Question_1.pdf

To Whom It May Concern:

Please see the response to the following question:

Question 1: Do you have any guidance about what the “Bureau’s electronic security requirements” are?

The SOW references it in the middle of page 13, but I can’t find any guidance as to what that means.

Answer: Electronic database/filing systems must meet FIPS 140-2 standards, as this is a Bureau of Prisons (BOP) and a Federal Government requirement. Federal Information Processing Standard Publication 140- 2 is a computer standard. Example: A contractor may reference an electronic filing system when all they mean is using a flash drive to store clinical notes and documents. This would be acceptable as long as the flash drive is encrypted and the flash drive is maintained on the performance site premises. Another contractor may have their own electronic filing system utilizing a cloud/remote access system. This would be acceptable as long as the BOP is allowed unrestricted access; all staff, including system maintenance staff with access to BOP records, are cleared/approved; and the contractor's system meets FIPS 140-2 standards, which are used with healthcare provider systems and such.

If you have any questions, please let me know.