Security Clause - USE THIS ONE.docx

Contract Security Language

52.204-9 Personal Identity Verification of Contractor Personnel. (JAN 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

(End of clause) Security Requirements

Pursuant to Federal Acquisition Regulation (FAR) clause 52.204-9, incorporated into this solicitation and the resulting contract, each contractor and subcontractor must comply with Agency Personal Identity Verification (PIV) procedures when the contractor and subcontractor will have unescorted physical access to a federally-controlled facility and/or access to a federally-controlled information system (including, but not limited to, computer systems, networks, or information technology infrastructure).

In addition, data contained within all SBA computer systems are governed by Agency record disclosure and privacy regulations (13 C.F.R. part 102), IT Security regulations as well as other regulations, and statutes and guidance, including the Privacy Act of 1974, as amended (5 U.S.C. § 552a). The contractor and its subcontractors will be held accountable for adherence to these statutes, regulations and guidance, as well as following SBA requirements described in this clause. Thus, anytime the term contractor is used, it shall be meant to include the contractor and all of its subcontractors working on this contract that have access to a federally-controlled facility and/or routine access to a federally-controlled information system (including, but not limited to, computer systems, networks, or IT infrastructure).

In addition, various Federal requirements obligate SBA to establish controls to limit access to PII and sensitive information, as defined below, to authorized personnel. These include OMB Circular A-130, Appendix III, and OMB Memoranda M-10-15, M-09-29, M-08-21, M-07-19, M-07-16, M-06-16, and M-06-15.

a. General. The contractor, within 30 days of contract award, must develop a final Systems Security Plan (SSP), which shall be updated at least annually. The SSP will be reviewed by the CO/COR/COTR or designated technical point of contact. The SSP must establish administrative, technical, and physical security measures at the contractor’s computer facility to protect sensitive and personally identifiable information (PII) from unauthorized disclosure, alteration, or misuse; prevent unauthorized access to the contractor’s computer system; and protect the availability of data and services to SBA. Sensitive information includes: Sensitive but Unclassified (SBU) information; procurement sensitive information; For Official Use Only (FOUO) information; information generated by or in the possession of SBA that is commercially valuable, trade secret, market sensitive, proprietary, related to an SBA enforcement or examination matter, subject to privilege, protected by the Privacy Act (5 U.S.C. § 552a), or otherwise deemed sensitive, confidential or non-public by an SBA office head, and is not otherwise available to the public. This definition applies to sensitive information in any form, including documents, electronic mail, computer files, conversations, and audio or video recordings. Examples of sensitive information include corporate financial data provided to SBA that has not been made public; SBA planned or contemplated courses of action regarding SBA examinations, investigations, and enforcement actions; and SBA personnel information covered by the Privacy Act, 5 U.S.C. § 552a.

b. Protection of Sensitive and PII Data. Physical access to the contractor’s office areas that contain sensitive and PII SBA data, including SBA loan and any other data subsequently identified by SBA as sensitive or PII, must be controlled to prevent unauthorized personnel from acquiring access to this data. Log-on passwords, identifiers, and access procedures must be safeguarded from unauthorized use and disclosure. Contractor personnel must comply as follows:

(1) The 1228 “Computer Access/Clearance Form” (available from the YES page) must be read and signed.

(2) Passwords must be changed every 90 days.

(3) The contractor shall notify the CO/COR/COTR as soon as it is known that a contractor will no longer be working on the contract. The contractor’s project manager must ensure that all personnel leaving this contract return all issued identification and any government property no later than the last day of their employment on the contract. Such identification and property must then be provided to the CO/COR/COTR within 24 hours.

(4) The contractor must not release SBA data outside of its facility, either orally or in written form, without the express written consent of the SBA CO/COR/COTR. The contractor must refer all requests for SBA data to the assigned SBA CO/COR/COTR for action.

(5) SBA reserves the right to inspect the contractor’s security measures, data handling procedures and other security safeguards to determine the security posture of the contractor facility. The contractor shall provide SBA access to the contractor’s and subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of this contract, with no additional cost to SBA. Authorized SBA personnel include the Chief Information Security Officer (CISO), the Contracting Officer (CO), the CO/COR/COTR, the Office of Inspector General (OIG) and other personnel designated by the Chief Information Officer (CIO).

(6) Weaknesses in physical, personnel, or computer security noted by SBA during the accreditation process must be corrected as specified by the CISO. Quarterly updates of the status of the corrective actions must be in writing and forwarded through the CO/COR/COTR to the information system owner.

