Attachment J-2 Contractor Compliance with SOW.docx

This is a contractor compliance checklist attachment to a solicitation for Location Tracking Services Utilizing GPS and Related Technologies for the Court Services and Offender Supervision Agency (CSOSA) under Solicitation 9594CS26Q0016.

The attachment requires all offerors to certify compliance with comprehensive security and information assurance requirements outlined in Section C.13 of the Statement of Work. Key compliance areas include: adherence to FISMA, OMB A-130, DHS directives, and NIST standards; implementation of NIST SP 800-53 Moderate baseline controls; preparation of Security Authorization Packages per NIST SP 800-37 using FedRAMP templates where applicable; support for continuous monitoring, penetration testing, and security assessments; maintenance of Plans of Action and Milestones (POA&M) with defined mitigation timelines (High priority within 30 days, Moderate within 90 days); provision of system access within 72 hours for authorized scans and audits; protection of Controlled Unclassified Information (CUI) with off-site protection equivalent to on-site standards; FedRAMP baseline implementation with documented continuous monitoring strategy; and engagement of accredited Third Party Assessors (3PAO) for significant system changes. Additional requirements include physical security of facilities, data availability within one business day, incident response cooperation at contractor expense, and CSOSA retention of data ownership with right to obtain full copies on request. Offerors must provide accurate and truthful responses to all compliance certifications, with failure to do so potentially resulting in quote rejection or contract termination.