Attachment_D_-_Electronic_Security_Requirements.docx

Attachment D: Security Requirements

ATTACHMENT D

SECURITY REQUIREMENTS

For

Chart of Accounts Redesign OPIC’s Department of Financial and Portfolio Management (DPFM)

All bidders shall be willing and able to comply with the following security requirements, which shall be added as a clauses in Section H of the contract that may result from this solicitation.

H-1 ELECTRONIC SECURITY

The contractor shall comply will all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system. The contractor shall be required to prevent and remedy data breaches and to provide the OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs.

A. Contractor information systems subject to the Federal Information Security Management Act of 2002 (FISMA). All agency information systems, see 44 U.S.C. 3505(c), operated by or on behalf of the Government by a Contractor or subcontractor containing Federal data shall be subject to the requirements of the FISMA, including routine testing without advance notice to or approval of the Contractor or its subcontractors. See 44 U.S.C 3544(b).

1. For all services acquisitions (including cloud services):

PROTECTION OF INFORMATION

The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as SBU information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor’s infrastructure, as well as maintains the right to request full copies of these at any time.

The data that is processed and stored by the various applications within the network infrastructure contains financial data as well as personally identifiable information (PII). This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure.

The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

No data shall be released by the Contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the COR/CO.

SECURITY CLASSIFICATION

The preparation of the deliverables in this contract will be completed at a Sensitive but Unclassified level.

SECURITY DOCUMENTATION

The contractor shall provide documentation describing the functional properties of the security controls employed within the information system, its components, or services.

2. For Cloud-based systems:

Contractor shall be responsible for the following privacy and security safeguards:

a. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

b. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

c. The contractor shall also comply with any additional FedRAMP privacy requirements.

d. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, contractor shall be responsible for the following privacy and security safeguards:

(a)The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification.

(b) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours (per FedRAMP requirement). The program of inspection shall include, but is not limited to:

· Authenticated and unauthenticated operating system/network vulnerability scans

· Authenticated and unauthenticated web application vulnerability scans

· Authenticated and unauthenticated database application vulnerability scans

· Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools.

d) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. If the vendor chooses to run its own automated scans or audits, results from these scans may, at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor-conducted scans shall be provided, in full, to the Government.

FedRAMP Security Compliance Requirements:

The contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for low and moderate impact system (as defined in FIPS 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems. While the FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4.

The contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and Security guidance. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

Assessment and Authorization:

(Agency) may choose to cancel the (Contract/award) and terminate any outstanding orders if the contractor has its provisional authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

Authorization of System:

The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The Government reserves the right to conduct on-site inspections. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

OR 2. Not Cloud-based Contractor-Owned Systems and Services:

Required Policies and Regulations for OPIC Contracts Contractors entering into an agreement for services to OPIC and/or its Federal customers shall be contractually subject to all OPIC and Federal IT Security standards, policies, and reporting requirements. The contractor shall meet and comply with all OPIC IT Security Policies and all applicable OPIC and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Contractors are also required to comply with Federal Information Processing Standards (FIPS), the “Special Publications 800 series” guidelines published by NIST, and the requirements of FISMA.

OPIC Security Compliance Requirements FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems”, is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Contractor systems supporting OPIC must meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800-53, Revision 4 (hereafter described as NIST 800-53), and “Recommended Security Controls for Federal Information Systems.

NIST 800-53 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with OPIC specifications. The OPIC-specified control parameters and supplemental guidance defining more specifically the requirements per FIPS 199 impact level are provided in Appendix A, of this document.

System Assessment Documentation

1. At the Moderate impact level and higher, the contractor or Government (as determined in the contract) will be responsible for providing an independent Security Assessment/Risk Assessment.

1. Identified gaps between required 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document.

1. The Contractor is responsible for mitigating all security risks found during C&A and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

B. Handling of third-party requests for access to records. In the event that the Contractor receives any subpoena or other voluntary or mandatory request for access to data first produced under this Contract, the Contractor shall immediately notify the COR and the CO, so that the Government may intervene or take any other steps it deems necessary to protect its interests.

C. Data Breaches. As part of the requirement explained elsewhere in this document for the contractor to comply with all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system, the contractor shall be required to prevent and remedy data breaches and to provide the OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs. Special attention should be paid to OMB Memorandum 06-19 (July 12, 2006), particularly the extremely urgent reporting time frames included therein for certain breaches, as well as to any other subsequent laws, regulations, or policy governing data breaches that may arise during the performance of the contract. The Information System Security Plan required elsewhere in this document shall include policies and procedures necessary to ensure the timely detection of and reporting to the OPIC of data breaches, as well as safeguards to prevent and mitigate the risk of, as well as to remedy, such breaches, if any.

D. Use of OPIC computer equipment by contractors is limited to what is necessary to accomplish the work identified under the contract. All contractors or his/her employees or subcontractors are subject to Internet access monitoring and auditing, and discoveries of inappropriate internet access or activity not directly related to the contract, will be reported to the COR and CO, and the contractor shall be held in default of the contract. Contractors or his/her employees or subcontractors found accessing inappropriate web sites while using an OPIC computer, may be grounds for initiating disbarment procedures.

(END OF CLAUSE)

H-2 PERSONNEL SECURITY/ SUITABILITY CLEARANCE REQUIREMENTS

All contract personnel who will have access to United States Overseas Private Investment Corporation data or websites shall have an Overseas Private Investment Corporation approved background investigation prior to gaining access to the Overseas Private Investment Corporation (per the standards in 5 CFR Part 731). At a minimum, personnel working on this contract will be cleared at the PUBLIC TRUST level. Overseas Private Investment Corporation approved background investigations may include the Applicant Name Check, the National Agency Check and Inquiry (NACI), Special Agreement Check (OFI-86C), and/or other Overseas Private Investment Corporation approved previous investigation(s). Personnel and Physical security contract employees must be able to obtain and maintain a favorable fitness / suitability determination.

Should the Contracting Officer or designee receive an unsuitable report on any contract employee as a result of processing the required forms, or should an existing employee under this contract become unsuitable or unfit for assigned duties in this regard, the Contractor will be advised by the Government that such employee cannot be assigned to work or continue to work under the contract. The Contractor shall immediately remove any such employee and begin the process to replace him/her with a suitable substitute.

Potential contract employees who have previously had their suitability determined may not need to submit forms, pending verification to the Overseas Private Investment Corporation by the prior Government agency or unless one (1) calendar year or more has elapsed since they last started work. These potential contract employees shall, however, submit, in lieu of Overseas Private Investment Corporation required paperwork and prior to employment, a statement on the prior agency’s letterhead that they have a current suitability determination. In addition to being submitted on the respective agency's letterhead, the statement shall also list the following: Full Name, Social Security Number, Date of Birth, and a Point-of-Contact, including an up-to-date telephone number, contract number(s), and performance dates for contracts on which they have or are currently participating, which required such a determination.

Applicants may be required to complete the following: