Crypto Class 1 - Attachment 6b. Appendix to the PWS - Standards and Compliance Requirements.pdf

Appendix TBD - Standards and Compliance Requirements

Procurement Sensitive For Official Use Only (FOUO)

Attachment A02 – Standards and Compliance Requirements outlines compliance specifications for FORCE Bridge performance delivery and services that the Contractor must meet and maintain.

The Government recognizes that some of the standards and their associated compliance data items identified below may change. Throughout this effort, the Contractor or the Government may propose following newer standards and their associated compliance data items that replace or supersede those below. To substitute newer standards and their associated data items the Contractor shall: 1) identify existing standards and data items to be replaced; 2) identify new standards and associated data items proposed for use; 3) provide a rationale for using the new items including cost, schedule, performance, and supportability impact; and 4) receive government approval. In the event of conflict between any of the documents comprised in the sections below, said conflict shall be brought to the attention of the Government and resolved with the Government. These standards apply to services delivered by the Contractor, services maintained by the Contractor and service designs proposed by the Contractor.

A2.1 CONGRESSIONAL MANDATES:

A. E-Government Act of 2002 at: https://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-

107publ347.pdf.

B. Federal Information Security Modernization Act of 2014 (FISMA) at:

https://www.gpo.gov/fdsys/pkg/PLAW-113publ283/pdf/PLAW-113publ283.pdf.

C. Privacy Act of 1974, 5 U.S.C. § 552a at https://www.gpo.gov/fdsys/pkg/USCODE-2012-title5/pdf/USCODE-2012-title5-partI-chap5-subchapII-sec552a.pdf D. Overview of the Privacy Act of 1974, 2015 Edition at: https://www.justice.gov/opcl/overview-privacy-act-1974-2015-edition.

E. Public Law 107-56 (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept an Obstruct Terrorism (USA PATRIOT ACT) Act of 2001) at:

https://www.gpo.gov/fdsys/pkg/PLAW-107publ56/content-detail.html

F. Homeland Security Act of 2002 (Public Law 107-296, 116 Stat. 2135) at:

https://www.dhs.gov/sites/default/files/publications/hr_5005_enr.pdf

G. Federal Records Management: (https://www.archives.gov/records-mgmt/laws)

a. 5 U.S.C. Chapter 5, Subchapter II, Administrative Procedures

b. 18 U.S.C. Chapter 101 Records and Reports

c. 40 U.S.C Chapter 25 Information Technology Management

d. 44 U.S.C. Chapter 21-35 Records Administration

e. 44 U.S.C. Chapter 31 – Federal Records Act

i. Requires all federal agencies to make and preserve records containing adequate and proper documentation of their organization, function, policies, procedures, decisions, and essential transactions. These records are public property and must be managed according to applicable laws and regulations as set forth by the National Archives and Records Administration (NARA) at:

https://www.congress.gov/bill/113th-congress/house-bill/1233/text https://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.gpo.gov/fdsys/pkg/PLAW-113publ283/pdf/PLAW-113publ283.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2012-title5/pdf/USCODE-2012-title5-partI-chap5-subchapII-sec552a.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2012-title5/pdf/USCODE-2012-title5-partI-chap5-subchapII-sec552a.pdf https://www.justice.gov/opcl/overview-privacy-act-1974-2015-edition https://www.justice.gov/opcl/overview-privacy-act-1974-2015-edition https://www.gpo.gov/fdsys/pkg/PLAW-107publ56/content-detail.html https://www.dhs.gov/sites/default/files/publications/hr_5005_enr.pdf https://www.archives.gov/records-mgmt/laws https://www.congress.gov/bill/113th-congress/house-bill/1233/text

Procurement Sensitive For Official Use Only (FOUO)

H. Rehabilitation Act of 1973 ((29 U.S.C § 794 (d)) at: http://www.gpo.gov/fdsys/pkg/USCODE- 2011-title29/html/USCODE-2011-title29-chap16-subchapV-sec794d.htm and https://www.ecfr.gov/cgi-bin/text-idx?tpl=/ecfrbrowse/Title36/36cfr1194_main_02.tpl

a. Additional Notes:

i. Requires Federal agencies to make their electronic and information technology

(EIT) accessible to people with disabilities. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. Under Section 508, agencies must give disabled employees and members of the public access to information comparable to the access available to others.

