RFI Intranet Modernization SOW (Draft).pdf

Government Accountability Office

Request for Information (RFI) for

GAO’s Intranet Modernization and Cloud Hosting (intranet.gao.gov)

Statement of Work

Contents

Introduction

Background

Objective

Working with GAO

Scope

1 WCMS and Search Requirements

1.1 Application Programming Interfaces (APIs)

1.2 WCMS Functionality

1.3 Redesign

1.4 Information Architecture and Navigation

1.4.1 Taxonomy

1.5 Search

1.6 Reporting and Analytics

1.7 Publishing and Workflow

1.8 User Roles and Permissions

1.9 Migration

1.10 User Guides and Training

2 Platform as a Service Requirements (PaaS) Requirements

2.1 Platform as a Service (PaaS) Capabilities

2.2 Load Time

2.3 99.9 Percent Availability

2.4 API Support

2.5 Application Log File Management

2.6 Customer Support

2.7 Security and Privacy

2.7.1 Security Audit Log Management

2.7.2 Authentication

2.7.3 Permissions

2.7.4 System Availability

2.7.5 Comprehensive Backup and Restoration

2.7.6 Data Management

2.7.7 Vulnerability Management

2.7.8 Incident Response

2.7.9 Media Protection

2.7.10 Personnel Security

2.7.11 Privacy Protections

2.7.12 Protection of Information at Rest

2.7.13 Secure Communications

2.7.14 Security Alerts, Advisories, and Directives

Introduction

The U.S. Government Accountability Office (GAO) is an independent, nonpartisan agency that works for Congress. Often called the "congressional watchdog," GAO investigates how the federal government spends taxpayer dollars. Our mission is to support Congress in meeting its constitutional responsibilities and to help improve the performance and ensure the accountability of the federal government for the benefit of the American people. We provide Congress with timely information that is objective, fact-based, nonpartisan, non-ideological, fair, and balanced.

Background

GAO’s current intranet was launched in 2008 and is maintained using a customized Web Content Management System (WCMS). GAO’s intranet is the primary platform for employees to access the information and applications they need to do their work and manage their careers.

To ensure employees have accurate and timely information, a core intranet team manages the intranet’s homepage, day-to-day operations, and governance. Additionally, about 400 content authors across the agency independently maintain content.

Objective GAO intends to obtain support and services for a full redesign of GAO’s intranet as well as a cloud-hosted WCMS and cloud hosting for the website. The new Intranet WCMS must be open source and hosted in the cloud. The cloud implementation must be a Platform as a Service (PaaS) solution that is only accessible within GAO’s network and hosted by selected vendor.

GAO is seeking a website redesign services and support that incorporate best practices at every step: discovery, prototyping, configuring the site and its tools, structuring the content management system architecture, integrating robust search capabilities, migrating content, training, launching the new site, and GAO’s ability to maintain the site going forward.

The WCMS must provide an improved employee experience with modern design, functionality, and features. The WCMS must be designed to enable information to be viewable by all GAO employees and editable by designated content authors.

In addition to content contained within the WCMS, content from designated applications and data sources must be migrated from the current intranet into the new WCMS.

Working with GAO

• GAO follows Agile, Scrum, and Kanban methodologies, where appropriate, for its technical projects. The Contractor shall follow the project management frameworks for the WCMS Intranet Modernization project.

• GAO considers User Acceptance Testing (UAT) as a part of its Definition of Done (DoD) for stories/tasks. A story/task shall include tasks for UAT where appropriate.

• The Contractor shall provide a codebase/repository access of the new WCMS GAO’s web developer to perform code review and testing.

• The Contractor proposed solution for WCMS project shall use a Global information tracker (Git) and a source code management tool to manage the day-to-day development work for the new WCMS Application and Search after the Go-Live date.

Scope The Contractor shall migrate the Content from several sites to fully consolidate and redesign GAO’s intranet. All sites and servers within this project are internal to GAO’s network and are not publicly accessible. They are listed as followed:

• https://intranet.gao.gov/ o 50GB File System o 150GB Database

• https://our.gao.gov/

• https://notices.gao.gov/

• https://gallery.gao.gov/gallery

• On premise server of files containing documents and internal-use video assets

1 WCMS and Search Requirements The new web content management system (WCMS) shall support device agnostic webpages1 and be fully functional across modern web browsers.

The WCMS shall adhere to the U.S. Web Design Standards (USWDS)2 version 3.0 or higher with the ability to pull versioning updates direct from USWDS’ code repository. The Contractor shall also allow for customization at GAO’s instruction.

The WCMS shall be compliant with all standards of section 508 of the Rehabilitation Act, and WCAG 2.1 AA. When creating or testing for accessibility, the Contractor team processes shall follow the Department of Homeland Security Trusted Tester methodology3.

The WCMS shall be a widely adopted open-source solution. The selected WCMS shall be able to be regularly updated to address security vulnerabilities and maintain its functionality as

1 https://digital.gov/resources/checklist-of-requirements-for-federal-digital-services

2 https://designsystem.digital.gov/

3 https://www.dhs.gov/trusted-tester technology changes over time (e.g. major releases of its programing language and/or framework).

The WCMS shall support dynamic webpage content and other automated processes that allow content managers to reduce the need for manual workflow processes and/or data entry, where appropriate.

The Contractor shall provide analysis to determine and implement a strategy for the WCMS to work in conjunction with other collaboration tools available at GAO, such as Microsoft Teams, Microsoft 365 and GAO’s Enterprise Content Management System (SharePoint).

• For example, links to SharePoint from the WCMS will always open the latest version of the file(s).

1.1 Application Programming Interfaces (APIs)

• The WCMS shall support API architecture capabilities to allow for interoperability and custom integration with other GAO systems as needed.

• The Contractor shall develop custom API(s), as needed, to migrate content and media to the new WCMS should the selected WCMS not have an “out-of-the-box” capabilities to migrate GAO’s content and media from its source to the new WCMS.

1.2 WCMS Functionality

• The WCMS shall meet all GAO records retention and privacy requirements.

• The WCMS shall support GAO’s internal staff blog. The blog’s mission is to connect GAO’s employees across its organization and physical locations throughout the United States.

• The WCMS shall be able to ingest feeds (RSS, JSON, XML) from its public website GAO.gov and other internal websites.

• The WCMS shall prevent duplicate file uploads. If a user tries to upload a duplicate file, the WCMS shall display a prompt with link to the media asset that already exists in the

WCMS.

• The WCMS shall have calendar integration. All GAO events shall be display in a calendar view.

• The WCMS’ “What You See Is What You Get” (WYSIWIG) editor shall support CKEditor

5.0 or higher.

• The WCMS shall support webforms that can also be configured to be confidential/ anonymous, where appropriate.

• The WCMS shall support the sending of email:

o The WCMS shall be able to send an email if a publishing state changes.

o The WCMS shall be able to send staff a list of content from a content type or dynamic display that has been published throughout the week.

• The WCMS shall support user authentication and the creation of user role/permissions.

o The WCMS shall authenticate GAO users via username and password.

o The system shall support minimum password strength requirements (minimum 12 characters, mixture of upper and lowercase letters, mixture of letters and numbers, includes at least one special character (! @, #, %, etc.)

o This system shall allow for user-initiated password resets to a user’s gao.gov email address o The WCMS shall be ready to support Single sign-on (SSO) or Security Assertion Markup Language (ASML) for account access but not have it enabled for Go- Live.

• The new website architecture shall support and where possible automate the process for managing GAO Notices, which are the Agency’s primary mechanism for delivering information to employees. In doing so, the WCMS shall o Provide the ability to display Notices on the homepage, grouped by category o Provide the ability to display a calendar view of events on the homepage o Provide the ability to add events to users Microsoft Outlook calendar o Provide the ability to flag events that meet specific criteria o Provide the ability to set expiration dates for notices display o Provide the ability to search content, specific to Notices o Provide the ability to automate the deletion of Notices according to records retention policy o Allow users to submit new GAO Notices via webform.

• The new website architecture shall support and where possible automate the process for managing GAO Forms and Orders. GAO Forms and Orders shall be o Sortable by number, date, title, category or point of contact o Allow links to source documents stored in GAO’s Enterprise Content Management System o Support links to Point-of-Contact (POC) email addresses o Support a description field with formattable text.

• The WCMS shall allow images to be expandable from its embedded size on a page into a lightbox. The lightbox shall allow users to click through all images on the page, view image captions, link to the image’s metadata page, and download image link. Images shall have several different styles for content creators to choose from as they add images to their content.

o Specifically, WCMS shall support the storage and organization of images:

Viewing

• Ability to organize images in albums

• Ability to view images in multiple resolutions, including full size image

• Ability to view multiple thumbnails on a single page

• Ability to view image publish date

• Ability to link to albums and images by URL

• Ability to embed images and alternative text within intranet content

• Ability to print images

Asset Entry

• Ability to batch upload images

• Ability to upload individual images

• Ability to upload images of various sizes (i.e. at least 5 megabits)

• Ability to have flexible system storage space that expands as needed

• Ability to add tags/metadata

• Ability to add descriptions/captions

• Ability to upload images of various file types (e.g., png, jpeg, gif, psd, tif, etc.)

• Ability to upload images in high resolution

• Ability to link files within descriptions/captions

• Ability to have an audit log

Image and Album Editing

• Ability to edit image description/caption

• Ability to rename album

• Ability to replace an existing image

• Ability to delete images

Organization and Retrieval

• Ability to generate new albums and sub-albums

• Ability to apply a standard naming convention to images

• Ability to batch rename images and albums

• Ability to batch tag albums of images

• Ability to store images in high resolution

• Ability to rearrange images

• Ability to move images

• Ability to nest albums

• Ability to move albums

• Ability to download images at original file resolution

• Ability to compress image file sizes for efficient page loading

Accessibility/Search

• Ability to search by keyword

• Ability to search single album

• Ability to search entire image library

• Ability to search by tag/metadata

• Ability to search by description/caption

• Ability to search by publish date

1.3 Redesign

• The Contractor shall use User Experience and User Interface (UX/UI) best practices to conduct user testing to inform the Information Architecture (IA) and overall design of the new Intranet WCMS. The Contractor shall:

o facilitate collaborative sessions or workshops to analyze and determine how to best structure the GAO intranet information architecture with the goal of providing an intuitive interface and positive user experience.

o facilitate user testing sessions with stakeholders for the various components, navigation, and information architecture of the new website.

• The Contractor shall provide three (3) to five (5) visually appealing, modern, responsive design options for GAO to select from as the new Intranet design.

o The Contractor shall follow iterative design best practices to select the final design from the initial design deliverables.

o The final design shall promote time-sensitive information make frequently needed content and tools easily accessible

1.4 Information Architecture and Navigation

• The WCMS shall allow flexibility in structuring content. It must support creating a new overall navigation, and clearly structured parent and child pages.

• The architecture shall support a variety of content type and media types (images, videos, audio, documents, pdfs, spreadsheets, data files, etc.)

• The new website navigation shall take the different information needs of our staff audiences into account.

o For example, Human Resources content and office operating status of GAO’s offices need to be easily accessible for all staff. Attorneys, Auditors, and other staff need to be able to easily access their own teams’ work tools and resources.

• The new website design shall be standardized across site sections to ensure a consistent user experience. Standardization must include:

o Global header, footer and search bar o Standard template layouts

1.4.1 Taxonomy

• The WCMS shall integrate with a commercial off-the-shelf, W3C complaint, taxonomy management and document classification software that GAO staff would maintain.

• Navigation and taxonomy shall work together, to support multiple connections and interrelations. For example:

o The navigation shall funnel or guide a user from a general topic area to a specific item on the intranet (staff announcements, FAQs, townhall meeting recordings, employee organizations, etc.). This sort of ‘drill-down navigation` must help a user navigate from a broad topic like “Employee Benefits” to a specific item in as few steps as possible. Conversely, a user must also be able to navigate form one specific item an easily ‘drill-up’ to a general topic.

o The navigation shall support enhanced interactivity across our content. This sort of ‘multidimensional’ navigation shall allow a user to browse and explore topics that may interest them. For example, a user can see all townhall recordings from the previous year or newly issued FAQs.

• The taxonomy module in the WCMS shall allow for a minimum of three (3) separate taxonomies to be imported into it and used to assigned terms to intranet content and assets.

• The WCMS must allow for both item-specific and group application of taxonomy terms to website content and assets.

1.5 Search

• The WCMS shall, support a website search feature or integrate with an off-the-shelf search technology.

• Search shall support a range of users, such as new employees who may be unfamiliar with GAO and longtime employees who likely have more familiarity with GAO.

• Search shall support the ability to have a dedicated search for specific content types.

o Example: A search specific to Human Resources’ FAQs o Natural language search

• Search shall support facets and filtering by taxonomies, topic/tags, and dates

• Search shall support synonyms so search results can reflect internal terminology o Example: Townhall Meeting and All-Hands Meeting

• Search shall regularly update with new/modified information either in real-time or via scheduled job (such as every 5-10 minutes for a larger index).

• Search shall support highlighting of query string/keyword(s) in search results

• The search results page shall support integration with other sources and indexing of designated content from other internal sources o E.g. a search for “Timesheets” will display a component at the top of the search results with a link to the external payroll website.

• A basic search and an advanced search function shall be available. Search shall support full text searching for content and metadata of web pages within the WCMS

• The advanced search shall support the following functions (syntax may be different than examples shown):

o Boolean operators (e.g. analyst OR specialist) o Truncation (e.g. environment* for environmental, environmentalism, etc.)

o Grouping strings (Analyst OR specialist) AND (promotion OR “career path”) o Proximity searching (“child care” “tax credit” ~3; the phrases are within 3 words of each other).

o Fuzzy logic o Summarization o Heuristics

1.6 Reporting and Analytics

• The WCMS shall provide reporting functions that allow users to generate (based on their roles and permissions) reports to view page analytics, top searches, content creation/update/authoring data, and feedback responses.

• Analytics shall be provided in a format that enables content authors to analyze aggregated trends over time, including most/least viewed pages, user clicks, user paths, user engagement and other key performance metrics.

1.7 Publishing and Workflow

• The WCMS shall support the ability to review and approve content for publishing.

• The WCMS shall provide an audit history of changes made to content.

• The WCMS shall provide a capability to revert to previous versions of the content.

• The WCMS shall support the capability to automatically show the date a webpage was last updated.

• The WCMS shall support the ability to archive content for records retention.

• The WCMS shall allow for scheduling the publication of content and media. Conversely, the scheduling tool shall also allow for the scheduling of the unpublishing of content and media.

o The WCMS shall also allow for items to display on the homepage for a scheduled period of time but once it expires, the reference on the homepage disappears and the actual page is still published in the WCMS.

Example: A component with a page reference to an announcement is published to the homepage. The component will expire and remove itself from the homepage, but the announcement will still be accessible to users.

• The WCMS shall support the ability to save a page as a draft.

• The WCMS shall support revisioning of all content and media assets.

• The WCMS shall support content and media dashboards so that they are able to quickly see and find all content and content that is under moderation.

1.8 User Roles and Permissions

• The WCMS shall have user role recognition and permissions for managing editorial workflows as well as content and media for webpages. The vendor shall configure roles with the following permissions:

o Viewer (Level 0) See all pages on the intranet without having the ability to make edits.

o Editor (Level 1)

Must be assigned to a page to gain edit access. Permissions must be assignable on an individual page level, not just at the subsite/section level.

Draft and publish content on assigned pages, without the ability to manage navigation, create and delete pages, and add code within the content editor.

See analytics data for assigned pages.

The ability to give other content authors edit access to owned pages, so long as the other content authors also have permission to the same subsite/section of the intranet.

o Intranet Site Coordinator (Level 2) Must be assigned to a section of the intranet to gain edit access.

Draft and publish content on all pages of an assigned subsite/sections, without the ability to add code within the content editor.

Manage navigation within an assigned subsite/section of the intranet.

Create and delete pages within an assigned subsite/section of the intranet.

See analytics data for assigned subsite/section of the intranet.

Manage content author permissions on an assigned subsite/section of the intranet.

Note: permissions must be easily assignable at the page and subsite/section level (i.e., the WCMS needs flexibility to allow content authors to be assigned to individual pages or a whole subsite/section without having to assign on a page-by-page basis).

o Intranet Manager/Developer (Level 3) Draft and publish content on all subsites/sections of the intranet, with the ability to add code within the content editor.

Manage the navigation on all subsites/sections of the intranet.

Create and delete pages on all subsites/sections of the intranet.

Create and delete subsites/sections across the intranet.

See analytics data for all subsites/sections of the intranet.

Create, edit, and delete user accounts permissions.

Access to intranet configuration settings and reports.

o Administrator Full access to all content and media across the Intranet

• The WCMS shall support multiple content authors to access the system concurrently, based on their role and responsibilities.

• The WCMS shall be configured in a way that prevents users from making edits to the same content at the same time if it would cause associated changes to be lost or overridden.

1.9 Migration

• The Contractor shall develop and deliver a comprehensive content migration and website transition and plan. Migration shall include content that is hosted in the following internal sites:

o https://intranet.gao.gov/

50GB File System

150GB Database o https://our.gao.gov/ o https://notices.gao.gov/ o https://gallery.gao.gov/gallery o On premise server of files containing documents and internal-use video assets

• The website transition plan shall provide build specifications of the new WCMS. These build specifications shall include:

o Content Types o Media Types o Fields for content and media types o Image styles o Menus o Taxonomy Vocabularies o Components o User Roles o Dynamic content/displays o Content specific search pages

E.g. a search of a specific content and/or media type o Webforms

1.10 User Guides and Training

The Contractor shall provide a comprehensive training plan for users at all levels. Training shall include:

• Live and recorded training webinars

• A training repository with comprehensive documentation and user guides

• Additional training as directed by GAO

2 Platform as a Service Requirements (PaaS) Requirements The Contractor shall provide a FedRAMP compliant Platform as a Service (PaaS) cloud hosting solution that also supports off-the-shelf search. The service shall have all required security, including FedRAMP, service delivery and hosting capabilities necessary to effectively support the web content management and hosting needs of GAO for its intranet. The solution shall be based on current and evolving industry standards and best practices over the course of the contract duration.

2.1 Platform as a Service (PaaS) Capabilities

• The PaaS shall have the following functionality for developers and power users to complete tasks using a graphical user interface (GUI).

o The PaaS allows developers and trusted power users to clear site caches on production o The PaaS allows developers to trigger database backups or sync the production database to a lower environment.

o The PaaS allows developers to sync files from production to a lower environment.

o The PaaS allows developers to change the branch/tag and deploy code on any environment.

o View, create, and modify scheduled jobs that run periodically on each environment. Some of the scheduled jobs may include:

Indexing search

Database backups

Rsync files from production to lower environments o Provides stack metrics that shows how the Intranet and Search applications are using each environment. Examples:

Memory and CPU usage

Database memory and CPU usage

Database storage used

Database slow queries

“Out of Memory” errors

Search index queries

Search index size (MB) o Provide infrastructure and services overview such as IP addresses, URLs, and DNS information for each environment and their load balancers.

o Developers can add and manage their own SSH keys.

o Developers can add and manage domain and SSL certificates.

• The PaaS shall provide Continuous Integration/Continuous Delivery (CI/CD) and Deployment Automation functionality. This shall be a user-friendly job runner that works with Git repositories. The CI/CD and Deployment Automation functionality shall allow Developers to manage their own deployments.

• The PaaS shall have a production environment (Prod) and two lower environments (Dev and QA).

o Developers shall be able to SSH into all environments inside and outside of GAO’s network and be able to run commands via the command line to manage configuration and search for each environment.

2.2 Load Time

Production’s site pages at a minimum shall load in 650 milliseconds or less and have a throughput of 600 requests per minute.

2.3 99.9 Percent Availability

The PaaS shall provide a robust, fault-tolerant infrastructure that provides for high availability of

99.9 percent.

• Production site shall have at a minimum a 99.9-percent uptime during Business Hours Monday through Friday, 5:00am to 11:59pm ET.

• Planned services outages are included in the calculation of 99.9-percent availability.

2.4 API Support

The PaaS shall support API over HTTPS to the WCMS application from other GAO-specific applications that live behind GAO’s VPN and firewall.

2.5 Application Log File Management

• The system shall provide persistent logging for all hits, including downloads, for the website with storage rolling one month at a time.

• The system shall provide persistent logging of application and search logs for traffic and other analysis purposes with storage for rolling one month at a time.

2.6 Customer Support

The Contractor shall provide customer support including, but not limited to, system owners and managers, as required. The support shall include both the web content management system and the hosted website.

• The Contractor shall provide service and support for the GAO solution 24 x 7 x 365 days to include Tier I, 2, 3 help desk support/service center functions defined as:

o Tier I (Incident response catch/dispatch) o Tier 2 (SME engagement) o Tier 3 (SME and Contractor engagement as required)

• The Contractor shall provide trouble ticketing via customizable online portal/interface with integrated email capabilities.

• The Contractor shall provide a mechanism to GAO for the secure bulk retrieval of all data, scripts, software, virtual machine images, and so forth, such as mirroring or copying to GAO—supplied industry standard media. The Contractor shall describe the formats in which data will be provided.

• Provide onboarding training to developer staff for the new platform solution(s) in order for them to be fully successful at managing GAO’s environments and code releases.

2.7 Security and Privacy

To ensure compliance with the Federal Information Security Modernization act of 2014 (FISMA), the Contractor shall demonstrate knowledge and understanding of the NIST SP 800-53 security controls for information systems. The security controls baseline implemented by the Contractor shall be consistent with the FIPS 199 Moderate Impact level. Additionally, the implementation of the Contractor ’s security controls shall be documented in the manner described in the NIST Risk Management Framework, NIST SP 800-37, and Revision 2. The security documentation shall describe how the security controls have been implemented for the infrastructure, platform, and software/application.

The Contractor shall provide such evidence of compliance for GAO’s review through one of these three methods:

• FedRAMP authorization package (https://www.fedramp.gov/documents/)

• A current independent security assessment of the Contractor’s documented NIST SP 800-53 security controls.

• An independent assessment using other internationally accepted security practices with a documented reference or crosswalk to the NIST SP 800-53 controls.

In addition to the evidence of compliance, the Contractor shall provide current IT security white papers/documentation that describe how security has been implemented for the solution’s infrastructure, platform, and software components. The IT security white papers/documentation should include information such as access controls, authentication, boundary protection, change management, customer segregation, contingency/disaster recovery planning, encrypted data transmission capabilities, log management, restricting website access, security monitoring, among other security capabilities.

The Contractor shall provide access to GAO, or their designee acting as their agent, security documentation needed to verify compliance with the requirements as describe in this statement of work, for the Contractor ’s information technology security program. The Contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

The Contractor shall ensure that GAO will have an opportunity to review, at least annually, the current security artifacts mandated by the FedRAMP Program Management Office, by the current versions of NIST SP 800-37 and NIST SP 800-53 guidelines, or by the internationally accepted security practices.

The Contractor shall ensure that its environment remains compliant with the control standards of Federal Information Security Modernization Act of 2014 (FISMA), the current NIST standards related to: FIPS 140-2, and current NIST Special Publications 800-37, 800-53, 800-60, 800-61, 800-70, and 800-163. In addition, the Contractor shall provide GAO with any documentation it requires for its security-related reporting requirements within 15 days of a request.

https://www.fedramp.gov/documents/

2.7.1 Security Audit Log Management

• The system shall provide an automated mechanism to collect log files (including syslog, web and application server logs, event logs, etc.) for security analysis purposes and shall be reviewed by the Contractor on a routine basis.

• The Contractor shall ensure that the automated mechanism allows GAO to periodically review the logs that can be exported into a format ingestible by an event correlation engine such as Splunk or in an .xlsx, .csv, .pdf, or .txt file format.

• The Contractor shall retain audit log records on-line for at least ninety (90) days and preserve audit log records off-line for a period of 365 days.

2.7.2 Authentication

• The system shall authenticate GAO users using modern authentication services such as Active Directory Federation Services (ADFS). The system will also support minimum password strength requirements (minimum 12 characters, mixture of upper and lowercase letters, mixture of letters and numbers, includes at least one special character (! @, #, %, etc.)

• The system shall support two-factor authentication via SMS message, mobile app (mobile app will work both on Android and iOS devices e.g. Google Authenticator and Authy).

• The system shall generate emergency recovery codes at the creation of all user accounts.

2.7.3 Permissions

Platform permissions shall be granular in nature to allow GAO to create the following user roles:

• Administrator: User has full permissions to the platform and any teams/applications associated with the account. User can create and modify permissions, roles, teams, and applications. User has SSH access. They also receive all notifications on support tickets.

• Senior Developer: User has full access to all environments. They have full access to the application and can invite other members to join the application and assign their permissions. User has SSH access. They also receive all notifications on support tickets.

• Developer: User has full access to the environments they are assigned to. User has SSH access. They also receive all notifications on support tickets that they create or are added as a stakeholder to.

• Cache-clear: User can clear site caches on production and lower environments. User does not have the ability to deploy code, backup databases, or SSH into the environment.

2.7.4 System Availability

• Whenever there is an interruption in service (cloud hosting and/or search), the Contractor shall inform GAO of the estimated time that the system or data will be unavailable. The estimated timeframe for recovery of the service shall be consistent with the agreed upon service level agreements (SLA) and system availability requirements.

• The Contractor shall provide regular updates to GAO on the status of returning the service (cloud hosting and/or search) to an operating state according to SLA and system availability requirements.

• The Contractor shall provide a Root Cause Analysis (RCA) within 5 business days of interruption in service (cloud hosting and/or search). The RCA shall be in plain language and understandable for non-technical stakeholders.

