Trusted_Integration_SOW.PDF

Statement of Work

(8/14/2018)

PROJECT TITLE:

TrustedAgent FISMA and C&A Software and Support

1.0 DELIVERY ORDER

This Statement of Work (SOW) is for non-severable professional Information Technology (IT) services and licenses for Trusted Integration's TrustedAgent FISMA 1 and Certification & Accreditation (C&A) software.

The non-severable professional IT services and software licenses specified herein are being acquired from Trusted Integration, Inc., 525 Wythe Street, Unit G, Alexandria, VA 22314-1026, under the company's General Services Administration (GSA) Federal Supply Schedule (FSS) Contract No. GS- 35F-0259N under Source 70, General Purpose Information Technology Equipment, Sofn-vare and Services. The following GSA FSS Category Numbers are applicable to this SOW:

132-33, Pe,petual So/Mare Licenses

132-34, Sofn-vare Maintenance 132-51, Information Technology (IT) Services

2.0 PURPOSE

The purpose of this requirement is to acquire licenses for Trusted Integration's TrustedAgent FISMA and C&A brand name software products, as well as professional support services, for the Office of the Chieflnformation Officer (OCIO), Office of the Director (OD), National Institutes of Health (NIH).

3.0 BACKGROUND

The mission of the National Institutes of Health (NIH) is to uncover new knowledge that will lead to better health for everyone. NIH works toward that mission by: conducting research in its own laborato1ies; suppo1iing the research of non-Federal scientists in universities, medical schools, hospitals, and research institutions throughout the country and abroad; helping in the training of research investigators; and fostering communication of biomedical infom1ation.

NIH consists of twenty-seven Institutes/Centers (I Cs), each having ptime responsibility for a particular facet of biomedical research and research administration. Each IC has its own internal management structure; however, ICs collaborate and cooperate in fulfilling the NIH mission.

Federal Information Security Management Act (FISMA)

Statement of Work: TrustedAgent FISMA & C&A Software & Support Pagel of20

The NIH OCIO serves the NIH community by providing leadership and management support to ensure that NIH l&IT investments and resources supporting administrative, scientific, and research activities. are well planned, effectively managed, in compliance with federal policies and mandates, adaptable tt( the l&lT architecture, and well secured. Ultimately, the mission of the CIO is to ensure that lT deli\�er:, the most value to the NIH at the least cost.

The OClO (I) advises the NIH Director on the strategic direction and management of significant NIH I&lT program and policy activities; (2) provides leadership for the enhancement of NIH T&lT capabilities, scientific and research computing services, and enterprise systems through policies, guidelines and standards, budget management, and lifecycle performance monitoring; (3) provides leadership for the enhancement of NIH I&IT capabilities, scientific and research computing services, and enterprise systems through policies, guidelines and standards, budget management, and lifecycle performance monitoring; (4) directs the establishment of a common infrastructure and enterprise architecture that optimizes NII-I's I&IT investments and that can adapt to emerging technologies and service models; (5) leads I&IT security initiatives to protect and secure NII-I's infonnation assets; (6) oversees the NIH-wide I&IT investment po1ifolio, inclusive of Institute and Center (IC), Center for Information Technology (CIT), and enterprise systems; (7) approves the progress of enterprise projects through the mandated DHHS Enterp1ise Perfonnance Life Cycle (EPLC) process; (8) identifies critical I&IT issues and analyzes, plans, and leads NIH's implementation of special HHS or Federal initiatives related to management of I&IT resources; (9) leads I&IT governance structure to align I&IT with NIH strategies and objectives; (10) leads the implementation of enterprise architecture policies, standards, and practices; (11) leads NIH !&IT suppo1i effo1is on medical initiatives such as Elech·onic Health Record; and (12) provides leadership and focus within NIH for the development and implementation of policy and standards in I&IT by identifying, documenting, and communicating issues, problems, and solutions to the NIH community in a comprehensive way.

FISMA, which is paii of the Electronic Government Act of 2002, requires federal agencies to establish risk-based, cost-effective infonnation security programs and provides a comprehensive framework for agencies to ensure the security of their infonnation. Agencies are required to submit pe1iodic progress reports to the Office of Management and Budget (0MB) to show compliance with FISMA in areas such as self-assessments, corrective actions, testing and evaluation, privacy, and continuity of operations. An essential part of ensuring FISMA compliance is conducting certification and accreditation (C&A) of IT systems which demonstrates that system controls are implemented correctly, effectively, and commensurate with potential risks. Agencies that do not comply with FISMA risk budget or resource reductions.

0MB is continually increasing FISMA reporting requirements resulting in additional oversight responsibilities. In addition, the Office of the Inspector General (OIG), Depa1iment of Health and Human Services (HHS), conducts an annual evaluation of the NIH Information Technology (IT) Security Program to detennine FISMA compliance. If the OIG identifies material weaknesses and reportable conditions, OClO requires additional resources to address and report on corrective actions. NIH requires the use of enterprise-management software tools that assist in complying with FISMA. Such tools help NIH to protect the confidentiality, integrity, and availability of information while preventing significant findings and material weaknesses for NIH and HHS.