ii. The offeror’s written proposal shall include a statement indicating its capability to comply with Section 508 requirements throughout its performance of this TO. The offeror’s proposal will be evaluated to determine whether it includes a statement indicating its capability to comply with Section 508 requirements throughout its performance of this TO. Any proposal that does not include a statement indicating the offeror’s capability to comply with Section 508 requirements throughout its performance of this TO shall be eliminated from further consideration for award.

iii. The Contractor represents that the products and services quoted in response to this solicitation comply with the Electronic and Information Technology Accessibility Standards at 36 CFR 1194, unless specifically stated otherwise within its submission.

iv. The contractor must clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., Vendor’s or other exact web page location). The contractor must ensure that the list is easily accessible by typical users beginning at time of award or at the proposal of introduction to USMS IT Enterprise.

v. The contractor shall use 508 best practices to ensure that information and services are accessible to persons with disabilities and during development create accessible digital products (https://www.section508.gov/create). The Revised 508 Standards include not just IT tools and systems, but electronic content such as documents, web pages, presentations, social media content, blogs, and certain emails.

vi. The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the offered device be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

vii. If the Contracting Officer determines that any furnished product or service is not (or cannot be made to be) in compliance with the contract/order, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the noncompliant products or services within a period of time to be specified by the http://www.gpo.gov/fdsys/pkg/USCODE-2011-title29/html/USCODE-2011-title29-chap16-subchapV-sec794d.htm http://www.gpo.gov/fdsys/pkg/USCODE-2011-title29/html/USCODE-2011-title29-chap16-subchapV-sec794d.htm https://www.ecfr.gov/cgi-bin/text-idx?tpl=/ecfrbrowse/Title36/36cfr1194_main_02.tpl https://www.section508.gov/create

Procurement Sensitive For Official Use Only (FOUO)

Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

viii. Cancellation of the contract, delivery, task order or purchase on line item without termination liabilities; or

ix. In the case of custom technology being developed for the Government, the Government shall have the right to have any necessary changes made or repairs performed by the Government or by another firm and the Contractor shall reimburse the Government for any expenses incurred thereby.

I. Geospatial Data Act (component of the FAA Reauthorization Act (H.R. 302, P.L. 115-254) at:

https://www.fgdc.gov/gda/geospatial-data-act-of-2018.pdf

a. Additional notes: The Federal Geographic Data Committee (FGDC) is an organized structure of Federal geospatial professionals and constituents that provide executive, managerial, and advisory direction and oversight for geospatial decisions and initiatives across the Federal government.

J. Open Government Data Act (Public Law 115-435) as Title II) at:

https://www.datacoalition.org/open-government-data-act/

a. Additional notes: On January 14, 2019, the Open, Public, Electronic, and Necessary (OPEN) Government Data Act was signed into law. The OPEN Government Data Act was included in the Foundations for Evidence-Based Policymaking Act (Public Law 115-435) as Title II. The open data proposal requires federal agencies to publish their information online, using machine-readable data formats.

b. Foundations for Evidence based policy making (Public Law No: 115-435) at:

https://www.congress.gov/bill/115th-congress/house-bill/4174/text

K. Twenty-First Century Communications and Video Accessibility Act of 2010 at:

https://www.govinfo.gov/app/details/PLAW-111publ260

A2.2 CODE OF FEDERAL REGULATIONS

A. Federal Records Management (https://www.archives.gov/records-mgmt/laws)

a. 5 CFR Chapter III, Subchapter B - OMB Directives

i. Part 1320. Controlling Paperwork Burdens on the Public

b. 36 CFR Chapter XII, Subchapter B - Records Management

i. Part 1220. Federal Records; General

ii. Part 1222. Creation and Maintenance of Federal Records

iii. Part 1228. Disposition of Federal Records

iv. Part 1230. Micrographic Records Management

v. Part 1232. Audiovisual Records Management

vi. Part 1234. Electronic Records Management

vii. Part 1236. Management of Vital Records

viii. Part 1238. Program Assistance https://www.fgdc.gov/gda/geospatial-data-act-of-2018.pdf https://www.datacoalition.org/open-government-data-act/ https://www.congress.gov/bill/115th-congress/house-bill/4174/text https://www.govinfo.gov/app/details/PLAW-111publ260 https://www.archives.gov/records-mgmt/laws

Procurement Sensitive For Official Use Only (FOUO)

A2.3 PRESIDENTIAL AND OFFICE OF MANAGEMENT AND BUDGET MEMORANDA:

A. M-05-24: Implementation of Homeland Security Presidential Directive (HSPD-12) Policy for a

Common Identification Standard for Federal Employees/Contractors, August 2005.

