RRB16Q0020_RMF_RFQ_Final.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24 & 30

1. REQUISITION NUMBER

5. SOLICITATION NUMBER

RRB16Q0020

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER 6. SOLICITATION ISSUE

DATE

06/28/2016

7. FOR SOLICITATION INFORMATION

CALL:

a. NAME Richard Ball (richard.ball@rrb.gov)

b. TELEPHONE NUMBER (No collect calls) 312-751-4510

8. OFFER DUE DATE / LOCAL

TIME

07/20/2016 12:00:00

CODE ACQMGMT

U.S. Railroad Retirement Board Acquisition Management 844 N. Rush St.

Chicago, IL 60611

9. ISSUED BY UNRESTRICTED OR X SET ASIDE: % FOR

X SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS: 541519

SIZE STANDARD: $27,500,000

10. THE ACQUISITION IS

SEE

SCHEDULE

11. DELIVERY FOR FOB DESTINATION

UNLESS BLOCK IS MARKED 0 Days: 0.00 %

0 Days: 0.00 % 0 Days: 0.00 % 0 Days: 0.00 %

12. DISCOUNT TERMS

13a. THIS CONTRACT IS

RATED ORDER UNDER DPAS

13b. RATING

X RFQ IFB RFP

14. METHOD OF SOLICITATION

091CODE15. DELIVER TO

U.S. RAILROAD RETIREMENT BOARD

BUREAU OF INFORMATION SYSTEMS

844 N RUSH ST., 3RD FL.

CHICAGO, IL 60611

CODE 03916. ADMINISTERED BY

U.S.RAILROAD RETIREMENT BOARD

ACQUISITION MANAGEMENT

844 N. RUSH ST., 9TH FL.

CHICAGO, IL 60611

FACILITY

CODE

CODE

Telephone No.

17a. CONTRACTOR/

OFFEROR

CODE18a. PAYMENT WILL BE MADE BY

U.S. RAILROAD RETIREMENT BOARD

FISCAL OPERATIONS

844 N RUSH ST., 5TH FLOOR

CHICAGO, IL 60611

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER SEE ADDENDUM

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS

CHECKED

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/SERVICES

(Use Reverse and/or Attach Additional Sheets as Necessary)

21. QUANTITY 22. UNIT 23. UNIT PRICE 24. AMOUNT

See Lines

25. ACCOUNTING AND APPROPRIATION DATA

See Line Item Detail

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

X 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4, FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE X ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4, 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

X 28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 1 COPIES TO

ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH

OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT TO THE

TERMS AND CONDITIONS SPECIFIED.

29. AWARD OF CONTRACT: REF. _____________________________ OFFER

DATED _________________ . YOUR OFFER ON SOLICITATION (BLOCK 5)

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH HEREIN,

IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF THE CONTRACTING OFFICER (TYPE OR PRINT) Paul T. Ahern

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 02/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

Document Number: RRB16Q0020 PROCESSED Page 1 of 59

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: _________________________________

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

PARTIAL FINAL

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

COMPLETE PARTIAL FINAL

36. PAYMENT 37. CHECK NUMBER

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print)

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 02/2012) BACK

Document Number: RRB16Q0020 PROCESSED Page 2 of 59

Table of Contents

Section Description Page Number

I Introduction Introduction

II Schedule of Supplies and Services Section II Continued:

III Statement of Work SOW Statement of Work

IV General Terms and Conditions RRB.A.05 A. General RRB Provision-5.Post award meeting RRB.A.01 A. General RRB Provision-1.Technical Direction RRB.A.07 A. General RRB Provision-7.The Role of Government Personnel and Responsibility for Contract Administration 52.228-5 Insurance - Work on a Government Installation (Jan 1997) RRB.B.03 B. Security Provisions-3.Additional Security Requirements RRB.B.01 B. Security Provisions-1.Security Information

NON-DISCLOSURE CERTIFICATION

52.224-1 Privacy Act Notification (Apr 1984) 52.224-2 Privacy Act (Apr 1984) 52.239-1 Privacy and Security Safeguards (AUG 1996) 52.209-5 Certification Regarding Responsibility Matters (Oct 2015) 52.209-7 Information Regarding Responsibility Matters (Jul 2013) 52.203-11 Certification And Disclosure Regarding Payments To Influence Certain Federal Transactions (Sept 2007) 52.203-12 Limitation On Payments To Influence Certain Federal Transactions (Oct 2010) 52.203-16 Preventing Personal Conflicts of Interest (Dec 2011) 52.212-3 Offeror Representations and Certifications--Commercial Items (Apr 2016) 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (Jul 2014) 52.252-1 Solicitation Provisions Incorporated by Reference (Feb 1998) 52.232-18 Availability Of Funds (Apr 1984) 52.232-19 Availability Of Funds For The Next Fiscal Year (Apr 1984) RRB.A.02 A. General RRB Provision-2.Term of Contract 52.217-8 Option to Extend Services (Nov 1999) 52.217-9 Option to Extend the Term of the Contract (Mar 2000) 52.237-3 Continuity Of Services (Jan 1991) 52.204-13 System for Award Management Maintenance (Jul 2013) RRB.A.06 A. General RRB Provision-6.Notice of Intent to Withhold Payment RRB.A.03 A. General RRB Provision-3.Billing RRB.A.13 Payment and Schedule for Invoices

V Proposal Submission Instructions 52.212-1 RRB Supplement to FAR 52.212-1 Instructions to Offerors

VI Evaluation and Award 52.212-2 RRB Supplement to FAR 52.212-2 Evaluation of Offers

VII List of Attachments

Document Number: RRB16Q0020 PROCESSED Page 3 of 59

Section I - Introduction

Introduction

A. Agency Information.

The U.S. Railroad Retirement Board (RRB) is an independent agency in the executive branch of the Federal government. The RRB’s primary function is to administer comprehensive retirement, survivor, unemployment and sickness insurance benefit programs for railroad workers and their families under the Railroad Retirement Act and the Railroad Unemployment Insurance Act. These programs provide income protection during old age in the event of disability, death, temporary unemployment, and sickness. The RRB has a long history of provid-ing excellent customer service to its annuitants and is committed to paying the right benefits to the right people, in the right amounts, in a timely manner. The RRB also administers aspects of the Medicare program and has administrative responsibilities under the Social Security Act and Internal Revenue Code. The RRB's headquar-ters (HQ) and the RRB's Office of the Inspector General are located in Chicago, IL. The RRB also provides ser-vices, in localities across the country, to large numbers of railroad workers through 53 easily accessible field of-fices.

B. Background/Requirement.

1. The Railroad Retirement Board (RRB) currently has one general support system (GSS) supporting the com-puter applications of the agency and three RRB Information Systems. The GSS is designated as the “Agency Enterprise General Information System (AEGIS)” system. The three Information Systems are the Benefits and Payments Operations System, Financial Interchange System and the Financial Management System. Using the National Institute of Standards and Technology (NIST) guidance provided in Federal Information Processing Standards (FIPS) 199 and NIST Special Publication (SP) 800-60 Rev 1, AEGIS and the three RRB information ssystems have been categorized as having the moderate level of risk for confidentiality, integrity, and availabil-ity.

2. The E-Government Act (P.L. 107-347) passed by the One Hundred and Seventh Congress and signed into law by the President in December 2002 recognized the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act, entitled the Federal Informa-tion Security Management Act of 2002 (FISMA) as amended by the Federal Information Security Moderniza-tion Act of 2014, emphasizes the need for agencies to develop, document, and implement an agency-wide pro-gram to provide information security for the information systems that support its operations and assets. The ul-timate goal of FISMA is to conduct the day-to-day operations of the agency and to accomplish the agency’s stated missions with what the Office of Management and Budget (OMB) Circular A-130 defines as adequate se-curity, or security commensurate with risk, including the magnitude of harm resulting from the unauthorized ac-cess, use, disclosure, disruption, modification, or destruction of information.

3. Risk Management Framework is a major feature of the President’s initiative to attain secure IT systems.

There are six (6) steps to the RMF process.

• Categorize Information System

• Select Security Controls

• Implement Security Controls

• Assess Security Controls

• Authorize Information System

• Monitor Security Controls

C. Objective

Document Number: RRB16Q0020 PROCESSED Page 4 of 59

The RRB is seeking contractual support to perform Risk Management Framework (RMF) services. The contrac-tual support services shall include, but not be limited to, the mandatory requirements of the NIST Special Pub-lication 800-37 Revision 1 Continuous Monitoring phase activities. RRB intends to award a firm fixed priced contract with mandatory and optional periods for this project no later than August 31, 2016.

1. Definitions

The following definitions may be useful for interpreting these attachments and other material in this solicitation package.

Applications Inventory – The Applications Inventory is the RRB’s official inventory of systems/applications by all business units and committees. It contains RRB developed applications, external applications used at the RRB and internal general support applications according to the established definitions. This inventory does not include one-time use programs/applications, business processes, business forms, or personally developed spreadsheets or databases on any individual's hard drive or share site. The inventory complies with FISMA re-quirements to create a single source of this information.

General Support System – (defined in OMB Circular A-130, Appendix III, (A)(2)(c)) An interconnected set of information resources under the same direct management control which shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people. The Gen-eral Support System for the RRB is considered to be the Agency Enterprise General Information System (AEGIS) which includes mainframe and open systems.

Information System - An application that requires special attention to security due to the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the ap-plication. Note: All Federal applications require some level of protection. Certain applications, because of the information in them, however, require special management oversight and should be treated as ma-jor. Adequate security for other applications should be provided by the security of the systems in which they op-erate. The three information systems considered for the RRB are:

• Benefits and Payments Operations System,

• Financial Interchange System,

• Financial Management System.

D. Questions pertaining to this solicitation must be submitted in writing and received by this office in sufficient time to allow the timely transmission of written answers by solicitation amendment. To ensure this, RRB will only answer questions received in this office no later than 12:00 PM CT, July 5, 2016. Questions shall be sent to: proposals@rrb.gov, with the e-mail subject line "RFQ RRB16Q0020 RMF Questions". Offers are due no later than 12:00 PM CT, July 20, 2016. Offers shall be submitted by e-mail to: proposals@rrb.gov. The email subject line shall state “RFP RRB16Q0020 RMF Proposal Submission ”.

Section II - Schedule of Supplies and Services

Number Supplies or Services Quantity Unit Unit Price Total ( Inc. disc., tax, and fees)

0001 OTHER IT AND TELECOMMUNICATIONS

SERVICES

0.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2021

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

0001AA OTHER IT AND TELECOMMUNICATIONS 1.000000 JOB

Document Number: RRB16Q0020 PROCESSED Page 5 of 59

Number Supplies or Services Quantity Unit Unit Price Total ( Inc. disc., tax, and fees)

SERVICES

Period of Performance: 10/01/2016 - 09/30/2017

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for the Initial Contract Term/Base Year.

0001AB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for the Initial Contract Term/Base Year.

0001AC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for the Initial Contract Term/Base Year.

0001AD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for the Initial Contract Term/Base Year.

0001BA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for

OPTION YEAR ONE (1).

0001BB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for OPTION YEAR ONE (1).

0001BC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for OPTION YEAR ONE (1).

0001BD OTHER IT AND TELECOMMUNICATIONS 1.000000 JOB

Document Number: RRB16Q0020 PROCESSED Page 6 of 59

SERVICES

Period of Performance: 09/30/2017 - 09/30/2018

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for OPTION YEAR ONE (1).

0001CA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for

OPTION YEAR TWO (2).

0001CB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for OPTION YEAR TWO (2).

0001CC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for OPTION YEAR TWO (2).

0001CD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 09/30/2018 - 09/30/2019

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for OPTION YEAR TWO (2).

0001DA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for

OPTION YEAR THREE (3).

0001DB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for OPTION YEAR THREE (3).

0001DC OTHER IT AND TELECOMMUNICATIONS 1.000000 JOB

Document Number: RRB16Q0020 PROCESSED Page 7 of 59

SERVICES

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for OPTION YEAR THREE (3).

0001DD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 09/30/2019 - 09/30/2020

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for OPTION YEAR THREE (3).

0001EA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Aegis System, for

OPTION YEAR FOUR (4).

0001EB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Benefit & Payment Operations System, for OPTION YEAR FOUR (4).

0001EC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Interchange System, for OPTION YEAR FOUR (4).

0001ED OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 09/30/2019 - 09/30/2020

Description: Risk Management Framework (RMF) Gap Analysis Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of RMF Gap Analysis Services, for Financial Management System, for OPTION YEAR FOUR (4).

0002 OTHER IT AND TELECOMMUNICATIONS

SERVICES

0.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2021

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Document Number: RRB16Q0020 PROCESSED Page 8 of 59

0002AA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for the Initial Contract Term/Base Year Services.

0002AB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for the Initial Contract Term/Base Year Services.

0002AC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for the Initial Contract Term/Base Year Services.

0002AD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for the Initial Contract Term/Base Year Services.

0002BA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for OPTION YEAR ONE (1).

0002BB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for OPTION YEAR ONE (1).

0002BC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for OPTION YEAR ONE (1).

Document Number: RRB16Q0020 PROCESSED Page 9 of 59

0002BD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for OPTION YEAR ONE (1).

0002CA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for OPTION YEAR TWO (2).

0002CB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for OPTION YEAR TWO (2).

0002CC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for OPTION YEAR TWO (2).

0002CD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for OPTION YEAR TWO (2).

0002DA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for OPTION YEAR THREE (3).

0002DB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for OPTION YEAR THREE (3).

Document Number: RRB16Q0020 PROCESSED Page 10 of 59

0002DC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for OPTION YEAR THREE (3).

0002DD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for OPTION YEAR THREE (3).

0002EA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Aegis System, for OPTION YEAR FOUR (4).

0002EB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Benefit & Payment Operations System, for OPTION YEAR FOUR (4).

0002EC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Interchange System, for OPTION YEAR FOUR (4).

0002ED OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: Risk Management Framework (RMF), Continuous Monitoring, Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Risk Management Framework (RMF), Continuous Monitoring Services for Financial Management System, for OPTION YEAR FOUR (4).

0003 OTHER IT AND TELECOMMUNICATIONS

SERVICES

0.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2021

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Document Number: RRB16Q0020 PROCESSED Page 11 of 59

0003AA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for the Initial Contract Term/Base Year Services.

0003AB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for the Initial Contract Term/Base Year Services.

0003AC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for the Initial Contract Term/Base Year Services.

0003AD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2016 - 09/30/2017

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for the Initial Contract Term/Base Year Services.

0003BA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for OPTION YEAR ONE (1).

0003BB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for OPTION YEAR ONE (1).

Document Number: RRB16Q0020 PROCESSED Page 12 of 59

0003BC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for OPTION YEAR ONE (1).

0003BD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2017 - 09/30/2018

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for OPTION YEAR ONE (1).

0003CA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for OPTION YEAR TWO (2).

0003CB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for OPTION YEAR TWO (2).

0003CC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for OPTION YEAR TWO(2).

0003CD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2018 - 09/30/2019

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for OPTION YEAR TWO(2).

Document Number: RRB16Q0020 PROCESSED Page 13 of 59

0003DA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for OPTION YEAR THREE (3).

0003DB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for OPTION YEAR THREE (3).

0003DC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for OPTION YEAR THREE (3).

0003DD OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2019 - 09/30/2020

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for OPTION YEAR THREE (3).

0003EA OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Aegis System, for OPTION YEAR FOUR (4).

0003EB OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Benefit & Payment Operations System, for OPTION YEAR FOUR (4).

Document Number: RRB16Q0020 PROCESSED Page 14 of 59

0003EC OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Interchange System, for OPTION YEAR FOUR (4).

0003ED OTHER IT AND TELECOMMUNICATIONS

SERVICES

1.000000 JOB

Period of Performance: 10/01/2020 - 09/30/2021

Description: OPTIONAL Risk Management Framework (RMF), Full Recertification & Accreditation Services, see Section III - Statement of Work, SOW.

Offerors shall enter, in the space above, the firm fixed price for the provision of Optional Risk Management Framework (RMF) Recertification & Accreditation Services for Financial Management System, for OPTION YEAR FOUR (4).

Section II Continued:

A. Offerors shall provide in the CLINs above, the offered Firm Fixed-Pricing (FFP) for the requested RMF CLINS 0001 thru 0003, and their sub-CLINs. The offered FFP rate, for the services above, shall be “fully loaded” for the services described in Section III. The RRB describes “fully loaded” as the price inclusive of direct wage, fringe benefits, all overheads, general and administrative (G&A) cost, profit and fees, and all travel and per diem costs, (per current GSA federal per diem rates), for the Contractor’s employees to perform the required services as stated in Section III. Offerors must also complete Sections II.D & E, below.

B. Offerors shall, based on their knowledge in provideing Risk Management Framework Strategy Services (RMF), also provide the following additional pricing information as an attachment to their proposal, with the following price break down for each pro-posed CLIN and sub-CLIN's firm-fixed price:

1. Proposed labor skill levels or categories,

2. Proposed unit pricing per labor skill level or category,

3. Number of hours for each labor skill level or category, and

4. Proposed number of staff per labor skill level or category.

C. Unbalanced offers: Offerors are cautioned that any offer may be rejected as nonresponsive if it is materially unbalanced as to prices for the initial and optional services. An offer is considered unbalanced when it is based on prices that are significantly less than cost for some work and prices that are significantly overstated for other work. Offerors must complete all pricing CLINs and sub-CLINs in-dicated in the above Schedule of Supplies and Services. Offers received with incomplete pricing schedules may be deemed non-responsive, and not further evaluated.

D. Price quotation is valid thru __________ / __________ 2016. (60 days from the date of offer, unless otherwise stated).

E. CONTRACTOR INFORMATION FOR ORDER ADMINISTRATION.

Order Address: ________________________________

Business Size: ________________________________

Federal Tax Id. No: ________________________________ Submit on an IRS Form W9 with offer.

DUNs No: ________________________________

Document Number: RRB16Q0020 PROCESSED Page 15 of 59

Remit Address: ________________________________

Authorized Representatives:

Business: Technical:

Name: __________________ ___________________

Phone: __________________ ___________________

Fax: __________________ ___________________

E-Mail: __________________ ___________________

System for Award Management (SAM) Completed: Yes [] No [].

* Offeror must be properly registered, including business size annotation, in SAM to be eligible for award of a Federal contract or or-der. (See www.sam.gov) and (FAR 52.204-13, SAM registration and Maintenance)

PERIOD OF PERFORMANCE

ITEM START END

0001 10/01/2016 09/30/2021

0001 AA 10/01/2016 09/30/2017

0001 AB 10/01/2016 09/30/2017

0001 AC 10/01/2016 09/30/2017

0001 AD 10/01/2016 09/30/2017

0001 BA 10/01/2017 09/30/2018

0001 BB 10/01/2017 09/30/2018

0001 BC 10/01/2017 09/30/2018

0001 BD 09/30/2017 09/30/2018

0001 CA 10/01/2018 09/30/2019

0001 CB 10/01/2018 09/30/2019

0001 CC 10/01/2018 09/30/2019

0001 CD 09/30/2018 09/30/2019

0001 DA 10/01/2019 09/30/2020

0001 DB 10/01/2019 09/30/2020

0001 DC 10/01/2019 09/30/2020

0001 DD 09/30/2019 09/30/2020

0001 EA 10/01/2020 09/30/2021

0001 EB 10/01/2019 09/30/2020

0001 EC 10/01/2019 09/30/2020

0001 ED 09/30/2019 09/30/2020

0002 10/01/2016 09/30/2021

0002 AA 10/01/2016 09/30/2017

Document Number: RRB16Q0020 PROCESSED Page 16 of 59

0002 AB 10/01/2016 09/30/2017

0002 AC 10/01/2016 09/30/2017

0002 AD 10/01/2016 09/30/2017

0002 BA 10/01/2017 09/30/2018

0002 BB 10/01/2017 09/30/2018

0002 BC 10/01/2017 09/30/2018

0002 BD 10/01/2017 09/30/2018

0002 CA 10/01/2018 09/30/2019

0002 CB 10/01/2018 09/30/2019

0002 CC 10/01/2018 09/30/2019

0002 CD 10/01/2018 09/30/2019

0002 DA 10/01/2019 09/30/2020

0002 DB 10/01/2019 09/30/2020

0002 DC 10/01/2019 09/30/2020

0002 DD 10/01/2019 09/30/2020

0002 EA 10/01/2020 09/30/2021

0002 EB 10/01/2020 09/30/2021

0002 EC 10/01/2020 09/30/2021

0002 ED 10/01/2020 09/30/2021

0003 10/01/2016 09/30/2021

0003 AA 10/01/2016 09/30/2017

0003 AB 10/01/2016 09/30/2017

0003 AC 10/01/2016 09/30/2017

0003 AD 10/01/2016 09/30/2017

0003 BA 10/01/2017 09/30/2018

0003 BB 10/01/2017 09/30/2018

0003 BC 10/01/2017 09/30/2018

0003 BD 10/01/2017 09/30/2018

0003 CA 10/01/2018 09/30/2019

0003 CB 10/01/2018 09/30/2019

0003 CC 10/01/2018 09/30/2019

0003 CD 10/01/2018 09/30/2019

0003 DA 10/01/2019 09/30/2020

0003 DB 10/01/2019 09/30/2020

0003 DC 10/01/2019 09/30/2020

0003 DD 10/01/2019 09/30/2020

0003 EA 10/01/2020 09/30/2021

0003 EB 10/01/2020 09/30/2021

0003 EC 10/01/2020 09/30/2021

0003 ED 10/01/2020 09/30/2021

Document Number: RRB16Q0020 PROCESSED Page 17 of 59

Section III - Statement of Work

SOW Statement of Work

Introduction

The Contractor is required to identify with all current, as revised, National Institute of Standards and Technology (NIST), Federal In-formation Processing Standards (FIPS), Office of Management and Budget (OMB) circulars/memorandums, other Government-wide laws and regulations, and requirements for protection and security of Information Technology, apply their work accordingly, and be prepared to crosswalk their work to that guidance, and to demonstrate the their completed work products do comply.

The deliverables will be reviewed on a yearly basis. The deliverables are subjected to change and the contactor is liable to adhere to any changes made by NIST guidance or the RRB’s environment shall be adhered to by the contractor at any given phase of the project. Additionally, if these changes cause a delay in completing the deliverable the contactor must submit in writing a justification to delay the project. The document must outline the estimated time of delay, cost, or any adverse changes. Each new change will be approved by an RRB representative in advance.

The work may involve interviewing the RRB activity staff, facilities security and management staff, application system support ser-vice providers, infrastructure support staff, application systems owners and users, business process managers, and security support personnel. The work may involve reviewing and updating existing RRB documents and preparing new documents such as, but not limited to, security plans, application system input and output documents, C&A packages, user guides, operational procedures, histor-ical logs and mission statements. At all times the service provider shall comply with existing FISMA related authorities or direction from OMB, existing and draft Federal guidelines and standards from NIST, and commercial best practices. The Contractor shall de-velop a thorough familiarization with the ordering activity’s mission and the role each asset plays in the support of that mission.

The contractor has the obligation to report within 48 hours of any change or delay in the project via normal communications (i.e.

phone, email, in writing).

This section describes requirements for providing RMF services for RRB Information Systems subject to the FISMA. The service provider shall follow NIST requirements for all Federal information systems other than those systems designated as national security systems as defined in 44 U.S.C., Section 3542.9. The tasks described in this section are in alignment with the six steps outlined in NIST SP 800-37 Rev. 1, “Guideline for Applying the Risk Management Framework to Federal Information Systems, A Security Life Cycle Approach.”

The contractor will continue to implement the RRB’s existing RMF strategy effort that is in place and outlined in the RRB Informa-tion Security Policy (Administrative Circular IRM-18). A copy of all of the RRB Information Systems as well the AEGIS General Support System RMF documentation will be provided to the contractor to ensure that the full scope of work is obtained.

The Contractor shall follow the Issue Resolution Process for any identified vulnerability or issue identified throughout the Risk Man-agement Framework. The Issue Resolution Procedure is used to communicate issues to key stakeholders and document risk-based de-cisions to include risk acceptance, recommend corrective actions to mitigate vulnerabilities and provide retesting solutions, or creating a Plan of Action and Milestones (POA&M), An issue Resolution Report provide an audit trail, accelerates the RMF strategy, and doc-uments management accountability.

A. Gap Analysis

The Contractor shall perform a gap analysis of all of the RRB Information systems to confirm that the security categorization has been completed and is appropriate and that the requisite security controls have been selected and allocated. Applying the gap analysis will determine if the necessary and sufficient security controls (i.e., system-specific, hybrid, and common controls) have been appropri-ately selected and allocated. The following tasks shall be completed in the gap analysis process:

1. The contractor shall perform gap analysis of RRB Information System risk assessments for each information system or general sup-port system on a yearly basis or as needed and requested by the RRB.

a. Update all risk assessments on RRB Information Systems.

Preparation:

• Review existing RRB system security documentation (e.g., security plan, system design documentation, FIPS 199 Security Categor-ization, past security assessments, etc.)

Document Number: RRB16Q0020 PROCESSED Page 18 of 59

• Review RRB’s existing audit and configuration files, and Vulnerability Assessment Report to certify that RRB’s audit reports do not alter from the recommendation compliance standards (i.e. USGCB).

• Schedule meeting with the RRB key stakeholders (e.g., System Owner, Authorizing Official, Data/Information Owner, Information System Security Officer, Senior Agency Information Security Officer, etc.) to conduct risk assessment. This meeting should also in-volve RRB system administrators, users, etc. if applicable.

b. Update Risk Assessment of RRB Information Systems:

• Discuss with RRB staff and record potential threats (human intentional/unintentional, natural, and environmental) to the information system. A threat is the potential for a particular threat-source to successfully exploit a particular vulnerability.