Attachment A-IT Security and Privacy.docx

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

CECS IT SECURITY AND PRIVACY

U.S. Department of Commerce

National Institute of Standards and Technology

Cloud Email and Collaboration Services

Information Technology Security and Privacy Requirements

Table of Contents

Note:

For the purposes of this solicitation “Offeror” will refer to any combination of teaming arrangements that may include: Cloud Service Provider (CSP), an Integrator, and any other Third party involved in any aspect of managing, hosting, delivering, maintaining and/or supporting the Cloud Services.

The Offeror shall use the latest revisions of all published applicable Regulations, Standards, and Guidelines in constructing their response to this solicitation.

1. Background

The National Institute of Standards and Technology (NIST) is seeking Cloud-based Email and Collaboration Services (CECS) that can meet security control objectives for a system having an overall security categorization of at least “MODERATE” (per FIPS 199) and individual potential risk impact ratings of at least “MODERATE” for the Confidentiality, Integrity and Availability objectives with corresponding management, operational, and technical security controls to adequately protect sensitive agency information, and the information system(s) and operating environment employed in the operations and maintenance of the delivery of those services.

As with all Federal government agencies, NIST is subject to numerous requirements stemming from a variety of laws, rules, regulations, directives, and standards aimed at ensuring the protection of sensitive agency information and information systems. These requirements include providing information security protections commensurate with the risk and magnitude of the potential harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of (i) information collected or maintained by or on behalf of the agency; and (ii) information systems used or operated by the agency or by a contractor on behalf of the agency.

Consequently, the Offeror shall also adhere to and comply with applicable Laws, Executive Orders and Executive Branch Policy regarding the design, build, testing, operations and maintenance of the information system and the security controls designed to safeguard agency information. This document establishes the information technology (IT) security and privacy requirements with which the service provider must comply. These requirements are applicable when NIST information is generated, accessed, stored, processed, or exchanged with NIST or on behalf of NIST by an Offerer, regardless of whether the information resides on a NIST information system or the Offeror’s information system. The Offeror shall protect the confidentiality, integrity, and availability of NIST electronic information and IT resources and protect NIST electronic information from unauthorized disclosure.

NIST remains responsible and accountable for all risk incurred by use of services provided by the Offeror. This risk is addressed by requiring a minimum set of security and privacy controls that must be implemented and monitored to provide assurance that NIST information remains accurate, secure and available. The requirements outlined herein are intended to provide NIST with an acceptable level of trust and controls that must be maintained throughout the lifecycle of the acquisition. This level of trust and controls are maintained by:

1. The Offeror acquiring the services of an agreed upon independent third-party assessor to test and evaluate the effectiveness of the applicable security controls.

2. Meeting the IT security and privacy requirements set forth within this document, including satisfying the ongoing requirements that correspond to NIST Special Publication (SP) 800-53 rev 3, Recommended Security Controls for Federal Information Systems.

2. Applicable Laws, Policy, Rules, Regulations, Standards and Guidelines

At no additional cost to the Government, Offeror shall comply with all Information Assurance, IT security and privacy laws, regulations, policies and standards that are applicable to Offeror in their provision of the services to the Government. In addition, Offeror shall agree, to assist the Government in its compliance with the requirements set forth in the Federal Information Security Management Act (FISMA), by successfully completing the Assessment and Authorization (A&A – formerly referred to as Certification and Accreditation (C&A)) required by FISMA, Office of Management and Budget (OMB) policy, and NIST standards for all information systems provided by Offeror that shall be used in the provision of the Solutions. Offeror shall complete the A&A process on or before providing solutions on-boarding notice. If, during the term of this contract, there are changes to the data protection and privacy laws and regulations, including FISMA, or if there are new US Federal Government requirements applicable to the Government, then the Offeror and the Government will address these changes in a mutually agreed upon Change Management Process.

A number of laws, regulations, directives, policies, standards and guidelines mandate protection of Federal government information, information systems and related resources, including all information systems owned or operated on behalf of the government by the Offeror. These directives can be found in Appendix A.

The Offeror shall also ensure conformance and compliance with, and provide services that implement and meet, the following requirements:

· Department of Commerce (DOC) Information Technology Security Program Policy.

· NIST Information Technology Security Program Policy.