B. M-06-15: Safeguarding Personally Identifiable Information, May 2006.

C. M-06-16: Protection of Sensitive Agency Information, June 2006.

D. M-11-11: Continued Implementation of Homeland Security Presidential Directive (HSPD) 12–

Policy for a Common Identification Standard for Federal Employees and Contractors, February 2011.

E. M-14-03, Enhancing the Security of Federal Information and Information Systems, November 18, 2013

F. M-16-04, Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government October 30, 2015.

G. Executive Orders 12958 - Classified National Security Information at:

https://www.federalregister.gov/documents/1995/04/20/95-9941/classified-national-security-information

H. Executive Order 12968 – Access to Classified Information at: https://www.dni.gov/index.php/ic-legal-reference-book/executive-order-12968

I. Executive Order 13526 -- Classified National Security Information at:

https://www.archives.gov/isoo/policy-documents/cnsi-eo.html

J. Executive Order 14028 -- Improving the Nation’s Cybersecurity at:

https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/

K. OMB Circular No. A130 Management of Federal Information Resources at:

https://obamawhitehouse.archives.gov/blog/2016/07/26/managing-federal-information-strategic-resource

L. OMB Circular No. A123 Management Accountability and Control at:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf

M. M-17-06: Policies for Federal Agency Public Websites and Digital Services at:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-06.pdf

a. Reference: PWS Attachment A06, Web Governance and Management for DOJ/USMS policy(s) and requirements.

N. OMB Memo M-21-31: Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents at: https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and- Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf

O. OMB Memo M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles at: https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf

P. OMB Memo M-22-18: Enhancing the Security of the Software Supply Chain through Secure Software Development Practices at: https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf

Q. OMB Memo M-23-16: Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices at:

https://www.federalregister.gov/documents/1995/04/20/95-9941/classified-national-security-information https://www.federalregister.gov/documents/1995/04/20/95-9941/classified-national-security-information https://www.dni.gov/index.php/ic-legal-reference-book/executive-order-12968 https://www.dni.gov/index.php/ic-legal-reference-book/executive-order-12968 https://www.archives.gov/isoo/policy-documents/cnsi-eo.html https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://obamawhitehouse.archives.gov/blog/2016/07/26/managing-federal-information-strategic-resource https://obamawhitehouse.archives.gov/blog/2016/07/26/managing-federal-information-strategic-resource https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-06.pdf https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf

Procurement Sensitive For Official Use Only (FOUO) https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18- Enhancing-Software-Security.pdf

R. OMB Memo M-23-18: Administration Cybersecurity Priorities for the FY 2025 Budget at:

https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-18-Administration- Cybersecurity-Priorities-for-the-FY-2025-Budget-s.pdf

S. OMB Memo M-24-08: Strengthening Digital Accessibility at:

https://www.whitehouse.gov/omb/management/ofcio/m-24-08-strengthening-digital-accessibility-and-the-management-of-section-508-of-the-rehabilitation-act/

T. OMB Memo M-24-04: Fiscal Year 2024 Guidance on Federal Information Security and Privacy Managment Requirements at: https://www.whitehouse.gov/wp-content/uploads/2023/12/M- 24-04-FY24-FISMA-Guidance.pdf

A2.4 FEDERAL REGULATIONS / GUIDANCE:

A. Homeland Security Presidential Directive (HSPD)-7, Critical Infrastructure Identification, Prioritization, and Protection, dated December 17, 2003 at https://www.dhs.gov/homeland-security-presidential-directive-7

B. Homeland Security Presidential Directive (HSPD) -12, Policies for a Common Identification Standard for Federal Employees and Contractors, dated August 27, 2004 at https://www.dhs.gov/homeland-security-presidential-directive-12

C. Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules at https://csrc.nist.gov/publications/detail/fips/140/2/final.

