EXHIBIT_C_OWF_IT_Contract_Baseline_Compliance_Requirements_(1).docx

CmDepartment of the Interior (DOI), Office of Wildland Fire (OWF) Information Technology (IT) Project Baseline Requirements Introduction This document outlines the compliance requirements for contractors engaged in IT-related projects with the DOI/OWF. It highlights key elements from the DOI IT Baseline Compliance Contract Guidelines[footnoteRef:2] and provides specific requirements for OWF IT projects. This guide aims to ensure comprehensive understanding and adherence to DOI’s IT Security, Privacy, and Data Protection Standards. [2: See the DOI IT Baseline Compliance Contract Guidelines.docx provided with this document.]

The OWF embraces the DOI and Federal Cloud Computing Strategy, commonly referred to as “Cloud Smart”. The Cloud Smart Strategy extends the Federal Governments initial Cloud First initiative and provides more guidance on security, procurement and workforce skills enabling cloud adoption and implementation.

These IT Project Baseline Requirements are focused on IT systems delivered to DOI/OWF through one of the Cloud Deployment models defined in the National Institute of Technology (NIST) Special Publication (SP) 800-145:[footnoteRef:3] [3: For purposes of this document, DOI defines any set of computing resources implemented outside a DOI owned data center as being a cloud system. All other characteristics in SP 800-145 also apply.]

More information on the Federal Government’s Cloud Computing Strategy is available at: Home: Federal Cloud Computing Strategy (cio.gov). The DOI specific Cloud Strategy is detailed at: The DOI Cloud Program | U.S. Department of the Interior.

1.0 Information Technology and Cybersecurity Requirements

Applicability These requirements apply to all IT system contractors, subcontractors, and their employees. Contractors must incorporate these terms in all subcontracts to ensure consistent compliance.

General Compliance Contractors must comply with:

- Federal Information Security Modernization Act (FISMA)

- Privacy Act of 1974

- NIST standards and guidelines

- DOI IT Security and Privacy Control Standards[footnoteRef:4] [4: The DOI IT Security and Privacy Control Standards are agency specific implementations of the NIST SP 800-53 controls. These documents can be provided to the customer upon receipt of a signed non-disclosure agreement (NDA) from the Contracting Officer responsible for that organization.]

- Applicable federal laws, regulations, and DOI policies.

- Encrypting system data in transit and at rest, complying with FIPS 140 standards

- Implementing phishing-resistant Multi-Factor Authentication (MFA) options for users of the application, whether Federal employees or members of the public Information System Security Management Contractors are responsible for Providing Security Assessment and Authorization (A&A) documentation within 6 months of contract award. Documentation must include:[footnoteRef:5] [5: DOI recommends using FedRAMP templates for documentation available at: Search For Any FedRAMP Policy or Guidance Resource | FedRAMP.gov]

· System Security Plan (SSP) for the contracted system;

· Security Assessment Report (SAR) provide by a FedRAMP recognized Third Party Assessment Organization (3PAO);

· Information System Continuous Monitoring Plan (ISCMP) describing ongoing monitoring of the contracted system’s security monitoring;

· System Contingency Plan describing how agency service and information is protected and recovered in case of an outage

· System Incident Response Plan describing how the contractor minimizes and recovers from information system security incidents (attacks).

2.0 Privacy Requirements

Compliance Contractors must adhere to the Privacy Act of 1974 and handle Personally Identifiable Information (PII) in accordance with federal guidelines. This includes implementing privacy controls and ensuring privacy training for all employees working with DOI/OWF information.

Incident Reporting Contractors must report any known or suspected breaches of PII immediately and comply with DOI’s breach response procedures.

3.0 Continuous Monitoring and Vulnerability Management

Continuous Monitoring Contractors must:

- Conduct monthly vulnerability scans using industry accepted tools, provide reports to DOI/OWF Information System Security Officer (ISSO) assigned to the system.

- Remediate identified vulnerabilities promptly, following DOI-mandated timeframes.

- Continuous monitoring must include annual security testing and regular updates to the Information System Continuous Monitoring Plan (ISCMP).

- Provide monthly continuous monitoring reports that provide visibility into the security posture of the systems.

4.0 Security Training

Initial Training All contractor employees involved with the system provided to DOI/OWF must complete IT security awareness training prior to being associated to the system. Employees with specific system security related roles must also complete additional role-based training.

Annual Training

Contractor employees associated with the contract must also complete annual refresher training.

5.0 Records Management

Compliance Contractors must comply with federal records management laws and DOI policies. This includes:

- Proper handling, preservation, and disposal of federal records.

- Ensuring records are managed in accordance with 44 U.S.C. chapters 21, 29, 31, and 33.

- Contractors must return all DOI-related information and certify its sanitization from contractor-owned systems following NIST SP 800-88 guidelines.

6.0 Cloud Security and FedRAMP Compliance

General Requirements Cloud-hosted services must comply with DOI cloud hosting program guidelines. All cloud-hosted services must have, or be able to receive within 12 months of contract award, one of the following FedRAMP Marketplace Designations:

- FedRAMP Authorized – have completed the FedRAMP authorization process with the FedRAMP Joint Authorization Board (JAB) or federal agency

- FedRAMP In Process – actively working toward a FedRAMP authorization with either the JAB or a federal agency

More details on the FedRAMP Marketplace and system designations can be found on FedRAMP’s About Marketplace webpage.

Additional Requirements

- Only authorized DOI personnel (employee or contractor) will have administrative access to computing resources in IaaS/PaaS service models. Phishing-resistant MFA is required for privileged access.

- The contractor will maintain an approved, documented strategy for migration of DOI/OWF data to alternate cloud provider or DOI Data Center in event of contract end termination.

- The contractor will follow NIST SP 800-125 guidelines for secure virtualization for resources in IaaS service models

- Systems will integrate with DOI’s existing security frameworks, including Trusted Internet Connection (TIC) requirements.

7.0 Accessibility (Section 508)

Compliance All Information and Communication Technology (ICT) products must conform to Section 508 standards, ensuring accessibility for people with disabilities.

8.0 Incident Response

Incident Reporting Contractors must report security incidents within one hour of awareness and follow DOI’s incident response procedures.[footnoteRef:6] [6: DOI Incident Response documents will be provided to the customer at the time of contract award.]

- Establish incident response and recovery procedures that integrate DOI’s incident and breach detection processes.

- Provide detailed information and cooperate fully with DOI in the investigation and remediation of incidents.

9.0 Audit Logging and Security Monitoring

General Requirements Contractors must gather and maintain system audit information and audit logs in compliance with DOI policies and Office of Management and Budget (OMB) Memo-21-31.

10.0 Conclusion

This document provides key elements from the DOI IT Baseline Compliance Contract Guidelines and provides specific requirements for OWF IT projects. Readers and prospective vendors seeking to provide IT services to OWF are encouraged to also read the full DOI IT Baseline Compliance Contract Guidelines document, review documents linked here and work with the Contracting Office/Officer that provided this document for more information.