PWS Attachment 10_Security and Privacy Requirements for Information Technology Procurements.pdf

Security and Privacy Requirements for Information Technology Procurements

Security and Privacy Requirements for Information Technology Procurements

Contents

1 INTRODUCTION

1.1 Applicability

2 REQUIREMENTS

2.1 Safeguarding Information and Information Systems

2.2 Safeguarding Controlled Unclassified Information (CUI)

2.3 Safeguarding Sensitive Information

2.4 Confidentiality, Integrity, Availability, and Nondisclosure of Information

2.5 Internet Protocol Version 6 (IPv6)

2.6 Government Websites

2.7 Public-Facing Websites

2.8 Encryption

2.9 Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)

2.10 Training

2.11 Rules of Behavior

2.12 Incident Response

2.13 Contract Initiation and Expiration

2.14 Records Management and Retention

2.15 Government-Furnished Equipment

2.16 Non-Public Facing Websites

2.17 E-mail Security

2.18 Privacy Act Requirements

2.19 Security Requirements for Government-Owned/Contractor-Operated (GOCO) and Contractor-Owned/Contractor-Operated (COCO) Information Systems

a. Federal Policies

b. Security Assessment and Authorization (SA&A)

c. SA&A Package Deliverables

d. System Security Plans (SSP)

e. Security Assessment Plan/Report (SAP/SAR)

f. Independent Assessments

g. POA&Ms

h. Contingency Plans and Contingency Plan Testing

i. E-Authentication Questionnaire

j. Information Security Continuous Monitoring

2.20 Government Access for Security Assessment

2.21 End of Life Compliance

2.22 Desktops, Laptops, and Other Computing Devices

2.23 FedRAMP Privacy and Security Requirements

a. FedRAMP-Compliant ATO

Options for ATO Issuance

Contractor Responsibilities:

b. Data Jurisdiction

c. Service Level Agreements

d. Interconnection Agreements/Memorandum of Agreements

2.24 Protection of Information in a Cloud Environment

2.25 Security Assessment and Authorization

2.26 Reporting and Continuous Monitoring

2.27 Configuration Baseline

2.28 Media Transport

2.29 Card Readers

2.30 Other Requirements

2.31 Binding Operation Directives

2.32 Continuous Monitoring / Ongoing Security Assessment & Authorization

2.33 ICAM and PIV Systems

2.34 Zero Trust Architecture/Zero Trust Network

2.35 Trusted Internet Connections

2.36 Transition to National Institute of Standards and Technology Special Publication 800-53, Rev. 5 from Rev. 4 – Security and Privacy Controls for Information Systems and Organizations

2.41 Office of Management and Budget (OMB) Executive Order Compliance

1 INTRODUCTION

1.1 Applicability

The requirements established in this document apply to all Department of Agriculture contractors. The requirements established herein apply to the entire contract or order (hereafter referred to as a “contract”), or any portion thereof and includes either or both of the following:

a. Access (Physical or Logical) to Government Information: Physical and Logical Access refers to when contractor personnel are expected to have (1) routine physical access to an USDA-controlled facility; (2) logical access to an USDA-controlled information system; (3) access to government information, whether in an USDA- controlled information electronic data or in hard copy; or (4) any combination of circumstances (1) through (3) as per OMB M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors.

b. Operate a Federal System Containing Information: A Contractor/employee will operate a federal system and information technology containing data that supports the USDA mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2 REQUIREMENTS

2.1 Safeguarding Information and Information Systems

In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor shall:

a. Protect Government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity.

• Availability, which means ensuring timely and reliable access to and use of information.

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf

b. Provide security for any Contractor systems, and information contained therein, connected to an USDA network or operated by the Contractor on behalf of ED regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within sixty (60) minutes or less, bring the situation to the attention of the other party.

c. Adopt and implement policies, procedures, controls, and standards required by the USDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the USDA Information Security Program security requirements, outlined in the Departmental Directives Cyber Security 3500 Series, and its subordinate Policy Framework Instructions / Standards documents, based on the National Institute of Standards and Technology (NIST) “Framework for Improving Critical Infrastructure Cybersecurity.” The framework contains the five (5) core functions to “Identify,” “Protect,” “Detect,” “Respond (to),” and “Recover (from)” any cybersecurity event.

d. Comply with the Privacy Act requirements and with the Federal Information Security Modernization Act (FISMA) and with the OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and with the Family Agricultureal Rights and Privacy Act (FERPA) and with the

Per Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII) is “information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother’s maiden name, biometric records, etc.

Sensitive PII is PII that if released improperly could result in harm, embarrassment, inconvenience, or unfairness to the individual whose name or identity is linked to the information.

Context shall be accounted for in order to determine whether PII is sensitive. Some PII is always sensitive, and some is only sensitive when it is used in a particular context. For example, a list of people subscribing to a government newsletter is generally not sensitive PII; a list of people receiving treatment for substance abuse would always be considered sensitive PII.

The list below is not exhaustive. Context shall be accounted for in order to determine whether PII is sensitive. The following types of information are always considered sensitive:

• Social Security Numbers (including using just the last 4 digits of the SSN)

• Date of birth

• Mother’s maiden name

• Biometric identifiers (e.g., fingerprint, iris scan, voice print)

• Personal financial information, credit card and purchase card account numbers

• Citizenship and immigration status

• Criminal history

• Computer access passwords and security questions

• Medical records

2.2 Safeguarding Controlled Unclassified Information (CUI)

CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The contractor shall comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) and Department Directive, DR 3440-002, Controlled Unclassified Information Program when handling CUI. 32 CFR 2002.4(aa) as implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. Marked appropriately;

b. Disclosed to authorized personnel on a “Need-To-Know” basis;

c. Protected in accordance with the current, finalized version of NIST SP

800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. Returned to USDA control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

2.3 Safeguarding Sensitive Information

For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The contractor shall protect all government information that is or may be sensitive in accordance with FISMA by securing it with a FIPS 140-2, as amended, validated solution.

2.4 Confidentiality, Integrity, Availability, and Nondisclosure of Information

Any information provided to the contractor by USDA or collected by the contractor on behalf of USDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract.

The Contractor assumes responsibility for protection of the confidentiality, integrity, and availability of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors at any level to whom any USDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with USDA policies and instructions. Unauthorized disclosure of information will be subject to the USDA sanction policies and/or governed by the following laws and regulations:

• 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

• 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

• 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act);

• 18 U.S.C. 1030 The Computer Fraud and Abuse Act (CFAA); and

• 44 U.S.C. 3301 Definition of Records.

2.5 Internet Protocol Version 6 (IPv6)

Any system hardware, software, firmware, or networked component (voice, video, or data) developed, procured, or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding, and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet protocol (IP) version 6 (IPv6) as set forth in Internet Engineering Task Force (IETF) Request for Comments (RFC) 2460 and associated IPv6-related IETF RFC standards.

In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products.

Specifically, any new IP product or system developed, acquired, or produced must:

1. Interoperate with both IPv6 and IPv4 systems and products; and

2. Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

2.6 Government Websites

All new and existing government websites shall be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

2.7 Public-Facing Websites

The contractor shall implement controls to ensure that all publicly accessible Department websites and web services only provide service through a secure connection, (such as the

HTTPS).

In accordance with Binding Operational Directive (BOD)-18-01: Enhance E-Mail and Web Security, any web services provided for or on behalf of USDA shall ensure all publicly accessible Federal websites and web services provide service through a secure connection (HTTPS-only, with HSTS); SSLv2 and SSLv3 are disabled on web servers, and DES and RC4 ciphers are disabled on web servers; and shall provide a list to USDA to provide to DHS of agency second-level domains that can be HSTS preloaded, for which HTTPS will be enforced for all sub-domains.

If an official public-facing website will be developed, modified, or maintained, then, in accordance with OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure and OMB Memorandum M-17-06, Policies and Requirements for Public Websites, the contractor shall use only an approved usda.gov domain.

In accordance with OMB-M-17-06, for requirements involving web applications, web servers, and web services, the contractor shall follow the policies, principles, standards, and guidelines on information security and privacy, in accordance with FISMA, and implement security and privacy requirements as set forth in OMB Circular A-130 and current, final version of NIST Special Publication 800-44, Guidelines on Securing Public Web Servers.

The public expects Federal Government websites to be secure and their interactions with those websites to be private. The contractor shall comply with requirements specified in OMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services that requires that all publicly accessible Federal websites and web services only provide service through a secure connection (HTTPS with HSTS).

The contractor use of third-party websites and applications shall comply with all relevant privacy protection requirements and a careful analysis of privacy implications as specified in OMB Memorandum M-10-23, Guidance for Agency Use of Third-Party Websites.

2.8 Encryption

The contractor shall:

a. Comply with Executive Order (EO) 14028, Improving the Nation’s Cybersecurity (May 12, 2021), Section 3(d)(iii) requirements for encrypting data at rest and data in transit as well as USDA Information Technology (IT) System and Communications Protection (SC) Standard to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, proprietary information, Controlled Unclassified Information, etc.) in motion (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2, as amended, validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process federally owned or federally managed information and ensure devices meet USDA-specific encryption standard requirements.

d. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

e. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-3. The contractor shall provide a written copy of the validation documentation to the COR when required by the Program Office.

f. Use the Key Management system on the USDA personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the CO, COR, or to the Project Manager or Program Manager, upon request and at the conclusion of the contract.

2.9 Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)

The contractor shall assist the USDA Senior Agency Official for Privacy (SAOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

If the results of the PTA show that a full PIA is needed, the contractor shall assist the USDA SAOP or designee with completing a PIA for the system or information within the timeframe required by the Program Office after completion of the PTA and in accordance with USDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002.

The contractor shall assist the SAOP or designee in reviewing the PIA at least annually throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

2.10 Training

a. Mandatory Training for All Contractor Staff - All contractor/employees assigned to work on this contract shall complete the applicable USDA Cybersecurity and Privacy Awareness training (provided upon contract award) before performing any work under this contract (this training is available to new contractors, even if they do not have a PIV card). Thereafter, the employees shall complete the USDA Cybersecurity and Privacy Awareness training at least annually, during the life of this contract. All provided training shall be compliant with USDA training policies.

b. Role-based Training - All contractor employees with significant security responsibilities (as determined by the program manager or generally, any individual who has any security responsibilities that are more than the security responsibilities that any end-user would have, e.g., an Information System Security Officer, an Information System Security Manager, or any individual working within the Information Assurance Services division of the Office of the Chief Information Officer) must complete role-based training annually in accordance with USDA policy.

c. Training Records - The contractor shall maintain training records for all its employees working under this contract in accordance with USDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter, or upon request.

2.11 Rules of Behavior

a. The contractor shall ensure that all employees performing on the contract comply with the applicable USDA Rules of Behavior and any specific rules provided by the Program Office.

b. All contractor employees performing on the contract shall read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual USDA Cybersecurity and Privacy Awareness training.

c. Employees, contractors, and anyone assigned to a contract shall sign Rules of Behavior (RoB). Signed copies of RoB shall be kept on file by the Contractor’s program manager.

2.12 Incident Response

• The contractor shall respond to all alerts/Indicators of Compromise (IOCs) provided by either the USDA SOC, ISSM, ISSO, the Project Manager, the Program Manager, the CO, the COR, the SAOP (or designee), or the CISO (or designee) within 24 hours, whether the response is positive or negative.

• The Federal Information Security Modernization Act of 2014 (FISMA) defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

• A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for any other-than-authorized purpose.

In the event of a suspected or confirmed incident or breach, the contractor shall:

a. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2, as amended, validated encryption.

b. NOT notify affected individuals unless so instructed by the contracting officer or designated representative. If instructed by the contracting officer or representative, the contractor shall send USDA and Program Office approved notifications to affected individuals within the timeframe established by the Program Office.

c. Report all suspected and confirmed information security and privacy incidents and breaches to the Cyber.incidents@usda.gov, and to the COR, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, within no more than sixty (60) minutes, and consistent with the applicable USDA policy and procedures, NIST standards and guidelines, as well as with US-CERT notification guidelines. The types of information required in an incident report shall include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised.

d. Cooperate and exchange any information, as determined by the agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

e. NOT include any sensitive information in the subject or body of any reporting e-mail; and

f. Encrypt sensitive information in attachments to email, media, etc.

g. Comply with OMB M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information,” and with the USDA incident response policies when handling PII breaches.

h. Provide full access and cooperate on all activities as determined by the United States Government, including USDA, any involved law enforcement or Department of Defense (DoD) agencies, such as The Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Central Intelligence Agency (CIA), the National Security Agency (NSA), the Defense Information Systems Agency (DISA), or the Office of Personnel mailto:EDSOC@ed.gov

Management (OPM) etc., to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

i. Implement scanning capabilities that assess for vulnerabilities using only Security Content Automation Protocol (SCAP) validated products.

j. Perform penetration and regular vulnerability testing and scanning of systems, IT devices, and websites. Scanning shall be conducted with reports provided to the Department. The contractor shall ensure authenticated Web Application and Data Base Application scans are conducted on a monthly basis (or as needed to be more frequent). In addition, authenticated Operating System (OS) scans are conducted at a minimum on a weekly basis. Once the Information System is integrated with the USDA Continuous Diagnostics and Mitigation (CDM) program, vulnerability information for all in-scope IT assets shall be updated at minimum every 72 hours.

k. Maintain the tools and capabilities to support asset discovery, to include passive network monitoring, active network monitoring, and automated network mapping.

l. Maintain tools and capabilities to support behavior monitoring, to include NetFlow analysis and network traffic capture, which captures the Transmission Control Protocol/Internet Protocol (TCP/IP) stream, allowing for replay of activity to determine what happened during a breach or incident.

m. Maintain tools and capabilities for intrusion prevention, to include host intrusion prevention systems (HIPS) and network intrusion prevention systems (NIPS).

n. Maintain a firewall system designed to prevent unauthorized access to or from any contractor systems and network.

o. Maintain tool and capabilities to perform Security Incident/Event Management and Analysis, to include centralized logging, log correlation, and a Security Information and Event Management (SIEM) solution that provides centralized monitoring of security incidents; network behavior analytics to provide behavior-based detection to help protect against zero day attacks; and a quarantine/sandbox environment that will isolate and analyze live traffic and/or suspected malware.

p. Maintain tools and capabilities to perform vulnerability and risk management and analysis to include threat intelligence threat hunt capabilities, sharing platforms, risk management or trouble ticketing system, anti-malware and anti-phishing services.

q. Maintain tools and capabilities to provide security situational awareness and visibility throughout the enterprise; this includes capabilities for full packet capture that collects detailed network information at the gateway and makes capture data available to analysts; endpoint incident response that enables searches all endpoints for Indicators of Compromise (IOCs) in a rapid fashion;

and encrypted traffic inspection.

r. If working as a SOC contractor, will provide a Daily Morning Report, 7 days per week, that summarizes the noteworthy daily security activities. Examples include activities such as the daily count of security incidents detected (viruses, malware, etc.), email traffic analysis for spam and phishing attempts, vulnerability scan results and progress in closing open weaknesses from scan results. The contractor is encouraged to propose a world class daily security morning report format, with the most noteworthy performance measures, to include any graphic displays, and charts to enhance reporting.

s. Provide and maintain automated means of discovering, monitoring, and protecting sensitive data to ensure protection of data in motion, at rest, and in use.

t. Provide and maintain an automated means of preventing unauthorized users and computing devices from accessing contractor hosted environments, including access via remote access, wired and wireless technologies.

u. Provide and maintain externally facing web application firewall capabilities providing inbound and outbound traffic filtering.

v. Provide and maintain an Out of Band network device management solution.

w. Administer, operate, maintain, configure, and tune cybersecurity software and hardware.

x. Provide full government visibility of continuous monitoring tool configurations and output on a real-time basis as well as historical data/logs.

y. Maintain the capability to perform periodic penetration testing, and also support for external agency red team testing, penetration testing, cyber hygiene web site vulnerability scanning tests and vulnerability assessments that the Department may need to conduct.

2.13 Contract Initiation and Expiration

The contractor shall comply with the following contract initiation and expiration requirements:

a. System Documentation. Contractors shall follow and adhere to current, final version of NIST SP 800-37, Risk Management Framework for

Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the SDLC that require artifact review and approval.

b. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the contractor shall provide all required documentation, as specified by the Program Office, to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

c. Notification. The contractor shall notify the CO and/or COR and system ISSO within 5 calendar days (or as otherwise specified by the Program Office) when an employee stops working under this contract, or immediately upon an employee’s termination or vacancy if prior-to-departure notice is not possible.

d. Contractor Responsibilities Upon Physical Completion of the Contract The contractor shall return all government information and IT resources (i.e., government information in nongovernment-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the contractor shall provide a certification that all government information has been properly sanitized and purged from contractor-owned systems, including backup systems and media used during contract performance, in accordance with ED and Program Office policies.

Further, the Contractor shall perform and document the actions identified in the Department’s Contractor Employee Separation Checklist when an employee terminates work under this contract within 5 calendar days (or as otherwise specified by the Program Office) of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

2.14 Records Management and Retention

The contractor shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and ED and policies and shall not dispose of any records unless authorized by ED.

In the event that a contractor accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with ED policies. Per OM: 6103, “Records and Information Management Program,” records include all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations or other activities of the United States Government or because of the informational value of data in them. (44 USC 3101, Definition of Records).

2.15 Government-Furnished Equipment

The contractor shall:

• Implement capabilities to ensure that GFE endpoints are covered by an intrusion prevention system, and by an antivirus (AV) solution using file reputation services, checking files against cloud-hosted, continuously updated malware information.

• Implement capabilities to ensure that GFE endpoints are covered by an anti-exploitation tool.

• Implement capabilities to ensure that GFE endpoints are protected by a browser-based or enterprise-based tool to block known phishing websites and IP addresses. Per DHS BOD 17-01, “Removal of Kaspersky-Branded Products,” all Kaspersky-Branded products shall be fully removed, and discontinued.

2.16 Non-Public Facing Websites

The contractor shall:

• Implement capabilities for all inbound network traffic to pass through a web content filter, which provides anti-phishing, anti-malware, and blocking of malicious websites (e.g., fake software updates, fake antivirus offers, and phishing offers).

• In accordance with OMB Memorandums M-17-06, and M-15-13, and M- 08- 23, M-10-23, and with DHS BOD-1801, and with the NIST SP 800-52 and with the NIST SP 800-44, all Federal websites and web services shall be accessible through a secure connection (HTTPS only, with HSTS), and e- mail applications shall have SMTP enabled. The use of HTTPS is encouraged on intranets, but not explicitly required.

• In accordance with BOD18-01: In accordance with OMB Memorandum M- 08-23, in order to ensure Domain Name System Security (DNSSEC), all Department websites must use an ed.gov domain. All websites that disseminate and/or do business on the Department’s behalf must adhere to this OMB Memorandum.

2.17 E-mail Security

• Enable SMTP for all e-mail applications, in accordance with OMB

Memoranda M-17-06, M-15-13, M-0823, M-10-23; DHS BOD 18-01;

and NIST SP 800-52 and SP 800-44.

• Abide by Department guidelines concerning auto-forwarding of

Department email to non-Department accounts by not configuring Department email accounts to auto-forward to non-ED.gov email addresses as this is explicitly prohibited unless specifically authorized through the Department Risk Acceptance process.

2.18 Privacy Act Requirements

If performance of this contract has been determined to involve the design, development, or operation of a system of records on individuals, the contractor shall comply with the Privacy Act of 1974, and complete all USDA Privacy Impact Assessment requirements as requested by the contracting officer representative.

For contracts subject to the Privacy Act of 1974, the contractor shall support a system of records in accordance with any Privacy Impact Assessments (PIAs) required and generated by any Privacy Threshold Analyses (PTAs), and any applicable System or Record Notices (SORNs), in conjunction with the judgment of the SAOP, and NARA-approved records schedule(s) and protection requirements for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to maintenance of links between records and metadata, and categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA- approved retention schedules.

2.19 Security Requirements for Government-Owned/Contractor-Operated

(GOCO) and Contractor-Owned/Contractor-Operated (COCO) Information Systems

The contractor shall comply with the following:

a. Federal Policies

The contractor shall comply with applicable federal laws that include, but are not limited to, USDA cybersecurity policies, and USDA’s Policy Framework Instructions / Standards documents, based on the National Institute of Standards and Technology (NIST) “Framework for Improving Critical Infrastructure Cybersecurity,” the Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

b. Security Assessment and Authorization (SA&A)

A valid authority to operate (ATO) certifies that the Contractor’s information system meets the contract’s requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor shall work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s) by the Program Office. The contractor shall conduct the

SA&A requirements in accordance with USDA cybersecurity policies, and ED’s five (5) Policy Framework Instructions / Standards documents, based on the National Institute of Standards and Technology (NIST) “Framework for Improving Critical Infrastructure Cybersecurity,” NIST SP 800- 37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision).

Program Office acceptance of the ATO does not alleviate the contractor’s responsibility to ensure the system security and privacy controls are implemented and operating effectively.

c. SA&A Package Deliverables

The contractor shall provide a SA&A package within the timeline, process and format specified by the Program Office to the CO and/or COR. Any additional SA&A deliverables that are required, if any, are detailed within the contract’s statement of work/performance work statement.

d. System Security Plans (SSP)

The SSP is required within 30 days of contract award. The SSP shall comply with the NIST SP 800- 18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as ED and Program Office policies and other guidance.

The SSP shall be consistent with and detail the approach to IT security contained in the contractor’s offer that resulted in the award of this contract. The SSP shall provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The contractor shall update the SSP at least annually thereafter. Per the NIST SP 800- 137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, “…FISMA… further emphasized the importance of continuously monitoring information system security by requiring agencies to conduct assessments of security controls at a frequency appropriate to risk, but no less than annually.”

e. Security Assessment Plan/Report (SAP/SAR)

SAP/SAR is required within 30 days of award. The appropriate security assessment will be conducted by the Program Office. It will be consistent with NIST SP 800-53A, NIST SP 800-30, and ED and Program Office policies. The assessor will document the assessment results in the SAR.

Thereafter, the contractor, in coordination with the Program Office shall conduct and/or assist in the assessment of the security controls, in the timeline specified, and update the SAR at least annually. Per the NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, “…FISMA… further emphasized the importance of continuously monitoring information system security by requiring agencies to conduct assessments of security controls at a frequency appropriate to risk, but no less than annually.”

f. Independent Assessments

The contractor shall have an independent third-party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the Security Authorization package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800-53.

The contractor shall address all “high” deficiencies, and any other deficiency requiring contractor mitigation as identified by the Program Office, before submitting the package to the Government for acceptance. All remaining deficiencies shall be documented in a system POA&M.

g. POA&Ms

POA&Ms are due as specified in the contract. The POA&M shall be documented consistent with the USDA Standard for Plan of Action and Milestones and Program Office policies. All high-risk weaknesses shall be mitigated within the timeframe specified by the Program Office and all medium weaknesses shall be mitigated within the number of days specified by the Program Office from the date the weaknesses are formally identified and documented. The Program Office will determine the risk rating of vulnerabilities.

Identified risks stemming from deficiencies related to the security control baseline implementation, assessment, continuous monitoring, vulnerability scanning, and other security reviews and sources, as documented in the SAR, shall be documented and tracked by the Contractor for mitigation in the POA&M document. Depending on the severity of the risks, the Program Office may require designated POA&M weaknesses to be remediated before an ATO is issued.

Thereafter, the POA&M shall be updated at least quarterly, or as specified by the Program Office.

h. Contingency Plans and Contingency Plan Testing

Contingency Plan is required within 30 days of contract award. The Contingency Plan shall be developed in accordance with NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, and be consistent with ED and Program Office policies. Upon acceptance by the System Owner, the contractor, in coordination with the System Owner, shall test the Contingency Plan and prepare a Contingency Plan Test Report that includes the test results, lessons learned and any action items that need to be addressed. Thereafter, the contractor shall update and test the Contingency Plan at least annually. Per the NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, “…FISMA… further emphasized the importance of continuously monitoring information system security by requiring agencies to conduct assessments of security controls at a frequency appropriate to risk, but no less than annually.

i. E-Authentication Questionnaire

The contractor shall collaborate with government personnel to ensure that an E- Authentication Threshold Analysis (E-auth TA) is completed to determine if a full E-Authentication Risk Assessment (E-auth RA) is necessary. System documentation developed for a system using E-auth TA/E-auth RA methods shall follow OMB 04-04 and NIST SP 800-63, Electronic Authentication Guidelines.

Based on the level of assurance determined by the E- Auth, the contractor shall ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E- Auth (when required) in accordance with ED policies

j. Information Security Continuous Monitoring

Upon the Government issuance of an Authority to Operate (ATO), the contractor -owned/operated systems that input, store, process, output, and/or transmit government information, shall meet or exceed the information security continuous monitoring (ISCM) requirements in accordance with FISMA and NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, and the ED Departmental Cybersecurity Policy, and its subordinate Policy Framework Instructions / Standards documents, based on the National Institute of Standards and Technology (NIST) “Framework for Improving Critical Infrastructure Cybersecurity.” The following are the minimum requirements for ISCM: the contractor shall perform within 60-90 days of award:

i. Annual Assessment/Pen Testing - Assess the system security and privacy controls (or ensure an assessment of the controls is conducted) at least annually to determine the implemented security and privacy controls are operating as intended and producing the desired results (this may involve penetration testing conducted by the agency or independent third-party.) In addition, review all relevant SA&A documentation (SSP, POA&M, Contingency Plan, etc.) and provide updates by Program Office specified due date.

ii. Asset Management - Using any available Security Content Automation Protocol (SCAP)-compliant automated tools for active/passive scans, provide an inventory of all information technology (IT) assets for hardware and software, (computers, servers, routers, databases, operating systems, etc.) that are processing USDA-owned information/data. It is anticipated that this inventory information will be maintained as current.

IT asset inventory information shall include IP address, machine name, operating system level, security patch level, and SCAP- compliant format information. The Contractor shall maintain a capability to provide an inventory of 100% of its IT assets using SCAP- compliant automated tools

iii. Configuration Management - Use available SCAP-compliant automated tools, per the NIST IR 7511, Security Content Automation Protocol (SCAP) Version 1.2, Validation Program Test Requirements, as amended, Revision 4, for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that store and process government information. Compliance will be measured using IT assets and standard USDA and government configuration baselines at least monthly, or more frequently if required by Department policy. The Contractor shall maintain a capability to provide security configuration compliance information for 100% of its IT assets using SCAP-compliant automated tools.

iv. Vulnerability Management - Use SCAP-compliant automated tools for authenticated scans to scan information system(s) and detect any security vulnerabilities in all assets (computers, servers, routers, Web applications, databases, operating systems, etc.) that store and process government information. Contractor shall actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with USDA policy & Federal Directives. Automated tools shall be compliant with NIST-specified SCAP standards for vulnerability identification and management. The Contractor shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets using SCAP- compliant automated tools and report to the agency at least weekly or more frequent as required by Department Policy.

v. Patching and Vulnerability Remediation - The contractor shall install software/product vendor released security patches and remediate critical and high vulnerabilities in systems processing government information in an expedited manner, within Department specified timeframes & Federal Directives. NOTE: Many patches are applied in immediate response to a detection of a specific threat and/or a specific vulnerability. In the absence of such a detection, available patches shall be applied at least annually, unless contra-indicated due to any other more important factor(s) determined in a risk assessment

vi. Secure Coding - Follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (USCERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits

vii. Boundary Protection - The Contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities is routed through a Trusted Internet Connection (TIC).

viii. Open Security Controls Assessment Language (OSCAL) Overlays -develop and maintain OCSAL overlays expressed in Extensible Markup Language (XML), JavaScript Object Notation (JSON), and YAML Markup Language (YAML) formats which provide machine-readable representations of control catalogs, control baselines, system security plans, and assessment plans and results.

2.20 Government Access for Security Assessment

The contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the confidentiality, integrity, and availability of federal data or to the protection of information systems operated on behalf of USDA, including but are not limited to:

a. At any tier handling or accessing information, consent to and allow the Government, or an independent third party working at the Government’s direction, without notice at any time during a weekday during regular business hours contractor local time, to access contractor installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms), databases, and personnel which are used in performance of the…