B02 Attach 1 Cyber_Acquisition_Language_JUL2023_R.docx

Instructions to Offerors – Cybersecurity and Supply Chain Risk for IT Acquisitions The following sentences must be added to the instructions to offerors section for all IT and IT-related acquisitions:

· The offeror shall, as part of their technical proposal, provide a detailed description of how the proposed solution will adhere to the requirements included in the “Appendix – Cybersecurity Language for IT Acquisitions” section of this solicitation.

06/14/2023

· The offeror shall, as part of their technical proposal, provide a detailed description of how the proposed solution will manage and minimize supply chain risk, addressing the requirements included in the “Appendix – Cybersecurity Language for IT Acquisitions” section of this solicitation.

Appendix – Cybersecurity Language for IT Acquisitions Purpose The U.S. Small Business Administration (SBA) must provide information security for the information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. The Federal Information Security Modernization Act of 2014 (FISMA) describes Federal agency security responsibilities as including “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.” This includes services which are either fully or partially provided; including other agency hosted, outsourced, and cloud computing solutions. FISMA has a somewhat broader applicability than prior security law and applies to both information and information systems used by the agency, contractors, and other organizations and sources. Agency information security programs apply to all organizations (sources) which possess or use Federal information – or which operate, use, or have access to Federal information systems (whether automated or manual) – on behalf of a Federal agency, information systems used or operated by an agency or other organization on behalf of an agency.

This document applies to all Agency contracts in which SBA sensitive information is stored, generated, transmitted or exchanged by an SBA contractor, subcontractor or third-party, or on behalf of any of these entities regardless of format. The regulations in this document also pertain to information residing on an SBA or a non-SBA system in order for the contractor, subcontractor or third party to perform their contractual obligations to SBA, standing in lieu of SBA or acting on SBA’s behalf.

The contractor shall leverage all applicable enterprise IT services available from the Office of the Chief Information Officer (OCIO), Information Security Division (ISD). The goal of enterprise services is to maintain enterprise protection and visibility of all agency IT systems. The agency expects a lower cost of ownership, less complexity, lower level of maintenance effort and overall cost savings over the life of the contract. The services include:

· Event log collection and aggregation

· Continuous monitoring

· Incident response

· Patch and configuration management

· Vulnerability scanning

· Penetration testing

· Incident response exercises

· Cybersecurity and privacy risk management

· Cybersecurity and privacy controls assessment

· Cybersecurity and privacy awareness training All requirements identified or referenced in this document shall be interpreted and implemented implicitly for all system components unless otherwise directed by the SBA.

All requirements identified or referenced in this document shall be implemented at the time of contract award unless otherwise directed by the government.

All requirements identified or referenced in this document shall apply to all contractors and subcontractors that will have access to Controlled Unclassified Information (CUI), collect or maintain CUI on behalf of the agency, operate federal information systems, including contractor information systems operated on behalf of the agency, to collect, process, store, or transmit CUI.

All physical and/or logical access to the IT system or supporting facilities deemed necessary by the SBA shall be granted to the SBA or its designated representative(s) by the Contractor.

Policies and Regulations Contractors entering into an agreement for services to the SBA or its Federal customers shall be contractually subject to all SBA and Federal IT Security standards, policies, and reporting requirements. The contractor shall meet and comply with all SBA IT Security Policies, SBA and NIST guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Contractors are required to comply with the SBA, FIPS, and NIST, Federal requirements outlined below (or successor documents):

· SBA Cybersecurity and Privacy Policy (SOP 90 47 5), as amended.

· Federal Information Security Modernization Act of 2014, as amended.

· Clinger-Cohen Act of 1996 also known as the “Information Technology Management Reform Act of 1996,” as amended.

· Privacy Act of 1974 (5 U.S.C. § 552a), as amended.

· Federal Information Technology Acquisition Reform Act (FITARA) of 2014, as amended.

· Chief Financial Officers Act of 1990 (Public Law 101–576), as amended.

· Cyber Supply Chain Management and Transparency Act of 2014.

· Trade Agreements Act (TAA) of 1979 as amended.

· Homeland Security Presidential Directive (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” as amended.

· Office of Management and Budget (OMB) Circular A-130, “Management of Federal Information Resources” as amended.

· FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems,” as amended.

· FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems,” as amended.

· FIPS PUB 140-2, “Security Requirements for Cryptographic Modules,” as amended.

· NIST Special Publication 800-18, “Guide for Developing Security Plans for Federal Information Systems,” as amended.

· NIST Special Publication 800-30-1, “Guide for Conducting Risk Assessments,” as amended.

· NIST Special Publication 800-34-1, “Contingency Planning Guide for Information Technology Systems,” as amended.

· NIST Special Publication 800-37-2, “Guide for Applying the Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” as amended.

· NIST Special Publication 800-47, “Security Guide for Interconnecting Information Technology Systems,” as amended.

· NIST Special Publication 800-53-5, “Security and Privacy Controls for Federal Information Systems and Organizations,” as amended.

· NIST Special Publication 800-53A-5, “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans,” as amended.

· NIST Special Publication 800-161, “Supply Chain Risk Management Practices for Federal Information Systems and Organizations,” as amended.

· NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,” as amended.

Contractors will also be expected to comply with new Federal mandates and cyber security memos issued by the Office of the Federal CIO, the Office of Budget and Management and the Cyber Security Infrastructure Security Agency.

Security and Privacy Requirements FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems,” is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Contractor systems supporting SBA must meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800-53, Revision 4 (as amended and hereafter described as NIST 800-53), and “Recommended Security and Privacy Controls for Federal Information Systems.

Data contained within all SBA computer systems are governed by Agency record disclosure and privacy regulations (13 C.F.R. part 102), IT Security regulations as well as other regulations, statutes and guidance, including the Privacy Act of 1974, as amended (5 U.S.C. § 552a). In addition, various Federal requirements obligate SBA to establish controls to limit access to Personally Identifiable Information (PII) and sensitive data, as defined below, to authorized personnel. These include OMB Circular A-130 and OMB Memoranda.

Contractors leveraging cloud solutions must utilize a Cloud Service Provider (CSP) with an existing Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB) Provisional Authorization to Operate (ATO) or Agency ATO at all service models [Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)].

To comply with the Federal standard, the SBA must determine the security category of the information and information system in accordance with FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems”, and then the contractor shall apply the appropriately tailored set of Low, Moderate, or High impact baseline security controls in NIST 800-53, as determined by the SBA.

The Contractor shall use SBA and NIST guidelines, Defense Information Security Agency (DISA) Security Technical Implementation Guides (STIGs), or industry guidelines in securing their systems.

Any information provided to the contractor (and/or any subcontractor) by SBA or collected by the contractor on behalf of SBA must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any SBA records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with SBA policies. Unauthorized disclosure of information will be subject to the SBA sanction policies and/or governed by the following laws and regulations:

· 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

· 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

· 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

Supply Chain Risk Management The contractor shall, as part of their technical proposal, describe how Supply Chain Risk Management (SCRM) is incorporated into the acquisition of the underlying technology that composes their solutions. Descriptions shall at a minimum describe how the contractor’s solutions satisfies the following regulatory components:

· The TAA of 1979 as amended.

· The Federal Acquisition Regulation (FAR) part 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities.

· The Federal Acquisition Regulation (FAR) part 52.204-25 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment.

· National Defense Authorization Act (NDAA) (as amended regarding covered Chinese companies deemed to be a national threat)

· The contractor’s technical proposal shall describe how SCRM is to be addressed and monitored throughout the lifecycle of the acquisition. At a minimum, they must implement the following:

· Develop rules for suppliers' development methods, techniques, or practices.

· Use of secondary market components.

· Prohibit counterfeit products.

· Dispose and/or retain elements such as components, data, or intellectual property securely.

· Ensure adequate supply of components.

· Require external providers handling federal information or operating systems on behalf of the federal government to meet the same security and privacy requirements as federal agencies.

· Require external providers to express security and privacy requirements (including the controls for systems processing, storing, or transmitting federal information) in contracts or other formal agreements.

· Establish Service Level Agreements (SLAs), patching vehicles and disclosure requirements in the case of a security incident or new vulnerability being discovered; and

· Ensure that the supplier applies same contractual requirements to any sub-contractors/suppliers that they involve in the provision of the product or service to the customer; and

· Prohibit the use of covered telecommunications and video surveillance equipment or services.

