CORHQ-24-Q-0493-Amendment 0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF AWARD

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicble)

7. ADMINISTERED BY (If other than Item 6) CODE

FDIC 3700/56 (3-08)

FACILITY CODE

9A. AMENDMENT OF SOLICIATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 11)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offer must acknowledge receipt of this amendment by signing in Block 15b below and including the signed amendment with the offeror's proposal.

12. N/A

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO THE CHANGE ORDERS CLAUSE

B. THIS MODIFICATION IS ENTERED INTO PURSUANT TO THE AUTHORITY OF THE FDIC CONTRACTING OFFICER

C. THIS MODIFICATION IS ENTERED INTO PURSUANT TO MUTUAL AGREEMENT OF THE PARTIES

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remain unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

CORHQ-24-Q-0493 / 0001

Statement of Work 2FA Solution for EIDM

1.0. GENERAL

1.1. Background.

The Federal Deposit Insurance Corporation (FDIC) maintains the stability and public confidence in the nation’s financial system by (1) insuring deposits, (2) examining and supervising financial institutions, and (3) managing resolutions and receiverships. The Federal Deposit Insurance Corporation (FDIC) maintains partnership with a variety of external organizations including financial institutions, vendors, service providers, other government entities and regulators. Many core business processes involve users from these external partners. The FDIC needs to manage and maintain trusted relationships with these users, and grant them access to FDIC IT resources and data. Thus, the FDIC has developed an Extranet Identity Management (EIDM) solution to fulfill this need. A critical component of the EIDM solution includes the ability for certain user types (roles) to authenticate into FDIC resources using two-factor authentication (2FA). This statement of work is focused on the 2FA component.

1.2. Scope of Work.

The purpose of the existing 2FA solution is to ensure that external users accessing FDIC resources provide appropriate authentication information for the resources they are trying to access. The 2FA service shall meet the following FDIC requirements:

• The solution shall be a vendor hosted service package to include One Time Password (OTP) token authentication service infrastructure and support.

• The solution shall integrate with FDIC's Identity Management solution.

Specifically, the 2FA service exposes an API that can be leveraged by the Optimal Virtual Identity Federation (VISFED) Server and Microsoft Active Directory Federated Services (ADFS). It shall be compatible with ASP.NET and have either ISAPI filter-based authentication process compatible with IIS7.x (or higher) or provide a .NET v3 (or higher) programming interface, or API interface via Web Services and have support for SAML.

• The solution shall be capable of supporting multiple OTP provider technologies (for example, hard tokens, soft tokens, SMS, etc.) and be able to deliver those tokens to end-users via first-class or expedited mail (hard tokens), electronic delivery (downloadable application for soft tokens), and via SMS gateway to cellular phones within USA.

• The solution shall provide administrative capability for FDIC staff, including but not limited to reports providing trend information pertaining to failed logons, along with all other reports available by the 2FA solution platform.

• The 2FA service shall provide a simple user experience for the user to register to use the 2FA service and deliver seamlessly those tokens to users as mentioned above.

• The 2FA service shall be fully integrated with the FDIC Extranet Identity Management solution in the FDIC DEV (PIE, CIE), QA, PROD, and DR environments.

1.3. Government-Furnished Property.

N/A

2.0. APPLICABLE DOCUMENTS

N/A

3.0. REQUIREMENTS

OVERALL

• The 2FA service provider shall provide the FDIC with a subject matter expert with deep product knowledge and experience with implementation of 2FA service in different environments, in particular experience with successful implementations of 2FA service with a US government agency.

• The contractor shall provide all necessary management, supervision, personnel, supplies, materials and equipment.

• The 2FA service shall be available 99.9% of the time (three 9s) outside any maintenance window.

• The 2FA service provider shall provide user support for users for issues associated with using the 2FA service.

• The 2FA service provider shall provide life-cycle management support for the chosen OTP technologies (for example, replacement of hard tokens, updates of soft tokens, etc.).

• The 2FA provider shall be committed to the 2FA industry space and has a roadmap for the service for the next four years.

• The 2FA service shall be recoverable in the event of disaster in a backup data center with a recovery time objective (RTO) of no more than 12 hours and recovery point in time objective of no more than 12 hours prior and the backup data center must reside in a different U.S. power grid region from the primary data center as per FDIC

Continuity of Operations and FEMA Category II requirements.

SECURITY SPECIFIC

• All FDIC data must be stored and processed in the United States only.

• Any vendor technical support staff must be physically located within the United States soil.

• Non-U.S. citizens shall not be authorized to access or assist in the any FDIC system without official approval from the FDIC Contracting Officer.

• Vendor shall provide information regarding primary and backup data processing handling sites, including type and locations.

• Vendor shall provide common criteria certification information.

• 2FA service to be purchased by the FDIC shall be FIPS 140-2 compliant, including encryption of sensitive data at rest and in transit and comply with Security Requirement is Section 3.2.

3.2. System Security Assessment and Authorization Requirements

3.2.1. Authority to Operate

3.2.1.1. The Contractor shall not input, store, process, output, and/or transmit FDIC data within a Contractor IT system without an Authority to Operate (ATO) signed by the FDIC Authorizing Official (AO) granted via the System Security Authorization (SSA) process. The FDIC process for obtaining and maintaining ATO, is in accordance with NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The Contractor shall adhere to current FDIC policies, procedures, and guidance for the SSA process as defined below.

