RFP No. 283-24-0642 Attachment 1b General Requirements.docx

SAMHSA INFORMATION TECHNOLOGY

(IT) & OFFICE OF COMMUNICATION (OC)

CONTRACT TECHNICAL REQUIREMENTS

Section C: Services to be Performed The Contractor shall account for project funding necessary to meet all requirements specified in Section C, including but not limited to activities supporting IT security and privacy, Section 508 compliance, and web content development, management, and migration.

1. Independently, and not as an agent of the Government, the Contractor shall furnish the necessary personnel, labor, equipment, software, services, materials, and supplies, except as otherwise noted specifically herein to perform the work set forth below.

2. All work under this contract/task order will be monitored by the Contracting Officer’s Representative (COR).

PART 1. SAMHSA INFORMATION TECHNOLOGY (IT) CONTRACT REQUIREMENTS

I . FEDERAL AND SAMHSA STANDARDS AND TERMINOLOGY

1. DATA AND COPYRIGHTS

1. “Data” means recorded information, regardless of form or the media on which it may be recorded. The term includes technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

2. Before development of any software for SAMHSA, the contractor shall understand and communicate any questions to SAMHSA regarding FAR Subpart 27.4 – Rights in Data and Copyrights.

3. The contractor shall not integrate any proprietary or commercial licensed software that cannot be severable at close out without the government incurring licensing costs or loss in functionality.

2. SYSTEMS

1. The term “information system” means a discrete set of information resources organized for the collection, processing, maintenance, transmission, and dissemination of information, in accordance with defined procedures, whether automated or manual.

2. For additional guidance, see OMB Circular A-130.

3. MAJOR INVESTMENTS

1. An Earned Value Management System (EVMS) is required for major acquisitions that include development activities, in accordance with OMB Circular A-11.

2. The Government may also require an EVMS for other acquisitions, in accordance with agency procedures. See FAR Subpart 52.234-2 – Notice of Earned Value Management System for additional guidance.

4. SAMHSA TECHNOLOGY STANDARDS

1. SAMHSA’s Capital Planning Investment Control (CPIC), Enterprise Architecture, Mobile, Privacy and Security and Website technology standards are available, see: Appendix A.

5. FEDERAL RECORDS

1. “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, function, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them. The term Federal record:

i. includes SAMHSA/HHS records; ii. does not include personal materials; iii. applies to records created, received, or maintained by Contractors pursuant to their SAMHSA contract; and

iv. may include deliverables and documentation associated with deliverables.

6. ELECTRONIC RECORDS

1. Any information that is recorded in a form that only a computer can process, and that satisfies the definition of a federal record in 44 U.S.C. 3301.

2. Electronic records include numeric, graphic and text information, which may be recorded on any medium capable of being read by a computer and which satisfies the definition of a record.

7. FEDERAL REPORTING REQUIREMENTS

1. The Contractor shall provide any required information on systems, applications, or IT investments as needed to support SAMHSA’s compliance with federally mandated reporting.

II. INFORMATION TECHNOLOGY (IT) PLAN

A. The Contractor shall prepare an IT Plan that addresses and describes the Design, Development, Implementation, and Maintenance for all IT Systems in the contract/ task order. The IT Plan shall include:

1. Functional requirements (e.g., data, workloads, user interface, reliability, security, and maintenance

2. Technical requirements (e.g., hardware, software, and telecommunications)

3. Operational requirements

4. Any additional requirements that are needed to accurately address design, development, implementation, and maintenance

5. System architecture

6. Iterative development approach for software development

7. IT milestones and implementation dates of the project.

B. A draft IT plan shall be included as part of the proposal. The final IT Plan (Electronic Version) shall be submitted as a deliverable to the COR and DTM (through the COR) for review and approval 60 calendar days after award.

C. Full acceptance of the Contractor’s IT Plan is required before implementation and contingent upon the review and approval of DTM.

D. The IT Plan will be reviewed on an annual basis and updated as necessary if major modifications are made to the system.

E. The contractor shall follow the Health and Human Services Enterprise Performance Lifecycle (EPLC) policy/templates or equivalent with an iterative and/or agile development approach to manage IT projects. The EPLC can be found at https://www.hhs.gov/sites/default/files/ocio/eplc-lifecycle-framework.pdf F. The proposal, project, schedule, and work products should clearly demonstrate an agile or iterative approach to software development.

III. SAMHSA’s DIVISION OF TECHNOLOGY MANAGEMENT (DTM) STANDARDS A. Consultation with DTM

1. Prior to award of this contract, the Requestor shall consult with the Division of Technology & Management (DTM) team. The DTM team will provide the Requestor with a comprehensive understanding of the technologies offered by DTM, including their applicability and potential benefits to the project. The Requestor acknowledges that the DTM team consultation is intended to:

· Facilitate better informed decision-making regarding the selection of technologies for the project.

· Identify any potential technical complexities associated with the project and ensure appropriate mitigation strategies are in place.

· Optimize the project's overall efficiency and effectiveness by ensuring alignment with the Requestor's specific needs and goals.

· Communicate impact of ongoing Enterprise Strategies such as enterprise data strategy, etc.

2. DTM team is readily available to the Requestor for consultation purposes throughout the pre-award phase. The Requestor shall be responsible for scheduling and coordinating consultation meetings with the DTM team.

3. This provision does not create any additional warranties or guarantees concerning the suitability or performance of the technologies offered by DTM.

B. Adoption of SAMHSA Computing Environments

1. New Contracts including Renewals:

· For all new contracts entered into after the effective date of this agreement, the Contract shall utilize the computing environment provided by SAMHSA for their production environment. This requirement is in accordance with OMB Memorandum 24-04 and is a material term of this agreement.

· For already existing systems, the Contractor shall migrate their current production environment to the computing environment provided by SAMHSA. If migration is not feasible, the Contract must install the applications from SAMHSA's current security stack to comply with recent OMB guidance. The Contract shall complete the migration within one year timeframe or installation of applications within a three-month timeframe.

2. The contractor shall adhere to SAMHSA's security development guidelines and requirements for this project. These guidelines will be provided to the Contractor upon contract award and may include secure coding practices, secure configuration management procedures, and risk management methodologies.

C. The Contractor shall use software that meets SAMHSA Technology Standards and has achieved the Federal Risk and Authorization Management Program (FedRAMP) authorization, where applicable. For SAMHSA technology standard, see: Appendix A.

The Contractor shall, at all times, maintain compliance with current SAMHSA DTM standards, which may change over the duration of this contract/task order. Any deviation from the SAMHSA standards shall be negotiated with SAMHSA and approved by the SAMHSA CIO prior to contract/task order award. SAMHSA is currently working on a policy. Until SAMHSA’s policy is established, follow the HHS policy.

IV. FEDERAL INFORMATION TECHNOLOGY ACQUISITION REFORM ACT (FITARA) REQUIREMENTS

1. Initial Contract information COR shall contact the DTM FITARA Team to provide basic contract information required to create contract in Federal Information Technology Tracking System (FITTS).

2. IT Cost Reporting Contractor shall comply with OMB, HHS, and SAMHSA requirements on reporting IT costs. Contractor shall submit reports of actual and future estimated IT costs to the COR twice a year (July and November). It is the responsibility of the COR to submit the reports to DTM. A reporting template shall be provided to the Contractor upon award of contractor/task order.

3. Contract Factsheet Contractor shall work with the COR to submit or update the contract factsheet annually. For a new contract, a factsheet should be submitted to the DTM FITARA team (fitara@samhsa.hhs.gov) within 90 calendar days of contract start.

4. Website Domain Registration Contractor shall work with the COR to submit domain registration information to DTM FITARA team when a new website domain name is registered, or website information is requested by the DTM FITARA team.

5. Contractor shall work with COR to provide contract-related software and hardware license or registration information to the DTM FITARA Team.

1. Contractor shall work with COR to provide all project information requested by HHS data calls and the DTM FITARA Team.

