FISMA Contract Language IT Version 6.0 May 2023.pdf

FISMA Contract Language

(IT Systems / Applications or Services)

Revised May 2023

INFORMATION SECURITY / FEDERAL INFORMATION SECURITY

MODERNIZATION ACT (FISMA)

Pursuant to the Federal Information Security Modernization Act (FISMA), Title III of the

E-Government Act of 2014 (Pub. L. 113–283), the contractor shall provide minimum security controls required to protect Federal information and information systems in accordance with NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. The contractor shall provide a risk-based process for selecting the security controls necessary to satisfy the minimum-security requirements in accordance with Federal Information Processing Standard (FIPS) 199. The term information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity and availability. An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information resources include information and related resources, such as personnel, equipment, funds, and information technology.

The contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; or information systems used or operated by an agency or by a contractor or subcontractor of an agency. This applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, which use or operate information technology systems containing IRS data.

IRS information or information system with a FIPS 199 security categorization impact level of low, moderate or high, and those systems identified by the As Built Architecture (ABA) and agency FISMA Master Inventory.

The potential impact values for confidentiality, integrity, and availability may not always be the same for a particular information system; the high-water mark concept must be used to determine the overall impact level of the information system. Thus, a low-impact system is an information system in which all three of the security objectives are low. A moderate-impact system is an information system in which at least one of the security objectives is moderate and no security objective is greater than moderate. And finally, a high-impact system is an information system in which at least one security objective is high. The determination of information system impact levels must be accomplished prior to the consideration of minimum-security requirements and the selection of appropriate security controls for those information systems.

Federal Risk and Authorization Management Program (FedRAMP) security requirements shall be applied to all IRS cloud services and products and shall be implemented and complied with as part of a competed FedRAMP authorization.

The enforcement of FedRAMP requirements shall be done through Service Level Agreements(SLA)/Contracts. IRS shall utilize aggregated and individual security categorization information when assessing interagency and Cloud Service Provider (CSP) connections with different FIPS 199Category Impact levels.(e.g., High Impact system connecting to Moderate Impact system etc.)

THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)GUIDANCE

FOR INFORMATION SECURITY

The contractor shall follow Information Security guidance established by the National Institute of Standards and

Technology (NIST). The contractor shall establish the minimum-security controls identified in NIST Special

Publication 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations for

FISMA compliance. The contractor shall follow the best practices and guidance established by NIST Special

Publication 800 Series and Federal Information Processing Standards (FIPS) for computer security. The IRS may determine such applicable Information Technology (IT) Security standards and policies.

CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) CONTRACT LANGUAGE

CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

Pursuant to the Federal Information Security Modernization Act (FISMA), Title III of the E-Government Act of 2014 (Pub. L.

113–283), the contractor shall comply with the security controls required to protect Federal information and information systems in accordance with NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and

Organizations and NIST Special Publication 800-161 Rev 1, Cybersecurity Supply Chain Risk Management Practices for

Systems and Organizations. Additionally, the contractor must comply with guidance provided in Executive Order (EO) 14028, Improving the Nation’s Cybersecurity (May 12, 2021), which focuses on the security and integrity of the software supply chain and emphasizes the importance of secure software development environments and NIST Secure Software Development

Framework (SSDF), SP 800-218.

The Federal Information Security Modernization Act of 2014 (FISMA) requires all Federal agencies provide security protections for both “information collected or maintained by or on behalf of an agency” and for “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.” This contract language is applicable to all

Information and Communications technology (ICT) and operational technology (OT) which includes commercial off-the-shelf

(COTS) products.

Ensuring software integrity is key to protecting Federal systems from threats and vulnerabilities and reducing overall risk from cyber-attacks. Federal agencies must only use software provided by software producers who can attest to and demonstrate complying with the Government-specified secure software development practices, Security and Privacy controls and

Cybersecurity Supply Chain Risk Management Practices, as described in the NIST Guidance.

CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) STRATEGY

An organization-wide supply chain risk management strategy includes an unambiguous expression of the supply chain risk appetite and tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the supply chain risk management strategy, and the associated roles and responsibilities.

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms continuous and ongoing imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions.

The contractor shall develop and provide an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services.

CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) PLAN

The dependence on products, systems, and services from external providers, as well as the nature of the relationships with those providers, present an increasing level of risk to an organization. Threat actions that may increase security or privacy risks include unauthorized production, the insertion or use of counterfeits, tampering, theft, insertion of malicious software and hardware, and poor manufacturing and development practices in the supply chain.

The Contractor shall provide evidence of a C-SCRM Plan that identifies supply chain risk with their product or services, components, suppliers, and contractors. The Contractor shall review and update the supply chain risk management plan annually or as required, to address threat, organizational or environmental changes. The Contractor shall follow the standards set forth by the control families of NIST SP 800-53 and by the cybersecurity supplemental guidance provided by NIST SP 800-161 Rev 1.

These represent the Security and Privacy Controls for Information Systems and Organizations. Following these standards, the

Contractor Shall identify and address weaknesses or deficiencies in the supply chain elements and processes of organization-defined system or system component in this procurement.

CYBERSECURITY SUPPLY CHAIN RISK ASSESSMENT (C-SCRA)

The Contractor shall manage the supply chain risk lifecycle of their products, services and subcontractor tiers using risk assessment methods and procedures identified by NIST SP 800-161 Rev 1. The assessment shall consider documented processes, documented controls, all-source intelligence, public information, foreign ownership, control, or influence (FOCI), Country of

Origin (COO), ownership and leadership personnel, comparisons against Federal Government restriction lists, and identification of product vulnerabilities through national known vulnerability databases. The assessment and reviews shall demonstrate the ability of the Contractor to effectively assess subordinate second-tier and third-tier suppliers and contractors. The contractor shall assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide.

During all contract phases, including the Request for Proposal (RFP) and/or Request for Information (RFI), the contractor shall provide responses to the IRS C-SCRA Questionnaire that contains a list of questions based on NIST SP 800-53 Revision 5

Supply Chain Risk Management security controls and NIST SP 800-161 Rev 1, Cybersecurity Supply Chain Risk Management

Practices for Systems and Organizations. The questionnaire is tailored for each procurement to assess the maturity of the

Contractor’s C-SCRM capabilities and any C-SCRM related risks relating to the Contractor and its supplier supply chain components, subsystems, intellectual property, and other services relevant to this procurement. The questionnaire supports the

C-SCRA process. The SCRA may include reviewing the subcontractors, suppliers, distributers, manufacturers, or any other sources involved in the awardee’s supply chain. This shall be provided at no additional cost to the Federal Government. For any risks identified, the contractor shall create Plan of Action & Milestones (POA&M) to identify and track remediation of the identified risks/vulnerabilities. The contractor shall report POA&M progress to the government as requested and at minimum quarterly. The contractor shall notify the IRS immediately of any supply chain compromises or critical vulnerabilities that could lead to a compromise. Early detection and notification are critical to allow an effective and timely response to a suspected or actual incident.

SELF-ATTESTATION

The contractor shall provide a self-attestation letter that will serve as a “conformance statement” for all third-party software used by the agency, including software renewals and major version changes upon or prior to award. For any practices from the NIST guidance that the software producer cannot attest, the contractor shall provide documented practices in place to mitigate those risks along with a Plan of Action & Milestone (POA&M) to remediate in accordance with Office of Management and Budget

(OMB) Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development

Practices.

MALICIOUS CODE DETECTION AND PROTECTION

In situations where malicious code cannot be detected by detection methods or technologies, organizations rely on other types of controls, including secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to ensure that software does not perform functions other than the functions intended.

The Contractor shall monitor code using code protection mechanisms at the entrance and exit points to identify signature and non-signature malicious code in accordance with NIST SP 800-53. The protection is required to ensure software behaves according to its designed functions. The Contractor shall maintain/update the malicious code protection; block, quarantine and/or remove any malicious code; perform real-time and routine periodic malicious code protection scans and address false positives.

The contractor shall develop and implement tampering and anti-counterfeit policies and procedures to detect tampering and prevent counterfeit components from entering the system.

VULNERABILITY MONITORING AND SCANNING

Vulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly.

The Contractor shall, monitor and scan for vulnerabilities in the system and hosted applications using vulnerability monitoring tools and techniques, and when new vulnerabilities potentially affecting the system are identified and reported, perform analysis and remediation activities. For any vulnerabilities identified that cannot be remediated within 30 days, the contractor shall create

POA&Ms to identify and track remediation of the identified risks/vulnerabilities. The contractor shall report POA&M progress to the government as requested and at minimum monthly.

SOFTWARE DEVELOPMENT

The Contractor shall comply with NIST Secure Software Development Framework (SSDF) SP 800-218 for its products and services or map to the SSDF to demonstrate a framework for well-secured products.

The Contractor shall apply the SSDF to the entire product lifecycle including design, development, testing and operations. As part of these practices the Contractor shall secure all code in a software versioning library located in a secured environment with access enabled for the government requirements, software review and oversight roles. This tool shall facilitate task management, versioning, check-in/check-out/commits, reporting, testing, automation, deficiencies, and vulnerabilities, debugging, flagging and traceability as examples.

The Contractor shall provide software and systems emphasizing authentication, logging, and monitoring capabilities that detect unusual behavior consistent with NIST 800-53 Security controls.

