OFM_IT_Data_Analytics_with_FISMA_FedRamp_requirements.pdf

FISMA and FedRamp Requirements Department of Commerce, Office of Financial Management

1. Objectives:

The Office of Financial Management (OFM) has implemented a data analytics program with the objective of developing the capability to identify trends, anomalies and other meaningful patterns in financial programs of the Department of Commerce. Prior phases of the program focused on three data from three Department of Commerce (DOC) programs; purchase card transactions, travel card transactions and payroll (mainly time and attendance).

OFM is requesting the assistance of a contractor to perform the tasks outlined below to ensure a successful implementation of the tools, processes and procedures required for an effective and dynamic data analytics program.

2. Scope and Requirements:

This project will involve the use of a contractor in performing the tasks below using contractor tools and capabilities.

a. Continuous Monitoring

1. The contractor will work to gain an understanding of the existing database structures, scripts, tests, dashboards, processes and procedures. The contractor will replicate existing dashboards and database structures similar to those developed for purchase card, travel card and payroll analytics.

2. Develop and perform procedures required to incorporate one year of roll forward data into existing purchase card, travel card and payroll dashboards.

In addition, the contractor will assist OFM to:

• Identify potential areas of weakness in the current data analytics process, develop and implement effective alternative processes and procedures.

• Identify and incorporate data from related systems (NFC and/or CBS) where appropriate

• Develop and implement risk ranking systems for payroll dashboards.

b. Ad Hoc Data Analytics Due to the unique and dynamic nature of the Department of Commerce and its bureaus, during the next twelve months, OFM will require analytic review and investigation for select DOC programs. Typically, these reviews require quick turn-around times and demand immediate attention. The contractor will support OFM in performing one instance of data analytics requiring a medium-level of effort similar to the purchase card and payroll data analytic projects described in the continuous monitoring section of this statement of work.

The contractor will assist OFM in:

• identifying stakeholders and owners of the data and determining the data and fields to be extracted

• extracting, cleansing/normalizing and loading pertinent data

• developing and identify risks for testing based on best practices, interviews and past findings

• developing a methodology of ranking the risks identified and applying rankings to results

• performing preliminary data analytics to develop summary level statistics

3. Deliverables:

The contractor will provide the following deliverables:

1. Continuous Monitoring

1. The contractor will replicate existing OFM dashboards and database structures for purchase card, travel card and payroll analytics

2. Roll forward analytics: The contractor will incorporate an additional year of data, analyze and deliver dashboards or other visualized output of selected risk items for purchase card, travel card and payroll

2. Ad Hoc Data Analytics:

• The contractor will perform data analytics and deliver the results in a dashboard or other visualized output consistent with prior deliverables

4. IT Security In addition to the IT security requirements defined in the main award:

Data transfer The contractor will use validated FIPS 140-2 encryption technology to transfer data to and from the Department of Commerce.

“On-Premise” Processing FISMA Security Compliance Requirements Contractors entering into an agreement for services with the Department shall be contractually subject to all Department of Commerce and Federal IT Security standards, policies, and reporting requirements.

The contractor shall meet and comply with all Department IT Security Policies and applicable Department and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Federal Information Processing Standards (FIPS) 200, “Minimum Security Requirements for Federal Information and information Systems”, is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security related areas. Contractor systems supporting the Department must meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800-53, Revision 4, DOC IT Security Program Policy, Commerce Information Technology Requirements (CITRs) and Policy Memos, which provide DOC specific implementation parameters and details.

To comply with the federal standard, the Department must determine the security category of the information and information system in accordance with FIPS 199, “Standards for Security categorization of Federal Information and Information Systems”, and then the contractor shall apply the appropriately tailored set of baseline security controls in NIST 800-53, Revision 4, as determined by the Department.

NIST 800-53, Revision 4 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with Department specifications.

Assessment and Authorization (A&A) Activities The implementation of a new Federal Government IT system requires a formal approval process known as Assessment and Accreditation (A&A). NIST Special Publication 800-37 Rev 1 gives guidelines for performing the A&A process. The contractor system/application must have a valid assessment and accreditation (signed off by the Federal government) before going into operation and processing Department information. The failure to obtain and maintain a valid A&A may be grounds for termination of the task order. A&As are conducted at the outset of procuring/implementing/entering into an agreement to use a service that will process, store, or transmit DOC info. Systems and/or services are then monitored pursuant to an agreed upon continuous monitoring plan, and the system or service receives an affirmation of an authorization to operate (ATO) on at least an annual basis as long as the continuous monitoring plan is implemented as agreed and the risks to the system/service remain within thresholds acceptable to the DOC Authorization Official (AO) for the system/service. The system must have a new A&A conducted (and signed off on by the Federal government) at least every three (3) years or at the discretion of the Authorizing Official when there is a significant change to the system’s security posture. All NIST 800-53, Revision 4 controls must be tested/assessed no less than every 3 years. DOC Risk Management Framework CITR-19 contains requirement for continuous monitoring.

Certification of System

1. The contractor shall comply with A&A requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of effort for the A&A is based on the System’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. The contractor shall create, maintain and update the following A&A documentation:

o FIPS 199 Categorization o Privacy Threshold Analysis (PTA) o Privacy Impact Assessment (if required) o Identification of key system stakeholders

i. Authorizing Official (AO)

ii. Co-Authorizing Official (Co-AO)

iii. Information System Owner (ISO)

iv. Information System Security Officer (ISSO) o System Security Plan (SSP) completed agreement with NIST Special Publication 800-18, Revision 1. The SSP shall include as appendices required policies and procedures across 18 control families mandated per FIPS 200, Rules of Behavior, and Interconnection Agreements (in agreement with NIST Special Publication 800-47) as well as:

i. Identification of AO, ISO, ISSO, and Co-AO

ii. Risk Assessment

iii. Interconnection Security Agreement(s)

iv. Continuous Monitoring Strategy o Security Assessment Report (SAR) o Contingency Plan (including Disaster Recovery Plan) completed in agreement with NIST

Special Publication 800-34.

o Contingency Plan Test Report o Plan of Actions and Milestones (POA&M) o Independent Penetration Test Report documenting the results of vulnerability analysis and exploitability of identified vulnerabilities.

o Authorization Decision Memorandum

Assessor independence as described in the current version of NIST 800-37 is required for Moderate and High-impact systems.

2. Information systems must be certified and accredited at least every three (3) years or whenever there is a significant change to the system’s security posture in accordance with NIST Special Publication 800-37, Revision 1, “Guide for the Security Certification and Accreditation of Federal Information Systems”, and CIO IT Security 06-30, “Managing Enterprise Risk”.

3. If the Department is responsible for providing a Security Assessment/Risk Assessment and Penetration Test, the contractor shall allow Department employees or designated agents to conduct A&A activities to include control reviews in accordance with NIST 800-53, Revision 4/NIST 800-53A.

Review activities include but are not limited to operating vulnerability scanning, web application scanning, and database scanning of applicable systems that support the processing, transportation, storage, or security of Department information. This includes the general support system infrastructure.

4. Identified gaps between required 800-53, Revision 4 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Government may require them to be remediated before an Authorization to Operate is issued.

5. The contractor is responsible for mitigation all security risks found during A&A and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Department will determine the risk rating of vulnerabilities.

Accreditation of System

1. Upon receipt of the documentation (Certification Package) the Department Authorizing Official for the system (in coordination with the Department Information Security Officer, system Program Manager, Information System Security Manager (ISSM), and Information System Security Officer (ISSO) will render an accreditation decision to:

o Authorize system operation without any restrictions or limitations on its operation;

o Authorize system operation without restriction or limitation on its operation, or;

o Not authorize for operation.

2. The contractor shall provide access to the Department, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. At its option, the Department may choose to conduct on site surveys. The contractor shall make appropriate personnel available for interviews and documentation during this review. If documentation is considered proprietary or sensitive, these documents may be reviewed on-site under the hosting contractor’s supervision.

Reporting and Continuous Monitoring Maintenance of the security authorization to operate will be through continuous monitoring of security controls of the contractor’s system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment.

Acceptable continuous monitoring results must be reaffirmed, risk reassessed, documented, and accepted annually by AO’s (and CO-AO’s if one is designated for the system) to ensure a system’s continued ATO. The AO’s (and Co-AO’s if one exists) reaffirmation of the ATO must be documented in writing, either by signing off on acceptable assessment results or by signing a Reauthorization Memo, and entered in the DOC FISMA Reporting System.

Through continuous monitoring, security controls and supporting deliverables are updated and submitted to the Department per the schedules below. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. They allow Department authorizing officials to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur.

Continuous Monitoring deliverables to be provided to the Department COTR/ISSO annually Reference: DOC CITR-19

1. Conduct and document assessments of DOC-defined “Minimum Continuous Monitoring” controls as frequently as appropriate to maintain acceptable levels of risk, but as least annually.

a. Define additional controls for continuous monitoring for their respective environments, in a Continuous Monitoring strategy, as needed.

b. Establish a process for ensuring AOs are informed when risks in the system’s environment exceed a level deemed acceptable at the time of the system’s initial authorization.

c. Ensure that Continuous Monitoring strategies evolve in accordance with drivers for risk-based decision making.

2. Document in a risk management methodology and have approved by the bureaus CIO a strategy which includes the following:

a. Process for assessing a subset of the controls in the system’s security baseline which describes controls to be monitored and a timeframe in which they are to be monitored by taking into consideration current threat and vulnerability information, history of cyber-attacks, results of previous security assessments, operational requirements, and mission/business impacts.

b. Process for ensuring AOs are informed when risks in the system’s environment exceed a level deemed acceptable at the time of the system’s initial authorization.

c. OUs must ensure that Continuous Monitoring strategies evolve in accordance with drivers from risk-based decision making and requirements for information.

3. OUs must conduct and document either a security impact analysis or a risk assessment when there is a significant system change, to determine the security impact and risk of proposed or actual changes to the information system and its environment of operation.

4. OUs may reuse assessment results derived from the system’s Continuous Monitoring activities for the re-authorization decision by following reuse criteria from the current version of NIST SP 800-37.

5. The System Security Plan, SAR and POA&Ms must be updated upon completion of on-going security control assessments. The System Security Plan must also be updated when there are significant changes that impact (negatively or positively) the security of the system.

OUs must manage the resolution of weaknesses found during the Continuous Monitoring phase using the Plans of Action & Milestones (POA&Ms) process defined in DOC CITR-018.

Reporting deliverables to be provided to the Department COTR/ISSO Monthly

1. Plan of Action & Milestones (POA&M) Update Reference: NIST 800-53, Revision 4 control CA-5 Contractor shall provide POA&M updates

2. Vulnerability Scanning

Reference: NIST 800-53, Revision 4 control RA-5

Contractor shall provide vulnerability scan reports from Web Application, Database, and Operating System Scans. Scan results shall be managed and mitigated in Plans of Action and Milestones (POA&Ms) and submitted together with the monthly POA&M submission.

Reporting deliverables to be provided to the Department COTR/ISSO Annually

1. Updated A&A documentation including the System Security Plan and Contingency Plan

i. System Security

Reference: NIST 800-53, Revision 4 control PL-2 Contractor shall review and update the System Security Plan annually to ensure the plan is current and accurately described implemented system controls and reflects changes to the contractor system and its environment of operation.

The System Security Plan must be in accordance with NIST 800-18, Revision 1, Guide for Developing Security Plans.

ii. Contingency plan Reference: NIST800-53, Revision 4 control CP-2 Contractor shall provide an annual update to the contingency plan competed in accordance with NIST 800-34, Contingency Planning Guide

2. User Certification/Authorization Review Documents Reference: NIST 800-53, Revision 4 control AC-2 Contractor shall provide the results of the annual review and validation of system users’ accounts to ensure the continued need for system access. The user certification and authorized documents will illustrate the organization establishes, activates, modifies, reviews, disables, and removes information system accounts in accordance with documented account management procedures.

3. Separation of Duties Matrix Reference: NIST 800-53, Revision 4 control AC-5 Contractor shall develop and furnish a separation of duties matrix reflecting proper segregation of duties for IT system maintenance, management, and development processes. The separation of duties matrix will be updated or reviewed on an annual basis.

4. Information Security Awareness and Training Records Reference: NIST 800-53, Revision 4 control AT-4 Contractor shall provide the results of security awareness (AT-2) and role-based information security technical training (AT-3). AT-2 requires basic security awareness training for employees and contractors that support the operation of the contractor system. AT-3 requires information security technical training to information system security roles. Training shall be consistent with the requirements contained in C.F.R.

Part 5 Subpart C (5 C.F.R 930.301) and conducted at least annually.

5. Annual FISMA Assessment Reference: NIST 800-53, Revision 4 control CA-2 Contractor shall deliver the results of the annual FISMA assessment.

6. System(s) Baseline Configuration Standard Document Reference: NIST 800-53, Revision 4 control CM-2 Contractor shall provide a well-defined, documented, and up-to-date specification to which the information system is built

7. System Configuration Settings

Reference: NIST 800-53, Revision 4 control CM-6 Contractor shall establish and document mandatory configuration settings for information technology products employed within the information system that reflect the most restrictive mode consistent with operational requirements.

Configuration settings are the configurable security-related parameters of information technology products that compose the information system. System configuration settings will be updated or reviewed on an annual basis.

8. Configuration Management Plan

Reference: NIST 800-53, Revision 4 control CM-9 Contractor shall provide an annual update to the Configuration Management Plan for the information system.

9. Contingency Plan Test Report

Reference: NIST 800-53, Revision 4 control CP-4 Contractor shall provide a contingency plan test report. A continuity test shall be conducted annually prior to mid-July of each year. The continuity test can be a table top test while the system is at the “Low Impact” level. The table top test must include Federal and hosting contractor representatives. Moderate and High impact systems must complete a functional exercise at least once every three years.

10. Incident Response Test Report

Reference: NIST 800-53, Revision 4 control IR-3 Contractor shall provide an incident response plan test report documenting results of incident reporting process.

11. Results of Physical Security User Certification/Authorization Review Reference: NIST 800-53, Revision 4 control PE-2

Contractor shall provide the results of annual reviews and validations of physical access authorizations to facilities supporting the contractor system to ensure the continued need for physical access.

12. Results of Review of Physical Access Records Reference: NIST 800-53, Revision 4 control PE-8 Contractor shall provide the results of annual reviews and validations of visitor access records to ensure the accuracy and fidelity of collected data.

13. Information System Interconnection Agreements Reference: NIST 800-53, Revision 4 control CA-3 The contractor shall provide updated Interconnection Security Agreements (ISA) and supporting Memorandum of Agreement/Understanding (MOA/U), completed in accordance with NIST 800-47, “Security Guide for Connecting Information Technology Systems”, for existing and new interconnections. Per NIST 800-47, an interconnection is the direct connection of two or more IT systems for the purpose of sharing data and other information resources through a pipe, such as ISDN, T1, T3, DS3, VPN, etc.

Interconnections agreements shall be submitted as appendices to the System Security Plan.

14. Rules of Behavior Reference: NIST 800-53, Revision 4 control PL-4 Contractor shall define and establish Rules of Behavior for information system users.

Rules of Behavior shall be submitted as an appendix to the System Security Plan.

15. Personnel Screening and Security Reference: NIST 800-53, Revision 4 control PS-3, NIST 800-53 control PS-7 Contractor shall furnish documentation reflecting favorable adjudication of background investigations for all personnel (including subcontractors) supporting the system.

o Those contract personnel (hereafter known as “Applicant”) determined to be in a Low Risk position will require a National Agency Check with Written Inquiries (NACI) investigation.

o Those Applicants determined to be in a Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI) based on the Contracting Officer’s (CO) determination.

o Those Applicants determined to be in a High Risk position will require a Background Investigation (BI).

The Contracting Officer, through the Contracting Officer’s Technical Representative or Program Manager will ensure that a completed Contractor Information Worksheet (CIW) for each Applicant is forwarded to the Federal Protective Service (FPS). FPS will then contact each Applicant with instructions for completing required forms and releases for the particular type of personnel investigation requested.

Applicants will not be reinvestigated if a prior favorable adjudication is on file with FPS or there has been less than a one year break in service, and the position is identified at the same or lower risk level.

Once a favorable FBI Criminal History Check (Fingerprint Check) has been returned, Applicants may receive a Department identity credential (if required) and initial access to Department information systems.

Deliverables to be provided to the Department COTR/ISSO Biennially Policies and Procedures Contractor shall develop and maintain current the following policies and procedures:

i. Access Control Policy and Procedures (NIST 800-53 AC-1)

ii. Security Awareness and Training Policy and Procedures (NIST 800-53 AT-1)

iii. Audit and Accountability Policy and Procedures (NIST 800-53 AU-1)

iv. Identification and Authentication Policy and Procedures (NIST 800-53 IA-1)

v. Incident Response Policy and Procedures (NIST 800-53 IR-1, reporting timeframes are documented in GSA CIO IT Security Procedural Guide 01-02, Incident Handling

vi. System Maintenance Policy and Procedures (NIST 800-53 MA-1)

vii. Media Protection Policy and Procedures (NIST 800-53 MP-1)

viii. Physical and Environmental Policy and Procedures (NIST 800-53 PE-1)

ix. Personnel Security Policy and Procedures (NIST 800-53 PS-1)

x. System and Information Integrity Policy and Procedures (NIST 800-53 SI-1)

xi. System and Communication Protection Policy and Procedures (NIST 800-53 SC-1)

xii. Key Management Policy (NIST 800-53 SC-12)

Additional Stipulations (as applicable)

1. The deliverables identified above shall be labeled “CONTROLLED UNCLASSIFIED INFORMATION” (CUI) or contractor selected designation per document sensitivity. External transmission/dissemination of FOUO and CUI to or from a Department computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security requirements for Cryptographic Modules.”

2. Federal Desktop Core Configuration The contractor shall certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC). The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved FDCC configuration. The information technology should also use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The contractor shall use Security Content Automation Protocol (SCAP) validated tools with FDCC Scanner capability to certify their products operate correctly with FDCC configurations and do not alter FDCC settings.

3. As prescribed in the Federal Acquisition Regulation (FAR) clause 24.104, if the system involves the design, development, or operation of a system of records on individuals, the contractor shall implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.”

4. The Contractor shall cooperate in good faith in defining non-disclosure agreements that other third parties must sign when acting as the Department’s agent.

5. The Department has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Department. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, the contractor shall be responsible for the following privacy and security safeguards:

i. The contractor shall not publish or disclose in any manner, without the Task Ordering Officer’s written consent, the details of any safeguards either designed or developed by the contractor under this Task Order or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification.

ii. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Department data collected and stored by the contractor, the contractor shall afford the Department logical and physical access to the contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of the request. Automated audits shall include, but are not limited to, the following methods:

o Authenticated and unauthenticated operating system/network vulnerability scans o Authenticated and unauthenticated web application vulnerability scans o Authenticated and unauthenticated database application vulnerability scans

Automated scans can be performed by Department personnel, or agents acting on behalf of the Department, using Department operated equipment, and Department specified tools. If the vendor chooses to run its own automated scans or audits, results from these scans may, at the Department’s discretion, be accepted in lieu of Department performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Department. In addition, the results of vendor-conducted scans shall be provided, in full, to the Department.

iii. If new or unanticipated threats or hazards are discovered by either the Government or the contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

FedRAMP Compliance If the contractor chooses to provide or utilize the services of a cloud computing provider the contractor must meet following FedRAMP and DOC CITR-024 requirements:

Under the FedRAMP1 policy, agencies leveraging cloud based-services must initiate an authorization and use the FedRAMP information security and privacy requirements (including security and privacy controls, and controls selected for continuous monitoring) for cloud services to support authorization decisions.

DOC CITR-024

A cloud service is required to be FedRAMP compliant when it meets all of the following criteria:

A. It has all five of the essential cloud criteria described in NIST SP 800-145.

B. It employs at least one of the cloud service models and one of the cloud deployment models described in NIST 800-145 C. It is hosted:

i. Internally by a bureau as part of its infrastructure OR

ii. External to the internal bureau infrastructure OR

iii. By another Federal organization but provides services to non-Federal organizations; and D. It is managed in such a way as to provide a capability to the bureau, which the bureau can then use to provide a service to its users.

A cloud service is considered to be FedRAMP compliant by DOC when the following DOC-specific requirements are met:

A. The Cloud Service Provider (CSP) providing the service is present on the list of FedRAMP Compliant CSPs located at: http://www.fedramp.gov/

B. A DOC bureau has documented and entered into the Cyber Security Assessment and Management System (CSAM), the following DOC-specific artifacts for the cloud service within a pre-existing FISMA-reportable system or the creation of a FISMA-reportable system:

i. Any security controls needed for the use of the service which are not sufficiently provided by the CSP and how they are to be implemented and monitored, such as:

agency responsible, hybrid and optional controls selected by the bureau.

ii. A Continuous Monitoring plan which aligns with DOC CITR-019 and describes plans for DOC oversight of the Agency-responsible controls, periodic review of the status of the CSP-responsible controls, and requires a periodic reauthorization, on at least an annual basis.

C. A DOC bureau has conducted and documented an assessment of the cloud service which reviews the existing FedRAMP package to determine security control implementation and associated risk(s) relevant to the bureau’s use of and interfaces to the cloud service.

1 In his December 8, 2011, memo titled “Security Authorizations of Information Systems in Cloud Computing Environments,” the Federal CIO established policy for the protection of Federal information in cloud services under the Federal Risk and Authorization Management Program (FedRAMP).

http://www.fedramp.gov/

D. After reviewing the results of the assessment described above in C., a DOC bureau Authorizing Official (AO) (and co-AO if one is designated for the system) has approved of, documented, and entered into CSAM the following:

i. The use of the cloud service

ii. The residual risks which are documented in a Security Assessment Report (SAR) and, if required, a Plan of Actions and Milestones (POA&M).

E. The ATO issued by the DOC bureau has been provided to the FedRAMP Program Management

Office (PMO).

Waivers In addition to the waiver requirements described in section 2.2.2 of the DOC IT Security Program Policy, the following requirements must be met and documented in order for a bureau to utilize a non- FedRAMP compliant cloud service:

A. Evidence that the cloud service has an Authorization to Operate (ATO) issued by a DOC bureau’s AO (and co-AO if one exists).

B. If the DOC ATO leveraged another Department or Agency-issued (D/A) ATO, then evidence of that D/A ATO must be documented.

FedRAMP Information Technology Systems Security Requirements:

Agencies can leverage cloud services assessed and granted provisional authorization through the FedRAMP process to increase efficiency and ensuring security compliance. The following security requirements apply to the services provided in this statement of work.

The Department will determine the security category for the cloud system in accordance with Federal Information Processing Standard 199 (FIPS 199); then the contractor shall apply the appropriate set of impact baseline controls as required in the FedRAMP Cloud Computing Security Requirements Baseline document to ensure compliance to security standards. The FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4, Recommended Security Controls for Federal Information Systems and Organizations (as amended), and also includes a set of additional controls for use within systems providing cloud services to the federal government.

The contractor shall maintain a security management continuous monitoring environment that meets or exceeds the requirements in the Reporting and Continuous Monitoring section based upon the latest edition of FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements.

FedRAMP Privacy Requirements:

Contractor shall be responsible for the following privacy and security safeguards:

1. To the extent required to carry out the FedRAMP assessment and authorization process and

FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Department data collected and stored by the contractor, the contractor shall afford the Department access to the contractor’s facilities, installations, technical capabilities, operations, documentation, records and databases.

