Statement of Work.doc

Statement of Work Credit Bureau Reports

1.0

INTRODUCTION

1.1 The Defense Personnel Security Research Center (PERSEREC) requires Equifax consumer credit report data in the form of electronic credit report on applicants and holders of national security clearances and positions of trust. Report data must be transmitted on a system to system basis utilizing the Automated Continuous Evaluation System (ACES).

2.0

BACKGROUND

ACES is an automated system to system data collection, analysis, and reporting system designed to identify issues of personnel security and counterintelligence concerns on applicants for and holders of national security clearances and positions of trust. The ACES system is developed and managed by the PERSEREC. The system schedules eligible personnel for a series of commercial and government database checks including but not limited to: credit reports, FBI criminal history, state criminal history, vehicle registrations, and foreign travel information.

2.2 PERSEREC uses consumer credit reports to detect financial issues among personnel holding national security clearances and national security clearance applicants. Requests for, and receipt of these credit must be capable of being transmitted on an automated system to system basis through the ACES using .

. ACES system. Delivery of these reports must enable processing of these records using the ACES business rules. Only Equifax is capable of providing Equifax credit reports using the required data sets to the ACES system. No resellers have been identified that can meet this requirement without negatively impacting the PERSEREC mission.

2.3 PERSEREC researchers determined that ACES required credit reports from the three major credit bureaus to ensure that complete credit report histories were made part of the ACES system.

3.0 SCOPE The contractor shall provide Equifax consumer credit reports as requested on a automated system to system basis

4.0 REQUIREMENTS The Contractor shall:

4.1 Provide electronic consumer credit data report in the three major credit bureaus format for the applicants and holders of national security clearances and positions of trust.

4.2 Provide consumer credit data via contractor’s interfaces and will include the account numbers in the trade lines.

4.3 Mask the inquiry from third parties who obtain the consumer’s credit report (except for the subject of the credit report per Fair Credit Report Act Guidelines). Ensure that the inquiry does not count against the subject’s credit score and ensure that the inquiry is attributed to the Department of the Defense

4.4 Provide the flexibility to choose one or all bureaus when Zip code filters are applied.

4.5 Establish and utilize appropriate communication security, physical security, personnel security, and information security policies and procedures adequate to minimize the possibility of any unauthorized use, release, modification, sales or retention of any data reflecting the personal identifiers of the individuals PERSEREC submits.

5.0 DELIVERABLES

6.0

SECURITY ISSUES

6.1 The contractor shall employ the following information safeguards to protect this information:

6.1.1 Ensure DoD information is not processed in public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

6.1.2 Protect information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

6.1.3 Sanitize media (e.g., overwrite) before external release or disposal.

6.1.4 Encrypt all information that has been identified as Controlled Unclassified Information (CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media suck as thumb drives and compact disks, using the best available encryption technology.

6.1.5 Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

6.1.6 Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryptions, and Transport Layer Security (TLS). Encrypt organizational wireless connections and use encrypted wireless connection where available when traveling. If encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using at least application-provided password protection level encryption.

6.1.7 Transmit voice and fax transmissions of DoD information only when there is a reasonable assurance that access is limited to authorized recipients.

6.1.8 Ensure DoD information is not posted to Web site pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to Web site pages that control access by user identification or password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies. Access control may be provided by the intranet (vice the Web site itself or the application it hosts).

6.1.9 Provide protection against computer network intrusions and data ex-filtration, minimally including the following:

(1) Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

(2) Monitoring and control of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

(3) Prompt application of security-relevant software patches, service packs, and hot fixes.

6.1.10 Comply with other current Federal and DoD information protection and reporting requirements for personally identifiable information including the Federal Information Security Management Act (FISMA), 44 U.S.C. 3541 et seq: related Office and Management and Budget (OMB) circulars and memoranda, including revised Circular A-130, and Memorandum M-06-16; National Institute of Science and Technology Directives, and Federal Acquisition Regulations (FAR). These laws, regulations and directives provide requirements for safeguarding information systems and Personally Identifiable Information (PII) used in Federal agency business processes, as well as related reporting requirements.

6.1.11 Loss or unauthorized disclosure or personally identifiable information must be reported within one hour to:

(1) The United States Computer Emergency Readiness Team (US CERT) in accordance with the requirements of OMG M-06-19 and guidance at www.us-cert.gov, as published.

(2) The PERSEREC Information Assurance Manager (IAM) at (831) 583-2815. If the vendor has been unable to speak with the IAM within one hour, they will contact the PERSEREC Security Manager at (831) 583-2826.

6.1.12 Notify PERSEREC whenever any provision of these Information Safeguards has been violated