Attachment J.2 - Critical Infrastructure Protection and Information Assurance.docx

Attachment J.2

CRITICAL INFRASTRUCTURE PROTECTION AND

INFORMATION ASSURANCE

1. Security Management

The Offeror shall implement a security management program to ensure compliance with FMCSA requirements and DOT-specific supplemental controls as applicable to prevent disruption of the cloud services environment (CSE), prevent unauthorized access to FMCSA information, and minimize threats to FMCSA data or operations. The Offeror shall perform the required Security Management functions for each computing environment.

1.1 Applicability

The Offeror shall be responsible for Information Technology security for all systems connected to a FMCSA network or operated by the Offeror for FMCSA, regardless of location. This clause is applicable to all or any part of the task order that includes information technology resources or services in which the Offeror has physical or electronic access to FMCSA information that supports the mission of FMCSA. The term information technology, as used in this clause, means any equipment or interconnected system or subsystem of equipment, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general supports systems as defined by OMB Circular A-130.

1.2 Security Categorization

In accordance with FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems,” FMCSA has determined that the security category of the information or information systems housed within the CSE is HIGH. The Offeror shall tailor an appropriate set of baseline security requirements as outlined in NIST Special Publication (SP) 800-53, “Recommended Security Controls for Federal Information Systems”, and the Center of Internet Security (CIS) guidelines (Level 1 for internal systems and Level 1&2 for external facing systems).

1.3 IT Security Assessment and Authorization

All covered Offeror systems/applications shall have a valid security assessment and authorization signed and approved by FMCSA in accordance with the DOT Departmental Cybersecurity Compendium, before going into operation and/or processing FMCSA information. While operational, the system shall be re- assessed on an annual basis to ensure the system maintains a valid authorization, signed and approved by FMCSA. The Offeror shall prepare and submit documents necessary to support security assessment activities and authorization of any covered systems no less than 90 days prior to initial operation and processing of FMCSA information. These documents shall be updated on an annual basis. The security assessment and authorization documents listed below shall be consistent in form and content with the approved FMCSA format. In accordance with the DOT Security Authorization and Continuous Monitoring Performance Guide, approximately one third of the security controls for each Information system shall be assessed yearly. The exact security controls to be assessed can be found in the system’s approved Continuous Monitoring Plan. In the event there is a significant change to the system’s security posture the entire security authorization shall be reassessed in accordance with NIST SP 800-37, and the DOT Departmental Cybersecurity Compendium. The Offeror shall provide the necessary support to ensure the security assessment is completed prior to the system authorization expiration date.

In support of the security assessment and authorization, the Offeror shall submit to the COR the following documents:

a. System Development Life Cycle - The Offeror shall prepare and provide System Development Life Cycle security consistent in form and content with NIST SP 800-64, “Security Considerations in the System Development Life Cycle”, and NIST SP 800-27, “Engineering Principles for Information Technology Security (A Baseline for Achieving Security)”and any additional guidance contained in the DOT Departmental Cybersecurity Compendium.

b. Security Architecture Design Document - The Offeror shall prepare and provide Security Architecture Design Document consistent in form and content with NIST SP 800-64, “Security Considerations in the System Development Life Cycle”. The Security Architecture Design Document is a schematic of security integration providing details on where, within the system, security is implemented and shared. Security architectures should be graphically depicted and detailed to the extent the reader can see where the core security controls are applied and how. The Security Architecture Design Document shall be updated on an annual basis to reflect any changes.

c. Configuration Management Plan – The Offeror shall prepare and provide a Configuration Management Plan consistent in form and content with NIST SP800-128, “Guide for Security- Focused Configuration Management of Information Systems” and NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control CM-9. The Configuration Management Plan for the information system should:

i. Address roles, responsibilities, and configuration management processes and procedures;

ii. Define the configuration items for the information system and when in the system development life cycle the configuration items are placed under configuration management; and

iii. Establish the means for identifying configuration items throughout the system development life cycle and a process for managing the configuration of the configuration items.