The Contractor shall use a published secure coding standard or provide their secure coding process for all application development following NIST Secure Software Development Framework (SSDF) SP 800-218.

The Contractor shall ensure the application development team members are trained in secure code development/deployment.

The Contractor shall provide a Software Bill of Materials (SBOM) for each product provided. SBOM format and content shall comply with the Department of Commerce and National Telecommunications and Infrastructure Administration’s (NTIA) The

Minimum Elements for a Software Bill of Materials or guidance published by the Cybersecurity and Infrastructure Security

Agency (CISA).

PROVENANCE

The Contractor shall maintain accurate and up to date configuration management on data and controls for third-party products and services regarding chronology of the origin, development, ownership, location, and changes to a system or system component and associated data in accordance with NIST SP 800-53, Rev. 5. It may also include the personnel and processes used to interact with or make modifications to the system, component, or associated data

The Contractor shall document changes to the baselines of components, component processes, information, systems, organizations, and organizational processes, to be reported to third-party products and services.

The Contractor shall notify the IRS within 7 business days whenever there is a change in subcontractors or suppliers at any point during design, development, fabrication, testing or deployment of software or hardware utilized in this procurement.

ADD TO ADDENDUM H OF CLAUSES SECTION

Office of the President Management and Budget (OMB) Policies for Security of Federal Automated

Information Resources

The contractor shall implement protections for personally identifiable information being accessed remotely or transported outside of the agency’s secured, physical perimeter, and/or stored offsite. In those instances where personally identifiable information is transported to a remote site of the contractor, the contractor shall implement

NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and

Organizations security controls and IRS specific security procedures to ensure that information is transported in encrypted form. The contractor shall comply with OMB Circular Policy M-17-12: Preparing for and Responding to a

Breach of Personally Identifiable Information.

TREASURY/ IRS POLICIES FOR INFORMATION TECHNOLOGY(IT) SECURITY

The contractor shall comply with FedRAMP Framework, Department of Treasury Directive TD P 85-01, Internal

Revenue Manual (IRM) 10.8.1, Information Technology (IT) Security Policy and Guidance and Internal Revenue Manual

(IRM) 10.8.24, Information Technology (IT) Security, Cloud Computing Security Policy. The contractor shall comply with IRS IRMs when developing or administering IRS information and information systems.

The contractor shall comply with the Taxpayer Browsing Protection Act of 1997 - Unauthorized Access (UNAX), the

Act amends the Internal Revenue Code 6103 of 1986 to prevent the unauthorized inspection of taxpayer returns or tax return information.

The contractor/contractor personnel are bound by the Records Management by Federal Agencies(44 U.S.C. Chapter

31) regarding the care and retention of federal records.

FEDERAL INFORMATION PROCESSING STANDARD (FIPS)-201-2

Homeland Security Presidential Directive-12 [HSPD-12], August 27, 2004, established the requirements for a common identification standard for identity credentials issued by Federal departments and agencies to Federal employees and contractors (including contractor employees) for gaining physical access to federally controlled facilities and logical access to federally controlled information systems. HSPD-12 directs the Department of Commerce to develop a FIPS publication to define such a common identity credential. In accordance with HSPD-12, this Standard defines the technical requirements for the identity credential that:

(a) is issued based on sound criteria for verifying an individual employee’s identity;

(b) is strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation;

(c) can be rapidly authenticated electronically; and

(d) is issued only by providers whose reliability has been established by an official accreditation process.

The standard for a Personal Identity Verification (PIV) system is based on secure and reliable forms of identity credentials issued by the Federal government to its contractors. These credentials are intended to authenticate individuals who require access to federally controlled facilities, information systems, and applications. A PIV Card must be personalized with identity information for the individual to whom the card is issued, to perform identity verification both by humans and automated systems. Humans can use the physical card for visual comparisons, whereas automated systems can use the electronically stored data on the card to conduct automated identity verification.

IRS will determine the level of security and authentication mechanisms appropriate for their applications and will employ only information technology products on the FIPS 201-approvedproducts list for PIV capability implementation within organization information systems.

CSPs must review SP 800-63-3, use its decision trees to obtain an overview of all digital identity requirements, and read the applicable 800-63 volumes to determine specific requirements that apply to their cloud offerings.

SECURITY AUTHORIZATION / CERTIFICATION AND ACCREDITATION PROCESS

CSP/Contractor systems that collect, maintain, contain or use agency information or an information system on behalf of the agency (a General Support System (GSS), with a FIPS 199 security categorization) must ensure annual reviews and continued security certification and accreditation. Some of the key elements of this IT risk and impact assessment process are project security deliverables such as the System Security Plan (SSP), Information System Contingency Plan

(ISCP),Interconnection Security Agreement (ISA), Security Risk Assessment (SRAs), Data Impact Assessments

(DIAs), Risk Analyses, Security Threat Analyses, Audit Plan, Source Code Review, Security Control Assessment

(SCA), and/or Event-Driven Security Control Assessment (ED-SCA).All systems that complete this process will, at a minimum, meet FedRAMP, Treasury and IRS requirements.

CLOUD SERVICE PROVIDER (CSP) ROLES AND RESPONSIBIILITES - INTERNAL REVENUE MANUAL

(IRM) 10.8.24, INFORMATION TECHNOLOGY (IT) SECURITY,

CLOUD COMPUTING SECURITY POLICY

Before a CSP launches into the FedRAMP process, and before getting a 3PAO consultant or assessor involved in the process, a

CSP drafts an accurate illustration of the system authorization boundary and all associated data flow diagrams.

a. The CSP system authorization boundary illustration shall include network and architecture diagram(s) and provide a written description of the Authorization Boundary. Ensure each diagram:

i. Includes a clearly defined authorization boundary.

ii. Clearly defines services wholly within the boundary.

iii. Depicts all major components or groups within the boundary.

iv. Identifies all interconnected systems.

v. Depicts all major software/virtual components (or groups of) within the boundary.

vi. Is validated against the inventory.

b. The CSP system boundary description shall clearly define the following:

i. All shared corporate services, with explicit rationale of any that are not within the boundary, such as a corporate Security Operations Center (SOC) or corporate security awareness training.

ii. All other external services with explicit rationale of any that are not within the boundary that includes all leveraged services.

iii. All systems related to but excluded from the boundary.

c. In addition to describing these, all of the services shall also be depicted either in the CSP system authorization boundary diagrams or in separate diagrams.

d. The CSP system data flow diagram(s) shall:

i. Clearly identify anywhere Federal data is to be processed, stored, or transmitted

ii. Clearly delineate how data comes into and out of the system boundary.

iii. Clearly identify data flows for privileged, non-privileged and customers’ access.

iv. Depict how all ports, protocols, and services of all inbound and outbound traffic are represented and managed.

e. The data flow diagrams shall be accompanied by a written description of the data flows.

f. If the CSP boundary is not adequately/accurately represented, the 3PAO shall identify boundary deficiencies that could lead to substantial delays in the CSP Readiness Assessment process.

g. If the CSP leverages another CSP that does not have a current FedRAMP JAB or Agency ATO, the CSP shall be fully responsible for the authorization of the entire Cloud Service model stack.

INFORMATION SYSTEMS AND INFORMATION SECURITY CONTROLS FOR CONTRACTING ACTIONS

SUBJECT TO IRS PUBLICATION 4812 REVISION 10-201

Note: Publication 4812 is a layperson's guide to NIST SP 800-53, Rev. 5 when access to IRS information or information systems under contracts for services on behalf of the IRS is outside of IRS controlled facilities or the direct control of the Service as opposed to Internal Revenue Manual 10.8.1 - Information Technology (IT) Security, Policy and Guidance, which applies when contractors are accessing IRS information and information systems at Government controlled facilities.

In performance of this contract, the contractor agrees to comply with the following requirements and assumes responsibility for compliance by its employees and subcontractors (and their employees):

(a) General. The contractor shall ensure IRS information and information systems (those of the IRS and/or the contractor, as appropriate) are always protected. In order to do so, the contractor shall develop, implement, and maintain effective controls and methodologies in its business processes, physical environments, and human capital or personnel practices that meet or otherwise adhere to the security controls, requirements, and objectives described in applicable security control guidelines, and their respective contracts.

(b) The contractor will be required to input data into a system, to be defined by the IRS, to describe the security controls being used to protect information.

(c) Publication (PUB) 4812 Applicability. This contracting action is subject to Publication 4812 – Contractor Security & Privacy Controls. PUB 4812 is available at:

https://www.irs.gov/pub/irs-pdf/p4812.pdf

IT SECURITY CONTROLS - (IRM) 10.8.24, INFORMATION TECHNOLOGY (IT) SECURITY,CLOUD

COMPUTING SECURITY POLICY

IT Security Controls

(1) The security requirements within this IRM and IRM 10.8.1 must be met to satisfy FISMA compliance. The following FedRAMP security requirements apply to all IRS cloud computing resources, as well as cloud computing resources used or operated by a contractor of the agency or other organization on behalf of the agency; and shall be implemented and complied with as part of FedRAMP.

a. See the Minimum FedRAMP Security Control Baseline Exhibit 10.8.24-5within this IRM for a list of security controls that are to be implemented as part of the minimum FedRAMP security control baseline.

b. For security controls that are a part of the FedRAMP baseline but not explicitly defined within this IRM, IRM 10.8.1 requirements shall be implemented.

