Attachment_19_-_ISSO_Presol_Cert.pdf

INFORMATION SECURITY PROGRAM REQUIREMENTS

Checklist and Certification (9/11)

RFP/ Contract No: HHS-NIH-NHLBI-SBSS-RG-15-80 Pre Solicitation Review Date:

Project Title: Audio Conferencing

From: Project Officer Patricia Young, patricia.young@nih.gov / Matthew Wise matthew.wise@nih.gov

Name and Contact Information

To: Contract Specialist/ Contract Officer:

Jenn Frazer, jenn.frazier@nih.gov John Turner, john.turner@nih.gov

Name and Contact Information

PRE-SOLICITATION

[ ] INFORMATION SECURITY IS NOT APPLICABLE for this RFP.

[X ] INFORMATION SECURITY IS APPLICABLE and the following information is required for RFP preparation:

A. INFORMATION TYPE ( Attach brief description) http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

[ ] Administrative, Management and Support

Information: Description Attached (e.g. meeting and travel arrangements, developing procedures, manuals)

[ ] Mission Based Information: Description Attached

(e.g. health research, education, training)

B. SECURITY CATEGORIES AND LEVELS (SCL): See SCL table at http://ocio.nih.gov/security/table1.htm

Confidentiality: [ ] Low [X ] Moderate [ ] High Integrity: [ ] Low [ X] Moderate [ ] High Availability: [ ] Low [X ] Moderate [ ] High

Overall: [ ] Low [ X ] Moderate [ ] High

C. POSITION SENSITIVITY DESIGNATIONS (PSD): see PSD table http://ocio.nih.gov/security/table2.htm The following position sensitivity designations and associated clearance and investigation requirements apply under this contract:

[ ] Level 6: Public Trust - High Risk (Requires

Suitability Determination with a BI). Contractor employees assigned to a Level 6 position are subject to a Background Investigation (BI).

[X ] Level 5: Public Trust - Moderate Risk (Requires

Suitability Determination with MBI or LBI).

Contractor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level 1: Non Sensitive (Requires Suitability

Determination with an NACI). Contractor employees assigned to a Level 1 position are subject to a National Agency Check and Inquiry Investigation (NACI).

D. PROSPECTIVE OFFEROR NON-DISCLOSURE

AGREEMENT

[X ] Offerors WILL NOT require access to sensitive information in order to prepare an offer.

[ ] Offerors WILL require access to sensitive information in order to prepare an offer:

Description of sensitive information:

[ ] Systems Security Plan (SSP) NOT Required.

[ X ] Systems Security Plan (SSP) Required.

E. CONTRACT CLAUSES

[ ] See anticipated Clauses Attached. (Pg 2/3)

CERTIFICATION: Based on the above information in items A-D, and contingent upon inclusion of all applicable RFP language prescribed in the RFP Workform, we certify that the solicitation will specify appropriate security requirements necessary to protect the Government’s interest and is in compliance with all Federal and DHHS security requirements.

Project Officer Signature Date

Project Officer Typed Name

_______________________________________April 7, 2015 Information Systems Security Officer Signature Date

__Prema G. Nair____________________________________ Information Systems Security Officer Typed Name mailto:patricia.young@nih.gov mailto:matthew.wise@nih.gov mailto:disommam@nhlbi.nih.gov mailto:john.turner@nih.gov http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://ocio.nih.gov/security/table1.htm http://ocio.nih.gov/security/table2.htm http://www.nhlbi.nih.gov/funding/inits/security/whoswho.htm youngp Stamp frazierje Typewritten Text Attachment 19

Applicable Clauses

ARTICLE C of the solicitation

[ ] Information Security and Physical Access Reporting Requirements

SOLICITATIONS AND CONTRACT THAT INCLUDE THE INFORMATION AND PHYSICAL ACCESS SECURITY ARTICLE IN

SECTION H

[X] Roster of Employees Requiring Suitability Investigations SOLICITATIONS AND CONTRACTS THAT INCLUDE THE INFORMATION AND PHYSICAL ACCESS SECURITY ARTICLE IN

SECTION H

[X ] IT Security Plan (IT-SP) SOLICITATIONS AND CONTRACTS THAT INVOLVE CONTRACTOR ACCESS TO FEDERAL INFORMATION OR FEDERAL

INFORMATION SYSTEMS

[X ] IT Risk Assessment (IT-RA) SOLICITATIONS AND CONTRACTS THAT INVOLVE CONTRACTOR ACCESS TO FEDERAL INFORMATION OR FEDERAL

INFORMATION SYSTEMS

[ ] IT Security Certification and Accreditation (IT-SC&A) SOLICITATIONS AND CONTRACTS THAT INVOLVE CONTRACTOR DEVELOPMENT, MAINTENANCE, AND ACCESS TO

FEDERAL INFORMATION SYSTEM(S)

[ ] Reporting of New and Departing Employees SOLICITATIONS AND CONTRACTS THAT INCLUDE THE INFORMATION AND PHYSICAL ACCESS SECURITY ARTICLE IN

SECTION H

[X] Contractor - Employee Non-Disclosure Agreement(s) SOLICITATIONS AND CONTRACTS THAT INCLUDE THE INFORMATION AND PHYSICAL ACCESS SECURITY ARTICLE IN

SECTION H

[ ] Vulnerability Scanning Reports SOLICITATIONS AND CONTRACTS WHEN THE CONTRACTOR WILL HOST NIH WEB PAGES OR DATABASES

ARTICLE H of the Solicitation

[ ] Information and Physical Access Security CONTRACTOR PERSONNEL MAY REQUIRE ACCESS TO HHS-CONTROLLED FACILITIES AND/OR INFORMATION

SYSTEMS, INCLUDING SENSITIVE DATA/INFORMATION, IN ORDER TO PERFORM THE CONTRACT

[ ] HHS-Controlled Facilities and Information Systems Security CONTRACTOR PERSONNEL MAY REQUIRE ACCESS TO HHS-CONTROLLED FACILITIES AND/OR INFORMATION

SYSTEMS, INCLUDING SENSITIVE DATA/INFORMATION, IN ORDER TO PERFORM THE CONTRACT

[ ] Standard for Security Configurations, HHSAR 352.239-70, (January 2010) SOLICITATIONS AND CONTRACTS THAT INVOLVE THE OPERATION OR ACQUISITION OF AN INFORMATION

TECHNOLOGY SYSTEM

frazierje

[X ] Standard for Encryption language, HHSAR 352.239-71, (January 2010) SOLICITATIONS AND CONTRACTS THAT INVOLVE THE ACQUISITION OR LEASE OF, OR THE REQUIREMENT TO USE, DESKTOP OR LAPTOP COMPUTERS, MOBILE DEVICES, OR PORTABLE MEDIA TO STORE OR PROCESS HHS SENSITIVE INFORMATION THAT THE PROJECT OFFICER CATEGORIZES AS MODERATE OR HIGH UNDER FEDERAL

INFORMATION PROCESSING STANDARD

[X ] Security Requirements For Federal Information Technology Resources, HHSAR 352.239-72, (January 2010) SOLICITATIONS AND CONTRACTS THAT INVOLVE CONTRACTOR ACCESS TO FEDERAL INFORMATION OR FEDERAL

INFORMATION SYSTEMS

[ ] Additional NIH Requirements WHEN INCLUDING THE CLAUSE AT HHSAR 352.239-72, Security Requirements for Federal Information Technology

Resources

[ X] INFORMATION SECURITY TRAINING

WHEN INCLUDING THE CLAUSE AT HHSAR 352.239-72, Security Requirements for Federal Information Technology

Resources.

[ ] PERSONNEL SECURITY RESPONSIBILITIES

WHEN INCLUDING THE CLAUSE AT HHSAR 352.239-72, Security Requirements for Federal Information Technology

Resources

[X ] Loss and/or Disclosure of Personally Identifiable Information (PII) - Notification of Data Breach SOLICITATIONS AND CONTRACTS WHEN CONTRACTOR/SUBCONTRACTOR PERSONNEL WILL HAVE ACCESS TO, OR

USE OF PERSONALLY IDENTIFIABLE INFORMATION (PII), INCLUDING INSTANCES OF REMOTE ACCESS TO OR

PHYSICAL REMOVAL OF SUCH INFORMATION BEYOND AGENCY PREMISES OR CONTROL

[ ] VULNERABILITY SCANNING REQUIREMENTS

SOLICITATIONS AND CONTRACTS WHEN THE CONTRACTOR/SUBCONTRACTOR WILL HOST NIH WEB PAGES OR

DATABASES

frazierje