d. System Security Plan (SSP) – Prepare consistent in form and content with NIST SP 800-18, “Guide for Developing Security Plans for Federal Information Systems.” The SSP shall include as appendices required policies and procedures across 18 control families mandated per FIPS 200, Rules of Behavior, and Interconnection Agreements, consistent with NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems.” The SSP shall also address the controls specified in NIST SP 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach” and NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” and the DOT Departmental Cybersecurity Compendium. The SSP should describe the security controls in place or planned for meeting those requirements. The SSP shall be updated on an annual basis.

e. Security Assessment Plan and Report - The Offeror shall support the independent third-party assessor in the creation of the Security Assessment Plan (SAP) in support of the annual security authorization process for the delivered information system consistent with NIST 800-53, “Recommended Security Controls for Federal Information Systems” control SA-11.

f. Information System Documentation – The Offeror shall:

i. Create and provide documentation for the information system that describes:

1) Secure configuration, installation, and operation of the information system;

2) Effective use and maintenance of security features/functions; and

3) Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions

ii. Create and provide user documentation for the information system that describes:

1) User-accessible security features/functions and how to effectively use those security features/functions;

2) Methods for user interaction with the information system, which enables individuals to use the system in a more secure manner;

3) User responsibilities in maintaining the security of the information and information system; and

4) Documents attempts to obtain information system documentation when such documentation is either unavailable or nonexistent.

g. FIPS 199 Assessment – The FIPS 199 assessment shall identify all information types as well as the “high water mark,” as defined in FIPS 199, of the processed, stored, or transmitted information necessary to fulfill the contractual requirements.

h. Contingency Plan (including Disaster Recovery Plan) – Prepared consistent in form and content with NIST SP 800-34, “Contingency Planning Guide for Information Technology Systems”, and any additional guidance contained in the DOT Departmental Cybersecurity Compendium. Consistent with NIST SP 800-34, “Contingency Planning Guide for Information Technology Systems”. The Contingency Plan shall be updated on an annual basis.

i. Business Impact Assessment - As part of the Contingency Plan, the Offeror shall perform a Business Impact Assessment prior to the system delivery, and when significant changes are introduced. The Business Impact Assessment shall be updated on a yearly basis.

1.4 Security Assessment and Authorization Activities

The Offeror shall allow an FMCSA designated independent third party assessor, also known as a 3PAO, to conduct the initial and subsequent annual security assessment and authorization activities to include control reviews in accordance with NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” and NIST SP 800-53A, “Guide for Assessing the Security Controls in Federal Information Systems” and the DOT Departmental Cybersecurity Compendium. In accordance with NIST guidance, the third-party offeror shall be an impartial assessor of the system. Impartiality implies that assessors are free from any perceived or actual conflicts of interest with regard to the development, operation, or management of the organizational information systems under assessment or to the determination of security control effectiveness. To achieve impartiality, assessors should not:

a. Create a mutual or conflicting interest with the organizations where the assessments are being conducted;

b. Assess their own work;

c. Act as management or employees of the organizations they are serving; or

d. Place themselves in positions of advocacy for the organizations acquiring their services. Review activities include, but are not limited to, operating system vulnerability scanning, web application scanning, database scanning, and integrity verification scans of applicable systems that support the processing, transportation, storage, or security of FMCSA information. This includes the general support system infrastructure.

Identified gaps between required NIST 800-53, “Recommended Security Controls for Federal Information Systems” controls and the Offeror’s implementation, as documented in the Security Assessment/Risk Assessment report, shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) completed in accordance with DOT Departmental Cybersecurity Compendium. Depending on the severity of the gaps, FMCSA may require them to be remediated before an Authorization to Operate is issued.

The Offeror is responsible for mitigating all security risks found during the initial and annual security assessment and authorization. All critical and high vulnerabilities found during the initial and annual assessments shall be mitigated immediately. During continuous monitoring activities, the following guidance applies: Remediate within 30 days for critical, 30 days for high, 60 days for medium, 90 days for lows and at the discretion of the Authorizing Official for informational vulnerabilities.

