B08_ATCH_3_FISMA.pdf
PDF 777 KB Posted
- Attached to
- Spectrofluorometer and Autosampler IAW Salients
- Solicitation number
- 140G0125Q0140
About this file
The document is a FISMA 18-Point Checklist for IT Security Guidelines issued by the U.S. Geological Survey Office of Acquisition and Grants on December 14, 2022. The checklist provides comprehensive security requirements for contractors with access to USGS IT systems, covering areas such as background investigations, non-disclosure agreements, training, personnel changes, and contractor location. Key requirements include mandatory computer security awareness training, annual self-assessments, immediate reporting of personnel changes, and strict protocols for accessing sensitive or proprietary data systems.
The guidelines apply to various scenarios including COTS hardware/software, development or maintenance of custom applications, and outsourced IT services or on-site support. Contractors must comply with multiple security standards, including NIST SP 800-53, FIPS 199, and DOI security guidelines. Critical obligations include signing non-disclosure agreements, conducting background investigations, ensuring all software is free of malicious code, reporting security incidents, and submitting contingency plans. Contractors are prohibited from performing any work outside the United States without express written permission from the Contracting Officer.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| B08_ATCH_1_SALIENTS.pdf | ||
| B08_ATCH_2_508.pdf | ||
| Sol_140G0125Q0140.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
FISMA 18-Point Checklist – IT Security Guidelines
U.S. Geological Survey Office of Acquisition and Grants December 14, 2022 Page 1 of 8 Questions to askoag@usgs.gov
Requirements herein are incorporated as part the Statement of Work/ Performance Work Statement:
Background Investigations. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information Technology.”
Non-disclosure Agreement. Prior to receiving access to USGS computers, contractor employees shall be required to sign nondisclosure or other system security agreements, depending on the systems to be used and level of access granted.
Applies whenever any contractor employee has unsupervised access to a
USGS system (even if only basic network, internet or email or will develop custom applications) such as:
• User Access to USGS IT Systems known to contain sensitive or proprietary data
• IT Support services (greater than user access)
• Development or Maintenance of Custom Applications
• On-site contractor support and management of IT system
• Off-site contractor Oversight and Management of IT System
• IT Security Services may have access]
Work to be performed: [Summarize nature of the contractor's use of such records, such as]
• User-level access to system containing protected records
• Operation or maintenance of Privacy Act System of records or computers hosting such system
• Design or modification of a Privacy Act system of records]
The contractor is not required or permitted to respond to requests for
U.S. Geological Survey Office of Acquisition and Grants December 14, 2022 Page 2 of 8 Questions to askoag@usgs.gov
Privacy Act data or to make decisions about releases of data under the
Act. Contractor shall ensure its employees are instructed to safeguard against improper use or release of such data and advise them that violation of the Act may involve criminal penalties. The contractor will comply with FAR clause 52.224-2, Privacy Act, incorporated herein by reference and with DOI Privacy Act regulations at 43 CFR 2, Subpart D
COTS
Hardware or Software
Development or Maintenance of Custom Applications
Outsourced IT Services or On-site Support
Requirements herein are incorporated as part the Statement of Work/
Performance Work Statement:
3 N/A Training. The Contractor shall perform in accordance with clause
“Security Requirements: Facility Access and Information Technology” -
Contractor employees must successfully complete DOI’s end-user computer security awareness training prior to being granted access to
DOI data or being issued a user account. Training must be renewed annually. Additionally, the contract employees must sign a Statement of
Responsibility (SOR) that states they have read the appropriate Rules of
Behavior and other applicable Information security policies.
4 N/A Personnel Changes. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information
Technology” - The contractor must notify the COR immediately when an employee working on a DOI system is reassigned or leaves the contractor’s employ.
Applies whenever any contractor employee has unsupervised access to a USGS system (even if only basic network, internet or email or will develop custom applications) such as:
• User Access to USGS IT Systems known to contain sensitive or proprietary data
• IT Support services (greater than user access)
• Development or Maintenance of Custom Applications *
• On-site contractor support and management of IT system
• Off-site contractor Oversight and Management of IT System
• IT Security Services *
*May not be applicable for off-site performance.
5 N/A
U.S. Geological Survey Office of Acquisition and Grants December 14, 2022 Page 3 of 8 Questions to askoag@usgs.gov
Contractor Location. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information
Technology.”
Applies whenever any contractor employee has unsupervised access to a USGS system (even if only basic network, internet or email or will develop custom applications) such as:
• User Access to USGS IT Systems known to contain sensitive or proprietary data
• IT Support services (greater than user access)
• Development or Maintenance of Custom Applications
• On-site contractor support and management of IT system
• Off-site contractor Oversight and Management of IT System
• IT Security Services
No portion of the services to be performed hereunder may be performed outside the United States without the express written permission of the
Contracting Officer.
U.S. Geological Survey Office of Acquisition and Grants December 14, 2022 Page 4 of 8 Questions to askoag@usgs.gov
U.S. Geological Survey Office of Acquisition and Grants Questions to askoag@usgs.gov to askoag@usgs.gov
May 11, 2021 Page 4 of 6
COTS
Hardware or Software
Development or Maintenance of Custom Applications
Outsourced IT Services or On-site Support
Requirements herein are incorporated as part the Statement of Work/
Performance Work Statement:
10 N/A plies if the purpose he contract udes obtaining
A services.
Certification & Accreditation.
User Access to USGS IT Systems or IT Supports Services (Greater than User Access Certification and Accreditation on USGS systems to which the Contractor may have access under this contract will be conducted by the Government or another of its contractors.
Development or Maintenance of Custom Applications The contractor will perform Certification and Accreditation (C&A) services on the application developed or maintained hereunder prior to going into production. The application must be re-accredited every three years or whenever there is a major change that affects security. C&A documents will be provided to the COR in both hard copy and electronic forms.
The contractor must follow NIST SP 800-37, 800-18, 800-30, 800-60, 800-53A, Federal Information Processing Standard (FIPS) 199 and 200, the associated DOI guides/templates, the DOI Security Test & Evaluation (ST&E) Guide, and the DOI Privacy Impact Assessment.
NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/ FIPS documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/.
The contractor may request copies of DOI documents by contacting the Contracting Officer.
The government reserves the right to conduct the ST&E using either Government personnel or an independent contractor. The contractor will take immediate and timely action to correct or mitigate any weaknesses discovered as necessary to bring the application or system into compliance with the above requirement.
On-Site Contractor Support and Management of IT System or Off-Site Contractor Operation and Management of IT System
The Contractor must maintain systems that are compliant with NIST SP 800-18, 800-30, 800-37, 800-53A, 800-60, Federal Information Processing Standard (FIPS) 199 and 200, the associated DOI guides/templates, the DOI Security Test & Evaluation (ST&E) Guide, and the DOI Privacy Impact Assessment. As required by the above, Major Applications and
General Support Systems shall be certified and accredited (C&A) prior to going into production and re-accredited every three years or whenever there is a major change that affects security. C&A documents will be provided to the COR in both hard copy and electronic forms. NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. The contractor may request copies of DOI documents by contacting the Contracting Officer. The government will reserve the right to conduct the ST&E, using either Government personnel or an independent contractor. The contractor will take immediate and timely action to correct or mitigate any weaknesses discovered as necessary to bring the application or system into compliance with the above requirement.
Ap of t incl C&
11 N/A for COTS HW & SW, User Access to USGS IT Systems (other than IT services), IT Support Services (User
Level or greater access)
N/A Internet Logon Banner. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information
Technology.”
Development or Maintenance of Custom Applications OR On-Site Contractor Support and Management of IT System OR Off-site Contractor Oversight and Management of IT
System- Web-based applications developed or maintained under this contract must contain a USGS approved logon banner:
https://portal.doi.net/CIO/ITPMgmt/Documents/IT Standards/IT Security/DOI Security Control Standards (based on NIST SP 800-53 Revision 3)/Access Control v1.4.pdf
12 N/A http://csrc.nist.gov/publications/nistpubs/ http://csrc.nist.gov/publications/nistpubs/ http://csrc.nist.gov/publications/nistpubs/ http://csrc.nist.gov/publications/nistpubs/ http://csrc.nist.gov/publications/nistpubs/ http://csrc.nist.gov/publications/nistpubs/ http://csrc.nist.gov/publications/nistpubs/ https://portal.doi.net/CIO/ITPMgmt/Documents/IT%20Standards/IT%20Security/DOI%20Security%20Control%20Standards%20(based%20on%20NIST%20SP%20800-53%20Revision%203)/Access%20Control%20v1.4.pdf https://portal.doi.net/CIO/ITPMgmt/Documents/IT%20Standards/IT%20Security/DOI%20Security%20Control%20Standards%20(based%20on%20NIST%20SP%20800-53%20Revision%203)/Access%20Control%20v1.4.pdf https://portal.doi.net/CIO/ITPMgmt/Documents/IT%20Standards/IT%20Security/DOI%20Security%20Control%20Standards%20(based%20on%20NIST%20SP%20800-53%20Revision%203)/Access%20Control%20v1.4.pdf https://portal.doi.net/CIO/ITPMgmt/Documents/IT%20Standards/IT%20Security/DOI%20Security%20Control%20Standards%20(based%20on%20NIST%20SP%20800-53%20Revision%203)/Access%20Control%20v1.4.pdf https://portal.doi.net/CIO/ITPMgmt/Documents/IT%20Standards/IT%20Security/DOI%20Security%20Control%20Standards%20(based%20on%20NIST%20SP%20800-53%20Revision%203)/Access%20Control%20v1.4.pdf to askoag@usgs.gov
Incident Reporting. The Contractor shall perform in accordance with contract clause “Security Requirements: Facility Access and Information
Technology” - The contractor must report computer security incidents affecting DOI data or systems in accordance with the DOI Computer
Incident Response Guide.
December 14, 2022 Page 5 of 6
COTS
Hardware or Software
Development or Maintenance of Custom Applications
Outsourced IT Services or On-site Support
Requirements herein are incorporated as part the Statement of Work/
Performance Work Statement:
13 Quality Control. All software or hardware purchased must be free of malicious code such as viruses, Trojan horse programs, worms, spyware, etc. Validation of this must be written into the contract.
14 N/A N/A Self-Assessment. The Contractor shall perform in accordance with contract clause “Security Requirements: Facility Access and Information
Technology” - The contractor must conduct an annual self-assessment in accordance with annual DOI guidance on all information systems in production.
15 N/A Vulnerability Analysis. Vulnerability Analysis on USGS systems to which the Contractor may have access under this contract will be conducted by the Government or another of its contractors.
16 N/A Logon Banner. Contractor employees who access DOI information systems must acknowledge a government-approved legal warning banner prior to logging on to the system. This includes contractor owned information systems hosting DOI data.
17 N/A Security Controls.
to askoag@usgs.gov
The Contractor shall perform in accordance with contract clause
“Security Requirements: Facility Access and Information Technology” –
The Contractor shall ensure compliance with the security control requirements of the current version of NIST SP 800-53, Rev.1, which are applicable to the security categorization of the data or system. FIPS 199 and the NIST SP 800-60 will be used to determine information types and security categorizations.
18 N/A N/A Contingency Plan.
The Contractor shall perform in accordance with contract clause “Security Requirements: Facility Access and Information Technology.”
For IT Support Services: The Contractor shall submit a contingency plan in accordance with NIST SP 800-34 and DOI IT Systems Contingency Plan
Guide.
December 14, 2022 Page 6 of 6
File details come from the government source that posted it. Updated .