy Act? What SEC information will be provided to the contractor? What information will the contractor provide to the SEC during the performance of the contract?

d. What information will be in the possession of the contractor and the SEC at the conclusion of the contract?

e. How will the contractor release data created under the contract to the SEC at the termination of the contract?

f. What are the expectations if there is a breach or loss of control by the contractor of information in this contract?

Attachment 4: DRAFT OIT Security Questionnaire for eFeeds Offerors

2. Does the solution meet all standards listed below for IT Security and Privacy? Yes ☐ No ☐

If response to this question is “No”, please provide responses for 2a – 2b.

If yes, proceed to question 3.

Response

IT Security ☐ 6001.00 SEC Non-Disclosure Requirements and Agreements ☐ 6001.01 Restrictions on Use, Disclosure, and Duplication of Confidential and Non-Public

Information ☐ 6012.00 Security and Privacy Act Matters ☐ 6012.05 Personally Identifiable Information (PII) ☐ 6013.00 Common Security Configurations ☐ 6013.01 Federal Requirements, Security, and Accessibility for Information Systems

Personally Identifiable Information (PII) ☐ 6017.00 Communicating Non-Public or Sensitive Information ☐ 6023.00 U.S. Citizenship

Cloud-Based Services ☐ 6022.00 FedRAMP Security Requirements for Cloud-Based Services

FAR Clauses ☐ 52.204-21 Basic Safeguarding of Covered Contractor Information Systems ☐ 52.227-14 Rights in Data-General ☐ 52.227-15 Representation of Limited Rights Data and Restricted Computer Software ☐ 52.227-16 Additional Data Requirements ☐ 52.227-17 Rights in Data-Special Works ☐ 52.227-18 Rights in Data-Existing Works ☐ 52.239-1 Privacy or Security Safeguards

a. What are the gaps (which instructions, FAR clauses, etc...) in meeting applicable IT security and Privacy requirements?

b. How and when will these gaps be addressed?

3. Does the solution use cloud services? Yes ☐ No ☐ If response to this question is “Yes”, please provide responses for 3a – 3j.

If no, proceed to question 4.

Response

a. Does the solution have a FedRAMP ATO? If NO, please explain the current level of progress toward meeting the proposals, sufficient to obtain an authorization to operate (ATO), as described in 6013.01 and 6022 for the IT system/services to be provided to SEC as part of the proposal.

b. Has the solution been independently assessed by a 3rd party against the NIST SP 800-53r4 FISMA/FedRAMP Moderate control baseline?

c. Have any Federal Agencies issued an ATO for the solution?

d. Has the solution been independently assessed by a 3rd party against any other information security standards e.g. CoBIT, ISO/IEC or SSAE-18/SOC2?

e. Can the SEC review the security controls documentation and/or the results of an independent 3rd party assessment of those security controls?

f. Is the solution FIPS compliant?

g. Is the solution’s system/service able to enforce TLS 1.2?

h. Is the solution’s system/service able to support encryption of data at-rest and in-transit?

i. Does the solution support multifactor authentication?

j. By what means does the SEC establish a connection? E.g.

Browser, VPN, client app, mobile app, SSH, SFTP, etc.

4. Does the solution provide software? Yes ☐ No ☐ If response to this question is “Yes”, please provide responses for 4a – 4j.

If no, proceed to question 5.

Response

a. Has the software previously been evaluated by the federal government? Has it previously been approved or denied for use?

b. What is the country of origin? What country is the manufacturer based?

c. Can the pedigree of the software be established? Briefly explain what is known of the people and processes that create and maintain the software.

d. How long has the software been available? Is there an active user community providing peer review and actively evolving the software?

e. Does software have a positive reputation? Does software have a positive reputation relative to security? Is there history of vulnerability exploitation?

f. Is source code closed (proprietary) or open and available for inspection?

g. Does the software include mechanisms to collect and transmit data to external entities including the manufacturer -e.g. licensing servers, software updates, diagnostics, etc.? Are these features optional?

h. Has the software been subject of any independent security assessments? Are the results of those assessments available for SEC to review?

i. Is the software intended to be installed on servers, workstations, or both?

j. Does the software require specific ports, protocols or other parameters that could require changes to the SEC operating environment – e.g. firewall rules?

5. Does the requirement involve purchasing hardware? Yes ☐ No ☐ responses for 5a – 5h.

If no, proceed to question 6.

Response

a. Has the hardware previously been evaluated by OIT? Has it previously been approved or denied for use? Has there been any supply chain risk analysis conducted?

b. What is the country of origin? What country is the manufacturer based?

c. Has the hardware been subject of any independent security reviews? Are the results of those reviews available?

d. Is the solution FIPS compliant?

e. Is the system/service able to enforce TLS 1.2?

f. Is the system/service able to support encryption of data at-rest and in-transit?

g. Does the solution support multifactor authentication?

h. Does the hardware require specific ports, protocols, infrastructure changes, or other parameters that could require changes to the SEC operating environment – e.g. firewall rules?

6. Does the solution provide IT labor support services? Yes ☐ No ☐ responses for 6a – 6c. Response

a. Will any contract personnel involved in this acquisition perform a function/role that requires access to a system(s) that processes non-public or sensitive SEC data?

b. Will any contract personnel involved in this acquisition perform a function/role that requires privileged access to SEC systems?

c. Will any off-site support personnel be located outside of the United States? If yes, where?