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 2 of 20

NIH requires an automated system to capture and manage information relevant to NlH IT Security Program compliance and FISMA compliance in order to meet FISMA requirements and improve the IT security posture of NIH systems. The software must provide a means to input and store system life cycle status, C&A status and suppo1iing documentation status, system security weaknesses and associated plan of action and milestones status. The software must be web based, run in the existing NJH architecture, and comply with the NIH Enterprise Architecture and NJH IT Security Standards.

The software tools must provide NIH with FJSMA project oversight and monitoring, data collection, and analysis. The tools must also provide inheritability and reusability of common controls for systems that reside on General Support Systems (GSS).2 An impo1iant component of the NIH C&A framework is that common security controls apply to multiple, dependent systems.

4.0 OBJECTIVE

The object of this SOW is to acquire commercially-available compliance solutions software products and professional suppo1i services that will provide substantial assistance to NIH in complying with FlSMA by enabling NIH to meet 0MB repo1iing requirements, and by improving oversight of the NIH

IT Security Program. It will also enable NIH to consolidate fragmented FISMA infomrntion through a central repository by assisting OCIO and the NIH Institutes/Centers (!Cs) in managing the status of security practices and controls so that resources are directed to the areas in most need ofremediation as well as reduce costs associated with FISMA reporting by automating reporting, reducing redundant effmis, and reusing common security controls where applicable. In addition, this SOW will provide a software product that will allow NIH users to establish built-in automatic reminders of due dates for FISMA deliverables; track infomrntion for all major deliverables of the C&A process; and automate and standardize the development of C&A packages by creating enterprise-wide, customized templates for all phases of the C&A process that can be used for an inventory of all systems.

5.0 SCOPE OF WORK

The Contractor shall provide TrustedAgent FISMA and C&A enterprise-management software tools and professional suppo1i services as specified in the Task Areas below.

6.0 TASK AREAS

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary professional suppmi services and software, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform task assignments at the direction of the

Contracting Officer's Representative (COR) in the Task Areas specified below.

6.1 TASK AREA 1 - TrustedAgent Support and Enhancement Services

6.1.1 Technical Support Services (Oracle SOL, software coding, training development)

(expertise located at Contractor's non-Federallv-controlled facility)

A GSS is an interconnected set of information resources under the same direct management control which shares common functionality and provides necessary IT infrastructure support.

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 3 of 20

The individuals' rt:sponsibilitics shall include the following: soHware troubleshooting, performance tuning, installation/upgrades, content development, data migration, and ad/we reporting. The individuals shall also be responsible for providing support for the tailoring of TrustedAgent software products for specific NIH requirements.

6.1.2 Project Management and Svstem Design Support Services

The individuals shall be responsible for coordinating change control meetings, software upgrades, acceptance testing with NIH, status repo1iing and budget planning, and demonstrations for new software releases.

6.2 TASK AREA 2 - Provide standard TrustedAgent FIS MA software maintenance updates related to overall product enhancements (non-NIH specific) and modifications due to changes in FISMA, 0MB and NIST requirements

6.3 TASK AREA 3 - Provide standard TrustedAgent C&A software maintenance updates related to overall product enhancements (non-NIH specific) and modifications due to changes in FISMA, 0MB and NIST requirements

6.4 TASK AREA 4 -- Provide additional TrustedAgent FISMA software licenses (Optional)

6.5 TASK AREA 5 - Provide additional TrustedAgent C&A software licenses (Optional)

7.0 DELIVERABLES/DELIVERY SCHEDULE

Any written deliverable products shall be submitted in draft format for review, comment and approval by the COR. Final copies of approved drafts shall be delivered to the COR within five (5) business days after receipt of the CO R's comments.

Any written draft deliverable products shall be submitted in a quantity to be specified by the COR for each deliverable sufficient for distribution to appropriate reviewers and one electronic copy for review and comment. Final deliverable products shall be submitted as three (3) final bound copies and an electronic copy. Other quantities and fo1mats may be submitted after prior approval from the COR.

Electronic copies will be submitted in Microsoft Office 2007 fonnat unless prior approval for another format has been obtained from the COR.

DELIVERY SCHEDULE

Task Deliverable Deliverable Due Date

Area

6.1 th.ru 6.5 Task Assigmnents As reauired bv the COR

22.0 Section 508 Report By January 18 of each Calendar Year

The Contractor shall submit an annual Section 508 report in accordance with the schedule set fo1ih in the ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY provision of this SOW.

The Section 508 Report Template and Instructions for completing the report are available at:

http://www.hhs.gov/od under "Vendor Information and Documents."

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 4 of 20

All electronic reports submitted shall be compliant with Section 508 of the Rch;:ibilitation Act of 1973.

Additional information about testing documents for Section 508 compliance, including specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Helpful Resources."

All paper/hardcopy documents/reports submitted under this Delivery Order shall be printed or copied, double-sided, on at least 30 percent post-consumer fiber paper, whenever practicable, in accordance with

FAR 4.302(b).

8.0 DELIVERY ORDER TYPE

This GSA FSS Delivery Order is an Indefinite-Delivery Requirements type. [Reference: Federal Acquisition Regulation (FAR) 16.503]

9.0 PLACE OF PERFORMANCE

The work requirements specified shall be performed at the Contractor's non-Federally-controlled facility.

The Contractor shall only be provided remote access to NlH's TrustedAgent FISM and C&A software applications through an authorized NIH VPN account. The Contractor shall not host and/or maintain any Federal information system at the Contractor's facility under this Delivery Order.

10.0 PERIOD OF PERFORMANCE OF DELIVERY ORDER

The period of perfo1111ance of this Delivery Order shall be a 12-month Base Period ofSeptember 01, 2018, through August 31, 2019; with an option for one (1) successive 12-month Option Period:

Base Period:

Option Period I :

September 01, 2018, through August 31, 2019

September 01, 2019, through August 31, 2020

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 5 of 20

11.0 REQUIRMENTS (ESTIMATED)

The Contractor shall provide the following resources in the perfo1mance of this SOW:

Labor Hours and Other Direct Costs (Estimate)

Labor Base Option Total

Categories Period Period 1 24 Months

9/1/2018 9/1/2019

Thru Thru

8/31/2019 8/31/2020

(12 Months) (12 Months) Labor Hours (Estimated)

Base Effort

Principal Security Consultant 1,920 1,920 3,840

Peincipal Security Consultant 624 624 1,248

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 6 of 20

I 1.1 Labor Category

The following labor category is required to successfully perform the work requirements specified in this

SOW.

The Contractor shall provide staff who meets the minimum skill sets specified below.

Due to the continuing evolution of OCIO's FlSMA and C&A enterprise-management software tools and professional support services requirements, it is understood that additional labor categories may need to be incorporated into this SOW in order to accomplish task assignments under Provision 6.0 above.

Labor Category: Principal Security Consultant

Minimum/General Experience: Has ten (I 0) years progressive experience, selectively or in combination, within the general functional area and six (6) years specialized experience directly related to the specified task area. Applicable functional areas include database application development and administration, database security engineering, database security assessment, information systems security and infomrntion assurance, critical infrastructure protection', critical infrastructure continuity and contingency planning, risk management, physical infrastructure protection, configuration and data infonnation systems, and program management.

Functional Responsibilities: Responsible for the management of a single large (or several smaller) systems acquisition programs/projects or a major functional area. Possesses demonstrated technical and managerial skills and is fully knowledgeable of all aspects of the program or programs under his/her management. Plans, develops or supports programs/projects; establishes objectives and requirements;

develops budgets; develops program/project standards and schedules; monitors outside resources. Has experience or extensive knowledge with the processes and procedures relative to the functional area.

Coordinate, review and supervise work of assigned staff. Reviews/oversees preparation of all related documentation; conducts program reviews, meetings, etc. Works independently under general guidelines or objectives set by s1:1pervisor. Employs a high degree of creativity, foresight and judgment to plan, organize and guide programs.

Minimum Education: Possesses a bachelor's degree in related technical or business discipline. Prefer master's degree in related technical or business discipline.

12.0 NIH INFORMATION AND PHYSICAL ACCESS SECURITY - DELIVERY ORDER

PROVISION

This acquisition requires the Contractor to:

Develop, have the ability to access, or host and/or maintain Federal infonnation and/or Federal information system(s).

This acquisition shall not require the Contractor to:

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 7 of 20

• Have regular or prolonged physical access to a --Fcclerally-controllcd focility,"' as defined in FAR Subpart 2.1; and

(Have access to Personally Identifiable lnformation (Pll) when performing the work requirement� specified in the Statement of Work.

The Contractor and all subcontractors performing under this acquisition shall comply with the following requirements:

a.

b.

C.

Jnfonnation Type

[X] Management and Support Information and Information Systems:

Administrative Management: Security Management - Involves the physical protection of an organization's personnel, assets, and facilities (including security clearance management).

Information & Technology Management - Information Security- Involves all functions pe11aining to the securing of Federal data and systems through the creation and definition of security policies, procedures and controls covering such services as identification, authentication, and non repudiation.

[ ] Mission Based Information and Information Systems:

Security Categories and Levels

Confidentiality Level:

Integrity Level:

Availability Level:

Overall Level:

Position Sensitivity Designations

[ ] Low [X] Moderate [ ] High [ ] Low [X] Moderate [ ] High [X] Low [ ] Moderate [ ] High f l Low [X] Moderate [ ] High

The following position sensitivity designation(s) and associated suitability detennination(s) and background investigation requirements apply to this acquisition:

[ ] Level 6: Public Trust -High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Detem1ination and Background Investigation (Bl).

[X] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Detennination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level I: Non Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Detennination and a National Agency Check and Inquiry Investigation

(NACI).

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 8 of 20 d.

The Contractor shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the COR, with a copy to the Contracting Officer, within 14 calendar days of the effective date of this Delivery Order. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at http://ocio.nih.gov/docs/public/Suitability-roster.xls

Suitability Investigations are required for contractors who will need access to NIH information systems and/or to NIH physical space. However, contractors who do not need access to NIH physical space will not need an NIH ID Badge. Each contract employee needing a suitability investigation will be contacted via email by the NIH Office of Personnel Security and Access

Control (DPSAC) within 30 days. The DPSAC email message will contain instructions regarding fingeqxinting as well as links to the electronic fonns contract employees must complete.

Additional information can be found at the following website:

http://idbadge.nih.gov/background/index.asp

All Contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this Delivery Order.

Contractors may begin work after the fingerp1int check has been completed.

Infonnation Security Training

d. l Mandatory Training

All employees having access to (1) Federal information or a Federal infonnation system or (2) personally identifiable information, shall complete the NIH Information Security Awareness Training course at http://irtsectraining.nih.gov/ before performing any work under this Delivery Order. Thereafter, employees having access to the infomrntion identified above shall complete an annual NIH-specified refresher course during the life of this Delivery Order. The Conh·actor shall also ensure subcontractor compliance with this training requirement.

d.2 Role-based Training

HHS requires role-based training when responsibilities associated with a given role or position, could, upon execution, have the potential to adversely impact the security posture of one or more

HHS systems. Read further guidance at: Secure One HHS Memorandum on Role-Based Training Requirement"

For additional infom1ation see the following: http://ocio.nih.gov/security/security communicating.htm#RoleBased

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 9 of 20 e.

f.

The Contractor shall maintain a list of all information security training completed by each contractor/subcontractor employee working under this Delivery Order. The list shall be provided to the COR and/or Contracting OHicer upon request.

Rules of Behavior

The Contractor shall ensure that all employees, including subcontractor employees, comply with the NIH Information Technology General Rules of Behavior, \-vhich are available at http://ocio.nih.gov/security/nihitrob.html.

Personnel Security Responsibilities

1. The Contractor shall notify the Contracting Officer, COR, and VC ISSO within five working days before a new employee assumes a position that requires a suitability determination or when an employee with a suitability determination or security clearance stops working under this Delivery Order. The Government will initiate a background investigation on new employees requiring suitability detennination and will stop pending background investigations for employees that no longer work under this acquisition.

2. The Contractor shall provide the COR with the name, position title, e-mail address, and phone number of all new Contractor employees working under this Delivery Order and provide the name, position title and suitability detennination level held by the forn1er incumbent. If the employee is filling a new position, the Contractor shall provide a position description and the Government will detem1ine the appropriate suitability level.

3. The Contractor shall provide the COR with the name, position title, and suitability detennination level held by or pending for departing employees.

Perfo1111 and document the actions identified in the Contractor Employee Separation

Checklist (attached) when a Contractor/subcontractor employee tern1inates work under this

Delivery Order. All documentation shall be made available to the COR and/or Contracting Officer upon request.

g. Commitment to Protect Non-Public Depaiimental lnfonnation Systems and Data

(1) Contractor Agreement

The Contractor, and any subcontractors perfo1ming under this Delivery Order, shall not release, publish, or disclose non-public Depaiimental infomrntion to unautho1ized personnel, and shall protect such infonnation in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such info1111ation:

- 18 U.S.C. 641 (Criminal Code: Public Money, Prope1iy or Records)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Inf01mation)

- Public Law 96-511 (Paperwork Reduction Act)

(2) Contractor Employee Non-Disclosure Agreement

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page IO of 20

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the Commitment to Protect Non-Public

Information - Contractor Emplovee Agreement A copy of each signed and witnessed Non Disclosure Agreement (NOA) shall be submitted to the COR prior to performing any work under this acquisition. fn addition, the Contractor shall ensure that each contractor/subcontractor employee's NOA is electronically entered into the Security Awareness Training System prior to the individual performing any work under this acquisition.

Loss and/or Disclosure of Personally Identifiable Information (PII) - Notification of Data Breach

Not applicable

1.

h.

. Data Encryption

The following encryption requirements apply to all laptop computers containing HHS data at rest and/or HHS data in transit. The date by which the Contractor shall be in compliance will be set by the COR, however, device encryption shall occur before any sensitive data is stored on the laptop computer/mobile device, or within 45 days of the start of this Delivery Order, whichever occurs first.

1. The Contractor shall secure all laptop computers used on behalf of the government using a Federal Infonnation Processing Standard (FIPS) 140-2 compliant whole-disk encryption solution. The cryptographic module used by an encryption or other cryptographic product must be tested and validated under the Cryptographic Module Validation Program to confirm compliance with the requirements of FIPS PUB 140-2 (as amended). For additional infomrntion, refer to http://csrc.nist.gov/cryptval.

2. The Contractor shall secure all mobile devices, including non-HHS laptops and po1table media that contain sensitive HHS infonnation by using a FIPS 140-2 compliant product.

Data at rest includes all HHS data regardless of where it is stored.

3. The Contractor shall use a FIPS 140-2 compliant key recovery mechanism so that encrypted infornrntion can be decrypted and accessed by authorized personnel. Use of encryption keys which are not recoverable by authorized personnel is prohibited. Key recovery is required by "OMB Guidance to Federal Agencies on Data Availability and Encryption", November 26, 2001, http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf.

Encryption key management shall comply with all HHS and NIH policies (http://intranet.hhs.gov/infosec/docs/guidance/hhs standard 2007.pdf) and shall provide adequate protection to prevent unauthorized decryption of the information.

All media used to store infonnation shall be encrypted until it is sanitized or destroyed in accordance with NIH procedures. Contact the NIH Center for Information Technology for assistance (http://cit.ni h. gov /Prod uctsAndServices/ServiceCatalog/Servi ces.htm ?Service= Medi a+Sani t

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 11 of20

J.

k.

ization+Service).

Physical Access Security

Not applicable

Common Security Configurations

1. The Contractor shall ensure new systems are configured with the applicable Federal Desktop Core Configuration (FDCC) (http://nvd.nist.gov/fdcc/download fdcc.cfin) and applicable configurations from http://checklists.nist.gov, as jointly identified by the Operating Division (OPDlV)/Staff Division (STAFFDIV) Contracting Officer's Representative (COR) and the Chief Information Security Officer (CISO).

2.

3.

4.

5.

6.

The Contractor shall ensure hardware and software installation, operation, maintenance, update, and/or patching will not alter the configuration settings specified in: (a) the FDCC (http://nvd.nist.gov/fdcc/index.cfin); and (b) other applicable configuration checklists as referenced above.

The Contractor shall ensure applications are fully functional and operate correctly on systems configured in accordance with the above configuration requirements.

The Contractor shall ensure applications designed for end users run in the standard user context without requiring elevated administrative privileges.

Federal lnfon11ation Processing Standard 201 (FIPS-201)-compliant, Homeland Security( Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase servers, desktops, and laptops; and (b) comply with FAR Subpmi 4.13, Personal Identity

Verification.

The Contractor shall ensure that all of its subcontractors (at all tiers) comply with the above requirements.

I. Special Infomrntion Security Requirements for Foreign Conh·actors/Subcontractors

When foreign conh·actors/subcontractors perform work under this acquisition at non-US Federal Government facilities, provisions of HSPD-12 do NOT apply.

m. References: lnfomrntion Security Including Personally Identifiable Infomrntion

I. Federal lnfonnation Security Management Act of2002 (FISMA), Title III, E- Govenm1ent Act of 2002, P. L.

No. I 07-347 (Dec. 17, 2002); http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

2. HHS Perso1mel Security/Suitability Handbook: http://www.hhs.gov/ohr/manual/pssh.pdf

3. N1H Computer Security Awareness Training Course: http://irtsectraining.nih.gov/

4. NIST Special Publication 800-16, Infom1ation Teclmology Security Training Requirements:

http://csrc.nist.gov/publications/nistpubs/800-16/800-J 6.pdf Appendix A-D:

http:/ /csrc.nist.gov/publications/nistpubs/800-16/ AppendixA-D .pdf

5. N1ST SP 800-18, Guide for Developing Security Plans for Infom1ation Technology Systems:

http://csrc.nist.gov/publications/nistpubs/800-J 8-Revl/sp800-l 8-Rev 1-final.pdf

(Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 12 of 20 c· n.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

16.

NIST SP 800-53. Revision I, Recommended Security Controls for Fcdcn-1I Information Systems:

http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf NIST SP 800-60, Guide for t\fapping Types of Information and lnfornrntion Systems to Security Categories, Volume I: http://csrc.nist.gov/publications/nistpubs/800-60-rev l/SP800-60 Vol I -Rev l .pdf; Volume 11, Appendices to Guide For Mapping Types of Information and Information Systems To Security Categories, Appendix C at: http://csrc.nist.gov/publications/nistpubs/800-60-rev l /SP800-60 Vol2-Rev l .pdf and Appendix D at: http://csrc.nist.gov/publications/nistpubs/800-60-rev I /SP800-60 Vol2-Rev l .pdf.

NIST SP 800-64, Security Considerations in the Information System Development Life Cycle:

http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf FIPS PUB 199, Standards for Security Categorization of Federal lnfonnation and Information Systems:http://csrc.nist.gov/publications/fips/fips 199/FIPS-PUB-199-final.pdf FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems:

http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf 0MB Memorandum M-06-15, Safeguarding Personally Identifiable Information (05-22-06):

http://www.whitehouse.gov/si tes/default/files/omb/memoranda/fy2006/m-06-l 5 .pdf 0MB Memorandum M-06-16, Protection of Sensitive Agency Information (06-23-06):

http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06- I 6.pdf 0MB Memorandum M-06- I 9, Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments (07-12-06) http://www. whitehouse. gov/si tes/default/files/omb/memoranda/fy2006/m-06-l 9 .pdf 0MB Memorandum, Recommendations for Identity Thefi Related Data Breach Notification (09-20-06) http://m.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/task force theft memo.pdf 0MB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (05-22-07) http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007 /m07-l 6.pdf 0MB Memorandum M-07-18 , Ensuring New Acquisitions Include Common Security Configurations (06-01-

07) http://www.google.com/url?g=http://download.microsoft.corn/download/5/c/4/5c46c4a0-950f-40a9-9a8f- 9af4a2869bc2/0MB Acquisition Policy.pdf&ei=DOJ9T4K B6rd0OHEwMiLDA&sa=X&oi=unauthorizedredirect&ct=targetlink&ust= l 333651732125 l 36&usg=AFOjCN GxM g96forei7U tc14t59jntz08cg

17. Guide for Identifying Sensitive Information, including Information in Identifiable Form, at the NIH (Draft: I 0- 04-06): http://ocio.nih.gov/security/NIH Sensitive lnfo Guide.doc

18. HHS OCIO Policies http://www.hhs.gov/ocio/policy/index.html#Security

References: Physical Access Security

I.

2.

3.

4.

5.

6.

7.

8.

9.

10.

HHS Cybersecurity Program Policy: http://intranet.hhs.gov/infosec/docs/policies guides/JSPP/ Information Security Program Policy.pdf Restricted access.

Homeland Security Presidential Directive/HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors (08-27-04):

http://www. wh i tehouse. gov/sites/ default/ files/ omb/memoranda/fy2 005/m0 5-24 .pdf 0MB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors (08-05-05):

http://www. whi tehouse. gov/sites/default/files/ omb/ memoranda/fy2 00 5/m05-24. pdf 0MB Memorandum M-07-06, Validating and Monitoring Agency Issuance of Personal Identity Verification Credentials (01-11-07): http://www.cio.gov/Documents/Vald Montr Agy IssuPIVCred.pdf Federal Infom1ation Processing Standards Publication (FIPS PUB) 201-1 (Updated June 26, 2006):

http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chngl .pdf HHS Interim Policy: Contractual Implementation of Homeland Security Presidential Directive (HSPD) 12, Policy for a Common Identification Standard for Federal Employees and Contractors [Draft] HHS Office of Security and Drug Testing, Perso1mel Security/Suitability Handbook (02-01-05):

http://www.hhs.gov/ohr/manual/pssh.pdf HHS AR 307. 7106, Statement of Work (SOW); HHS AR 307. 7 I 08 in new coverage as of 02-01-07:

http://www.hhs.gov/asfr/og/acquisition/policies/hspd l 2contractguide.doc Federal Acquisition Regulation (FAR) 37.602, Performance Work Statement (PWS):

http://acquisition.gov/far/current/html/S ubpart%203 7 6.html#wp I 074648 FAR Subpart 4.13, Personal Identity Verification of Contractor Personnel:

Statement of Work: TrustedAgent FJSMA & C&A Software & Support Page 13 of20

I I.

http://acguisition.gov/far/cun-ent/html/Subpart%204 13.html#wp 1074125

FAR 52.204-9, Personal Identity Verilication of Contractor Personnel [clause]:

http://acguisition.gov/far/cun-ent/html/52 200 206.html#wp 1139617

13.0 GOVERNMENT-FURNISHED PROPERTY (GFP)/GOVERNMENT-FURNISHED

INFORMATlON (GFI)

Not applicable

14.0 PACKAGING, PACKJNG, AND SHIPPING INSTRUCTIONS

The Contractor shall ensure that all items are preserved, packaged, packed and marked in accordance with best commercial practices to meet the packing requirements of the carrier and to ensure fast and timely delivery at the intended destination.

15.0 POST-AW ARD EVALUATION OF CONTRACTOR PERFORMANCE

15.1 Contractor Performance Evaluations

Interim and final evaluations of Contractor performance will be prepared on this Delivery Order in accordance with FAR 42.15. The final perfomrnnce evaluation will be prepared at the time of completion of work. In addition to the final evaluation, interim evaluations will be prepared annually to coincide with the anniversary date of this Delivery Order.

Interim and final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be pennitted thirty days to review the document and to submit ( additional information or a rebutting statement. If agreement cannot be reached between the pai1ies, th\) matter will be refened to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as pa11 of the Delivery Order file, and may be used to suppo11 future award decisions.

