Exhibit 7 Safeguarding Contract Language.pdf
PDF 413 KB Posted
- Solicitation number
- RFP - 171 - 240000001469
- Issued by
- Ingham County, Lansing City, Michigan
About this file
The document is Exhibit 7 Safeguarding Contract Language, which contains requirements for contractors handling Federal Tax Information (FTI) under a government contract. The key requirements include: maintaining a list of authorized personnel, restricting use of FTI to only what is necessary for contract performance, securing storage and disposal of FTI, notifying personnel of criminal and civil penalties for unauthorized access or disclosure, and allowing government inspections for compliance. The contractor must flow down these FTI safeguarding requirements to any approved subcontractors.
The contract language also specifies the government's inspection rights, the contractor's responsibilities for incident reporting and response, and the government's ability to void the contract if the contractor fails to meet the FTI safeguarding terms.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| IRS Publication 1075.pdf | ||
| Schedule A Statement of Work.docx | DOCX document | |
| Schedule C Insurance Requirements.docx | DOCX document | |
| Proposal Instructions Vendor Questions Worksheet.docx | DOCX document | |
| Schedule B - Pricing.xlsx | XLSX spreadsheet | |
| Schedule F File Layout.doc | DOC document | |
| Hybrid Contract Terms.docx | DOCX document | |
| Schedule D Service Level Agreements for Hybrid Purchases.docx | DOCX document | |
| Schedule G Section 2 Software Table.xlsx | XLSX spreadsheet | |
| 240000001469 WC Questions Answers.pdf | ||
| Department of Treasury Safeguard Requirements of Confidential Tax Data.doc | DOC document | |
| Schedule E Data Security Requirements for Hybrid Purchases.docx | DOCX document | |
| Schedule H Service Availability Report.xlsx | XLSX spreadsheet |
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Exhibit 7 Safeguarding Contract Language
I. PERFORMANCE
In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:
(1) All work will be performed under the supervision of the contractor.
(2) The contractor and c ontractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.
(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.
(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.
(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.
(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.
(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.
(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.
(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.
(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.
(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.
(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.
(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.
II. CRIMINAL/CIVIL SANCTIONS
(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and t hat further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.
(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.
(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.
(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C.
552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.
(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.
III. INSPECTION
The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.
| IRS Mission Statement |
| Office of Safeguards Mission Statement |
| Office of Safeguards Vision Statement |
| Highlights for November 2021 Revision |
| Security and Privacy Control Table |
| INTRODUCTION |
| General |
| Overview of Publication 1075 |
| SAFEGUARD RESOURCES |
| Safeguards Website |
| Safeguards Mailbox |
| KEY DEFINITIONS |
| Federal Tax Information |
| Return and Return Information |
| Personally Identifiable Information (PII) |
| Information Received from Taxpayers or Third Parties |
| Access |
| Cloud Computing |
| Inadvertent Access |
| Inadvertent Disclosure |
| Incidental Access |
| Unauthorized Access |
| Unauthorized Disclosure |
| Need-to-Know |
| Adverse Action |
| Disciplinary Action |
| Personnel Sanction |
| 1.0 FEDERAL TAX INFORMATION, REVIEWS and OTHER REQUIREMENTS |
| 1.1 General |
| 1.2 Authorized Use of FTI |
| 1.3 Secure Data Transfer |
| 1.4 State Tax Agency Limitations |
| 1.5 Coordinating Safeguards within an Agency |
| 1.6 Safeguard Reviews |
| 1.6.1 Before the Review |
| 1.6.2 During the Review |
| 1.6.3 After the Review |
| 1.7 Termination of FTI |
| 1.7.1 Agency Request |
| 1.7.1.1 Termination Documentation |
| 1.7.1.2 Archiving FTI Procedure |
1.7.2 FTI Suspension, Termination and Administrative Review
| 1.8 Reporting Improper Inspections or Disclosures |
| 1.8.1 Terms |
| 1.8.1.1 Data Incident |
| 1.8.1.2 Data Breach |
| 1.8.2 General |
| 1.8.3 Office of Safeguards Notification Process |
| 1.8.4 Incident Response Procedures |
| 1.8.5 Incident Response Notification to Impacted Individuals |
| 1.9 Disclosure to Other Persons |
| 1.9.1 General |
| 1.9.2 Authorized Disclosure Precautions |
| 1.9.3 External Personnel Security |
| 1.9.4 Disclosing FTI to Contractors or Sub-Contractors |
| 1.9.5 Re-Disclosure Agreements |
| 1.10 Return Information in Statistical Reports |
| 1.10.1 General |
| 1.10.2 Making a Request under IRC § 6103(j) |
| 1.10.3 State Tax Agency Statistical Analysis |
| 2.0 PHYSICAL SECURITY REQUIREMENTS |
| 2.A Recordkeeping Requirement – IRC § 6103(p)(4)(A) |
| 2.A.1 General |
| 2.A.2 Logs of FTI (Electronic and Non-Electronic Receipts) |
| Figure 1 – Sample FTI Logs |
| 2.A.3 Converted Media |
| 2.A.4 Recordkeeping of Disclosures to State Auditors |
| 2.B Secure Storage – IRC § 6103(p)(4)(B) |
| 2.B.1 General |
| 2.B.2 Minimum Protection Standards |
| Table 1 – Minimum Protection Standards |
| 2.B.3 Restricted Area Access |
| 2.B.3.1 Visitor Access Logs |
| Figure 2 – Visitor Access Log |
| 2.B.3.2 Authorized Access List |
| 2.B.3.3 Controlling Access to Areas Containing FTI |
| 2.B.3.4 Control and Safeguarding Keys and Combinations |
| 2.B.3.5 Locking Systems for Secured Areas |
| 2.B.4 FTI in Transit |
| 2.B.4.1 Security During Office Moves |
| 2.B.5 Physical Security of Computers, Electronic and Removable Media |
| 2.B.6 Media Off-Site Storage Requirements |
| 2.B.7 Alternate Work Site |
| 2.B.7.1 Equipment |
| 2.B.7.2 Storing Data |
| 2.B.7.3 Other Safeguards |
| 2.C Restricting Access – IRC § 6103(p)(4)(C) |
| 2.C.1 General |
| 2.C.2 Policies and Procedures |
| 2.C.3 Background Investigation Minimum Requirements |
| 2.C.3.1 Background Investigation Requirement Implementation |
| 2.C.4 Personnel Actions |
| 2.C.4.1 Personnel Transfer |
| 2.C.4.2 Personnel Sanctions |
| 2.C.4.3 Personnel Termination |
| 2.C.5 Commingling of FTI |
| 2.C.5.1 Commingling of Electronic Media |
| 2.C.6 Access to FTI via State Tax Files or Through Other Agencies |
| 2.C.7 Offshore Operations |
| 2.C.8 Controls Over Processing |
| 2.C.8.1 Agency-owned and Operated Facility |
| 2.C.8.2 Agency, Contractor or Sub-Contractor Shared Facilities |
| 2.C.9 Service Level Agreements (SLA) |
| 2.C.10 Review Availability of Contractor and Sub-Contractor Facilities |
| 2.C.11 Restricting Access – Other Disclosures |
| 2.C.11.1 Child Support Agencies—IRC §§ 6103(l)(6), (l)(8) and (l)(10) |
| 2.C.11.2 Human Services Agencies—IRC § 6103(l)(7) |
| 2.C.11.3 Deficit Reduction Agencies—IRC § 6103(l)(10) |
| 2.C.11.4 Centers for Medicare and Medicaid Services—IRC § 6103(l)(12)(C) |
| 2.C.11.5 Disclosures under IRC § 6103(l)(20) |
| 2.C.11.6 Disclosures under IRC § 6103(l)(21) |
| 2.C.11.7 Disclosures under IRC § 6103(i) |
| 2.C.11.8 Disclosures under IRC § 6103(m)(2) |
| 2.D Other Safeguards - IRC § 6103(p)(4)(D) |
| 2.D.1 General |
| 2.D.2 Training Requirements |
| Table 2 – Training Requirements |
| 2.D.2.1 Disclosure Awareness Training |
| 2.D.2.2 Disclosure Awareness Training Products |
| 2.D.3 Internal Inspections and On-Site Reviews |
| 2.D.4 Recordkeeping |
| 2.D.5 Secure Storage |
| 2.D.6 Limited Access |
| 2.D.7 Disposal |
| 2.D.8 Computer Systems Security |
| 2.D.9 Plan of Action and Milestones (POA&M) |
| 2.E Reporting Requirements – IRC § 6103(p)(4)(E) |
| 2.E.1 General |
| 2.E.2 Report Submission Instructions |
| 2.E.3 Encryption Requirements |
| 2.E.4 Safeguards Security Reports (SSR) |
| 2.E.4.1 Initial SSR Submission Instructions – New Agency Responsibilities |
| 2.E.4.2 Agencies Requesting New FTI Data Streams |
| 2.E.4.3 Annual SSR Update Submission Instructions |
| 2.E.4.4 SSR Submission Dates |
| 2.E.5 Corrective Action Plan |
| 2.E.5.1 CAP Submission Instructions |
| 2.E.5.2 CAP Submission Dates |
| 2.E.6 Notification Reporting Requirements |
| Table 6 – Notification Reporting |
| 2.E.6.1 Cloud Computing |
| 2.E.6.2 Contractor or Sub-Contractor Access |
| 2.E.6.3 Tax Modeling |
| 2.E.6.4 Live Data Testing |
| 2.F Disposing of FTI – IRC § 6103(p)(4)(F) |
| 2.F.1 General |
| 2.F.2 Returning IRS Information to the Source |
| 2.F.3 Destruction and Disposal |
| 2.F.3.1 Media Sanitization |
| 2.F.4 Other Precautions |
| 3.1 General |
| 3.2 Assessment Process |
| Table 8 – Assessment Methodologies |
| 3.3 Technology-Specific Requirements |
| 3.3.1 Cloud Computing |
| 3.3.2 Email Communications |
| 3.3.3 Facsimile and Facsimile Devices |
| 3.3.4 Mobile Devices |
| 3.3.5 Multifunction Devices (MFDs) and High-Volume Printers (HVPs) |
| 3.3.6 Network Boundary and Infrastructure |
| 3.3.7 Virtual Desktop Infrastructure |
| 3.3.8 Public-Facing Systems |
| 4.0 NIST 800-53 SECURITY AND PRIVACY CONTROLS |
| 4.1 ACCESS CONTROL |
| AC-1 Access Control Policy and Procedures |
| AC-2 Account Management |
| AC-3 Access Enforcement |
| AC-4 Information Flow Enforcement |
| AC-5 Separation of Duties |
| AC-6 Least Privilege |
| AC-7: Unsuccessful Logon Attempts |
| AC-8: System Use Notification |
| AC-11: Device Lock |
| AC-12: Session Termination |
| AC-14: Permitted Actions Without Identification or Authentication |
| AC-17: Remote Access |
| AC-18: Wireless Access |
| AC-19: Access Control for Mobile Devices |
| AC-20: Use of External Systems |
| AC-21: Information Sharing |
| AC-22: Publicly Accessible Content |
| AC-23: Data Mining Protection |
| 4.2 AWARENESS AND TRAINING |
| AT-1: Awareness and Training Policy and Procedures |
| AT-2: Awareness Training |
| AT-3: Role-Based Training |
| AT-4: Training Records |
| AT-6: Training Feedback |
| 4.3 AUDIT AND ACCOUNTABILITY |
| AU-1: Audit and Accountability Policy and Procedures |
| AU-2: Audit Events |
| AU-3: Content of Audit Records |
| AU-4: Audit Storage Capacity |
| AU-5: Response to Audit Processing Failures |
| AU-6: Audit Review, Analysis and Reporting |
| AU-7: Audit Reduction and Report Generation |
| AU-8: Time Stamps |
| AU-9: Protection of Audit |
| AU-11: Audit Record Retention |
| AU-12: Audit Generation |
| AU-16: Cross-Organizational Auditing Logging |
| 4.4 ASSESSMENT, AUTHORIZATION AND MONITORING |
| CA-1: Assessment, Authorization and Monitoring Policy and Procedures |
| CA-2: Control Assessments |
| CA-3: Information Exchange |
| CA-5: Plan of Action and Milestones |
| CA-6: Authorization |
| CA-7: Continuous Monitoring |
| CA-8: Penetration Testing |
| CA-9: Internal System Connections |
| 4.5 CONFIGURATION MANAGEMENT |
| CM-1: Configuration Management Policy and Procedures |
| CM-2: Baseline Configuration |
| CM-3: Configuration Change Control |
| CM-4: Security and Privacy Impact Analyses |
| CM-5: Access Restrictions for Change |
| CM-6: Configuration Settings |
| CM-7: Least Functionality |
| CM-8: System Component Inventory |
| CM-9: Configuration Management Plan |
| CM-10: Software Usage Restrictions |
| CM-11: User-Installed Software |
| CM-12: Information Location |
| CM-13: Data Action Mapping |
| CM-14: Signed Components |
| 4.6 CONTINGENCY PLANNING |
| CP-1: Contingency Planning Policy and Procedures |
| CP-2: Contingency Plan |
| CP-3: Contingency Training |
| CP-4: Contingency Plan Testing |
| CP-9: System Backup |
| CP-10: System Recovery and Reconstitution |
| 4.7 IDENTIFICATION AND AUTHENTICATION |
| IA-1: Identification and Authentication Policy and Procedures |
| IA-2: Identification and Authentication (Organizational Users) |
| IA-3: Device Identification and Authentication |
| IA-4: Identifier Management |
| IA-5: Authenticator Management |
| IA-6: Authenticator Feedback |
| IA-7: Cryptographic Module Authentication |
| IA-8: Identification and Authentication (Non-Organizational Users) |
| IA-9: Service Identification and Authentication |
| IA-11: Re-Authentication |
| IA-12: Identity Proofing |
| 4.8 INCIDENT RESPONSE |
| IR-1: Incident Response Policy and Procedures |
| IR-2: Incident Response Training |
| IR-3: Incident Response Testing |
| IR-4: Incident Handling |
| IR-5: Incident Monitoring |
| IR-6: Incident Reporting |
| IR-7: Incident Response Assistance |
| IR-8: Incident Response Plan |
| IR-9: Information Spillage Response |
| 4.9 MAINTENANCE |
| MA-1: System Maintenance Policy and Procedures |
| MA-2: Controlled Maintenance |
| MA-3: Maintenance Tools |
| MA-4: Nonlocal Maintenance |
| MA-5: Maintenance Personnel |
| MA-6: Timely Maintenance |
| 4.10 MEDIA PROTECTION |
| MP-1: Media Protection Policy and Procedures |
| MP-2: Media Access |
| MP-3: Media Marking |
| MP-4: Media Storage |
| MP-5: Media Transport |
| MP-6: Media Sanitization |
| MP-7: Media Use |
| 4.11 PHYSICAL AND ENVIRONMENTAL PROTECTION |
| PE-1: Physical and Environmental Policy and Procedures |
| PE-2: Physical Access Authorizations |
| PE-3: Physical Access Control |
| PE-4: Access Control for Transmission |
| PE-5: Access Control for Output Devices |
| PE-6: Monitoring Physical Access |
| PE-8: Visitor Access Records |
| PE-16: Delivery and Removal |
| PE-17: Alternate Work Site |
| 4.12 PLANNING |
| PL-1: Planning Policy and Procedures |
| PL-2: System Security and Privacy Plans |
| PL-4: Rules of Behavior |
| PL-8: Security and Privacy Architectures |
| 4.13 PROGRAM MANAGEMENT |
| PM-1: Information Security Program Plan |
| PM-2: Information Security Program Leadership Role |
| PM-3: Information Security and Privacy Resources |
| PM-4: Plan of Action and Milestones Process |
| PM-5: System Inventory |
| PM-7: Enterprise Architecture |
| PM-9: Risk Management Strategy |
| PM-10: Authorization Process |
| PM-12: Insider Threat Program |
| PM-14: Testing, Training and Monitoring |
| PM-18: Privacy Program Plan |
| PM-19: Privacy Program Leadership Role |
| PM-21: Accounting of Disclosures |
| PM-29: Risk Management Program Leadership Roles |
| 4.14 PERSONNEL SECURITY |
| PS-1: Personnel Security Policy and Procedures |
| PS-2: Position Risk Designation |
| PS-3: Personnel Screening |
| PS-4: Personnel Termination |
| PS-5: Personnel Transfer |
| PS-6: Access Agreements |
| PS-7: External Personnel Security |
| PS-8: Personnel Sanctions |
| PS-9: Position Descriptions |
| 4.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY |
| PT-1: Personally Identifiable Information Processing and Transparency Policy and Procedures |
| PT-2: Authority to Process Personally Identifiable Information |
| 4.16 RISK ASSESSMENT |
| RA-1: Risk Assessment Policy and Procedures |
| RA-3: Risk Assessment |
| RA-5: Vulnerability Monitoring and Scanning |
| RA-7: Risk Response |
| RA-8: Privacy Impact Assessments |
| 4.17 SYSTEM AND SERVICES ACQUISITION |
| SA-1: System and Services Acquisition Policy and Procedures |
| SA-2: Allocation of Resources |
| SA-3: System Development Life Cycle |
| SA-4: Acquisition Process |
| SA-5: System Documentation |
| SA-8: Security Engineering Principles |
| SA-9: External System Services |
| SA-10: Developer Configuration Management |
| SA-11: Developer Testing and Evaluation |
| SA-15: Development Process, Standards and Tools |
| SA-22: Unsupported System Components |
| 4.18 SYSTEM AND COMMUNICATIONS PROTECTION |
| SC-1: System and Communications Protection Policy and Procedures |
| SC-2: Application Partitioning |
| SC-4: Information in Shared System Resources |
| SC-7: Boundary Protection |
| SC-8: Transmission Confidentiality and Integrity |
| SC-10: Network Disconnect |
| SC-12: Cryptographic Key Establishment and Management |
| SC-13: Cryptographic Protection |
| SC-15: Collaborative Computing Devices and Applications |
| SC-17: Public Key Infrastructure Certificates |
| SC-18: Mobile Code |
| SC-20: Secure Name/Address Resolution Service (Authoritative Source) |
| SC-21: Secure Name/Address Resolution Service (Recursive or Caching Resolver) |
| SC-22: Architecture and Provisioning for Name/Address Resolution Service |
| SC-23: Session Authenticity |
| SC-28: Protection of Information at Rest |
| SC-35: External Malicious Code Identification |
| SC-39: Process Isolation |
| SC-45: System Time Synchronization |
| 4.19 SYSTEM AND INFORMATION INTEGRITY |
| SI-1: System and Information Integrity Policy and Procedures |
| SI-2: Flaw Remediation |
| SI-3: Malicious Code Protection |
| SI-4: System Monitoring |
| SI-5: Security Alerts, Advisories and Directives |
| SI-7: Software, Firmware and Information Integrity |
| SI-8: Spam Protection |
| SI-10: Information Input Validation |
| SI-11: Error Handling |
| SI-12: Information Management and Retention |
| SI-16: Memory Protection |
| 4.20 SUPPLY CHAIN RISK MANAGEMENT |
| SR-1: Supply Chain Risk Management Policy and Procedures |
| SR-2: Supply Chain Risk Management Plan |
| SR-3: Supply Chain Controls and Processes |
| SR-6: Supplier Assessments and Reviews |
| SR-10: Inspection of Systems and Components |
| SR-11: Component Authenticity |
| Exhibit 1 IRC §§ 6103(a) and (b) |
| Exhibit 2 IRC § 6103(p)(4) |
| Exhibit 3 Code of Federal Regulations (CFR) § 301.6103(p)(7)-1 [T.D. 9445, 74 FR 6830, Feb. 11, 2009] |
| Exhibit 4 IRC §§ 7213 and 7213A – Sanctions for Unauthorized Disclosure and Access |
| Exhibit 5 IRC § 7431 - Civil Damages for Unauthorized Inspection or Disclosure of Returns and Return Information |
| Exhibit 6 Contractor 45-Day Notification Procedures |
| Exhibit 7 Safeguarding Contract Language |
| Exhibit 8 Warning Banner Examples |
| Exhibit 9 Record Retention Schedules |
| GLOSSARY AND KEY TERMS |
| INDEX |
Accessibility Report
Filename:
p1075--2021-11-00v.pdf
Report created by:
Organization:
[Enter personal and organization information through the Preferences > Identity dialog.]
Summary
The checker found no problems in this document.
Needs manual check: 2
Passed manually: 0
Failed manually: 0
Skipped: 2
Passed: 28
Failed: 0
Detailed Report
Document
Rule Name Status Description
Accessibility permission flag Passed Accessibility permission flag must be set
Image-only PDF Passed Document is not image-only PDF
Tagged PDF Passed Document is tagged PDF
Logical Reading Order Needs manual check Document structure provides a logical reading order
Primary language Passed Text language is specified
Title Passed Document title is showing in title bar
Bookmarks Passed Bookmarks are present in large documents
Color contrast Needs manual check Document has appropriate color contrast
Page Content
Rule Name Status Description
Tagged content Passed All page content is tagged
Tagged annotations Passed All annotations are tagged
Tab order Passed Tab order is consistent with structure order
Character encoding Passed Reliable character encoding is provided
Tagged multimedia Passed All multimedia objects are tagged
Screen flicker Passed Page will not cause screen flicker
Scripts Passed No inaccessible scripts
Timed responses Passed Page does not require timed responses
Navigation links Passed Navigation links are not repetitive
Forms
Rule Name Status Description
Tagged form fields Passed All form fields are tagged
Field descriptions Passed All form fields have description
Alternate Text
Rule Name Status Description
Figures alternate text Passed Figures require alternate text
Nested alternate text Passed Alternate text that will never be read
Associated with content Passed Alternate text must be associated with some content
Hides annotation Passed Alternate text should not hide annotation
Other elements alternate text Skipped Other elements that require alternate text
Tables
Rule Name Status Description
Rows Passed TR must be a child of Table, THead, TBody, or TFoot
TH and TD Passed TH and TD must be children of TR
Headers Passed Tables should have headers
Regularity Passed Tables must contain the same number of columns in each row and rows in each column
Summary Skipped Tables must have a summary
Lists
Rule Name Status Description
List items Passed LI must be a child of L
Lbl and LBody Passed Lbl and LBody must be children of LI
Headings
Rule Name Status Description
Appropriate nesting Passed Appropriate nesting
Back to Top
File details come from the government source that posted it. Updated .