POTS 20-005163 DRD RADIS Injector-to-CT Interface Controllers Security Cert.pdf

Appendix A. Information Security Certification Checklist (Internal Use Only)

This security and privacy checklist includes Part A and Part B. Part A should be completed and signed by the OpDiv Chief Information Security Officer (CISO) or designee. Part B should be completed by the OpDiv Senior Official for Privacy (SOP) or designee. The purpose of this form is to determine if the procurement 1) requires information security, 2) involves personally identifiable information (PII) or 3) is subject to the Privacy Act. This Checklist is for internal use only and will not be included in the package of documents submitted to Contractor. The information obtained with the completion of this checklist will be used to complete Section 2.A.3.

The title of document may be changed to meet OpDiv-specific needs. In addition, the OpDiv may include additional information that is pertinent to the acquisition.)

Unique Procurement ID:_________________________________________________________________

Pre-Solicitation Review Date:

Project Title:

Contracting Officer/Contract Specialist:

(Name and Contact Information)

Information Technology (IT) Security Representative:

(Name and Contact Information)

Senior Official for Privacy or Representative:

(Name and Contact Information)

System/Data Owner or Program Manager:

(Name and Contact Information)

Information Security Categorization – Part A

PRE-SOLICITATION

Information security is not applicable. Proceed to the signature page and include this form with the RFP.

Information security is applicable and the following information is required for RFP preparation:

INFORMATION SECURITY CATEGORIZATION

(NOTE: Categorize the system and/or information and select the appropriate information type(s) below. Then, list the specific element(s) within those information types that are relevant to the acquisition.)

Information Types: Use the National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, (http://csrc.nist.gov/publications/) to determine the applicable information type(s). Enter information types in Table 1 below (add/remove rows as needed).

Mission/Program Based Information: For all selected information types from the NIST 800-60, rate the risk of all information types. The NIST-defined risk ratings may be changed to reflect the actual risk to the agency/program mission. If changing the NIST risk ratings, an explanation for changing the ratings must be included.

Information/Information System Categorization: Use the Federal Information Processing Standard (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems, (http://csrc.nist.gov/publications/) to categorize the information and/or information system and determine the overall risk. The overall risk is based on the highest water mark (e.g., if Confidentiality is Moderate, Integrity is Low and Availability is Low, the overall rating is Moderate.) Enter the overall risk rating in Table 2 below.

Security Categorization Level:

Information Type (Number and Title)

Confidentiality (Low, Moderate, High)

Integrity (Low, Moderate, High)

Availability (Low, Moderate, High)

Table 1: Information Types and Risk Ratings

Information/System Categorization:

Project/System Name Confidentiality

(Low, Moderate, High) Integrity (Low, Moderate, High)

Availability (Low, Moderate, High)

Overall Risk:

(Low, Moderate, High)

Table 2: Information/System Categorization and Overall Risk

E-AUTHENTICATION RISK ASSESSMENT

Conduct an E-Authentication Threshold Analysis (E-Auth TA) to determine if a full E-Authentication Risk Assessment (E-auth RA) is necessary by following the OMB 04-04, E-Authentication Guidance for Federal Agencies (https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-04.pdf) and NIST SP 800-63, Electronic Authentication Guideline. If a full E-auth RA is required, determine the level of assurance. The potential levels of assurance are:

• Level 1: Little or no confidence in the asserted identity’s validity;

• Level 2: Some confidence in the asserted identity’s validity;

• Level 3: High confidence in the asserted identity’s validity; or

• Level 4: Very high confidence in the asserted identity’s validity.

Based on the required level of assurance determined by the E-auth RA, select the appropriate authentication level of assurance and authentication method required to access the information system, including remote authentication.

http://csrc.nist.gov/publications/ http://csrc.nist.gov/publications/ https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-04.pdf

N/A Level 1 Level 2 Level 3 Level 4

N/A Single-Factor Two-Factor Multi-Factor

POSITION SENSITIVITY DESIGNATIONS

ISSO, CISO, or representative, in coordination with the requiring activity representative and Personnel Security Offices, determine the applicable position designations using OPM’s Position Sensitivity Designation Automated Tool, which is located at: https://www.opm.gov/investigations/. The following are position sensitivity levels that may apply to this solicitation/contract:

L evel of Assurance:

Authentication Method:

• Level:

• Sensitivity:

https://www.opm.gov/investigations/

Information Privacy Certification – Part B

PRE-SOLICITATION

Upon notification from the requiring activity, the HHS/OpDiv Senior Official for Privacy in coordination with the OpDiv Privacy Act Contact or the Departmental Privacy Act Officer shall complete this form to categorize the information collected/handled by this solicitation/contract. The purpose of this form is to categorize the information and determine the privacy requirements and language to be included in this solicitation.

1 The E-Government Act of 2002 Section 208 (E-Government Act) and Office of Management and Budget (OMB) Memorandum M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government of 2002, form the core of the Privacy Impact Assessment (PIA) requirement. Together, they state that a PIA is an assessment of how information is handled within certain electronic systems. Each PIA should consider: 1) Whether the system complies with legal, regulatory, and policy requirements related to privacy; 2) The risks and effects of how that system handles personally identifiable information (PII); and 3) How the system could be changed to mitigate potential privacy risks.

The Department of Health and Human Service (HHS) has chosen to evaluate the privacy implications of all electronic systems regardless of whether the E-Government Act or OMB M-03-22 requires a PIA.

No privacy requirements apply to this solicitation. Proceed to the signature page.

Privacy requirements1 apply to this solicitation. Complete the checklist and sign below.

The following tailored information is required for RFP preparation.

PERSONALLY IDENTIFIABLE INFORMATION (PII)

Select the PII Confidentiality Impact Level. For additional information, see NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (http://csrc.nist.gov/publications/PubsSPs.html).

PII2 Overall Level: No PII Yes PII N/A

If yes for PII, insert language from the following sections/sub-sections

• Section 2: All

• Section 3: Applicable language as determined by the OpDiv Senior Official for Privacy

Contractors will require access/inadvertent access to sensitive and/or personally identifiable information in the course of their assigned task(s). (See attached Contractor Non-Disclosure Agreement form.)

N/A

PRIVACY ACT

If Privacy Act requirements apply, complete the following:

TAILORED PRIVACY ACT INFORMATION: Provide the following information if the Privacy Act applies to this solicitation (this is needed to tailor the SOW as required by the HHSAR “Privacy Act” clause, 352.224-70):

• Applicable SORN number(s), or statement that a SORN will be developed:

• Description of design, development, or operation work:

• Records disposition instructions:

PROSPECTIVE OFFEROR NON-DISCLOSURE AGREEMENT

Offerors WILL NOT require access to sensitive information in order to prepare an offer.

Offerors WILL require access to sensitive information in order to prepare an offer. A Non- Disclosure Agreement (NDA) is necessary for a prospective offeror who will require access to government information in order to prepare and offer (i.e., a prospective offer must access an HHS computer room, floor plan).

N/A

Appendix B contains the NDA template

2 PII means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. OMB Circular A-130, Managing Information as a Strategic Resource (July 28, 2016).

Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

CERTIFICATION: Based on the above, and contingent upon inclusion of all applicable RFP language prescribed in the RFP, I certify that the solicitation specifies appropriate security/privacy requirements necessary to protect the Federal Government’s interests and is in compliance with all Federal and HHS security and privacy requirements.

Chief Information Security Officer (CISO) or Representative Signature: ____________________________

Printed Name: Date:

OpDiv Senior Privacy Official (SOP) or Representative Signature:

Printed Name: Date:

ACKNOWLEDGMENT: Based on the above, and contingent upon inclusion of all applicable security and privacy language prescribed in the RFP, I acknowledge the Security/Privacy Official Certification.

Program Manager Signature:

Printed Name: Date: