Attachment_3_IT_Security_Req.pdf

ATTACHMENT 3 -INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

The Contractor shall ensure compliance with all IT security requirements, including:

DHHS Information Security and Privacy Program http://www.hhs.gov/ocio/securityprivacy/index.html

Federal Information Security Management Act (FISMA) http://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf

National Institute of Standards and Technology (NIST) SP800-53 http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05- 01-2010.pdf

FDA Security Authorization process, which closely resembles NIST SP800-37 http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

Format and Media: The Contractor shall furnish deliverables in a manner consistent with the FISMA and NIST security requirements of the information provided. For example, the Contractor shall not send Sensitive Personal Identifying Information via e-mail across the internet.

CONFLICTS OF INTEREST

Purpose: The purpose of this clause is to ensure that the contractor and its subcontractors:

(1) Are not biased because of their financial, contractual, organizational, or other interests which relate to the work under this contract, and

(2) Do not obtain any unfair competitive advantage over other parties by virtue of their performance of this contract.

Scope: This clause applies to performance or participation by the contractor, its parents, affiliates, divisions and subsidiaries, and successors in interest (hereinafter collectively referred to as “contractor”) in the performance of this contract as a prime contractor, subcontractor, co-sponsor, joint venturer, consultant, or in any similar capacity.

Warrant and Disclosure: The warrant and disclosure requirements apply to both the contractor and all subcontractors. The contractor warrants that, to the best of the contractor's knowledge and belief, there are no relevant facts or circumstances which would give rise to an organizational conflict of interest, as defined in FAR Subpart 9.5, and that the contractor has disclosed all relevant information regarding any actual or potential conflict. The contractor agrees it shall make an immediate and full disclosure, in writing, to the Contracting Officer of any potential or actual organizational conflict of interest or the existence of any facts that may cause a reasonably prudent person to question the contractor's impartiality because of the appearance or existence of bias or an unfair competitive advantage. Such disclosure shall include a description of the actions the contractor has taken or proposes to take in order to avoid, neutralize, or mitigate any resulting conflict of interest.

http://www.hhs.gov/ocio/securityprivacy/index.html http://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

ATTACHMENT 3 -INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

Remedies: The Contracting Officer may terminate this contract for convenience, in whole or in part, if the Contracting Officer deems such termination necessary to avoid, neutralize or mitigate an actual or apparent organizational conflict of interest. If the contractor fails to disclose facts pertaining to the existence of a potential or actual organizational conflict of interest or misrepresents relevant information to the Contracting Officer, the Government may terminate the contract for default, suspend or debar the contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

Subcontracts: The contractor shall include a clause substantially similar to this clause, including paragraphs (f) and (g), in any subcontract or consultant agreement.

Prime Contractor Responsibilities: The Contractor shall determine in writing whether the interests disclosed present an actual, or significant potential for, an organizational conflict of interest. The contractor shall identify and avoid, neutralize, or mitigate any subcontractor organizational conflict prior to award of the contract to the satisfaction of the Contracting Officer. If the subcontractor's organizational conflict cannot be avoided, neutralized, or mitigated, the contractor must obtain the written approval of the Contracting Officer prior to entering into the subcontract. If the contractor becomes aware of a subcontractor's potential or actual organizational conflict of interest after contract award, the contractor agrees that the Contractor may be required to eliminate the subcontractor from its team, at the contractor's own risk. The contractor shall obtain from its subcontractors or consultants the disclosure required in FAR Part 9.507.

Waiver: The contractor may seek a waiver from the Head of the Contracting Activity by submitting such waiver request to the Contracting Officer, including a full written description of the requested waiver and the reasons in support thereof.