B08 140G0220R0034 Attch 3 FISMA Requirements.doc

140G0220R0034 Attachment 3

FISMA

Information Technology Security Requirements Summary

1. Background Investigation Contractor employees who will have access to DOI information or will develop custom applications are subject to background investigations. The level/complexity of background investigations must be the same as for a federal employee holding a similar position; DM441, Chapter 3, provides guidance for the appropriate background investigations based on types of access. The solicitation and contract should state the levels required for applicable labor categories or positions.

Ordinarily, the vendor should be responsible for paying the cost the background investigations. Existing clearances at the same or higher levels may be accepted. The request forms should be included in the solicitation if possible. Work cannot begin on the DOI system until the background investigation has at least been initiated and the National Agency Check (NAC) is completed.

IT Administration Application Development Support Program Management Support

Moderate Moderate Moderate

Work cannot begin on the DOI/USGS system until the fingerprint check has been favorably adjudicated and background investigation has been initiated.

* Non-Sensitive/Low Risk - National Agency Check with Inquiries with a Credit Check (NACIC)

* Moderate Risk - Minimum Background Investigation (MBI)

2. Non-disclosure Agreement Prior to receiving access to USGS computers, contractor employees shall be required to sign nondisclosure or other system security agreements, depending on the systems to be used and level of access granted. The required non-disclosure agreement will be similar to the attached but may be customized as needed to reflect the data involved. Restrictions on use, duplication and disclosure of sensitive and proprietary data are covered in clause GS1406.

Work under this contract will involve design, development or operation of (access to) the following system(s) of records containing personal information protected by the Privacy Act (5 U.S.C. Section 552a).

System: USGS, web-sites, databases and other applications

Work to be performed:

Software and geospatial development, database support, system requirements, project management, and system administration.

The contractor will not be required or permitted to respond to requests for Privacy Act data or to make decisions about releases of data under the Act. Contractor will ensure its employees are instructed to safeguard against improper use or release of such data and advise them that violation of the Act may involve criminal penalties. The contractor will comply with FAR clause 52.224-2, Privacy Act, incorporated herein by reference, and with DOI Privacy Act regulations at 43 CFR 2, Subpart D, available at: http://www.doi.gov/foia/43cfrsub.html .

3. Training Contractor employees must successfully complete DOI’s end-user computer security awareness training prior to being granted access to DOI data or being issued a non-privileged and privileged user accounts. Training must be renewed annually. Additionally, the contract employees must sign a Statement of Responsibility (SOR) that states they have read the appropriate Rules of Behavior and other applicable Information security policies. Failure to complete training within the required timeframe may result in loss of system access for that user. Contractor employees with significant IT security responsibilities shall also complete specialized role-based training.

4. Personnel Changes Before starting work, the contractor will provide a listing to the COR/technical liaison identifying contractor and subcontractor employees requiring access to USGS systems for performance of work hereunder and will assign each person a unique user ID conforming to USGS policy in Survey Manual Chapter 600.2.1. The contractor shall immediately advise the USGS Project Officer when any of their personnel no longer require USGS computer access so that those ID's and access privileges can be cancelled. When possible, the COR must be notified in advance of any potentially unfriendly termination of an employee or subcontractor.

5. Contractor Location Custom software development and outsourced operations must be located in the United States to the maximum extent practical. If such services are proposed to be performed abroad, the contractor must provide an acceptable security plan specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the US may be an evaluation factor.

6. Applicable Standards Contractors shall follow the DOI System Development Life Cycle (SDLC), NIST SP 800-64, and the DOI SDLC Security Integration Guide. NIST SP 800-64 is available at http://csrc.nist.gov/publications/nistpubs/index.html, DOI SDLC and DOI SDLC Security Integration Guide will be provided by the Contracting Officer upon request.

Contractors shall also follow USGS NGTOC Configuration Management, Security, and Software Development/Deployment Best practices.

7. Security Categorization:

The Contractor must use the FIPS 199 and the NIST SP 800-60 for all systems to determine information types and security categorization based on mission impact, data sensitivity, risk level, and bureau / departmental / national criticality. These can be found at:

http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdfhttp://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdfhttp://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

8. Property Rights The Government shall be granted unlimited rights in software or data produced hereunder as described in FAR clause 52.227-17, Rights in Data—Special Works, incorporated by reference herein. This includes custom software development for distribution to any USGS and/or NGTOC partner organization.

