B06_ATCH_3_S22101_FISMA.pdf

Work Statement Attachment - Information Technology Security Requirements Summary for: turbidity probes with dataloggers and a single turbidity probe

1. Background Investigation Not Applicable

2. Non-disclosure Agreement Not Applicable

3. Training Not Applicable

4. Personnel Changes Not Applicable

5. Contractor Location Not Applicable

6. Applicable Standards Not Applicable

7. Asset Valuation Not Applicable

8. Property Rights

(A) Open Market COTS Hardware or Software. The Government's rights in software delivered hereunder shall be as described in software developer's commercial software license agreement or the clause FAR 52.227-19, Commercial Computer Software-Restricted Rights, whichever is greater. (B) Development or Maintenance of Custom Applications. The Government shall be granted unlimited rights in software or data produced hereunder as described in FAR clause 52.227-17, Rights in Data—Special Works, incorporated by reference herein.

9. Independent Verification and Validation (IV & V) Not Applicable

10. Certification & Accreditation Not Applicable

11. Internet Logon Banner Not Applicable

12. Incident Reporting

13. Quality Control (Malicious Code)

All software or hardware must be free of malicious code such as viruses, Trojan horse programs, worms, spyware, etc. Validation of this must be written into the contract.

See clause GS0199 “Prevention of Malicious Code.”

Prevention of Malicious Code

(a) Definitions Malicious code is a computer code developed for the purpose of causing some form of intentional damage to computer systems or networks. Malicious code may be a complete program or code imbedded in software programs that appear to provide useful functions.

The term includes computer viruses and other destructive programs, such as "Trojan Horses" and network "worms."

(b) The contractor must have in place an anti-virus procedure to ensure that media supplied is uncontaminated by malicious code.

(c) The contractor is required to scan all delivered software to insure it is free of malicious code prior to its installation or operation on USGS-owned computers or contractor-owned computers connected to USGS computer systems or networks.

Contractors using diagnostics software disks or connecting to a non-USGS computer while performing repairs or upgrades to a USGS computer will scan the serviced computer's drive(s) to insure they are free of malicious code upon completion of the service call, or prior to return of serviced equipment, if servicing is performed off-site.

14. Self Assessment

15. Vulnerability Analysis Not Applicable

16. Logon Banner Not Applicable

17. Security Controls Not Applicable

18. Contingency Plan

Responsible Program Official Date

IT Official Approval Date