Attach 6 Sample SON 4 FISMA.doc

FA3002-10-R-0045

Attachment 6

AIR EDUCATION & TRAINING COMMAND (AETC)

PERFORMANCE WORK STATEMENT (PWS) ADDENDUM

FOR

ANNUAL FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) VALIDATION OF AUTOMATED INFORMATION SYSTEMS (AISs) AND CIRCUIT/ENCLAVES

20 JANUARY 2010

1.0 DESCRIPTION OF TASK ORDER SERVICES:

1.1 Headquarters Air Education & Training Command, Director of Communications (HQ AETC/A6) requires contractor support to complete the Annual FISMA Validation of AISs and circuit/enclaves. Specifically three questions are to be reviewed and validated on an annual basis: Annual Security Review, Annual Security Control Testing and Annual Contingency testing. A listing of required AIS, circuit/enclave FISMA validation will be provided by HQ AETC/A6OK. Not all AIS, circuit/enclaves require validation at the same time as they are spread out throughout the year. The contractor will require access to the Enterprise Information Technology Database Repository (EITDR) which requires a minimum of a national agency check (NAC).

2.0 BACKGROUND.

2.1 Annual Security Review involve reviewing the entire AIS, circuit/enclave to determine if any changes have been made which would warrant a new certification and accreditation effort. Contingency Testing can be a desktop planning exercise which illustrates the effects on the mission if the AIS or circuit/enclave goes down, it may be as simple as if the systems fails, use a pen and paper or robust enough that an alternate location is available to continue the mission. Annual Security Control Testing requires 1/3 of the IA controls to be reviewed each year and ensure the AIS or circuit/enclave is still compliant to the established security practices and the accreditation package Approval to Operate (ATO).

3.0 SCOPE/DELIVERABLES:

3.1 Contractor will complete the Annual FISMA review for each AIS circuit/enclave and answer the three FISMA questions: Annual Security Review, Annual Security Control Testing and Contingency Testing.

3.2 The contractor will develop and maintain documentation that meets or exceeds DoD Information Security requirements for system deliverables IAW DoDI 8510.01 DIACAP, AFI 33-202, Network and Computer Security Vol. 1, and SAF/XC promulgated FISMA guidance.

3.3 The contractor shall provide support required to achieve Federal Information System Management Act (FISMA) validation. FISMA support will be provided by the contractor to satisfy annual reporting guidance requirements in accordance with the Air Force Chief Information Officer (CIO) 7 April 2007 memo and subsequent released guidance. FISMA requirements listed in this memorandum shall meet or exceed minimum standards as required by the program manager/system owner or the Quality Assurance Personnel (QAP). Cooperation between the contractor and the system owner shall ensure the appropriate FISMA questions in EITDR are answered and meet minimum solution requirements listed within the database. FISMA minimum requirements must be met or an appropriate Plan of Action and Milestones (POA&M) schedule shall be produced if it should fail.

3.7 The contractor shall support the AIS/circuit/enclave program manager in responding to any questions, attending meetings, and/or any other activities/tasks facilitating the development of the Annual FISMA validation to include travel for testing and evaluation. Trip reports and/or meeting minutes detailing formal interactions will be required and supplied by the contractor, and included in a Status Report.

3.8 The contractor shall provide a schedule for completion of all tasks/activities required for Validating the FISMA questions within five business days of contract. The Annual FISMA questions are due 30 days after task order award.

DRAWING 1

DRAWING 2