9. Independent Verification and Validation (IV & V) Software will be independently verified and validated by the Government or another selected contractor prior to being moved into production. Process are in-place within the USGS NGTOC Configuration Management Program to insure software scans, code sharing, and other processes are in place. The contractor shall abide by all of those processes.

Additionally, the contractor will ensure that independent verification and validation is performed on software deployed on contractor managed systems containing USGS data, in accordance with methodology specified by the USGS System Owner.

10. Certification & Accreditation Certification and Accreditation on USGS systems to which the Contractor may have access under this contract will be conducted by the Government or another of its contractors.

The Contractor must maintain systems that are compliant with NIST SP 800-18, 800-30, 800-37, 800-53A, 800-60, Federal Information Processing Standard (FIPS) 199 and 200, and the associated guides and templates provided by the Government through the USGS Information Security Office.

The government will reserve the right to conduct the ST&E, using either Government personnel or an independent contractor.

The contractor will take immediate and timely action to correct or mitigate any weaknesses discovered as necessary to bring the application or system into compliance with the above requirement.

11. Internet Logon Banner Web-based applications developed or maintained under this contract must contain a USGS approved logon banner which will be provided by the Government.

12. Incident Reporting The contractor must report computer security incidents affecting DOI data or systems in accordance with the DOI Computer Incident Response Guide. Solicitations must include either the complete publication or a reference to public facilities, such as a website or office, where it may be accessed.

13. Quality Control (Malicious Code) All software and hardware must be free of malicious code and will be scanned before public release per the NGTOC Security, Configuration Management, and Software Deployment guidelines.

14. Self Assessment Self-assessment on USGS systems to which the Contractor may have access under this contract will be conducted by the Government or another of its contractors. The contractor will take appropriate and timely action (this can be specified in the contract) to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

15. Vulnerability Analysis Vulnerability Analysis on USGS systems to which the Contractor may have access under this contract will be conducted by the Government or another of its contractors.

All systems operated and managed by the contractor shall be scanned monthly and/or before major software public releases with a vulnerability analysis tool provided by and performed by the Government.

The Government may conduct additional independent vulnerability scans, pre-arranged or unannounced. All high risk systems and systems accessible from the Internet will be tested for penetration. Independent testing may be performed by the Government or by another contractor.

The contractor shall take immediate action to correct or mitigate any weaknesses discovered during any vulnerability testing, as needed to bring the system into compliance with security standards invoked elsewhere in this work statement. This includes contractor owned information systems hosting DOI data.

16. Logon Banner Applications developed or maintained under this contract must contain a DOI approved logon warning advising users of rules, restrictions, and privacy expectations for that application. The network warning banner communicates that there is no expectation of privacy in the authorized or unauthorized use of DOI information systems. The use of warning banners on DOI computers and networks provides legal notice to anyone accessing them that they are using a U.S. Government system that is subject to monitoring. Users should also be notified of the possible sanctions, such as loss of privileges or prosecution, if they misuse or access the network without authorization. Banners will display a warning that states the system is for legitimate use only, is subject to monitoring, and carries no expectation of privacy. DOI networks and information systems do not inherently provide users a right of privacy. As such, the DOI reserves the right to monitor use in accordance with Information Security Program policies.

The text of such warning will be provided by the Government.

17. Security Controls Contractors will be required to ensure compliance with the security control requirements of the current version of NIST SP 800-53, Rev.1, which are applicable to the security categorization of the data or system. FIPS 199 and the NIST SP 800-60 will be used to determine information types and security categorizations.

Security functionality in applications or integrated systems delivered hereunder must operate with the Government systems on which or with which it will eventually be deployed. Products delivered hereunder must not cause misoperation of government resources or loss of integrity, confidentiality, or availability of electronic information or data.

References are found at:

https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdfhttp://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdfhttp://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

18. Contingency Plan Contractor has no critical function to perform in the event of a contingency operation and should stop work until notified by the Government where and when to resume contract performance. Contingency Plans, documentation, and other materials are developed by the Government and input may be requested of the contractor.