J.7 IHS FedRAMP Privacy and Security Requirements.pdf

A. IHS FedRAMP Privacy and Security Requirements

The Contractor (and/or any subcontractor) shall be responsible for the following privacy and security requirements:

1) FedRAMP Compliant ATO. Comply with FedRAMP Security Assessment and Authorization (SA&A) requirements and ensure the information system/service under this contract has a valid FedRAMP compliant (approved) authority to operate (ATO) in accordance with Federal Information Processing Standard (FIPS) Publication 199 defined security categorization.

a. Implement applicable FedRAMP baseline controls commensurate with the agency-defined security categorization and the applicable FedRAMP security control baseline (www.FedRAMP.gov). The IHS Information Security and Privacy Policy (IS2P) and IHS Cloud Computing and Federal Risk and Authorization Management Program (FedRAMP) Guidance further define the baseline policies as well as roles and responsibilities. The Contractor shall also implement a set of additional controls identified by the agency when applicable.

b. A security control assessment must be conducted by a FedRAMP third-party assessment organization (3PAO) for the initial ATO and annually thereafter or whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

2) Data Jurisdiction. The contractor shall store all information within the security authorization boundary, data at rest or data backup, within the continental United States (CONUS) if so required.

3) Service Level Agreements. Add when applicable The Contractor shall understand the terms of the service agreements that define the legal relationships between cloud customers and cloud providers and work with IHS to develop and maintain an SLA.

4) Interconnection Agreements/Memorandum of Agreements. Add when applicable The Contractor shall establish and maintain Interconnection Agreements and or Memorandum of Agreements / Understanding in accordance with IHS policies.

B. Protection of Information in a Cloud Environment

1) If contractor (and/or any subcontractor) personnel must remove any information from the primary work area, they shall protect it to the same extent they would the proprietary data and/or company trade secrets and in accordance with IHS policies.

2) IHS will retain unrestricted rights to federal data handled under this contract. Specifically, IHS retains ownership of any user created/loaded data and applications collected, maintained, used, or IHS Security and Privacy Language for Information and Information Technology Procurements v2 Page 29 operated on behalf of IHS and hosted on contractor’s infrastructure, as well as maintains the right to request full copies of these at any time. If requested, data must be available to IHS within one (1) business day from request date or within the timeframe specified otherwise. In addition, the data shall be provided at no additional cost to IHS.

3) The Contractor (and/or any subcontractor) shall ensure that the facilities that house the network infrastructure are physically and logically secure in accordance with FedRAMP requirements and IHS policies.

4) The contractor shall support a system of records in accordance with NARA-approved records schedule(s) and protection requirements for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to the following:

a. Maintenance of links between records and metadata, and

b. Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

5) The disposition of all IHS data shall be at the written direction of IHS. This may include documents returned to IHS control; destroyed; or held as specified until otherwise directed.

Items returned to the Government shall be hand carried or sent by certified mail to the COR.

6) If the system involves the design, development, or operation of a system of records on individuals, the Contractor shall comply with the Privacy Act requirements.

C. Security Assessment and Authorization (SA&A) Process

1) The Contractor (and/or any subcontractor) shall comply with IHS and FedRAMP requirements as mandated by federal laws, regulations, and IHS policies, including making available any documentation, physical access, and logical access needed to support the SA&A requirement.

The level of effort for the SA&A is based on the system’s FIPS 199 security categorization and IHS security policies.

a. In addition to the FedRAMP compliant ATO, the contractor shall complete and maintain an agency SA&A package to obtain agency ATO prior to system deployment/service implementation. The agency ATO must be approved by the authorizing official (AO) prior to implementation of system and/or service being acquired.

b. CSP systems categorized as Federal Information Processing Standards (FIPS) 199 high must leverage a FedRAMP accredited third-party assessment organization (3PAO); moderate impact CSP systems must make a best effort to use a FedRAMP accredited 3PAO. CSP systems categorized as FIPS 199 low impact may leverage a non-accredited, independent assessor.

c. For all acquired cloud services, the SA&A package must contain the deliverables mentioned in the FedRAMP Standard Contract Language available on the FedRAMP site. Following the initial ATO, the Contractor must review and maintain the ATO in accordance with HIS policies.

2) IHS reserves the right to perform penetration testing (pen testing) on all systems operated on behalf of agency. If IHS exercises this right, the Contractor (and/or any subcontractor) shall allow IHS employees (and/or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with IHS requirements. Review activities include, but are not limited to, scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

3) The Contractor must identify any gaps between required FedRAMP Security Control Baseline/Continuous Monitoring controls and the contractor’s implementation status as documented in the Security Assessment Report and related Continuous Monitoring artifacts. In addition, all gaps shall be documented and tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the risks, IHS may require remediation at the contractor’s expense, before IHS issues an ATO.

4) The Contractor (and/or any subcontractor) shall mitigate security risks for which they are responsible, including those identified during SA&A and continuous monitoring activities. All vulnerabilities and other risk findings shall be remediated by the prescribed timelines from discovery: (1) critical vulnerabilities no later than thirty (30) days and (2) high, medium and low vulnerabilities no later than sixty (60) days. In the event a vulnerability or other risk finding cannot be mitigated within the prescribed timelines above, they shall be added to the designated POA&M and mitigated within the newly designated timelines. IHS will determine the risk rating of vulnerabilities using FedRAMP baselines.

5) Revocation of a Cloud Service. IHS has the right to take action in response to the CSP’s lack of compliance and/or increased level of risk. In the event the CSP fails to meet IHS and FedRAMP security and privacy requirements and/or there is an incident involving sensitive information, IHS may suspend or revoke an existing agency ATO (either in part or in whole) and/or cease operations. If an ATO is suspended or revoked in accordance with this provision, the CO and/or COR may direct the CSP to take additional security measures to secure sensitive information.

These measures may include restricting access to sensitive information on the Contractor information system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

D. Reporting and Continuous Monitoring

1) Following the initial ATOs, the Contractor (and/or any subcontractor) must perform the minimum ongoing continuous monitoring activities specified below, submit required deliverables by the specified due dates, and meet with the system/service owner and other relevant stakeholders to discuss the ongoing continuous monitoring activities, findings, and other relevant matters. The CSP will work with the agency to schedule ongoing continuous monitoring activities.

2) At a minimum, the Contractor must provide the following artifacts/deliverables on a monthly basis

a. Operating system, database, Web application, and network vulnerability scan results;

b. Updated POA&Ms;

c. Any updated authorization package documentation as required by the annual attestation / assessment / review or as requested by the System Owner or AO; and

d. Any configuration changes to the system and/or system components or CSP’s cloud environment, that may impact IHS’s security posture. Changes to the configuration of the system, its components, or environment that may impact the security posture of the system under this contract must be approved by the agency.

E. Configuration Baseline

1) The contractor shall certify that applications are fully functional and operate correctly as intended on systems using the US Government Configuration Baseline (USGCB), DISA Security Technical Implementation Guides (STIGs), Center for Information Security (CIS) Security Benchmarks or any other IHS-identified configuration baseline. The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved IHS.

2) The contractor shall use Security Content Automation Protocol (SCAP) validated tools with configuration baseline scanner capability to certify their products operate correctly with IHS and NIST defined configurations and do not alter these settings.

F. Incident Reporting

1) The Contractor (and/or any subcontractor) shall provide an Incident and Breach Response Plan

(IRP) in accordance with IHS, OMB, and US-CERT requirements and obtain approval from IHS. In addition, the Contractor must follow the incident response and US-CERT reporting guidance contained in the FedRAMP Incident Communications.

2) The Contractor (and/or any subcontractor) must implement a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, and availability of federal data, afford IHS access to its facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of notification. The program of inspection shall include, but is not limited to:

a. a. Conduct authenticated and unauthenticated operating system/network/database/Web application vulnerability scans. Automated scans can be performed by IHS personnel, or agents acting on behalf of IHS, using agency-operated equipment and/or specified tools. The Contractor may choose to run its own automated scans or audits, provided the scanning tools and configuration settings are compliant with NIST Security Content Automation Protocol (SCAP) standards and have been approved by the agency. The agency may request the Contractor’s scanning results and, at the agency discretion, accept those in lieu of agency performed vulnerability scans.

b. In the event an incident involving sensitive information occurs, cooperate on all required activities determined by the agency to ensure an effective incident or breach response and provide all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. In addition, the Contractor must follow the agency reporting procedures and document the steps it takes to contain and eradicate the incident, recover from the incident, and provide a post-incident report that includes at a minimum the following:

• Company and point of contact name;

• Contract information;

• Impact classifications/threat vector;

• Type of information compromised;

• A summary of lessons learned; and

• Explanation of the mitigation steps of exploited vulnerabilities to prevent similar incidents in the future.

G. Media Transport

1) The Contractor and its employees shall be accountable and document all activities associated with the transport of government information, devices, and media transported outside controlled areas and/or facilities. These include information stored on digital and non-digital media (e.g., CDROM, tapes, etc.), mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards).

2) All information, devices and media must be encrypted with IHS-approved encryption mechanisms to protect the confidentiality, integrity, and availability of all government information transported outside of controlled facilities.

H. Boundary Protection: Trusted Internet Connections (TIC)

1) The contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities using cloud services is inspected by Trusted Internet Connection (TIC) processes.

2) The contractor shall route all external connections through a TIC.

3) Non-Repudiation. The contractor shall provide a system that implements FIPS 140-2 validated encryption that provides for origin authentication, data integrity, and signer non-repudiation.