PWS NG SCADA Maintenance Upgrades_12Oct 2025.pdf

PERFORMANCE WORK STATEMENT

(PWS)

for

The U.S. International Boundary and

Water Commission

SCADA Systems Maintenance and

Improvements

Table of Contents

1. BACKGROUND

2. OBJECTIVES

3. CONTRACTOR REQUIREMENTS

4. REGULATIONS COMPLIANCE

5. DELIVERABLES

6. SCOPE

7. Patching Level Expectations

8. USIBWC Points of Contact

9. REQUIRED PERFORMANCE METRICS (RPM) TABLE

10. INCREMENTAL FUNDING LIMITATION OF GOVERNMENT’S OBLIGATION

11. AVAILABILITY OF FUNDS

12. FFP “AS A SERVICE” PRICING IN ORDERS

14. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

15. CONTRACT ADMINISTRATION

16. ORDER QUOTE SUBMISSION

17. ORDER ISSUANCE

18. INVOICE REQUIREMENTS

19. FIRM-FIXED-PRICE (FFP) CLINs

20. TRAVEL

21. GOVERNMENT-FURNISHED EQUIPMENT AND GOVERNMENT FURNISHED

INFORMATION

22. ACCESS TO FACILITIES, SYSTEMS AND SECURITY CLEARANCE REQUIREMENTS

23. SECURITY REQUIREMENTS

24. USIBWC SYSTEM SECURITY COMPLIANCE REQUIREMENT

25. REQUIRED SECURITY POLICIES AND REGULATIONS

26. ADDITIONAL SECURITY STIPULATIONS

27. ORGANIZATIONAL CONFLICT OF INTEREST

28. NON-DISCLOSURE REQUIREMENTS

29. INTELLECTUAL PROPERTY RIGHTS

30. U.S. GOVERNMENT CONFIGURATION BASELINE (USGCB)

1. BACKGROUND

The U.S. Section of the International Boundary and Water Commission (USIBWC) is a federal agency and the U.S. component of the International Boundary and Water Commission (IBWC), which applies the boundary and water treaties of the United States and Mexico and settles differences that may arise in their application. Established in 1889, the USIBWC is an international body composed of the United States Section and the Mexican Section, each headed by an Engineer- Commissioner appointed by his/her respective president. Each Section is administered independently of the other.

The USIBWC is headquartered in El Paso, Texas and supports thirteen field offices throughout the U.S. and Mexico border with a single General Support System (GSS). Two field offices, located in San Ysidro, CA and Nogales, AZ have as their primary mission, the treatment of wastewater from Mexico and the surrounding areas through International Wastewater Treatment Plants (IWTP) with Supervisory Control and Data Acquisitions (SCADA) Systems. The NG SCADA System is completely independent from the HQ, El Paso, General Support System (GSS) System.

The NIWTP SCADA requires upgrades and the performance of predictive, preventive and timely maintenance. The required services include the application of software and firmware patching and remediation, software upgrades, parts and component replacement, IT Security control assessments and improvements to the functionality of the Systems through their inherent Ignition SCADA software. Emergency repair of the Systems at these sites and any other System improvement work identified as necessary by the USIBWC are within the scope of these contractor services. The Information Management Department (IMD) of the USIBWC manages and supports all Information Technology (IT) resources and services for the USIBWC. The IMD is responsible for overseeing and assisting agency-specific efforts to provide adequate, risk-based, and cost-effective Cybersecurity for all USIBWC Systems, per the Office of Management and Budget (OMB) Memorandum 10-28 and The Federal Information Security Modernization Act of 2014.

The SCADA System is in Nogales; AZ is a critical infrastructure essential to facilitating mission operations of the agency and is designated as a High Value Asset (HVA) by DHS. The growing issue of cybersecurity and its impact on Industrial Control Systems (ICS) or SCADA systems highlights fundamental risks to our Nation’s critical infrastructure and the USIBWC is in need to implement a Defense-in-Depth and maintenance strategy to our SCADA System to ensure they continue to evolve and operate in a secure, multi-layered environment that can adjust to the marked increase in cyber-based attacks on critical infrastructure systems. The USIBWC seeks a contractor that understands the relationship of threats and vulnerabilities to controls, standards, and countermeasures put in place to protect the operations, personnel and technologies that make up our SCADA system. Existing software at the site includes but is not limited to Rockwell RSLogix, Ignition, VMWare ESXI, Rockwell ThinManager, FactoryTalk ME and both Windows and Linux operating systems. The tools, maintenance enhancements, and services required through this Performance Work Statement (PWS) will provide the USIBWC with the ability to enhance our capabilities, correlate, analyze critical security-related information, and enhance risk-based decision making at the agency and Federal enterprise level.

2. OBJECTIVES

USIBWC’s IMD has a mission to safeguard and secure our SCADA environments where the cyber-attack threat is continuously growing and evolving. This acquisition is intended to assist USIBWC utilize managed services for functions that require highly specialized skills and technologies to include cyber vulnerability assessments and mitigation, risk management, continuity of operations, incident response training, and support in implementing effective SCADA system maintenance and emergency call-out programs at both sites. The services acquired by this PWS will help defend USIBWC’s SCADA Systems from cybersecurity threats by providing discovery efforts, updated documentation of existing Systems, and establishing a progressive maintenance program specific to SCADA systems. Maintaining software, firmware and implementing aggressive patching, remediation. The contractor will serve as the agency SME responsible for reviewing and providing expert feedback/comments/direction on upgrade design and implementation plans for either WWTP or SCADA system upgrades within IBWC.

3. CONTRACTOR REQUIREMENTS

The contractor must provide documentation, certifications and a summary of experience that shows staff assigned to this contract possess the following credentials, skills, and knowledge that are necessary to provide the specialized services the USIBWC requires at both SCADA System sites:

(a) The contractor should provide documentation or a summary detailing their level of knowledge and experience working with SCADA Systems within wastewater treatment plants and their familiarity with wastewater treatment processes and operations. Contractors should possess a minimum of 5 years working in Wastewater treatment and preferably, at least 3 completed contracts with references in the wastewater space.

(b) One or more contractor staff must be Ignition (Inductive Automation) Gold 8 or newer certified certification with a minimum of 7 years’ experience working with the software/system. Ignition is the main HMI software used within our SCADA environments. Contractors must be listed on the Inductive Automation Integrator list on the Inductive Automation website and provide a copy of their certifications.

(c) One or more contractor staff must have a CCNA certification. Both SCADA System network equipment consists of Cisco hardware that is essential for the USIBWC to achieve the level of network efficiency our SCADA networks require. The contractor must provide certification and a summary of experience to include the level of expertise in managing, patching, and configuring Cisco networking equipment.

(d) The contractor must be a Rockwell solutions provider with extensive Rockwell experience.

Contractors will be provided with all the licenses required to work on the Nogales facility upon award. The contractor is required to have solutions provided by credentials. The contractor will create a virtual machine to host the Rockwell software needed and licenses for remote support, development, and maintenance of the facility.

(e) One or more contract staff must have VMware Certified Professional or equivalent skills.

Hands-on experience deploying, configuring, and managing VMware environments. This includes expertise with VMware vCenter and VMware ESXI. Experience should include the ability and knowledge on how to allocate resources and monitor for issues within a virtual environment. Experience in disaster recovery and backup of virtual environments should also be submitted.

(f) Networking experience includes but not limited to fiber networks, firewall management, configuration, creating and maintaining VLANs to segregate and protect SCADA System networks. Experience should include documenting, diagnosing, updating, and configuring SCADA systems.

(g) Windows Domain Expertise. Experience in building, configuring, and managing Windows domains, including Active Directory, DNS, DHCP, PKI, and Group Policy management.

(h) Programming knowledge and experience with Java, Python, and SQL.

(i) Contractor personnel requiring administrator privileges to the SCADA system must possess a current tier 4 (public trust) or higher background investigation to submit an offer and must be confirmed by IBWC prior to award. Otherwise, the bid would not meet this requirement and could be removed from consideration.

(j) The contractor shall provide support via telephone, as needed to on-site employees to assess, troubleshoot or improve plant operations. The expectation for support is to be “on call” status during MST daytime hours Monday through Friday.

(k) Some examples of support required include:

1) Accessing the System to diagnose SCADA System issues, identify root causes, and implement solutions to said issues immediately or after any appropriate delays to avoid disrupting Plant processes, operations.

2) Adjusting plant control functionality through a combination of PLC or HMI changes – licenses to be provided by IBWC as needed/required.

3) Troubleshooting equipment problems that affect the plant’s efficiency or long-term operability in respect to the NG SCADA System and not plant equipment or process control – Anything past the PLC/HMI is not within the scope of this contract.

4) Troubleshooting Network Issues to determine root cause and implement resolutions (to include inside plant cabling – internal to Comm Room) – outside plant cabling will be outside the scope of this contract.

5) Walk on-site personnel through initial troubleshooting steps that cannot be performed remotely, as required.

(l) Contractors must have experience in migrating legacy PLC’s supporting wastewater treatment plants.

(m) Contractors must have experience in SCADA and OT project management initiatives, to include but not limited to; providing recommendations on statements of work, performance work statements and various construction projects, also includes auditing existing SCADA and OT systems agency wide and providing recommendations for improvements. Contractors must also be familiar with FISMA and NIST standards and apply these standards to improvements and auditing metrics.

4. REGULATIONS COMPLIANCE

The contractor shall be required to comply with and utilize the following laws and guidance to conduct quality control of the work and services provided. Applying the best practices described within the following guidance will ensure our SCADA Systems are sufficiently protected and that the work and services provided align with NIST’s Federal Cybersecurity Framework, industry’s best practices and USIBWC business practices.

(a) The Federal Information Security Modernization Act of 2014

(b) NIST SP-800-82, Revision 3, Guide to Industrial Control Systems (ICS) Security

(c) DHS-Homeland Security’s Recommended Practice: Improving Industrial Control System

Cybersecurity with Defense-in-Depth Strategies, September 2016

(d) DHS-Homeland Security’s Configuring and Managing Remote Access for Industrial

Control Systems, November 2010

(e) DHS-Homeland Security’s Recommended Practice for Patch Management of Control

Systems, December 2008

5. DELIVERABLES

IBWC ALL:

(a) Acts as IBWC SCADA expert on new, existing and expansion projects for all sites.

(b) States standards/establishes agency standards for SCADA to include NIST/RMF Standards

– Established by SCADA SME and IMD

(c) Review designs and proposals – provides recommendations and areas for improvement for integration into SCADA.

a. To include but not limited to facility improvement projects, including but not limited to reviewing contractor bids for SCADA system upgrades or modifications, verifying hardware/software, compatibility with existing system, and reviews Bill of Materials (BOM) proposals. Reviews risk assessments and SCADA integration plans, reviewing and advising on required documentation and integration strategies.

Verifies field commissioning/testing and project completion and planned integrations are completed as designed and documented. Reviews proposed SCADA system PLC or HMI programming language changes for approval.

Participates in the acquisition process of systems or support resources as necessary to include overseeing the budget, staffing, and contracting resources required to plan, design and implement SCADA system projects. Provides advice on project costs, design concepts, or design changes required for possible improvements and upgrades. Identifies and prioritizes critical System upgrades or improvements, in collaboration with agency stakeholders or contractors. Provides input into implementation plans and standard operating procedures.

(d) Assists and Develops SCADA SOW(s)/PWS(s) and RFP(s)

(e) Audit existing SCADA units for compliance and provide recommendations and findings to org

a. Audit expectation is at least once a year on sites with existing O&M contracts

i. IBWC will help to generate audit metrics

Nogales

(a) Train key IBWC personnel on how to access Networking components of the SCADA system.

(b) Address system vulnerabilities with Critical and high patches/updates (Servers and PLCs)

(c) Provide Remote troubleshooting support for the SCADA system, consistent with the contract requirements within 4 hours of being made aware of issue – From IBWC IMD.

(d) Provide emergency on-site troubleshooting, upgrade, or repairs if cannot be accomplished remotely – respond within 72 hours (IBWC will pay for travel and any hardware, equipment to be replaced). Contract will provide estimated timeline and fix action prior to 72 Hours – if cannot be done in time.

(e) IBWC will pay for all equipment directly or reimburse for any additional expenses outside of this contract.

(f) IBWC to purchase Rockwell licenses, by purchasing a Rockwell Toolkit subscription (To include Legacy Software Add-on), needed for PLC software.

(g) Identify items /devices in most critical need of update (up to 20% of system) and do upgrade (Infrastructure Only -- No Outside Plant Work) (IBWC will purchase hardware and software – and any unforeseen expenses) (Only to be done one time)

12) Provide documentation and as-builts / testing results after completing (For Network and PLC Eqmt).

(h) Draft up a new solution for a complete rebuild of the system – full solution/turn key (just design and equipment required) – to get complete system up to standard. (Provide 2 quotes Higher Price Point / Lower Price Point)

12) May be asked to perform work under a separate order.

(i) Keep Network Design layouts updated along with Hardware and Software Lists. IBWC can provide template if needed.

(j) Develop RMF documentation at the System Level

San Diego

(a) Act as functional expert for the SCADA system (But not as operator)

(b) Where needed and on a limited basis - Assists in providing emergency maintenance/direction in critical times of need – provide guidance to O&M contract

(c) ID items in most critical need of upgrade (for O&M contract to purchase).

6. SCOPE

The Contractor shall provide the following System maintenance at the NIWTP SCADA System.

Performance Metric Performance Standard Acceptable Quality Level

(AQL)

Method of Surveillance

System Documentation Complete and submit all required system documentation by the end of the period of performance.

100% Report review

Emergency Response to Incidents and Operations Issues

Respond to emergency incidents and operations issues within 8 hours. 100%

Emergency response documentation, inspection, complaints

7. Patching Level Expectations

Contractor shall update, patch and remediate any software, firmware, or patches that are deemed critical either by IBWC, or CISA. Critical Vulnerabilities shall be completed within 14 Days. No Monthly Report required.

Table 7-1: Patching, Remediation and Emergency

Response Times

Category Response Time

Critical Vulnerabilities Within 14 days of notification

8. USIBWC Points of Contact The following Points of Contact are provided for the contractor to help perform the scope of requirements under this contract and report activities towards each CLIN completion. If the contacted personnel are unavailable, the notification will be raised to the next contact listed.

Table 4-1: Primary Points of Contact for USIBWC

USIBWC Headquarters

Contact Phone Email

Donald Gazaway, Network Admin

915-832-4130 (work) Donald.Gazaway@ibwc.gov

Antonio C.

Almaguer, Supervisor

(915) 832-4726 (work)

(915) 710-9452 (cell) Antonio.Almaguer@ibwc.gov

Nogales, IWTP

John Light, USIBWC Area Operations Mngr.

(520) 281-5814 (work)

(520) 470-9029 (cell)

John.light@ibwc.gov

Albert Flores, AAOM (520) 281-1832 Albert.Flores @ibwc.gov

9. REQUIRED PERFORMANCE METRICS (RPM) TABLE

Performance Metric Performance Standard Acceptable

Quality Level

(AQL)

Method of Surveillance

System Documentation

Complete and submit all required system documentation by the end of the period of performance.

100% Report review

Patching Operations and Maintenance

Initiate patching operations and maintenance as required. 100% Vulnerability scan results

Emergency Response to Incidents and Operations Issues

Respond to emergency incidents and operations issues within 8 hours. 100%

Emergency response documentation, inspection, complaints

Project Management

Provide necessary project management support, including biweekly technical status meetings, project management documentation, and trip reports.

100%

Timeliness of reporting, status meetings, inspection, verification of data provided

10. INCREMENTAL FUNDING LIMITATION OF GOVERNMENT’S OBLIGATION

If an order is incrementally funded, it shall specify the total amount of the order, the amount obligated, the estimated performance period based on the amount of obligated funds, and a statement that the contractor is not required to perform work nor is the Government obligated to reimburse the contractor for work performed in excess of the amount obligated.

11. AVAILABILITY OF FUNDS

The Government's obligation regarding orders placed under this contract is contingent upon the availability of appropriated funds from which payment for ordering purposes can be made. No legal liability on the part of the Government for any payment may arise until funds are available and until there is written notice to the contractor from the Contracting Officer.

12. FFP “AS A SERVICE” PRICING IN ORDERS

It is the Government’s intent to implement “as a service” pricing for some orders when appropriate to the Government’s requirements. This will be one or more FFP CLINs that will include software, ancillary hardware, and services requirements for a defined contract period into one FFP price. The contractor shall then propose one FFP based on hardware, tools, and services as available on contractor’s IT Schedule 70 and this contract. If required, details instructing the contractor to provide pricing for these CLINs will be in the order.

13. PERIOD OF PERFORMANCE

The period of performance for this contract is 365 days from date of award, with further renewals probable.

Contract is to be Base Year, plus 3 Option Years.

14. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

The CO will appoint a COR in writing using a COR Appointment Letter that will be provided to the contractor upon award.

CORs are not authorized to change any of the terms and conditions, scope, schedule, and price of the contract. Changes in the scope of work will be made only by the Ordering CO by properly executed modifications to the order or by modification to the contract.

15. CONTRACT ADMINISTRATION

Contracting Officer:

Suzette Smith Contracting Officer U.S. International Boundary and Water Commission 4191 N. Mesa El Paso, TX 79902 Telephone: (915) 832-4129 Email: Suzette.Smith@ibwc.gov

Contracting Officer’s Representative:

Antonio C. Almaguer “T.C.”

Chief Information Officer U.S. International Boundary and Water Commission 4191 N. Mesa El Paso, TX 79902 Telephone: (915) 832-4755 Cell: (915) 929-7727 Email: antonio.almaguer@ibwc.gov

16. ORDER QUOTE SUBMISSION

At a minimum, the quote shall include:

(a) Price: The quote may include a detailed cost per hour of all labor required to accomplish the tasks as set forth in this PWS or be a fixed-price quote with sufficient information to substantiate the price quoted. Prime contractor shall provide off-site or on-site rates as required by the order. The discounts offered do not preclude the prime contractor from offering or the Government requesting further price reductions in accordance with commercial practices, market forces, and volume buying at the time of placing orders.

(b) Statement disclosing any known or expected conflicts of interest pursuant to FAR 9.5: The quote may also require the submission of the following additional information (the Government is not limited to the list below and may require other information than posted on the evaluation factors in the solicitation):

1) Technical information (e.g., technical approach, including team partners and experience as required by the PWS).

2) Technical data, computer software, and computer software documentation, if applicable, as required in reference to meeting the needs of the statement of work in the PWS.

3) Corporate Experience (as it relates to the specific requirements of an order).

4) Proposed Key Personnel and Staffing.

5) Price Quote and any additional discounts against the schedule labor rates.

(c) Evaluation: The Government will evaluate responses against evaluation criteria contained in the order PWS.

17. ORDER ISSUANCE

The SOW, labor mix, and hours (if applicable), as well as a proposed ceiling price for the PWS, may be incorporated into the order. The proposed technical solution may also be incorporated in the order. Each order shall, as appropriate:

(a) Set forth a pricing schedule.

(b) Set forth the specific level of effort and/or performance outcomes desired to be fulfilled under the order based on the estimated dollar value and complexity of the proposed order.

(c) Designate the Ordering COR who will perform inspection and acceptance. (d) Set forth any payment options.

(e) Be dated.

(f) Set forth the property, if any, to be furnished by the Government and the date(s) such property is to be delivered to the contractor.

(g) Set forth the disbursing office where payment is to be made.

(h) Set forth administration data.

(i) Set forth the contractor’s and Government’s respective technical data rights. (j) Set forth any other pertinent information

18. INVOICE REQUIREMENTS

Invoices shall be submitted in accordance with FAR Clause 52.212-4(g). Invoices shall be submitted to invoices@ibwc.gov with a courtesy copy sent to the CO and COR.

19. FIRM-FIXED-PRICE (FFP) CLINs If no payment schedule is specified in the order, the contractor may invoice monthly, the amount obtained by dividing the FFP amount for the order period, by the number of months of performance in the period. For FFP CLINs, the invoice shall include the period of performance covered by the invoice, and the CLIN number and title. All amounts invoiced shall be reported by CLIN element (as shown in Section 1 – Supplies or Services and Price of the order) and shall be provided for the current invoice and in total from project inception to date. The contractor shall provide the invoice data in spreadsheet form with the following detailed information. The listing shall include separate columns and totals for the current invoice period and the project to date.

(a) FFP period of performance period

(b) Amount invoiced

20. TRAVEL

The contractor may invoice monthly based on cost incurred for cost of travel comparable with the Joint Travel Regulation (JTR)/Federal Travel Regulation (FTR). The invoice shall include the period of performance covered by the invoice, the CLIN number and title, and the GSA Schedule number. Separate worksheets, in MS Excel format, shall be submitted for travel.

CLIN/Task Total Travel: This invoice information shall identify all cumulative travel costs billed by CLIN/Task. The current invoice period’s travel details shall include separate columns and totals and include the following:

(a) Travel Authorization Request identifier, approver name, and approval date

(b) Current invoice period

(c) Names of persons traveling

(d) Number of travel calendar days

(e) Dates of travel

(f) Number of calendar days per diem charged

(g) Per diem rate used

(h) Total per diem charged

(i) Transportation costs (rental car rental, air fare, etc.)

(j) Total charges

(k) Explanation of variances exceeding 10% of the approved versus actual costs (l) Indirect handling rate

21. GOVERNMENT-FURNISHED EQUIPMENT AND GOVERNMENT FURNISHED

INFORMATION

The USIBWC may provide the contractor with some of the necessary information, and/or office space required to perform the services outlined in this contract. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract.

In addition, the contractor shall protect all Government data, etc., by treating the information as Controlled Unclassified Information (CUI). CUI data, and/or equipment will only be disclosed to authorized personnel as described in the order. The contractor shall keep the information confidential, use appropriate safeguards to maintain its security in accordance with minimum Federal standards.

When no longer required, this information, data, and/or equipment shall be returned to Government control, destroyed, or held until otherwise directed by the CO. The contractor shall destroy unneeded items by burning, shredding, or any other method that precludes the reconstruction of the material.

Work under this contract may require that the contractor’s personnel have access to information covered under the Privacy Act. Contractor personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, section 552a and applicable agency rules and regulations.

22. ACCESS TO FACILITIES, SYSTEMS AND SECURITY CLEARANCE

REQUIREMENTS

The USIBWC has specific personnel security and background check requirements for contractor personnel to access the facilities and SCADA systems necessary to perform the work described in this PWS. Any personnel requiring administrator privileges to any SCADA Systems components, appliances, hardware, operating systems or applications will require a favorably Adjudicated Tier 4 Suitability level background investigation or equivalent background investigation. Personnel proposed for administrator privileges must be eligible for Tier 4 prior to award. All personnel requiring access to programming code or field devices in support of deliverables of this contract that do not require administrator privileges to the System or SCADA System applications will require a Tier 2 Suitability level background investigation prior to working on these Systems. All contractors, whether they are the primary contractor or any subcontractor, must have U.S citizenship.

23. SECURITY REQUIREMENTS

The contractor is advised to review the NIST documents to determine the level of effort that will be necessary to complete the requirements.

24. USIBWC SYSTEM SECURITY COMPLIANCE REQUIREMENT

The data that will be processed by the information systems being requested in support of contract requirements will be classified by the Office of the Chief Information Officer (OCIO), or equivalent for impact in the PWS, in all three categories (confidentiality, integrity, and availability) as defined in Federal Information Processing Standards (FIPS) Pub 199, “Standards for Security Categorization of Federal Information and Information Systems.” The three categories are defined as follows:

Definitions:

(a) CONFIDENTIALITY: “Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information…” [44 U.S.C, Sec 3542] A loss of confidentiality is the unauthorized disclosure of information.

