Draft-SOW-Genesys Maintenance and Support 2025 v 1.0.pdf

Statement of Work (SOW) for Maintenance/Support and/or Emergency Services for The United States Small Business Administration (SBA) Office of Capital Access (OCA)

Genesys Cloud CX (SaaS)

1. INTRODUCTION

The U.S. Small Business Administration, Office of Disaster Assistance, has a requirement for Licensing, Professional Services and Support on all existing Genesys Cloud CX and support will allow the SBA OCA to maintain the highest level of continuous operation of the Genesys Cloud CX SaaS system. The requirements will include all software, programming, engineering, and support remotely to ensure all telecommunication activities meet the agencies needs and are in accordance with the agency’s specifications.

2. BACKGROUND

The SBA OCA Customer Service Center is located in Buffalo, NY and the Covid EIDLService Center is located in Fort Worth, TX. Call Center functionality is provided by Genesys Cloud CX 3 licensing.

3. SCOPE OF WORK

3.1 General

a. The Vendor must be a certified Genesys Business Partner authorized by Genesys to perform work at the large business enterprise solution . Prospective Vendors not possessing this certification level will be excluded from consideration for bid.

b. The Vendor shall provide all personnel, management, supervision, properly trained labor, subcontractors, quality control, materials, transportation, tools, supplies and shall plan, schedule, coordinate, and assure effective completion of all work in accordance with all local, state and federal laws and regulations.

c. Period of Performance will be 4/1/2025 through 3/31/2026. Option Period 1 is from 4/1/2026 through 3/31/2027. Option Period 2 is 4/1/2027 through 3/31/2028. Option Period 3 is 4/1/2028 through 3/31/2029. Option Period 4 is 4/1/2029 through 3/31/2030.

d. Maintenance/emergency service shall be performed by the contractor, as required, 12 hours per day, five days per week, 6:00am - 6:00pm.

3.2 Personnel

a. The Vendor shall display and document the ability to perform the work on all equipment installed or maintained on site as specified in the SOW and the bid schedule. The Vendor shall provide a brief resume of each of their technical staff working on this project. These resumes shall, at a minimum include the technician's name, citizenship, and knowledge of the equipment/system to be upgraded.

Employees performing the equipment upgrades, programming, installation and/or configuration must be certified by the manufacturer to perform these functions. For security purposes, all employees of the Vendor or sub-contractors may be subject to routine background investigations in order to gain access to the SBA ODA facilities and systems.

b. The Vendor shall provide and require all Vendors’ employees to wear an identification badge showing the Vendor name and the employee’s name. This badge shall be worn at all times while the

DRAFT

individual is at the SBA ODA facilities, except when safety dictates removal of the badge.

c. The Vendor shall submit to the Contracting Officer and the COR a roster of their employees which shall include the name and employment date of each employee. The Vendor shall notify the COR within two (2) working days of any changes to the roster and ensure this notification is made prior to Vendor employee entering the SBA ODA facilities.

d. The Vendor must perform all operations in a prudent, conscientious, safe and professional manner. At a minimum, the Vendor’s personnel and equipment shall comply with applicable federal, state, local and host installation laws, safety regulations and procedures, and Vendor will ensure that its agents, employees, and subcontractors perform in a safe manner. Personal protective equipment shall be provided by the Vendor and must be appropriate for the task. The Vendor agrees that his personnel and equipment are subject to safety inspections by Government personnel while on Federal Property.

e. The Vendor shall provide personnel that are fully qualified and trained on the Genesys Cloud CX to perform support services and other ancillary maintenance support services needed for the existing Genesys Cloud CX instances.

3.3 Deliverables

For the purposes of this section, any reference to technician or onsite technician will be a person provided by the Vendor and any reference to staff or staff member will be someone who is employed by the SBA OCA. In this section normal business hours are 8:00am to 6:00pm, Monday thru Friday.

3.3.1 The Vendor shall provide support and maintain the SBA’s FEDRAMP Genesys Instance and licensing.

3.3.2 The Vendor shall support and maintain the SBA’s FEDRAMP Genesys Instance to include all software updates, vulnerability patching and provide required audit logs. Vendor shall engage in continuous monitoring and provide status monthly with the SBA security team.

3.3.3 Additional licenses purchased by the SBA ODA will be installed by a certified Genesys technician, also any other software or firmware related issues that affect the operation of the service will be corrected by technicians.

3.3.4 Vendor shall provide at least (1) Genesys certified technician or engineer. Copies of the Genesys certifications shall be attached to the bid. Minimum Genesys certification: current Genesys Cloud Certified Professional (GCP- GC) with Genesys Cloud Architect Specialist (GCS- GC-ARC) and Genesys Cloud Scripting Specialist (GCS-GC-SCR) together with 5 years platform experience.

3.3.4 Vendor shall provide two (2) hour emergency response for complete (100%) system or any subsystem application. Vendor shall provide four (4) hour response for partial (50%) system or any subsystem application failure. Vendor shall provide forty-eight (48) hour response to request for moves, adds, changes (MAC), software updates or patches to any system, subsystem, or applications.

3.3.5 Vendor shall provide both technical and end user training on hardware or software applications when requested for SBA OCA staff. On-site training may be conducted for any SBA OCA locations as requested by SBA OCA staff.

3.3.6 Vendor shall follow SBA’s security and access control policies and procedures.

The offeror shall, as part of their technical proposal, provide a detailed description of how the proposed solution will adhere to the requirements included in the “Appendix – Cybersecurity Language for IT Acquisitions” section of this solicitation.

4 DOCUMENTATION

4.3 The SBA OCA DSSD shall be provided status, performance, maintenance, and alarm reports.

4.1.2 A Status report shall be provided quarterly. The status report will provide the status of all phone systems as of the date of the report.

4.1.3 A performance report shall be provided semi-annually. The performance report will provide in detail how each phone or voice mail system is performing and provide suggestions on improving the performance of each system.

4.1.4 An Alarm report shall be provided anytime an alarm is detected. The Alarm report will include the alarm condition, the alarm type, the time and date it was received and the system location. The Alarm report shall also include from start to finish how the alarm was resolved. If an alarm happens multiple times within the same month then no additional report is required. The original report shall be edited to show any additional information and resubmitted.

4.4 Invoices must include the information required by Federal Acquisition Regulation (FAR) 52.212-4(g). The COR will approve the invoice accepting the services and send it to the payment office for payment. If the COR decides not to accept services, in whole or in part, because of deficiencies in the service provided by the contractor, the COR will issue the contractor written notification of deficiency within 10 days after completion of the inspection period specifying therein all deficiencies present.

Upon subsequent correction of the noted deficiencies and acceptance of services, the COR will approve the invoice accepting the services and send it to the payment office for payment.

5 DEFINITIONS

Contracting Officer (CO) - The CO is the warranted individual who has the overall responsibility for the administration of this contract. The CO alone, without delegation, is authorized to take actions on behalf of the Government to enter into, modify and/or terminate contracts, contract terms, conditions, requirements, specifications, details and/or delivery schedules and make related determinations and findings. However, the CO may delegate, in writing, certain responsibilities to an authorized representative.

Contracting Officer’s Representatives (COR) - The COR is the individual or individuals designated in writing by the CO at the time of award to act as his/her authorized representative within the scope and limitations as defined by the CO and be responsible for the day-to-day administration of the contract. The COR may authorize other individuals to act on his/her behalf.

6 CONTRACT TERMS

This contract shall run for one year. Each proposal shall include a price for up to four option years.

Once the contract with Vendor is executed, Vendor will provide service for a period of twelve (12) months (the “term”), beginning on the date of the contract execution. SBA reserves the option to extend the contract term for four (4) additional periods of twelve

(12) months each. The charge will be payable monthly. Charges may increase or decrease during the term, depending on the addition or subtraction of equipment from Vendor’s Scope of Services. SBA reserves the right to add or subtract equipment from the Vendor’s Scope of Services with a direct change in charge.

The contract shall remain in full force and effect between SBA and Vendor until terminated or amended by the parties. Vendor must provide SBA with ninety (90) days advance written notice to terminate or amend the contract after the initial term. SBA must provide Vendor thirty (30) days advance written notice to terminate or amend the contract. Until a new contract is executed, the existing contract will continue on a month-to-month basis at the stated monthly charge.

7 PAYMENTS, INCENTIVES, AND PENALTIES

The requirements for payment are to meet all aspects of the contract, pending any approved exceptions.

Full performance of all aspects of this contract may result in activation of option years. Failure to meet any part of this contract, without a written request and a written approval, may result in the termination, non-payment, and/or non-renewal of the contract. The only persons authorized to approve exceptions are the contracting officers.

8 IDIQ

8.3 – Equipment

N/A

8.4 – Man Hours

Provide up to 600 hours of professional services for additional configuration of licensed features, miscellaneous installation work or other work requested by the SBA.

8.5 – Training

Provide up to 120 hours of classroom or online training on current or pr future Genesys software releases

Renew existing Plural Sight with Cloud Guru licenses (16 licenses)

Renew Genesys Training (All Access) subscription CLIN: 16 subscriptions

Surge Genesys Training (All Access) subscription CLIN: 1 each subscription

Surge Plural Sight with Cloud Guru licenses CLIN: 1 each license

8.6 – Licensing

Base Licensing CLIN: 250 Genesys Cloud CX 3 (Concurrent)

1 each Microsoft Teams Connector Add on

Surge CLIN: 1000 Genesys Cloud CX 3 with Microsoft Teams connector

8.7 . – Disaster Recovery Environment

Full disaster recovery environment with same capabilities and features of the Production environment with a nightly synchronization of organizational changes from Production to DR environment. Provide a trunking solution with the ability for automated and manual traffic allocation between Production and DR environments via a customer accessible portal during fail-over events.

8.8 – Dev / Test Environments

Development Instance Customer Lab bundle 5 user customer lab with work automation and 350 fair use AI tokens per month

Test Instance Customer Lab bundle 5 user customer lab with work automation and 350 fair use AI tokens per month

Minimum salient characteristics have to be met to be considered responsive for this requirement.

1) Shall have native Interactive Voice Response (IVR)/ Automatic Call Distribution (ACD)

2) Shall have native Quality Management (Call Recording, Screen Capture, Agent Evaluations, Sentiment Analysis, Agent Co-Pilot) with included fair usage for call recording and screen capture storage amounts. No third-party or external integration is allowed.

3) Shall have native Work Force Management (Scheduling, Shift Bidding). No third-party or external integration is allowed

4) Shall have native Microsoft Teams Integration with Presence, ability to create Teams Meetings from within the call center platform.

5) Shall have native Speech and Text Analytics. No third-party or external integration is allowed

6) Shall have native 100% web based single pane for all system administration functions including IVR and call flows changes using a Microsoft Entra Single Sign On authenticator, no downloadable client or web browser plug-in will be allowed.

7) Shall have native API’s for all system functionality configurable by government developers (if you can perform the action in the GUI there needs to be a corresponding API to perform the same action callable from both inside and outside the platform)

8) Shall have native PCI compliancy at minimum 3.21 Level 1

9) Shall be FedRAMP accredited with ATO

10) Shall be compatible with Genesys CX Cloud

11) Shall include Fair Use IVR minutes and per minute pricing.

12) Shall have native outbound campaigning and management for a minimum of voice, email and SMS. No third-party or external integration is allowed.

13) Shall have native ability to connect to 3rd party APIs to ingest data directly into call flow

14) Shall have a secured IVR call flow built to process (Debit and ACH) payments using the pay.gov TCS Single and Collections API using 3rd party API data connections.

15) Shall have support for platform event triggers that allow for reactions to those events and perform workflows based on those events.

16) Shall have a custom build pre-configured data connector to Microsoft Dynamics that allows for the screen pop of new contacts and retrieves existing contact data

17) Shall have an SMS integration to Microsoft Dynamics allowing an API to send SMS messages from a Dynamics contact or Dynamics contact list that when sent will populate a call record within the telephony platform and utilize the SMS capabilities of the platform to carry out full SMS functionality and return data from that SMS conversation back to the Dynamics contact record for a custom web facing scheduling application. All SMS conversation records will be part of the phone platform system of record and allow for native telephony platform reporting.

18) Shall have pre-built embeddable frameworks with minimum capabilities (calls, callbacks, outbound dialing, chats, emails, messages and voicemail) that support Microsoft Edge, Google Chrome, Salesforce, Microsoft Teams and Zoom.

** Native – is defined as the feature is built into the management console of the platform and no additional integration is needed to make the feature work as part of the platform

8.9 – Additional Services

Voice Cloud Minutes and fees CLIN

Voice Cloud IVR Minutes and fees CLIN

SMS Inbound and Outbound message fees CLIN

Additional work items CLIN

Outbound Email usage CLIN

API Usage CLIN

AI Token usage (Agent Assist, Agent CoPilot, Bots both digital and voice, Predictive

Engagement and Predictive Routing) CLIN

SMS Number MRC CLIN: Purchasing and recurring charges for SMS Long and Short code numbers

SMS Long and Short code Setup CLIN: Setup fees and charges

SMS Long and Short code MRC CLIN: Recurring monthly fees and charges

SMS Third Party Messaging CLIN: Monthly charges for third party messaging (Facebook

Messenger, Twitter Direct Message, Instagram Direct Messaging, LINE Messaging and

WhatsApp)

CX 1 License (monthly and hourly) CLIN

CX 2 License (monthly and hourly) CLIN

CX 3 License (monthly and hourly) CLIN

CX Custom License (monthly and hourly) CLIN

License add on Salesforce Connector CLIN

License add on Teams Connector CLIN

License add on Dynamics Connector CLIN

License add on WFM (CX 1 and CX 2 both monthly and hourly) CLIN

License add on Digital (CX 1, CX2 and CX 3 both monthly and hourly) CLIN

License add on for Work Automation (monthly and hourly) CLIN

License add on Predictive Routing CLIN

License add on Predictive Engagement Events CLIN

License add on Blackchair Symphony and Continuance

Blackchair Symphony setup fee

BYOT (Bring Your Own Technology) -A CLIN

BYOT (Bring Your Own Technology) -B CLIN

BYOT (Bring Your Own Technology) -C CLIN

BYOT (Bring Your Own Technology) -D CLIN

BYOT (Bring Your Own Technology) -E CLIN

Genesys Bot Flows (digital and voice)

A3S Reporting as a Service charges and fees

Toll-Free and DID Genesys Voice Number purchases CLIN

Additional Professional Services Hourly rate CLIN

Appendix – Cybersecurity Language for IT Acquisitions

1. Purpose

The U.S. Small Business Administration (SBA) must provide information security for the information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. The Federal Information Security Modernization Act of 2014 (FISMA) describes Federal agency security responsibilities as including “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.” This includes services which are either fully or partially provided; including other agency hosted, outsourced, and cloud computing solutions. FISMA has a somewhat broader applicability than prior security law and applies to both information and information systems used by the agency, contractors, and other organizations and sources. Agency information security programs apply to all organizations (sources) which possess or use Federal information – or which operate, use, or have access to Federal information systems (whether automated or manual) – on behalf of a Federal agency, information systems used or operated by an agency or other organization on behalf of an agency.

This document applies to all Agency contracts in which SBA sensitive information is stored, generated, transmitted or exchanged by an SBA contractor, subcontractor or third-party, or on behalf of any of these entities regardless of format. The regulations in this document also pertain to information residing on an SBA or a non-SBA system in order for the contractor, subcontractor or third party to perform their contractual obligations to SBA, standing in lieu of SBA or acting on SBA’s behalf.

The contractor shall leverage all applicable enterprise IT services available from the Office of the Chief Information Officer (OCIO) and the Office of the Chief Information Security Officer (OCISO). The goal of enterprise services is to maintain enterprise protection and visibility of all agency IT systems.

The agency expects a lower cost of ownership, less complexity, lower level of maintenance effort and overall cost savings over the life of the contract. The services include:

• Enterprise audit log aggregation

• 24/7 Security Monitoring and Incident Response

• Enterprise Patch and Configuration Management

• Enterprise Vulnerability Scanning

• Annual and Ad Hoc Penetration Testing

• Annual and Ad Hoc Tabletop Exercises for Incident Response

• Enterprise Cybersecurity Continuous Monitoring

All requirements identified or referenced in this document shall be interpreted and implemented implicitly for all system components unless otherwise directed by the SBA.

All requirements identified or referenced in this document shall be implemented at the time of contract award unless otherwise directed by the government.

All requirements identified or referenced in this document shall apply to all contractors and subcontractors that will have access to Controlled Unclassified Information (CUI), collect or maintain CUI on behalf of the agency, operate federal information systems, including contractor information systems operated on behalf of the agency, to collect, process, store, or transmit CUI.

All physical and/or logical access to the IT system or supporting facilities deemed necessary by the SBA shall be granted to the SBA or its designated representative(s) by the Contractor.

2. Policies and Regulations

Contractors entering into an agreement for services to the SBA or its Federal customers shall be contractually subject to all SBA and Federal IT Security standards, policies, and reporting requirements. The contractor shall meet and comply with all SBA IT Security Policies, SBA and NIST guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Contractors are required to comply with the SBA, FIPS, and NIST, Federal requirements outlined below (or successor documents):

• SBA Cybersecurity and Privacy Policy (SOP 90 47 5), as amended.

• Federal Information Security Modernization Act of 2014, as amended.

• Clinger-Cohen Act of 1996 also known as the “Information

Technology Management Reform Act of 1996,” as amended.

• Privacy Act of 1974 (5 U.S.C. § 552a), as amended.

• Federal Information Technology Acquisition Reform Act (FITARA) of 2014, as amended.

• Chief Financial Officers Act of 1990 (Public Law 101–576), as amended.

• Cyber Supply Chain Management and Transparency Act of 2014.

• Trade Agreements Act (TAA) of 1979 as amended.

• Homeland Security Presidential Directive (HSPD-12), “Policy for a

Common Identification Standard for Federal Employees and Contractors,” as amended.

• Office of Management and Budget (OMB) Circular A-130, “Management of Federal Information Resources” as amended.

• FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems,” as amended.

• FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems,” as amended.

• FIPS PUB 140-2, “Security Requirements for Cryptographic Modules,” as amended.

• NIST Special Publication 800-18, “Guide for Developing Security Plans for Federal Information Systems,” as amended.

• NIST Special Publication 800-30-1, “Guide for Conducting Risk Assessments,” as amended.

• NIST Special Publication 800-34-1, “Contingency Planning Guide for Information Technology Systems,” as amended.

• NIST Special Publication 800-37-2, “Guide for Applying the Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” as amended.

• NIST Special Publication 800-47, “Security Guide for Interconnecting Information Technology Systems,” as amended.

• NIST Special Publication 800-53-4, “Security and Privacy Controls for Federal Information Systems and Organizations,” as amended.

• NIST Special Publication 800-53A-4, “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans,” as amended.

• NIST Special Publication 800-161, “Supply Chain Risk Management Practices for Federal Information Systems and Organizations,” as amended.

• NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,” as amended.

3. Security and Privacy Requirements

FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems,” is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas.

Contractor systems supporting SBA must meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800- 53, Revision 4 (as amended and hereafter described as NIST 800-53), and “Recommended Security and Privacy Controls for Federal Information Systems.

Data contained within all SBA computer systems are governed by Agency record disclosure and privacy regulations (13 C.F.R. part 102), IT Security regulations as well as other regulations, statutes and guidance, including the Privacy Act of 1974, as amended (5 U.S.C.

§ 552a). In addition, various Federal requirements obligate SBA to establish controls to limit access to Personally Identifiable Information (PII) and sensitive data, as defined below, to authorized personnel. These include OMB Circular A- 130 and OMB Memoranda M-19-17, M-10-15, M-09-29, M-08-21, M-07- 19, M-07-16, M-06-16, and M-06-15.

Contractors leveraging cloud solutions must utilize a Cloud

Service Provider (CSP) with an existing Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB) Provisional Authorization to Operate (ATO) or Agency ATO at all service models [Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)].

To comply with the Federal standard, the SBA must determine the security category of the information and information system in accordance with FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems”, and then the contractor shall apply the appropriately tailored set of Low, Moderate, or High impact baseline security controls in NIST 800- 53, as determined by the SBA.

The Contractor shall use SBA and NIST guidelines, Defense Information Security Agency (DISA) Security Technical Implementation Guides (STIGs), or industry guidelines in securing their systems.

4. Supply Chain Risk Management

The contractor shall, as part of their technical proposal, describe how Supply Chain Risk Management (SCRM) is incorporated into the acquisition of the underlying technology that composes their solutions. Descriptions shall at a minimum describe how the contractor’s solutions satisfies the following regulatory components:

• The TAA of 1979 as amended.

• The Federal Acquisition Regulation (FAR) part 52.204-

23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities.

• The Federal Acquisition Regulation (FAR) part 52.204-25 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment.

The contractor’s technical proposal shall describe how SCRM is to be addressed and monitored throughout the lifecycle of the acquisition.

5. Essential Security Controls

All NIST 800-53 controls must be implemented as per the applicable FIPS 199 Low, Moderate, or High baseline. Controls, control enhancements, or parts of controls or enhancement may be implemented jointly between the Contractor and CSP as applicable.

The following table identifies essential security controls from the respective baselines to highlight their importance and to understand the potential implementation costs. The Contractor shall make the proposed system and security architecture of the information system available to the Office of the Chief Information Officer for review and approval before commencement of system build.

Cont rol

ID

Control Title

Baseli ne Implementation Guidance

AC-02 Account Managem ent

L, M, H The contractor shall perform an annual user recertification for all roles implemented within the information system.

AC-17

(3)

Remote Access | Managed Access Control Points

M, H The information system routes privileged authentication traffic to external hosted infrastructures / applications through SBA’s managed network access control points and are subject to the Trusted Internet Connections (TIC) and the U.S.

Department of Homeland Security’s (DHS’) Einstein monitoring system.

AC-20 Use of External Informat ion Systems

L, M, H Physical access to the contractor’s office areas that contain PII and sensitive data shall be controlled to prevent unauthorized personnel from acquiring access to this data.

ID

Control Title

Baseli ne Implementation Guidance

The contractor shall not release SBA data outside of its facility, either orally or in written form, without the express written consent of the SBA CO/COR.

AU-02 Audit Events

L, M, H Information systems shall implement audit configuration requirements including but not limited to successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. Web applications should log all admin activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes.

Web applications should log all admin activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes.

AT-

02/

AT-

Securi ty Awaren ess Traini ng

L, M, H All contractors with access to SBA’s IT systems and/or PII and sensitive data shall complete the annual Computer Security Awareness Training (CSAT) and role-based training as necessary

CA-07 Contin uous Monito ring

L, M, H Information systems, including vendor owned / operated systems on behalf of the SBA, shall integrate with SBA implemented continuous monitoring, Continuous Diagnostics and Monitoring (CDM), and Security Operation Center

(SOC)

capabilities.

CA-08 Penetra tion Testing

L, M, H The contractor shall support, providing all physical and logical access necessary to the target system(s), in annual agency penetrations testing efforts.

CM-06 Configur ation Settings

L, M, H Information systems, including vendor owned / operated systems on behalf of the SBA, shall configure their systems in agreement with SBA policies and guidelines, DISA STIGs, NIST guidelines, or manufacturer guidelines as appropriate.

CP-07 Alternat ive Processin g Site

M, H FIPS 199 Moderate and High impact systems must implement processing across geographically disparate locations to ensure fault tolerance.

Infrastructure as a Service architectures must implement a multi-region strategy.

CP-08 Telec om Servi ces

M, H FIPS 199 Moderate and High impact information systems must implement alternate telecom services to support resumption when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

IA-02

(1)

Identifi cation and

L, M, H All information systems shall implement multi-factor authentication for privileged accounts. All information

ID

Control Title

Baseli ne Implementation Guidance

Authentic ation (Organiza tional Users) | Network Access to Privilege d Accounts systems must have the built-in capability to accept a Security Assertion markup Language (SAML) assertion from an existing SBA Single Sign On (SSO) capability [e.g., Active Directory Federation Services (ADFS), Azure Active Directory (AAD) Enterprise Applications].

IA-02

(2)

Identific ation and Authentic ation (Organiza tional Users) | Network Access to Non- Privilege d Accounts

L, M, H FIPS 199 Moderate and High impact information systems must implement multi-factor authentication for non- privileged accounts. All information systems must have the built-in capability to accept a Security Assertion markup Language (SAML) assertion from an existing SBA Single Sign On (SSO) capability [e.g., Active Directory Federation Services (ADFS), Azure Active Directory (AAD) Enterprise Applications].

IA-

(12

Identific ation and Authentic ation | Acceptanc e of PIV Credentia ls

L, M, H Information systems with an e- authentication assurance level of 3 or above, used by federal employees or contractors must accept federal Personal Identity Verification (PIV) cards and verify them in accordance with guidance in OMB M-11-33.

IA-07 Cryptogr aphic Module Authenti cation

L, M, H The information system shall implement FIPS 140-2 validated encryption modules for authentication functions.

Reference: http://csrc.nist.gov/groups/STM/cmvp /documents/140- 1/1401vend.htm

IR-04 Incid ent Handl ing

L, M, H The Contractor shall cooperate with agency incident response activities, including but not limited to, providing logical and http://csrc.nist.gov/groups/STM/cmvp/documents/140-http://csrc.nist.gov/groups/STM/cmvp/documents/140-physical access to compute resources and media for investigative, examination, or forensic purposes.

IR-06 Incide nt Report ing

L, M, H The contractor shall report all suspected security incidents to the SBA Security Operations Center in accordance with U.S. CERT reporting requirements.

MP-04 Media Storage

M, H Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives, diskettes, compact disks and digital video disks shall be encrypted using a FIPS 140-2 validated encryption module.

MP-05 Media Transport

M, H Digital media including magnetic tapes, external/removable hard drives, flash/thumb drives and digital video disks shall be encrypted using a FIPS 140-2

ID

Control Title

Baseli ne Implementation Guidance validated encryption module during transport outside of controlled areas.

PL-02 System Security Plan

L, M, H The contractor must develop a final System Security Plan (SSP) within thirty (30) calendar days from contract award. The SSP must be updated at least annually. The SSP will be reviewed by the Contracting Officer’s Technical Representative (COR) or designated technical point of contact. The SSP must document administrative, technical, and physical security measures at the contractor’s computer facility to protect PII and sensitive data from unauthorized disclosure, alteration, or misuse; prevent unauthorized access to the contractor’s computer system; and protect the availability of data and services to SBA. All controls and enhancements must be described in detail, focusing on how each control or enhancement is implemented. All technical controls must be described for all technologies included in the system boundary

PL-08 Informa tion Securit y Archite cture

M, H All information system security architectures must be reviewed and approved by the Office of the Chief Information Officer prior to development or implementation.

PS-03 Person nel Screen ing

L, M, H [Applies to acquisitions where the contract personnel are provided direct logical or physical access to agency data, compute resources, or offices.]

Pursuant to Federal Acquisition Regulation (FAR) clause 52.204-9, incorporated into this solicitation and the resulting contract, each contractor and subcontractor must comply with Agency Personal Identity Verification (PIV) procedures.

These procedures must be followed when the contractor and or subcontractor will have unescorted physical access to a federally controlled facility, and/or access to a federally controlled information system (including, but not limited to computer systems, networks, or information technology infrastructure).

PS-04 Personn el Termina tion

L, M, H [Applies to acquisitions where the contract personnel are provided direct logical or physical access to agency data, compute resources, or offices.]

The Contractor shall provide weekly in electronic format to the CO and COR a current roster of individuals with direct logical or physical access to agency data, compute resources, or offices.

Roster shall indicate any and all changes (additions and departures).

RA-05 Vulnera bility Scannin g

L, M, H All information system must complete quarterly privileged authenticated operating system, web, and

ID

Control Title

Baseli ne Implementation Guidance database vulnerability and configuration scanning and provide results to the SBA on a quarterly basis.

SA-04

/ SA-

(1)

Acquisi tion Process | Functio nal Propert ies of Securit y Control s

L, M, H All external service providers (contractor hosted, contractor managed, proprietary, IaaS, PaaS, SaaS, resellers, etc.) shall include as part of their technical proposal attestations of Service Level Agreements (SLAs) for the following key areas:

o Response to Cybersecurity incidents o Availability of service o Data retention o Encryption of data at rest o Telecommunication service redundancy o Logical and Physical Data

Access Limited to Continental United States

SLA commitments and/or attestations must either be included in the offeror’s technical proposal or be provided by reference to publicly available Internet resources.

SC-08

/ SC- 08

(1)

Transmiss ion Confident iality and Integrati on

M, H Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS 140-2 validated, respectively.

o Digital signature encryption algorithms -

Reference: (http://csrc.nist.gov/groups/ST/t oolkit/d igital_signatures.html#Approved o Block cypher encryption algorithms - Reference: http://csrc.nist.gov/groups/ST/t oolkit/block_ciphers.

http://csrc.nist.gov/groups/ST/toolkit/digital_signatures.html#Approved http://csrc.nist.gov/groups/ST/toolkit/digital_signatures.html#Approved http://csrc.nist.gov/groups/ST/toolkit/digital_signatures.html#Approved http://csrc.nist.gov/groups/ST/toolkit/block_ciphers.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/block_ciphers.html%23Approved html#Approved o Secure hashing algorithms – Reference:

http://csrc.nist.gov/groups/ST/t oolkit/secure_hashin g.html#Approved

Internet-facing systems shall enforce HTTPS and implement HTTP Strict Transport Security (HSTS).

SC-13 Cryptograp hic Protection

| FIPS

Validated Cryptograp hy

L, M, H Implemented encryption algorithms and cryptographic modules shall be FIPS-approved and FIPS 140-2 validated, respectively.

o Digital signature encryption algorithms -

Reference:

http://csrc.nist.gov/groups/ST/ toolkit/di gital_signatures.html#Approved o Block cypher encryption algorithms - Reference: http://csrc.nist.gov/groups/ST/t oolkit/block_ciphers. html#Approved o Secure hashing algorithms – Reference:

http://csrc.nist.gov/groups/ST/t oolkit/secure_hashin g.html#Approved

SC-22 Architectu re and Provisioni ng for

L, M, H Information systems shall be Domain Name System Security Extensions (DNSSEC) compliant as per OMB http://csrc.nist.gov/groups/ST/toolkit/block_ciphers.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/digital_signatures.html#Approved http://csrc.nist.gov/groups/ST/toolkit/digital_signatures.html#Approved http://csrc.nist.gov/groups/ST/toolkit/digital_signatures.html#Approved http://csrc.nist.gov/groups/ST/toolkit/block_ciphers.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/block_ciphers.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/block_ciphers.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html%23Approved http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html%23Approved

ID

Control Title

Baseli ne Implementation Guidance

Name / Address Resolutio n Service

Memorandum, M-08-23, which requires all Federal Government departments and agencies that have registered and are operating second level .gov to be DNSSEC.

SC-28

(1)

Protecti on of Informat ion at Rest | Cryptogr aphic Protecti on

Require d for Systems with PII Only

System bearing PII must implement protect information at rest. At a minimum, fields bearing PII data must be encrypted with field level encryption. Encryption algorithms shall be FIPS-approved; implemented encryption modules shall be FIPS 140-2 validated

SI-02 Flaw Remedia tion

L, M, H All systems must establish monthly flaw remediation (patch) processes. High and Critical risk findings must be remediated prior to go-live.

Post go-live, all critical [CVSS Base Score = 10] vulnerabilities identified must be mitigated within 15 calendar days, high [CVSS Base Score ≥ 7.0] vulnerabilities identified must be mitigated within 30 calendar days and all other [CVSS Base Score < 7.0 vulnerabilities mitigated within 90 calendar days.

SI-03 Malicious Code Protectio n

L, M, H Information systems, including vendor owned / operated systems on behalf of the SBA, shall implement anti- malware capabilities for all assets.

SI-04 Informa tion System Monitor ing

L, M, H Information systems, including vendor owned / operated systems on behalf of the SBA, shall integrate with SBA implemented continuous monitoring, Continuous Diagnostics and Monitoring (CDM), and Security Operation Center

(SOC)

capabilities.

SI-10 Informati on Input Validatio n

M, H All systems accepting input from end users must validate the input in accordance with the OWASP Top 10 Web Application Security Vulnerabilities.

SI-12 Informat ion Handling and Retentio n

L, M, H All external service providers (contractor hosted, contractor managed, proprietary, IaaS, PaaS, SaaS, etc.) must describe, as part of their technical proposal, the means for ensuring that agency data stored and processed within the offeror’s solution is portable, interoperable, and owned by the agency.

Specifically, the offeror shall describe in detail the mechanism for exporting all agency data and meta-data into a Comma Separated Values (CSV), eXtensible Markup Language (XML), or equivalent structured format. This mechanism shall be available to agency administrators as a routine practice, shall not have proprietary software nor Application Programming Interface (API) dependencies, and shall result in no additional cost to the agency, however often the mechanism is used.

6. Assessment and Authorization (A&A) Activities

The implementation of a new Federal Government IT system requires a formal approval process known as Assessment and Authorization (A&A). NIST SP 800-37-2 provides guidelines for performing the A&A process. The Contractor system/application must have a valid assessment and authorization, known as an Authority to Operate (ATO) (signed by the Federal government) before going into operation and processing SBA information. The failure to obtain and maintain a valid ATO may result in the termination of the contract.

The system must have a new A&A conducted (signed by the Federal government) at least every three (3) years or at the discretion of the Authorizing Official when there is a significant change to the system’s security posture. All NIST 800-53-4 controls must be tested/assessed every three (3) years or as defined by SBA policy.

Assessing the System

a. The Contractor shall comply with Assessment and Authorization (A&A) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the A&A is based on the System’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. The contractor shall create, maintain and update the following A&A documentation:

• System Security Plan (SSP) completed in agreement with NIST SP 800-18-1 (or successor document), “Guide for Developing Security Plans for Federal Information Systems”. The SSP shall include as appendices required policies and procedures across 18 control families mandated per FIPS 200, Rules of Behavior, and Interconnection Agreements (in agreement with NIST Special Publication 800-47, “Security Guide for Interconnecting Information Technology Systems”).

• Contingency Plan and test Report completed in agreement with NIST Special Publication 800-34.

• Privacy Threshold Analysis/Privacy Impact Assessment (PTA/PIA)

• Configuration Management Plan (CMP).

b. Information systems must be assessed and authorized every three (3) years, whenever there is a significant change to the system’s security posture and updated annually in accordance with NIST Special Publication 800-37-2.

c. At the Moderate impact level and higher, the contractor or Government (as determined in the contract) will be responsible for providing an independent Security Assessment/Risk Assessment in accordance with SBA Policy.

d. If the Government is responsible for providing a Security Assessment/Risk Assessment, the Contractor shall allow SBA employees (or SBA-designated third-party contractors) to conduct A&A activities to include control reviews in accordance with NIST 800-53/NIST 800-53A. Review activities include but are not limited to operating system vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, or security of SBA information. This includes the general support system infrastructure.

e. Identified gaps between required 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation as a Plan of Action and Milestones (POA&M) item within SBA’s Cyber Security Assessment Management (CSAM) implementation. Depending on the severity of the gaps, the Government may require them to be remediated before an Authorization to Operate is issued.

f. The Contractor is responsible for mitigating all security risks found during A&A and continuous monitoring activities. All critical-risk vulnerabilities must be mitigated within 15 days, high-risk vulnerabilities must be mitigated within 30 days, and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

Authorization of the System

a. Upon receipt of the Security Authorization Package, the Authorizing Official (AO), in coordination with the SBA Office of the CIO, System Owner (SO), Information System Security Manager (ISSM), and Information System Security Officer (ISSO) will render an authorization decision to:

• Authorize system operation w/out any restrictions or limitations on its operation;

• Authorize system operation w/ restriction or limitation on its operation, or;

• Not authorize for operation.

b. The Contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program, and in response to security incidents. At its option, the Government may choose to conduct on site surveys. The Contractor shall make appropriate personnel available for interviews and documentation during this review. If documentation is considered proprietary or sensitive, these documents may be reviewed on-site under the hosting Contractor’s supervision.

7. Continuous Monitoring Deliverables and Schedule

Maintenance of the security authorization to operate will be through continuous monitoring of security controls of the contractors system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to SBA per the schedules below. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. They allow SBA AOs to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur.

The contractor is required to provide the following deliverables to the CO/COR during the performance of the contract.

Deliverable Control ID Frequency Plan of Action & Milestones (POA&M) Updates

CA-05 Quarterly

Vulnerability Scanning RA-05 Quarterly System Security Plan Update PL-02 Annually Contingency Plan Update CP-02 Annually Contingency Plan Test Report CP-07 Annually User Certification AC-02 Annually Separation of Duties Matrix AC-05 Annually Baseline Configuration Settings CM-06 Annually Configuration Management Plan CM-09 Annually Incident Response Test Report IR-03 Annually Automated API Feeds/Log Data to SBA

SIEM

SI-04 Continuous

Results of Review of Physical Access Records

PE-08 Annually

Contractor Personnel Roster PS-04 Weekly Personnel Screening and Security PS-07 Continuous