D. FIPS 199 Standards for Security Categorization of Federal Information and Information Systems at http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

E. FIPS 200 Minimum Security Requirements for Federal Information and Information Systems at https://csrc.nist.gov/publications/detail/fips/200/final

F. Federal Risk and Authorization Management Program (FedRAMP) at https://www.fedramp.gov/ G. Federal GPS Policy Dec 2004 at https://www.gps.gov/policy/docs/2004/ H. Environmentally sustainable federally compliant “Green” efficiencies at https://www.epa.gov/greenerproducts. All equipment, software and services shall support a “Green” approach meeting EPEAT Silver standards or higher

I. National Institute of Standards and Technology (NIST) Special Publications (SP) 500-280v2.1 Mobile ID Device Best Practice Recommendation and Specification, version 2.1, Sept 2016 at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.500-280v2.1.pdf

J. NIST SP 800-124 Rev. 1 - Guidelines for Managing the Security of Mobile Devices in the Enterprise at: https://csrc.nist.gov/publications/detail/sp/800-124/rev-1/final

K. NIST SP 500-245 American National Standard for Information Systems - Data Format for the Interchange of Fingerprint, Facial, & Scar Mark & Tattoo (SMT) Information at https://www.nist.gov/sites/default/files/documents/itl/ansi/sp500-245-a16.pdf

L. NIST SP 800-23 Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products at http://csrc.nist.gov/publications/nistpubs/800-23/sp800-23.pdf https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-18-Administration-Cybersecurity-Priorities-for-the-FY-2025-Budget-s.pdf https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-18-Administration-Cybersecurity-Priorities-for-the-FY-2025-Budget-s.pdf https://www.whitehouse.gov/omb/management/ofcio/m-24-08-strengthening-digital-accessibility-and-the-management-of-section-508-of-the-rehabilitation-act/ https://www.whitehouse.gov/omb/management/ofcio/m-24-08-strengthening-digital-accessibility-and-the-management-of-section-508-of-the-rehabilitation-act/ https://www.whitehouse.gov/wp-content/uploads/2023/12/M-24-04-FY24-FISMA-Guidance.pdf https://www.whitehouse.gov/wp-content/uploads/2023/12/M-24-04-FY24-FISMA-Guidance.pdf https://www.dhs.gov/homeland-security-presidential-directive-7 https://www.dhs.gov/homeland-security-presidential-directive-7 https://www.dhs.gov/homeland-security-presidential-directive-12 https://csrc.nist.gov/publications/detail/fips/140/2/final http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf https://csrc.nist.gov/publications/detail/fips/200/final https://www.fedramp.gov/ https://www.gps.gov/policy/docs/2004/ https://www.epa.gov/greenerproducts https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.500-280v2.1.pdf https://csrc.nist.gov/publications/detail/sp/800-124/rev-1/final https://www.nist.gov/sites/default/files/documents/itl/ansi/sp500-245-a16.pdf http://csrc.nist.gov/publications/nistpubs/800-23/sp800-23.pdf http://csrc.nist.gov/publications/nistpubs/800-23/sp800-23.pdf

Procurement Sensitive For Official Use Only (FOUO)

M. NIST SP 800-37 Rev 1 Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach at https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final.

N. NIST SP 800-53 Revision 5 at (https://nvd.nist.gov/800-53/) with DOJ specific security controls for unclassified information and information technology systems.

O. NIST SP 800-60 Vol I Rev 1 Guide for Mapping Types of Information and Information Systems to Security Categories at https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final and NIST SP 800-60 Vol 2 Rev 1 Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices at https://csrc.nist.gov/publications/detail/sp/800-60/vol-2-rev-1/final

P. NIST SP 800-88, Revision 1 Guidelines for Media Sanitization at https://www.nist.gov/publications/nist-special-publication-800-88-revision-1-guidelines-media-sanitization

Q. NIST SP 800-124 Rev. 1 Guidelines for Managing the Security of Mobile Devices in the Enterprise at https://csrc.nist.gov/publications/detail/sp/800-124/rev-1/final

R. NIST Special publication 800-28 v2 Guidelines on Active Content and Mobile Code at http://csrc.nist.gov/publications/nistpubs/800-28-ver2/SP800-28v2.pdf

S. NIST Special publication 800-63, Electronic Authentication Guideline at https://csrc.nist.gov/publications/detail/sp/800-63/2/archive/2013-08-29.

T. NIST Standard SP 800-73-4 Interfaces for Personal Identity, https://csrc.nist.gov/publications/detail/sp/800-73/4/final.

U. NIST SP 800-161 Supply Chain Risk Management Practices for Federal Information Systems and Organizations at: https://csrc.nist.gov/publications/detail/sp/800-161/final

a. Additional notes:

i. The contractor shall mitigate supply chain risk to all extents possible and in accordance with proscribed DOJ policy PGD 14-03.

ii. The contractor shall support supply chain protections as defined in the NIST

800-53 SA-12 control. The contractor shall provide the Government with a description of what safeguards it intends for supply chain protections.

V.

W. Biometric Technology standard - Registry of USG Recommended Biometric Standards Version

5.0; August 1, 2014 at https://www.nist.gov/sites/default/files/documents/2017/04/12/registry_v5_2014_08_01.pdf.

X. Biometric Data Format Standard - NIST Special Publication 500-290, Edition 3 (2015), Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.500-290e3.pdf

Y. DHS Biometric Transmit Standards - Services must be able to transmit data meeting standards outlined with DHS Automated Biometric Identification System (IDENT) Exchange Messages (IXM) Specification v6.0, https://www.dhs.gov/xlibrary/assets/usvisit/usvisit_biometric_standards.pdf

Z. DOD Biometric Transmit Standards - DOD Electronic Biometric Transmission Specification) EBTS, Version 4.0 Amendment 1, May 2016, http://www.dfba.mil/functions/library/standards_docs/EBTS_v4_amd1_10Aug17.pdf https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final https://nvd.nist.gov/800-53/ https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-60/vol-2-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-60/vol-2-rev-1/final https://www.nist.gov/publications/nist-special-publication-800-88-revision-1-guidelines-media-sanitization https://www.nist.gov/publications/nist-special-publication-800-88-revision-1-guidelines-media-sanitization https://csrc.nist.gov/publications/detail/sp/800-124/rev-1/final http://csrc.nist.gov/publications/nistpubs/800-28-ver2/SP800-28v2.pdf https://csrc.nist.gov/publications/detail/sp/800-63/2/archive/2013-08-29 https://csrc.nist.gov/publications/detail/sp/800-73/4/final https://csrc.nist.gov/publications/detail/sp/800-161/final https://www.nist.gov/sites/default/files/documents/2017/04/12/registry_v5_2014_08_01.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.500-290e3.pdf https://www.dhs.gov/xlibrary/assets/usvisit/usvisit_biometric_standards.pdf http://www.dfba.mil/functions/library/standards_docs/EBTS_v4_amd1_10Aug17.pdf

Procurement Sensitive For Official Use Only (FOUO)

A2.5 DEPARTMENT OF JUSTICE (DOJ) REGULATIONS / GUIDANCE:

A. DOJ Order 0903 for DOJ policy for enterprise information technology (IT) management at:

https://www.justice.gov/jmd/file/877186/download B. DOJ Order 0904 for DOJ’s Cybersecurity Program at:

https://www.justice.gov/jmd/page/file/964941/download C. DOJ Procurement Guidance Documents (PGD) 15-03, Security of Information and Information

Systems at: https://www.fbo.gov/utils/view?id=6c291331a4ef8ea3fdec40ef31409d8d

a. Refer to PWS Attachment A01

D. DOJ Procurement Guidance Document (PGD) 14-03, Acquisition of High- or Moderate-Impact Information Technology Systems at https://dojnet.doj.gov/jmd/cao/pgd/pgd-14-03.pdf

E. DOJ Procurement Guidance Document (PGD) 16-04, Required Whistleblower Protection Provisions in Non-Disclosure Agreements at https://dojnet.doj.gov/jmd/cao/pgd/pgd-16-04.pdf

F. DOJ Instruction 0900.00.01, Incident Response Procedures for Data Breaches, August 6, 2013 at https://portal.doj.gov/sites/dm/dm/Directives/0900.00.01.pdf

G. DOJ Order 0801.01, Records and Information Management H. DOJ Order 2880.1C, Information Resources Management Program at:

https://portal.doj.gov/sites/dm/dm/Directives/2880.1C.pdf

a. Chapter 16 of this Order provides DOJ policies for acquisition and use of the public

Internet and the Department-wide Intranet (DOJNet).

I. USMS Policy 1.4, Records Management J. USMS Policy 17.6.3, Document Security -- establishes the United States Marshals Service’s

(USMS) procedures for the protection of classified National Security Information, Limited Official Use, Law Enforcement Sensitive, and other unclassified information from unauthorized access.

K. Department of Justice Information Technology (IT) Security Rules of Behavior (ROB) for General Users, January 2019

a. Refer to PWS Attachment A07 L. Department of Justice Information Technology (IT) Security Rules of Behavior (ROB) for

Privileged Users, January 2019

a. Refer to PWS Attachment A08

M. FBI/CJIS Image Quality Specifications

a. Refer to PWS Attachment A05

b. These specifications apply to: (1) systems that scan and capture fingerprints1 in digital, softcopy form, including hardcopy scanners such as ten print card scanners, and live scan devices, altogether called “fingerprint scanners”; and (2) systems utilizing a printer to print digital fingerprint images to hardcopy called “fingerprint printers.” These specifications provide criteria for ensuring the image quality of fingerprint scanners and printers that input fingerprint images to, or generate fingerprint images from within, the NGI system.

N. FBI CJIS Electronic Biometric Transmission Specification (FBI EBTS) v10 for both traditional and XML formats at https://www.fbibiospecs.cjis.gov/ebts/Approved.

a. Software and servers must meet the FBI Certified Product List criteria and Certified Product List at https://www.fbibiospecs.cjis.gov/certifications.

https://www.justice.gov/jmd/file/877186/download https://www.justice.gov/jmd/page/file/964941/download https://www.fbo.gov/utils/view?id=6c291331a4ef8ea3fdec40ef31409d8d https://dojnet.doj.gov/jmd/cao/pgd/pgd-14-03.pdf https://dojnet.doj.gov/jmd/cao/pgd/pgd-16-04.pdf https://portal.doj.gov/sites/dm/dm/Directives/0900.00.01.pdf https://portal.doj.gov/sites/dm/dm/Directives/2880.1C.pdf https://www.fbibiospecs.cjis.gov/ebts/Approved https://www.fbibiospecs.cjis.gov/certifications

Procurement Sensitive For Official Use Only (FOUO)

O. DOJ Technical Standards – Website Development and Management

a. The Department's Technical Reference Architecture (TRA) which serves as an authoritative source for DOJ IT standards and guidance. The TRA documents the IT principles, standards, and guidance that apply to all of the Department's information technology.

b. Reference: DOJ Technical Reference Architecture at:

https://dojnet.doj.gov/jmd/ocio/ses/end-user-services/tra.php

c. Website presence – Website development, hosting, and content management for both internet (public facing) and intranet (internal, non-public) websites. A website can be static, interactive and self-serving in its nature of sharing information. Website development encompasses many different skills and disciplines in the production, hosting and maintenance of DOJ/USMS websites.

d. For the ease of prototyping and deployment, new or redesigned DOJ websites should use the U.S. Web Design Standards at: https://designsystem.digital.gov/documentation/

e. Public websites must comply with the justice.gov Privacy Policy. Personal Identity Information (PII) must not be posted on DOJ websites.

f. Use of HTTPS connections for web services is required; OMB M-15-13 requires all existing federal websites and web services to be accessible through a secure connection (HTTPS-only, with HSTS)

g. DHS Binding Operational Directive BOD-18-01 at: https://cyber.dhs.gov/bod/18-01/

i. Federal agencies can ensure the integrity and confidentiality of internet-delivered data, minimize spam, and better protect users who might otherwise fall victim to a phishing email that appears to come from a government-owned system.

h. Content must be compliant with Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 794d) to ensure accessibility and usability by individuals with disabilities.

i. For adding videos to DOJ intranet websites, components are advised to consider HTML5 video which does not require additional plug-ins and all the modern browsers support HTML5 video format. Adobe Flash’s end of life (EOL) is 2020.

j. When linking to an outside site be sure to follow exit communication guidance provided for in DOJ IT Order 0904 for IT Security.

A2.6 INDUSTRY / TECHNOLOGY GUIDANCE:

A. American National Standards Institute (ANSI) / Electronic Industries Alliance (EIA)-649B, Configuration Management Standard at https://www.sae.org/standards/content/eia649b B. International Organization for Standardization (ISO) / International Electrotechnical Commission

(IEC) / Institute of Electrical and Electronics Engineers (IEEE) 29148:2011(E) - Systems and Software Engineering -- Life Cycle Processes --Requirements Engineering at https://standards.ieee.org/findstds/standard/29148-2011.html

C. Internet Protocol (IP) Network Requirements:

https://dojnet.doj.gov/jmd/ocio/ses/end-user-services/tra.php https://designsystem.digital.gov/documentation/ https://cyber.dhs.gov/bod/18-01/ https://www.sae.org/standards/content/eia649b https://standards.ieee.org/findstds/standard/29148-2011.html

Procurement Sensitive For Official Use Only (FOUO)

a. IP Based Requirements apply to all services that leverage IP aware device and address Space Management and shall follow the federal regulatory requirements.

b. All IP-aware devices and applications purchased by USMS must be IPv4 and IPv6-compliant per Office of Management and Budget (OMB) memorandum M-05-22 (August 2, 2005).

c. USMS’s definition of IPv6-compliant devices, applications, products or services is consistent with OMB, National Institute of Standards and Technology (NIST) and the Internet Engineering Task Force (IETF).

d. Services currently deployed at USMS shall be converted to support IPv6 where possible.

D. American National Standards Institute (ANSI)/NIST-ITL 1-2011 Update: 2015 Standard References at https://www.nist.gov/itl/iad/image-group/ansinist-itl-standard-references

E. ANSI International Committee for Information Technology Standards (INCITS) 358-2002, the BioAPI Specification 1.1 at https://standards.incits.org/apps/group_public/project/details.php?project_id=1686

F. ANSI INCITS 398-2008[R2013] Information technology - Common Biometric Exchange Formats Framework (CBEFF) at https://standards.incits.org/apps/group_public/project/details.php?project_id=848

G. ISO/IEC 19794-1:2011 Information technology -- Biometric data interchange formats -- Part 1:

Framework at https://www.iso.org/standard/50862.html

H. ISO/IEC 19794-2:2011 Information technology -- Biometric data interchange formats -- Part 2:

Finger minutiae data at https://www.iso.org/standard/50864.html

I. ISO/IEC 19794-3:2006 Information technology -- Biometric data interchange formats -- Part 3:

Finger pattern spectral data at https://www.iso.org/standard/38747.html

J. ISO/IEC 19794-4:20011 Information technology -- Biometric data interchange formats -- Part 4:

Finger image data at https://www.iso.org/standard/50866.html

K. ISO/IEC 19794-5:2011 Information technology -- Biometric data interchange formats -- Part 5:

Face image data at https://www.iso.org/standard/50867.html

L. ISO/IEC 19794-6:2011 Information technology -- Biometric data interchange formats -- Part 6:

Iris image data at https://www.iso.org/standard/50868.html

M. ISO/IEC 19794-8:2011 Information technology -- Biometric data interchange formats -- Part 8:

Finger pattern skeletal data at https://www.iso.org/standard/50869.html

A2.7 SERVICE / DATA MANAGEMENT GUIDANCE:

A. The Contractor shall support electronic data management across multiple information technology enclaves; Production, Development, Test and others as may be determined necessary to support agency mission(s) during contract tenure.

a. Key tenets:

i. High availability

ii. Recovery optimization B. The Contractor shall support data management throughout the full IT lifecycle (a. through j., below) and across all USMS information technology systems:

a. Initiation https://www.nist.gov/itl/iad/image-group/ansinist-itl-standard-references https://standards.incits.org/apps/group_public/project/details.php?project_id=1686 https://standards.incits.org/apps/group_public/project/details.php?project_id=848 https://www.iso.org/standard/50862.html https://www.iso.org/standard/50864.html https://www.iso.org/standard/38747.html https://www.iso.org/standard/50866.html https://www.iso.org/standard/50867.html https://www.iso.org/standard/50868.html https://www.iso.org/standard/50869.html

Procurement Sensitive For Official Use Only (FOUO)

b. Concept

c. Planning

d. Analysis

e. Design

f. Development

g. Integration and Test

h. Implementation

i. Operations & Maintenance

j. Disposition

C. The Contractor shall maintain systems and data in alignment with the regulatory compliance standards and requirements as referenced throughout this document and as further specified in PWS Attachment A04 – Personnel and Property Contractor Requirements to ensure the protection of sensitive data and information technology are maintained and in accordance with policy and regulatory requirements. Key elements required by contractor support staff providing services on this contract:

a. Corporate Non-Disclosure and Confidentiality Agreement form (PWS Attachment A09:

Non-Disclosure Agreement) shall be signed by the Contracting Officer (CO) and a management representative of the Contractor with the requisite authority to bind the company in the agreement.

b. Personnel Non-Disclosure and Confidentiality Agreement form (PWS Attachment A03:

Non-Disclosure Agreement) shall be signed by all Contract support personnel performing Data Management Lifecycle activities.

c. Annual review and signature of DOJ Rules of Behavior (ROB), both for general and privileged users

d. Annual completion of DOJ computer security awareness training (CSAT)

e. The Contractor and all subcontractors must maintain the required background investigations and site clearance levels required throughout the life of the contract. The Contractor shall comply with all security requirements. Clearance levels may range from Public Trust to Top Secret (TS) with Special Compartmental Information (SCI) levels.

i. The Government requires that contract personnel obtain and maintain DOJ security clearances necessary to perform work where access to data or systems is involved. It is the expectation of the Government that the Contractor has performed the requisite background checks to ensure that the individuals submitted by the contractor can be successfully adjudicated by the Department.

D. New services/systems must be assessed to ensure data protection measures are in place and functional and approved by the Government. USMS requires the following approach in creating a solution strategy to achieve data protections requirements:

a. Identify Data Sources - Data Platforms/Boundaries, shared, cross agency

b. Asses Data Types - Administrative/Infrastructure, Functionality/configuration, Content

c. Identify Critical Data Requirements

d. Deploy High Availability/Disaster Recovery and Continuity of Operations (COOP):

Procurement Sensitive For Official Use Only (FOUO)

i. Address Recovery Time Objective (RTO) -- System-level metric defining the maximum amount of time a system or system resource can be down before there is an unacceptable impact on other resources or system-supported mission(s)/business function(s).

ii. Address Recovery Pont Objective (RPO) – System-level metric describing an acceptable amount of data loss, or the point-in-time, prior to the disruption, to which data can be recovered. RPO depends upon the system’s data backup or replication procedures.

e. Identify Compliance: How long data is retained and who has access (Records/Case/PII/Permissions)

f. Identify Data consumption and access

g. Identify End user/Systems – access and storage

h. Identify Business/Dynamic Analytics/Static Reports

i. Identify performance elements

j. Deploy Data Access Protection Measures

A2.8 ACQUISITION REGULATIONS / GUIDANCE

A. FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE – This contract incorporates one or more clauses by reference with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a provision may be accessed electronically at the FAR website: http://www.acquisition.gov/far/

Clause No Clause Title Date

52.203-14 Display of Hotline Posters (fill in or provide link to client’s posters)

(Dec 2007)

52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights

(Apr 2014)

52.204-2 Security Requirements (Aug 1996) 52.204-9 Personal Identity Verification of Contractor Personnel (Jan 2011) 52.204-13 System for Award Management Maintenance (Jul 2013)

52.204-14 Service Contract Reporting Requirements (Jan 2014)

52.215-22 Limitations on Pass-Through Charges- Identification of Subcontractor Effort

(Oct 2009)

52.215-23 Limitations on Pass-Through Charges (Oct 2009)

52.224-1 Privacy Act Notification (Apr 1984)

52.224-2 Privacy Act (Apr 1984)

52.227-14 Rights in Data – General (Dec 2007)

52.227-14 Rights In Data – General Alternate II and III (May 2014) http://www.acquisition.gov/far/

Procurement Sensitive For Official Use Only (FOUO)

Clause No Clause Title Date

52.232-40 Providing Accelerated Payment to Small Business Subcontractors (Deviation)

(Dec 2013)

52.239-1 Privacy or Security Safeguards (Aug 1996) 52.246-5 Inspection of Services—Cost-Reimbursement (Apr 1984)

52.247-14 Contractor Responsibility for Receipt of Shipment (Apr 1984)

(End of Attachment)