V. SECURITY AND PRIVACY REQUIREMENTS FOR SAMHSA IT SYSTEMS

BASELINE SECURITY REQUIREMENTS

1) Applicability The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Information Security Laws, Regulations, Policies

a. Federal Policies. The Contractor (and/or any subcontractor) shall comply with applicable federal laws that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P), and SAMHSA Security Policy; Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 (current version), Security and Privacy Controls for Federal Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; Executive Order 14028 Improving the nations cybersecurity with a focus on implementing Zero Trust Architecture; OMB: M-21-03: Protecting Critical Software Through Enhanced Security Measures; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

b. Comply with all new and existing cybersecurity CISA directives, OMB circulars, memorandums, and signed Presidential Executive Orders. The Contractor shall perform periodic reviews to ensure compliance with existing information security and privacy requirements. The Contractor shall make all system information and documentation produced in support of the contract/task order available to the agency and agency auditors upon request and/or in real-time. All questions concerning IT security should be directed to the IT Security Team (through the COR) at infosecurity@samhsa.hhs.gov.

3) U.S. Citizenship Contractors shall identify in their proposals, the names and citizenship of all proposed to work under the contract. Any additions or deletions after contract award shall be reported to the Contracting Officer.

Per FAR 3052.204.71, each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-551).

Any exceptions must be approved by the SAMHSA Chief Information Security Officer or designee.

4) Safeguarding Information and Information Systems In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems to ensure:

i. Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

ii. Integrity, which means guarding against improper information modification or destruction, and ensuring information non- repudiation and authenticity; and

iii. Availability, which means ensuring timely and reliable access to and use of information.

b. PERIMETER DEFENSE: CONTRACTOR SHALL ENSURE THAT THE SYSTEM AND THE INFORMATION IT CONTAINS OR STORES ARE SECURED; using appropriate perimeter defense technologies and that these technologies are monitored for anomalous traffic behavior. Contractor shall provide security for any Contractor systems, and information contained therein, connected to an HHS network, or operated by the Contractor on behalf of HHS regardless of location. Per EO directive, all applications should be considered to be hosted in SAMHSA’s cloud. Meet with DTM for determination and justification within base year or timeline agreed upon.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS and SAMHSA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Per EO directive, all applications should be hosted in SAMHSA’s cloud. Meet with DTM for determination and justification within base year or timeline agreed upon. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P) and SAMHSA Security Policy by contacting the SAMHSA Security team emailing infosecurity@samhsa.hhs.gov and/or emailing fisma@hhs.gov.

d. Categorize all information owned and/or collected/managed on behalf of HHS/[SAMHSA] and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

· Confidentiality: [ ] Low [ ] Moderate [ ] High

· Integrity: [ ] Low [ ] Moderate [ ] High

· Availability: [ ] Low [ ] Moderate [ ] High

· Overall Impact Level: [ ] Low [ ] Moderate [ ] High

e. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/[SAMHSA] regardless of location or purpose.

e. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

f. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/[SAMHSA] Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/[SAMHSA] security and/or privacy officials.

g. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

h. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/SAMHSA privacy policies, and complete all the requirements below:

Protecting PII Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

1. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

2. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

3. If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 30 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

4. The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

5. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

a Marked appropriately;

b Disclosed to authorized personnel on a Need-To-Know basis;

c Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and d Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

7. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

8. The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and [SAMHSA] policies. Unauthorized disclosure of information will be subject to the HHS/[SAMHSA] sanction policies and/or governed by the following laws and regulations:

a 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and c 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

9. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (1Pv6) available at https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

10. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

11. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

12. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency to comply with contract deliverables as appropriate.

13. Standard for Encryption. The Contractor (and/or any subcontractor) must:

a Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

c Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and SAMHSA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR within 30 days.

e Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

14. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the SAMHSA non-disclosure agreement. https://samhsa273.sharepoint.com/sites/DTM/IT%20Clearance%20Documents/DTM%20NDA%20for%20Contractors.pdf, as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

15. Training Requirements a Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/SAMHSA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete Information Security Awareness, Privacy, and Records Management trainings at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

16. Role-based Training: All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training within thirty (30) calendar days after the award of the contract and annually thereafter to commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

17. Training Records.

a The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

18. Rules of Behavior a The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior and HHS Rules of Behavior for Privileged Users.

b All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual SAMHSA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

19. Incident Response a The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/[SAMHSA] IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

ii NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send SAMHSA approved notifications to affected individuals after consulting with the CISO and CIO.

iii Report all suspected and confirmed information security and privacy incidents and breaches to the SAMHSA Incident Response Team (IRT) infosecurity@samhsa.hhs.gov, COR, CO, OpDiv SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable SAMHSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

iv Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

v Not include any sensitive information in the subject or body of any reporting e-mail; and vi Encrypt sensitive information in attachments to email, media, etc.

vii Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/SAMHSA privacy breach response policies when handling PII breaches.

viii Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents within 72 hours of notification. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

20. Position Sensitivity Designations a All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

b Note to the Requiring Activity Representative: The Requiring Activity Representative, in conjunction with Personnel Security, must use the OPM Position Sensitivity Designation automated tool (https://www.opm.gov/investigations/) to determine the sensitivity designation for background investigations. After making those determinations, include all applicable position sensitivity designations.

21. Homeland Security Presidential Directive (HSPD)-12 a The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

b Note to the Requiring Activity Representative: For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12)

22. Roster a The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/or CO within 15 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within 15 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

b If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

23. Contract Initiation and Expiration

1. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

2. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO as soon as possible before an employee stops working under this contract.

5. Contractor Responsibilities upon Physical Completion of the Contract.

a. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or SAMHSA policies.

b. The Contractor (and/or any subcontractor) must perform and document the actions identified in the SAMHSA Contractor Employee Separation Checklist when an employee terminates work under this contract within 5 days of the employee's exit from the contract. All documentation must be available to the CO and/or COR upon request.

c. NOTE: Request Project Closeout/System Decommission Meeting with DTM and Division of Operational Support (DOS) representatives at least 30 calendar days before the completion of the contract.

6. Records Management and Retention

a. The Contractor (and/or any subcontractor) must maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS Policy for Records Management and SAMHSA policies and must not dispose of any records unless authorized by HHS/SAMHSA.

b. In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, he/she must document and report the incident in accordance with HHS/[SAMHSA] policies.

7. High Value Asset (HVA)

If a system is identified as HVA,[23] the contractor must comply with the HHS Policy for the High Value Asset (HVA) Program and the DHS HVA Control Overlay[24] in addition to the above requirements.

VI. SECURITY REQUIREMENTS FOR GOCO AND COCO RESOURCES

The Federal Information Security Modernization Act (FISMA of 2014, (44 U.S.C.

101)22, Office of Management and Budget (OMB Circular A-130, Managing Information as a Strategic Resource23, and Federal Procurements Regulation (FAR) 39.10124 mandate that contractor systems, including Government- Owned/Contractor-Operated (GOCO) or Contractor-Owned/Contractor- Operated (COCO) be at least as secure as government systems operated by the government.

a. Federal Policies. See baseline security requirements section.

b. Security Assessment and Authorization (SA&A). A valid authority to operate (ATO) certifies that the Contractor’s information system meets the contract’s requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) shall work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s). The Contractor shall conduct the SA&A requirements in accordance with HHS IS2P/and SAMHSA Security Policy, NIST SP 800- 37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision).

NOTE: SAMHSA’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the system security and privacy controls are implemented and operating effectively. In addition, all directives provided by CISA and OMB.

c. Contractor must be able to implement the Federal Information Security Management Act (FISMA), NIST 800-53 Rev. 5 required security controls at the FIPS-199 Low and/or Moderate data classification level. This contract has a preliminary Low data classification level.

d. The Contractor shall assist in the security assessment and authorization (SA&A) of all systems developed for support of the contract/task order in conformance with the standards set forth by the FISMA and NIST SP800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach.

e. Contractor must reach out to SAMHSA Security through the COR infosecurity@samhsa.hhs.gov to initiate the SA&A process (Authorization to Operate) within 30 days after the contract/task order effective date (CED), categorize the system and information hosted on the system in accordance with:

· FIPS-199, see NIST FIPS PUB 199

· Federal Information Processing Standard NIST SP 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, Table C-2 at Vol 2, see: NIST SP800-60 Vol2 Rev1.

