Chief_Information_Security_Officer's_comments.docx

Chief Information Security Officer Comments- October 15, 2012

1. As part of the continuous monitoring program, monthly scans and quarterly scans are required as part of the Certification and Accreditation process. Guidance for the Certification and Accreditation process can be found in the following documents.

SP-800-53 Rev3, SP-800-37 Rev2, SP 800-168, SP 800-30, SP 800-18, FIPS 199, FIPS 200, OMB A-130 FISMA.

2. Independent 3rd party certification is the responsibility of the successful, The independent third party will certify for the successful bidder that their system meet the NIST, FISMA and OMB A-130 requirements for Certification. Ginnie Mae will provide guidance in the process.

3. D.R. testing is required twice per year, your organization D.R. plan must show how your company will continue to do work in the event of a business interruption at your main production site.

4. You will be required to provide Ginnie Ma copy of of your organization’s Disaster Recovery and COOP plan 30 days after award, you will also be required to provide a Transition-In plan at this time.

5. continuous monitoring of network and quarterly POAM reports are to be submitted to Ginnie Mae on a quarterly basis..

6. Transition-in process usually 6 months.

7. SSAE-16 (SOC-1 and SOC-2), CARS, and A-123 are an annual requirements.