B08_Attachment_-_FISMA_COTS.docx

Work Statement Attachment - Information Technology Security Requirements Summary (Instructions)

1. Background Investigation (N/A)

2. Non-disclosure Agreement (N/A)

3. Training (N/A)

4. Personnel Changes (N/A)

5. Contractor Location (N/A)

6. Applicable Standards (N/A)

7. Security Categorization (N/A)

8. Property Rights (N/A)

9. Independent Verification and Validation (IV & V) (N/A)

10. Certification & Accreditation (N/A)

11. Internet Logon Banner N/A

12. Incident Reporting (N/A)

13. Quality Control (N/A)

14. Self Assessment (N/A)

15. Vulnerability Analysis (N/A)

16. Logon Banner N/A

17. Security Controls (N/A)

18. Contingency Plan (N/A)

1. Background Investigation Instructions: This topic applies whenever any contractor employee has frequent access to a USGS facility or any unsupervised access to a USGS system (on site or remote access). This topic is largely covered in a separate clause to be inserted by the Contracting Officer (GS1414 or in Denver GS 1419).

For all other services involving user-level access (or higher) to any USGS/DOI system –

· User Access to USGS IT Systems (includes contracts for other than IT services)

· IT Support services (greater than user access)

· Development or Maintenance of Custom Applications

· On-site contractor support and management of IT system

· Off-site contractor Oversight and Mgmt of IT System

· IT Security Services [Requisitioner must determine appropriate clearance levels using guidance in DM DOI Departmental Manual Part 441, Chapter 3, Illustration 1 and complete the fill-in section. Human Resources and the system security manager may also be consulted.] Contractor employees who will have access to federal information technology (IT) systems are subject to background investigations by the Federal Office of Personnel Management. Procedures for investigations and obtaining identity credentials are described in clause GS1414 (or GS1419 if working on the Denver Federal Center). The level of investigation required will be the same as would be required for federal employees holding positions involving similar duties.

Based on the risk and sensitivity of duties performed and system access authorities to be granted, the following type of background investigations will be required, as described in DOI Departmental Manual Part 441, Chapter 3, Illustration 1 (available at: http://elips.doi.gov/app_dm/act_getfiles.cfm?relnum=3860).

2. Non-disclosure Agreement Instructions: This topic applies whenever any contractor employee has unsupervised access to a USGS system (even if only basic network, internet or Lotus email). It is primarily covered in a separate clause to be inserted by the Contracting Officer (GS1405 or GS1406). The DOI model nondisclosure agreement is found at the end of this document.

For other services involving user-level access (or higher) to any USGS/DOI system-

· User Access to USGS IT Systems known to contain sensitive or proprietary data

· IT Support services (greater than user access)

· Development or Maintenance of Custom Applications

· On-site contractor support and management of IT system

· Off-site contractor Oversight and Mgmt of IT System

· IT Security Services

Prior to receiving access to USGS computers, contractor employees shall be required to sign nondisclosure or other system security agreements, depending on the systems to be used and level of access granted. The required non-disclosure agreement will be similar to the attached but may be customized as needed to reflect the data involved. Restrictions on use, duplication and disclosure of sensitive and proprietary data are covered in clause GS1406.

System: [Identify covered system(s) to which the contractor may have access] Work to be performed: [Summarize the nature of the contractor's use of such records, such as User-level access to system containing protected records Operation or maintenance of Privacy Act System of records or computers hosting such system Design or modification of a Privacy Act system of records ] The contractor will not be required or permitted to respond to requests for Privacy Act data or to make decisions about releases of data under the Act. Contractor will ensure its employees are instructed to safeguard against improper use or release of such data and advise them that violation of the Act may involve criminal penalties. The contractor will comply with FAR clause 52.224-2, Privacy Act, incorporated herein by reference, and with DOI Privacy Act regulations at 43 CFR 2, Subpart D, available at: http://www.doi.gov/foia/43cfrsub.html .

3. Training

For other services involving user-level access (or higher) to any USGS/DOI system

· User Access to USGS IT Systems (Contracts for other than IT services)

· IT Support services (greater than user access)

· Development or Maintenance of Custom Applications*

· On-site contractor support and management of IT system

· Off-site contractor Oversight and Mgmt of IT System

· IT Security Services*

* may be "not applicable" if work will be performed off-site and contractor will not have unsupervised access to any USGS system.

Contractor employees shall complete USGS-defined Federal Information Systems Security Awareness computer security training before being granted system access and must renew the training annually. Failure to complete training within the required timeframe may result in loss of system access for that user. Contractor employees with significant IT security responsibilities shall also complete specialized role-based training.

