Statement of work.pdf

Attachment 1

U.S. DEPARTMENT OF TRANSPORTATION

ENTERPRISE SERVICES CENTER

ESC SSAE Independent Assessment of Controls

STATEMENT OF WORK

Version 1.0 September 14, 2017

U.S. DEPARTMENT OF TRANSPORTATION

ENTERPRISE SERVICES CENTER

Table of Contents Section Description Page

1 OVERVIEW

2 BACKGROUND

3 SCOPE REQUIREMENTS

4 OBJECTIVES

5 AUDIT STANDARDS / GUIDANCE

6 REQUIREMENTS

7 CONTRACT DELIVERY SCHEDULE

8 SPECIAL CONTRACT REQUIREMENTS ...... ERROR! BOOKMARK NOT DEFINED.

9 LIST OF DOCUMENTS, EXHIBITS AND ATTACHMENTS ... ERROR! BOOKMARK

NOT DEFINED.

1 OVERVIEW

1.1 The Enterprise Services Center (ESC) is a Federal Aviation Administration (FAA) matrix organization within the

U.S. Department of Transportation (DOT) that provides system hosting, transaction processing and financial reporting support services to Federal government entities. The transaction processing and financial reporting services are provided utilizing the Oracle-based Delphi Financial Management application and ESC’s Portable Reusable Integrated Software Modules (PRISM), a procurement application. Operating Administrations (OAs) include DOT- OAs and Non-DOT OAs, with the DOT-OAs representing the largest block of Financial Services Division customers. Support services are defined for each customer in annual service level agreements (SLA), and can include Accounts Receivable (AR), Accounts Payable (AP), Purchasing (PO), Fixed Assets (FA), Project Accounting, (PA), General Ledger (GL), financial reporting support, and other transaction-based services. Delphi and ESC PRISM are hosted by the ESC at the FAA Mike Monroney Aeronautical Center (MMAC), located in Oklahoma City, Oklahoma.

The purpose of this contract is to perform a Readiness Assessment for a Statement on Standards for Attestation Engagements (SSAE) Type II Examination of the DOT’s Enterprise Services Center (ESC) as it relates to ESC’s Application Hosting, Hardware and Software Maintenance.

The purpose of this report will document the results and conclusions from each Fiscal Year review of ESC’s Security Program Controls, Logical Access Controls, Configuration Management and Change Controls, Computer Operations Controls and Physical Access and Environmental Controls.

The key objective for this contract is to provide ESC constructive feedback on the possible results that will be obtained by a service auditor if the service auditor attempts to obtain reasonable assurance about whether, in all material respects, based on suitable criteria,

i. Management’s description of ESC’s system fairly presents the system that was designed and implemented throughout the specified period.

ii. The controls related to the control objectives stated, in management’s description of ESC’s system, were suitably designed throughout the specified period.

iii. The controls operated effectively to provide reasonable assurance that the control objectives, stated in management’s description of ESC’s system, were achieved throughout the specified period.

An additional objective is to provide ESC management with a justification for the written assertion that ESC will have to provide to their SSAE service auditor as part of their upcoming SSAE examination. One of the requirements in SSAE is that the service organization management (i.e. ESC) has to provide to their service auditor a written assertion from management about the fairness of the presentation of the description of its system, the suitability of the design and the operating effectiveness of the controls included in their description.

The SSAE requires that the service organization’s internal controls are a living document and subject to change.

Prior to issuance of a task order, the contractor will receive notice that the internal controls have not changed, or a revised set of internal controls. Changes may dictate negotiations on estimated number of controls and the on-site period of performance (POP).

2 BACKGROUND

2.1 The Enterprise Services Center (ESC) is a Federal Aviation Administration (FAA) within the U.S. Department of

Transportation (DOT) that provides system hosting, transaction processing and financial reporting support services to Federal government entities. The transaction processing and financial reporting services are provided utilizing the Oracle-based “Delphi” Financial Management application and ESC’s Portable Reusable Integrated Software Modules (PRISM), FAA’s procurement application. Operating Administrations (OAs) include DOT-OAs and Non- DOT OAs, with the DOT-OAs representing the largest block of ESC’s Financial Services Division customers.

Support services are defined for each customer in annual service level agreements (SLA), and can include Accounts Receivable (AR), Accounts Payable (AP), Purchasing (PO), Fixed Assets (FA), Project Accounting, (PA), General Ledger (GL), financial reporting support, and other transaction-based services. Delphi and ESC PRISM are hosted by ESC at the FAA Mike Monroney Aeronautical Center (MMAC), located in Oklahoma City, Oklahoma.

{Figure 1: Enterprise Service Center}

The Program Office at the Director Level, AMK-1, is comprised of three sub offices: AMK-010 Business

Office, AMK-200 Information Services Division, and AMK-300 Financial Services Division

{Figure 2: ESC Information Services Division}

The AMK-200 Information Services Division is comprised of three sub offices: AMK-210 Engineering

Solution Delivery Branch, AMK-220 Operations Management Branch, and AMK-230 Information Security Branch

{Figure 3: ESC Financial Services Center}

The AMK-300 Financial Services division is comprised of four sub branches: AMK-310 Administrative Payments Branch, AMK-320 General Accounting Branch, AMK-330 Reporting and Analysis Branch, AMK-340 Travel Services Branch

3 SCOPE REQUIREMENTS

3.1 This Statement of Work (SOW) is for an independent audit firm to perform a SSAE Type II Assessment based on:

• Fairness of presentation of description of service organization’s system,

• Suitability of design of controls to achieve related control objectives stated in description, &

• Operating effectiveness of controls to achieve related control objectives stated in description.

Referred to hereafter as Fairness, Suitability, and Operating Effectiveness.

3.2 Contract PoP

3.2.1 Base Year: Annual review of the entire scope of systems / services

3.2.2 Option Year 1: Annual review of the entire scope of systems / services

3.2.3 Option Year 2: Annual review of the entire scope of systems / services

3.2.4 Option Year 3: Annual review of the entire scope of systems / services

3.2.5 Option Year 4: Annual review of the entire scope of systems / services

Task POP’s are estimated for Base year and each option year; if exercised, and will be negotiated with the issuance of individual task orders.

Task PoP SCOPE OF SYSTEM Contract PoP Oct 2017 – Dec 2017 10/1/2017 – 9/30/2018 Fairness Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0001

Oct XX – Dec XX, 2018 (TBD) 10/1/2018 – 9/30/2019 Fairness Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0003

Oct XX – Dec XX, 2019 (TBD) 10/1/2019 – 9/30/2020 Fairness Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0005

Oct XX – Dec XX, 2020 (TBD) 10/1/2020 – 9/30/2021 Fairness Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0007

Oct XX – Dec XX, 2021 (TBD) 10/1/2021 – 9/30/2022 Fairness Delphi, ESC PRISM, ESC EDC and ESC Level Controls Suitability Delphi, ESC PRISM, ESC EDC and ESC Level Controls Operating effectiveness Delphi, ESC PRISM, ESC EDC and ESC Level Controls

Travel for CLIN 0009

3.3 Scope Description Summary

The scope of this SOW includes:

• Delphi (DOT's financial application)

• ESC PRISM

• Enterprise Services Center’s (ESC), Enterprise Data Center (EDC)

3.4 Scope Detailed

3.4.1 Systems: Delphi & ESC PRISM

3.4.2 Systems hosting includes installation and maintenance; system management; configuration management;

data backup; logical and physical access control; and continuously monitored and controlled environment for HVAC and power (Includes Infrastructure Support).

Systems: ESC EDC

4 OBJECTIVES

4.1 The objective of this SOW is for the Independent Public Accounting (IPA) firm to act as confidential internal auditors (referencing the AICPA’s SSAE, Reporting on Controls at a Service Organization) to support the ESC in its attestation of Fairness, Suitability, and Operating Effectiveness as required by SSAE. This is a Type II engagement.

4.1.1. Fairness

The IPA will perform and document an independent assessment of the fairness of presentation of description of service organization’s system,

4.1.2. Suitability

The IPA will perform and document an independent assessment of the suitability of design of controls to achieve related control objectives stated in description.

4.1.3. Operating Effectiveness

The IPA will perform and document an independent assessment, by individual control, of the effectiveness of these controls, which are stated in the description of ESC's systems / services. This assessment shall document the effectiveness of controls (pass/fail) employed by the ESC as it relates to the service offerings as described in Section 3. If a control does not pass the IPA's test the contractor will support, as requested by the Audit Liaison, the ESC's development of a corrective action.

The final deliverable of each Phase will be a Type II assessment which will become the property of the government and will be used by the ESC as the basis for its attestation in ESC’s annual SSAE Type II engagements in Fiscal Years 2018/2019/2020/2021/2022. The Report will be comprised of two sections; a summary by the IPA explaining the engagement, and the results of the tests by control. A template is attached for the controls. All documentation will become the property of the government and shall be prepared by the contractor.

5 AUDIT STANDARDS / GUIDANCE

5.1 Audit Standards / Guidance. The Contractor shall perform the review in accordance with standards and guidance established by the American Institute of Certified Public Accountants (AICPA), Government Accountability Office (GAO), Office of Management and Budget (OMB), Public Laws, etc., that are in effect for Fiscal Year (FY) 2018 These include but are not limited to:

5.1.1 AICPA Standards.

5.1.1.1. AICPA’s Statement on Standards for Attestation Engagements (SSAE), Reporting on Controls at a Service Organization, as amended.

5.1.1.2 Codification of Statements on Auditing Standards, AU §324.44.

5.1.2 GAO Standards and Manuals.

5.1.2.1 Generally Accepted Government Auditing Standards (GAGAS).

5.1.2.2 Federal Information Systems Controls Audit Manual (FISCAM).

5.1.2.3 President’s Council on Integrity and Efficiency (PCIE) Financial Audit Manual (FAM).

5.1.3 Public Law.

Federal Information Security Management Act (FISMA), a part of the E-Government Act of 2002 (PL No.

107-347).

5.1.4 National Institute of Standards and Technology (NIST) Standards, as applicable.

5.1.5 OMB Memorandums.

6 REQUIREMENTS

6.1 Initial Planning Meeting with ESC Audit Liaison

The Contractor and Audit Liaison shall discuss; via conference call, the internal assessment process and expectations including sampling methodologies, an overview of ESC PBC Tracker Application “ES3”, {Provided by Client (PBC) tracking repository}, and all deliverables. The Contractor shall prepare all documentation, including the Report, using Microsoft Windows Office Suite of products (i.e., Word, Excel) so they are compatible with the Audit Liaison's software. The ESC Audit Liaison will assist the Contractor in the process to obtain personnel security clearances for access to the MMAC for the on-site engagement period.

6.2 Provided by Client (PBC) Requests

To ensure expeditious submittal of PBCs commencing the contractor shall become familiar with the comprehensive system/services controls that are outlined within the ESC SSAE description and controls document. PBC requests shall be incrementally entered by the contractor into the designated ES3 Readiness Assessment PBC Tracker Application. The ESC Audit Liaison will provide an import template to the contractor, so that PBC Requests can be automatically uploaded into the ES3 Readiness Assessment PBC Tracker Application. The contractor shall “assign” each PBC to the applicable point of contact (POC), with a two week suspense date.

6.3 Control Modifications or creation

Throughout each assessment, the contractor may become aware of discrepancies within the ESC SSAE management assertions document, in which ESC needs assistance in modifying the control objectives. In coordination with the ESC Audit Liaison and FAA Contracting Officer, the contractor shall provide revised control language or proposed additional controls that pertain to the scope of the current assessment. Control modifications or the creation of new controls must be negotiated between FAA and the contractor and approved prior to implementation. In doing so, the contractor will have assisted ESC by ensuring it is prepared for official DOT Office of Inspector General (OIG), SSAE Audit Engagement.

