Credit_Monitoring_SOW.pdf

1300798720

Statement of Work DoD Data Breach Response:

Credit Monitoring and Identity

Theft Protection

1 Introduction

The Naval Undersea Warfare Center Division Newport (NUWCDIVNPT) has a need for identity credit monitoring data breach response and protection services for an estimated 890 Department of Defense employees. The identity credit monitoring services shall include business information services, credit monitoring services from at least three credit bureaus, identity monitoring services, identity theft insurance, identity restoration services, website services, mail alternative services (for individuals not wanting to monitor online) and call center services (related to these requirements). These services are critical to responding to cyber security events, and in mitigating the risk of identity theft or compromise government security and operations.

1.1 Mission

To provide data breach response services as a result of a recent data breach incident involving the compromise of Personally Identifiable Information (PII).

1.2 Background

NUWCDVNPT recently discovered a data breach incident that may have compromised the data of US Government Civilian Personnel. NUWCDIVNPT has determined that personally identifiable information (PII) of approximately 890 individuals may have been compromised.

This potential breach warrants notification of individuals, whose PII data may have been compromised. The Government has determined that it will provide credit and cyber monitoring and identity protection services to all individuals who may have suffered exposure as a result of the breach. These services will be offered to individuals who were impacted b y the recent PII breach incident.

1.3 Scope

NUWCIVNPT has requirements for post-breach incident support services for individuals impacted by the NUWCIVNPT data breach incident. The maximum number of impacted individuals covered by this order is estimated to be 890 individuals.

1.4 Definitions

Impacted Individuals is defined as individuals whose PII information were compromised in the recent data breach incident occurring to DoD Travelers.

2 General Requirements

All Contractor personnel with access to protected information shall be a U.S. Citizen or be a Legal Permanent Resident of the U.S. and have a favorable National Agency Check (NAC).

2.1 Security

2.1.1 The Contractor shall meet all Government security requirements

Work under this purchase order is unclassified. Contractor personnel shall not disclose and must safeguard all sensitive information, computer systems and data, privacy act data, Personally Identifiable Information (PII), and government personnel work products obtained or generated in the performance of this contract.

The Contractor shall protect, secure, and encrypt protected information in accordance with:

a) NIST-SP-800-171

b) NIST SP-800-53-REV4 Appendix J; and

1. DoD Directive (DoDI) 8410.01, Cyberspace Workforce Management DoD

2. Instruction (DoDI) 8500.1, Cybersecurity

3. The Privacy Act (5 U.S.C. 552a)

4. DoD 5400.11-R, DoD Privacy Program

5. DoD 5200.2-R, Personnel Security Program

6. HSPD-12, Homeland Security Presidential Directive.

c) In addition to the requirement in NIST SP 800-171, 3.5.3, to use multifactor authentication for access to a protected contractor information system, the Contractor shall provide for multifactor authentication to the protected contractor information system for affected individuals. The Contractor shall meet all requirements specified in NIST 800- 63-2 to achieve Level of Assurance 3 of the protected contractor information system.

d) The Contractor shall update its System Security Plan, as required, with any needed security or technical corrections, or upon a security relevant change. The System

Security Plan and any revisions shall meet the requirements of:

1. NIST-SP-800-53 RES6 (PL 2, PL 7, PL

8), and,

2. NIST-SP-800-18.

e) The Contractor shall provide information security continuous monitoring data of its systems to the Government in accordance with NIST-SP-800-137.

f) The Contractor shall support security onsite inspections by the Government at any location where protected information is collected, stored or used. The Contractor shall provide the Government personnel network drops, conference room for briefings, most recent and historical network data (e.g., configuration, vulnerability scans) and appropriate network monitoring tools used by the Contractor. Appropriate Contractor personnel supporting the inspection shall be available at the Contractor’s worksite.

g) When the Contractor discovers a cyber incident that affects a protected contractor information system or the protected information residing therein, or that affects the Contractor’s ability to perform the requirements of the contract, the Contractor shall—

1. Conduct a review for evidence of compromise of protected information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing protected contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised protected information, or that affect the Contractor’s ability to perform the requirements of the contract; and

2. Rapidly report cyber incidents to DoD in accordance with DFARS Clause

252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

h) In order to report cyber incidents, the Contractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD- approved medium assurance certificate, see http://iase.disa.mil/pki/eca/Pages/certificate.aspx.

2.1.2 The Government reserves the right to inspect and validate Contractor’s facilities, protocols, and processes for compliance. If the Government determines that the facilities, protocols or processes do not meet security requirements, the Contractor shall provide a plan within 3 calendar days for Government approval to achieve compliance.

http://iase.disa.mil/pki/eca/Pages/certificate.aspx

2.2 Privacy

2.2.1 Contractor shall meet all Government privacy requirements of the purchase order. The Contractor shall protect, secure, and encrypt protected information in accordance with:

a) NIST-SP-800-171, NIST SP-800-53-RES6 Appendix J, NIST SP 800-88

Privacy Act 1974, and Federal OMB privacypolicies (www.whitehouse.gov/omb/privacy_general)

2.2.2 The Contractor shall only use protected information for the purpose for which it was provided. Protected information shall not:

a) be shared with any other entity except for subcontractors under the agreement, unless expressly authorized by the impacted individual(s)

b) be used for marketing of any kind, or

c) be sold or transferred unless approved in writing by the Contracting Officer

The Contractor shall limit access to protected information to only those employees requiring access to the information to perform the contract and that trained, to include privacy awareness training, and authorized by the Contractor, unless expressly authorized by the impacted individual.

The Contractor shall notify the Government in the event of any suspected or confirmed compromise of protected information within 1 hour of discovery of the incident.

Upon completion of the contract the Contractor shall conduct sanitization and destruction of all protected information, except for information needed for pending and on-going restoration claims. Any sanitization or destruction of information shall be done in accordance with NIST-SP-800-171 and NIST 800-88. Within 30 days after the end of the performance period, the Contractor shall provide notification to the Contracting Officer. The notification shall include a description of the information that will be destroyed, as well as, a description of the information required for completion of pending/on-going restoration claims. The contractor shall not destroy any information or compromised data without written approval from the Contracting Officer. The Contractor shall certify to the destruction of all protected information no more than 30 days after receiving written approval from the Contracting Officer, with the exception of information needed for pending and on-going restoration claims.

2.2.2 The Government reserves the right to inspect and validate Contractor’s facilities, protocols, and processes for compliance. If the Government determines Contractor does not meet privacy requirements, Contractor shall provide a plan within 3 calendar days for Government approval to achieve compliance.

http://www.whitehouse.gov/omb/privacy_general)

3.1 Performance Requirements/Tasks:

The following section specifies the Performance Requirements and Performance Standards for this Order.

3.2 Enrollment

3.2.1 The Contractor shall provide a dedicated website for potentially affected individuals to enroll themselves and access all monitoring services included in this order.

Website Performance Standards

a) Standard: 508 compliant

b) Standard: IAW NIST-SP-800-171

c) Standard: website shall be accessible on major commercial browsers

d) Standard: fully operational in advance of notification to affected individuals

e) Standard: 99.99% operational

f) Standard: multi-factor authentication for affected individuals

3.2.2 The Contractor shall establish Call Center Services.

Performance Standards

a) Standard: Operational prior to notification of impacted individuals

b) Standard: Located in the U.S.

c) Standard: English

d) Standard: Dedicated U.S. toll-free telephone number

e) Standard: 508 compliant

f) Standard: Free international telephone access

3.2.3 The Contractor shall respond to queries, enrollments, and requests for use of provided services from impacted individuals.

a) Standard: Wait times not to exceed 15 minutes before human assistance is rendered

b) Standard: Average wait time shall not exceed 10 minutes

c) Standard: Maintain daily call log

d) Standard: Call Center hours will be 0800 to 2000 ET (Monday – Friday)

Deliverables

a) Call Logs (including number of calls, wait time, length, dropped calls) (A008)

3.2.4 The Contractor shall connect impacted individuals to designated Identity Restoration Services and Identity Theft Insurance Services.

a) Standard: On-going basis

b) Standard: Initiation of the process for use of the Identity Restoration Service or Identity

c) Theft Insurance Services shall occur within 15 minutes of connection

3.1.4.1 Individuals notified will be given instructions to register for credit monitoring service.

The Contractor shall be prepared to accept enrollments and respond to queries and requests no later than 10 days after award.

3.1.4.2 The Contractor shall authenticate the identity of impacted individuals who desire to enroll using the data provided by the Government. Once authenticated, impacted individuals may enroll themselves.

3.2 Credit and Cyber/Identity Monitoring Services

The Contractor shall provide affected individuals monitoring services for a two (2) year period. Affected individuals may elect to enroll themselves to receive credit monitoring and identity theft protection services at any time throughout the two year period of performance specified in this order.

3.2.1. Individuals notified will be given instructions to register for credit monitoring service. The Contractor shall be prepared to accept enrollments and respond to queries and requests no later than 10 days after award.

3.2.1.1. The Contractor shall authenticate the identity of impacted individuals who desire to enroll using the data provided by the Government. Once authenticated, impacted individuals may enroll themselves for these services.

3.2.2 Credit monitoring of credit reports at all three national credit reporting agencies (i.e., Experian, Equifax, and TransUnion)

Upon enrollment, the Contractor shall provide credit monitoring of credit reporting from Experian, Equifax and TransUnion. The Contractor shall monitor credit reports from all three credit bureaus and provide a mechanism to allow a Fraud Alert Reminders to be sent to the affected individuals every 90 days to remind them to reset their fraud alert.

Performance Standards:

a) Standard: identify changes in credit reports

b) Standard: identify and notify impacted individuals of findings or changes no later than 24 hours after occurrence

c) Standard: on-going basis

3.2.3 Cyber/Identity Monitoring

The Contractor shall also provide cyber/Identity Monitoring for enrolled individuals. Identity monitoring includes, but is not limited to, monitoring the internet, black market and database sources including bank account and routing numbers, medical insurance account number, email addresses, phone numbers, social security number (SSN) monitoring and credit and debit card number monitoring.

Performance Standards:

a) Standard: 24 hours a day, 7 days a week

b) Standard: identify and notify enrolled individuals of findings or changes no later than 26 hours after occurrence

4.1 Status Reporting Requirements

The Contractor shall provide Status Reporting. The Contractor shall provide Status Reports to accurately reflect the status of service provided

1. Monitoring Services Status Report shall reflect the reporting period and cumulative summaries for the following:

a. Number of individuals affected who enrolled in

i. Credit monitoring

ii. Number of individuals (impacted and minor) enrolled

iii. Number of individuals that were notified of suspicious activity

iv. Number of individuals that confirmed activity was suspicious

b. Cyber/Identity monitoring

i. Number of individuals (impacted and minor) enrolled

ii. Number of individuals that were notified of suspicious activity

iii. Provide the location of suspicious activity (i.e. internet or specific monitored database)

iv. Number of individuals that confirmed activity was suspicious

v. Provide the location of suspicious activity (i.e. internet or specific monitored database)

2. Notification Services Status Report shall include:

a. Delivery status of all Government Furnished Information

b. Status of data cleanse with estimated completion date

c. Status of de-duplication of data with estimated/actual completion date

d. Estimated or revised estimated number of impacted individuals, if revised

e. Total number of notifications distributed via US mail by contractor

g. Total number of returned US mail notifications

h. Total number of redistributed mail notifications after being returned

i. Total number of 2nd/Follow Up notifications sent via email

j. Total number of returned 2nd/Follow Up notifications sent via email

Reporting Performance Standards

a) Standard:

• Months 1 through 6: Weekly reporting

• Month 7 through Completion: Monthly reporting

b) Standard: Contractor generated format, subject to approval and feedback of Government

c) Standard: Format: .XML

d) Reports shall clearly state the period start and end date/time of data contained in report

Deliverables:

a) Status Reports

5.1 Additional Requirements and Terms

This section describes the special requirements for this effort. The following sub-sections provide details of various considerations on this effort.

5.2 Government Furnished Materials and Information (GFI)

The Government will make available the following information for use by the Contractor in the performance of this contract at time of award.

• Initial and subsequent data sets of impacted individuals (last name, other information necessary to enable multi-factor authentication)

This requirement involves use of Government Furnished Information (GFI) to notify impacted individuals. This includes the use of GFI to generate a standard letter, mailing letters, tracking returned letters destruction of returned letters, certification of destruction, and to provide credit and identity monitoring services.

The contractor must be capable of working independently and with government employees involving government furnished data or other information and to perform data collection, manipulation and related tasks to accomplish assignments.

The government activity will provide a data via AMRDEC SAFE with all required information to develop a mailing list of impacted individuals (last name, First Name, initial, address, email address, telephone number and other information necessary to enable multi-factor authentication), the desired format for the return postal address, and a standard letter template with a signature that will be used for all letters. The contractor shall safeguard and maintain information security of the data.

5.3 Place of Performance/Location of Work

The place of performance will be at the Contractor site.

5.4 Quality

This section describes the Quality Control components for this effort. The following sub-sections provide details of various considerations on this effort.

5.4.1 Quality Control

The Contractor shall develop an Order QCP and maintain an effective quality control program to ensure services are performed in accordance with the contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s QCP is the means by which he assures himself that his work complies with the requirement of the contract.

The proposed QCP will be submitted to the Contracting Officer’s Representative within 5 days after the award of the Task Order. The Contracting Officer may notify the Contractor of required modifications to the plan during the period of performance. The Contractor then shall coordinate suggested modifications and obtain acceptance of the plan by the Contracting Officer. Any modifications to the program during the period of performance shall be provided to the Contracting Officer for review no later than 10 days prior to effective date of the change. The QCP shall be subject to the Government’s review and approval. The Government may find the QCP "unacceptable" whenever the Contractor’s procedures do not accomplish quality control objective(s). The Contractor shall revise the QCP within 10 days from receipt of notice that QCP is found "unacceptable."

Deliverables:

a) Quality Control Plan

6.0 Deliverables

The Contractor shall provide the following deliverables as described below.

Name Frequency

Duplicate List As Required

Final List As Required Medium Assurance Certificate Time of Award Fail Notification List As Required Status Reports As Required: Weekly Quality Control Plan As Required Security Plan Time of Award Call Center Call Logs As Required: Weekly

7.0 Contract Management

Notwithstanding the Contractor's responsibility for total management during the performance of this contract, the administration of the contract/order will require maximum coordination between the Government and the Contractor.

Communications pertaining to the contract will be addressed to the Contracting Officer. No changes to the statement of work are authorized without a written modification to the contract executed by the Contracting Officer.

The Contractor is advised that only the Contracting Officer can change or modify the contract terms or take any other action, which obligates the Government. Then, such action must be set forth in a formal written modification to the contract.

Contractors who rely on direction from anyone other than the Contracting Officer do so at their own risk and expense. Such actions do not bind the Government contractually. Any contractual questions shall be directed to the Contracting Officer, or Contract Specialist.