· OMB Memorandum M-05-24, Implementation of Homeland Security Presidential (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors.

· OMB Memoranda M-06-16, Protection of Sensitive Agency Information, and M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, which establish requirements for the use of two-factor authentication for remote system access and requirements for responding to breaches or possible breaches of Personally Identifiable Information (PII).

· OMB Memorandum M-08-05, Implementation of Trusted Internet Connections, which establishes the requirement for NIST to comply with the Trusted Internet Connection (TIC) initiative and the architectural requirements defined by the Department of Homeland Security (DHS) in the TIC Reference Architecture (current version 2.0 dated 2011).

· OMB Memorandum M-08-16, Guidance for Trusted Internet Connection Statement of Capability Form.

· Office of Management and Budget (OMB) Memorandum M-08-26, Transition from FTS 2001 to Networx.

· OMB Memorandum M-08-27, Guidance for Trusted Internet Connection Compliance.

· OMB Memorandum M-11-11, Continued Implementation of Homeland Security Presidential Directive (HSPD) 12– Policy for a Common Identification Standard for Federal Employees and Contractors.

· All management, operational and technical security control and continuous monitoring requirements as specified by FedRAMP.

3. Personnel Security Background Investigations and Clearances

Acquired services shall comply with the following regulations and requirements. Homeland Security Presidential Directive-12 requires that all federal entities ensure that all contractors have current and approved security background investigations that are equivalent to investigations performed on federal employees. The Offeror shall comply with NIST policy relating to HSPD-12. NIST separates the risk levels for personnel working on federal computer systems into three categories: Low Risk, Moderate Risk, and High Risk. The level/complexity of background investigations must be the same as for a Federal employee holding a similar position. The Offeror shall ensure that only appropriately cleared personnel are assigned to positions that meet these criteria.

Those contract personnel determined to be in a:

· Low Risk position will require a National Agency Check with Written Inquiries (NACI) or equivalent investigation;

· Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI) based on the Contracting Officer’s (CO) determination; and

· High Risk position will require a Background Investigation (BI).

After the required background investigations have been initiated, the Offeror may request authorization for employees whose investigations are pending to access systems supporting NIST email and collaboration applications. The NIST Chief Information Officer may grant this authorization based on determination of risk to the government and operational need for the support of these applications.

The Offeror is responsible for maintaining an up to date list of all personnel that have access to NIST data. This list shall be provided by the Offeror at any time during the life of the contract when requested by the Contracting Officer (CO) or Contracting Officer Representative (COR) via email. The Offerer shall provide the list within three business days of the request.

4. Non-Disclosure Agreements (NDAs)

The Offeror shall require each employee that interfaces with the NIST cloud services data, its management, hosting, and delivery to sign non-disclosure agreements prior to beginning work on the NIST contract. NDAs typically utilized by the Offerer may be utilized in lieu of the NIST standard NDAs provided they are deemed appropriate and acceptable by the Contracting Officer.

5. Personnel Changes

The Offeror shall notify the COR immediately of all changes in key personnel having access to the CECS system or NIST information. This shall include when employees are added, replaced, reassigned or leave the Offeror’s employ, and prior to an unfriendly termination.

6. Government Access to Offeror’s Facilities, Documentation, and Electronic Records

The following objectives may be achieved by employing the services of mutually agreed to independent third-party auditors, inspectors, evaluators, investigators, or assessors as deemed appropriate by NIST.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, availability, and reliability of any non-public government data collected and stored by the Offeror, the Offeror shall afford the government access to the Offeror’s facilities, documentation, and electronic records relevant to NIST. The Offeror shall also identify how the following compliance, oversight and law enforcement objectives can be effectively and efficiently conducted by NIST in the event such activity is deemed by NIST to be appropriate and necessary relative to the facilities, documentation, IT systems, devices, and personnel used in performance of the contract, regardless of the location:

· audits;

· inspections;

· evaluations;

· investigations;

· continuous monitoring of the security posture and continued effectiveness of management, operational and technical controls (including IT asset and device discovery, inventory and security configurations);

· penetration testing; and

· vulnerability testing.

The above are in addition to the similar types of activities outlined herein that are normally conducted by the Offeror or independent assessors. Such activities are expected to occur only when NIST determines that special circumstances necessitate additional measures to ensure the CECS system is employing adequate safeguards against specific threats and hazards to the confidentiality, integrity and availability of NIST data/information or to the function of the CECS system and the preservation of evidence of computer crimes. All associated reporting information shall be available to NIST upon request.

7. Incident Detection, Notification, Handling, Response, Containment, Eradication, Recovery and Reporting

Upon becoming aware of any unauthorized access to any NIST data/information stored on Offeror’s equipment or in Offeror’s facilities, or unauthorized access to such facilities or equipment resulting in loss, disclosure or alteration of any NIST data/information (a “Security Incident”), The Offeror will:

(i) immediately notify the NIST Security Implementation Incident Response Team (SIIRT) via email and phone with details of the Security Incident;

(ii) investigate the Security Incident and provide NIST with ) electronic copies of all incident supporting data, including, but not limited to: system event logs, application logs (including web applications), network packet captures (including full packet captures), file system timelines, e-discovery case files, facility access logs, IDS logs, IPS logs, quarantine logs, anti-virus logs, malware samples, and memory dumps

(iii) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident while promptly coordinating with NIST-SIIRT

If new or unanticipated threats or hazards are discovered by either the government or the Offeror, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the Contracting Officer’s (CO).

8. Assessment and Authorization (A&A)

The Offeror, using an independent assessor, will perform the Assessment and Authorization (A&A – formerly referred to as Certification and Accreditation (C&A)) of the CECS information system developed or maintained hereunder prior to going into production. Subsequent to the initial authorization to operate, required to be formally approved by the NIST AO, NIST requires that the CECS information system follow the ongoing authorization process and associated continuous monitoring requirements as prescribed by OMB and NIST. This Offeror shall assess the effectiveness of required implemented controls on an ongoing basis to inform the AO’s decisions regarding the continued use and operation of the system. A&A documents will be provided to the COR, NIST System Owner, and NIST AO in both hard copy and electronic forms.

The Offeror must obtain the appropriate security authorization through validation of security functionality of required management, operational, and technical controls selected, documented in the System Security Plan (SSP), and formally approved by the NIST AO. The security control objectives for the CECS information system shall have an overall security categorization of at least “MODERATE” and individual potential risk impact ratings of at least “MODERATE” for the Confidentiality, Integrity and Availability objectives (see NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, and 800-39, Managing Information Security Risk: Organization, Mission, and Information System View). Security functionality must be obtained by employing within the information system and its environment of operation, a combination of the appropriate set of management, operational, and technical security controls from NIST Special Publication 800-53 that correspond to the security categorization and associated potential risk impact ratings.

The Offeror must follow all relevant and current versions of NIST FIPS Pubs and SPs to include, but not limited to, FIPS Pub 199 and 200, SP 800-39, 800-37, 800-137, 800-60, 800-53, 800-53A, 800-34, 800-30, and 800-18. The Offeror must also comply with NIST and DOC IT security and Privacy policies and standards.

The Government will review Offerors’s Assessment and Authorization (A&A) documentation package and any changes submitted by Offeror that could require re-assessment in order to assist the Government in its compliance with FISMA and the NIST 800-53 security control requirements. If there are any errors, omissions or other issues with the Offeror’s A&A documentation package or assessment results, the Government will timely notify Offeror and provide reasonable descriptions of specific errors, omission or other issues. The Government will reasonably cooperate with Offeror in the A&A process and will not unreasonably withhold or delay any review of A&A package documentation, assessment result from the independent assessor, or authorization decisions.

Upon completion and acceptance of the A&A the Offeror is responsible for providing all signed documentation to the Contracting Officer and COR. Below is a list of required documents and their description:

8.1 System Security Plan (SSP)

As part of the A&A, the Offeror shall develop a SSP in conformance with NIST SP 800-37, 800-39, 800-18, 800-60, 800-53, 800-137 and FIPS Pubs 199 and 200.

8.2 Contingency Plan (CP)

The Offeror shall submit a contingency plan for restoration and testing of CECS system services and resumption of maintenance support during a contingency operation. The plan must conform to the NIST SP 800-34 and be consistent with existing NIST continuity of operation procedures and plans. The Offeror shall submit contingency plans to the NIST System Owner.

8.3 Network Diagram

The Offeror shall submit a diagram that displays a graphical topology of the Offeror’s network, as it relates to the service being provided to NIST and/or NIST’s data. The network diagram must include all networks, firewalls, security zones, communication paths, network assets (servers, databases, network devices), and ingress/egress points to the security boundary of the network.

8.4 Vulnerability Scan and Analysis

The Offeror shall submit vulnerability scan results and analysis for the following scans:

· Authenticated vulnerability and configuration scans of network assets

· Authenticated database vulnerability scans

· Web application vulnerability scans

For each identified vulnerability, the analysis shall include whether the results are false positive, accepted risk (with justification and compensating controls provided), mitigated, or planned for mitigation.

8.5 Security Assessment Plan (SAP) and Security Assessment Report (SAR)

The Offeror, using an independent third-party assessor approved by the NIST AO, will plan and conduct the security assessment of the CECS information system in accordance with NIST SP 800-53A and document all identified vulnerabilities and weaknesses and appropriately characterize and assess the resulting risks in accordance with NIST SP 800-30 in the SAP and SAR. That documentation, including vulnerability scan results, will be provided to the NIST AO.

The qualifications and required degree of independence of the assessors shall be at the discretion and approval of the NIST AO.

With the approval of the Government System Owner, and as required by the NIST AO, the Offeror will take immediate and timely action to correct or mitigate any vulnerabilities and weaknesses discovered, as necessary, to bring the application or system into compliance with the IT security and Privacy requirements outlined herein.

8.6 Plan of Action and Milestones (POA&M)

The Offeror shall develop and maintain a POA&M documenting all known IT security vulnerabilities and weaknesses in the CECS information system and associated components that will be remediated. The Offeror shall submit POA&Ms to the NIST System Owner and, in coordination with the NIST System Owner, provide quarterly briefings to the NIST AO regarding the corrective action status of known vulnerabilities and weaknesses and the risks they pose to NIST’s information and the CECS information system.

Where the security control requirements outlined herein cannot be met, at the discretion of and approval by the NIST AO, either:

· other alternative mitigating/compensating controls can be offered by the Offeror for consideration and acceptance by the NIST AO;

· the NIST AO can formally document and accept the associated risk of not implementing a control or the residual risk level resulting from partial risk mitigation;

· the Provider can submit a Plan of Action and Milestones (POA&M) for meeting the control that is approved by the NIST AO; or

· the NIST AO can choose to authorize the system to operate.

Where a proposed CECS information system offers a compensating/mitigating control obviating the need to impose one or more of the requirements outlined herein, the Offeror should provide the appropriate rationale and justification supporting such assertions for consideration, risk acceptance, and approval by the NIST AO.

8.7 Continuous Monitoring Plan (CMP)

The Offeror is required to conduct continuous monitoring of the CECS information system in a manner that enables enterprise-wide visibility into the security posture and effectiveness of controls across the CECS. The Offeror is required to monitor the security state of the CECS information system on an ongoing basis with a frequency sufficient to enable the NIST AO to make ongoing risk-based decisions on whether to continue to utilize the system.

The Offeror shall submit a continuous monitoring plan that supports the NIST AO’s ongoing authorization process. The plan must conform to the NIST SP 800-137 and be formally approved by the NIST AO. The Offeror shall submit annual continuous monitoring reports to the applicable Government System Owner and Authorizing Official.

The continuous monitoring program must address, at a minimum: (i) the effectiveness of deployed security controls; (ii) changes to information systems and the environments in which the system operates; and (iii) compliance to federal legislation, directives, policies, standards, and guidance with regard to information security and risk management. In documenting the continuous monitoring program for the CECS information system, the Offeror must identify and obtain approval by the NIST AO for the security controls to be monitored, the frequency of monitoring, and the control assessment approach. The program must define how changes to the CECS information system will be monitored, how security impact analyses will be conducted, and the security status reporting requirements including recipients of the status reports.

Information systems used or operated by Federal agencies, or by contractor(s) on their behalf, must be tested and evaluated at least annually. The security control assessment results may be drawn upon from the following sources to satisfy the annual FISMA requirement, including but not limited to:

· Security assessments conducted as part of an information system security authorization or re-authorization process;

· Continuous monitoring activities; or

· Testing and evaluation of the information system as part of the ongoing system development life cycle process (provided that testing and evaluation results are current and relevant to the determination of security control effectiveness).

Automated monthly discovery and reporting of all associated CECS system physical and logical assets shall be conducted to maintain an accurate physical and logical inventory of all system components. Automated monthly vulnerability scans and verification of security configurations for all CECS system physical and logical assets shall be conducted using authenticated and agent-based mechanisms to ensure the most comprehensive and accurate detection, identification and reporting of vulnerabilities and weaknesses in the CECS information system and associated components. An electronic copy of each report and session data shall be made available for review by the System Owner upon request.

At least annually, the CECS information system and associated components accessible from the Internet must be penetration tested by a mutually agreed to independent third-party assessor. Electronic and hard copy reports of penetration test results shall be provided to the COR and System Owner.

The Government reserves the right to conduct prearranged vulnerability scans or penetration tests using a mutually agreed to independent third-party assessor in accordance with a formally documented Memorandum of Agreement (MOA) and accompanying Rules of Engagement.

The Offeror will take appropriate and timely action to correct or mitigate weaknesses discovered during such testing, at no additional cost to the Federal Government.

8.8 Training

Offeror employees must complete end-user computer security awareness training, prior to being granted access to NIST data or being issued a user account. Training must be renewed annually. Offeror employees are also required to annually complete IT security role-based training in accordance with the NIST SP 800-16, Information Security Training Requirements: A Role- and Performance-Based Model. The Offeror shall annually prepare a report listing all Offeror employees, security awareness course completion status by each employee, and IT security role-based training completion status by each employee with an explanation as to how each employee satisfied these annual training requirements. The Offeror shall maintain records of all supporting evidentiary artifacts of completion and make them available for inspection/audit by the government upon request.

9. Roles and Responsibilities

Authorizing Official The authorizing official is the NIST Chief Information Officer (CIO). The NIST CIO formally assumes all risks to NIST for use of these external information services.

The authorizing official is responsible for:

· Reviewing and approving the security requirements, information security documentation, and CMP.

· Approving the authorization to operate (ATO).

· Reviewing risk reports on an ongoing basis.

· Disapproving the ATO if the trust relationship with the service provider is broken.

The authorizing official may rescind the authorization to operate immediately if an acceptable level of trust and applicable controls are not maintained, which may result in termination of the contract.

System Owner The system owner is the NIST official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information service. This is typically the management official who funds the acquisition for the system.

The information owner is responsible for:

· Ensuring a privacy impact assessment is performed.

· Ensuring a security categorization is performed.

· Ensuring the service provider assesses and implements all applicable controls.

· Ensuring that continuous monitoring is being performed.

· Reporting risk to the authorizing official as defined in the CMP.

Offeror The offeror is the third-party entity hired by the system owner to provide services external to the NIST network of services.

The offeror is responsible for:

· Collaborating with the information owner to implement all applicable controls.

· Performing continuous monitoring activities.

· Sharing information as required by the CMP.

APPENDIX A

Applicable Laws:

Government Paperwork Elimination Act (GPEA) of 1998, 44 U.S.C. § 3504 This law provides for Federal agencies, by October 21, 2003, to give persons who are required to maintain, submit, or disclose information, the option of doing so electronically when practicable as a substitute for paper and to use electronic authentication methods to verify the identity of the sender and the integrity of electronic content.

Executive Orders:

Executive Branch Policies:

APPENDIX B

NIST A&A Related Standards

The following NIST Federal Information Processing Standard Publications (FIPS Pubs) and Special Publications (SPs) are especially applicable to the Product Acquisition. Successful completion of A&A includes, but is not limited to, these standards:

NIST Standards

FIPS Pub 199, Standards for Security Categorization of Federal Information and Information Systems

FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems

SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories: (2 Volumes) - Volume 1: Guide Volume 2: Appendices

SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View

SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach

SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations

SP 800-34, Contingency Planning Guide for Federal Information Systems

SP 800-30, Guide for Conducting Risk Assessments

SP 800-18, Guide for Developing Security Plans for Federal Information Systems

SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations

SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans

2 | Page image1.png image2.png image3.gif