B08_A4_Analite_WQ_Equip-1FISMA_Signature.pdf

Work Statement Attachment - Information Technology Security Requirements Summary for: Analite V3 NEP5000 Turbidity Sensors, 10M & 25M Cable Lengths

1. Background Investigation

Not Applicable

2. Non-disclosure Agreement

Not Applicable

3. Training

Not Applicable

4. Personnel Changes

Not Applicable

5. Contractor Location

Not Applicable

6. Applicable Standards

Not Applicable

7. Asset Valuation

Not Applicable

8. Property Rights

(A) Open Market COTS Hardware or Software. The Government's rights in software delivered hereunder shall be as described in software developer's commercial software license agreement or the clause FAR 52.227-19, Commercial Computer Software-Restricted Rights, whichever is greater. (B) Development or Maintenance of Custom Applications. The Government shall be granted unlimited rights in software or data produced hereunder as described in FAR clause

52.227-17, Rights in Data—Special Works, incorporated by reference herein.

9. Independent Verification and Validation (IV & V)

Not Applicable

10. Certification & Accreditation

Not Applicable

11. Internet Logon Banner

12. Incident Reporting

Not Applicable

13. Quality Control (Malicious Code)

All software or hardware must be free of malicious code such as viruses, Trojan horse programs, worms, spyware, etc. Validation of this must be written into the contract.

See clause GS0199 “Prevention of Malicious Code.”

Prevention of Malicious Code

(a) Definitions

Malicious code is a computer code developed for the purpose of causing some form of intentional damage to computer systems or networks. Malicious code may be a complete program or code imbedded in software programs that appear to provide useful functions.

The term includes computer viruses and other destructive programs, such as "Trojan

Horses" and network "worms."

(b) The contractor must have in place an anti-virus procedure to ensure that media supplied is uncontaminated by malicious code.

(c) The contractor is required to scan all delivered software to insure it is free of malicious code prior to its installation or operation on USGS-owned computers or contractor-owned computers connected to USGS computer systems or networks.

Contractors using diagnostics software disks or connecting to a non-USGS computer while performing repairs or upgrades to a USGS computer will scan the serviced computer's drive(s) to insure they are free of malicious code upon completion of the service call, or prior to return of serviced equipment, if servicing is performed off-site.

14. Self Assessment

Not Applicable

15. Vulnerability Analysis

Not Applicable.

16. Logon Banner

Not Applicable

17. Security Controls

18. Contingency Plan

Responsible Program Official Date

IT Official Approval Date