(2) Business Units shall use an existing FedRAMP authorized CSO unless there is a compelling justification to use a non-FedRAMP authorized alternative CSO. (IRS-defined)

a. The justification must demonstrate there is no FedRAMP authorized CSO available that provides the same or similar capabilities as the non-FedRAMP authorized CSO being considered.

b. The justification to use a non-FedRAMP solution must be approved by the IRS Senior Agency Information Security Officer (SAISO)/Chief Information Security Officer (CISO) in writing.

https://www.irs.gov/irm/part10/irm_10-008-001.html https://www.irs.gov/irm/part10/irm_10-008-001.html https://www.irs.gov/pub/irs-pdf/p4812.pdf

(3) If a non-FedRAMP solution is approved, the provisions within this IRM still apply.

Note: This control does not nullify the need for an Analysis of Alternatives (AoA)and market research.

Note: If a CSP has been granted a FedRAMP P-ATO for one or more implementation of a CSO, it does not mean all the CSPs CSO offerings are covered under the FedRAMP P-ATO. P-ATOs on the

FedRAMP Marketplace are granted to CSOs, not to the CSPs.

(4) The enforcement of FedRAMP requirements shall be done through Service Level Agreements (SLA)/Contracts. (FedRAMP)

Note: Special contract language to properly address all potential CSP risk includes but it is not limited to security monitoring, auditing, data governance, data protection, data location, data and system availability, data and system confidentiality, data and system integrity, data and system access, data portability, data backup, data encryption, data breach notification, data restoration, contract exit conditions, contract termination conditions, data disposal, data retention, user/device/service authentication, authorization, audit logging and remediation of security concerns.

(5) Business Units shall use the Table in Exhibit 10.8.24-2 within this IRM for the recommended Cloud deployment requirements. (IRS-defined)

a. All CSO with sensitive but unclassified (SBU) data (including Personal Identifiable Information (PII) and Federal Tax Information (FTI)) shall comply with the Privacy requirements codified in PGLD Privacy IRMs 10.5.xand 11.3.x series.

Note: Per NIST SP 800-60 v1r1, the Chief Information Officer (CIO), Senior Agency Information

Security Officer (SAISO), Authorizing Officials may adjust the security impact level for each system deploying into Cloud Service Models.

(6) IRS shall utilize aggregated and individual security categorization information when assessing interagency and CSPs connections with different FIPS 199 Category Impact levels. (e.g., High Impact system connecting to Moderate Impact system etc.,)(NIST SP 800-60 v1r1).

Note: For example, if information processed on a high impact information system is flowing to another agency’s or CSP moderate impact information system should cause both agencies (US local, state, tribal, or territorial government) or CSPs to evaluate the security categorization information, the implemented or resulting security controls, and the risk associated with interconnecting systems. The results of this evaluation may substantiate the need for additional security controls in the form of an

SLA, information systems upgrades, additional mitigating security controls, or alternative means of sharing the required information.

Note: Each use case shall be assessed based on mission, business need and the datatype being exchanged.

CONTRACTOR (AND SUBCONTRACTOR) SITE AND INFORMATIONTECHNOLOGY (SOFTWARE,

HARDWARE AND DATA) LOCATION

The CSP/Contractor headquarters, infrastructure, servers (including back-up servers) and data must be physically located in the United States (or U.S. territories).

The infrastructure associated with services outsourced by the CSP/Contractor must located in the United States (or

U.S. territories).

The current version and all subsequent versions of the software implemented by the CSP/Contractor must be escrowed in the United States (or U.S. territories) at the CSP’s expense to protect the code in the event the CSP declares bankruptcy.

Data stored outside the United States cannot be protected under the Privacy Act of 1974 or safe harbor framework and may allow for certain local or foreign law enforcement authorities to search IRS data pursuant to a court order, subpoena, or informal request outside the control of the IRS.

The Clarifying Lawful Overseas Use of Data ("CLOUD") Act enacted into law on March 23, 2018, provides that U.S. law-enforcement orders issued under the Stored Communications Act (SCA) may reach certain data located in other countries.

Recognizing the limits of existing law enforcement tools and privacy laws to govern requests for electronic evidence in the age of cloud computing, the CLOUD Act establishes processes and procedures for law enforcement requests for data in other countries.

Although the Act expands the geographic scope of the SCA, it does not change who is subject to SCA orders or what type of data is subject to U.S. law-enforcement requests under the SCA.

The CLOUD Act lays out the circumstances under which a "provider of electronic communication service or remote computing service" must comply with a U.S. law-enforcement order to disclose data within its "possession, custody, or control," even when that data is "located … outside the United States."

ALTERNATE STORAGE

The CSP/Contractor shall establish an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information. The alternate storage site shall be geographically separated within the

United States (or U.S. territories) from the contractor site to enable recovery of operations. The alternate storage site is separated from the primary storage site so as not to be susceptible to the same hazards and identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. All backup data that contains SBU information shall be encrypted.

The alternate storage site shall provide information security safeguards equivalent to that of the primary site.

BACKUPS

Backups must be provided as part of the CSP service offering.

All backup data that contains SBU information shall be encrypted.

(1) The IRS or CSP/Contractor shall conduct backups for information contained in the information system at the following frequency:

• User-level: daily incremental; weekly full

• System-level: daily incremental; weekly full

• Information system configuration; daily incremental; weekly full

Note: The defined backup frequencies are above IRM 10.8.1 baseline and assigned by FedRAMP.

(2) The CSP/Contractor shall maintain:

• At least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative.

• At least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative.

• At least three backup copies of information system documentation including security information (at least one of which is available online) or provides an equivalent alternative.

Note: This requirement is defined by FedRAMP.

(3) The IRS or CSP/Contractor shall determine what elements of the cloud environment require the Information System Backup control.

1. The CSP/Contractor shall determine how Information System Backup is going to beverified and the appropriate periodicity of the check.

(3) Backup copies of the operating system (i.e., deployed operating system with agency defined configurations and controls) and other critical information system software, as well as copies of the information system inventory (including hardware, software, and firmware components) shall be stored in a separate facility or in a fire-rated container that is not collocated with the operational system.

Note: This requirement is assigned to Moderate and High impact systems by FedRAMP.

DATA LOSS PREVENTION (DLP) SOFTWARE

The CSP/Contractor shall implement data loss prevention (DLP) software to assure existing software will operate effectively in the cloud.

The CSP/Contractor shall be responsible for all patching and vulnerability management (PVM) of software and other systems’ components supporting services provided under this agreement so as to prevent proactively the exploitation of IT vulnerabilities that may exist within the CSP/Contractor operating environment. Such patching and vulnerability management shall meet the requirements and recommendations of NIST SP 800-40, as amended, with special emphasis on assuring that the vendor’s PVM systems and programs apply standardized configurations with automated continuous monitoring of the same to assess and mitigate risks associated with known and unknown IT vulnerabilities in the

CSP/Contractor operating environment.

Furthermore, the CSP/Contractor shall apply standardized and automated acceptable versioning control systems that use a centralized model to capture, store, and authorize all software development control functions on a shared device that is accessible to all developers authorized to revise software supporting the services provided under this agreement.

Such versioning control systems shall be configured and maintained to make sure all software products deployed in the

CSP/Contractor operating environment and serving the IRS are compatible with existing systems and architecture of the

IRS.

CONTINUOUS MONITORING BASELINE CONTRACT DELIVERABLES

Cloud Continuous Monitoring baseline contract deliverables are needed as applicable, such as, but not limited to:

• Weekly Security Status Report

• Monthly Security Status Report

• Continuous Monitoring Plan

• Security Configuration and Change Management Plan

• Security Patch Management Plan

• Security Incident Handling, Monitoring and Response Plan

• Information System Contingency Plan (ISCP)

• Security Concept of Operations (Security CONOPS)

• Access Management Plan (AMP)

• System Security Plan (SSP)

• Authorization Boundary Memorandum

• Interconnection Security Agreements (ISA)

• Security Control Assessment (SCA) Test Plan

• Security Assessment Report (SAR) Mitigation Plan

• Privacy/Civil Liberties Impact Assessment (PCLIA)

• State of Security (SoS) Package

• FISMA Compliance Reports including, but not limited to, inventory, inventory change log,security configuration compliance reports, personal security, and POA&Ms.

• Information Security Status Package

• Alternate Site Processing Environment (ASPE) Plan

• Executive Summary of Analytical Results and Recommendations

• Key Management Practices Statement

• Contractor Security Assessments (CSA) Test Plan

• Configuration Compliance Summary Report

• Security Incident Report

• Mitigation Report

• FSTAR Mitigation Plan

• Incident Response Test Report

USE OF OUTSOURCED / CONTRACTOR FACILITIES TO PROCESS IRS SBU DATA

The infrastructure associated with services outsourced by the CSP/contractor must located in the United States (or

U.S. territories).

If IRS products/applications/data/services/solutions are hosted and/or managed by a CSP (outside the IRS network boundaries/facilities (e.g., outsourced)) then all such products/applications/data/services/solutions shall go through (and maintain) the Federal Risk and Authorization Management Program (FedRAMP) certification, and meet all of the IRS unique business/legal requirements (including applicable PUB 4812 requirements, etc.).

Note: FedRAMP is mandatory for all IRS cloud deployments and cloud service models at the Federal Information

Processing Standards (FIPS) 199 Low, Moderate and High impact levels. FedRAMP does not apply for internal housed IRS systems that are operated for IRS use only. This service model would be considered an On-Site-

Private Cloud.

Special contract language shall be included in all types of Cloud Service Provider (CSP) contracts/non-disclosure agreements/Service Level agreements to address all potential CSP risks(e.g., Data Governance, Data Protection, Data Location, Data Availability, Data Confidentiality, Data Integrity, Data Access, Data Backup, Data Encryption, Data Breach Notification, Contract

Exit Conditions, Contract Termination Conditions, Data Disposal, Data Retention, User/Device/Service AAA services

(e.g., Authentication, Authorization, Audit Logging, Background Checks etc.). The Vendor shall pay special attention to the logical and physical separation of IRS data, applications, and communications to maintain security. Vendors are encouraged to manage any cloud environments containing IRS data with only other Federal or State and local

Government customers operating at the same security level. The IRS shall control and maintain the centralized/authoritative control (in-house) of ALL the IRS authorized Users/Devices/Services Authentication, Authorization, and Auditing (AAA) functions, even if a particular IRS application/data/service/solution is hosted in a third-party cloud environment.

Outsourced operations shall report monthly for FISMA and Treasury submission. This includes all systems in the following environments: production, disaster recovery, training, development, and testing.

ENCRYPTION

The IRS or CSP shall ensure that the information system implements FIPS-validated or National Security

Agency (NSA)-approved cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

IRS sensitive data (e.g., Sensitive But Unclassified (SBU), Personally Identifiable Information http://www.gsa.gov/portal/category/102371?utm_source=OCM&amp%3Bamp%3Butm_medium=print-radio&amp%3Bamp%3Butm_term=HP_13_SpecialTopics_fedramp&amp%3Bamp%3Butm_campaign=shortcuts http://mits.web.irs.gov/cybersecurity/Divisions/SRM/Compliance/InfraReviews.htm

(PII) that is processed, stored, or transmitted by an information system outside of IRS facilities or IRS IT information system shall be protected with FIPS 140-2 or later validated cryptographic modules with approved modes of operation.

The vendor shall provide a system that implements (encryption standard) that provides for origin authentication, data integrity, and signer non- repudiation. Consider AU-11 audit Records retention

A list of NIST validated modules is available at the following link:

http://csrc.nist.gov/groups/STM/cmvp/validation.html.

The CSP/Contractor shall ensure all SBU information is protected at rest, in transit, and in exchanges(i.e., internal and external communications). Limit access to SBU information to authorized personnel (those favorably adjudicated and trained) with a need to know and ensure internal and external exchanges are conducted only through secure or encrypted channels. The CSP/Contractor shall employ encryption concepts and approved standards to ensure the confidentiality, integrity, and availability of the SBU information, consistent with the security controls under Publication 4812 and any security requirements specified elsewhere in the contract.

Contractual liability to the government only exists with the prime contractor.

The CSP/contractor shall retain operational configuration and control of data repository systems used to process and store government data to include any or remote work. The CSP/contractor shall not subcontract the operational configuration and control of any government data.

IRS retains exclusive ownership over all its data; the CSP/Contractor acquires no rights or licenses through the agreement, including intellectual property rights or licenses, to use the IRS data for its own purposes; and that the

CSP/Contractor does not acquire and may not claim any interest in the data due to security. If CSP/Contractor moves data, the IRS will not lose rights and access to conduct audits.

Intellectual property, including original works created using the cloud infrastructure, may be stored. IRS must ensure that the cloud provider contract respects the IRS’ right to any intellectual property or original works as far as possible without compromising the quality of service offered (e.g., backups may be a necessary part of offering a good service level).

CONTRACTOR SYSTEM REVIEW / SITE VISIT

In conjunction with the use of outsourced / Contractor facilities, the contractor shall be subject to at the option / discretion of the IRS, to periodically test and inspection (annually) and evaluate the effectiveness of information security controls and techniques. The assessment of information security controls may be performed by an agency independent auditor, security team or Inspector General, and shall include testing of management, operational, and technical controls, as indicated by the security plan, of every information system that maintain, collect, operate or use federal information on behalf of the agency. The agency and contractor shall document and maintain a remedial action plan, also known as a

Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The contractor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

CONTRACTOR SYSTEM OVERSIGHT/COMPLIANCE

(a) The Contractor, service providers, and third-party vendors must complete the IRS Security – Assessments (IT Security Product Questionnaire) and submit the assessments to the Contracting Officer and Cybersecurity for review and evaluation. This is a supplemental requirement and does not replace contract requirements under FISMA. The federal government has the authority to conduct site reviews for compliance validation. Full cooperation by Contractor and third-party providers is required for audits and forensics.

(b) The Contractor must support IRS in its efforts to assess and monitor the Contractor systems and infrastructure.

The Contractor must provide logical and physical access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases upon request. The

Contractor will be expected to perform automated scans and continuous monitoring activities which may include, but will not be limited to, authenticated and unauthenticated scans of networks, operating systems, applications, and databases and provide the results of the scans to the IRS Cybersecurity, or designate, or allow IRS (or its designate) to run the scans http://csrc.nist.gov/groups/STM/cmvp/validation.html directly.

(c) All Contractor systems must participate in Information Security Continuous Monitoring(ISCM) and Reporting as defined in the IRS IT Policy.

(d) All Contractor systems must perform vulnerability scanning as defined by IRS IT Security Policy and provide scanning reports to the IRS Cybersecurity, or designate, on a monthly basis.

(e) All Contractor systems must participate in the implementation of automated security controls testing mechanisms and provide automated test results in Security Compliant Automation Protocol

(SCAP) compliant data to the IRS Cybersecurity, or designate, on a monthly basis.

CONTRACTOR SECURITY TRAINING

IR1052.224-9001 Mandatory IRS Security Training for Information Systems, Information Protection and

Facilities Physical Access (JUN 2021)

The Federal Information Security Modernization Act of 2014 (FISMA) requires each federal agency to provide periodic information security awareness training to all contractors/subcontractors involved in the management, use, or operation of

Federal information and information systems. In addition, contractor/subcontractor personnel are subject to the Taxpayer

Browsing Protection Act of 1997, which prohibits willful unauthorized inspection of returns and return information and details that any violation of the Act could result in civil and criminal penalties. Contractor/subcontractor personnel are subject to the Privacy Act of 1974 (5 U.S.C. 552a; Pub. L. No. 93-579), December 1974.

Contractor/subcontractor personnel are bound by the Records Management by 93 Federal Agencies(44 U.S.C. Chapter

31) regarding the care and retention of federal records.

1. The contractor must ensure all new contractor/subcontractor personnel complete all assigned briefings which are based on the responses provided on the Risk Assessment Checklist Form 14606.These responses pertaining to access to any IRS system, including basic LAN, email and internet; access to any Sensitive but Unclassified (SBU) data; and access to any IRS facility. Since new contractor/subcontractor personnel will not have access to the IRS training system, the COR shall provide softcopy versions of each briefing.

i. Exception: Contractor personnel (including subcontractors) performing under IRS contracts with Nonprofit

Agencies Employing People Who Are Blind or Severely Disabled (as described in FAR Subpart 8.7) are exempted from the aforementioned briefing requirements, unless the contractor requests access to the training, or there is a compelling justification for requiring the training that is approved by the Contracting Officer (CO). An example of this would be in an instance where visually impaired personnel is assigned to perform systems development and has potential staff-like access to IRS information.

ii. Contractor/subcontractor personnel working with IRS information at contractor-controlled facilities with no access to the IRS network will be subject to all mandatory briefing excepting the Facilities Management Physical Security briefing as outlined in Publication 4812.

iii. Service Personnel: Inadvertent Sensitive Information Access Training

Contractor personnel performing: (i) janitorial and cleaning services (daylight operations), (ii)building maintenance, or (iii) other maintenance and repair and need staff-like access to IRS facilities are required to complete Inadvertent

Access to Sensitive Information (SBU) Access training.

iv. Service Personnel Security Awareness Training: Contractor personnel providing services in the following categories are required to complete FMSS Physical Security Training:

o Medical;

o Cafeteria;

o Landscaping;

o Janitorial and cleaning (daylight operations);

o Building maintenance; or o Other maintenance and repair

2. In combination these mandatory briefings are known as IRS Security Awareness Training (SAT). The topics covered are Cybersecurity Awareness, Privacy Information Protection and Disclosure, Unauthorized Access to Taxpayer Data, Records Management, Inadvertent Sensitive Information Access, Insider Threat and/or Facilities Physical Security. The completion of the assigned mandatory briefings constitutes the completion of the Security Orientation.

3. The SAT must be completed by contractor/subcontractor personnel within 5 business days of successful resolution of the suitability and eligibility for staff-like access as outlined in IR1052.204-9000 Submission of Security Forms and Related Materials and before being granted access to SBU data. The date listed on the memo provided by IRS Personnel Security shall be used as the commencement date.

4. Training completion process:

The contractor must submit confirmation of completed SAT mandatory briefings for each contractor/subcontractor personnel by either:

i. Using Form 14616 signed and dated by the individual and authorized contractor management entity and returned to the COR.