J-20_Information_Security_Attestation.docx

Attachment J.20 – Information Security Attestation

(Insert Offeror/Company Name) understands and unconditionally assents to the requirements of the Statement of Work entitled Security Clause (Section G.27) and attests that it has in place an effective security program that articulates and demonstrates the Offeror’s commitment to security. Specifically, the (Insert Offeror/Company Name) attests to the security program and security-related requirements in the table below.

Security Program Requirements

1. (Insert Offeror/Company Name) has written security policies and procedures maintained in a QIO System Security Plan.

2. (Insert Offeror/Company Name) has a Security Point of Contact to work with CMS ISSO on FISMA compliance requirements and other security activities.

3. (Insert Offeror/Company Name) conducts employee training and education program on security awareness annually (or more frequent basis).

4. (Insert Offeror/Company Name) has a process to report security-related violations to CMS.

5. (Insert Offeror/Company Name) has knowledge of CMS security requirements and policy as specified within the CMS Information Security (IS) “Virtual Handbook” (a collection of CMS policies, procedures, standards and guidelines that implements the CMS Information Security Program) and the QualityNet System Security Policy.

6. (Insert Offeror/Company Name) has an enforcement process to address security violations.

7. (Insert Offeror/Company Name) has processes to develop and implement security corrective action plans to ensure continued FISMA compliance.

(Insert Offeror/Company Name) agrees that this Attestation will become a part of the organization’s proposal. As an individual with authority to bind the (Insert Offeror/Company Name), I accept responsibility for this written document.