FIRST_TASK_ORDER.pdf

Task Order Statement of Work (SOW) for Security Authorization Procurement Directorate

Office of Human Resources Management

1. SCOPE:

The Contractor shall complete security authorization requirements in order to ensure the security posture of the system/application is implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system/application.

2. TASKS:

Complete all required tasks and deliverables for security authorization as noted in this

SOW.

3. DELIVERABLES AND DELIVERY SCHEDULE:

The Contractor is required to submit reports and deliverables to the COR throughout the contract performance period, as defined below.

Diagram 1 Deliverables and Delivery Schedule Deliverable Description Delivery/

Frequency Submit To

1 Security Authorization The Contractor must conduct and complete all required procedures and documentation resulting in a successful Security Authorization of their system or systems by the Department of Homeland Security (DHS) and/or US Customs and Border Protection (CBP), whether hosted internally within DHS or CBP networks or hosted externally.

• FIPS 199, E-

Authentication,

• Privacy Threshold Analysis (PTA),

• Requirements Traceability Matrix

(RTM),

• Security Plan,

• Contingency Plan (CP)

& Contingency Plan Test (CPT), After contract award

COR

• Security Test & Evaluation Plan,

• Security Test & Evaluation,

• Plan of Action & Milestones (POA&Ms)

4. SECURITY:

The requirements of security ensure that the process of establishing and maintaining a framework and supporting management structure and processes provide assurance that information security strategies are aligned with and support the business objectives of CBP and DHS, are consistent with applicable laws and regulations through adherence to policies and internal controls, and provide assignment of responsibility, all in an effort to manage risk.

CBP Program Offices shall provide personnel (System Owner and Information System Security Officers) with the appropriate clearance levels to support the Security Authorization (SA), (formerly Certification & Accreditation (C&A)) processes under this Agreement in accordance with the current version of the DHS MD 4300A Sensitive Systems Policy and Sensitive Systems Policy Handbook, CBP HB-1400-05D, Information Systems Security Policies and Procedures Handbook, and all applicable National Institute of Standards and Technology (NIST) Special Publications (800 Series).

During all SELC phases of CBP systems, CBP personnel shall develop documentation and provide any required information for all levels of classification in support of the SA process. In addition, all SAs will be performed using the DHS SA process, methodology and tools. An ISSO performs security actions for an information system. There is only one ISSO designated to a system, but multiple Alternate ISSOs may be designated to assist the ISSO. While the ISSO performs security functions, the System Owner is always responsible for information system security (4300A). System owners shall include information security requirements in their capital planning and investment control (CPIC) business cases for the current budget year and for the Future Years Homeland Security Program (FYHSP) for each DHS information system. System owners or AOs shall ensure that information security requirements and POA&Ms are adequately funded, resourced and documented in accordance with current OMB budgetary guidance.

4.1. General Security

a. All Government furnished information must be protected to the degree and extent required by local rules, regulations, and procedures. Contractor shall conform to all security policies contained in the U.S. Customs and Border Protection Information Systems Security Policies and Procedures Handbook, CIS HB 1400-05D.

b. All services provided under this task order must be compliant with DHS Information Security Policy, identified in MD4300.1, Information Technology Systems Security Program and 4300A Sensitive Systems Handbook."

4.1.1. Security Clearances: Personnel Security Background Data Performance under this SOW is considered sensitive but unclassified and a security clearance is not required.

a. All personnel employed by the Contractor for work performed under this Statement of Work (including any new personnel hired as replacement(s) during the term of this contract) must receive a favorable suitability determination for employment by the Office of Internal Affairs-Personnel Security Division (PSD) following completion of a CBP background investigation. Periodic reinvestigations will be required pursuant to applicable CBP requirements (currently 5 years). Federal investigations completed by other federal entities may be given reciprocal consideration in accordance with CBP policy. A preliminary (a.k.a. provisional) determination may be rendered by PSD thereby authorizing the individual to begin work prior to completion and final adjudication of the investigation (access to systems may be restricted until completion and final adjudication of the investigation. Any individual employed under this contract who is determined unsuitable by PSD will be removed from all work on CBP contracts immediately.

b. All contract personnel should orient themselves with the CBP Security Policy and Procedures Handbook (HB1400-02B), August 13, 2009, Volume IV, Chapter 13, Safeguarding Sensitive But Unclassified (For Official Use Only) Information.

The majority of data processed on Customs and Border Protection (CBP) systems is considered Sensitive But Unclassified (SBU), For Official Use Only (FOUO). The network used to transport this data is the Department of Homeland Security (DHS) OneNet.

c. The Contractor shall submit within ten (10) working days after award of the contract a list containing the full name, social security number, and date of birth of those employees who claim to have already successfully passed a background investigation by CBP, or submit such information and documentation as may be required by the Government to have a background investigation performed. The background information must be correct and reviewed by the designated CBP Security Official for completeness.

Normally, information requested for a background investigation consists of:

• An SF-85P, “Questionnaire for Public Trust Positions”

• An SF-86, “Questionnaire for Sensitive Positions (For National

Security”

• TDF 67-32.5, “U.S. USCS Authorization for Release of Information”

• An FD-258, “Fingerprint Chart”

• A Financial Statement

Failure of any Contractor personnel to successfully pass a background investigation shall be cause for the candidate’s dismissal from the project.

The Contractor shall immediately recommend an equally qualified replacement with similar or equal experience. The recommended replacement shall be approved by the Contracting Officer and the COR. This policy also applies to any personnel hired as replacements during the term of the contract.

d. The Contractor shall immediately notify the Contracting Officer (CO) and the Contracting Officer Technical Representative (COR) of any personnel changes. Written approval for confirmation purposes is also required if there has been a telephone notification. This includes resignations, terminations, and reassignment.

e. The Contractor shall also notify the CO/COR, in writing, of any changes in access requirements for its personnel no later than one (1) day after any personnel changes occur. This includes name changes, resignations, terminations, and transfers to another contract. The Contractor’s Program Manager is responsible for the completion and timely submission to the CO/COR of the CF-242 “Separation Procedures for Contractor Employee” for all departing contract personnel. Contractor shall also provide OIT/Information Security Branch (ISB) the following information on behalf of their personnel to telephone number (703) 921-6116 or fax the below information to (703) 921-6570:

Full Name Social Security Number Effective Date Reason for Change

f. “DHS/OS/SSPD CONCURS AND APPROVES THE ‘NEED-TO-KNOW’ AT THE

SCI LEVEL /NON-SCI LEVEL” TOP SECRET CLEARANCES: ACCESS TO

INTELLIGENCE INFORMATION REQUIRES A FINAL U.S.

GORVERNEMENT CLEARANCE. SUBCONTRACTING:

SUBCONTRACTING REQUIRES PRIOR APPROVAL OF THE GCA.

BRIEFINGS: Special briefings and procedures ARE REQUIRED. THE DSS

(CSO) DOES NOT CONDUCT INSPECTIONS FOR SENSITIVE

COMPARTMENTED INFORMATION 9SCI0, BUT MUST INSPECT NON-SCI

INTELLIGENCE MATERIAL THE CONTRACTOR PROSESSES.”

4.1.2. Security Documentation

The Contractor shall provide the COR with the following information within three (3) business days of each employee’s successful adjudication of the BI or the issuance of the Interim Clearance:

a. A signed and dated statement from each Contractor employee that he/she has received, read, and understands the CBP requirements contained in the DHS Management Directive (MD) 11042.1 Safeguarding Sensitive but Unclassified (For Official Use Only) Information; Management Directive (MD) 4300.1 Information Technology Systems Security; and the DHS 4300A Sensitive Systems Handbook:

“I, [insert name of employee] ________, have read and understand the contents of the: DHS MD 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information; DHS MD 4300.1 Information Technology Systems Security; and The DHS Sensitive Systems Handbook 4300A Sensitive Systems Handbook.

I understand that there could be an impact to the CBP systems, as well as other consequences, for not following the requirements of these security documents.”

4.1.3. Security Requirements for Unclassified Information Technology Resources, HSAR 3052.204-70 The Contractor shall contact the COR for security matters. The COR will provide assistance and direction.

(a) The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission.

(b) The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

(1) Within sixty (60) days after contract award, the contractor shall submit for approval its IT Security Plan, which shall be consistent with and further detail the approach contained in the offeror's proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

(2) The Contractor’s IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.); the Government Information Security Reform Act of 2000; and the Federal Information Security Management Act of 2002; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130.

(3) The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

(c) Examples of tasks that require security provisions include--

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the contractor’s copy be corrupted;

and

(2) Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

(d) At the expiration of the contract, the contractor shall return all sensitive DHS information and IT resources provided to the contractor during the contract, and certify that all non-public DHS information has been purged from any contractor-owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

(e) Within six (6) months after contract award, the contractor shall submit written proof of IT Security Accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A (Version 9.0, July 17, 2012) or any replacement publication, which the Contracting Officer will provide upon request.

This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The contractor shall comply with the approved accreditation documentation.

4.1.4. Contractor Employee Access, HSAR 3052.204-71

(a) Sensitive Information, as used in this Chapter, means any information, the loss, misuse, disclosure, or unauthorized access to or modification of which could adversely affect the national or homeland security interest, or the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of S SI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

(b) “Information Technology Resources” include, but are not limited to, computer equipment, networking equipment, telecommunications equipment, cabling, network drives, computer drives, network software, computer software, software programs, intranet sites, and internet sites.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the contractor to prohibit individuals from working on the contract if the government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to sensitive information. Therefore, the Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the Contracting Officer. For those contractor employees authorized access to sensitive information, the contractor shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

(f) The Contractor shall include the substance of this clause in all subcontracts at any tier where the subcontractor may have access to Government facilities, sensitive information, or resources.

When the Department has determined contract employee access to sensitive information or Government facilities must be limited to U.S. citizens and lawful permanent residents, but the contract will not require access to IT resources, add the following paragraphs:

(g) Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-55 1). Any exceptions must be approved by the Department’s Chief Security Officer or designee.

(h) Contractors shall identify in their proposals, the names and citizenship of all non- U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the contracting officer.

4.1.5. Interconnection Security Agreements

Interconnections between DHS and non-DHS IT systems shall be established through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements, memoranda of understanding, service level agreements or interconnect service agreements. Components shall document interconnections with other external networks with an Interconnection Security Agreement (ISA). Interconnections between DHS Components shall require an ISA when there is a difference in the security categorizations for confidentiality, integrity, and availability for the two networks. ISAs shall be signed by both Authorizing Officials (AOs) or by the official designated by the AO to have signatory authority.

4.2. Security Authorization (SA)

Security Authorization (SA) consists of important activities that support a risk management process and are an integral part of an agency's information security program. The security authorization process is designed to ensure that an information system will operate with the appropriate management review, that there is ongoing monitoring of security controls, and that reauthorization occurs periodically.

The Contractor must conduct and complete all required procedures and documentation resulting in a successful SA, formerly Certification and Accreditation (C&A) of their system or systems by the Department of Homeland Security (DHS) and/or US Customs and Border Protection (CBP), whether hosted internally within DHS or CBP networks or hosted externally. Prior SA for/by another private, Federal, State, or Local entity does not constitute completion of this requirement. Prior SA by DHS or CBP may also not constitute completion of this requirement, given that each implementation of a system can and does change SA factors such as accreditation boundaries which may trigger the need for a new, successful SA. The Contractor must adhere to contract deliverable requirements that require all deliverables to be submitted in a timely manner. All deliverables are subject to management approval prior to acceptance.

The Contractor shall meet the requirements of:

• DHS Sensitive Systems Policy Directive 4300A, Information Technology Security

Program;

• CBP Information Systems Security Policies and Procedures Handbook, HR

1400-05D to provide the following:

4.2.1. Initiation

4.2.1.1 Information System Description

• Confirm that the information system has been completely and accurately described and documented.

4.2.1.2. Security Categorization

• Confirm that the security category of the information system has been determined and documented.

4.2.1.3. Privacy Threshold Analysis

• Review and document attribute of personally identifiable information collected by the information system.

• Identify and document why the data is being collected, the intended use of the information, with whom the information will be shared, opportunities for consent and how consent is granted, and how the information will be secured.

4.2.1.4. E-Authentication

• Document risk ratings (High, Moderate, Low) for each identified transaction based on impact of unauthorized access to reputation, health and safety, productivity and performance, administrative action, regulatory and legislative compliance, finance, and fines and legal penalties.

• Assign assurance level to information system based on M-04-04 guidance, and validate that the information system has achieved the required assurance level.

4.2.1.5. Security Plan

• Confirm that the system description including purpose, mission, system type (major application, general support system, or minor application), system boundary, users, type of information, information classification, system components (software and hardware), environment, interconnections, etc. have been identified.

4.2.1.6. Contingency Plan

• Document system description, line of succession, and contingency responsibilities.

• Document notification/activation phase procedures to include notification procedures, damage, assessment, and plan activation.

• Document recovery/reconstitution phases activities to include the sequence of recovery events and recovery procedures, and the necessary activities to return to original or new facility for normal operations.

4.2.2. Assessment

4.2.2.1. Security Control Assessment

• Assess the management, operational and technical security controls protecting and in the information system (including hardware, software, firmware, and surrounding environment) using methods and procedures, documentation and supporting materials necessary for the assessment of the security controls.

4.2.2.2. Security Testing and Evaluation (ST&E)

• Participate in the ST&E Kickoff meeting.

• Review and agree to the ST&E Plan.

• Allow the ST&E Team access to Contractor facilities to conduct security testing.

The ST&E team will ask Contractor personnel to perform testing on their systems; if Contractor personnel believe that a particular test will cause a problem with the system, the notification shall be provided in advance to the ST&E team and arrangements will be made.

• Plan of Action and Milestones (POA&Ms) will be created to document remediation activities for managing and resolving weaknesses.

4.2.2.3. Contingency Plan Testing

• Establish and document plans for contingency testing to include system recovery on an alternate platform from backup media, coordination among recovery teams, internal and external connectivity, system performance using alternate equipment, restoration of normal operations, and notification procedures.

• Assist in performing tabletop and/or functional contingency exercises.

4.2.2.4. Disaster Recovery Strategies

• Review policy and procedures, as well as existing security documentation to determine the level of effort and resources required to develop the contingency plan.

• Identify and document preventive controls (e.g., UPS, generators, fire detection and suppression systems, water sensors, etc.)

• Identify and document backup procedures, offsite storage locations, alternative processing sites, equipment replacement strategies and/or existing compatible equipment, and roles and responsibilities for recovery teams.

4.2.2.5. Disaster Recovery Planning & Testing – Hardware

If the CBP system owner requires a robust DR solution (full redundancy and failover capabilities (for near zero downtime)) then the funded DR solution must match the production environment like-for-like. This solution would also include additional software licenses, hardware, firmware and storage for the DR environment. The system owner or program office must also include travel, per diem and approximately sixteen (16) over the core hours for travel to recovery facilities twice per fiscal year for system administrators, DBA’s, end users or testers.

If the system owner requires a moderate DR solution that would provide a working environment that is capable of handling their mission essential functions then they can fund a scaled down solution which should still take into consideration additional hardware, software licenses, and storage for the DR environment. The system owner or program office is still responsible for the costs associated with testing their DR solution;

however, for a scaled down solution, it may be possible to leverage or share staff already designated to participate in DR activities.

