Attachment_3_-_Reporting_and_Deliverable_Requirements_-_ISSO.pdf

Attachment 3 – Reporting and Deliverable Requirements

XVI. Additional terms and conditions applicable to this requirement.

(b) REPORTING REQUIREMENTS

2. Other Reports/Deliverables

(b) Information Security and Physical Access Reporting Requirements

The Contractor shall submit the following reports as required by the INFORMATION AND PHYSICAL ACCESS SECURITY item 12 of this solicitation. Note: Each report listed below includes a reference to the appropriate subparagraph of this item.

1. Roster of Employees Requiring Suitability Investigations

The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract who will develop, have the ability to access, or host and/or maintain a Federal information system(s).

The roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days of the effective date of the contract.

See Item 12(d) of Attachment 1 – Additional Terms and Conditions

2. IT Security Plan (IT-SP)

In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the contractor shall submit the IT-SP within thirty (30) days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

The Contractor shall review and update the IT-SP in accordance with NIST SP 800- 53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, on an annual basis.

See Item 15.(c).1 of Attachment 1 – Additional Terms and Conditions

3. IT Risk Assessment (IT-RA)

Information Technology Resources, the contractor shall submit the IT-RA within thirty (30) days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy.

The Contractor shall update the IT-RA on an annual basis.

See Item 15.(c).2 of Attachment 1 – Additional Terms and Conditions

4. FIPS 199 Assessment

Information Technology Resources, the Contractor shall submit a FIPS 199 Assessment within thirty (30) days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard.

See Item 15.(c).3 of Attachment 1 – Additional Terms and Conditions

5. IT Security Certification and Accreditation (IT-SC&A)

Attachment 3 – Reporting and Deliverable Requirements

Information Technology Resources, the Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed within three (3) months after contract award.

The Contractor shall perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid.

See Item 15.(c).4 of Attachment 1 – Additional Terms and Conditions

6. Reporting of New and Departing Employees The Contractor shall notify the Contracting Officer's Representative (COR) and Contracting Officer within five working days of staffing changes for positions that require suitability determinations as follows:

i. New Employees who have or will have access to HHS Information systems or data: Provide the name, position title, e-mail address, and phone number of the new employee. Provide the name, position title and suitability level held by the former incumbent. If the employee is filling a new position, provide a description of the position and the Government will determine the appropriate security level.

See Item 18.(b) of Attachment 1 – Additional Terms and Conditions

ii. Departing Employees: 1) Provide the name, position title, and security clearance level held by or pending for the individual; and 2) Perform and document the actions identified in the "Employee Separation Checklist", when a Contractor/Subcontractor employee terminates work under this contract. All documentation shall be made available to the COR and/or Contracting Officer upon request.

See Items 18(c) of Attachment 1 – Additional Terms and Conditions

7. Contractor - Employee Non-Disclosure Agreement(s)

The contractor shall complete and submit a signed and witnessed "Commitment to Protect Non-Public Information - Contractor Agreement" form for each contractor and subcontractor employee who may have access to non-public Department information under this contract.

This form is located at: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf

See Items 18(d) of Attachment 1 – Additional Terms and Conditions

8. Vulnerability Scanning Reports The Contractor shall report the results of the required monthly special vulnerability scans no later than 10 days following the end of each reporting period. If required monthly, this report may be included as part of the Technical Progress Report. Otherwise, this report shall be submitted under separate cover on a monthly basis.

See Item 20 of Attachment 1 – Additional Terms and Conditions

9. Section 508 Annual Report The contractor shall submit an annual Section 508 report in accordance with the schedule set forth in the ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY Article in SECTION H of this contract. The Section 508 Report Template and Instructions for completing the report are available at: http://www.hhs.gov/web/508/contracting/technology/vendors.html

See Items 23 of Attachment 1 – Additional Terms and Conditions https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf http://www.hhs.gov/web/508/contracting/technology/vendors.html