4. Personnel Changes

For other services involving user-level access (or higher) to any USGS/DOI system

· User Access to USGS IT Systems

· IT Support services (greater than user access)

· Development or Maintenance of Custom Applications*

· On-site contractor support and management of IT system

· Off-site contractor Oversight and Mgmt of IT System

· IT Security Services*

* may be "not applicable" if work will be performed off-site and contractor will not have unsupervised access to any USGS system.

Before starting work, the contractor will provide a listing to the COR/technical liaison identifying contractor and subcontractor employees requiring access to USGS systems for performance of work hereunder and will assign each person a unique user ID. The contractor shall immediately advise the USGS Project Officer when any of their personnel no longer require USGS computer access so that those ID's and access privileges can be cancelled. When possible, the COR must be notified in advance of any potentially unfriendly termination of an employee or subcontractor.

5. Contractor Location Instructions: As a practical matter, the requirement for background clearance for user access to USGS system effectively precludes us from allowing performance in a foreign country for any service involving work requiring user access (or greater) to a USGS system. DOI policy is that custom software development and outsourced operations must also be located in the United States to the maximum extent practical. Unless national security issues are involved, we have to stop short of an outright prohibition. If a contractor or prospective offeror proposes to perform some or all of the services abroad, the contractor must provide an acceptable security plan specifically to address mitigation of the resulting problems of communication, control, data protection, personnel clearances, etc. Location within the US may be considered in source selection as part of a security evaluation factor.

COTS Hardware or Software User Access to USGS IT Systems Not applicable.

For other services involving user-level access (or higher) to any USGS/DOI system

· IT Support services (greater than user access)

· Development or Maintenance of Custom Applications

· On-site contractor support and management of IT system

· Off-site contractor Oversight and Mgmt of IT System

No portion of the services to be performed hereunder may be performed outside the United States without the express written permission of the Contracting Officer. If a contractor proposes to perform services outside the United States, the contractor must submit a Security Plan to address mitigation of security issues due specifically to location. The Security Plan Template is available upon request from the Contracting Officer. Such proposals will not be accepted unless the contractor can demonstrate that the Government systems or data would be no more vulnerable than if work were performed domestically.

6. Applicable Standards

For other services involving user-level access (or higher) to any USGS/DOI system

· COTS Hardware or Software

· User Access to USGS IT Systems

· IT Support services (greater than user access)

· On-site contractor support and management of IT system

· Off-site contractor Oversight and Mgmt of IT System

Not applicable.

7. Asset Valuation Instruction: Applies only to Major Applications and General Support Systems as defined in OMB Circular A-130, Appendix III and NIST SP800-53. For all others, use "Not applicable - not a Major Application or GSS." The security categorization is generally the responsibility of the government unless it is specifically stated in the SOW.

[If contractor is responsible for system security controls, use language from row below.]

Development or Maintenance of Custom Applications

On-site contractor support and management of IT system

The Government has defined the [insert name of system to be developed, operated or maintained by the contractor] to be a [Major Application], [Minor Application] or [General support system] as defined in OMB Circular A-130, Appendix III and NIST SP800-53. The following risk and sensitivity levels have been assigned based on the FIPS 199 and the NIST SP 800-60.

Mission impact:

Data sensitivity Risk level:

Bureau/departmental/national criticality:

IT Security Services * [Applies only if the purpose of the contract includes obtaining asset valuation services.. Otherwise, use "not applicable."] The Contractor shall use the FIPS 199 and the NIST SP 800-60 to determine information types and security categorization based on mission impact, data sensitivity, risk level, and bureau / departmental / national criticality for Contractor-owned and operated systems used to provide services under this contract. Solicitations must include either the complete publication or a reference to public facilities, such as a website or office, where it may be accessed.

8. Property Rights

COTS Hardware or Software Amplify if greater rights than these minimum are needed. Examples of greater rights may be those necessary for networking purposes or use of the software from remote terminals communicating with a host computer where the software is located. In addition, the specification or work statement must adequately describe the computer programs and/or data bases, the physical form of delivery, and any necessary documentation.

If the acquisition is by lease or license: Also address the disposition of the computer software (by returning to the vendor or destroying) at the end of the term of the lease or license [If order under FSS or other existing contract vehicle:] Rights to software acquired hereunder are set forth in the basic contract.

[If open market contract or purchase order:] The Government's rights in software delivered hereunder shall be as described in software developer's commercial software license agreement or the clause FAR 52.227-19, Commercial Computer Software-Restricted Rights, whichever is greater.

