RRB16Q0020_A001_RMF_RFQ_Final.pdf
PDF 440 KB Posted
- Attached to
- Risk Management Framework Strategy and Related Activities -- D Federal contract opportunity
- Solicitation number
- RRB16Q0020
- Issued by
- Railroad Retirement Board
About this file
Solicitation Ammendment 1
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| RRB16Q0020_RMF_PPQ_Attachment._1.docx | DOCX document | |
| RRB16Q0020_A001_RMF_Answers_to_Potential_Offeror's_Questions_Attachment._2_Final.docx | DOCX document | |
| RRB16Q0020_RMF_PPQ_Attachment._1.docx | DOCX document | |
| RRB16Q0020_RMF_RFQ_Final.pdf |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table of Contents
Section Description Page Number
I Introduction Introduction
II Schedule of Supplies and Services Section II Continued:
III Statement of Work SOW Statement of Work
IV General Terms and Conditions RRB.A.05 A. General RRB Provision-5.Post award meeting RRB.A.01 A. General RRB Provision-1.Technical Direction RRB.A.07 A. General RRB Provision-7.The Role of Government Personnel and Responsibility for Contract Administration 52.228-5 Insurance - Work on a Government Installation (Jan 1997) RRB.B.03 B. Security Provisions-3.Additional Security Requirements RRB.B.01 B. Security Provisions-1.Security Information
NON-DISCLOSURE CERTIFICATION
52.224-1 Privacy Act Notification (Apr 1984) 52.224-2 Privacy Act (Apr 1984) 52.239-1 Privacy and Security Safeguards (AUG 1996) 52.209-5 Certification Regarding Responsibility Matters (Oct 2015) 52.209-7 Information Regarding Responsibility Matters (Jul 2013) 52.203-11 Certification And Disclosure Regarding Payments To Influence Certain Federal Transactions (Sept 2007) 52.203-12 Limitation On Payments To Influence Certain Federal Transactions (Oct 2010) 52.203-16 Preventing Personal Conflicts of Interest (Dec 2011) 52.212-3 Offeror Representations and Certifications--Commercial Items (Apr 2016) 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (Jul 2014) 52.252-1 Solicitation Provisions Incorporated by Reference (Feb 1998) 52.232-18 Availability Of Funds (Apr 1984) 52.232-19 Availability Of Funds For The Next Fiscal Year (Apr 1984) RRB.A.02 A. General RRB Provision-2.Term of Contract 52.217-8 Option to Extend Services (Nov 1999) 52.217-9 Option to Extend the Term of the Contract (Mar 2000) 52.237-3 Continuity Of Services (Jan 1991) 52.204-13 System for Award Management Maintenance (Jul 2013) RRB.A.06 A. General RRB Provision-6.Notice of Intent to Withhold Payment RRB.A.03 A. General RRB Provision-3.Billing RRB.A.13 Payment and Schedule for Invoices
V Proposal Submission Instructions 52.212-1 RRB Supplement to FAR 52.212-1 Instructions to Offerors
VI Evaluation and Award 52.212-2 RRB Supplement to FAR 52.212-2 Evaluation of Offers
VII List of Attachments
Document Number: RRB16Q0020 PROCESSED Page 2 of 60
Section I - Introduction
Introduction
A. Agency Information.
The U.S. Railroad Retirement Board (RRB) is an independent agency in the executive branch of the Federal government. The RRB’s primary function is to administer comprehensive retirement, survivor, unemployment and sickness insurance benefit programs for railroad workers and their families under the Railroad Retirement Act and the Railroad Unemployment Insurance Act. These programs provide income protection during old age in the event of disability, death, temporary unemployment, and sickness. The RRB has a long history of provid-ing excellent customer service to its annuitants and is committed to paying the right benefits to the right people, in the right amounts, in a timely manner. The RRB also administers aspects of the Medicare program and has administrative responsibilities under the Social Security Act and Internal Revenue Code. The RRB's headquar-ters (HQ) and the RRB's Office of the Inspector General are located in Chicago, IL. The RRB also provides ser-vices, in localities across the country, to large numbers of railroad workers through 53 easily accessible field of-fices.
B. Background/Requirement.
1. The Railroad Retirement Board (RRB) currently has one general support system (GSS) supporting the com-puter applications of the agency and three RRB Information Systems. The GSS is designated as the “Agency Enterprise General Information System (AEGIS)” system. The three Information Systems are the Benefits and Payments Operations System, Financial Interchange System and the Financial Management System. Using the National Institute of Standards and Technology (NIST) guidance provided in Federal Information Processing Standards (FIPS) 199 and NIST Special Publication (SP) 800-60 Rev 1, AEGIS and the three RRB information ssystems have been categorized as having the moderate level of risk for confidentiality, integrity, and availabil-ity.
2. The E-Government Act (P.L. 107-347) passed by the One Hundred and Seventh Congress and signed into law by the President in December 2002 recognized the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act, entitled the Federal Informa-tion Security Management Act of 2002 (FISMA) as amended by the Federal Information Security Moderniza-tion Act of 2014, emphasizes the need for agencies to develop, document, and implement an agency-wide pro-gram to provide information security for the information systems that support its operations and assets. The ul-timate goal of FISMA is to conduct the day-to-day operations of the agency and to accomplish the agency’s stated missions with what the Office of Management and Budget (OMB) Circular A-130 defines as adequate se-curity, or security commensurate with risk, including the magnitude of harm resulting from the unauthorized ac-cess, use, disclosure, disruption, modification, or destruction of information.
3. Risk Management Framework is a major feature of the President’s initiative to attain secure IT systems.
There are six (6) steps to the RMF process.
• Categorize Information System
• Select Security Controls
• Implement Security Controls
• Assess Security Controls
• Authorize Information System
• Monitor Security Controls
C. Objective
Document Number: RRB16Q0020 PROCESSED Page 3 of 60
The RRB is seeking contractual support to perform Risk Management Framework (RMF) services. The contrac-tual support services shall include, but not be limited to, the mandatory requirements of the NIST Special Pub-lication 800-37 Revision 1 Continuous Monitoring phase activities. RRB intends to award a firm fixed priced contract with mandatory and optional periods for this project no later than August 31, 2016.
1. Definitions
The following definitions may be useful for interpreting these attachments and other material in this solicitation package.
Applications Inventory – The Applications Inventory is the RRB’s official inventory of systems/applications by all business units and committees. It contains RRB developed applications, external applications used at the RRB and internal general support applications according to the established definitions. This inventory does not include one-time use programs/applications, business processes, business forms, or personally developed spreadsheets or databases on any individual's hard drive or share site. The inventory complies with FISMA re-quirements to create a single source of this information.
General Support System – (defined in OMB Circular A-130, Appendix III, (A)(2)(c)) An interconnected set of information resources under the same direct management control which shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people. The Gen-eral Support System for the RRB is considered to be the Agency Enterprise General Information System (AEGIS) which includes mainframe and open systems.
Information System - An application that requires special attention to security due to the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the ap-plication. Note: All Federal applications require some level of protection. Certain applications, because of the information in them, however, require special management oversight and should be treated as ma-jor. Adequate security for other applications should be provided by the security of the systems in which they op-erate. The three information systems considered for the RRB are:
• Benefits and Payments Operations System,
• Financial Interchange System,
• Financial Management System.
D. Questions pertaining to this solicitation must be submitted in writing and received by this office in sufficient time to allow the timely transmission of written answers by solicitation amendment. To ensure this, RRB will only answer questions received in this office no later than 12:00 PM CT, July 5, 2016. Questions shall be sent to: proposals@rrb.gov, with the e-mail subject line "RFQ RRB16Q0020 RMF Questions". Offers are due no later than 12:00 PM CT, July 22, 2016. Offers shall be submitted by e-mail to: proposals@rrb.gov. The email subject line shall state “RFP RRB16Q0020 RMF Proposal Submission ”.
Section II - Schedule of Supplies and Services
Number Supplies or Services Quantity Unit Unit Price Total ( Inc. disc., tax, and fees)
0001 OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 0.000000
Change: 0.000000
Current: 0.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2021
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Document Number: RRB16Q0020 PROCESSED Page 4 of 60
Number Supplies or Services Quantity Unit Unit Price Total ( Inc. disc., tax, and fees)
0001AA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for the Initial Contract Term/Base Year.
0001AB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for the Initial Contract Term/Base Year.
0001AC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for the Initial Contract Term/Base Year.
0001AD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for the Initial Contract Term/Base Year.
0001BA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for
OPTION YEAR ONE (1).
Document Number: RRB16Q0020 PROCESSED Page 5 of 60
0001BB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for OPTION YEAR ONE (1).
0001BC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for OPTION YEAR ONE (1).
0001BD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 09/30/2017 - 09/30/2018
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for OPTION YEAR ONE (1).
0001CA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for
OPTION YEAR TWO (2).
0001CB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for OPTION YEAR TWO (2).
Document Number: RRB16Q0020 PROCESSED Page 6 of 60
0001CC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for OPTION YEAR TWO (2).
0001CD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 09/30/2018 - 09/30/2019
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for OPTION YEAR TWO (2).
0001DA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for
OPTION YEAR THREE (3).
0001DB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for OPTION YEAR THREE (3).
0001DC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for OPTION YEAR THREE (3).
Document Number: RRB16Q0020 PROCESSED Page 7 of 60
0001DD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 09/30/2019 - 09/30/2020
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for OPTION YEAR THREE (3).
0001EA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for
OPTION YEAR FOUR (4).
0001EB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for OPTION YEAR FOUR (4).
0001EC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for OPTION YEAR FOUR (4).
0001ED OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 09/30/2019 - 09/30/2020
Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for OPTION YEAR FOUR (4).
0002 OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 0.000000
Change: 0.000000
Current: 0.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2021
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Document Number: RRB16Q0020 PROCESSED Page 8 of 60
0002AA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for the Initial Contract Term/Base Year Services.
0002AB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for the Initial Contract Term/Base Year Services.
0002AC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for the Initial Contract Term/Base Year Services.
0002AD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for the Initial Contract Term/Base Year Services.
0002BA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for OPTION YEAR ONE (1).
Document Number: RRB16Q0020 PROCESSED Page 9 of 60
0002BB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for OPTION YEAR ONE (1).
0002BC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for OPTION YEAR ONE (1).
0002BD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for OPTION YEAR ONE (1).
0002CA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for OPTION YEAR TWO (2).
0002CB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for OPTION YEAR TWO (2).
Document Number: RRB16Q0020 PROCESSED Page 10 of 60
0002CC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for OPTION YEAR TWO (2).
0002CD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for OPTION YEAR TWO (2).
0002DA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for OPTION YEAR THREE (3).
0002DB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for OPTION YEAR THREE (3).
0002DC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for OPTION YEAR THREE (3).
Document Number: RRB16Q0020 PROCESSED Page 11 of 60
0002DD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for OPTION YEAR THREE (3).
0002EA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for OPTION YEAR FOUR (4).
0002EB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for OPTION YEAR FOUR (4).
0002EC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for OPTION YEAR FOUR (4).
0002ED OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for OPTION YEAR FOUR (4).
Document Number: RRB16Q0020 PROCESSED Page 12 of 60
0003 OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 0.000000
Change: 0.000000
Current: 0.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2021
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
0003AA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for the Initial Contract Term/Base Year Services.
0003AB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for the Initial Contract Term/Base Year Services.
0003AC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for the Initial Contract Term/Base Year Services.
0003AD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2016 - 09/30/2017
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for the Initial Contract Term/Base Year Services.
Document Number: RRB16Q0020 PROCESSED Page 13 of 60
0003BA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for OPTION YEAR ONE (1).
0003BB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for OPTION YEAR ONE (1).
0003BC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for OPTION YEAR ONE (1).
0003BD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2017 - 09/30/2018
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for OPTION YEAR ONE (1).
0003CA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for OPTION YEAR TWO (2).
0003CB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Document Number: RRB16Q0020 PROCESSED Page 14 of 60
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for OPTION YEAR TWO (2).
0003CC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for OPTION YEAR TWO(2).
0003CD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2018 - 09/30/2019
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for OPTION YEAR TWO(2).
0003DA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for OPTION YEAR THREE (3).
0003DB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for OPTION YEAR THREE (3).
Document Number: RRB16Q0020 PROCESSED Page 15 of 60
0003DC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for OPTION YEAR THREE (3).
0003DD OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2019 - 09/30/2020
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for OPTION YEAR THREE (3).
0003EA OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for OPTION YEAR FOUR (4).
0003EB OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for OPTION YEAR FOUR (4).
0003EC OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for OPTION YEAR FOUR (4).
0003ED OTHER IT AND TELECOMMUNICATIONS
SERVICES
Original: 1.000000
Change: 0.000000
Document Number: RRB16Q0020 PROCESSED Page 16 of 60
Current: 1.000000 JOB
Period of Performance: 10/01/2020 - 09/30/2021
Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.
Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for OPTION YEAR FOUR (4).
Section II Continued:
A. Offerors shall provide in the CLINs above, the offered Firm Fixed-Pricing (FFP) for the requested RMF CLINS 0001 thru 0003, and their sub-CLINs. The offered FFP rate, for the services above, shall be “fully loaded” for the services described in Section III. The RRB describes “fully loaded” as the price inclusive of direct wage, fringe benefits, all overheads, general and administrative (G&A) cost, profit and fees, and all travel and per diem costs, (per current GSA federal per diem rates), for the Contractor’s employees to perform the required services as stated in Section III. Offerors must also complete Sections II.D & E, below.
B. Offerors shall, based on their knowledge in provideing Risk Management Framework Strategy Services (RMF), also provide the following additional pricing information as an attachment to their proposal, with the following price break down for each pro-posed CLIN and sub-CLIN's firm-fixed price:
1. Proposed labor skill levels or categories,
2. Proposed unit pricing per labor skill level or category,
3. Number of hours for each labor skill level or category, and
4. Proposed number of staff per labor skill level or category.
C. Unbalanced offers: Offerors are cautioned that any offer may be rejected as nonresponsive if it is materially unbalanced as to prices for the initial and optional services. An offer is considered unbalanced when it is based on prices that are significantly less than cost for some work and prices that are significantly overstated for other work. Offerors must complete all pricing CLINs and sub-CLINs in-dicated in the above Schedule of Supplies and Services. Offers received with incomplete pricing schedules may be deemed non-responsive, and not further evaluated.
D. Price quotation is valid thru __________ / __________ 2016. (60 days from the date of offer, unless otherwise stated).
E. CONTRACTOR INFORMATION FOR ORDER ADMINISTRATION.
Order Address: ________________________________
Business Size: ________________________________
Federal Tax Id. No: ________________________________ Submit on an IRS Form W9 with offer.
DUNs No: ________________________________
Remit Address: ________________________________
Authorized Representatives:
Business: Technical:
Document Number: RRB16Q0020 PROCESSED Page 17 of 60
Name: __________________ ___________________
Phone: __________________ ___________________
Fax: __________________ ___________________
E-Mail: __________________ ___________________
System for Award Management (SAM) Completed: Yes [] No [].
* Offeror must be properly registered, including business size annotation, in SAM to be eligible for award of a Federal contract or or-der. (See www.sam.gov) and (FAR 52.204-13, SAM registration and Maintenance)
PERIOD OF PERFORMANCE
ITEM START END
0001 10/01/2016 09/30/2021
0001 AA 10/01/2016 09/30/2017
0001 AB 10/01/2016 09/30/2017
0001 AC 10/01/2016 09/30/2017
0001 AD 10/01/2016 09/30/2017
0001 BA 10/01/2017 09/30/2018
0001 BB 10/01/2017 09/30/2018
0001 BC 10/01/2017 09/30/2018
0001 BD 09/30/2017 09/30/2018
0001 CA 10/01/2018 09/30/2019
0001 CB 10/01/2018 09/30/2019
0001 CC 10/01/2018 09/30/2019
0001 CD 09/30/2018 09/30/2019
0001 DA 10/01/2019 09/30/2020
0001 DB 10/01/2019 09/30/2020
0001 DC 10/01/2019 09/30/2020
0001 DD 09/30/2019 09/30/2020
0001 EA 10/01/2020 09/30/2021
0001 EB 10/01/2019 09/30/2020
0001 EC 10/01/2019 09/30/2020
0001 ED 09/30/2019 09/30/2020
0002 10/01/2016 09/30/2021
0002 AA 10/01/2016 09/30/2017
0002 AB 10/01/2016 09/30/2017
0002 AC 10/01/2016 09/30/2017
0002 AD 10/01/2016 09/30/2017
0002 BA 10/01/2017 09/30/2018
0002 BB 10/01/2017 09/30/2018
0002 BC 10/01/2017 09/30/2018
0002 BD 10/01/2017 09/30/2018
Document Number: RRB16Q0020 PROCESSED Page 18 of 60
0002 CA 10/01/2018 09/30/2019
0002 CB 10/01/2018 09/30/2019
0002 CC 10/01/2018 09/30/2019
0002 CD 10/01/2018 09/30/2019
0002 DA 10/01/2019 09/30/2020
0002 DB 10/01/2019 09/30/2020
0002 DC 10/01/2019 09/30/2020
0002 DD 10/01/2019 09/30/2020
0002 EA 10/01/2020 09/30/2021
0002 EB 10/01/2020 09/30/2021
0002 EC 10/01/2020 09/30/2021
0002 ED 10/01/2020 09/30/2021
0003 10/01/2016 09/30/2021
0003 AA 10/01/2016 09/30/2017
0003 AB 10/01/2016 09/30/2017
0003 AC 10/01/2016 09/30/2017
0003 AD 10/01/2016 09/30/2017
0003 BA 10/01/2017 09/30/2018
0003 BB 10/01/2017 09/30/2018
0003 BC 10/01/2017 09/30/2018
0003 BD 10/01/2017 09/30/2018
0003 CA 10/01/2018 09/30/2019
0003 CB 10/01/2018 09/30/2019
0003 CC 10/01/2018 09/30/2019
0003 CD 10/01/2018 09/30/2019
0003 DA 10/01/2019 09/30/2020
0003 DB 10/01/2019 09/30/2020
0003 DC 10/01/2019 09/30/2020
0003 DD 10/01/2019 09/30/2020
0003 EA 10/01/2020 09/30/2021
0003 EB 10/01/2020 09/30/2021
0003 EC 10/01/2020 09/30/2021
0003 ED 10/01/2020 09/30/2021
Section III - Statement of Work
SOW Statement of Work
Introduction
The Contractor is required to identify with all current, as revised, National Institute of Standards and Technology (NIST), Federal In-formation Processing Standards (FIPS), Office of Management and Budget (OMB) circulars/memorandums, other Government-wide laws and regulations, and requirements for protection and security of Information Technology, apply their work accordingly, and be prepared to crosswalk their work to that guidance, and to demonstrate the their completed work products do comply.
Document Number: RRB16Q0020 PROCESSED Page 19 of 60
The deliverables will be reviewed on a yearly basis. The deliverables are subjected to change and the contactor is liable to adhere to any changes made by NIST guidance or the RRB’s environment shall be adhered to by the contractor at any given phase of the project. Additionally, if these changes cause a delay in completing the deliverable the contactor must submit in writing a justification to delay the project. The document must outline the estimated time of delay, cost, or any adverse changes. Each new change will be approved by an RRB representative in advance.
The work may involve interviewing the RRB activity staff, facilities security and management staff, application system support ser-vice providers, infrastructure support staff, application systems owners and users, business process managers, and security support personnel. The work may involve reviewing and updating existing RRB documents and preparing new documents such as, but not limited to, security plans, application system input and output documents, C&A packages, user guides, operational procedures, histor-ical logs and mission statements. At all times the service provider shall comply with existing FISMA related authorities or direction from OMB, existing and draft Federal guidelines and standards from NIST, and commercial best practices. The Contractor shall de-velop a thorough familiarization with the ordering activity’s mission and the role each asset plays in the support of that mission.