The Offeror shall provide support for an Independent Security Assessment/Risk Assessment in accordance with NIST SP 800-137 - “Information Security Continuous Monitoring for Federal Information Systems and Organizations” and the DOT Departmental Cybersecurity Compendium for the annual security assessment and authorization activities.

1.5 Annual Security Controls Assessment

Information systems shall be assessed yearly or whenever there is a significant change to the system’s security posture in accordance with NIST SP 800-37, and the DOT Departmental Cybersecurity Compendium. The annual security controls assessment testing requirement has been interpreted by OMB as being within 365 calendar days of the prior test. Over a 3-year period, all DOT Minimum Security Controls applicable to a system or application shall be tested. This means a subset (no less than one- third [1 /3]) of the minimum security controls shall be tested each year so that all security controls are tested during a 3-year period. In an effort to standardize testing and results summarization, a 3-year rotation of control families was established by FMCSA. As control families are added or removed, FMCSACIO reserves the right to change the controls that shall be tested each year. To fulfill the annual FMCSA validation obligation, the annual security control assessment shall be conducted by an FMCSA impartial independent agent or team. It is the responsibility of FMCSA to procure the services of an independent third party assessor to ensure impartiality from the Offeror managing the accredited system. Impartiality implies that the assessors are free from any perceived or actual conflicts of interest with respect to the development, operation, and/or management chain of command associated with the information system or to the determination of DOT Minimum Security Controls effectiveness. All management-directed and independent testing conducted within 365 days of the attestation due date may be used to meet the requirement for the annual security controls (i.e., annual security control assessment) testing. Upon successful completion of the Independent Security Assessment/ Risk Assessment, FMCSA (in coordination with the information system Program Manager and Information System Security Manager (ISSM)) will communicate an authorization decision to the Authorizing Official to accept or deny assigned risks.

a. Continuous Monitoring - The Offeror shall facilitate a consistent approach to managing security risks for FMCSA IT systems in accordance with National Institute of Standards and Technology (NIST) Special Publication 800-37 (as amended), Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, National Institute of Standards and Technology Special Publication 800-137 (as amended), Information Security Continuous Monitoring for Federal Information Systems and Organizations, DOT Security Authorization and Continuous Monitoring Performance Guide, and FMCSA Continuous Monitoring Plan. The Offeror shall provide oversight and monitoring of security controls for managing all systems and software operated by the Offeror. The Offeror shall develop methods for advising and auditing operational and business practices so as to ensure due diligence and provide adequate security for the systems under their control or responsibility.

The Offeror shall report on all assets within the FMCSA system accreditation boundary on an ongoing basis and inform the COR and ISSM when changes occur that may impact the security of the system. The Offeror shall perform review activities to include, but are not limited to, weekly operating system vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, or security of FMCSA information using the relevant tools as required and directed by the ISSM, identify deficiencies and make recommendations for remedies to the ISSM. The Offeror shall develop the reporting processes necessary to provide FMCSA ISSM and Management with real-time visibility and scoring of the security posture and its assets.

For Offeror developed, third-party procured web or application software, and static code scanning software in accordance with the DOT Cyber Compendium Risk Assessment Policy RA-5, the offeror shall be responsible for testing coding errors prior to deployment using automated static code analysis software. If source code is not available, the offeror shall test the compiled code using a static binary analysis tools. A static code scan shall be conducted whenever there is a change to the source code or as part of the annual system security assessment.

The Offeror shall provide the relevant tools necessary for the execution of system security continuous monitoring to ensure completion of the above tasks.

a. Contract Compliance - Upon approval by FMCSA, the Systems Security Plan, Configuration Management Plan, Incident Response Plan, Software Development Life Cycle Methodology, FIPS 199 Assessment, and Contingency Plan, including any required updates, shall be incorporated into the contract file as compliance documents. The Level of Effort for the security assessment and authorization is based on the System’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization.

b. Availability of Documents and Access - The Offeror shall provide FMCSA (or FMCSA independent third party assessor) access to the Offeror’s and subcontractors’ facilities, installations, operations, documentation, databases, and personnel used in performance of resulting task orders. Access shall be provided to the extent required to carry out physical security site assessments, investigations, and/or audits to safeguard against threats and hazards to the integrity, availability, and confidentially of FMCSA information or to the functions of information technology operated on behalf of FMCSA, and to preserve evidence of computer crime. To facilitate mandatory reviews, the Offeror shall ensure appropriate compartmentalization of FMCSA information, stored and/or processed, either by information systems in direct support of the Offeror or that are incidental to the resulting task orders.