· The security categories and risk level shall be documented in the designated System Security Plan (SSP) for all systems within the proposal and must obtain Authorization to Operate (ATO) from SAMHSA CIO and CISO prior to system goes live into the production or becomes operational.

VII. SA&A PACKAGE DELIVERABLES

Contractor shall develop and submit ATO package (SA&A Checklist) to SAMHSA Security through the COR along with related documentation and supporting artifacts to meet applicable security controls before obtaining ATO. SAMHSA has created the checklist and SA&A package to facilitate compliance with the OMB-mandated SA&A process. The SA&A Checklist will be provided to the Contractor after contract/task order award and upon request to DTM through the COR.

VIII. ATO PACKAGE ARTIFACTS & OF DELIVERABLES ARE BUT NOT LIMITED TO THIS LIST:

a. Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA)

b. SAMHSA provided Information System Security Plan (ISSP) template along with evidences to backup compliance descriptions; The SSP shall comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and SAMHSA policies and other guidance.

c. Each of the 17 NIST control families prescribed in NIST Special Publication 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations, and the specific ways in which those controls are implemented must be addressed, if applicable, in the ISSP and pertinent to the function the system is designed to provide. The system security plan must be reviewed on at least an annual basis. The version numbers must be employed and revised to record when changes are made to the document.

i. System Contingency Plan: The Contingency Plan must be developed in accordance with NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, and be consistent with HHS policies.

ii. CP Test Report

iii. CP Test Lessons Learned report iv. System Account Management Plan

iv. System Categorization (Low, Moderate, High)

v. System Risk Assessment

vi. Evidence related to security controls implementation i.e. artifacts, supporting documentation or references to appropriate sources and other risk or security-related documents

vii. Interconnection Security Agreement, where applicable

viii. Vulnerability and Compliance Scan report: The Contractor shall address all “Critical” and “high” deficiencies and vulnerabilities before submitting the package to the Government for acceptance This activity shall be performed in conjunction with the initial development of the system, updated when a major change occurs to the system and renewed no less than every three years. Contractor will be responsible for ATO re-assessment if they add or delete Hardware or Software to the current ATO baseline or system accreditation boundary.

THE SAMHSA ATO PACKAGE WILL BE PROVIDED TO THE

CONTRACTOR AFTER CONTRACT AWARD AND UPON REQUEST TO

DTM THROUGH THE COR. ALL SYSTEM AUTHORIZATION TO OPERATE (ATO) PACKAGES SHALL BE COMPLIANT WITH ALL PUBLIC LAW (PL) - 107-347, OMB MANDATES, FIPS, AND ADDITIONAL APPLICABLE NIST GUIDANCE. THIS GUIDANCE INCLUDES, BUT IS NOT LIMITED TO FIPS 199, FIPS 200, NIST SP 800-18, NIST SP 800-30, NIST SP 800-37, NIST SP 800-53 (CURRENT VERSION), NIST SP 800-53A, AND NIST SP 800- 60. ALL NIST AND FIPS DOCUMENTATION CAN BE FOUND AT THE NIST WEBSITE.

IX.

E-AUTHENTICATION QUESTIONNAIRE

X.

The contractor (and/or any subcontractor) must collaborate with government personnel to ensure that the E-Authentication requirements are implemented in accordance with OMB 04-04 and NIST SP 800-63.

Based on the level of assurance determined by the E-Auth, the Contractor (and/or subcontractor) must ensure appropriate authentication to the system, including remote authentication, is in- place in accordance with the assurance level determined by the E- Auth (when required) in accordance with HHS Guidance for Selection of e-Authentication Assurance Levels and any other applicable HHS policies. Answers to the questionnaire shall be submitted to CISO and infosecurity@samhsa.hhs.gov within 30 calendar days after CED.

a. Contractor shall remediate security weaknesses resulting from a security authorization (ATO) process in a timely manner (Plan of Action and Milestones or POA&Ms). All Critical security findings must be addressed within seven (7) calendar days. Security relevant patches, service packs and hot fixes must be promptly installed. All High-risk findings must be addressed within 30 calendar days. All Moderate risk findings must be addressed in 60 calendar days and Low risk findings in 90 calendar days. Depending on the severity of the risks, SAMHSA may require designated POAM weaknesses to be remediated before an ATO is issued.

b. Contractor must be able to appoint a security resource on the contracting staff with at least 3 years of professional IT Security experience in FISMA & NIST. Security resource must act as liaison between SAMHSA Security & Contractor. That person must be capable of providing the services and expertise to the contractor to implement and maintain the IT security requirements and completing ATO package at the appropriate data classification level or contractor must hire a 3rd party contractor(s) who has the expertise and is capable of implementing NIST based IT security requirements at least at the Moderate data classification level.

c. The Contractor shall ensure all staff has the required level of security clearance commensurate with the sensitivity of the information being stored, processed, transmitted or otherwise handled by the System or required to perform the work stipulated by the contract/task order.

Contractor shall comply with all Federal and Department of Health and Human Services (HHS) security and privacy guidelines in effect at the time of the award of this contract, see HHS CYBERSECURITY WEBSITE.

XI.

CONTRACTOR MUST ESTABLISH INTERCONNECTION SECURITY AGREEMENT (ISA), MEMORANDUM OF UNDERSTANDING (MOU), OR MOU WITH ENTITIES EXTERNAL TO SAMHSA AND OUTSIDE OF THEIR DEFINED ACCREDITATION BOUNDARY EXCEPT FOR CONNECTIONS TO INFRASTRUCTURE GENERAL SUPPORT SYSTEMS THAT PROVIDE INHERITED SECURITY CONTROLS.

CONTRACTOR SHALL PERFORM ANNUAL PENETRATION TESTING ON

THE SYSTEM(S) AND PROVIDE THE FOLLOWING TO THE SAMHSA COR

AND DTM SECURITY TEAM, INFOSECURITY@SAMHSA.HHS.GOV: 1) TEST PLAN; 2) REMEDIATION PLAN.

THE CONTRACTOR MAY PERFORM THE TEST ANYTIME WITHIN EACH CONTRACT YEAR.

XII.

CONTRACTOR MUST HAVE SEPARATE AND SEGREGATED

DEVELOPMENT, TEST AND PRODUCTION ENVIRONMENTS, AND MUST NOT USE PRODUCTION DATA OR PII DATE ON THE TEST ENVIRONMENT.

XIII.

SYSTEM SHALL EMPLOY MULTI-FACTOR AUTHENTICATION FOR ACCESS TO THE SYSTEM

XIV.

BASELINE CONFIGURATION STANDARDS:

XV.

Contractor IT equipment (e.g., laptops, desktops, servers, routers, mobile devices, peripheral devices etc.) containing or processing information on behalf of HHS/SAMHSA data shall be configured with the applicable security configuration baselines established by the United States Government Configuration Baselines (USGCB). The following actions are recommended when configuring operating systems, applications, IT products and devices:

a. Consult HHS-approved security configuration standard baselines for configuring IT products, hardware, and software.

b. If an HHS-defined configuration standard baseline is not available, select the checklist maintained on the NIST NCP (National Checklist Program Repository).1 Select the source of each checklist in the following order depending on their availability:

c. NIST-produced checklists and/or the United States Government Configuration Baseline (USGCB);

d. Agency-produced checklists (e.g., Defense Information Systems Agency [DISA] or the National Security Agency [NSA]);

e. Vendor-produced checklists;

f. Other checklists; Refer to page 15 of NIST SP 800-70 rev.3 and NIST Special Publication 800-73-4. Other checklists are those that are posted on the NCP other than the government-authorized checklists (USGCB, DISA, and NSA) and vendor-produced checklists.

System components shall have and maintain the latest operating systems and applications patch level and anti-virus software level.

All exceptions and deviations from the standard baseline configurations shall be documented and approved by the HHS or SAMHSA Chief Information Officer (CIO) or designated official.

Contractor…