The contractor has the obligation to report within 48 hours of any change or delay in the project via normal communications (i.e.
phone, email, in writing).
This section describes requirements for providing RMF services for RRB Information Systems subject to the FISMA. The service provider shall follow NIST requirements for all Federal information systems other than those systems designated as national security systems as defined in 44 U.S.C., Section 3542.9. The tasks described in this section are in alignment with the six steps outlined in NIST SP 800-37 Rev. 1, “Guideline for Applying the Risk Management Framework to Federal Information Systems, A Security Life Cycle Approach.”
The contractor will continue to implement the RRB’s existing RMF strategy effort that is in place and outlined in the RRB Informa-tion Security Policy (Administrative Circular IRM-18). A copy of all of the RRB Information Systems as well the AEGIS General Support System RMF documentation will be provided to the contractor to ensure that the full scope of work is obtained.
The Contractor shall follow the Issue Resolution Process for any identified vulnerability or issue identified throughout the Risk Man-agement Framework. The Issue Resolution Procedure is used to communicate issues to key stakeholders and document risk-based de-cisions to include risk acceptance, recommend corrective actions to mitigate vulnerabilities and provide retesting solutions, or creating a Plan of Action and Milestones (POA&M), An issue Resolution Report provide an audit trail, accelerates the RMF strategy, and doc-uments management accountability.
A. Gap Analysis
The Contractor shall perform a gap analysis of all of the RRB Information systems to confirm that the security categorization has been completed and is appropriate and that the requisite security controls have been selected and allocated. Applying the gap analysis will determine if the necessary and sufficient security controls (i.e., system-specific, hybrid, and common controls) have been appropri-ately selected and allocated. The following tasks shall be completed in the gap analysis process:
1. The contractor shall perform gap analysis of RRB Information System risk assessments for each information system or general sup-port system on a yearly basis or as needed and requested by the RRB.
a. Update all risk assessments on RRB Information Systems.
Preparation:
• Review existing RRB system security documentation (e.g., security plan, system design documentation, FIPS 199 Security Categor-ization, past security assessments, etc.)
• Review RRB’s existing audit and configuration files, and Vulnerability Assessment Report to certify that RRB’s audit reports do not alter from the recommendation compliance standards (i.e. USGCB).
• Schedule meeting with the RRB key stakeholders (e.g., System Owner, Authorizing Official, Data/Information Owner, Information System Security Officer, Senior Agency Information Security Officer, etc.) to conduct risk assessment. This meeting should also in-volve RRB system administrators, users, etc. if applicable.
b. Update Risk Assessment of RRB Information Systems:
• Discuss with RRB staff and record potential threats (human intentional/unintentional, natural, and environmental) to the information system. A threat is the potential for a particular threat-source to successfully exploit a particular vulnerability. A threat source does
Document Number: RRB16Q0020 PROCESSED Page 20 of 60 not present risk when there is no vulnerability. Simplified: Who or what is capable of harming the system?
• Discuss with RRB staff and record any flaws or weaknesses in the supporting controls or information system that could be exploited by potential threat sources. A flaw or weakness in the system may include security procedures, design, implementation, or internal controls that could be accidentally triggered or intentionally exploited.
• Discuss with RRB staff and record implemented or existing security controls (technical and non-technical) that help mitigate the risk of an identified vulnerability. Simplified: What is in place to prevent the threat from exploiting vulnerability?
• Discuss with RRB staff and record the likelihood or probability of a threat-source exploiting vulnerability. This should be completed for all identified vulnerabilities. Likelihood indicates the probability (Low, Medium, High) of a threat-source acting on a potential vulnerability. When determining the likelihood, consider the motivation and capability of the threat source, nature of the vulnerabil-ity, and the existence and effectiveness of current controls.
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .