RRB13Q013_Amendment_A-1_Attachment_1.docx

RRB13Q013 Amendment A-1 Attachment 1 Page 20 of 20 20

RRB Responses to Vendor Submitted Questions Regarding RFQ RRB13Q013

Question 1: What are the RRB’s expectation on the accuracy rate of the OCR process, taking into consideration some that some of the quality on the original documents may have an adverse effect on getting accurate hits when trying to translate, especially characters from the Onion skin, and some of Photocopied documents?

RRB Answer 1: The RRB has modified the QASP, Attachment 1, to state that each offeror shall propose their accuracy rate of the OCR process for each type of legal opinion paper format. The RRB will evaluate the proposed accuracy rates for each offeror as part of the technical evaluation process.

Question 2: Since the OCR will not work on Cursive Handwritten notes, do all Cursive notes found on a document require to be hand keyed?

RRB Answer 2: Yes, all hand written notes on the legal opinion documents shall be hand keyed and included as a new field for each legal opinion document. They shall also be full text searchable when performing a search for legal opinions.

Question 3: We understand the documents need to be re-assembled; do you require us to also re-staple the documents upon completion of the scanning process?

RRB Answer 3: Based on NARA’s guidelines for the handling of fragile documents the RRB has decided not to require that the legal opinions be re-stapled. The RRB is interested in other methods available to identify and maintain the order of the pages in the legal opinion documents. Offerors shall identify such methods in their proposals.

Question 4: Please confirm that you will be supplying and Indexing Spreadsheet to work with for Phase 1 indexing purposes for the Subject, Legal Opinion, Date of Legal Opinion.

RRB Answer 4: Yes, the RRB will be providing a spreadsheet index for each binder which will list the following: Legal Opinion number; date of opinion; type of correspondence; addressee and subject. RRB will provide this to the awarded contractor.

Question 5: Can you please confirm that you will be providing a listing of the index fields (Subject, Legal Opinion Number, and Date of Legal Opinion) for all Phases of the project – not just for Phase 1?

RRB Answer 5: See RRB Answer 4 above.

Question 6: For any handwritten notes, can you please provide the guidelines for when you would like these to be searchable?

RRB Answer 6: See RRB Answer 2 above.

Question 7: Can you please provide an example of a case file that is linked to the public record? Can you please confirm where the link will reside and would they need to go through security to access the link?

RRB Answer 7: The legal opinions will only link to other legal opinions. No link will take a user outside the hosted system provided as the solution to the RFQ.

Question 8: Can you please confirm that the online version cannot be an image of the document with underlying text values? Given that you only want a “print only” capability on the website, as well as the disadvantage of the cost and the appearance of a text file, would you consider using a text-searchable pdf or image of the original document as an option?

RRB Answer 8: The redacted electronic file of the legal opinions must be full text searchable. Offerors may propose the type of file that will meet this requirement.

Question 9: Redaction generally means to place a permanent black box over the information to be redacted. Is this acceptable?

RRB Answer 9: See RFQ RRB13Q013 section III.B.1 for further information regarding the redaction requirements.

Question 10: There are a total of 258 binders listed in CLINs 001-005, and there are 83,850 total pages listed for conversion (Section III.A). Is it correct to assume that the 83,850 pages encompass CLINS 001-005, which would put the average number of pages per binder at approximately 325 (83,850 pages / 258 binders)? If not, please clarify.

RRB Answer 10: The average page number is correct, however, the total number of pages per binder vary and range from 25 pages to approximately 350 pages.

Question 11: The RFQ states that there are between 1-200 pages per Legal Opinion. In reviewing some 50 post-1997 Legal Opinions from the RRB website, it was determined that the average number of pages per Legal Opinion appears to approximately 2.6 pages. Will the RRB confirm the average number of pages per Legal Opinion?

RRB Answer 11: See RRB’s Answer 10 above.

Question 12: For CLINs 001-005, is there an expected duration for the time to convert the Legal Opinions? Example, the expectation is that all the binders in CLIN 001 will be fully processed within 60 days of the start of production?

RRB Answer 12: The RRB does not have a timeframe in mind at this time for the duration of the requested services. The offerors are required to provide a timeline for their offered solution as part of their technical proposal submission.

Question 13: Will CLINs 001-005 be released in a staggered manner, or will they all be awarded at the same time? In other words, if possible, please provide the timeline for when each CLIN will be released.

RRB Answer 13: The RRB does not know at this time when or if the Optional CLINS will be exercised. It will depend on the availability of funds and the performance of the contractor during Phase 1.

Question 14: CLINs 001-005 each have three Position/Labor/Skill lines for breaking down the FFP. Is it possible for vendor to add additional lines where needed? Additionally, is the expectation that all of the employee line items pricing (hours x rates), when summed, will equal the total FFP for each CLIN?

RRB Answer 14: Yes, offerors may add additional lines for the position/labor/skills provided for each CLIN. The RRB’s expectation is that the price breakdown of hours and labor categories will be a near match and evident build to the Firm Fixed Price offer for each CLIN.

Question 15: Will the US RRB accept additional startup fees (Capital Expenditure, Implementation, T&E, development, etc.), or must all costs associated with each CLIN be included in the FFP?

RRB Answer 15: Any start-up fees associated with the implementation period for the services shall be included in the offerors firm fixed price for Phase One services in CLIN 001 of the Price Schedule.

Question 16: Is the RFQ asking that only the text file portion of the converted image be redacted, and not the actual image itself? Meaning that when viewed, the scanned image of the Legal Opinion will not have the PII redacted (via black bar overlay)?

RRB Answer 16: As stated in the RFQ RRB13Q013 section III, the RRB is requiring a contractor to provide un-redacted electronic image files of the legal opinion documents on CD/DVD ROM, and also a redacted text version of the legal opinion documents that will be posted on the contractor’s website for viewing by the RRB and the public.

Question 17: The RFQ states "Referenced case files or prior legal opinions must include a URL link to the publically available case file or legal opinion." In reviewing an available Case File on the RRB Website (L-2002-14), please confirm that this would result in 4 referenced case files or opinions: "Referenced case files or prior legal opinions must include a URL link to the publically available case file or legal opinion. "See 24 Comp. Gen 676, 678 (1945) and 38 Comp. Gen 316, 319 (1958)." Additionally, should each referenced case file or legal opinion be bookmarked with the URL in the comment of the PDF?

RRB Answer 17: See RRB answer 7 above. The legal opinions will not link to outside cases or the decisions of other Agencies. L-2002-14 would only need to be linked to a previous legal opinion referenced in the opinion text.

Question 18: Based on our research, the location of the publicly available case files or legal opinions is the US Government Accountability Office (US GAO) website (www.gao.gov). Is our understanding correct that this GAO website should be searched for the case file or legal opinion?

RRB Answer 18: See RRB answer 7 and 17 above. The GAO website would not need to be linked to the solution system.

Question 19: The RFQ states "Exceptions: RRB and other Federal Employee public information (Name and job title only) should not be redacted". How is vendor to determine whether or not a name listed in a Legal Opinion is a Federal Employee / RRB Name?

RRB Answer 19: All names that appear in memos or letters need to be redacted to “Person A” or Person B.” A short list of exceptions will be provided to the successful Contractor which will indicate which officials need not be redacted.

Question 20: Essentially, is the RRB asking for a word-to-word transcription of the legal opinion image into the redacted text file?

RRB Answer 20: Yes

Question 21: The RRB is asking that full-text OCR be performed on the scanned Legal Opinions, with the data being stored in a text file with an accuracy rate of 99.99%. Contractor has the following questions:

1) Is the 99.99% Accuracy at the Document, Page, Word, or Character Level?

2) Would the RRB consider an alternate quality level for the redacted text file other than 99.99%? In terms of performing full-text OCR on a non-standard, full page of free-form text, the quality level that will be attained is nowhere near 99.99% accurate. This type of quality level would essentially require the entire document be transcribed manually by a keyer, and then transcribed a second time by a separate keyer, with any character differences being verified by a 3rd keyer (double-blind keying).

3) Is there a chance that the 99.99% quality level was for the three index fields (Legal Opinion Number, Subject, and Date) and that contractor potentially mis-interpreted the delivery requirement? If not, what quality level is expected on the three index fields listed?

RRB Answer 21: See RRB’s answer 1 above.

Question 22: For the PII to be redacted, does the redaction format have to follow the written format? For example, if the SSN is listed as "123-45-6789" does the redaction have to be XXX-XX-XXXX and if it is written as "123456789" does it have to be keyed as XXX-XX-XXXX? Or can a standard SSN redaction template be used, something along the lines of "SSNXXX-XX-XXXX" for all SSNs?

RRB Answer 22: The standard redaction format for all SSN’s shall be “SSN”.

Question 23: If a Legal Opinion has multiple names that require redaction, is vendor required to assign each person a distinct redacted name ("Person A, Person B, etc.")? This would require that the redaction use the same redacted name "Person A" for each occurrence of the same individual "John Smith". Or is it acceptable to just refer to each redacted name as "Person X" or something similar?

RRB Answer 23: Yes, each name in a legal opinion document shall have a distinct redacted name that shall be used for each occurrence of that name throughout the specific opinion.

Question 24: The RFQ states: "If any legal opinions are missing from a binder for whatever reason, it should be brought to the attention of the project manager upon discovery by the contractor project staff". How is contractor to know whether or not a Legal Opinion is missing from a binder? Is there a database table that lists Binder ID and the Legal Opinion Numbers within the binder? Is there a sheet at the front of the binder listing all the Legal Opinions within?

RRB Answer 24: The RRB will be providing an index for each binder as stated above in RRB Answer 4. The index lists the total number of legal opinions in each binder along with the total number of pages in the binder. The contractor will sign out each binder that they take possession of and if the contractor discovers a missing legal opinion they should notify the RRB Project Manager immediately. When the binders are returned, the RRB project manager will count to make sure all opinions and pages are in the binder.

Question 25: Would the RRB prefer that contractor check for the presence of all Legal Opinions within a binder prior to taking possession of the binder, with any discrepancies being handled immediately with RRB staff?

RRB Answer 25: See RRB Answer 24 above.

Question 26: This section states that Phase 1 consists of 37 binders with Legal Opinions. The CLIN listed for Phase 1, CLIN 001, states there are 54 binders in Phase 1. Please provide the number of binders in Phase 1.

RRB Answer 26: Phase 1 consists of a total of 54 binders. The RFQ Section III has been updated to reflect this total number of binders.

Question 27: This section states that along with the Phase 1 binders, there are 371 Legal Opinions in Microsoft Word or PDF Format. Since these are already digitized, how is RRB expecting vendor to process these electronic files? Additionally, these 371 Word/PDF files are not listed under CLIN 001.

RRB Answer 27: In order to maintain the integrity of the original signed opinion, no Microsoft Word documents will be provided. All Opinions will be scanned from the signed original copy in a binder. The attached Amendment A-1 document has been updated to reflect this change.

Question 28: Is there a quality level requirement for the referenced case file URLs?

Answer 28: The RRB does not have a quality target and will accept quotes of various legible quality levels. Only other RRB Legal Opinions will be linked from a Legal Opinion.

Question 29: Is the text-based output for the redacted file supposed to be a fully searchable PDF file, or something more like an ASCII text file? Contractor believes it to be the former, but would like to verify. The reason this is being asked is because in RFQ section III.B.1, the requirement is to replace the PII with a string ("Person A", "SSN XXX-XX-XXXX"), and by its nature, a PDF document is uneditable.

Answer 29: The redacted text files of the legal opinion documents shall be fully searchable files. Offerors shall propose the type of file, etc. in their technical proposal.

Question 30: The requirement states that the opinions are to be viewable by the public only through the Agency's website: www.rrb.gov. Does this mean that the RRB is expecting to integrate with contractor's hosted image repository via API / Web Services / etc.? If not, how will contractor's hosted images be viewable via the RRB's website?

Answer 30: The electronic redacted text files shall be stored and hosted on the contractor’s database repository and shall be accessible by RRB staff and the public via a link from RRB’s website to the contractor’s hosted data repository site. The redacted versions of the legal opinions are to be viewable by the public only through the RRB’s website. The offeror's proposed solution should include the technical method to meet this deliverable. The offeror’s Project Approach and Management Plan should include a detailed narrative outlining the project approach and methodology for all deliverables, the required functionalities and activities, and a projected time-line for all deliverables. The offeror’s Staffing Plan shall explain and provide details of the proposed staffing and organizational structure to accomplish the deliverables described in Section III.

The offeror’s Project Approach and Management Plan and Staffing Plan must detail any task from their solution that will require the involvement of RRB IT staff to accomplish a deliverable, such as web programming changes on the RRB’s website. The RRB is seeking a solution that includes contractor services to fully accomplish deliverables with minimum time/services required of RRB IT staff and hosting services without the use of the RRB’s current IT infrastructure.

Question 31: As it is currently architected, the text within a searchable PDF is only searchable in contractor's repository once the image has been loaded into a viewer. In other words, it is not possible from the search interface to perform a search on a text string and have that search be applied to all the text within each stored image. As a workaround, since the users will access the images via the RRB's website, would the RRB consider this alternate solution: Contractor will provide to the RRB a database file that has a row for each captured Legal Opinion. Within the row there would be a column for Legal Opinion ID, and another that contains the full text from the Legal Opinion. The RRB would set a query on its site that would allow the user to search for a string of text within the database, and return any matching Legal Opinion IDs. From there, the Legal Opinion IDs would be passed to contractor via API / Web Service / etc. and the search results would then be displayed.

Answer 31: The RRB is seeking a solution that includes contractor services to fully accomplish deliverables with minimum time/services required of RRB IT staff and hosting services without the use of the RRB’s current IT infrastructure. The contractor’s Project Approach and Management Plan and Staffing Plan must detail any task from their solution that will require the involvement of RRB IT staff to accomplish a deliverable, such as web programming changes on the RRB’s website.

Question 32: The RFQ states: "The proposed solution is required to meet all security controls for a FISMA moderate system as defined by NIST 800-53 Rev 4, regardless of whether or not each requirement is specified in this solicitation. The offeror shall comply with NIST 800-53 Rev. 4, including, but not limited to, indicating compliance with the requirement for use of multifactor authentication [1] for network access to privileged accounts (Organizational Users IA-2(2)). RRB requires at minimum two factor authentication."

Currently contractor does not have a two factor authentication solution that supports FIPS 201 requirements. Contractor provides multifactor authentication for network access to non-privileged and privileged accounts (Organizational Users IA-2(2)). Non-privileged accounts (General Users) are configured with a complex password, 14 Character length, the password expires every 60 days. Privileged accounts (administrators) are configured with a complex password, 15 Character length, the password expires every 60 days. Would this suffice as an alternate security requirement?

Answer 32: OMB Memorandum M-11-11 requires that all procurements for services and products involving facility or system access control must be in accordance with HSPD-12 policy and the Federal Acquisition Regulation. Therefore, if RRB employees are required to have system access control to the hosted web service, multi-factor authentication will be required.

The use of PIV credentials is not required for access to Federal applications where identity assurance is not needed (i.e. E-Authentication Assurance Level 1), such as low risk public-facing websites. This will apply to the web access for the redacted legal opinions.

Question 33: If the work is to be performed on-site, what type of room will be provided to process the work (square footage, network drops, types and numbers of power outlets, desks, chairs, phones, etc.)?

Answer 33: The RRB will provide required space, etc. for offerors to provide the services onsite at the RRB. Offerors shall provide in their proposals their requirements in order to provide the services onsite at the RRB. See attached Amendment A-1 section III.K. for more information.

Question 34: The RFQ states that the RRB would prefer the digitization services take place within its facility. Will more weight be given to proposals that have the work being performed on-site vs. off-site? In other words, for two completely similar proposals, with the only difference being location of work, would the proposal with on-site work win out?

Answer 34: Yes, the RRB prefers for the services to be provided onsite at the RRB. As stated in section VI.C.1.a of RFQ RRB13Q013 additional points will be awarded to vendors that propose providing the services onsite at the RRB.

Question 35: What percentage of the paper documents are duplex?

Answer 35: A small percentage (estimated to be less than 5%) of the legal opinion files are double-sided.

Question 36: In section III.C.1 it is stated that there are 53,751 Legal Opinion Cards, but CLINs 013 and 014 do not lists volumes. Should contractor assume that each CLIN will encompass half of the work? If not, please provide the volume breakdown for CLINS 013 and 014.

RRB Answer 36: The total estimated volume of legal opinion index/digest cards is 86,200. Please review the attached Amendment A-1 document which updated the Price Schedule to remove CLIN 014.

Question 37: Please provide an estimate on the number of double-sided cards.

RRB Answer 37: See RRB answer 35 above.

Question 38: Other than the full-text, are there any indexing requirements for the Index/Digest Cards?

Answer 38: No, the index/digest cards do not need to be indexed.

Question 39: Is there a quality level requirement for this work?

Answer 40: See RRB Answer 1 above.

Question 40: Similarly to the question about regarding section III.H.2, would the RRB consider an alternate approach rather than full-text OCR of the documents?

RRB Answer 40: The RRB will consider all proposed solutions submitted by offerors as long as they meet the requirements of the RFQ RRB13Q013.

Question 41: How are these Index/Digest cards stored? Would the RRB consider boxing and shipping these cards to contractor's facility?

RRB Answer 41: The index/digest cards are stored in card catalog file drawers at the RRB. The RRB will not ship the cards to the contractor. The Contractor is responsible for shipping all legal opinion files and digest cards if they chose to perform the services at their location.

Question 42: How are the Legal Opinion Binders stored (Open shelving in one storage area? Scattered throughout the RRB facility? Etc.?)? If performing the work off-site, will contractor have access to a loading dock / parking space / freight elevator in order to gain access to the Legal Opinion Binders? Will the RRB "stage" the binder for pickup (removing a designated set of binders, creating a listing of binders to be picked up, and placing the binders in a centralized location)?

RRB Answer 42: The legal opinion files are stored in binders as stated in RFQ RRB13Q013 Section III. They are stored in one secure location in the RRB headquarters facility. If a Contractor provides the services offsite then the Contractor shall be responsible for the pick-up of the binders at the RRB headquarters facility. The RRB may prepare the binders for pick-up in contractor provided packaging and a contractor staff member must pick them up from the secure location in the RRB headquarters facility building. The RRB headquarters facility has a dock that could be used for the pick-up of the binders on a certain scheduled date and time.

Question 43: Would the RRB consider shipping the new Legal Opinions on a quarterly basis for conversion?

RRB Answer 43: The RRB will send the contractor electronic files of the new Legal Opinions to be redacted, and posted on the contractor’s data repository on a quarterly basis for the quarterly update services required after the completion of Phases 1-5 services.

Question 44: What resolution (Dots per Inch) is expected? 200? 300?

RRB Answer 44: The resolution shall be the dots per inch (DPI) the Contractor identifies as necessary to meet the requirements as stated in RFQ RRB13Q013 Section III.

Question 45: Is it the intent of the RRB to award all of the CLINs in each category to one vendor?

RRB Answer 45: Yes, the RRB intends to award a contract to one vendor for the services.

Question 46: Has this project been fully budgeted and funded?

RRB Answer 46: The RRB has funds available for this project and plans to issue a contract for the Phase 1 services at a minimum.

Question 47: What percentage of the Index / Digest cards are handwritten? If unsure, please provide an estimate.

RRB Answer 47: The estimated percentage of handwritten index/digest cards is 10%.

Question 48: For the Legal Opinions, it is stated that there are 480 words per page. Please provide a similar estimation on the number of words per index / digest card.

RRB Answer 48: The RRB does not have an estimate at this time for the number of words per index/digest card.

Question 49: The RFQ states: "All electronic data must be encrypted using a FIPS-201 approved product. The minimum standard is AES-256 bit encryption for data at rest."

Data at rest is used for mobile computing systems i.e. laptops, thumbs, drives etc. and Contractor does not provide mobile computing system services. Contractor does provide AES-256 bit encryption for Information at rest Storage Hard drives. Is this acceptable?

RRB Answer 49: All encryption is required to be FIPS 140-2 certified. Link to vendor list of FIPS 140-2 validated cryptographic modules: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

Question 50: How will these Legal Opinions be stored? Will they be in binders similar to the Legal Opinions in CLINS 001-005? Or will they be loose, being just stapled together?

RRB Answer 50: The new electronic legal opinions will be stored in an electronic format such as a pdf file. All RRB legal opinions are physically stored at RRB headquarters in 3” 3 rings binders

Question 51: When does the US RRB anticipate providing responses to vendor questions?

RRB Answer 51: The responses to vendor submitted questions are included in this Amendment A-1.

Question 52: Based on the anticipated volume of questions from all vendors, would the US RRB consider granting an extension to the July 15th Deadline?

RRB Answer 52: The RRB has decided to extend the due date for offers from July 15th to July 22nd at 1:00PM CST.

Question 53: Does RRB (or RRB HQ) have a data center? If so, does it meet the security standards for this requirement?

RRB Answer 53: The RRB has a data center. The RRB Information Systems have been categorized as a moderate system based on FIPS 199 guidance. All of our systems have been authorized to operate as a moderate system per FISMA guidance.

Question 54: If the contractor works on-site as RRB prefers, what facilities will be available? How much square footage, tables/chairs, power outlets, etc. will be available?

RRB Answer 54: See RRB Answer 33 above.

Question 55: Would RRB consider utilizing an 8(a) or HubZone Set-aside in effort to help reach your small business contracting goals?

RRB Answer 55: This solicitation is full and open and not set aside for any socioeconomic group of contractors. The RRB will evaluate all responsive offers received for the requested services.

Question 56: Do you have a database administrator or developer in house that will be working on this project? Or are you expecting the vendor to provide these resources and costs as part of the RFP?

RRB Answer 56: The Contractor shall provide all required staff resources to provide the requested services. It is unclear why RRB IT staff would be providing DBA work for documents hosted on a contractor site.

Question 57: Are you willing to utilize your current office equipment to scan, index and archive the documents?

RRB Answer 57:` The Contractor must provide all equipment necessary to provide the services as stated in the RFQ section III.

Question 58: Besides conservation and integrity of the original documents, what else is important to RRB in this process?

RRB Answer 58: Please review RFQ RRB13Q013 for further information.

Question 59: For OCR, 300 dpi is recommended; 400 or 500 dpi can produce a marginally improved OCR results. However, the higher the dpi, the slower the scanning thus the cost increases with higher dpi. Do you have a dpi expectation other than what is recommended?

RRB Answer 59: See RRB Answer 44 above.

Question 60: Would we have the opportunity to scan a sample set of legal opinions?

RRB Answer 60: The RRB may request those offerors that are determined to be in the competitive range to provide a demonstration of their ability to scan the legal opinion documents.

Question 61: Does the RRB accept progress billing i.e. monthly or bi-monthly?

RRB Answer 61: The RRB will accept monthly billing for the services. However the monthly billing cannot exceed the imaging and hosting services progress rates percentages planned by the contractor. Progress payments stop at 60% of the phase total price until the contractor has fully delivered/hosted, and the RRB has accepted all of the digitized redacted text files and un-redacted legal opinion documents for the given phase.

Question 62: Will the fields listed in the excel spreadsheet being created provide classifications or categories that are required to search for applicable opinions in lieu of OCR recognition.

RRB Answer 62: No, the index will not provide classifications or categories that are required to search for applicable opinions as the redacted text legal opinion files are required to be full text searchable.

Question 63: How many pages are in the Phase 1 binders?

RRB Answer 63: See RRB answer 10. The RRB estimates that there are a total of 11,000 pages in the Phase 1 binders.