(b) INTEGRITY: “Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity…” [44 U.S.C., Sec 3542] A loss of integrity is the unauthorized modification or destruction of information.

(c) AVAILABILITY: “Ensuring timely and reliable access to and use of information…” [44 U.S.C., Sec 3542] A loss of availability is the disruption of access to or use of information or an information system.

NIST Special Publication 800-53 Revision 5, “Recommended Security Controls for Federal Information Systems” (hereafter described as NIST SP 800-53) defines requirements for compliance to meet the minimum-security requirements. NIST SP 800-53 requirements are viewed as mandatory requirements for which some risks are acceptable, but generally most requirements pertaining to the impact level must be incorporated into the infrastructure. The controls requiring organizationally defined parameters will be provided by the ordering activity within the individual PWS.

The contractor shall implement the controls from NIST SP 800-53 for the appropriate impact level (as defined in FIPS 199). The Government has determined that the appropriate impact level for CDM systems is “high” for availability and integrity and “moderate” for confidentiality.

The contractor shall generally and substantially and in good faith follow NIST guidelines and any security guidance provided by the ordering activity, or activity being supported by the order, as appropriate. Where there are no procedural guides, the contractor shall use generally accepted industry’s best practices for IT security.

25. REQUIRED SECURITY POLICIES AND REGULATIONS

To perform work on orders under this contract, the contractor shall be subject to all ordering activity IT security standards, policies, reporting requirements, and Government-wide laws or regulations applicable to the protection of Government-wide information security.

Contractors are also required to comply with FIPS, the “Special Publications 800 series” guidelines published by NIST, and the requirements of FISMA.

• Federal Information Security Management Act (FISMA) of 2002.

• Clinger-Cohen Act of 1996 also known as the “Information Technology Management Reform Act of 1996.”

• Privacy Act of 1974 (5 U.S.C. § 552a).

• Homeland Security Presidential Directive (HSPD-12), “Policy for a Common

Identification Standard for Federal Employees and Contractors,” August 27, 2004.

• Office of Management and Budget (OMB) Circular A-130, “Management of Federal Information Resources,” and Appendix III, “Security of Federal Automated Information Systems,” as amended.

• OMB Memorandum M-04-04, “E-Authentication Guidance for Federal Agencies.”

• FIPS PUB 199, “Standards for Security Categorization of Federal Information and

Information Systems.”

• FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems.”

• FIPS PUB 140-2, “Security Requirements for Cryptographic Modules.”

• NIST Special Publication 800-18 Rev 1, “Guide for Developing Security Plans for

Federal Information Systems.”

• NIST Special Publication 800-30, “Risk Management Guide for Information Technology Security Risk Assessment Procedures for Information Technology Systems.”

• NIST Special Publication 800-34, “Contingency Planning Guide for Information Technology Systems.”

• NIST SP 800-37, Revision 1, “Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach.”

• NIST Special Publication 800-47, “Security Guide for Interconnecting Information Technology Systems.”

• NIST Special Publication 800-53 Revision 5, “Recommended Security Controls for Federal Information Systems.”

• NIST Special Publication 800-53A, “Guide for Assessing the Security Controls in Federal Information Systems.”

• NIST Special Publication 800-82r2, “Guide to Industrial Control Systems (ICS) Security (May 2015)

• Department of Homeland Security: Cyber Security Procurement Language for Control Systems (Sept 2009)

• Recommended Practice for Patch Management of Control Systems (Dec 2008)

• Recommended Practice: Improving Industrial Control System Cybersecurity with

Defense-in-Depth Strategies

• Configuring and Managing Remote Access for Industrial Control Systems http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf

26. ADDITIONAL SECURITY STIPULATIONS

Under this contract, deliverables designated in the PWS shall be labeled “CONTROLLED UNCLASSIFIED INFORMATION (CUI) per document sensitivity labeling requirements.

