Attachment_5_-_NIST_Checklist.doc

DOC document 216 KB Posted Feb 26, 2013

Attached to: Designated Provider/US Family Health Plan - Data Support Federal contract opportunity
Solicitation number: HT0011-13-R-0001
Issued by: Defense Health Agency

About this file

From the source

Attachment 5 - NIST Checklist

View the file

Other files for this federal contract opportunity

Other files attached to Designated Provider/US Family Health Plan - Data Support, newest first.
File	Type	Posted
HT0011-13-R-0001_(Q A's).pdf	PDF	Mar 13, 2013
HT0011-13-R-0001_(Conformed_Copy).pdf	PDF	Mar 12, 2013
ATTACHMENT_2_-_Pricing_Sheet.doc	DOC document	Mar 12, 2013
HT0011-13-R-0001 _0001.pdf	PDF	Mar 12, 2013
Exhibit_3_-_Interface_Specification_-_PIDS-UPdate.pdf	PDF	Feb 26, 2013
Exhibit_4_-_Technical_Specification_-_CCDD.pdf	PDF	Feb 26, 2013
HT0011-13-R-0001(RFP).pdf	PDF	Feb 26, 2013
Attachment_1_-_Non_Disclosure_Agreement.pdf	PDF	Feb 26, 2013
Attachment_2_-_Pricing_Sheet.doc	DOC document	Feb 26, 2013
Exhibit_8_-_Technical_Overview_-_BWE_Fee_Gateway.pdf	PDF	Feb 26, 2013
Exhibit_9_-_BWE_System_Implementation_Plan_T3.pdf	PDF	Feb 26, 2013
Attachment_3_-_Access_to_HA-TMA_Network-DoD_Systems.pdf	PDF	Feb 26, 2013
Exhibit_7_-_T3_Data_Dictionary.pdf	PDF	Feb 26, 2013
Exhibit_2_-_Technical_Specification_-Claims.pdf	PDF	Feb 26, 2013
Attachment_4_-__Government_Furnished_Equipment_Information_Property(2).pdf	PDF	Feb 26, 2013
Exhibit_6_-_Technical_Specification_-_Premium_Billing_Service.pdf	PDF	Feb 26, 2013
Exhibit_5__-_Technical_Specification_-_Premium_Interface.pdf	PDF	Feb 26, 2013
Exhibit_1_-_Technical_Specification_-_Policy_Notification.pdf	PDF	Feb 26, 2013

Show all 18

On GovTribe

Work with this file on GovTribe

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Checklist for Minimum Level of Enhanced Safeguarding for Unclassified DoD Information Form Instructions:

1. In the column marked “Compliance Statement,” the Contractor shall select the appropriate response from the form’s drop down list to indicate its compliance with the specific information assurance (IA) control.

2. In the column marked “Validation Method,” the Contractor shall select the appropriate NIST-based validation method(s)* for how it achieved compliance with the specific IA control.

3. In the column marked “Compliance Date,” the Contractor shall enter the date it achieved compliance with the specific IA control.

4. In the column marked “Activity Description,” the Contractor shall enter a brief description of its activities to achieve compliance with the specific IA control.

If the “Enhanced Safeguarding” control is not implemented, the Contractor shall prepare a written determination that explains how either the required security control is not applicable, or how an alternative control or protective measure is used to achieve equivalent protection. The Contractor shall provide the written determination and / or completed checklist and signed “certification” statement in accordance with the terms listed in the contract.

Access Control

Ref #

Nomenclature

Compliance Statement

Validation Method*

Compliance Date

Activity Description

AC-2

Account Management

FORMDROPDOWN

AC-3

Access Enforcement

FORMDROPDOWN

AC-3(4)

Access Enforcement

FORMDROPDOWN

AC-4

Information Flow Enforcement

FORMDROPDOWN

AC-6

Least Privilege

FORMDROPDOWN

AC-7

Unsuccessful Login Attempts

FORMDROPDOWN

AC-11

Session Lock

FORMDROPDOWN

AC-11(1)

Session Lock

FORMDROPDOWN

AC-17

Remote Access

FORMDROPDOWN

AC-17(2)

Remote Access

FORMDROPDOWN

AC-18

Wireless Access

FORMDROPDOWN

AC-18(1)

Wireless Access

FORMDROPDOWN

AC-19

Access Control for Mobile Devices

FORMDROPDOWN

* Note – Details about the validation methods of specific security controls can be found within NIST SP 800-53 and -53A.

Awareness & Training

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

AT-2

Security Awareness

FORMDROPDOWN

Audit & Accounting

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

AU-2

Auditable Events

FORMDROPDOWN

AU-3

Content of Audit Records

FORMDROPDOWN

AU-6

Audit Review, Analysis & Reporting

FORMDROPDOWN

AU-6(1)

Audit Review, Analysis & Reporting

FORMDROPDOWN

AU-7

Audit Reduction & Report Generation

FORMDROPDOWN

AU-8

Time Stamps

FORMDROPDOWN

AU-9

Protection of Audit Information

FORMDROPDOWN

AU-10

Non-Repudiation

FORMDROPDOWN

AU-10(5)

Non-Repudiation

FORMDROPDOWN

Configuration Management

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

CM-2

Baseline Configuration

FORMDROPDOWN

CM-6

Configuration Settings

FORMDROPDOWN

CM-7

Least Functionality

FORMDROPDOWN

CM-8

Information Sys Component Inventory

FORMDROPDOWN

Contingency Planning

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

CP-9

Information System Backup

FORMDROPDOWN

Identification & Authentication

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

IA-2

User Identification & Authentication

FORMDROPDOWN

IA-4

Identifier Management

FORMDROPDOWN

IA-5

Authenticator Management

FORMDROPDOWN

IA-5(1)

Authenticator Management

FORMDROPDOWN

Incident Response

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

IR-2

Incident Response Training

FORMDROPDOWN

IR-4

Incident Handling

FORMDROPDOWN

IR-5

Incident Monitoring

FORMDROPDOWN

IR-6

Incident Reporting

FORMDROPDOWN

Maintenance

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

MA-4

Remote Maintenance

FORMDROPDOWN

MA-4(6)

Remote Maintenance

FORMDROPDOWN

MA-5

Maintenance Personnel

FORMDROPDOWN

MA-6

Timely Maintenance

FORMDROPDOWN

Media Protection

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

MP-4

Media Storage

FORMDROPDOWN

MP-6

Media Sanitization & Disposal

FORMDROPDOWN

Physical & Environmental Protection

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

PE-5

Access Control for Display Medium

FORMDROPDOWN

PE-7

Visitor Control

FORMDROPDOWN

Program Management

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

PM-10

Security Authorization Process

FORMDROPDOWN

System & Comm Protection

Ref #

Nomenclature

Compliance Statement

Validation Approach

Compliance Date

Activity Description

SC-2

Application Partitioning

FORMDROPDOWN

SC-4

Information Remnance

FORMDROPDOWN

SC-7

Boundary Protection

FORMDROPDOWN

SC-7(2)

Boundary Protection

FORMDROPDOWN

SC-9

Transmission Confidentiality

FORMDROPDOWN

SC-9(1)

Transmission Confidentiality

FORMDROPDOWN

SC-13

Use of Cryptography

FORMDROPDOWN

SC-13(1)

Use of Cryptography

FORMDROPDOWN

SC-13(4)

Use of Cryptography

FORMDROPDOWN

SC-15

Collaborative Computing

FORMDROPDOWN

SC-28

Protection of Information at Rest

FORMDROPDOWN

System & Information Integrity

Ref #

Nomenclature

Compliance Statement

Compliance Date

Activity Description

SI-2

Flaw Remediation

FORMDROPDOWN

SI-3

Malicious Code Protection

FORMDROPDOWN

SI-4

FORMDROPDOWN

CERTIFICATION OF COMPLIANCE:

I certify that I am an official representative for <Insert Company Name>, that I have authority to sign this document and obligate <Insert Company Name> to the statements made in this document, and that I have personal knowledge of the matters to which this certification applies. I also certify that <Insert Company Name> is in compliance with the enhanced safeguarding requirements identified within the contract clause stated above and this document.

Signature:

Date:

Name:

Title:

Company:

TMA Checklist – Minimum Enhanced Level of Security Controls, 20110720

Pg 5 of 5

File details come from the government source that posted it. Updated Nov 14, 2017.