Attachment 9 - Security Compliance Requirements Questionnaire.docx

CUI//SP-PROCURE//FED ONLY

ATTACHMENT 9 – SECURITY COMPLIANCE REQUIREMENTS QUESTIONNAIRE

1) Offeror must confirm all technology and information transmitted and maintained to originate and remain within the United States for the duration of the contract. In addition, the Offeror must affirm that all persons having access to the OCC’s CUI, PII, sensitive data be U.S. citizens or have lawful permanent resident alien status (e.g., green card holders).

2) Offeror to provide a security architecture diagram of all its proposed Life Insurance technology product system components.

As part of the Contractor’s proposal, the security architecture diagram requirements as listed in this paragraph should be for a typical customer, as opposed to specifically OCC.

After contract award, the Contractor shall provide a security architecture diagram(s) specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all its connections, ports, protocols, functions, services, and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The Contractor shall address all components, connections, ports, protocols, security controls, and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary. If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the Offeror’s existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The Contractor shall provide a key for symbols used. This diagram shall be delivered to the OCC Group Life Insurance COR, Enterprise Architect, and Information System Security Officer.

3) Offeror must provide its latest SOC 2 Type II Report (July 1, 2024 through June 30, 2025 or prior year) and, as applicable, associated Bridge Letter from the date of the last SOC 2 Report to date of submission.

4) Offeror must provide a configuration management plan or policy that addresses configuration settings, updates, and relevant functions to its proposed Life Insurance technology product.

5) Offeror must confirm the ability to timely allow access to its facilities, installations, records and databases pertinent to the resulting contract for performing compliance reviews and audits when necessary. If applicable and feasible, the Offeror must provide its FedRAMP authorization number, if applicable and an attestation to confirm Event Logging Maturity Level 3 (EL3) of OMB M-21-31 is met.

6) Offeror must provide its encryption method, which should be compliant with or superior to Federal Information Processing Standards (FIPS) Publication 140-3.

7) Offeror must demonstrate its incident reporting protocols/procedures; specifically transmitting incident notices and reports, including and not including sensitive information, within 1 hour of incident occurrence.

8) Offeror must provide a plan for OCC data/information removal, destruction, and transmission of files at time of contract completion, while also outlines the protocol for encrypting data/information via electronic transmission (i.e., email). This plan should be compliant with the latest version of NIST 800-88 Guidelines for Media Sanitization.

9) Offeror must demonstrate its supply chain risk management plan for remediating vulnerabilities and mitigating risks of its proposed Life Insurance technology product for safeguarding OCC CUI, PII, and other sensitive data/information, while also monitoring individuals’ access within its supply chain of incoming and outgoing data/information and requests (e.g. background investigations/screening of individuals and partners, in-house versus third-party processing, implementation of access restrictions and privacy controls, customization and configuration limitations, approving/vetting of multiple suppliers’ processes). This plan should be compliant with NIST SP 800-171r3 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.