2.7.5 Comprehensive Backup and Restoration

• The Contractor shall have a backup and restoration process that will ensure no more than 24 hours of data is loss.

• The Contractor shall respond to GAO’s restoration request within one (1) business day of request.

• The Contractor shall restore an agreed upon GAO dataset that is part of the regular backup schedule. The Contractor shall ensure that such testing takes place, semi-annually, at a minimum.

• Data backups shall be maintained or replicated at a site geographically disparate from the production site such that the loss of one data center does not prohibit recovery of data within the prescribed RTO. The backup site must be in the continental United States.

• The Contractor shall provide a Failover should there be loss of a data center. The Failover will be automatic and result in a minimal outage (under three hours) for GAO and its customers.

2.7.6 Data Management

• The Contractor shall maintain all of GAO’s data, including backup data, within the continental United States. The staff managing the data and/or systems maintaining GAO data shall be employed within and working from a system that is within the continental United States.

• The Contractor shall ensure that GAO maintains ownership of all data stored in the hosted environment and that GAO will be permitted to access the data at any time.

• The Contractor shall ensure that GAO data is being properly segregated from and thus inaccessible by the Contractor’s other clients.

• The Contractor shall not access, use, or disclose GAO data unless specifically authorized by the terms of this contract or a task order issued hereunder. If authorized by the terms of this contract or a task order issued hereunder, any access to, or use or disclosure of, GAO data shall only be for purposes specified in this contract or task order.

• The Contractor shall provide the Contracting Officer all GAO data and GAO-related data in the format specified in this document or as directed by the Contracting Officer.

• The Contractor shall dispose of/purge GAO data and GAO-related data in an agreed upon manner and provide the confirmation of disposition to the Contracting Officer in accordance with contract closeout procedures. The data disposal/sanitization process shall be consistent with the current version of NIST SP 800-88, Guidelines for Media Sanitization.

• The Contractor shall adhere to GAO Records Management Program Order 0410.1 and GAO’s Records Retention Schedules. The documents are available upon request.

2.7.7 Vulnerability Management

• Prior to deployment of the platform, the Contractor shall ensure that the scan results (OS/APP/DB) for GAO’s hosted environment are provided for review by the GAO Project Manager and Information System Security Officer.

• The Contractor shall be responsible for all patching and vulnerability management (PVM) of the platform’s software and other systems’ components supporting services provided under this agreement, to proactively prevent the exploitation of IT vulnerabilities that may exist within the Contractor’s operating environment. Such patching and vulnerability management shall meet the requirements and recommendations of the current version of NIST SP 800-40.

• The Contractor shall ensure that the CVSS v3.0 specifications for critical and high-risk vulnerabilities are patched within 3 and 15 days of discovery, respectively. After patching occurs, the remediated Common Vulnerabilities and Exposures (CVE) will be shared with the GAO Project Manager and Information System Security Officer.

2.7.8 Incident Response

• The Contractor shall have an incident/breach notification process that is tested annually.

The GAO ISSO for the system shall have an opportunity to review the annual test results.

• The Contractor shall ensure that GAO is notified of all incidents, to include system outages and equipment failures, within an agreed upon timeframe consistent with federal government guidance.

• The Contractor shall report incidents in a manner consistent with the current NIST SP 800-61 guidelines that is ultimately agreed upon by GAO to ensure that critical information is provided in a timely manner.

• The Contractor shall share contact information, to include GAO staff, of key incident response personnel for the hosting environment. The contact information shall be reviewed periodically to ensure accuracy and completeness.

2.7.9 Media Protection

• The Contractor shall ensure that all electric and hard-copy deliverables, are labeled in a manner that is agreed upon by GAO.

• The Contractor shall ensure that GAO data that resides on mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards) are encrypted using a NIST-approved tool. In all cases where GAO data are stored in mobile, easily transportable devices, the data must be encrypted at rest.

• The Contractor shall ensure that external transmission/ dissemination of any GAO data is encrypted. Certified encryption modules must be used in accordance with the current FIPS Publication, “Security requirements for Cryptographic Modules,” FIPS 140-2, level 2, at a minimum. The transport layer security (TLS) protocol shall be version 1.2, at a minimum. There shall be no obsolete TLS protocols used in the transmission of GAO data.

• The Contractor ’s chain of custody practices for media containing GAO information that is transported outside of the controlled areas, such as the data center, shall ensure full accountability of all data. This can be accomplished through appropriate actions such as logging and/or a documented chain of custody form.