3.2.1.2. Complete the Security Authorization Process. The SSA process shall proceed according to the NIST SP 800-37 Risk Management Framework for Information Systems and Organizations or any successor publication including templates.

3.2.1.3. System Security Assessment and Authorization Process Documentation. SSA documentation shall be developed by the Contractor using the FDIC provided security documentation templates. SSA documentation consists of the following: Security Categorization Worksheet, System Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

3.2.1.4. Independent Assessment. Contractor shall have an independent third party perform an assessment of the FDIC-prescribed security and privacy controls as outlined in NIST SP 800-53 to determine the extent to which the selected controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements for the system and the FDIC. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

3.2.1.5. Support the Completion of the Privacy Compliance Documentation. As part of the SSA process, the Contractor may be required to support the FDIC in the completion of a Privacy Threshold Analysis (PTA). The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a contractor IT system that will store, maintain and use PII. Upon review of the PTA, the OCISO Privacy Section determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the FDIC in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the FDIC about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the FDIC’s privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at www.fdic.gov/privacy.

3.2.1.6. Authorization to Operate. Upon completion of the SSA documentation and independent assessment, the Contractor shall submit a signed SSA package, validated by the independent third party, to the Oversight Manager for acceptance by the FDIC Authorizing Official (AO), or designee, at least thirty (30) days prior to the use of the system. The FDIC is the final authority on the compliance of the SSA package and may limit the number of resubmissions of a modified SSA package. Once the ATO has been granted by the FDIC AO the Contracting Officer shall incorporate the ATO letter into the contract as a compliance document. The FDIC’s issuance of the ATO does not alleviate the Contractor’s responsibility to ensure the controls are implemented and operating effectively. The SSA package must include the following:

3.2.1.6.1. Deliverables (30 Days Prior to System Use)

3.2.1.6.1.1. Security and privacy plans

3.2.1.6.1.2. Security and privacy assessment reports

3.2.1.6.1.3. Plan of action and milestones

3.2.1.6.1.4. Supporting assessment evidence or other documentation, as required.

3.2.1.7. Continuous Monitoring/Ongoing Assessment. After an initial authorization, the

Contractor shall have the security and privacy controls assessed on an ongoing basis in accordance with NIST SP 800-37 and based on the FDIC Control Assessment Frequency.

Ongoing assessment of the control effectiveness is part of the continuous monitoring activities of the FDIC. Adherence to the terms and conditions specified by the AO as part of the authorization decision are also monitored. Ongoing control assessment continues as the information generated as part of continuous monitoring is correlated, analyzed, and reported to the Oversight Manager for acceptance by the FDIC AO. The system needs to undergo a Security Impact Assessment (SIA) whenever any changes/modifications are made to the system. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default. The following table shall be utilized for the control assessment schedule:

Control Assessment Schedule

Period Scope

Base Year 33% subset of requirements

Option Year 1 33% subset of requirements

Option Year 2 33% subset of requirements

Option Year 3 100% of requirements

3.3.

3.3. Personnel.

3.4. Deliverables

The contractor shall provide the following deliverables in connection with this work:

Deliverable Description Estimated Delivery Date

A working 2FA solution for the FDIC DEV (PIE, CIE), QA, PROD and DR environments including required tokens, authentication service and support.

Contract Award

Integration support with FDIC for all release upgrades of the 2FA solution platform.

As required

Operational support for the 2FA platform and escalation support for end-users issues associated with using the 2FA service.

As required

Weekly Status Report, in a format to be agreed upon by the FDIC project manager (or designee) and the contractor project manager to capture weekly performance against ATO Project Plan and scope of work performed by solution engineers.

This plan shall include hours worked weekly under any labor hour category and planned hours for the following week.

Weekly

User registration documentation for users to sign up to use the 2FA service.

As required

System documentation, Configuration and maintenance procedures as required by FDIC Operations Personnel.

As required

Support for FDIC Security requests pertaining to security of the system, penetration testing, configuration baselines.

As required

Systems usage and other agreed upon reports. Monthly

System Maintenance and support services. As required

Re-configuration of system and ATO Deliverables

System Security Assessment and Authorization Requirements project plan: Timelines for system build out, assessment, and implementation within 30 days of contract award. This project plan is required to be updated once the initial scanning assessment has been completed.

30 Days after award

System Security Assessment and Authorization Documentation

In accordance with Project Plan

Independent Assessment Results In accordance with Project Plan

SSA Package (must include Security and Privacy Plans, Security and Privacy Reports, POAMs, & support assessment evidence)*

In accordance with Project Plan but NLT 31 December 2022

ATO Maintenance Deliverables:

Monthly security scan reports* Monthly

* Payment for these items will only begin after FDIC has approved the ATO. Vendor shall submit invoices on a monthly basis for services furnished during the preceding month, unless otherwise stated, and each invoice shall reference the applicable line under the Statement of Work and shall include supporting detail and documentation of all charges. In no event shall FDIC pay for services not performed during the period of performance of this contract.

3.5. Place of Delivery or Performance.

The performance will take place at a contractor’s facility, and third-party shipping facility.

DOA/ASB

3501 Fairfax Drive Arlington, VA 22226 ditoles@fdic.gov

(703) 5622778 ditoles@fdic.gov

The Offer Due Date is extended to December 30, 2024 at 12pm EST.