Attachment_VI_-_IT_Security_Requirements_Instructions_ _Guidance_.pdf

ATTACHMENT VI - IT SECURITY REQUIREMENTS

INSTRUCTIONS & GUIDANCE

NOTE: Contact the COR if unable to access the links that reference documents linked below.

2.A Baseline Security Requirements

2.A.1. Safeguarding Information and Information Systems. The Contractor (and/or any subcontractor) is responsible for the following:

1. On behalf of HHS/NIH/NIEHS, protecting federal information and information systems in order to ensure:

a. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information;

b. Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

c. Availability, which means ensuring timely and reliable access to and use of information.

a. The Contractor is prohibited from subcontracting to companies to conduct HHS business in which foreign governments that support international terrorism have a “significant interest” per 10 U.S.C.

§ 2327 (https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm).

2. Adopting, and implementing the policies, procedures, controls, and standards required by HHS

Information Security Program to ensure the confidentiality, integrity, and availability of federal information and federal information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. The HHS Information

Security Program security requirements are outlined in the HHS IS2P, which is accessible on the HHS

Office of the Chief Information Officer’s (OCIO) website (http://intranet.hhs.gov/it/ocio/).

a. The Information Security Solicitation Checklist and Certification Form (See Appendix A, for the

Information Security Solicitation Checklist and Certification Form) must be completed when the acquisition requires contractor personnel to develop or access federal information systems.

2.A.2. Information Security Categorization. The Contractor/subcontractor will coordinate with the system owner, Contracting Officer Representative (COR) and/or Contracting Officer to categorize the system and information to determine applicable information type(s) and the overall level of risk in accordance with FIPS-199 (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf) and the Federal

Information Processing Standard NIST SP 800-60, “Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories”, Appendix C, Table C-2 at Vol 2

(http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf).

2.A.3. Internet Protocol Version 6 (IPv6). All acquisitions using Internet Protocol must comply with FAR sections: FAR 7.105(b)(5), FAR 11.002(g), and FAR 12.202(e)

(https://www.acquisition.gov/?q=browsefar).

2.A.4. Contract Documentation. The Contractor shall contact the Contracting Officer and/or COR for any

NIEHS templates, policies, forms and other documents necessary to comply with the requirements of this section. All contract deliverables shall be compliant with Section 508

(http://www.hhs.gov/ocio/policy/508_policy.html#3Scope).

https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm http://www.hhs.gov/ocio/policy/index.html http://www.hhs.gov/ocio/policy/index.html http://intranet.hhs.gov/it/ocio/ http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf https://www.acquisition.gov/?q=browsefar http://www.hhs.gov/ocio/policy/508_policy.html#3Scope

2.A.5. Contractor Agreement. The Contractor (and/or any subcontractor), performing under this contract, shall not release, publish, or disclose non-public federal information to unauthorized individuals. The confidentiality, integrity, and availability of such information shall be protected by the Contractor in accordance with the governing laws and regulations listed as follows:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

(https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

(https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf)

- Public Law 96-511 (Paperwork Reduction Act) (http://ciog6.army.mil/Portals/1/Policy/Paper Reduction

1980.pdf)

2.A.6. Privacy or Security Safeguards (FAR Clause 48 CFR § 52.239-1). The Contractor(and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.239-1 privacy and security requirements, which can be located at: https://www.acquisition.gov/?q=browsefar. If new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

2.A.7. Confidential Information (HHSAR Clause 48 CFR § 352.224-71). The Contractor (and/or any subcontractor) shall comply with HHSAR Clause 48 CFR § 352.224-71 requirements, which can be located at: http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html.

2.A.8. Privacy Threshold Analysis (PTA) – The contractor will support the creation of new PTA forms and

PIA forms as required.

1. The Contractor shall assist the Senior Agency Official for Privacy (NIEHS PRIVACY OFFICER) (or his or her designee) with conducting a PTA (using the Privacy Impact Assessment [PIA] form) for the information system and/or information collection project to determine whether or not a full PIA needs to be completed (http://intranet.hhs.gov/it/cybersecurity/fisma/sport/faq_pia/).

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the NIEHS

PRIVACY OFFICER (or his or her designee) and other designated authorities with completing a

PIA for the system or project within after completion of the PTA.

b. The PIA shall be completed in accordance with HHS policy, OMB M-03-22, Guidance for

Implementing the Privacy Provisions of the E-Government Act of 2002

(https://www.whitehouse.gov/omb/memoranda_m03-22) and shall be revised at each milestone during the system development lifecycle (SDLC).

c. PIAs and PTAs are required in the early stages of system development. PIAs must be reviewed within 3 years of the last PIA approval date and/or updated as needed based on a major change to the system or when new types of PII are collected, that introduces new or increased privacy risks.

HHS Privacy Officers are listed here: http://intranet.hhs.gov/it/cybersecurity/privacy/#header1. Some of them may also be HHS Privacy Act Contacts, mentioned in Section 3.

https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf http://ciog6.army.mil/Portals/1/Policy/Paper%20Reduction%201980.pdf http://ciog6.army.mil/Portals/1/Policy/Paper%20Reduction%201980.pdf https://www.acquisition.gov/?q=browsefar http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html http://intranet.hhs.gov/it/cybersecurity/fisma/sport/faq_pia/ http://intranet.hhs.gov/it/cybersecurity/privacy/#header1

2.D Incident Response

2.D.1. Per FAR 52.239-1, if new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

2.D.2. The Contractor (and/or any subcontractor) shall report all suspected and confirmed information security and privacy incidents to the COR and Contract Officer including incidents involving personally identifiable information (PII), in electronic or physical form, within 1 hour of discovery. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised.

1. Pursuant to 45 C.F.R. § 164.308(a)(6), Business Associates must implement policies and procedures to address security incidents; identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the Business

Associates; document security incidents and their outcomes; and require their subcontractors to do the same.

2. Pursuant to 45 C.F.R. § 164.314(a)(2)(i)(C), Business Associates must report to Covered Entities any security incident of which they become aware, including breaches of unsecured protected health information as required by 45 C.F.R. § 164.410. Pursuant to 45 C.F.R. § 164.410(c), such notification must include, to the extent possible, the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the Business Associate to have been accessed, acquired, used, or disclosed during the breach.

2.D.3. In the event of an information security or privacy incident, the Government may suspend or revoke an existing Authority to Operate (ATO) (either in part or in whole). If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the Contractor (and/or any subcontractor) to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor (and/or any subcontractor) IT system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

2.D.4. The Contractor (and/or any subcontractor) shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Incident response activities determined to be required by the Government may include, but are not limited to, the following:

1. Inspections,

2. Investigations,

3. Forensic reviews,

4. Containment and damage assessment, and

5. Data analysis and processing.

2.J Contract Initiation and Close Out

2.J.1. General Security Requirements. IT security requirements must be incorporated into all phases of program planning and execution, from budgeting to close-out and the implementation of those requirements should align with the HHS Enterprise Performance Life Cycle (EPLC). The Contractor

(and/or any subcontractor) shall comply with security requirements, EPLC processes, and HHS

Enterprise Architecture requirements, to ensure proper and confidential handling of data and information (including privacy data and information). All IT systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology

(http://www.hhs.gov/ocio/eplc-lifecycle-framework.pdf) and the HHS Contract Closeout Guide

(2012).

2.J.2. Providing System Documentation at Contract Close Out. Contractors (and/or any subcontractors) must follow and adhere to National Institute of Standards and Technology NIST SP 800-64, Security

Considerations in the System Development Life Cycle (latest revision), at a minimum, for system development. This requirement may include providing system documentation at designated intervals

(specifically, at the close out of the contract) within the EPLC that require artifact review.

2.J.3. Certification of Sanitization of Government and Government-Activity-Related Files and

Information. As part of contract closeout, the Contractor shall submit the certification to the COR and/or Contracting Officer following the template provided in NIST SP 800-88, Guidelines for Media

Sanitization (http://www.nist.gov/manuscript-publication-search.cfm?pub_id=50819).

2.J.4. Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all HHS provided information and IT resources (to include contractor-owned and/or sub-contractor systems and backup systems) for this contract at completion of contractor performance to the CO and/or COR. Additionally, the Contractor shall certify that all

HHS information has been properly sanitized and purged, in accordance with HHS and/or NIH policies, from Contractor-owned (and/or any subcontractor) systems, including backup systems, used during contract performance.