1.6 Annual Deliverables

The Offeror shall provide, on an annual basis, the following deliverables to the FMCSA COR:

a. Updated Security Assessment and Authorization documentation - Including the System Security Plan, Plan of Action and Milestones, Business Impact Assessment, and Contingency Plan.

i. System Security Plan - Reference: NIST 800-53, “Recommended Security Controls for Federal Information Systems” control PL-2 - Offeror shall Develop a security plan for the information system that:

1) Is consistent with the organization’s enterprise architecture;

2) Explicitly defines the authorization boundary for the system;

3) Describes the operational context of the information system in terms of missions and business processes;

4) Provides the security categorization of the information system including supporting rationale;

5) Describes the operational environment for the information system;

6) Describes relationships with or connections to other information systems;

7) Provides an overview of the security requirements for the system;

8) Describes the security controls in place or plans for meeting those requirements including a rationale for the tailoring and supplementation decisions;

9) Is reviewed and approved by the Authorizing Official or designated representative prior to plan implementation

10) Is reviewed annually;

11) Includes updates to the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and

12) Is in accordance with NIST 800-18, “Guide for Developing Security Plans.”

ii. Contingency Plan Test - Reference: NIST 800-53, “Recommended Security Controls for Federal Information Systems” control CP-2 – The Offeror shall provide an annual update to the contingency plan completed in accordance with NIST 800-34, “Contingency Planning Guide.” The Offeror shall perform a yearly Contingency Plan Test and provide a report detailing the results of the test to FMCSA ISSM and COR.

iii. Disaster Recovery Plan Test - The Offeror shall also perform a full functional Disaster Recovery Test every year and provide a report (Deliverable XX) detailing the results of the test to FMCSA ISSM and COR. For any new systems, the Offeror shall ensure the Disaster Recovery Test is performed prior to implementation. The Offeror shall train personnel in their contingency roles and responsibilities with respect to the information system and provides refresher training annually.

iv. FIPS 199 Assessment – The Offeror shall provide an update to the FIPS 199 assessment which shall identify all information types as well as the “high water mark,” as defined in FIPS 199, of the processed, stored, or transmitted information necessary to fulfill the contractual requirements.

v. User Authorization Review Documents - Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” controls AC-2 – The Offeror shall provide the results of their monthly review and validation of system users’ accounts to ensure the continued need for system access. The user authorization documents will describe how the organization establishes, activates, modifies, reviews, disables, and removes information system accounts in accordance with documented account management procedures.

vi. Separation of Duties Matrix - Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control AC-5 - The Offeror shall develop and furnish a separation of duties matrix reflecting proper segregation of duties for IT system maintenance, management, and development processes.

vii. Information Security Awareness and Training Records - Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control AT-4 –The Offeror shall ensure that employees receive security awareness (AT-2) and role-based information security technical training (AT-3) and shall provide documentation of this training to FMCSA. AT-2 requires basic security awareness training for FMCSA employees and Offerors that support the operation of any and all systems. AT-3 requires information security technical training to information system security roles. Training shall be consistent with the requirements contained in C.F.R. Part 5 Subpart C (5 C.F.R 930.301) and conducted at least annually.

viii. System(s) Baseline Configuration Standard Document - Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control CM-2 – the Offeror shall provide a well-defined, documented, and up-to-date current baseline configuration of the information system.

ix. System Configuration Settings - Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control CM-6 – The Offeror shall establish and document mandatory configuration settings for information technology products employed within the information system that reflect the most restrictive mode consistent with operational requirements. Configuration settings are the configurable security-related parameters of information technology products that compose the information system; and identify and document exceptions from the mandatory configuration settings for individual components within the information system based on explicit operational requirements. Systems should be configured in agreement with NIST guidelines at the NIST Checklist website (checklists.nist.gov) and the Center for Internet Security (CIS) guidelines (Level 1

- for internal information systems, Level 1&2 – for external facing information systems), and the National Vulnerability Database Guidelines, unless a waiver is granted by FMCSA

x. Configuration Management Plan - Reference: NIST SP800-128, “Guide for Security- Focused Configuration Management of Information Systems” and NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control CM-9 – The Offeror shall develop and provide an annual update to the Configuration Management Plan in conformance with the FMCSA EA for the information system that:

1) Addresses roles, responsibilities, and configuration management processes and procedures;

2) Defines the configuration items for the information system and when in the system development life cycle the configuration items are placed under configuration management; and

3) Establishes the means for identifying configuration items throughout the system development life cycle and a process for managing the configuration of the configuration items.

xi. Incident Response Plan - Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control IR-8 - The Offeror shall:

i. Develop an incident response plan that:

1) Provides the organization with a roadmap for implementing its incident response capability;

2) Describes the structure and organization of the incident response capability;

3) Provides a high-level approach for how the incident response capability fits into the overall organization;

4) Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;

5) Defines reportable incidents;

6) Provides metrics for measuring the incident response capability

7) Defines the resources and management support needed to effectively maintain and mature an incident response capability; and

8) Is reviewed and approved by designated officials within the organization.

ii. Review the plan annually

iii. Revise the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing.

iv. Integrate with and incorporate guidance and procedures from the DOT CSIRC to ensure effective detection, reporting and response.

v. The Incident Response Plan must be in accordance with NIST 800-61, “Computer Security Incident Handling Guide”.

vi. Incident Response Test Report - Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control IR-3 - The Offeror shall provide an incident response test report documenting results of incident reporting test/exercise in accordance with the DOT Departmental Cybersecurity Compendium.

vii. Results of Physical Security User Security Assessment and Authorization Review

- Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control PE-2 – The Offeror shall provide the results of annual reviews and validations of physical access authorizations to facilities supporting the Offeror system to ensure the continued need for physical access.

viii. Results of Review of Physical Visitor Access Records - Reference: NIST SP 800- 53, “Recommended Security Controls for Federal Information Systems” control PE-8 – The Offeror shall provide the results of annual reviews and validations of visitor access records to ensure the accuracy and fidelity of collected data.

ix. Maintenance Records – Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control MA-2(2) – The Offeror shall provide up-to date, accurate, complete, and available records of all maintenance and repair actions, needed, in process, and completed.

x. Information System Interconnection Agreements - Reference: NIST SP 800-53, “Recommended Security Controls for Federal Information Systems” control CA-3

– The Offeror shall provide updated Interconnection Security Agreements (ISA) and supporting Memorandum of Agreement/Understanding (MOA/U), completed in accordance with NIST SP 800-47, “Security Guide for Connecting Information Technology Systems”, for existing and new interconnections. Per NIST SP 800- 47, “Security Guide for Interconnecting Information Technology Systems” an interconnection is the direct connection of two or more IT systems for the purpose of sharing data and other information resources through a pipe, such as ISDN, T1, T3, DS3, VPN, etc. Interconnections agreements shall be submitted as appendices to the System Security Plan.

xi. Rules of Behavior - Reference: NIST 800-53, “Recommended Security Controls for Federal Information Systems” control PL-4 – The Offeror shall a. establish and make readily available to all information system users, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; and b. receive signed acknowledgment from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system.

xii. User Guide for the FMCSA Security Operations User Interface - the Offeror shall complete a User Guide for the FMCSA Security Operations User Interface for FMCSA. The Offeror shall also perform demos of the interface used for these services for FMCSA personnel.

1.7 Additional Deliverables

Additional deliverable shall include:

a. Monthly training records in accordance with FMCSA IT Security Training Policy

b. Monthly POAM and vulnerability updates in accordance with FMCSA IT Security POAM and Vulnerability Management Policy

c. Monthly scan summary and reports in accordance with FMCSA IT Security Vulnerability Management Policy

d. Data Call and Security Advisories Responses in accordance with FMCSA IT Security Advisory Policy

e. Controlled Unclassified Information - All deliverables under this section shall be labeled according to the sensitivity of the information. FOR OFFICIAL USE ONLY (FOUO), Sensitive Security Information (SSI), and/or other designations as directed by FMCSA shall be applied to paper and electronic documents. External transmission/dissemination of sensitive unclassified information to or from a FMCSA computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security requirements for Cryptographic Modules.” Handling, storage, processing, transmitting and discussing of Controlled Unclassified Information shall be in accordance with FMCSA guidance in order to prevent the release of such information to persons not authorized by FMCSA to have access to the information.

f. HSPD-12 / Identity, Credential and Access Management Requirements – The Offeror shall ensure that all systems that it develops for or operates on behalf of FMCSA support the use of Personal Identity Verification (PIV) smart cards, and PIV interoperable (PIV-I) smart cards as appropriate, for authentication and access to those systems, for the digital signature of documents and workflows, and for the encryption of documents and information, in accordance with NIST PUB 201 and related special publications. When explicitly required, or by September 30, 2012, whichever occurs sooner, the Offeror shall ensure that all systems it develops for or operates on behalf of FMCSA meet applicable DOT/FMCSA policy requirements for identity, credential and access management (ICAM) and require the use of a PIV card or PIV-I for authentication, access, digital signature, and encryption. The Offeror shall ensure that services and products it purchases involving facility or system access control are on the current FIPS 201 Approved Products List which can be found on http://www.idmanagement.gov/.

g. Internet Protocol Version 6 (IPV6) Mandate- The Offeror shall ensure that all applicable systems that it develops for or operates on behalf of FMCSA are compatible with IPV6. The contactor must perform testing to validate IPv6 compatibility. IPV6 validation tests must include the test date and the method of testing used the validate IPV6 compatibility. Test results must be submitted to FMCSA ISSO for validation.

h. Domain Name System Security Extension (DNSSEC) Mandate- The Offeror shall implement DNSSEC on all second level DNS servers to prevent the pirating of government domain names. The Offeror must validate DNSSEC compliance to FMCSA ISSM.

i. Trusted Internet Connection (TIC) – The Offeror shall ensure that all applicable systems that it develops for or operates on behalf of FMCSA are compliant with National Security Presidential Directive 54 and Homeland Security Presidential Directive 23.

j. Federal Desktop Core Configuration/US Government Configuration Baseline - The Offeror shall certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC)/US Government Configuration Baseline (USGCB). This includes Internet Explorer configured to operate on Windows. The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved FDCC/USGCB configuration. The information technology should also use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The Offeror shall use Security Content Automation Protocol (SCAP) validated tools with FDCC/USGCB Scanner capability to certify their products operate correctly with FDCC/USGCB configurations and do not alter FDCC/USGCB settings.

k. Privacy Threshold Analysis (PTA) - The Offeror shall provide support to FMCSA in developing Privacy Threshold Analysis.

l. Privacy Impact Assessment (PIA) - The Offeror shall provide support to FMCSA in developing Privacy Impact Assessments in accordance with Section 208 of the e-Government Act of 2002.

m. System of Record Notice (SORN) - The Offeror shall provide support to FMCSA in developing System of Record Notices (SORN) in accordance with the Privacy Act of 1974.

n. System Access Notice - The Offeror shall ensure that the following banners are displayed on all FMCSA systems (both public and private) operated by the Offeror prior to allowing authenticated access to the system(s) (message in quotes):

“ATTENTION ATTENTION ATTENTION”

You are accessing a U.S. Government information system, which includes (1) this computer, (2) this computer network, (3) all computers connected to this network, and (4) all devices and storage media attached to this network or to a computer on this network. This information system is provided for U.S. Government-authorized use only.

Unauthorized or improper use of this system may result in disciplinary action, as well as civil and criminal penalties.

By using this information system, you understand and consent to the following:

· You have no reasonable expectation of privacy regarding any communications or data transiting or stored on this information system. At any time, and for any lawful government purpose, FMCSA may monitor, intercept, and search and seize any communication or data transiting or stored on this information system.

· Any communications or data transiting or stored on this information system may be disclosed or used for any lawful government purpose.

[click button: I AGREE]”

o. Privacy Act Notifications - As prescribed in the Federal Acquisition Regulation (FAR) clause 24.104, if the system involves the design, development, or operation of a system of records on individuals, the Offeror shall implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.” The Offeror shall ensure that the following banner is displayed on all FMCSA systems that contain Privacy Act information operated by the Offeror prior to allowing anyone access to the system:

i. “This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93-579). Any privacy information displayed on the screen or printed shall be protected from unauthorized disclosure. Individuals who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both.”

p. Non-Disclosure Agreements - The Offeror shall cooperate in good faith in defining non- disclosure agreements that other third parties must sign when acting as the Federal government’s agent.

q. Non-Disclosure of Security Safeguards - In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, the Offeror shall be responsible for the following privacy and security safeguards: The Offeror shall not publish or disclose in any manner, without the contracting officer’s written consent, the details of any safeguards either designed or developed by the Offeror under this task order. If new or unanticipated threats or hazards are discovered by either FMCSA or the Offeror, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

1.8 Security of Systems Handling Personally Identifiable Information and Privacy Incident Response

a. Definitions

i. Breach (may be used interchangeably with “Privacy Incident’) as used in this document means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, in usable form whether physical or electronic.

ii. Personally Identifiable Information (PII) as used in this document refers to any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States.

1) Examples of PII include: name, date of birth, mailing address, telephone number, Social Security Number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), Internet protocol addresses, biometric identifiers (e.g., fingerprints), photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

iii. Sensitive Personally Identifiable Information (Sensitive PII) as used in this document refers to a subset of Personally Identifiable Information, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Complete social security numbers (SSN), alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered Sensitive PII even if they are not coupled with additional PII. Additional examples include any groupings of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

2) Driver’s license number, passport number, or truncated SSN (such as last 4 digits)

3) Date of birth (month, day, and year)

4) Citizenship or immigration status

5) Financial information such as account numbers or Electronic Funds Transfer Information

6) Medical Information

7) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

iv. Other Personally Identifiable information may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains Personally Identifiable Information but it is not sensitive.

b. Systems Access - Work to be performed under any resulting task order requires the handling of Sensitive PII. The Offeror shall provide FMCSA access to, and information regarding systems the Offeror operates on behalf of FMCSA when requested by FMCSA, as part of its responsibility to ensure compliance with security requirements, and shall otherwise cooperate with FMCSA in assuring compliance with such requirements. FMCSA access shall include independent validation testing of controls, system penetration testing by FMCSA, Federal Information Security Management Act (FISMA) data reviews, and access by agency Inspectors General for its reviews.

c. Systems Security - In performing its duties related to management, operation, and/or access of systems containing Sensitive PII under the resulting task orders, the Offeror, its employees and subcontractors shall comply with applicable security requirements or any replacement publication and rules of conduct described in DOT Order 1351.37.

In addition, use of Offeror-owned laptops or other media storage devices to process or store PII is prohibited under contract until the Offeror provides, and the contracting officer in coordination with CISO approves, written certification by the Offeror that the following requirements are met:

i. Laptops employ encryption using a NIST Federal Information Processing Standard (FIPS) 140-2 or successor approved product;

ii. The Offeror has developed and implemented a process to ensure that security and other applications software are kept current;

iii. The Offeror is responsible for implementing mechanisms to protect the integrity of the data by employing integrity verification tools;

iv. Mobile computing devices utilize anti-viral software and a host-based firewall mechanism;

v. When no longer needed, all removable media and laptop hard drives shall be processed (i.e., sanitized, degaussed, or destroyed) in accordance with DOT security requirements.

vi. The Offeror shall maintain an accurate inventory of devices used in task order performance;

vii. Offeror employee annual training and rules of conduct/behavior shall be developed, conducted/issued, and acknowledged by employees in writing. Training and rules of conduct shall address at minimum:

1) Authorized and official use;

2) Prohibition against use of personally-owned equipment to process, access, or store Sensitive PII;

3) Prohibition against access by unauthorized users and unauthorized use by authorized users; and

4) Protection of Sensitive PII;

viii. All Sensitive PII obtained under contract shall be removed from Offeror-owned information technology assets upon termination or expiration of Offeror work. Removal must be accomplished in accordance with DOT Order 1351.14 which the contracting officer will provide upon request. Certification of data removal will be performed by the Offeror’s Project Manager and written notification confirming certification will be delivered to the contracting officer within 15 days of termination/expiration of Offeror work.

d. Data Security - Offeror shall limit access to the data to those employees and subcontractors who require the information in order to perform their contractual duties. The Offeror, Offeror employees, and subcontractors must physically secure Sensitive PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. When Sensitive PII is no longer needed or required to be retained under applicable FMCSA records retention policies, it must be destroyed through means that will make the Sensitive PII irretrievable. The Offeror shall only use Sensitive PII obtained during the period of performance for FMCSA purposes and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At contract expiration or termination, the Offeror shall turn over all Sensitive PII obtained during the contract that is in its possession to FMCSA.

e. Breach Response - The Offeror agrees that in the event of any actual or suspected breach of Sensitive PII (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), it shall immediately, and in no event later than one hour of discovery, report the breach to the contracting officer, the Contracting Officer’s Technical Representative (COTR), and the FMCSA Privacy Officer (fmcsasecurity@dot.gov). The Offeror is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing FMCSA parties.

f. Personally Identifiable Information Notification Requirement - The Offeror has in place procedures and the capability to promptly notify any individual whose Sensitive PII was, or is reasonably believed to have been, breached, as determined appropriate. The method and content of any notification by the Offeror shall be coordinated with, and subject to the prior approval of the Government, based upon a risk-based analysis conducted by FMCSA in accordance with DOT Privacy Incident Handling Guidance. Notification shall not proceed unless FMCSA has determined that: (1) notification is appropriate; and (2) would not impede a law enforcement investigation or jeopardize national security.

Subject to Government analysis of the breach and the terms of its instructions to the Offeror regarding any resulting breach notification, a method of notification may include letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by FMCSA. At minimum, a notification should include: (1) a brief description of how the breach occurred; (2) a description of the types of personal information involved in the breach; (3) a statement as to whether the information was encrypted or protected by other means; (4) steps an individual may take to protect themselves; (5) what the agency is doing, if anything, to investigate the breach, to mitigate losses, and to protect against any further breaches; and (6) point of contact information identifying who affected individuals may contact for further information.

In the event that a Sensitive PII breach occurs as a result of the violation by the Offeror or its employees, the Offeror shall, as directed by the contracting officer and at no cost to FMCSA, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected individuals for a period not to exceed 12 months from discovery of the breach. Should FMCSA elect to provide and/or procure notification or identity protection services in response to a breach, the Offeror will be responsible for reimbursing FMCSA for those expenses.

1.9 Accessibility Requirements

In support of executing the task orders associated with this task order, the Offeror shall comply with Section 508 of the Rehabilitation Act. Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All deliverables within the task orders associated with this task order shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable accessibility standards have been identified:

Section 508 Applicable Accessibility Standards 36 CFR 1194.21 Software Applications and Operating Systems, applies to all software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement.

When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous JavaScript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.31 Functional Performance Criteria, applies to all deliverables regardless of delivery method. All deliverables shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required 1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a service desk shall have the ability to transmit and receive messages using TTY.

Section 508 Applicable Exceptions Exceptions for this task order have been determined by FMCSA and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COR and determination will be made in accordance with FMCSA Policy. FMCSA has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all that is exclusively owned and used by the offeror to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those offerors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

Section 508 Compliance Requirements 36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a FMCSA solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some, but not all of the standards, the agency must procure the product that best meets the standards.