PWS Attachment 1_508 Compliance 2023-09 Internet Protocol EVM Reporting.pdf

Section 508 – Accessibility of Information and Communications Technology

This contract vehicle is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 749d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). The Revised Section 508 Standards, which consist of 508 Chapters 1 and 2 (Appendix A), along with Chapters 3 through 7 (Appendix C), contain scoping and technical requirements for information and communication technology (ICT) to ensure accessibility and usability by individuals with disabilities. Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

Each ICT product or service furnished under this contract shall comply with the Revised Section 508 ICT Accessibility Standards at a minimum, as specified in the contract. If any furnished product or service is determined to be noncompliant, the Contracting Officer will notify the Contractor in writing. The Contractor shall, without charge to the Government, remediate or replace the noncompliant products or services within a specified timeframe as determined by the Government in writing. If such remediation or replacement is not completed within the time specified, the Government shall have the following recourses:

1) Cancellation of the contract, delivery, task order, purchase, or line item without termination liabilities; or

2) In the case of custom ICT being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant ICT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

The contractor must ensure all noncompliant ICT products and services are provided pursuant to extensive market research and exhibit the highest level of compliance while satisfying the contract requirements.

For every ICT product or service accepted under this contract by the Government that does not comply with the Revised Section 508 Accessibility Standards, the contractor shall, at the discretion of the Government, remediate or upgrade the item with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date, whichever shall occur first.

Section 508 Compliance

Vendors, contractors, and their respective ICT products and services shall comply with the following standards, policies, and procedures. In the event of conflicts between the referenced documents and this contract vehicle, the contract vehicle shall take precedence.

1) Revised Section 508 ICT Accessibility Standards

2) Section 508 of the Rehabilitation Act as amended (29 U.S.C. 794d)

3) Federal Acquisition Regulation (FAR) Subpart 39.2

4) USDA Section 508 Departmental Regulation

Additionally, all contract deliverables are subject to these standards.

All ICT products and services, regardless of format, must conform to the applicable Section 508 standards to allow Federal employees and members of the public with disabilities equivalent access to and use of information and data provided to those without disabilities.

All contractors, sub-contractors, and consultants are responsible for preparing or posting content must comply with the applicable Section 508 accessibility standards and, where applicable, those set forth in the referenced policy or standards document. Remediation of any noncompliant ICT or materials as set forth in this contract vehicle shall be the responsibility of the contractor, sub-contractor, or consultant.

According to the Access Board’s Section 508 Scoping Requirements The following Section 508 provisions apply to the products and/or services identified in this contract vehicle:

• C202 Functional Performance Criteria: Where the requirements in Chapters 4 and 5 do not address one or more functions of telecommunications or customer premises equipment, the functions not addressed shall conform to the Functional Performance Criteria specified in Chapter 3.

• C203 Electronic Content: Electronic content that is integral to the use of telecommunications or customer premises equipment shall conform to the most current Web Content Accessibility Guidelines (WCAG) Level A and Level AA Success Criteria and Conformance Requirements.

https://www.access-board.gov/ict/#about-the-ict-accessibility-standards https://www.access-board.gov/law/ra.html#text-of-section-508-of-the-rehabilitation-act-of-1973-as-amended-29-usc-794d https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2039_2.html http://www.ocio.usda.gov/document/departmental-regulation-4030-001 https://www.access-board.gov/ict/#508-chapter-2-scoping-requirements https://www.access-board.gov/ict/#C202-functional-performance-criteria https://www.access-board.gov/ict/#C203-electronic-content

• C204 Hardware: Where components of telecommunications equipment and customer premises equipment are hardware, and transmit information or have a user interface, those components shall conform to applicable requirements in Chapter 4.

• C205 Software: Where software is integral to the use of telecommunications functions of telecommunications equipment or customer premises equipment and has a user interface, such software shall conform to C205 and the applicable requirements in Chapter 5.

WCAG Conformance: User interface components, as well as the content of platforms and applications shall conform to the most current WCAG Level A and Level AA Success Criteria and Conformance Requirements.

• C206 Support Documentation and Services: Where support documentation and services and provided for telecommunications equipment and customer premises equipment, manufacturers shall ensure that such documentation and services conform to Chapter 6 and are made available upon request at no additional charge.

In addition, vendors and contractors shall comply with the standards, policies, and procedures below for all ICT pursuant to this contract:

• For Custom ICT Development Services, the vendor or contractor shall ensure the ICT fully conforms to the applicable Revised Section 508 standards prior to delivery and before final acceptance.

• For Installation, Configuration, and Integration Services, the vendor or contractor shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised Section 508 standards.

• For Maintenance, Upgrades, and Replacements, the vendor or contractor shall ensure maintenance upgrades, substitutions, and replacements do not reduce the original level of conformance with the applicable Revised Section 508 standards at the time of the contract award.

• Service Personnel are ensured by the vendor or contractor to possess the knowledge, skills, and ability necessary to address the applicable Revised Section 508 standards and shall provide supporting documentation upon request.

• When providing Hosting Services, the vendor or contractor shall not reduce the existing level of conformance of the electronic content with the applicable Revised Section 508 standards.

• When purchasing ICT where 1) Section 508 validation is not possible prior to award, 2) the ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, the vendor or contractor shall test and validate the ICT solution for conformance to the Revised Section 508 standards, in accordance with the required testing methods as defined by the agency.

• The vendor or contractor shall document and maintain information regarding the measures taken to ensure compliance with the applicable requirements. This documentation includes but is not limited to testing records, product demonstrations, and reported defects by end users and testers.

• Prior to acceptance, the vendor or contractor shall provide an Accessibility Conformance Report (ACR) for each ICT item that is developed, updated, and/or configured for the agency, and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary Product Accessibility Template (VPAT) provided by the Information Technology Industry Council (ITI). To be considered for award, an ACR must be submitted for each ICT item, and must be completed according to the instructions provided by the ITI.

Note: A supplemental ACR may be required if the agency has additional or stricter accessibility requirements than what is outlined in the VPAT.

• Prior to acceptance, the agency reserves the right to require a full working demonstration of the completed ICT item to demonstrate conformance to the agency’s accessibility requirements in addition to independent testing to validate.

• In the case of non-compliance where the vendor or contractor claims its products and/or services satisfy the applicable Revised Section 508 standards specified in the contract vehicle, the contracting officer will promptly inform the vendor or contractor in writing of the non-compliance. The vendor or contractor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.

https://www.access-board.gov/ict/#C204-hardware https://www.access-board.gov/ict/#C205-software https://www.access-board.gov/ict/#C206-documentation-services https://www.section508.gov/sell/vpat https://www.section508.gov/sell/vpat http://www.itic.org/policy/accessibility

All Information and Communications Technology (ICT) subject to the Revised Section 508 standards will be evaluated for Section 508 conformance and usability. The test must be administered by a Federal Section 508 Testing Center. All maintenance for ICT that requires upgrades, modifications, installations, repairs, and purchases shall adhere to the Revised Section 508 standards.

Compliance with Internet Protocol version 6 IPv6 in Acquiring Information Technology

For web-based applications (intranet, internet information and applications, 16 rules), the Contractor shall comply with the following standards, policies, and procedures:

(a) Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products:

(b) Specifically, any new IP product or system developed, acquired, or produced must:

(1) Interoperate with both IPv6 and IPv4 systems and products, and

(2) Have available contractor/Creative IPv6 technical support for development and implementation and fielded product management.

(c) As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered, or utilized at no additional cost to the Government.

(d) The Contractor shall provide technical support for both IPv4 and IPv6.

(e) Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

(f) Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified, or replaced to bring it into compliance at no additional cost to the Government

EVM Reporting Requirements The Offeror shall adhere to FAR 34.201(b-e) to use an Earned Value Management System (EVMS) to be compliant with the guidelines in ANSI/EIA Standard 748-C to manage this contract.

The Offeror shall submit Earned Valuate Management (EVM) monthly metrics for all

Development, Maintenance, and Enhancement (DME) costs of labor, materials, and other costs which will include Earned Value (EV), Planned Value (PV), and Actual Cost (AC) along with the Budget at Completion (BAC). These values should reflect cumulative totals for the values that are reported each month.

The Offeror shall submit monthly all costs of labor, materials, and other costs. These values should reflect cumulative totals for the values that are reported each month.

The Offeror shall develop and deliver:

A Work Breakdown Structure (WBS) that provides for the logical sequencing of the work that makes up the scope identified in the SOW.

A WBS Dictionary that provides for the logical sequencing of the work that makes up the scope identified in the SOW.

A Schedule that provides for the logical sequencing of the work that makes up the scope identified in the WBS.

Records Management Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created during performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

United States Department of Agriculture (USDA) and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of USDA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to USDA.

The agency must report promptly to NARA in accordance with 36 CFR 1230.

The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract/task order/delivery order. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records, and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government's behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records, and/or equipment is no longer required, it shall be returned to USDA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand-carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the contract/task order/delivery order. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and USDA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with USDA policy.

The Contractor shall not create or maintain any records containing any non-public USDA information that are not specifically tied to or authorized by the contract.

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

The USDA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which USDA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

Training. All Contractor employees assigned to this contract who create, work with or otherwise handle records are required to take USDA-provided records management training. The Contractor is responsible for confirming training has been completed per agency policies, including initial training and any annual or refresher training.

[Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

1. The Contractor shall incorporate the substance of this clause, its terms, and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

The contractor shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents and this PWS, the PWS shall take precedence.

Custom ICT Development Services When the contractor provides custom Information and Communication Technology (ICT) development services pursuant to this contract, the contractor shall ensure the ICT fully conforms to the applicable Revised 508 Standards prior to delivery and before final acceptance.

Installation, Configuration, and Integration Services When Vendor provides installation, configuration, or integration services for equipment and software pursuant to this contract, the offeror shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised 508 standards.

Maintenance, Upgrades, and Replacements The contractor shall ensure maintenance upgrades, substitutions, and replacements to equipment and software pursuant to this contract do not reduce the original level of conformance with the applicable Revised 508 standards at the time of the contract award.

Service Personnel The contractor shall ensure the personnel providing the labor hours possess the knowledge, skills, and ability necessary to address the applicable Revised 508 standards defined in this contract and shall provide supporting documentation upon request.

Hosting Services When providing hosting services for electronic content provided by the agency, the contractor shall not implement the hosting services in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 standards. Throughout the life of the contract, the agency reserves the right to perform testing on a vendor or contractor’s hosted solution to verify conformance with this requirement.

Validation for ICT Items When purchasing ICT where 1) 508 validation is not possible prior to award, 2) when ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, the contractor shall test and validate the ICT solution for conformance to the Revised 508 standards, in accordance with the requirement testing methods, as defined by the agency. Throughout the life of the contract, the agency reserves the right to perform testing to verify conformance with this requirement.

Documentation The contractor shall maintain and retain full documentation of the measures taken to ensure compliance with the applicable requirements, including records of any testing or demonstrations conducted.

Conformance Reporting Prior to acceptance, the contractor shall provide an Accessibility Conformance Report (ACR) for each ICT item that is developed, updated, configured for the agency, and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary Product Accessibility Template (VPAT) provided by the Information Technology Industry Council (ITI).

To be considered for award, an ACR must be submitted for each ICT item, and must be completed per the instructions provided by ITI.

When the contractor is required to perform testing to validate conformance to the agency’s accessibility requirements, the contractor shall provide a Supplemental Accessibility Conformance Report (SAR) that contains the following information:

• Accessibility test results based on the required test methods.

• Documentation of features provided to help achieve accessibility and usability for people with disabilities.

• Documentation of core functions that cannot be accessed by persons with disabilities.

• Documentation on how to configure and install the ICT item to support accessibility.

• When an ICT item is an authoring tool that generates content (including documents, reports, videos, multimedia productions, web content, etc.)., provide information on how the ICT item enables the creation of accessible electronic content that conforms to the Revised 508 Standards, including the range of accessible user interface elements the tool can create.

• Before final acceptance, the contractor shall provide a fully working demonstration of the completed ICT Item to demonstrate conformance to the agency's accessibility requirements.

The demonstration shall expose where such conformance is and is not achieved. Before acceptance, the agency reserves the right to perform independent testing to validate that the ICT solution provided by the contractor conforms to the applicable Revised 508 standards.

Non-Compliance Before final acceptance of any ICT item, including updates and replacements, if the contractor claims its products or services satisfy the applicable Revised 508 standards specified in the contract vehicle, and the contracting officer determines that any furnished ICT item is not in compliance with such requirements, the contracting officer will promptly inform the contractor in writing of the non-compliance. The contractor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.

Earned Value Management (EVM)

1. RD REQUIREMENTS FOR FIXED PRICE CONTRACTS

1.1 INVOICE REQUIREMENTS

1.1.1. The Contractor must adhere to FAR 52.212-4 (g) (1) Contract Terms and Conditions—

Commercial Items in regards to submitting an invoice.

1.1.2. The Contractor must provide an itemized invoice for each task order that references:

a) Investment Name

b) Project and/or Sub-Project Name

c) Billing period

1.1.3. At a minimum, the Contractor must provide the following required data as substantiation for each invoice submitted:

a) The total number of hours, summarized by Task Order, CLIN, Investment, Project, and OMB

Categorization.

b) The total funds expended, summarized by Task Order, CLIN, Investment, Project, and OMB

Categorization.

c) The total Cumulative hours expended through the reporting period. The reporting period must clearly state which exact days of the month it covers.

d) The total ODC and travel funds expended summarized by Task Order, CLIN, Investment, Project, and OMB Categorization.

e) The total Cumulative Travel and ODC funds expended through the reporting period.

f) The total Cumulative funds expended through the reporting period.

g) Remaining balances of funds available on all incomplete Task Order, CLIN, Investment, Project, and OMB Categorization.

1.1.4. The invoice must reflect all the expenditures to date for the entire contract (Cumulative

Expense) and the funds remaining with regards to funding allocations and budgets.

1.1.5. The Contractor must submit invoices on a monthly basis, to meet EVM requirements.

1.1.6. The invoice needs to include the following information: Contract #, Contract type, Investment name, Project name, Project Code (this will be provided by Government POC), Period of Performance of invoice, Period of Performance of Contract, Brief Description of the Work and any additional information requested by Government POC to match internal BOT requirements.

1.2 SCHEDULE REQUIREMENTS

The Contractor shall request access for one (1) team member who will be using the current RD Earned Value Management System (EVMS) to update schedules.

The Contractor shall submit a schedule for each Development, Modernization, and Enhancement (DME) Project outlined in the Task Order.

The Contractor shall follow the current RD Naming Convention used for Vendor Schedules to name the Schedule.

The Contractor shall submit schedule(s) in .MPP format to comply with the RD Earned Value Management System (EVMS).

https://www.acquisition.gov/browse/far/52/212/

For Development, Modernization and Enhancement (DME) work, the Contractor shall include all of the following in the schedule:

a) Work Breakdown Structure (WBS) as Auto Tasks

b) Work

c) Duration

d) Start Date and Finish Date

e) Control Accounts

f) Planned Value (PV) at Release or Version levels in Cost Column (BCWS)

g) Budget at Complete (BAC) in Cost Column that totals to Contract Costs (Baseline Cost)

For Planning work, the Contractor shall include all of the following in the schedule:

h) Work Breakdown Structure (WBS) as Auto Tasks

i) Work

j) Duration

k) Start Date and Finish Date

l) Control Accounts

m) Planned Value (PV) at Release or Version levels in Cost Column (BCWS)

n) Budget at Complete (BAC) in Cost Column that totals to Contract Costs (Baseline Cost)

After the schedule has been baselined by the RD EVM Team, the Contractor shall achieve at least 90 percent of the cost, schedule, and performance goals established at time of contract award.

The Contractor shall ensure the schedule is updated on the EVMS monthly.

The Contractor shall ensure all of the following items are updated monthly for all tasks:

o) % Complete

p) Actual Work

q) Cumulative Actual Cost (AC) aligned with Cumulative Invoiced Amount

r) Cumulative Earned Value (EV) (BCWP)

The Contractor shall be required to review tasks in schedule with the Federal Project Manager or any other RD Federal Staff or PMO Support Team Member.

All schedules are required to have the following naming conventions:

EVM STATUS REPORT REQUIREMENTS

The Contractor shall submit monthly performance reports against baselined scope, schedule, and cost in formats that integrates with the current RD Earned Value Management System (EVMS) and other RD Project Portfolio Management systems and tools.

The Contractor shall include all of the following in the performance reports:

a) Work Breakdown Structure (WBS) showing Deliverables from SOW/PWS

b) Control Accounts

c) BAC, PV, EV, & AC for DME work

d) BAC, PV, EV, & AC for Planning work

e) Cost Performance Index (CPI) and Schedule Performance Index (SPI)

f) Cost Variance (CV) and Schedule Variance (SV)

g) Estimate at Completion (EAC) and Estimate to Complete (ETC)

h) Deliverables Schedule

i) Corrective Action Plan (CAP)

The Contractor shall achieve at least 90 percent of the cost, schedule, and performance goals established at time of contract award.

The Contractor shall submit a re-baseline request to the COR and Investment Program Manager if:

b) The Estimate at Completion (EAC) falls outside of +/- 10% of the authorized Budget at Completion (BAC);

c) The BAC increases or decreases by more than 25% via approved changes in the investment’s baseline change control process

d) The schedule has a slippage that exceeds 10% of the original baseline date(s).

The Contractor must adhere to the current USDA Earned Value Management (EVM) Departmental Regulation 3130-006 for contracts performing work for investments that meet the following criteria:

e) All new information technology (IT) investments for which any agency or staff office is planning to spend $20 million or more in Development, Modernization, and Enhancement (DME) over the agency-defined life cycle.

f) All major IT investments that are currently in process and are budgeted for $20 million or more in DME during the remainder of the life cycle.

g) Any investment for which an agency or staff office is planning to spend $1 million or more in DME in current-year funding shall use an EVMS for tracking investment cost, schedule, and performance.

For contracts meeting the criteria above, the Contractor must submit monthly Investment EVM reports which include cumulative data for Budget at Completion (BAC), Earned Value (EV), Planned Value (PV), and Actual Cost (AC) for each Project at the Government-specified control account level.

h) For contracts that have a combination of O&M and DME cost, the Contractor must submit a monthly Investment EVM report with the portion of the contract that is DME only.

i) The Contractor must submit Corrective Action Plans (CAPs) if Investment EVM reports show negative or positive CPI trends for at most 3 periods, approaching the 10% threshold.

For contracts meeting the criteria above, the Contractor shall comply with ANSI/EIA Standard 748-C for EVMS standards (a copy of the standard is available from Global Engineering Documents (1-800- 854-7179).

j) If the Contractor proposes to use a system that is not in ANSI/EIA Standard 748-C compliance, the Contractor shall submit to the COR a comprehensive plan for compliance with these EVMS standards.

For contracts meeting the criteria above, the Contractor shall attend a pre-award Integrated Baseline Review (IBR).

For contracts meeting the criteria above, the Contractor shall attend a post-Integrated Baseline Review, when requested by the Government.

https://www.ocio.usda.gov/document/departmental-regulation-3130-006 https://www.ocio.usda.gov/document/departmental-regulation-3130-006

Baseline Securities Requirements (BSR)

Compliance with Security IT Policies

• Information systems and system services provided to USDA by the Contractor must comply with the current USDA/ IT security and privacy policies, specifically the 3500 – 3599 Cyber Security Department regulations - https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories .

• Contractors are also required to comply with current Federal regulations and guidance found in the Federal Information Security Modernization act of 2014 (FISMA); Privacy Act of 1974; E- Government Act of 2002, Section 208; National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and the 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise Patch Management Technologies; Office of Management and Budget (OMB) memoranda; USDA/FSA Information Security Program policies and other relevant Federal laws and regulations with which USDA/FSA must comply.

• USDA departmental regulation DR3575-002, System and Information Integrity (08/16/18), mandates that information technology development projects follow the Agency’s accepted System Development Lifecycle (SDLC). All projects with congressional visibility can expect to be audited for compliance. Other projects may be audited at Agency discretion. Audits may occur at any time.

• Contractors/Vendors are required to protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational client software are exposed. If new vulnerabilities are identified after the acceptance of COTS software, the vendor must review and remediate the vulnerabilities and then present the results for Government approval within the timeframes documented in USDA IT security policies.

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories

Baseline Securities Requirements (BSR)