• The Contractor shall ensure that data that is being shared with GAO or with GAO-designated recipients by e-mail shall also be encrypted and password-protected by contract staff using an agreed upon tool such as PKZIP. Password distribution shall be handled securely to minimize potential compromise. Alternatively, a secure portal for secure messaging or for secure file transfers, for example, can be used.

2.7.10 Personnel Security

• The Contractor shall require all employees and representatives, and any others (e.g., subcontractor employees) who will have access to GAO data, the architecture that supports GAO data, or any physical or logical devices/code, to pass the appropriate background investigation required by the Government in compliance with HSPD -12 and OPM’s Federal Investigations Notice 15-03.

• Contractor personnel performing work under this contract shall have at a minimum, a Tier-2, Public Trust, favorably adjudicated background investigation before accessing GAO data, the architecture that supports GAO data, or any physical or logical devices/code. The assigned personnel must maintain the level of clearance required for the life of the contract.

• If the Contractor does not have staff meeting this requirement, the Contractor shall be responsible for costs associated with GAO’s efforts to initiate the background investigation process.

• If more than ten contract staff (and subcontract staff) can access GAO’s hosted environment and data, the Contractor shall assign specific staff who (1) will support GAO’s overall coding, troubleshooting, and system administration needs, and (2) has and can sustain a favorably adjudicated Tier-2 security clearance.

• Contractor personnel shall sign a non-disclosure agreement and must be a U.S. citizen or have lawful U.S. resident status.

• Upon contract award, if the Contractor personnel assigned to support GAO do not meet the Tier-2 background investigation requirement, GAO will require that completed SF- 85P forms be submitted securely to GAO’s Industrial Security section for review and processing.

• Any time changes occur with a Contractor’s personnel security clearance, the Contractor shall contact the GAO COR, who will ensure that GAO’s Personnel Management Branch is informed. GAO will conduct the appropriate reviews and will request pertinent information for review.

• The Contractor shall be responsible for the cost for any Tier-2 background investigations for newly assigned Contractor personnel supporting GAO’s hosted environment.

2.7.11 Privacy Protections

• The Contractor shall provide privacy protections that are consistent with the NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing” and other applicable standards and guidelines.

• The Contractor shall adhere to GAO Privacy Program Order, 0450.1. The documentation will be made available, upon request.

2.7.12 Protection of Information at Rest

• The Contractor shall provide security mechanisms for handling data at rest and in transit in accordance with the current, implemented version of the FIPS Publication “Security Requirements for Cryptographic Modules,” or FIPS 140-2, level 2, at a minimum. The transport layer security (TLS) protocol shall be version 1.2, at a minimum. There shall be no obsolete TLS protocols used in the transmission of GAO data.

2.7.13 Secure Communications

• As described in the NIST SP 800-53 System and Communications Protection control family, the Contractor, upon request, shall be able to restrict access to GAO’s hosted environment based on an agreed upon public (non-RFC 1918) IPv6 and IPv4 address(es) through a secure connection or by an IP restrictions/whitelisting mechanism.

• The solution shall provide connectivity that is able to access the Contractor ’s main and disaster recovery locations from GAO’s Headquarters and Alternate Computing Facility locations. Oftentimes, the VPN connectivity will require two (2) VPNs with four (4) tunnels. If an IP whitelisting/restrictions mechanism is used, it shall be able to detect, reject and log attempts at spoofing IP addresses per IETF Best Common Practice 38 (https://tools.ietf.org/html/rfc2827).

• The Contractor shall deploy strong cryptography and end-to-end application layer encryption to protect customer PINs, user passwords, email transmissions, web traffic, and other sensitive data in networks and data at rest. The level of encryption used must comply with the current, implemented version of the FIPS Publication “Security

Requirements for Cryptographic Modules,” or FIPS 140-2, level 2, at a minimum. The transport layer security (TLS) protocol shall be version 1.2, at a minimum. There shall be no obsolete TLS protocols used in the transmission of GAO data.

• The Contractor shall encrypt customer account and transaction data which is transmitted, transported, delivered or couriered to external parties or other locations considering all intermediate junctures and transit points from source to destination.

2.7.14 Security Alerts, Advisories, and Directives

• The Contractor shall ensure that contractor personnel with responsibilities for system administration, monitoring, and/or security, receive security alerts, advisories, and directives for the Contractor’s solution(s). The Contractor shall ensure that designated GAO personnel receive the same alerts, advisories and directives.