If the system owner only requires a low DR solution then the system owner or program office can use internal resources to perform a table-top exercise, which generally does not require travel, additional hardware or software licenses.

4.3. References, Resources, and Monitoring

4.3.1. References

The Contractor shall be familiar with all of the references below which provide policy, regulations and guidance that have a bearing on the Security Authorization Process.

Legislation

• Federal Information Security Management Act of 2002 (FISMA) (Title III of the E-Government Act, Public Law (PL) 107-3479)

• Privacy Act of 1974, PL 93-579, as amended

• OMB Circular A-123 – Management Accountability and Control

• OMB Circular A-127 – Financial Management Systems

• OMB Circular A-130 – Management of Federal Automated Information

Resources

• Computer Fraud and Abuse Act of 1986, PL 99-474

• Computer Security Act of 1987, PL 100-235

• Paperwork Reduction Act of 1980, as amended

• Section 508 of the Rehabilitation Act, as amended Policies, Directives, Instructions

• DHS Sensitive Systems Policy Directive 4300A

• DHS 4300A Sensitive Systems Policy Handbook Standards

• Federal Information Processing Standard (FIPS) 199, Standards for

Security Categorization of Federal Information and Information Systems

• Federal Information Processing Standard (FIPS) 200, Minimum Security

Requirements for Federal Information and Information Systems Guidelines

• NIST Special Publications (SPs) in the 800 series, but especially:

o SP 800-18, Guide for Developing Security Plans for Federal Information Systems o SP 800-30, Guide for Conducting Risk Assessments (Draft) o SP 800-34, Contingency Planning Guide for Federal Information

Systems o SP 800-37, Guide for Applying the Risk Management Framework to

Federal Information Systems: A Security Life Cycle Approach o SP 800-53, Recommended Security Controls for Federal

Information Systems and Organizations o SP 800-53A, Guide for Assessing the Security Controls in Federal

Information Systems and Organizations, Building Effective Security Assessment Plans o SP 800 60, Guide for Mapping Types of Information and Information Systems to Security Categories: Volume 1- Guide Volume, Volume 2 - Appendices

The above references can be found at:

Office of Management and Budget (OMB) -http://www.whitehouse.gov/omb/circulars_default Other Legislation – can be found by searching on the title NIST – http://csrc.nist.gov/publications/PubsSPs.html DHS/CBP – have been included as an attachment

4.3.2. Access to Unclassified Facilities, Information Technology Resources, and Sensitive Information

The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information, describes how contractors must handle sensitive but unclassified information. DHS MD 4300.1 Information Technology Systems Security and the DHS Sensitive Systems Handbook prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering contractors specifically for all Task Orders that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the contractor except as specified in the task order.

4.3.3. Common Security Configuration

4.3.3.1. Common Security Configuration Clause, OMB-M-07-18 FDCC/ In acquiring information technology, Contractors shall include the appropriate information technology security policies and requirements, including use of common security configurations available from the National Institute of Standards and Technology’s website at http://checklists.nist.gov. Agency contracting http://www.whitehouse.gov/omb/circulars_default http://csrc.nist.gov/publications/PubsSPs.html http://checklists.nist.gov/ officers should consult with the requiring official to ensure the appropriate standards are incorporated.

4.3.4. Monitoring/Reviewing Contractor Security Requirements

4.3.4.1. Security Review and Reporting

a) The Contractor shall include security as an integral element in the management of this contract. The Contractor shall conduct reviews and report the status of the implementation and enforcement of the security requirements contained in this contract and identified references.

b) The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS including the organization of the DHS Office of the Chief Information Officer, Office of Inspector General, the CBP Chief Information Security Officer, authorized Contracting Officer’s Technical Representative (COR), and other government oversight organizations, access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

“All services provided under this task order must be compliant with DHS Information Security Policy, identified in MD4300.1, Information Technology Systems Security Program and 4300A Sensitive Systems Handbook."