15.2 Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address: http://www.cpars.gov

16.0 CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representatives (CORs) will represent the Govenunent for the purpose of this Delivery order:

COR:

Alternate COR:

Amber Simco Larry Scales

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 14 of20

The COR is responsible for: (I) monitoring the Contrador technical progress, including the survci I lance and assessment of performance c.1ncl recommending to the Contracting Officer changes in requirements;

(2) interpreting the Statement of Work and any other technical performance requirements; (3) performing technical evaluations as required; (4) performing technical inspections and acceptance required by this Delivery Order; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this Delivery Order. Only the Contracting Officer has authority to: (I) direct or negotiate any changes in the

Statement of Work; (2) modify or extend the period of performance; (3) change the delivery schedule;

(4) authorize reimbursement to the Contractor of any costs incmTed during the performance of this Delivery Order; or (5) otherwise change any terms and conditions of this Delivery Order.

The duties of the Alternate COR will be to provide administrative support to the COR.

The Government may unilaterally change its COR designation.

17.0 KEY PERSONNEL, HHSAR 352.242-70 (January 2006)

The key personnel specified in this Delivery Order are considered to be essential to work performance.

At least 30 days p1ior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result of leaving the employ of the Contractor), the Contractor shall notify the Contracting Officer and shall submit comprehensive justification for the diversion or replacement request (including proposed substitutions for key personnel) to pennit evaluation by the Government of the impact on perforniance under this Delivery Order. The Contractor shall not dive1t or otherwise replace any key personnel without the written consent of the Contracting Officer. The Government may modify this Delivery Order to add or delete key personnel at the request of the Contractor or Government.

(End of Clause)

The following individuals are considered to be essential to the work being perfonned hereunder:

Principal Security Consultant (TrustedAgent Professional Services)

Principal Security Consultant (TrustedAgent Project Management Suooort)

18.0 NON-PERSONAL SERVICES AND INHERENTLY GOVERNMENTAL FUNCTIONS

Pursuant to FAR 37.1, no personal services shall be perfo1111ed under this SOW. All work requirements shall flow only from the COR to the Contractor Project Manager. No Conb·actor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable Contractor supervisor. If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 15 of 20

Pursuant to FAR 7.5, the Contractor shall not perform any inherently governmental actions under this SOW. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all comm uni cations with third parties in connection with this SOW, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government contractors in connection with this SOW, the Contractor employee shall state that they have no authority to in any way change this SOW and that if the other contractor believes this communication to be a direction to change their contract, they should notify the Contracting Officer for that contract and not ca1Ty out the direction until a clarification has been issued by the Contracting Officer.

The Contractor shall insure that all of its employees working on this SOW are infonned of the substance of this aiiicle. Nothing in this article shall limit the Government's rights in any way under the other provisions of this SOW, including those related to the Government's right to inspect and accept the services to be performed under this SOW. The substance of this aiiicle shall be included in all subcontracts at any tier.

19.0 ORGANIZATIONAL CONFLICTS OF INTEREST

Purpose: The purpose of this aiiicle is to ensure that the Contractor (1) is not biased because of its financial, contractual, organizational, or other interest which relate to the work under this Delivery Order, and (2) does not obtain any unfair competitive advantage over other pa1iies by vi1iue of its perfonnance of this Delivery Order.

Scope: The restrictions desc1ibed herein shall apply to performance or participation by the Contractor and any of its affiliates or their successors in interest (hereinafter collectively referred to as "Contractor") in activities covered by this miicle as a p1ime contractor, subcontractor, cosponsor, joint venture, consultant, or in any similar capacity. For the purpose of this aiiicle, affiliation occurs when a business concern is controlled by or has the power to control another or when a third party has the power to control both.

"Organizational conflict of interest" means that because of other activities or relationships with other persons, a person is unable or potentially unable to render impartial assistance or advice to the Government, or the person's objectivity in perfonning the contract work is or might be otherwise impaired, or a person has an unfair competitive advantage (FAR 9.501). An organizational conflict of interest may result when factors create an actual or potential conflict of interest on an instant contract, or when the nature of the work to be perfo,med on the instant contract creates an actual or potential conflict of interest on a future acquisition (FAR 9.502(c)).

Because of the unusual nature of the work perfonned under this Delivery Order, and the fact that the Contractor will have access from time to time to sensitive Government infonnation, and because some of the work will be perforn1ed in Government facilities, the Government must maintain a special, close relationship with the Contractor and the Contractor's personnel in various impo1iant areas.

The Contractor shall not use this p1ivileged infonnation or access to facilities to compete with the private sector.

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 16 of 20

The Contractor is required to conduct its business in a manner befitting its special relationship with the Government, to operate in the public interest with objectivity and independence, to be free from organizational conflicts of interest, and to have full disclosure of its affairs to the sponsoring agency.

The Contractor shall be ineligible to participate in any capacity in contracts, subcontracts, or proposals therefore (solicited and unsolicited) which stem directly from the Contractor's performance of work under this contract for a period of one (1) year after the completion of this Delivery Order, except as provided hereinafter.

If, under this Delivery Order, the Contractor prepares a complete or essentially complete statement of work or specifications to be used in competitive acquisitions, the Contractor shall be ineligible to perfonn or participate in any capacity in any contractual effo11 that is based on such statement of work or specifications. The Contractor shall not inc01vorate its products or services in such statement of work or specifications unless approved in writing by the Contracting Officer, in which case the restriction in this subparagraph shall not apply.

It is imperative that the Contractor be proactive in order to avoid organizational conflicts of interest.

The Contractor shall take all reasonable measures to assure that organizational conflicts of interest do not occur. As pa11 of the Contractor's effo11s to avoid organizational conflict of interest situations, the Contractor shall inform the Government of any actual, potential, or apparent conflicts of interest. The Contractor is responsible for providirig a detailed written repo11 of actual, potential, or apparent organizational conflicts of interest to the Contracting Officer as soon as the circumstance is known, describing the conflict and how the Contractor plans to resolve the problem.

Subcontracts: The Contractor shall include an m1icle, substantially similar to this ai1icle, in subcontracts involving the perfo1mance of advisory and assistance services as that tenn is defined at FAR 37.201.

The terms "contract," "contractor," and "contracting officer" shall be appropriately modified to preserve the Government's rights.

20.0 RIGHTS IN DATA

This Delivery Order is subject to the Federal Acquisition Regulation (FAR) Clause No. 52.227-19, Commercial Computer Software License (Dec 2007).

21.0 ACCESS TO NATIONAL INSTITUTES OF HEAL TH (NIH) ELECTRONIC MAIL

All Contractor staff that have access to and use of NIH electronic mail (e-mail) must identify themselves as contractors on all outgoing e-mail messages, including those that are sent in reply or are forwarded to another user. To best comply with this requirement, the Contractor staff shall set up an e-mail signature ("AutoSignature") or an electronic business card ("V-card") on each contractor employee's computer system and/or Personal Digital Assistant (PDA) that will automatically display "Contractor" in the signature area of all e-mails sent.

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 17 of 20

22.0 ELECTRONlC AND lNf<ORMATION TECHNOLOGY ACCESSIBILITY HI-ISAR

352.239-73(b) (January 2010)

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) products and services developed, acquired, maintained, or used under this contract/order must comply with the "Electronic and Information Technology Accessibility Provisions" set forth by the Architectural and Transpo11ation Barriers Compliance Board (also referred to as the "Access Board") in 36 CFR pait 1194. Information about Section 508 provisions is available at http://www.section508.gov/. The complete text of Section 508 Final provisions can be accessed at http://www.access board.gov/sec508/provisions.htm.

The Section 508 standards applicable to this Delivery Order are:

The Section 508 standards applicable to this Delivery Order have been identified by

Trusted Integration in its GSA FSS Group 70 Contract No. GS-35F-0259N.

Prior to the Contracting Officer exercising an option for a subsequent perfornrnnce pe1iod/additional quantity or adding funding for a subsequent perfonnance period under this contract, as applicable, the Contractor must provide a Section 508 Annual Report to the Contracting Officer and Project Officer.

Unless otherwise directed by the Contracting Officer in writing, the Contractor shall provide the cited report in accordance with the following schedule. Instructions for completing the report are available in the Section 508 policy on the HHS Office on Disability Web site under the heading Vendor Information and Documents. The Contractor's failure to submit a timely and properly completed report may jeopardize the Contracting Officer's exercising an option or adding funding, as applicable.

Schedule for Contractor Submission of Section 508 Annual Report:

Due no later than November 30 of each calendar year.

Statement of Work: TrustedAgent FISMA & C&A Software & Support Page 18 of 20 (

[End of HHSAR 352.239-73(c)]

23.0 YEAR 2000 COMPLIANCE

In accordance with FAR 39. l 06, Information Technology acquired under this Delivery Order must be Year 2000 compliant as set forth in the following clause(s):

23.1 Services Involving the Use of Information Technology

YEAR 2000 COMPLIANCE-SERVICES INVOLVING THE USE OF INFORMATION

TECHNOLOGY

The Contractor agrees that each item of hardware, software, and firmware used under this Delivery Order shall be able to accurately process date data (including, but not limited to, calculating, comparing and sequencing) from, into and between the twentieth and twenty-first centuries and the Year 1999 and the Year 2000 and leap year calculations.

(End of Clause)

23.2 Commercial Supply Products Warranty

YEAR 2000 \VARRANTY--COMMERCIAL SUPPLY ITEMS

The Contractor warrants that each hardware, software and finnware product delivered under this Delivery Order and listed below shall be able to accurately process date data (including, but not limited to, calculating, comparing, and sequencing) from, into, and between the twentieth and twenty-first centuries and the Year 1999 and the Year 2000 and leap year calculations, when used in accordance with the product documentation provided by the Contractor, provided that all listed or unlisted products ( e.g., hardware, software, firn1ware) used in combination with such listed product properly exchange date data with it. If the Delivery Order requires that specific listed products must perforn1 as a system in accordance with the foregoing waiTanty, then that warranty shall apply to those listed products as a system.