2.J.5. Failure to Comply. Failure on the part of the Contractor (and/or any subcontractor) to comply with the terms and conditions stated within this document may be grounds for the Contracting Officer to terminate this contract.

2.K Audit Record Retention

2.K.1. The Contractor (and/or any subcontractor) shall support a system in accordance with the requirement for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20

(http://www.gpo.gov/fdsys/granule/CFR-2011-title36-vol3/CFR-2011-title36-vol3-sec1236-20) &

1236.22 (http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25) (ref. a), including but not limited to capabilities such as those identified in:

1. NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records

(https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html),

2. NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing

Environments (ref 8).

These provide requirements for maintaining records to retain functionality and integrity throughout the records’ full lifecycle including:

1. Maintenance of links between records and metadata, and

2. Categorization of records to manage retention and disposal, either through transfer of permanent http://www.hhs.gov/ocio/eplc-lifecycle-framework.pdf http://www.nist.gov/manuscript-publication-search.cfm?pub_id=50819 http://www.gpo.gov/fdsys/granule/CFR-2011-title36-vol3/CFR-2011-title36-vol3-sec1236-20 http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25 https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

3.A Privacy Incident Handling and Notification

The Contractor (and/or any subcontractor) shall obtain notification instructions and approval from the Contracting

Officer prior to notifying individuals whose PII resided in the Contractor (and/or any subcontractor) IT system at the time of the incident. The method and content of any notification by the Contractor shall be compliant with

HHS Privacy Incident Response Team (PIRT) Standard Operating Procedures (SOP)

(http://intranet.hhs.gov/it/cybersecurity/docs/incident_mgmt/PIRTSOP/pirt_sop.pdf) and NIH OCIO and NIH IRT

Guidance as well as coordinated and approved by the HHS PIRT in consultation with the Contracting Officer, the

NIEHS PRIVACY OFFICER (or his or her designee), and/or Computer Security Incident Response Team

(CSIRT). Upon receiving notification and approval from the agency Contracting Officer, the Contractor shall send notifications to affected individuals within 3 days..

3.A.1. All determinations related to privacy incidents, including response activities, notifications to affected individuals and/or federal agencies, and related services (e.g., credit monitoring and identity protection) will be made in writing by the Contracting Officer in consultation with the HHS PIRT, NIH OCIO, and NIEHS

PRIVACY OFFICER (or his or her designee) and in compliance with HHS and/or NIH Guidance.

3.A.2. The Contractor (and/or any subcontractor) shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Incident response activities determined to be required by the Government may include, but are not limited to, the following:

1. Inspections,

2. Investigations,

3. Forensic reviews, and

4. Data analysis and processing.

3.B Privacy Plan

The Government will ensure the Contractor’s System Security Plan (SSP) is compliant, appropriate and compliant with HHS IS2P.

3.C Privacy Act

3.C.1. Privacy Act Notification (FAR Clause 48 CFR § 52.224-1). The Contractor (and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.224-1 requirements, which can be located at: https://www.acquisition.gov/?q=browsefar.

3.C.2. Privacy Act (FAR Clause 48 CFR § 52.224-2). The Contractor (and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.224-2 requirements, which can be located at:

https://www.acquisition.gov/?q=browsefar.

3.C.3. Privacy Act (HHSAR Clause 48 CFR §352.224-70). The Contractor (and/or any subcontractor) http://intranet.hhs.gov/it/cybersecurity/docs/incident_mgmt/PIRTSOP/pirt_sop.pdf shall comply with HHSAR Clause 48 CFR §352.224-70 requirements, which can be located at:

http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html.

4.A Security Requirements for GOCO and COCO Resources

4.A.1. Contractor Security Deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security requirements to the COR and/or Contracting Officer and

System Owner or designated representative for review, comment, and acceptance, when applicable and identified in the deliverables section of the contract. All deliverables shall comply with applicable federal laws that include, but are not limited to, the Federal Information Security Modernization Act (FISMA) of

2014, (Title III of the E-Government Act of 2002, Public Law 107-347), Office of Management and

Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of

Federal Automated Information Resources, Federal Acquisition Regulation (FAR) 39.101

(https://www.acquisition.gov/?q=/browse/far/39), HHS Acquisition Regulation (HHSAR) Subpart

311.70—Section 508 Accessibility Standards (http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-311-describing-agency-needs/index.html#311.7000) and other applicable federal laws, regulations, NIST guidance and Departmental policies excluding cloud service providers (those requirements are included in Section 5).

4.A.3. Information Security Continuous Monitoring. All Contractor/subcontractor-owned/operated systems that input, store, process, output, and/or transmit HHS information shall meet or exceed the information security continuous monitoring (ISCM) requirements in accordance with FISMA and NIST

SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and

Organizations, as amended (http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-

137.pdf), and HHS IS2P. The agency may elect to perform ISCM and vulnerability scanning of

Contractor (and/or any subcontractor) systems and environment from Government tools and infrastructure and/or request ad-hoc ISCM reports throughout the live of the contract.

1. Asset Management. The contractor (and/or any subcontractor) shall use any available Security Content

Automation Protocol (SCAP)-compliant automated tools for active/passive scans to provide an inventory of all information technology (IT) assets for both hardware and software, (computers, servers, routers, databases, operating systems, etc.) that are processing HHS owned information/data. It is anticipated that this inventory information will be required to be produced. The contractor (and/or any subcontractor) shall be capable of providing detailed IT asset inventory information, to include IP address, machine name, operating system level, security patch level, and SCAP-compliant format information. The contractor (and/or any subcontractor) shall maintain a capability to provide an inventory of 100% of its IT assets using SCAP-compliant automated tools.

2. Configuration Management. The contractor (and/or any subcontractor) shall use available SCAP-compliant automated tools, per NIST IR 7511

(http://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.7511r4.pdf), for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that store and process HHS information/data.

Compliance will be measured using IT assets and standard HHS and government configuration baselines. The contractor shall maintain a capability to provide security configuration compliance information for 100% of its IT assets using SCAP-compliant automated tools.

3. Vulnerability Management. The contractor (and/or any subcontractor) shall use SCAP-compliant automated tools for authenticated scans to detect any security vulnerabilities in all information technology (IT) assets, (computers, servers, routers, Web applications, databases, operating systems, etc.) that store and process HHS information/data. Contractors (and/or any subcontractors) shall actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with HHS policy. Automated tools shall be compliant with NIST specified SCAP standards http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html https://www.acquisition.gov/?q=/browse/far/39 http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-311-describing-agency-needs/index.html#311.7000 http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-311-describing-agency-needs/index.html#311.7000 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf http://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.7511r4.pdf for vulnerability identification and management. The contractor (and/or any subcontractor) shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets using

SCAP-compliant automated tools and report to the agency.

4. Continuous Patching and Vulnerability Remediation. The contractor (and/or any subcontractor) shall install vendor released/ security patches and remediate critical and high vulnerabilities in systems processing HHS information/data in an expedited manner, within 30 days.

5. Secure Coding. The contractor (and/or any subcontractor) shall follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards (https://buildsecurityin.us-cert.gov/resources/secure-coding-sites) and the Open Web

Application Security Project (OWASP)

(https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide), that will limit system software vulnerability exploits.

6. End of Life Compliance. The contractor (and/or any subcontractor) must use Commercial Off The Shelf

(COTS) software or other software that is supported by the manufacturer. In addition, the COTS/other software needs to be within one major version of the current version; deviation from this requirement will only be allowed via the HHS waiver process (approved by HHS CISO). The contractor (and/or any subcontractor) shall retire and/or upgrade all software/system that have reached end-of-life in accordance with HHS End-of-Life Policy (http://intranet.hhs.gov/it/cybersecurity/policies/index.html ).

4.A.4. Standard for Security Configurations. The Contractor (and/or any subcontractor) shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS (http://intranet.hhs.gov/it/cybersecurity/enterprise_security/config_mgmt/).

4.A.5. Desktop and/or Laptop Computers Required for Use by the Contractor. The Contractor (and/or any subcontractor) shall ensure that IT equipment that is used to process information on behalf of HHS are deployed and operated in accordance with approved security configurations, as follows:

1. The Contractor (and/or any subcontractor) shall configure its computers that contain HHS data in accordance with the latest applicable United States Government Configuration Baseline (USGCB)

(http://usgcb.nist.gov/), FAR Subpart 39.101(c) (https://www.acquisition.gov/?q=/browse/far/39), and/or other approved HHS IT security configurations.

