Attachment J.2 - Information Technology Security and Privacy.pdf

Services. Support. Solutions.

Information Security and Privacy Certification Checklist (Internal Use Only)

This security and privacy checklist contains three sections: Part A, Part B, and Part C. Part A should be completed and signed by the Program. If needed, Part B should be completed and signed by the CDC Chief Information Security Officer (CISO) or delegate, and Part C should be completed by the CDC Senior Official for Privacy (SOP) or delegate. The purpose of this form is to determine if a procurement 1) requires information security, 2) involves Personally-Identifiable Information (PII), and 3) is subject to the Privacy Act. This checklist is for internal use only and will not be included in any package of documents submitted to a contractor.

OCISO Form Version 2018-03-22 Page 1 of 2

Part A: Purchase Request Information

Purchase Request Title [box will expand]

Short Term Survivor CCE

Purchase Request Code or Number

0000HCCP-2020-42056

Contract Officer/Specialist Name and Contact Information [box will expand]

Eric Lyon, kpy2@cdc.gov; 770-488-

C/I/O Program Official/Manager Name and Contact Information [box will expand]

Pattama Ulrich, yih6@cdc.gov; 513-5338570

C/I/O Information Systems Security Officer (ISSO) Name and Contact Information [box will expand]

Bill Brinkley, giy2@cdc.gov; 404-498-2508

CDC Chief Privacy Officer (CPO) Name and Contact Information [box will expand]

Beverly Walker, vhz4@cdc.gov

CDC Chief Information Security Officer (CISO) Name and Contact Information [box will expand]

Information Technology and Privacy Applicability Select the applicable identification below of the requested goods/services. The selection will determine which certifications and digital signatures are required. If selecting identifications #5 or #6, this form will automatically expand to display additional required fields.

1 Furniture

2 Reagents

3 Consumable laboratory supplies

4 Utility contracts (e.g., electricity, natural gas)

5 Solicitations/procurements (other than #1-4 above) NOT INVOLVING IT and/or Information subject to security/privacy regulations

6 Solicitations/procurements INVOLVING IT and/or Information subject to security/privacy regulations

Certification I certify that the solicitation does not involve information technology nor information that may be subject to federal security and privacy regulations.

Information Security and Privacy Certification Checklist (Internal Use Only)

Services. Support. Solutions.

Program Official/Manager (or delegate) Comments [box will expand]

This procurement is consistent with the previously awarded Clinical Centers of Excellence contracts and should fall under the same exemptions.

êApplying a digital signature here will LOCK all preceding document sections and save the form

Program Official/Manager (or delegate) Digital Signature

Information Systems Security Officer (ISSO) (or delegate) Comments [box will expand] êApplying a digital signature here will LOCK all preceding document sections and save the form

ISSO (or delegate) Digital Signature

..\..\Branding\CDC_OCISO_logo_new.jpg Services. Support. Solutions.

Information Security and Privacy Certification Checklist (Internal Use Only) This security and privacy checklist contains three sections: Part A, Part B, and Part C. Part A should be completed and signed by the Program. If needed, Part B should be completed and signed by the CDC Chief Information Security Officer (CISO) or delegate, and Part C should be completed by the CDC Senior Official for Privacy (SOP) or delegate. The purpose of this form is to determine if a procurement 1) requires information security, 2) involves Personally-Identifiable Information (PII), and 3) is subject to the Privacy Act. This checklist is for internal use only and will not be included in any package of documents submitted to a contractor.

OCISO Form Version 2018-03-22 Page of Information Security and Privacy Certification Checklist (Internal Use Only) ..\..\Branding\CDC_OCISO_logo_new.jpg Services. Support. Solutions.

Page of Part A: Purchase Request Information Information Technology and Privacy Applicability Select the applicable identification below of the requested goods/services. The selection will determine which certifications and digital signatures are required. If selecting identifications #5 or #6, this form will automatically expand to display additional required fields.

Part B: Information Security Categorization Section 1: Information Type and Impact Level Assessment Categorize the requested information technology and/or information by completing the table per the instructions listed below.

NOTE: Use the buttons directly below the table to add and remove rows as needed.

• Information Type: Use the National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II:

Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories (https://csrc.nist.gov/publications/).

• Impact Levels (Confidentiality/Integrity/Availability): Rate the risks for each Information Type. The NIST-defined risk ratings may be changed to reflect the actual risk to the CDC and/or C/I/O mission.

• Overall Risk: This is equal to the highest risk rating in its specific column for all of the Information Types listed.

Table of Information Types and Security Objective Impact Levels Item Information Type Confidentiality Integrity Availability Overall Risk:

[cells will expand] Section 2: E-Authentication Risk Assessment This section only applies if the procurement involves the development or maintenance of an Information System that is externally-facing (outside the CDC). If not applicable; please select the "Not Applicable" radio buttons below; otherwise, proceed with the following instructions.

Conduct an E-Authentication Threshold Analysis (E-Auth TA) to determine if a full E-Authentication Risk Assessment (E-auth RA) is necessary by following the OMB 04-04, E-Authentication Guidance for Federal Agencies (https://georgewbush-whitehouse.archives.gov/omb/memoranda/fy04/m04-04.pdf) and the CDC OCISO Standard for E-Auth (http://intranet.cdc.gov/ocio/docs/information-systems-security/OCISO_Standard_E-Authentication.pdf).

If a full E-Auth RA is required, determine the level of assurance. The potential levels of assurance are as follows:

• Level 1: Little or no confidence in the asserted identity's validity

• Level 2: Some confidence in the asserted identity's validity

• Level 3: High confidence in the asserted identity's validity

• Level 4: Very high confidence in the asserted identity's validity Based on the required level of assurance determined by the E-Auth RA, select the appropriate authentication level of assurance and authentication method required to access the information system, including remote authentication.

Level of Assurance:

Authentication Method:

Section 3: Position Sensitivity Designations The ISSO and/or CISO (or delegates), in coordination with the requiring activity representative and Personnel Security Offices, determine the applicable position designations using OPM's Position Sensitivity Designation Automated Tool (https://www.opm.gov/investigations/). The following selections are position sensitivity levels that apply to this solicitation/contract:

Investigation Position Requirement New Old

NAC

National Agency Check Level 1: Non-Sensitive

NACI

Low-Risk Non-Sensitive, including HSPD-12 Credentialing Level 5: Moderate Risk Public Trust

MBI

Moderate-Risk Public Trust (MRPT) Level 2: Non-Critical Sensitive

NACLC & ANACI

Non-Critical Sensitive, National Security, including Secret and "L" access eligibility Level 6: High-Risk Public Trust

BI

High-Risk Public Trust Level 3: Critical-Sensitive

SSBI

Critical Sensitive and Special Sensitive, National Security, including Top Secret, SCI, and "Q" access eligibility Level 4: Special Sensitive [now combined with Tier 5] Section 4: Prospective Offeror Non-Disclosure Agreement A Non-Disclosure Agreement (NDA) must be completed by any offeror prior to access to sensitive information being granted. See Appendix B of the HHS Security and Privacy Language for Information and Information Technology Procurements v2.0 for the appropriate NDA template.

Part C: Information Privacy Categorization -- Part C to be completed by the CDC Chief Privacy Officer (CPO) or delegate only --

Upon notification from the requiring Activity, the CPO (or delegate), in coordination with the CDC Privacy Act Contact or the C/I/O Privacy Act Officer, shall complete Part C of this form to categorize the information collected and/or handled by this purchase request and determine the privacy requirements and language to be included in any resulting solicitation.

Section 1: Personally-Identifiable Information (PII) Assessment PII means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Examples of PII include, but are not limited to, the following types of information: Social Security Number, date and place of birth, mother`s maiden name, and biometric records such as fingerprints. See OMB Circular A-130, Managing Information as a Strategic Resource (July 28, 2016) for further detail.

Select below whether PII is involved with the requested procurement/solicitation.

Section 2: Privacy Act Applicability Section 3: Prospective Offeror Non-Disclosure Agreement Certification I certify that the solicitation does not involve information technology nor information that may be subject to federal security and privacy regulations.

Based on the information provided on this form and contingent upon inclusion of all applicable RFP language (as determined using the HHS Security and Privacy Language for Information and Information Technology Acquisitions v 2.0 and any associated CDC implementing guidance), I certify that the solicitation specifies appropriate security and/or privacy requirements necessary to protect the United States Government’s interests and is in compliance with all Federal, HHS and CDC security and privacy requirements.

ê Applying a digital signature here will LOCK all preceding document sections and save the form ê Applying a digital signature here will LOCK all preceding document sections and save the form ê Applying a digital signature here will LOCK all preceding document sections and save the form ê Applying a digital signature here will LOCK all preceding document sections and save the form CDC Purchase Request Information Security and Privacy Certification Worksheet Template

PVB4

0.001

TG

2018/02/23 CDC Purchase Request Information Security and Privacy Certification Worksheet Template 2018/02/23 1.