Attachment_4_-_Security_Requirements_.docx

Attachment 4 – Security Requirements Special Protection for Sensitive information – Experts and Consultants (April 2011)

(1) Definitions. For purposes of these requirements, the following definitions apply:

(a) “Information” includes any records, data, or other information that is: provided or made available to the Contractor by the FTC; provided or made available on the FTC’s behalf to the Contractor by a non-FTC party; created, compiled, generated, collected, or maintained for the FTC to the extent it is first produced in the performance of this contract; or delivered to the FTC under this contract, other than limited rights data or restricted computer software, see Federal Acquisition Regulation (FAR) § 27.402-2.

(b) “Personally Identifiable Information” (PII). The term PII, as defined by the Office of Management and Budget in Memorandum 07-16 issued May 22, 2007, refers to information which can be used to distinguish or trace an individual’s identity, such as their name, Social Security Number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

(c) “Sensitive Personally Identifiable Information” (Sensitive PII) refers to the following information, whether in paper, in electronic form, or communicated orally:

(i) An individual’s Social Security Number (SSN), Sensitive Health Information, or a Biometric Identifier; or

(ii) An individual’s name or address or phone number in combination with one or more of the following: date of birth; driver’s license number or other state identification number, or foreign country equivalent; military identification number; passport number; financial account number; or credit or debit card number.

(d) “Sensitive Health Information” (SHI) includes medical records and other individually identifiable health information, whether on paper, in electronic form, or communicated orally. SHI relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

(e) “Biometric Identifier” Biometric Identifier means a measurable anatomical, physiological, or behavioral characteristic collected or used for purposes of automated identity verification or other types of authentication. Typical examples of Biometric Identifiers are: fingerprints; palm prints; iris and retina scans; facial characteristics; and signature and voice dynamics. All Biometric Identifiers are treated as Sensitive Information, except for photographs (e.g., driver’s license photographs), voice recordings (e.g., undercover tapings), and signatures, standing alone. A database of photographs and corresponding analyses by facial recognition software, however, are Sensitive Information. Likewise, voice recordings and signatures that are captured in a database so that they can be analyzed and used to verify a person’s identity or check against other entries within the database (e.g., to authenticate that a particular person has access rights to a building or computer system) are Sensitive Information.

(f) “Other Sensitive Information” means information filed with the FTC or the Department of Justice pursuant to the premerger notification provisions of the Hart-Scott-Rodino Act, 18 U.S.C. 7A(h), information subject to any in camera or protective order issued in any administrative or judicial proceeding, and any other confidential or sensitive information provided or made available to the Contractor by the FTC directly, or from a non-FTC party on behalf of the FTC, as identified and designated in writing to the Contractor by the Contracting Officer’s Representative (COR).

(g) “Sensitive Information” shall refer collectively to the categories of information defined in paragraphs (1)(c), (d), (e), and (f) of this provision.

(2) Protecting Sensitive Information: General Provisions. Contractor is required to follow the FTC policies and procedures incorporated by reference in this provision or attached to this contract for the protection of Sensitive Information, and any superseding or supplemental policies and procedures that may be subsequently incorporated into the contract or attached hereto. These requirements shall govern the Contractor’s handling of such information when performing work for the FTC on-site and off-site (i.e., storage, transfer and shipping, traveling, sharing, disposal, and breach reporting). Contractor shall further ensure that its own data shall not be commingled with, and shall remain logically and physically separate from, Sensitive Information provided by or specifically compiled, created, stored, or processed for the FTC, except as needed on a temporary basis to carry out the tasks required by the contract and such commingled data shall not be stored or saved. Further, such Sensitive Information shall not be used for any purpose other than to carry out the Contractor’s obligations under the contract.

(3) Ensuring the Secure Use of Other Non-FTC Electronic IT Networks and Facilities.

(a) Limitation on use. Contractor warrants and agrees that it shall not use any non-FTC network or facility (e.g., commercial, corporate, university) to store or process Sensitive Information on behalf of the FTC, unless such network has reasonable administrative, technical, physical and procedural controls to ensure the security (i.e., confidentiality, integrity and availability) of Sensitive Information stored or processed for the FTC using such network or facility. The Contractor shall provide to the FTC for its review and acceptance a system security plan (SSP) or similar narrative statement summarizing and documenting these controls following execution of this contract. Such plan or statement shall include and address the controls on any non-FTC equipment used by subcontractors in the performance of this contract. The Contractor shall submit and any updated plan and statement to reflect any material changes in the applicable controls that could reasonably affect the privacy or security of the FTC’s data.

(b) Supporting documentation; inspection. The FTC reserves the right to require at any time that the contractor, without undue delay and at its own cost, produce documentation, including, for example, the Contractor’s SSP, an independent audit or review, or other records or information sufficient to demonstrate to the FTC’s satisfaction the adequacy of the safeguards applicable to the network or facility. The COR, at the direction of the Contracting Officer (CO) or as requested by the FTC’s CISO or Chief Privacy Officer (CPO), shall exercise this right on behalf of the FTC by written notice to the Contractor, describing the nature and scope of documentation to be produced and setting forth the time period within which such documentation must be produced. The Contractor may also be required to make the relevant network or facilities reasonably available for physical inspection or audit by the FTC or other authorized Government or non-Government representatives. The CO may extend the time-period for compliance as the COR deems appropriate.

(c) Remedies. In the event the Contractor fails to produce the documentation and/or reasonably permit the inspection, if any, required by the FTC under paragraph (b) above within the specified time period, or if the FTC at any time is notified or otherwise believes that the applicable safeguards are no longer operational or sufficient to protect Sensitive Information, the FTC, by written notice to the Contractor, may take any and all steps that it deems reasonable and necessary to protect such Sensitive Information, including, but not limited to:

(i) requiring that the Contractor no longer use the network or facility to perform work required by the contract;

(ii) requiring that the Contractor, at no additional cost to the FTC, ensure and certify that certain additional security controls approved or specified by the FTC have been implemented before the Contractor may continue to use such network or facilities;

(iii) requiring that the Contractor, at no additional cost to the FTC, use alternate networks or facilities approved by the FTC;

(iv) requiring that the Contractor use networks, facilities, or equipment furnished by the FTC; and/or

(v) suspending the Contractor’s performance or terminating the contract.

(4) Websites. Unless expressly authorized by this contract, the Contractor shall not operate any Web site or page (e.g., to collect, process, or disseminate information) on behalf of the FTC without prior written approval of the COR, in order to ensure that such Web site complies with all requirements under applicable law, regulation, and policy (e.g., OMB Memoranda 10-22 and 10-23). This includes any Web site or function, whether operated by the Contractor or a third party, to provide the FTC with access to transcripts or other deliverables under this contract.

(5) Redaction. In the event the Contractor is required to redact documents electronically for delivery to or on behalf of the FTC, the Contractor shall use electronic redaction software or other equipment, technology, and methods approved by the FTC to ensure that such redaction is done securely, completely, and otherwise properly.

(6) Check-in Check-Out Moves (CICOM). If the Contractor is assigned any Government-furnished property (e.g., laptops, thumb drives, BlackBerrys, cell phones, identification badges or other official credentials), office space, or network system access (e.g., FTC email accounts, access rights to FTC or commercial subscription databases), the Contractor agrees to participate in the FTC’s CICOM process to ensure that all such property (e.g., records, equipment) is returned and that all logical and physical access rights are properly discontinued or revoked.

(7) Photocopying, Facsimile Transmissions. The FTC has contractual arrangements with approved off-site photocopying and facsimile (fax) facilities. In the event the Contractor is required to photocopy or fax Sensitive Information, the Contractor shall use photocopying or fax facilities designated by the COR, or notify and seek the COR’s express approval for the use of alternative facilities that provide comparable levels of privacy and data security protection, including but not limited to secure deletion of FTC images and content from the storage components of photocopying, facsimile, and similar devices.

(8) Non-FTC devices, media or equipment may not be used to store, ship or transfer Sensitive Information, except where expressly authorized by the terms of this contract or by the COR, with approval of the CISO. Approval shall be given only where adequate controls (administrative, technical, and/or physical) are in place to guard against loss, theft, or other compromise. Such controls shall include encryption of Sensitive Information during storage, shipping or transfer using Federal standards (i.e., FIPS 140-2) or reasonably comparable standards. Non-FTC equipment (e.g., laptops, desktops) shall be password protected to prevent unauthorized access, use a supported operating system with the latest security patches, and utilize up-to-date anti-virus software.

DATA BREACHES

a) General duty. In performing the work required by this contract, the Contractor shall prevent and help remedy breaches, if any, of FTC materials and information, as defined by the Contractor’s nondisclosure agreement with the FTC, and to provide the FTC with all information and cooperation necessary to enable the FTC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs.

b) Definition. The term “breach” is used to include the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where any unauthorized person has access or potential access to such information, whether physical or electronic, for any unauthorized purpose.

c) Reporting. Contractor must immediately report to the FTC all breaches of FTC materials and information, as defined by the Contractor’s nondisclosure agreement with the FTC, including, but not limited to, any breaches of non-public information or Sensitive Personally Identifiable Information (Sensitive PII), or Other Sensitive Information, encrypted, unencrypted, paper or electronic as those terms are defined by the contract or modifications thereto.

d) Liability, remedies. In the event of a breach, the Contractor may be held liable in whole or in part for such breach, to the extent that the Contractor, by virtue of its own acts or omissions, or those of its agents, bears responsibility for the breach, as determined by the FTC. Such acts or omissions include, but are not limited to: failure to comply with data privacy or security requirements expressly set forth in the contract; failure to take other reasonable and appropriate precautions to prevent such breach; or failure to report a breach immediately, such that the delay results in a harm that could have been avoided or mitigated had the breach been reported immediately. Remedies may include, but shall not be limited to: costs of forensic analysis or other investigation; breach notification to affected individuals or entities; credit monitoring services for such individuals or entities; training; or other costs associated with mitigating or remedying the breach, or preventing further breaches.

PRIVACY AND SAFEGUARDS

The Contractor shall be responsible for the following privacy and security safeguards:

a) The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards used by the Contractor under the resulting contract or otherwise provided by or for the government.

b) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public government data collected and stored by the Contractor, the Contractor shall afford the government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

c) If new or unanticipated threats or hazards are discovered by either the government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

d) Work on this project may require or allow contractor personnel access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

e) All data (FTC employee and contractor information, e-mail, contact information, calendar contents, etc.) is and shall remain the property of the Government. The Contractor shall ensure that the Government retains access and download capability of all data for research, investigation, transfer, or migration to other systems.

Page | 1