Question 64: Is there a requirement that all coding, indexing, and redacting be done onshore or can offshore solutions be utilized?

RRB Answer 64: Due to the condition of the legal opinion documents the RRB requires that the services be provided within the continental United States.

Question 65: Many of the specifications that you have referenced within the RFQ utilize outdated technologies and methodologies which may not be appropriate for today's solutions. When submitting our bid do we need to provide justification to why we are utilizing certain technologies in deference to what is written in the specifications?

RRB Answer 65: This is a performance based acquisition and the RRB will consider all responsive offers received to provide the requested services.

Question 68: What is the total count of pages? What size are these documents?

RRB Answer 68: See RFQ RRB13Q013 Section III for this information.

Question 72: How will you handle Phases 2-5 if the awarded vendor does not meet your expectations with Phase 1?

RRB Answer 72: Phases 2-5 are optional services and the RRB may or may not exercise those options based on the availability of funds and also the performance of the Phase 1 services by the contractor.

Question 73: Are the personnel security requirements required if the job is done at the vendor’s site as opposed to at RRB’s site?

RRB Answer 73: The PIV card requirement for contractor personnel in relation to physical access to federal facilities will not apply if the services are provided offsite at a contractor’s facility and the solution does not require contractor access to the RRB’s site. See RRB answer 32, for information on PIV card requirements in relation to logical access to systems. :

The RRB expects a reasonable assurance and trustworthiness in the security of any information system that maintains RRB information sensitive data. Please see Appendix E of the NIST Special Publication 800-53 Revision 4 ‘Security and Privacy Controls for Federal Information Systems and Organizations’, as well as the NIST Special Publication 800-37 Revision1 ‘ Guide for Applying the Risk Management Framework to Federal Information Systems’.

The RRB, based on our security requirements, security policies, and needed security capabilities, requires security functionality of the contractor information system is complete, consistent, and correct. Security functionality and assurance for a moderate-impact system is achieved by the implementation of the following security controls based on the security controls in Appendix D of NIST 800-53 Rev 4.

The assurance related controls listed below are a subset of the security controls contained in the security control baseline for moderate-impact systems in the Appendix D in NIST 800-83 Revision 4. Implementing these assurance-related controls will satisfy the minimum assurance requirements:

Access Control (AC)

AC-1 – Access Control Policy and Procedures

Awareness and Training (AT)

AT-1 – Security Awareness and Training Policy and Procedures AT-2 – Security Awareness Training AT-2 (2) – Insider Threat (i.e. inclusion of security awareness training on recognizing and reporting potential indicators of insider threat) AT-3 – Role-based Security Training AT-4 – Security Training Records

Audit and Accountability (AU)

AU-1 – Audit and Accountability Policy and Procedures AU-6 – Audit Review, Analysis, and Reporting AU-6 (1) – Process integration (i.e. employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities) AU-6 (3) – Correlate audit repositories AU-7 – Audit Reduction and Report Generation AU-7 (1) – Automatic processing

Security Assessment and Authorization (CA)

CA-1 – Security Assessment and Authorization Policy and Procedures CA-2 – Security Assessment CA-2 (1) – Specialized assessments (i.e. employs independent assessors) CA-3 – System Interconnections (i.e. Interconnection Security Agreement (ISA)) CA-3 (5) – Restrictions on external system connections CA-5 – Plan of Action and Milestones (i.e. develops and maintains POA&M) CA-6 – Security Authorization (i.e. provide provisional authorization to operate (pATO) for applicable Authorizing Official to review and approve) CA-7 – Continuous Monitoring CA-7 (1) – Independent Assessment CA-9 – Internal System Connections

Configuration Management (CM)

CM-1 – Configuration Management Policy and Procedures CM-2 – Baseline Configuration CM-2 (1) – Reviews and updates CM-2 (3) – Retention of previous configurations CM-2 (7) – Configure systems, components, or devices for high-risk areas CM-3 – Configuration Change Control CM-4 – Security Impact Analysis CM-8 – Information System Component Inventory CM-8 (1) – Updates during installations / removals CM-8 (3) – Automated unauthorized component detection CM-8 (5) – No duplicate accounting of components

Contingency Planning (CP)

CP-1 – Contingency Planning Policy and Procedures CP-3 – Contingency Training CP-4 – Contingency Plan Testing CP-4 (1) – Coordinate with related plans

Identification and Authentication (IA)

IA-1 – Identification and Authentication Policy and Procedures IA-2 – Identification and Authentication IA-2 (11) – Remote access (i.e. requirement for multi-factor authentication) * IA-2 (12) – Acceptance of PIV credentials*

Incident Response (IR)

IR-1 – Incident Response Policy and Procedures IR-2 – Incident Response Training IR-3 – Incident Response Testing IR-3 (2) – Coordination with related plans IR-5 – Incident Monitoring (Needs to include clause in ISA for reporting incidents to the RRB)

Maintenance (MA)

MA-1 – System Maintenance Policy and Procedures

Media Protection (MP)

MP-1 – Media Protection Policy and Procedures MP-2 – Media Access* MP-3 – Media Marking* MP-4 – Media Storage* MP-5 – Media Transport* MP-6 – Media Sanitization*

Physical and Environmental Protection (PE)

PE-1 – Physical and Environmental Protection Policy and Procedures PE-6 – Monitoring Physical Access PE-6 (1) – Intrusion alarms/surveillance equipment PE-8 – Visitor Access Records

Planning (PL)

PL-1 - Security Planning Policy and Procedures PL-2 – System Security Plan (i.e. will be developed with pATO) PL-2 (3) – Plan / coordinate with other organizational entities PL-4 – Rules of Behavior (i.e. reference will be included in ISA) PL-4 (1) – Social Media and Networking restrictions (i.e. written guidance on employee use) PL-8 – Information Security Architecture (i.e. describes system)

Personnel Security (PS)

PS-1 - Personnel Security Policy and Procedures PS-6 – Access Agreements PS-7 – Third-Party Personnel Security

Risk Assessment (RA)

RA-1 – Risk Assessment Policy and Procedures RA-3 – Risk Assessment (i.e. included with pATO) RA-5 – Vulnerability Scanning (i.e. RRB expects vulnerability assessment reports of the information system on an at least quarterly frequency).

RA-5 (1) – update tool capability

System and Services Acquisition (SA)

SA-1 – System and Services Acquisition Policy and Procedures SA-2 – Allocation of Resources SA-3 – System Development Life Cycle SA-4 – Acquisition Process SA-4 (1) – Functional properties of security controls SA-4 (2) – Implementation information for security controls SA-4 (9) – Functions / ports / protocols / services in use SA-4 (10) – Use of approved PIV product SA-5 – Information System Documentation SA-8 – Security Engineering Principles SA-9 – External Information System Services SA-9 (2) – Identifications of functions / ports / protocols / services SA-10 – Developer Configuration Management SA-11 – Developer Security Testing and Evaluation

System and Communications Protection (SC)

SC-1 – System and Communications Protection Policy and Procedures SC-2 – Application Partitioning SC-39 – Process Isolation

System and Information Integrity (SI)

SI-1 – System and Information Integrity Policy and Procedures SI-4 – Information System Monitoring SI-4 (2) – Automated tools for real-time analysis SI-4 (4) – inbound and outbound communications traffic SI-4 (5) – System-generated alerts SI-5 – Security Alerts, Advisories, and Directives SI-7 – Software, Firmware, and Information Integrity SI-7 (1) – Integrity checks SI-7 (7) – Integration of detection and response SI-10 – Information Input Validation SI-16 – Memory Protection

*Additional security controls required by the RRB to ensure assurance of the security strength of the information system.

NIST 800 Special Publication 800-53A provides additional information on depth and coverage in security control assessments.

Links:

NIST 800-53 Rev 4 - http://csrc.nist.gov/publications/drafts/800-53-rev4/sp800-53-rev4-ipd.pdf NIST 800-53A Rev 1- http://csrc.nist.gov/publications/nistpubs/800-53A-rev1/sp800-53A-rev1-final.pdf NIST 800-37 Rev 1 - http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf