Applicable_Information_Security_Clauses_CSS_Addendum.pdf

HHS-NIH-NIDA-SSSA-CSS-17-075

ADDENDUM ONE: APPLICABLE INFORMATION SECURITY CLAUSES

1. SECURITY CATEGORIZATION OF FEDERAL INFORMATION AND

INFORMATION SYSTEMS (FIPS 199 Assessment)

a. Information Type:

[ ] Administrative, Management and Support Information:

[X] Mission Based Information:

Research and Development Information Scientific and Technological Research and Innovation

b. Security Categories and Levels:

Confidentiality Level: [X] Low [ ] Moderate [ ] High Integrity Level: [ ] Low [X] Moderate [ ] High Availability Level: [X] Low [ ] Moderate [ ] High

Overall Level: [ ] Low [X] Moderate [ ] High

The contractor shall submit a FIPS 199 Assessment within 30 days after contract award. Any differences between the contractor's assessment and the information contained herein, will be resolved, and if required, the contract will be modified to incorporate the final FIPS 199 Assessment.

2. POSITION SENSITIVITY LEVELS

This contract will entail the following position sensitivity levels:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

3. REPORTING OF NEW AND DEPARTING EMPLOYEES

The Contractor shall notify the Contracting Officer's Representative (COR) and Contracting Officer within five working days of staffing changes for positions that require suitability determinations as follows:

New Employees who have or will have access to HHS Information systems or data:

Provide the name, position title, e-mail address, and phone number of the new employee.

Provide the name, position title and suitability level held by the former incumbent. If the employee is filling a new position, provide a description of the position and the Government will determine the appropriate security level.

Departing Employees: 1) Provide the name, position title, and security clearance level held by or pending for the individual; and 2) Perform and document the actions identified in an "Employee Separation Checklist" when a Contractor/Subcontractor employee terminates work under this contract. All documentation shall be made available to the COR and/or Contracting Officer upon request.

4. CONTRACT EMPLOYEE NON-DISCLOSURE AGREEMENT(S)

The contractor shall complete and submit a signed and witnessed "Commitment to Protect Non-Public Information - Contractor Agreement" form for each contractor and subcontractor employee who may have access to non-public Department information under this contract. This form is located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf

5. VULNERABILITY SCANNING REPORTS

The Contractor shall report the results of the required monthly special vulnerability scans no later than 10 days following the end of each reporting period. If required monthly, this report may be included as part of the Technical Progress Report. Otherwise, this report shall be submitted under separate cover on a monthly basis.

6. STANDARD FOR ENCRYPTION LANGUAGE

The Contractor shall use Federal Information processing Standard (FIPS) 140-2-compliant encryption (Security) Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered "sensitive" in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004).

The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/groups/STM/cmvp/ ) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf ). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf http://csrc.nist.gov/groups/STM/cmvp/ http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf

The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

The Contractor shall ensure that its subcontractors (all tiers) which perform work under this contract comply with the requirements contained in this clause.