2. The Contractor (and/or any subcontractor) shall ensure that its computers have and maintain the latest operating system patch release and anti-virus software definitions.

3. The Contractor (and/or any subcontractor) shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

4. The Contractor (and/or any subcontractor) shall validate the configuration settings after hardware and software installation, operation, maintenance, update, and patching.

5. The Contractor (and/or any subcontractor) shall use automated means to ensure that its computers remain in compliance with the above configuration requirements by:

a. Configuring its systems to allow for periodic HHS vulnerability and security configuration assessment scanning; or where such outside scanning is not practicable.

b. Using Security Content Automation Protocol (SCAP)-validated tools with USGCB Scanner capabilities to scan its systems on at least a monthly basis and report the results of these scans to the

COR and/or Contracting Officer, Project Officer, and any other applicable designated POC.

4.A.6. Other Computing Devices Required for Use by the Contractor. These computing devices include https://buildsecurityin.us-cert.gov/resources/secure-coding-sites https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide http://intranet.hhs.gov/it/cybersecurity/policies/index.html http://intranet.hhs.gov/it/cybersecurity/enterprise_security/config_mgmt/ http://usgcb.nist.gov/ https://www.acquisition.gov/?q=/browse/far/39 ancillary and peripheral IT devices as well as other computing servers, but not desktop and/or laptop computers).

1. The Contractor (and/or any subcontractor) shall ensure that information technology (IT) that is used to process information on behalf of HHS are deployed and operated in accordance with approved security configurations, as follows:

a. The Contractor (and/or any subcontractor) shall configure all ancillary and peripheral IT devices and computers that are not desktops or laptops (e.g. servers, routers, mobile devices, etc.) that store and/or transport HHS data, in accordance with the applicable HHS and/or NIH requirements and ensure that they have and maintain the latest operating system patch level and anti-virus software level, when applicable.

b. The Contractor (and/or any subcontractor) shall ensure that all ancillary and peripheral IT devices and other computing devices, as applicable, have and maintain the latest operating system patch release and anti-virus software definitions.

c. The Contractor (and/or any subcontractor) shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

d. The Contractor (and/or any subcontractor) shall validate the configuration settings after hardware and software installation, operation, maintenance, update, and patching.

e. The Contractor (and/or any subcontractor) shall use automated means to ensure that its computers remain in compliance with the above configuration requirements by:

i. Configuring systems to allow for periodic HHS vulnerability and security configuration assessment scanning; or where such outside scanning is not practicable.

ii. Using Security Content Automation Protocol (SCAP)-validated tools, per NIST IR 7511

“SCAP Version 1.2 Validation Program Test Requirements, Rev. 4”

(http://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.7511r4.pdf), to scan its systems on at least a

30 days and report the results of these scans to the COR and/or Contracting Officer.

4.A.7. Confidentiality and Nondisclosure of Information

1. Personnel working on any of the described tasks may, at HHS’ request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of HHS information and documents.

2. Any information made available to the Contractor (and/or any subcontractor) by HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any HHS record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030

(https://www.gpo.gov/fdsys/granule/USCODE-2010-title18/USCODE-2010-title18-partI-chap47-sec1030/content-detail.html).

http://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.7511r4.pdf

5.A HHS FedRAMP Privacy and Security Requirements

5.A.1. The Contractor (and/or any subcontractor) shall be responsible for the following privacy and security requirements:

1. The Contractor (and/or any subcontractor) shall comply with FedRAMP Security Assessment and

Authorization (SA&A) and continuous monitoring requirements to safeguard against threats and hazards to the, integrity and confidentiality of HHS data collected and stored .

2. The Contractor (and/or any subcontractor) shall apply the appropriate set of impact baseline controls commensurate with the agency defined security categorization and FedRAMP Cloud Computing

Security Requirements Baseline and NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations (as amended)

(http://csrc.nist.gov/publications/PubsSPs.html). The Contractor shall also include a set of additional controls for use within systems providing cloud services to the federal government as identified by the agency and maintain a continuous monitoring environment that meets or exceeds the requirements contained herein.

3. The Contractor (and/or any subcontractor) shall comply with current and future FedRAMP and HHS privacy and security requirements.

4. If new or unanticipated threats or hazards are discovered by either the agency or the Contractor, or if existing safeguards have ceased to function, then the discoverer shall immediately (within 1 hour or less) bring the situation to the attention of the other party.

5. As specified in the FAR section 52.239-1, available at: https://www.acquisition.gov/?q=/browse/far/52), Contractor (and/or any subcontractor) shall be responsible for the following requirements:

a. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, and availability of federal data, the Contractor shall afford

HHS access to the Contractor’s (and/or any subcontractor’s) facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of notification. The program of inspection shall include, but is not limited to:

i. Authenticated and unauthenticated operating system/network vulnerability scans.

ii. Authenticated and unauthenticated web application vulnerability scans.

iii. Authenticated and unauthenticated database application vulnerability scans.

iv. Automated scans can be performed by HHS personnel, or agents acting on behalf of the HHS, using Government operated equipment, and Government specified tools.

v. If the Contractor (and/or any subcontractor) chooses to run its own automated scans or audits, then the results from these scans may, at HHS’s discretion, be accepted in lieu of HHS performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by HHS. In addition, the results of Contractor-conducted (and/or any subcontractor) scans shall be provided, in full, using NIST Security Content Automation Protocol (SCAP) standards, to HHS, upon request.

http://csrc.nist.gov/publications/PubsSPs.html https://www.acquisition.gov/?q=/browse/far/52

5.A.2. Protection of Information in Cloud Environment

1. The Contractor (and/or any subcontractor) shall be responsible for properly protecting and safeguarding all information used, gathered, or developed as a result of work under this contract.

2. The Contractor (and/or any subcontractor) shall also protect all HHS data (including data at rest), equipment, etc. by treating the information as sensitive.

3. If contractor (and/or any subcontractor) personnel must remove any information from the primary work area they shall protect it to the same extent they would their proprietary data and/or company trade secrets and in accordance with the HHS Standard for Encryption of Computing Devices

(http://www.hhs.gov/ocio/policy/2009-0002.001s.html).

4. HHS will retain unrestricted rights to government data. HHS retains ownership of any user created/loaded data and applications hosted on contractor’s infrastructure, as well as maintains the right to request full copies of these at any time.

5. The data that is processed and stored by the various applications within the network infrastructure may contain sensitive information such as financial data and PII. This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction.

6. The Contractor (and/or any subcontractor) shall ensure that the facilities that house the network infrastructure are physically secure.

7. The data must be available to HHS upon request within one (1) business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The

Contractor (and/or any subcontractor) shall provide requested data at no additional cost to the HHS.

8. The contractor shall support a system in accordance with the requirement for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to capabilities such as those identified in:

• NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email

Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html),

• NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing Records in Cloud Computing

Environments (ref 8) (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html).

These provide requirements for maintaining records to retain functionality and integrity throughout the records’ full lifecycle including:

• Maintenance of links between records and metadata, and

• Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

9. All information about the systems gathered or created under this contract shall be considered as

Controlled Unclassified Information (CUI) and marked appropriately.

a. CUI, sensitive/proprietary data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis.

http://www.hhs.gov/ocio/policy/2009-0002.001s.html https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html

b. Contractors (and/or any subcontractors) processing CUI incidental to developing a product or service for the NIEHS must meet the requirements of NIST SP 800-171

(http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf).

c. When no longer required, this information and/or data will be returned to HHS control, destroyed, or held until otherwise directed. Destruction of information and/or data shall be accomplished by following NIST SP 800-88, Guidelines for Media Sanitization

(http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf).

10. The disposition of all HHS data shall be at the written direction of HHS/NIH. This may include documents returned to HHS control; destroyed; or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the COR

(https://www.fedramp.gov/files/2015/03/FedRAMP_Standard_Contractual_Clauses_062712_0.pdf).

11. Contractors (and/or any subcontractors) shall support a secure, multi-factor method of remote authentication and authorization to identified administrators that will allow contractor (and/or any subcontractor) designated personnel the ability to perform management duties on the system.

5.A.3. Confidentiality and Nondisclosure of Information in Cloud

1. Personnel working on any of the described tasks may, at HHS request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of HHS information and documents.

2. Any information made available to the Contractor (and/or any subcontractor) by HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract.

In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any HHS record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030

(https://www.gpo.gov/fdsys/granule/USCODE-2010-title18/USCODE-2010-title18-partI-chap47-sec1030/content-detail.html).

5.A.4. Security Baseline Requirements

The minimum requirements for Low, Moderate and High impact cloud systems are contained within the

FedRAMP Cloud Computing Security Requirements Baseline as per FedRAMP Security Plan templates and NIST SP 800-53 latest revision (available at https://www.fedramp.gov/resources/templates-3/ and http://csrc.nist.gov/publications/PubsSPs.html). In addition, the HHS IS2P, HHS FedRAMP Memo and

HHS FedRAMP SOP (as amended) (http://intranet.hhs.gov/it/cybersecurity/policies/index.html) provide details regarding HHS policies as well as roles and responsibilities.

5.A.5. Security Assessment and Authorization (SA&A) Process

1. The contractor (and/or any subcontractor) shall comply with HHS and FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The level of effort for the SA&A is based on the system’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf https://www.fedramp.gov/files/2015/03/FedRAMP_Standard_Contractual_Clauses_062712_0.pdf https://www.gpo.gov/fdsys/granule/USCODE-2010-title18/USCODE-2010-title18-partI-chap47-sec1030/content-detail.html https://www.gpo.gov/fdsys/granule/USCODE-2010-title18/USCODE-2010-title18-partI-chap47-sec1030/content-detail.html https://www.fedramp.gov/resources/templates-3/ http://csrc.nist.gov/publications/PubsSPs.html http://intranet.hhs.gov/it/cybersecurity/policies/index.html

a. A security control assessment must be conducted by a FedRAMP third-party assessment organization (3PAO) for the ATO, annually thereafter and whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan. A listing of FedRAMP accredited 3PAOs is available on FedRAMP at: http://www.fedramp.gov/.

b. A SA&A package must be created and maintained for all cloud services. For all CSPs, the following documentation must be developed and maintained using FedRAMP templates

(http://www.fedramp.gov/):

Privacy Impact Assessment (PIA)

FedRAMP Test Procedures and Results

Security Assessment Plan (SAP)

Security Assessment Report (SAR)

System Security Plan (SSP)

IT System Contingency Plan (CP)

IT System CP Test Results

Plan of Action and Milestones (POA&M)

Continuous Monitoring Plan (CMP)

FedRAMP Control Tailoring Workbook

Control Implementation Summary Table

Results of Penetration Testing

Software Code Review

E-Authentication Questionnaire

System of Record Notice (SORN)

Interconnection Agreements/Service Level Agreements/Memorandum of Agreements

2. HHS reserves the right to perform Penetration Testing. If HHS exercises this right, the Contractor

(and/or any subcontractor) shall allow HHS employees (and/or designated third parties) to conduct

Security Assessment activities to include control reviews in accordance with HHS requirements.

Review activities include, but are not limited to, scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

3. Identified gaps between required FedRAMP Security Control Baseline and Continuous Monitoring controls and the contractor’s implementation as documented in the Security Assessment Report and related Continuous Monitoring artifacts shall be tracked by the contractor for mitigation in a Plan of

Action and Milestones (POA&M) document. Depending on the severity of the risks, HHS may require them to be remediated before a HHS Authorization is issued.

4. The Contractor (and/or any subcontractor) is responsible for mitigating all security risks found during

Assessment and Authorization and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 daysand all moderate risk vulnerabilities must be mitigated within 30 daysfrom the date vulnerabilities are formally identified. HHS will determine the risk rating of vulnerabilities using FedRamp baselines.

5. Revocation of a Cloud Service. CSPs with systems authorized by HHS or HHS NIHs/NIEHSs are expected to comply with FedRAMP requirements, federal regulations, FedRAMP guidance, and meet the conditions provided on their ATO letter. If the CSP fails to meet these requirements, HHS and HHS

NIHs/NIEHSs have the right to take action in response to the CSP’s lack of compliance.

http://www.fedramp.gov/ http://www.fedramp.gov/

FedRAMP requirements set the following minimum requirements for CSPs that have been authorized:

Establish a Continuous Monitoring plan that aligns with FedRAMP’s continuous monitoring requirements

Implement the continuous monitoring activities as outlined in the CSP’s approved Continuous

Monitoring Plan

Mitigate all open low, moderate, and high findings and corresponding POA&Ms

Ensure significant changes or critical vulnerabilities and incidents are managed in accordance with applicable Federal law, guidelines, and policies and that the HHS Cloud Security Team is notified in a timely manner.

In extreme cases, corrective actions could include a risk-based decision to revoke a CSP’s ATO and require cessation of operations if necessary and feasible. The FedRAMP SOP (as amended) provides

HHS’s escalation processes when a CSP fails to adhere to requirements.

5.A.6 Reporting and Continuous Monitoring

CSPs that receive a FedRAMP Compliant Agency ATO are required to perform continuous monitoring, provide continuous monitoring evidence as required by FedRAMP, and also meet with the CST and

CSWG to discuss the system’s status and findings on a monthly basis.

The CST will work with the CSP to schedule the monthly continuous monitoring meetings.

CSPs are expected to provide the following artifacts on monthly basis:

Completed Continuous Monitoring summary slide deck using the HHS Continuous Monitoring summary template (Findings and POA&M summary, Summary of any Incidents, Change

Management Schedule)

Operating system and network vulnerability scan results

Database vulnerability scan results

Web application vulnerability scan results

Updated POA&Ms

Any updated authorization package documents as required by the annual attestation or as requested by the CST or Authorizing Official

Information on changes to the CSP’s system

IMPORTANT NOTE: CSPs are required to provide their continuous monitoring summary and evidence at least 3 days before their scheduled monthly meeting.

The FedRAMP deliverables shall be labeled “CONTROLLED UNCLASSIFIED INFORMATION” (CUI) or contractor selected designation per document sensitivity. External transmission/dissemination of FOUO and CUI to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security Requirements for Cryptographic Modules”

(http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf).

5.A.7 Configuration Baselines. The contractor shall certify applications are fully functional and operate correctly as intended on systems using the, US Government Configuration Baseline (USGCB)

(http://usgcb.nist.gov/), DISA Seccurity Techinical Implementation Guides (STIGs), Center for

Information Security (CIS) Security Benchmarks or any other HHS identified configuration baseline. The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved HHS/NIH configuration baselines.

5.A.8. Offerings that require installation should follow OMB Memorandum 07-18

(http://www.gsa.gov/portal/mediaId/213135/fileName/Common_Sec_Config.action). Applications http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://usgcb.nist.gov/ http://www.gsa.gov/portal/mediaId/213135/fileName/Common_Sec_Config.action designed for normal end users shall run in the standard user context without elevated system administration privileges.

1. The contractor shall use Security Content Automation Protocol (SCAP) validated tools

(http://scap.nist.gov/) with configuration baseline scanner capability to certify their products operate correctly with HHS defined configurations and do not alter these settings.

2. As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104

(https://www.acquisition.gov/far/html/Subpart%2024_1.html), if the system involves the design, development, or operation of a system of records on individuals, the contractor shall implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy

Act” (https://www.acquisition.gov/?q=/browse/far/52).

3. The contractor shall cooperate in good faith in defining non-disclosure agreements that other third parties must sign when acting as the Federal government’s agent.

5.A.9. Data Jurisdiction. The contractor shall identify all data centers, within the accreditation boundary, that the data at rest or data backup will reside.

5.A.10. Interconnection Agreements/Service Level Agreements/Memorandum of Agreements. (Add when applicable) The Contractor shall understand the terms of the service agreements that define the legal relationships between cloud customers and cloud providers.

5.A.11. FIPS-140 Validated Cryptography for Secure Communications. All deliverables shall be labeled according to any applicable NIH guidance from the NIH OCIO. External transmission/dissemination of labeled deliverables to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2 “Security Requirements for Cryptographic

Modules” or the updated cryptographic standard, as applicable.

5.A.12. Incident Reporting

HHS expects that CSPs are able to demonstrate how they respond to security incidents as required by

FedRAMP. CSPs are required to follow the Incident Response Plan as approved by HHS. CSPs are also required to follow the incident response and US-CERT reporting guidance contained in the FedRAMP

Incident Communications Procedure, with additional requirements added by HHS

When HHS is the primary AO and the CSP’s authorization package that is stored for re-use by Federal

Agencies in the FedRAMP Secure Repository is based on a HHS FedRAMP Agency ATO letter, all incidents that…