B08__Attachment_2_FISMA.pdf
PDF 2 MB Posted
- Attached to
- UMESC MASS SPECTROMETER BRAND NAME ONLY
- Solicitation number
- 140G0225Q0120
About this file
This document is a FISMA 18-Point Checklist for IT Security Guidelines from the U.S. Geological Survey (USGS) Office of Acquisition and Grants, dated December 14, 2022. The checklist provides comprehensive security requirements for contractors working with USGS IT systems, covering scenarios involving COTS hardware/software, custom application development, and on-site IT support services. Key security requirements include background investigations, non-disclosure agreements, employee training, personnel change notifications, security categorization, property rights, independent verification and validation, certification and accreditation, quality control, self-assessment, vulnerability analysis, security controls, and contingency planning.
The document mandates strict protocols for contractors, such as requiring employees to complete end-user computer security awareness training, signing non-disclosure agreements, immediately reporting personnel changes, conducting annual self-assessments, and ensuring all software and hardware are free of malicious code. Contractors must comply with various federal standards including NIST SP 800-64, DOI System Development Life Cycle (SDLC) Security Integration Guide, and FIPS 199. The checklist also specifies requirements for different access levels, from basic network access to custom application development, and includes provisions for international work, emphasizing the protection of system confidentiality, integrity, and availability.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| B08__Attachment_1_508_Compliance.pdf | ||
| Sol_140G0225Q0120.pdf | ||
| B08_Attachment_3_Brand_Name_Justification_REDACTED.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
FISMA 18-Point Checklist - IT Security Guidelines
COTS Development or Outsourced IT
Hardware Maintenance of Services or or Custom On-site
Software Applications Support
N/A _J LJ
N/A u _J
Contractor will have access to Privacy
Act System of
Records - Work under this contract will involve design, development or operation of (access
to) system(s) of records containing personal information protected by the
Privacy Act (5 U.S.C.
Section 552a).
U.S. Geological Survey Office of Acquisition and Grants Questions to askoaq@usgs.gov
Requirements herein are incorporated as part the Statement of Work/ Performance Work Statement:
Background Investigations. The Contractor shall perform in accordance with clause "Security Requirements: Facility Access and Information Technology."
Non-disclosure Agreement. Prior to receiving access to USGS computers, contractor employees shall be required to sign nondisclosure or other system security agreements, depending on the systems to be used and level of access granted.
Applies whenever any contractor employee has unsupervised access to a USGS system ( even if only basic network, internet or email or will develop custom applications) such as:
. User Access to USGS IT Systems known to contain sensitive or proprietary data . IT Support services (greater than user access) . Development or Maintenance of Custom Applications
. On-site contractor support and management of IT system
. Off-site contractor Oversight and Management of IT System
• IT Security Services
Privacy Act System: [Identify covered system(s) to which the contractor
I may have access]
Work to be performed: [Summarize nature of the contractor's use of such records, such as]
• User-level access to system containing protected records
• Operation or maintenance of Privacy Act System of records or computers hosting such system
• Design or modification of a Privacy Act system of records]
The contractor is not required or permitted to respond to requests for Privacy Act data or to make decisions about releases of data under the Act. Contractor shall ensure its employees are instructed to safeguard against improper use or release of such data and advise them that violation of the Act may involve criminal penalties. The contractor will comply with FAR clause 52.224-2, Privacy Act, incorporated herein by reference and with DOI Privacy Act regulations at 43 CFR 2, Subpart D
December 14, 2022 Page 1 of 6
Attachment #2
File details come from the government source that posted it. Updated .