· The contractor must also comply with the requirements of M-23-13 “No TikTok on Government Devices” Implementation Guidance and SBA requirements regarding the prohibition on the use or the requirement to use “the social networking service TikTok or any successor application or service of TikTok developed or provided by ByteDance Limited or an entity owned by ByteDance Limited as part of a contract or part of the contractor’s services.

Contracts issued by SBA must contain the following language:

· Contractors shall not use or require the use of the social networking service TikTok or any successor application or service of TikTok developed or provided by ByteDance Limited or an entity owned by ByteDance Limited as part of the contractor’s services or in the performance of a contract with SBA, except in cases of exceptions explicitly approved in advance by the SBA Office of the CIO in accordance with eligible exceptions as defined in M-23-13.

· This requirement applies to all “information technology,” as that term is defined in 40 U.S.C. § 11101(6) (herein after referred to as “IT”). That definition reaches not only IT owned or operated by agencies, but also IT “used by a contractor under a contract with the executive agency that requires the use” of that IT, whether expressly or “to a significant extent in the performance of a service or the furnishing of a product.” That definition does not, however, “include any equipment acquired by a federal contractor incidental to a federal contract.

Essential Security Controls All NIST 800-53 controls must be implemented as per the applicable FIPS 199 Low, Moderate, or High baseline. Controls, control enhancements, or parts of controls or enhancement may be implemented jointly between the Contractor and CSP as applicable. The controls can be accessed by referencing the NIST Computer Security Resource Center website.

The Contractor shall make the proposed system and security architecture of the information system available to the Office of the Chief Information Officer for review and approval before commencement of system build.

Assessment and Authorization (A&A) Activities The implementation of a new Federal Government IT system requires a formal approval process known as Assessment and Authorization (A&A). NIST SP 800-37-2 provides guidelines for performing the A&A process. The Contractor system/application must have a valid assessment and authorization, known as an Authority to Operate (ATO) (signed by the Federal government) before going into operation and processing SBA information. The failure to obtain and maintain a valid ATO may result in the termination of the contract. The system must have a new A&A conducted (signed by the Federal government) at least every three (3) years or at the discretion of the Authorizing Official when there is a significant change to the system’s security posture. All NIST 800-53 (as amended) controls must be tested/assessed every three (3) years or as defined by SBA policy.

Assessing the System

a. The Contractor/System Owner shall comply with Assessment and Authorization (A&A) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the A&A is based on the System’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. The contractor shall create, maintain and update the following A&A documentation:

· System Security Plan (SSP) completed in agreement with NIST SP 800-18-1 (or successor document), “Guide for Developing Security Plans for Federal Information Systems”. The SSP shall include as appendices required policies and procedures across 18 control families mandated per FIPS 200, Rules of Behavior, and Interconnection Agreements (in agreement with NIST Special Publication 800-47, “Security Guide for Interconnecting Information Technology Systems”).

· Contingency Plan (including Business Impact Analysis (BIA) and test Report completed in agreement with NIST Special Publication 800-34.

· Privacy Threshold Analysis/Privacy Impact Assessment (PTA/PIA)

· Configuration Management Plan (CMP).

· E-Authentication Threshold Analysis and E-Authentication Risk Assessment (ETA-ERA) in agreement with NIST Special Publication 800-63.

b. Information systems must be assessed and authorized every three (3) years, whenever there is a significant change to the system’s security posture and updated annually in accordance with NIST Special Publication 800-37-2.

c. At the Moderate impact level and higher, the contractor or Government (as determined in the contract) will be responsible for providing an independent Security Assessment/Risk Assessment in accordance with SBA Policy.

d. If the Government is responsible for providing a Security Assessment/Risk Assessment, the Contractor shall allow SBA employees (or SBA-designated third-party contractors) to conduct A&A activities to include control reviews in accordance with NIST 800-53/NIST 800-53A. Review activities include but are not limited to operating system vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, or security of SBA information. This includes the general support system infrastructure.

e. Identified gaps between required 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation as a Plan of Action and Milestones (POA&M) item within SBA’s Cyber Security Assessment Management (CSAM) implementation. Depending on the severity of the gaps, the Government may require them to be remediated before an Authorization to Operate is issued.

f. The Contractor is responsible for mitigating all security risks found during A&A and continuous monitoring activities. All critical-risk vulnerabilities must be mitigated within 15 days, high-risk vulnerabilities must be mitigated within 30 days, and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

g. The Contractor / System Owner is responsible for maintaining accurate inventory information of the system’s components such as servers, databases, operating system, software, etc.

h. The contractor / System Owner is responsible to ensure that the system is onboarded to ECS monitoring services.

i. The Contractor (and/or any subcontractor) must use Commercial off the Shelf (COTS) software or other software that is supported by the manufacturer. The contractor must retire and/or upgrade all software/systems that have reached end-of-life in accordance with SBA Cybersecurity and Privacy Policy.

j. For applications developed in-house, the Contractor (and/or any subcontractor) must follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards, the Open Web Application Security Project (OWASP), and SBA related policies that will limit system software vulnerability exploits.

Authorization of the System

a. Upon receipt of the Security Authorization Package, the Authorizing Official (AO), in coordination with the SBA Office of the CIO, System Owner (SO), Information System Security Manager (ISSM), and Information System Security Officer (ISSO) will render an authorization decision to:

· Authorize system operation w/out any restrictions or limitations on its operation;

· Authorize system operation w/ restriction or limitation on its operation, or;

· Not authorize for operation.

· It is important to note that no system will be placed into production without an Authorization to Operate.

b. The Contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program, and in response to security incidents. At its option, the Government may choose to conduct on site surveys. The Contractor shall make appropriate personnel available for interviews and documentation during this review. If documentation is considered proprietary or sensitive, these documents may be reviewed on-site under the hosting Contractor’s supervision.

c. SBA has the right to take action in response to the contract or cloud service provider's (CSP) lack of compliance and/or increased level of risk. In the event the contractor/CSP fails to meet SBA’s security and privacy requirements and/or there is an incident involving sensitive information, SBA may suspend or revoke an existing agency ATO (either in part or in whole) and/or cease operations. If an ATO is suspended or revoked in accordance with this provision, the CO and/or COR may direct the contractor/CSP to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor/CSP information system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

Continuous Monitoring Deliverables and Schedule Maintenance of the security authorization to operate will be through continuous monitoring of security controls of the contractor’s system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to SBA per the schedules below. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. They allow SBA AOs to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur. The contractor is required to provide the following deliverables to the CO/COR during the performance of the contract.

Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements and SBA Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow appropriate system development lifecycle framework and methodology.

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to SBA’s Cybersecurity and Privacy Program requirements, at a minimum, for system development and provide system documentation as required.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must complete a System Decommission Plan and provide all required documentation in accordance with SBA’s requirements to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization. The contractor must provide evidence of proper sanitization to the SBA as part of this process.

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO within as soon as possible or as determined by SBA before an employee stops working under this contract.

e. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with SBA policies.

f. The Contractor (and/or any subcontractor) must perform and document the actions identified by the COR when an employee terminates work under this contract within 30 calendar days of the employee's exit from the contract. All documentation must be available to the CO and/or COR upon request.

SOC 2 Type 2 Audit Report SBA requires the Contractor (and/or any subcontractor) to provide a SOC audit report along with a copy of Contractor’s annual independent service auditor’s report on Contractor’s controls relevant to security, availability, processing integrity, confidentiality, and privacy. The SOC audit report must be a Type 2 report that includes management’s description of Contractor’s system and the suitability of the design controls set forth in AICPA Trust Services Criteria Section 100 (2017). This independent audit of the Contractor’s controls must be completed in accordance with the AICPA SSAE No. 18 (SOC 2, Type 2). The SSAE 18 (SOC 2, Type 2) annual audit will include all programs under the Contract and will be conducted at the Contractor’s expense. If the Contractor’s SSAE 18 (SOC 2, Type 2) audit covers less than twelve (12) months of a calendar year, the Contractor will provide a bridge letter to the SBA, stating whether processes and controls have changed since the SSAE 18 (SOC 2, Type 2) audit.