(7) Contingency plans must be implemented and tested annually, at a minimum, to avoid loss of SBA data and to minimize, within the provisions of the contract, the impact of contingencies (environmental failures, fire, severe weather, natural disasters, etc.) on services provided to SBA. Contractors must develop and provide plans for responding to security incidents, as that term is used in OMB Circular A-130, Appendix III, involving sensitive data and PII, and procedures for making any changes to the data processing environment. Documentation must be provided to the CO/COR/COTR within 30 days from the date of contract award. (See NIST 800 53, as revised.)

c. Information Handling and Disposition.

(1) Sensitive data and PII when distributed electronically must be protected against unauthorized disclosure and modification. At a minimum, draft and final documents must be encrypted.

(2) The CO’s approval is required prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of sensitive information received under, generated under, or relating to this contract. The contractor support team will be required to abide by government and Agency guidance for protecting sensitive data and PII. Any such information made available in any format will be used only for the purpose of carrying out the provisions of this agreement.

Such information will not be divulged or made known in any manner to anyone outside the Agency or removed from approved work sites without approval from the CO/COR/COTR or other authorized SBA personnel.

The contractor support team will immediately notify the CO/COR/COTR upon discovery of any inadvertent disclosures of information. The contractor will not disclose sensitive or proprietary information of, or in the possession of, SBA or any of its operating units, contractors, or business partners to unauthorized persons. The contractor will be subjected to any and all penalties imposed by law for unlawful disclosure of SBA information which may include termination of the contract.

(3) Sensitive data and PII, and/or equipment will only be disclosed to authorized personnel with “a need-to-know” as described in the contract or order. The contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established prior to storing SBA data to ensure the security and confidentiality of this information. Data containing PII information is prohibited from being used as test data or stored in a non production-processing environment for development/testing.

(4) All contracts supporting SBA’s Information Systems shall require Internet Protocol Version 6 (IPv6) compliant products to be included in all new IT acquisitions using Internet protocol.

d. Contractor Background Investigations. The following guidelines apply to contractor background investigations:

(1) Office of Management and Budget (OMB) Circular A-130 requires that as a condition for access to Government Automated Information System (AIS) (including data), SBA must screen contractor personnel commensurate with the level of risk presented by their access to sensitive SBA systems. Not all SBA automated information systems (AIS) and data are considered sensitive. SBA policy is to perform background investigations on personnel accessing sensitive data and PII to perform their primary job functions. (See SOP 90 47 2a.)

(2) SBA designates all contractor positions requiring access to AIS and physical access to a federally-controlled facility as Moderate Risk and requires a minimum background investigation (MBI) or higher level, if required by SBA, for all such contractor employees. An adjudicated background investigation is required for all contractor personnel who cannot show positive results of a recent MBI (one that was successfully adjudicated within the last five years or the contractor has not had a break as a contractor from the Federal Government exceeding two years) or higher level investigation, such as a Limited Background Investigation or other background investigation. The CO/COR/COTR or designated staff may assign each contract labor category a higher security sensitivity rating, which will determine the type of background investigation to be performed for that labor position.

(3) The Office of Security Operations (OSO) in the Office of Inspector General, Office of Investigations, will coordinate with the Office of Personnel Management (OPM) which will perform all required investigations. Any background investigation received by a contractor prior to employment on an SBA contract must have been conducted by OPM (or contracting firm approved by Defense Security Service (DSS) and/or OPM.) In order to be accepted by SBA, a contractor’s background investigation must be reviewed and approved by OSO to determine if it meets OPM’s standards.

The background investigation must also meet the requirements applicable to all other SBA contractor personnel.

Background investigations are not required if the contractor is not working in an SBA facility, not accessing an SBA information system, and working with non-sensitive, non-personally identifiable data.

(4) Investigation results will be reviewed by OSO for adjudication. The CO/COR/COTR will be informed of any issues requiring additional action by the contractor.

(5) The CO/COR/COTR will request the contractor to complete the 1228 “Computer Access/Clearance Form” and provide additional information (e.g., social security number, date and place of birth, position description). This information will be submitted to OSO to initiate the clearance process.

e. Designation of a System Security Officer (SSO). The contractor shall designate a management official responsible for fulfilling the responsibilities of an SSO who is knowledgeable in Automated Data Processing technology and computer security methodology. The SSO shall:

(1) Ensure that an appropriate level of physical, operational, and technical security is maintained to protect the computing environment(s) and facility that process SBA information, and the information is processed in accordance with SBA policy. This must include implementing controls described in an SBA approved System Security Plan and ensuring vulnerability scanning is routinely conducted for all devices supporting Agency operations. Scanning should also be conducted by the contractor’s external auditors as a part of the scope of the SAS 70 Type II evaluation.

(2) Assist SBA’s CISO in the investigation of information technology security breaches that affect processing at the contractor’s facility.

(3) Implement, at the direction of SBA’s CISO, SBA AIS security policies, procedures, and standards that affect systems that process SBA information at the contractor’s facility.

(4) Support SBA’s CISO in maintaining the system security plan and in conducting periodic information security audits and internal control reviews. Reviews will be scheduled and conducted at least every three years, and additionally, as required by changes in the system, data, and operating environment.

(5) Recommend security enhancements and improvements where appropriate.

(6) Ensure the timely correction or remediation of discrepancies found during the periodic information security audits and internal control reviews.

(7) Ensure that an accurate inventory list of all networking devices and licensed software products is maintained.

(8) Ensure that security patches and updates are applied to SBA-owned, contractor operated computing devices in a timely fashion.

(9) Notify information system owner of all security incidents immediately after they are discovered. Detailed follow-up reports must be submitted to the CISO describing the incidents, successful/unsuccessful network penetrations, root or user account compromises, denial of service attacks, website defacing attacks, malicious code, viruses, probes and scans, etc.

(10) Ensure that all contractors with access to SBA’s IT systems and/or sensitive data and PII, complete the annual Computer Security Awareness Training (CSAT) and report status of completion to SBA for tracking. New contractors must complete the CSAT within 45 days from starting to work as an SBA contractor.

(11) Provide SBA with a copy of the facility’s Statement of Auditing Standard 70 (SAS-70) in accordance with Federal guidelines over hosted applications as outlined in NIST 800-53, Recommended Security Controls for Federal Information Systems and Organizations and provisions of OMB Bulletin 07-04, Audit Requirements for Federal Financial Statements. The SAS-70 is a “Report on the Processing of Transactions by Service Organizations” where professional standards are set up to audit and assess internal controls of that specific service organization. In this instance, the specific organization would be the outsourcing facility that hosts and/or processes data belonging to SBA. The SAS-70 serves as SBA’s verification that the facility has satisfactory controls and safeguards in place to protect Agency data housed at a third party service provider.

(12) SBA system owners will ensure that all contractors that have been granted access to one or more of SBA’s information systems are provided with a copy of the system’s “Rules of Behavior” which is a group of standards detailing permissible actions while using the system.

f. Service Level for Reporting, Review and Resolution. SBA system owners and contractors hosting SBA systems off-site, must ensure the system is capable of logging and the logging feature is enabled. Logs should capture account, name, normal and exceptional activities time, data and source of occurrence. Logs for privileged accounts (e.g., administrator, auditor, database administrator) must be set up to capture all activities carried out with these accounts with controls that cannot be altered by an individual. The contractor shall include in their proposal an established process and designated resources for the review and monitoring of such logs.

(1) Frequency of review of system and audit logs

a. Logs must be reviewed daily.

b. Critical and High alerts must be addressed within one hour.

(2) Log Retention

a. Logs must be kept for at least 90 days before deleting. After 90 days, logs must be archived offline.

b. Archived logs must be kept for at least one year.

(3) Turn-around time for reporting of events such as security incidents and violations.

a. Security incidents and violations need to be reported to SBA within one hour.

(4) Turn-around time for resolution of reported security problems

a. Reported security problems must be resolved within three business days of initial report.

(5) Turn-around time for applying approved security patches, updates and changes

a. Security patches, updates and changes need to be applied within one week from release date. However, quality assurance testing must be done on all patches, updates and changes before they are applied.

(6) Submission of reports such as periodic problems, audit and system reports

a. Weekly report submission is required.

g. SBA Information Technology Security Program Requirements. The following Federal laws, OMB/NIST/SBA Policies and Guidelines are applicable to operating or hosting all SBA systems. See documents and links below:

SBA’s IT Security Policies Please click here to access the website to review and comply with the following SOPs pertaining to SBA’s Information Security Program:

· SBA Standard Operating Procedure (SOP) 90 47 2, Automated Information Systems Security Program

· SBA Standard Operating Procedure (SOP) 90 49, Appropriate Use of SBA’s Automated Information Systems

· Standard Operating Procedure (SOP) 90 50, Breach Notification Response Plan

Upon request, the contracting officer or the CO/COR/COTR will provide you with copies of the following documents:

· SBA Procedural Notice 9000-1709: Protecting End User Files Containing Sensitive and Personally Identifiable Information

· SBA Information Notice 9000-1241: New Internet Monitor (November 22, 2000)

· SBA Information Notice 9000-1227: Computer Security Reminder, (September 21, 2000)

· SBA Information Notice 9000-1205: E-Mail Passwords (April 13, 2000)

· SBA Procedural Notice 9000-1383: Managing Security Alerts and Vendor Patches (October 22, 2000)

· SBA Procedural Notice 9000-1388: Information Technology System Interconnection Requirements (November 19, 2002)

· SBA Procedural Notice 9000-1391: Storage Media Handling and Disposal (November 26, 2002)

· SBA Procedural Notice 9000-1392: Information Technology - Maintaining System Security Documentation (November 26, 2002)

· SBA Procedural Notice 9000-1797 Computer Security Awareness and Training (May 14, 2009)

· SBA Procedural Notice 9000-1397: Telecommuting Security Policy (December 27, 2002)

· SBA Procedural Notice 9000-1400: Information Technology - Computer Security Rules of Behavior (January 2, 2003)

· SBA Procedural Notice 9000-1403: Automated Information System Support Separation of Duties (January 7, 2003)

· SBA Procedural Notice 9000-1405: Information Technology - Protection of Backup and Recovery Media (January 14, 2003)

· SBA Procedural Notice 9000-1406: Removal of Old Computer User Accounts (January 13, 2003)

· SBA Procedural Notice 9000-1407: Information Technology - System and Application Audit Logs and Trails (January 13, 2003)

· SBA Policy Notice 9000-1830: Wireless Security Policy (October 14, 2009)

Public Law and Statutes http://www.whitehouse.gov/omb

· Privacy Act of 1974 (5 U.S.C. § 552a)

· Freedom of Information Act (5 U.S.C. § 522b)

· Federal Managers Financial Integrity Act of 1982 (31 U.S.C. § 1352)

· Paperwork Reduction Act of 1986 (44 U.S.C. 35)

· Electronic Communications Privacy Act of 1986 (P.L. 99-508, as amended; codified in 18 U.S.C. chapters 119, 121 and 206)

· Computer Fraud and Abuse Act of 1986 (P.L. 99-474, as amended; codified at 18 U.S.C. § 1030)

· Information Technology Management Reform Act of 1996 (Clinger-Cohen Act) (Division E of P.L. 104-106, as amended; codified in part in 44 U.S.C. chapters 111, 113, 115 and 117)

· Title III of the E-Government Act of 2002 (P.L. 107-347) and Federal Information Security Management Act of 2002 (FISMA) (P.L. 107-296; codified in part in 44 U.S.C. chapters 35 and 36)

· Computer Security Act of 1987 (P.L. 100-235, as amended)

Office of Management and Budget (OMB) Circulars and Bulletins:

http://www.whitehouse.gov/omb

· Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility for Internal Control, Dec. 21, 2004, OMB Circular A-127, Financial Management Systems, revised July 23, 1993;

· OMB Circular A-130, Management of Federal Information Resources, Appendix III, Transmittal #4, Security of Federal Automated Information Resources, Nov. 28, 2000;

· Executive Order (EO) 12656, Assignment of Emergency Preparedness Responsibilities (COOP Plans), Nov. 18, 1988, as amended by EO 13074, Feb. 9, 1998;

· EO 13011, Federal Information Technology, July 16, 1996;

· OMB Circular No. A-130, Appendix III establishes a minimum set of controls to be included in the Federal automated information security programs and links agency automated information security programs and agency management control systems established in accordance with OMB Circular No. A-123; OMB Bulletin 90-08, Guidance for Preparation and Submission of Security Plans for Federal Computer Systems that Contain Sensitive Information, July 9, 1990;

· Homeland Security Presidential Directive (HSPD-7), Critical Infrastructure Identification, Prioritization and Protection;

· HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors;

· Presidential Decision Directive (PDD) 67, Continuity of Government (COG) and Continuity of Operations (COOP) Plans Practices for Securing Critical Information and Information Systems and Networks, 1988;

· M-03-22 – OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002;

· M-05-16 – Regulation on Maintaining Telecommunication Services During a Crisis or Emergency in Federally-owned Buildings;

· M-06-16 – Protection of Sensitive Agency Information;

· M-06-20 – FY 2006 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management;

· M-06-15 – Safeguarding Personally Identifiable Information;

· M-06-19 – Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments;

· M-07-11 – Implementation of commonly Accepted Security Configurations for Windows Operating Systems, March 22, 2007;

Federal Information Processing Standards Publications (FIPS PUBs):

http://www.nist.gov/index.html

· FIPS-201, Personal Identity Verification (PIV) of Federal Employees and Contractors;

· FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems;

· FIPS PUB 200, Minimum Security Requirements for Federal Information Systems;

· National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems;

· NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal information Systems;

· NIST SP 800-53, Recommended Security Controls for Federal Information Systems, and referenced supplemental guidance documents;

· NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories;

SBAHQ-12-R-0021

Contract Specialist Staffing Services in Support of the SBA, DFC, Acquisition Division