Attachment 5 - Applicable standards and references SAM posting.pdf

U.S. Department of Justice Federal Bureau of Prisons Administration Division National Acquisitions Section Washington, D.C. 20534

ATTACHMENT 5

Applicable Laws, Regulations, Standards, and Government Policies

Enterprise First Step Act (FSA) Time Credit Management Solution

1. Purpose

This attachment identifies the principal Federal laws, regulations, standards, and Government policies applicable to performance of this contract.

The Contractor shall comply with all applicable Federal statutes, regulations, Executive Orders, Government-wide policies, Department of Justice (DOJ) directives, Federal Bureau of Prisons (BOP) policies, and contract requirements in effect during contract performance.

Nothing contained in this attachment limits the Contractor's responsibility to comply with additional requirements identified elsewhere in the solicitation or resulting contract.

2. Federal Acquisition Requirements

The Contractor shall comply with all applicable acquisition statutes, regulations, and contract requirements, including, but not limited to:

• Federal Acquisition Regulation (FAR)

• Department of Justice Acquisition Regulation (DJAR)

• Solicitation provisions and contract clauses incorporated into the contract

• Applicable contract modifications issued during contract performance

3. Information Security and Cybersecurity

The Contractor shall comply with applicable Federal information security requirements, including, as applicable:

• Federal Information Security Modernization Act (FISMA)

• NIST Risk Management Framework (RMF)

Administration Division

• NIST Special Publication (SP) 800-53, Security and Privacy Controls for Information Systems and Organizations

• NIST SP 800-37, Risk Management Framework

• NIST SP 800-61, Computer Security Incident Handling Guide

• Federal Information Processing Standards (FIPS) Publication 140-3, Security Requirements for Cryptographic Modules, as applicable

• Department of Justice cybersecurity requirements

• Bureau of Prisons information security policies

• Continuous monitoring requirements

• Secure system configuration

• Identity, Credential, and Access Management (ICAM)

• Security logging and audit capabilities

• Vulnerability management

• Incident reporting and response

4. Privacy and Records Management

The Contractor shall comply with all applicable privacy and records management requirements, including, as applicable:

• Privacy Act of 1974

• E-Government Act of 2002

• Federal records management requirements

• National Archives and Records Administration (NARA) requirements

• DOJ and BOP records management policies

• Protection of Personally Identifiable Information (PII)

• Confidentiality of Government information

Administration Division

• Records retention and disposition requirements

5. Accessibility

The Contractor shall ensure that all applicable software, user interfaces, documentation, reports, dashboards, training materials, and electronic content comply with Section 508 of the Rehabilitation Act, as amended, and applicable Federal accessibility standards.

6. Business Rules Governance

The Government retains sole responsibility for:

• Interpretation of Federal statutes.

• Interpretation of Federal regulations.

• Interpretation of Department of Justice policy.

• Interpretation of Federal Bureau of Prisons policy.

• Approval of operational business rules.

• Approval of changes to business rules.

• Approval of Government business processes supporting First Step Act Time Credit administration.

The Contractor shall configure, implement, maintain, and document only those business rules approved by the Government.

Nothing in this contract authorizes the Contractor to independently interpret statutes, regulations, judicial decisions, or Department of Justice or Bureau of Prisons policies.

7. Software Licensing

The Contractor shall provide, maintain, and administer all commercial software licenses necessary to perform the contract unless otherwise specified by the Government.

Administration Division

The Contractor shall ensure that all software, third-party components, and supporting technologies used in contract performance are properly licensed and authorized for Government use.

8. Data Rights and Intellectual Property

The Contractor shall comply with all contract provisions governing:

• Data rights

• Intellectual property

• Proprietary information

• Confidential business information

• Government purpose rights, restricted rights, or other applicable license rights as specified in the contract

Nothing contained in this attachment modifies the data rights established by the resulting contract.

9. Enterprise Architecture and Interoperability

The Contractor shall implement the solution consistent with applicable Federal and Department of Justice enterprise architecture principles.

The solution shall support interoperability with Government systems through documented interfaces, standard communication protocols, and commercially supported integration capabilities identified in the solicitation.

10. Order of Precedence

In the event of any inconsistency between this attachment and the resulting contract, the terms and conditions of the contract shall govern.

This attachment identifies applicable authorities and does not supersede any statute, regulation, contract clause, Executive Order, or other legally binding requirement.

Administration Division

11. Changes to Applicable Authorities

During contract performance, the Contractor shall comply with applicable Federal statutes, regulations, Executive Orders, Government-wide policies, Department of Justice requirements, and Bureau of Prisons policies that become effective and are incorporated into the contract through applicable contract clauses or authorized contract modifications.