6.4 Draft Assessment Report

This report will be the basis of and incorporated into ESC's Attestation Report for the FYs 2018/2019/2020/2021/2022 SSAE engagements. The contractor shall incorporate suggestions made by the Audit Liaison, with the exception changing the outcome of the tests.

The contractor will prepare and provide a draft assessment report of all controls, complete with all testing notes and results, in softcopy format. The draft Independent Service Auditor’s Report will document in two sections, the assessment performed; a summary by the IPA explaining the engagement, and the completed testing results by individual control.

6.5 Final Assessment Report

This documentation will become the property of the Government, and will be the basis of and incorporated into ESC's Attestation Report for the FYs 2018/2019/2020/2021/2022 SSAE engagements.

The Contractor will prepare and provide a signed final assessment report of all controls, complete with all testing notes and results, in softcopy format. The Independent Service Auditor’s Report will document in two sections, the assessment performed; a summary by the IPA explaining the engagement, and the completed testing results by individual control.

6.6 Work Papers

The Contractor shall protect all work papers from unauthorized access and/or disclosure.

7 CONTRACT DELIVERY SCHEDULE

Delivery Schedule for Base year:

The Contractor shall comply with the following delivery schedule. Any changes to the delivery schedule shall require the COR and/or CO approval. The Contractor shall submit all deliverables to the Audit Liaison no later than 3:00 P.M.

(CT) on the due date.

Delivery schedules will be negotiated for each of the option years. These will be included in the individual task orders.

DELIVERABLE DUE DATE TO AUDIT LIAISON

Provided by Client (PBC) Request ES3 Import Listing 4 weeks prior to onsite testing Provided by Client (PBC) Requests; additional As required Immediate notification of Failed Control As required Draft Assessment Report 1 week prior to End of Performance Period Final Assessment Report, entitled Service Auditor’s Report NLT Last day of Period of Performance Invoice w/Receipts (Electronic Only) NLT 30 days from End of Performance Period

8 SPECIAL CONTRACT REQUIREMENTS

8.1 Contracting Officer (CO), Contracting Officer Representative (COR) / Audit Liaison.

The Contractor shall interact with the Contracting Officer, COR/Audit Liaison. Specifically,

8.2 Contracting Officer (CO)

Franchise Acquisition Division, AAQ-722 MMAC, MBP Bldg.

6500 S. MacArthur Blvd.

Oklahoma City, OK 73169

8.3 Audit Liaison / COR

As assigned by Contracting Officer (CO) Federal Aviation Administration Mike Monroney Aeronautical Center 6500 South MacArthur Boulevard Oklahoma City, Oklahoma 73169

8.4 Contractor Audit Lead / Manager. The contractor shall provide a Lead / Manager who shall be responsible for the performance of the work specified in accordance with the terms and conditions of the resulting contract and/or task orders issued thereunder. The individual shall have full authority to act on behalf of the contractor for all issues pertaining to contract administration for subject contract. The Lead/Manager will possess at least three years of SAS70 and SSAE audit experience for government agencies similar in scope to that of ESC’s requirement. The lead/manager must be a Certified Public Accountant (CPA) and possess a certification in one of the following: Certified Information Systems Auditor (CISA) or Certified Information Systems Manager (CISM) or equivalent. Equivalent certification must be validated. Qualifications of the proposed lead/manager are subject to Government review and approval and will be considered “Key Personnel” in the performance of this contract.

Contractor Audit Lead / Manager is considered Key Personnel and as such must be employed with the firm at the time of award and shall be maintained to the maximum extent possible throughout this program. Should changes be necessary, the contractor shall notify the Government in writing of the proposed substitution and their qualifications. Implementation of the changes shall be subject to Government approval in accordance with Clause 3.8.2-17 (Key Personnel and Facilities.) If the Government determines that certain personnel are considered “key” to successful completion of a task order, they will be designated as key task order personnel in the task order and subject to the provisions of the aforementioned clause. Resumes shall be submitted detailing the qualifications and experience of key personnel prior to award. The Government retains the authority to accept or reject the qualifications of any key personnel.

8.5 Support Audit Team. The contractor shall provide highly skilled and qualified auditors to support the Audit

Lead/Manager in the performance of all SSAE Readiness Assessments.

Each auditor must have at a minimum:

-two (2) years of auditing experience in SSAE Examinations or Information Technology Audits; and -Certified to an industry standard such as CISA, CISM or equivalent.

The contractor must provide resumes for support auditors that may be substituted during the performance of the contract. The Government retains the authority to accept or reject the qualifications of the support auditors.

8.6 Confidentiality Statement. All work performed under this contract is confidential and is not to be released to outside parties without the ESC’s written permission.

8.7 Security Clearances. All Contractor employees working on this SOW are will have a Background Investigation completed justifying a Risk Level of Moderate.

In order for the contactor to support this contract, they will be required to obtain the FAA PIV Card, as it is required to access the FAA Network and/or systems, such as the ES3 Readiness Assessment PBC Tracker Application. The ESC Audit Liaison will assist contractors in obtaining the government identification badges;

however they will need access to a DOT Government Location, so that the FAA PIV can be enabled.

8.8 Geographic Locations. The Contractor will work on-site during the test phase, (CLIN 0001 Anticipated October – December 2017; option years TBN in individual task orders), in government furnished facilities at the FAA’s Mike Monroney Aeronautical Center, in Oklahoma City, Oklahoma.

8.9 Building Access. Building access during off duty hours is not needed for this SOW.

8.10 Government Furnished Property and Work Space. The ESC will supply work areas, at least one LAN line telephone, desks, and chairs at the MMAC in Oklahoma City, Oklahoma for the period of on-site performance.

The Contractor must ensure that sensitive and confidential information and documentation is kept in a locked, secure place when not in use by contract staff, and must ensure that Government property is kept locked up after regular business working hours (6 a.m. - 6 p.m. Monday – Friday, except for government holidays or shutdowns). The Contractor will supply its own computers/laptops, monitors, printers, calculators, office supplies, and other equipment. The contractor will allow the FAA, MMAC Helpdesk Team the opportunity to scan their device(s) prior to accessing the FAA Network Connection while onsite at the FAA MMAC.

8.11 Furnished Software. Furnished software will not be included within this SOW. The ES3 Readiness Assessment PBC Tracker Application, referenced above, is a .Net application and can only be accessed from within the FAA Firewall.

8.12 Travel. The Contractor shall be reimbursed for authorized travel IAW the Federal Travel Regulations (FTR) and applicable AMS clause(s). The contractor will provide travel authorizations for COR review and approval prior to travel. Reference AMS Clause 3.3.2-2 Reimbursement for Travel and Subsistence incorporated into the contract.

9 LIST OF DOCUMENTS, EXHIBITS AND ATTACHMENTS

The following list applies to the base year. Attachments for option years will be provided with each individual task order issued, or as needed.

• SSAE Management Assertions – GITC Description & Controls

The Contractor will prepare and deliver the completed forms below in the format provided as part of the solicitation, which shall become part of the official file:

• DOT Sensitive Information Form; for each contractor supporting this contract

United States Department of Transportation

Enterprise Services Center Delphi

SSAE18 Management Assertions

Table of Contents

I. INDEPENDENT SERVICE AUDITORS’ REPORT PROVIDED BY AUDITOR

II. ENTERPRISE SERVICES CENTER’S ASSERTION

III. DESCRIPTION OF CONTROLS PROVIDED BY THE ENTERPRISE SERVICES CENTER

IV. CONTROL OBJECTIVES, RELATED CONTROLS, AND TESTS OF OPERATING EFFECTIVENESS

GENERAL INFORMATION TECHNOLOGY CONTROLS

Security Program Controls

Logical Access Controls

Configuration Management and Change Controls

Computer Operations Controls

Physical Access and Environmental Controls

I. INDEPENDENT SERVICE AUDITORS’ REPORT PROVIDED BY AUDITOR

II. ENTERPRISE SERVICES CENTER’S ASSERTION

III. DESCRIPTION OF CONTROLS PROVIDED BY THE ENTERPRISE SERVICES

CENTER

(To be provided once contract is awarded)

IV. CONTROL OBJECTIVES, RELATED CONTROLS, AND TESTS OF

OPERATING EFFECTIVENESS

GENERAL INFORMATION TECHNOLOGY CONTROLS

Security Program Controls

Control Objective G1: Controls provide reasonable assurance that a security program is maintained and security controls are reviewed and monitored.

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor)

1 ESC Applications are required to undergo a Security Authorization (SA) every three years or whenever a major change occurs to the system or the environment in which it operates.

2 Security Authorizations are conducted on an annual basis or whenever a major change occurs to the system or the environment in which it operates.

3 ESC Applications are categorized using the Federal Information Processing Standards 199 (FIPS-199) Standards for Security Categorization of Federal Information and Information Systems guidance, for reviewing the confidentiality, availability, and integrity (CIA) of federal information systems.

4 Delphi SSPs are documented and updated at least annually or as a result of a major change to the systems or the environment in which they operate. SSPs reflect the current operating environment.

5 ESC management ensures documentation and tracking of verified deficiencies in a

Control Objective G1: Controls provide reasonable assurance that a security program is maintained and security controls are reviewed and monitored.

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor)

POA&M.

6 The ESC performs periodic vulnerability scans and third-party testing of security controls to continuously and proactively monitor risks and identify security control gaps.

7 Security Awareness Training (SAT) is completed annually by all ESC employees and contractors using the eLMS portal to monitor the completion of annual SAT for ESC employees and contractors. ESC employees and contractors are required to complete both the DOT SAT and ASH SAVI trainings.

8 Procedures for identifying, categorizing, and responding to security incidents have been implemented and defined in the ESC incident response procedures.

9 MOUs are documented and tracked for interconnected systems.

Logical Access Controls

Control Objective G2: Controls provide reasonable assurance that logical access to programs, data, and computer resources is restricted to authorized and appropriate users.

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor) 1 Password configuration settings for Delphi are in accordance with Department of Transportation 1351.37 Cybersecurity Compendium requirements.

2 ESC Applications create user accounts or modify user access roles based on an authorized access request.

3 A biweekly report multiple sources to ensure ESC Application access is monitored and unauthorized access is disabled.

4 On a quarterly basis, ESC users’ access to ESC Applications is reviewed to help ensure access is commensurate with job responsibilities.

5 Database audit logs for ESC Applications are maintained in a central log repository.

6 Audit logs for ESC Applications are reviewed and handled in accordance with the ESC-EDC Technical Operating Procedures (TOP) Security Audit Review document.

Control Objective G2: Controls provide reasonable assurance that logical access to programs, data, and computer resources is restricted to authorized and appropriate users.

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor) 7 The ESC performs weekly automated segregation of duties checks on Delphi to detect any incompatible roles assigned to users.

8 Reviews of privileged access on the ESC applications, the supporting databases and operating systems are performed semi-annually.

9 At the database level, DBA are assigned named accounts.

Configuration Management and Change Controls

Control Objective G3: Controls provide reasonable assurance that application, operating systems and databases changes are documented, tested, and approved prior to implementation.

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor) ESC Applications

1 Application changes and configuration modifications to ESC Applications are documented, tested, and approved prior to migration to production.

2 Application Programmers and Developers do not have access to migrate changes to production.

3 System software changes and database changes are requested, documented, tested, and approved.

4 Security configuration baselines are documented, maintained, and reviewed on an annual basis.

5 Application OS, database and application servers are scanned monthly for vulnerabilities. Vulnerabilities are reported to the ISSO and technical personnel for mitigation and are tracked in associated POA&Ms. If mitigation is not possible, the vulnerability may be accepted as a risk by the Authorizing Official.

6 Application changes and configuration modifications are documented, tested, and

Control Objective G3: Controls provide reasonable assurance that application, operating systems and databases changes are documented, tested, and approved prior to implementation.

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor) approved prior to migration to production.

7 Application programmers do not have access to production environments to migrate changes to production.

8 System software changes and database changes are requested, documented, tested, and approved

9 Security configuration baselines are documented, maintained, and reviewed on at least an annual basis.

10 ESC Applications OS, database and application servers are scanned monthly for vulnerabilities. Vulnerabilities are reported to the ISSO and technical personnel for mitigation and are tracked in the POA&Ms. If mitigation is not possible, the vulnerability may be accepted as a risk by the Authorizing Official.

Computer Operations Controls

Control Objective G4: Controls provide reasonable assurance that application and system processing jobs, including back-ups, are authorized and job processing errors are identified and tracked to resolution.

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor)

1. New process, modifications and changes to

ESC Application production jobs and job schedules follow the change control process and are tracked.

2. ESC Application Administrators monitor the completion of scheduled processing jobs on a daily basis and document their review in job scheduling reports to ensure that all jobs were kicked off and completed.

3. ESC Applications are backed up.

Physical Access and Environmental Controls

Control Objective G5: Controls provide reasonable assurance that physical access to computer and system resources is restricted to authorized and appropriate personnel and environmental controls are established to protect systems housed in the data center from environmental hazards..

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor) 1 The ESC-EDC has implemented the following environmental controls to mitigate risks related to fire, heat, and water damage, and monitors the maintenance to help ensure continued operation:

Raised flooring is used throughout the data center to conceal and protect cabling and to minimize damage from flooding

Fire alarms and fire suppression systems are installed

UPS system is in operation Temperature and humidity are kept within specified parameters.

2 The ESC-EDC is monitored by a video recording system and all exits are alarmed.

3 Logs of personnel with access to the ESC- EDC are reviewed every 180 days to determine that all personnel with access to the ESC-EDC are valid and have a need to enter this sensitive area.

Logs documenting personnel with access to the ESC-EDC are reviewed.

4 Individuals accessing the ESC-EDC without a key card are required to sign in

Control Objective G5: Controls provide reasonable assurance that physical access to computer and system resources is restricted to authorized and appropriate personnel and environmental controls are established to protect systems housed in the data center from environmental hazards..

Description of Controls Provided by the ESC

Auditor Testing w/results Complementary User Entity Controls Described by the ESC

(Not Tested by Auditor) and wear a visitors badge while inside the facility. Visitors must be escorted while inside the ESC-EDC.

DOT/ESC Contractor Certification Regarding DOT Sensitive Information

I, _____________________________, and employee of _______________________________________, (Name) (Firm) which is under contract with DOT/ESC to perform ___________________________________, certify that I:

(Name of Audit) (check one) Do not have any sensitive DOT data stored in my portable computers.

Am authorized by DOT/ESC COR to store the following sensitive DOT data in my portable computers to perform my duties. (Specify type and size of the sensitive data). (Note: PII is not allowed)

I use the following security mechanisms to protect the sensitive DOT data store in my portable computer.

I certify that I will:

1. Comply with DOT’s policy for securing sensitive information stored in my portable computer.

2. Only store sensitive DOT data in my portable computer and backup device authorized by DOT/ESC COR.

3. Not transfer sensitive DOT data to another computer without COR’s approval.

4. Remove sensitive DOT data from my computer when completing my assignment or being reassigned to another project.

5. Notify the COR immediately, but no more than 24 hours, if the computer containing sensitive DOT data is missing, lost, or stolen.

(Signature and Title) (Date)

Contractor Supervisor Certification I certify that I have discussed DOT/ESC’s requirements with the above employee and will continue monitoring the employee’s compliance with the requirements.

(Name) (Signature) (Date)

DOT/ESC COR Certification

I certify that I have authorized the contractor employee named above to store the specified sensitive DOT data in his/her portable computers.

(Name) (Signature) (Date)