2. If new or unanticipated threats or hazards are discovered by either the Department or the contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

3. The contractor shall also comply with any additional FedRAMP privacy requirements.

4. The Department has the right to perform manual or automated audits, scans, reviews or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Department. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, contractor shall be responsible for the following privacy and security safeguards:

• The contractor shall not publish or disclose in any manner, without the contracting officer’s consent, the details of any safeguards either designed or developed by the contractor under this contract or otherwise provided by the Government.

• To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Department data, the contractor shall afford the Department access to the contractor’s facilities, installations, technical capabilities, operations, documentation, records and databases within 72 hours.

The program of inspection shall include, but is not limited to:

• Authenticated and unauthenticated operating system/network vulnerability scans

• Authenticated and unauthenticated web application vulnerability scans

• Authenticated and unauthenticated database application vulnerability scans

• Automated scans can be performed by Department personnel, or agents acting on behalf of the Department, using Department operated equipment, and Department specified tools.

• If new or unanticipated threats or hazards are discovered by either the Department or the contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

If the contractor chooses to run its own automated scans or audits, results from these scans may, at the Department’s discretion, be accepted in lieu of Department performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Department. In addition, the results of vendor-conducted scans shall be provided, in full to the Department.

Sensitive Information Storage Sensitive But Unclassified (SBU) information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment will be returned to Department control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, Guidelines for Media Sanitization.

The disposition of all data will be at the written direction of the COR, this may include documents returned to the Department control; destroyed; or held as specified until otherwise directed. Items returned to the Department shall be hand carried or sent by certified mail to the COR.

Protection of Information The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task order. The contractor shall also protect all Department data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as SBU information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

The Department will retain unrestricted rights to Department data. The ordering activity retains ownership of any user created/loaded data and applications hosted on the contractor’s infrastructure, as well as maintains the right to request full copes of these at any time.

The data that is processed and stored by the various applications within the network infrastructure contains financial as well as personally identifiable information (PII). This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure. Sensitive PII data should be stored and processed using approved encryption technologies where applicable. Reference Rev 800-53 SC-9 and SC-28 for more information.

The data must be available to the Department upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the Department.

No data shall be released by the contractor without the consent of the Department in writing. All requests for release must be submitted in writing to the COR/CO.

Security Classification The preparation of the deliverables in this task order will be completed at a Sensitive but Unclassified level.

Confidentiality and Nondisclosure

The preliminary and final deliverables and all associated working papers and other material deemed relevant by the agency that have been generated by the contractor in the performance of this contract, are the property of the Department and must be submitted to the COR at the conclusion of the contract. The Department has unlimited data rights to all deliverables and associated working papers and materials in accordance with FAR 52.227-14.

All documents produced for this project are the property of the Department and cannot be reproduced, or retained by the contractor. All appropriate project documentation will be given to the agency during and at the end of this contract. The contractor shall not release any information without the written consent of the contracting officer.

Personnel working on any of the described tasks may, at the Departments request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of the Departments information and documents.

Disclosure of Information Any information made available to the contractor by the Department shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the contractor assumes responsibility for protection of the confidentiality of Department records and shall ensure that all work performed by its subcontractors shall be under the supervision of the contractor or the contractor’s responsible employees. Each officer or employee of the contractor or any of its subcontractors to whom any Department record may be made available or disclosed shall be notified in writing by the contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

FedRAMP Security Requirements Overview:

The minimum requirements for low and moderate impact cloud systems are contained within the FedRAMP Cloud Computing Security Requirements Baseline. The contractor and Department share responsibility to ensure compliance with security requirements.

The implementation of a new Federal Government cloud system requires a formal process, known as Assessment and Authorization (A&A), which provides guidelines for performing the assessment.

FedRAMP requires cloud service providers to utilize a Third-Party Assessment Organization (3PAO) to perform an assessment of the cloud service provider’s security controls to determine the extent to which security controls are implemented correctly, operate as intended, and produce the desired outcome with respect to meeting security requirements.

The FedRAMP Program Management Office (PMO) security staff will be available for consultation during the process. Both the FedRAMP PMO staff and the Joint Authorization Board (JAB)2 will review the results before issuing a Provisional Authorization decision. The Department reserves the right to verify the infrastructure and security test results before issuing an Authorization decision.

Federal agencies will be able to leverage the provisional Authorization granted by FedRAMP and any documentation prepared by the contractor to issue their own authority to operate.

The contractor is advised to review the FedRAMP guidance documents to determine the level of effort that will be necessary to complete the requirements. All FedRAMP documents and templates are available at www.FedRAMP.gov

FedRAMP Security Compliance Requirements:

The contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for low and moderate impact system (as defined in FIPS 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems. While the FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4, the contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and security guidance. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

Required FedRAMP Policies and Regulations:

OMB Memo Security Authorization of Information Systems in Cloud Computing Environments

Assessment and Authorization The Department may choose to cancel the task order and terminate any outstanding orders if the contractor has its provisional authorization revoked and the deficiencies are greater than Department tolerance thresholds.

Assessment of the System:

1. The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The level of effort for the A&A is based on the system’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. The

2 The Joint Authorization Board (JAB) is the primary governance and decision-making body for the FedRAMP program. The JAB reviews and provides joint provisional security authorization of cloud solutions using a standardized baseline approach. The FedRAMP JAB will not review authorization packages assembled by non-accredited third-party assessors. Contractors can find the list of FedRAMP-accredited 3PAOs at www.FedRAMP.gov contractor shall create, maintain and update the following documentation using FedRAMP requirements and templates, which are available at www.FedRAMP.gov:

• Privacy Impact Assessment (PIA)

• FedRAMP Test Procedures and Results

• Security Assessment Report (SAR)

• System Security Plan (SSP)

• IT System Contingency Plan (CP)

• IT System Contingency Plan (CP) Test Results

• Plan of Action and Milestones (POA&M)

• Continuous Monitoring Plan (CMP)

• FedRAMP Control Tailoring Workbook

• Control Implementation Summary Table

• Results of Penetration Testing

• Software Code Review

• Interconnection Agreements/Service Level Agreements/Memorandum of Agreements

2. Information systems must be assessed by an accredited 3PAO whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

3. The Department reserves the right to perform penetration testing. If the Department exercises this right, the contractor shall allow Department employees (or designated third parties) to conduct security assessment activities to include control reviews in accordance with FedRAMP requirements. Review activities include but are not limited to scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Department information for vulnerabilities.

4. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor’s implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Department may require them to be remediated before a provisional authorized is issues.

5. The contractor is responsible for mitigating all security risks found during A&A and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 30 days from the date vulnerabilities are formally identified. The Department will determine the risk rating of vulnerabilities.

Authorization of System:

The contractor shall provide access to the Department, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The Department reserves the right to conduct on-site inspections. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

Reporting and Continuous Monitoring:

Maintenance of the FedRAMP Provisional Authorization will be through continuous monitoring and periodic audit of the operational controls within a contractor’s system, environment, and processes to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to the FedRAMP PMO as required by FedRAMP Requirements. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. The deliverables will allow the FedRAMP JAB to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur. Contractors will be required to provide updated deliverables and automated data feeds as defined in the FedRAMP Continuous Monitoring Plan.

Additional Stipulations:

• The FedRAMP deliverables shall be labeled “CONTROLLED UNCLASSIFIED INFORMATION” (CUI) or contractor selected designation per document sensitivity. External transmission/dissemination of FOUO and CUI to or from a Department computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security requirements for Cryptographic Modules.”

• Federal Desktop Core Configuration & US Government Configuration Baseline: The contractor shall certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC) and US Government Configuration Baseline (USGCB). The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved FDCC/USGCB configuration. Offerings that require installation should follow OMB memorandum 07-18.

Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The contractor shall us Security Content Automation Protocol (SCAP) validated tools with FDCC/USGCB Scanner capability to certify their products operate correctly with FDCC/USGCB configurations and do not alter FDCC/USGCB settings.

• As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104, if the system involves the design, development, or operation of a system of…