IT Support services (User-level or greater access) On-site contractor support and management of IT system Off-site contractor Oversight and Mgmt of IT System [Select either COTS or custom software language as applicable. If both apply, identify software/data deliverables governed by each clause.]

9. Independent Verification and Validation (IV & V)

COTS Hardware or Software User Access to USGS IT Systems Not applicable.

Development or Maintenance of Custom Applications IT Support services (greater than user access) Software will be independently verified and validated by the Government or another selected contractor prior to being moved into production.

IT Security Service* [Applies only if the purpose of the contract includes obtaining IV&V services. Otherwise, use "not applicable."] Contractor will perform independent verification and validation services on the following systems [or for the following software applications:] [Identify which USGS software the contractor will be responsible for testing] IV and V will be conducted in accordance with DOI SDLC Security Integration Guide http://internal.usgs.gov/gio/security/doi_sdlc_security_integration_guide_for_doi_it_systems_attachment.pdf

10. Certification & Accreditation

COTS Hardware or Software

Not applicable.

Development or Maintenance of Custom Applications* *Applies only if the purpose of the contract includes obtaining C&A services. Otherwise, use "not applicable."

The contractor will perform Certification and Accreditation (C&A) services on the application developed or maintained hereunder prior to going into production. The application must be re-accredited every three years or whenever there is a major change that affects security. C&A documents will be provided to the COR in both hard copy and electronic forms. The contractor must follow NIST SP 800-37, 800-18, 800-30, 800-60, 800-53A, Federal Information Processing Standard (FIPS) 199 and 200, the associated DOI guides/templates, the DOI Security Test & Evaluation (ST&E) Guide, and the DOI Privacy Impact Assessment. NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. FIPS documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. The contractor may request copies of DOI documents by contacting the Contracting Officer.

The government reserves the right to conduct the ST&E, using either Government personnel or an independent contractor.

The contractor will take immediate and timely action to correct or mitigate any weaknesses discovered as necessary to bring the application or system into compliance with the above requirement.

User Access to USGS IT Systems IT Support services (greater than user access) Certification and Accreditation on USGS systems to which the Contractor may have access under this contract will be conducted by the Government or another of its contractors.

On-site contractor support and management of IT system Off-site contractor Operation and Mgmt of IT System The Contractor must maintain systems that are compliant with NIST SP 800-18, 800-30, 800-37, 800-53A, 800-60, Federal Information Processing Standard (FIPS) 199 and 200, the associated DOI guides/templates, the DOI Security Test & Evaluation (ST&E) Guide, and the DOI Privacy Impact Assessment.

As required by the above, Major Applications and General Support Systems shall be certified and accredited (C&A) prior to going into production and re-accredited every three years or whenever there is a major change that affects security. C&A documents will be provided to the COR in both hard copy and electronic forms.

NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. The contractor may request copies of DOI documents by contacting the Contracting Officer.

The government will reserve the right to conduct the ST&E, using either Government personnel or an independent contractor.

The contractor will take immediate and timely action to correct or mitigate any weaknesses discovered as necessary to bring the application or system into compliance with the above requirement.

IT Security Service* *Applies only if the purpose of the contract includes obtaining C&A services. Otherwise, use "not applicable."

The contractor will perform Certification and Accreditation (C&A) services on the specified USGS system (s). C&A documents will be provided to the COR in both hard copy and electronic forms. The contractor must follow NIST SP 800-37, 800-18, 800-30, 800-60, 800-53A, Federal Information Processing Standard (FIPS) 199 and 200, the associated DOI guides/templates, the DOI Security Test & Evaluation (ST&E) Guide, and the DOI Privacy Impact Assessment. NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. FIPS documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. The contractor may request copies of DOI documents by contacting the Contracting Officer.

The contractor must provide a report recommending actions the Government or its contractors should take to correct or mitigate any weaknesses discovered.

11. Internet Logon Banner:

User Access to USGS IT Systems (other than IT services) IT Security Services Not applicable. Contractor will not be required to develop or maintain any public internet pages under this contract.

On-site contractor support and management of IT system

Off-site contractor Oversight and Mgmt of IT System Web-based applications developed or maintained under this contract must contain a USGS approved logon banner. See http://internal.usgs.gov/gio/security/standard_usgs_logon_banner.doc.

12. Incident Reporting:

For services involving user-level access (or higher) to any USGS/DOI system

· User Access to USGS IT Systems

· IT Support services (greater than user access)

· Development or Maintenance of Custom Applications*

· On-site contractor support and management of IT system

· Off-site contractor Oversight and Mgmt of IT System

· IT Security Services*

* Applies only if contractor is working on-site or has non-supervised access to a USGS system. Otherwise, use "not applicable."

Contractor employees must report any computer security incidents (viruses, intrusion attempts, system compromises, offensive e-mail, etc.) which may affect Government data or systems in accordance with the DOI Computer Incident Response Guide. Report computer security incidents to USGS help desk or Security Point Of Contact (SPOC). In many cases, your local system administrator is your Security Point Of Contact. The help desk or SPOC will investigate and coordinate with the Computer Security Incident Response Team (CSIRT).

13. Quality Control (Malicious Code):

COTS Hardware or Software Development or Maintenance of Custom Applications User Access to USGS IT Systems IT Support services (User-level or greater access) On-site contractor support and management of IT system Off-site contractor Oversight and Mgmt of IT System IT Security Services

All software or hardware purchased must be free of malicious code such as viruses, Trojan horse programs, worms, spyware, etc.

Validation of this must be written into the contract.

14. Self Assessment:

Instruction: Applies only to Major Applications and General Support Systems as defined in OMB Circular A-130, Appendix III and NIST SP800-53. For all others, use "Not applicable – not a Major Application or GSS."

COTS Hardware or Software

Not applicable.

Development or Maintenance of Custom Applications

On-site contractor support and management of IT system

Off-site contractor Oversight and Mgmt of IT System The contractor shall conduct an annual self assessment in accordance with NIST SP 800-53 on major applications and General Support Systems operated or maintained under this contract and on any and outsourced applications in production, or other off-site systems used by the contractor for performance under this contract. NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. Both hard copy and electronic copies of the assessment will be provided to the COR.

The government will reserve the right to conduct such an assessment using Government personnel or another contractor.

The contractor will take immediate action to correct or mitigate any weaknesses discovered during such testing to ensure that all systems meet security standards specified elsewhere in this work statement.

15. Vulnerability Analysis:

On-site contractor support and management of IT system

Off-site contractor Oversight and Mgmt of IT System All systems operated and managed by the contractor shall be scanned monthly with a vulnerability analysis tool provided by the Government. All "safe" or "non-destructive" checks must be turned on. All electronic copy of each report and session data shall be provided to the COR.

The Government may conduct additional independent vulnerability scans, prearranged or unannounced. All high risk systems and systems accessible from the Internet will be tested for penetration. Independent testing may be performed by the Government or by another contractor.

The contractor shall take immediate action to correct or mitigate any weaknesses discovered during any vulnerability testing, as needed to bring the system into compliance with security standards invoked elsewhere in this work statement.

16. Logon Banner:

User Access to USGS IT Systems IT Support services (greater than user access) IT Security Service *

* Applies if contractor may need access to any USGS system When presented with the USGS logon banner, contractor employees shall read and acknowledge a Government approved logon warning.

On-site contractor support and management of IT system Off-site contractor Operation and Mgmt of IT System When presented with the USGS logon banner, contractor employees shall read and acknowledge a Government approved logon warning. Contractor will maintain and update such warnings to accommodate updated regulations and new concerns, as required by the COR.

IT Security Service *

* Applies if contractor will not have user access to any USGS system.

Not applicable. Contractor will not have user access to any USGS system.

17. Security Controls:

Security functionality in applications or integrated systems delivered hereunder must operate with the Government systems on which or with which it will eventually be deployed. Products delivered hereunder must not cause misoperation of government resources or loss of integrity, confidentiality, or availability of electronic information or data.

* Below Applies only if contractor creates login access to a USGS application. Otherwise, use "not applicable."

The Contractor shall ensure compliance with the security control requirements of the current version of NIST SP 800-53 and FIPS 200 appropriate to the sensitivity and criticality of the application/system, assigned by the Government based on FIPS 199. DOI and/or USGS common security configurations in addition to those recommended by NIST will be used where appropriate. NIST common security configurations are available from the NIST web site at http://checklists.nist.gov NIST Special Publications are available on the Internet at http://csrc.nist.gov/publications/PubsSPs.html. FIPS documents are available on the Internet at http://csrc.nist.gov/publications/PubsFIPS.html. Any applicable DOI or USGS documents will be provided by the Contracting Officer, upon request.

NIST Special Publications are available on the Internet at http://csrc.nist.gov/publications/PubsSPs.html. FIPS documents are available on the Internet at http://csrc.nist.gov/publications/PubsFIPS.html. Any applicable DOI or USGS documents will be provided by the Contracting Officer, upon request.

Off-site contractor Oversight and Mgmt of IT System The Contractor shall ensure compliance with the security control requirements of the current version of NIST SP 800-53 and FIPS 200 appropriate to the sensitivity and criticality of the application/system, assigned by the Government based on FIPS 199. DOI and/or USGS common security configurations in addition to those recommended by NIST will be used where appropriate. NIST common security configurations are available from the NIST web site at http://checklists.nist.gov NIST Special Publications are available on the Internet at http://csrc.nist.gov/publications/PubsSPs.html. FIPS documents are available on the Internet at http://csrc.nist.gov/publications/PubsFIPS.html. Any applicable DOI or USGS documents will be provided by the Contracting Officer, upon request.

18. Contingency Plan:

Instructions: Contractor's responsibilities during a contingency operation or in contingency planning can vary widely. Examples:

· Contractor will provide advisory service specifically for development of a contingency plan for a USGS system, with no role or responsibility in the event of an actual contingency operation.

· Contractor will be responsible for developing, maintaining and executing a contingency plan for a contractor operated and managed system

· Contractor will be responsible for executing a portion of a USGS-developed system contingency plan, such as responsibility for performing or assisting in recovery and re-establishment of service at an alternate location.

· Contractor has no critical function to perform in the event of a contingency operation and should stop work until notified by the Government where and when to resume contract performance.

In addition to incorporation of basic language provided below, the work statement needs to specify what the contractor's responsibilities will be in the event of a contingency operation and what the Contractor's contingency plan needs to cover. If the contractor has no critical responsibilities, then he should only be required to provide contact information for USGS and a plan for communication with his employees.

COTS Hardware or Software Non-IT Services involving User Access to USGS IT Systems *

* If the Government contingency plan depends on this contractor as part of our contingency response, this should be addressed in the work statement, but as the contract is not for IT services, the need for this coverage and plan is not an IT security issue.

Not applicable

Development or Maintenance of Custom Applications* If contract is for one-time development with no continuing support responsibilities, use "not applicable" The Contractor shall submit a contingency plan for restoration and testing of software and resumption of maintenance support during a contingency operation. The plan must conform to applicable portions of NIST SP 800-34 and DOI IT Systems Contingency Plan Guide. The Contractor shall submit contingency plans to the COR. NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. The contractor can request copies of the DOI IT Systems Contingency Plan Guide by contacting the Contracting Officer.

On-site contractor support and management of IT system Off-site contractor Oversight and Mgmt of IT System The Contractor shall submit a contingency plan in accordance with NIST SP 800-34 and DOI IT Systems Contingency Plan Guide. The Contractor shall submit contingency plans to the COR. NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. The contractor can request copies of the DOI IT Systems Contingency Plan Guide by contacting the Contracting Officer.

IT Security Services [Applies only if the purpose of the contract includes obtaining contingency planning services. Otherwise, use "not applicable."] The Contractor shall submit a contingency plan in accordance with NIST SP 800-34 and DOI IT Systems Contingency Plan Guide. The Contractor shall submit contingency plans to the COR. NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. The contractor can request copies of the DOI IT Systems Contingency Plan Guide by contacting the Contracting Officer.

Rev. December 2011

- 29 -

CONTRACTOR EMPLOYEE NON-DISCLOSURE AGREEMENT

It is understood that as part of my official duties under Contract No. (insert contract no.), I may come in contact with Government procurement sensitive information or proprietary business information from other contractors (e.g., cost data). I, as an official Government contractor, certify that I will not disclose, publish, divulge, release, or make known, in any manner or to any extent, to any individual other than an appropriate or authorized Government employee, the content of any procurement sensitive information provided during the course of my employment. I understand that for the purpose of this agreement, procurement sensitive information is to include procurement data, contract information, plans, strategies and any other information that may be deemed sensitive.

I further certify that I will use proprietary business information only for official purposes in the performance of Contract No. (insert contract no.), and will disclose such information only to those individuals who have a specific need to know in performance of their official Government duties. I hereby agree not to disclose to others any contractual information, including, but not limited to, proprietary information, trade secrets, financial data, technical proposals which will be presented to me by the Contracting Officer or other Government Official. I agree that the described information is “inside information” and shall not be used for private gain by myself or another person, particularly one with whom I have family, business, or financial ties. For the purposes of this agreement, “inside information” means information obtained under Government authority which has not become part of the body of public information. I specifically will not disclose any such information to employees of my company or any other contractor employees who have not signed this agreement. I will take all reasonable precautions to prevent the unauthorized disclosure and use of such information.

I hereby certify that I have read the non-disclosure agreement described above and I am familiar with the directives and policies governing the disclosure of procurement sensitive information. I will fully and completely observe these directives and will not disclose such information to any unauthorized person, or use any information obtained for private use or gain at any time, including subsequent to the performance of duties under (insert contract no.).

Rev. December 2011

- 30 -