External transmission/dissemination of CUI to or from a government computer must be encrypted.

Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security requirements for Cryptographic Modules.”

As prescribed in the Federal Acquisition Regulation (FAR) 24.104, if the system involves the design, development, or operation of a system of records on individuals, the contractor shall implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.”

The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. The contractor shall be responsible for privacy and security safeguard provisions in accordance with FAR clause 52.239-1 “Privacy and Security Safeguards.”

The contractor shall not publish or disclose in any manner, including responding to press inquiries, without the Ordering CO’s written consent, the details of any security safeguards either designed or developed by the contractor in support of this contract or otherwise provided by the Government.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the contractor, the contractor shall afford the Government logical and physical access to the contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of the request. Automated audits shall include, but are not limited to, the following methods:

(a) Authenticated and unauthenticated operating system/network vulnerability scans.

(b) Authenticated and unauthenticated web application vulnerability scans.

(c) Authenticated and unauthenticated database application vulnerability scans.

Automated scans may be performed by Government personnel, or agents acting on behalf of the Government, using Government-operated equipment, and Government-specified tools. If the contractor chooses to run its own automated scans or audits, results from these scans may, at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor-conducted scans shall be provided, in full, to the Government.

If new or unanticipated threats or hazards are discovered by either the Government or the contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

27. ORGANIZATIONAL CONFLICT OF INTEREST

For work to be performed in support of this contract, if the contractor has or is currently providing support or anticipates providing support to the department or agency, for whom order work is being performed, that creates or represents an actual or potential organizational conflict of interest (COI), the contractor shall immediately disclose this actual or potential COI in accordance with

FAR Subpart 9.5. The contractor is also required to complete and sign an Organizational Conflict of Interest Statement in which the contractor (and any subcontractors, consultants or teaming partners) agrees to disclose information concerning the actual or potential conflict with any quote for any solicitation relating to any work in the order. All actual or potential COI situations shall be handled in accordance with FAR Subpart 9.5.

28. NON-DISCLOSURE REQUIREMENTS

If the contractor acts on behalf of, or provides advice with respect to any phase of agency procurement, as defined in FAR 3.104-4, then the contractor shall ensure that all its personnel (to include subcontractors, teaming partners, and consultants) who will be personally and substantially involved in the performance of the order:

(a) Execute and submit a Corporate Non-Disclosure Agreement (NDA), using procedures outlined in the order PWS, prior to the commencement of any work on the order, and are instructed in the FAR 3.104 requirements for disclosure, protection, and marking of contractor bid or quote information, or source selection information.

All proposed replacement contractor personnel must submit a Non-Disclosure Agreement and be instructed in the requirements of FAR 3.104. Any information provided by contractors regarding the performance of order work under this contract, or obtained by the Government, is only to be used in the performance of the order. The contractor shall put in place appropriate procedures for the protection of such information and shall be liable to the Government for any misuse or unauthorized disclosure of such information by its personnel, as defined above.

29. INTELLECTUAL PROPERTY RIGHTS

The existence of any patent, patent application, or other intellectual property right that encumbers any deliverable must be disclosed in writing on the cover letter that accompanies the delivery. If no such disclosures are provided, the data rights provisions in FAR 52.227-14, Rights in Data – General, Alt. II and III apply. The Software Agreements referenced in Section 7.9, amended as contemplated therein, shall be deemed to constitute such disclosure regarding their associated commercial software tools and shall prevail over any inconsistent provision in FAR 52.227-14, Rights in Data – General, Alt. II and III to the extent of such inconsistency.

30. U.S. GOVERNMENT CONFIGURATION BASELINE (USGCB)

The contractor shall certify that software applications and tools are fully functional and operate correctly as intended on systems using the USGCB. The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved USGCB configuration.

Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The contractor shall use Security Content Automation Protocol (SCAP) validated tools with USGCB Scanner capability to certify their products operate correctly with USGCB configurations and do not alter USGCB settings.