SS_75F40126Q00036 Attachment Draft SOW.pdf

SOURCES SOUGHT NOTICE

Request # SS-75F40126Q00036

ATTACHMENT – DRAFT SOW

Food and Drug Administration

Draft Statement of Work (SOW) for FDA

Cybersecurity Risk Management Services – Blanket Purchase Agreement (BPA)

Introduction

1.1 Background

The U.S. Food and Drug Administration (FDA) is a scientific regulatory agency that employs more than 20,000 scientific, regulatory, technical, and support staff who are responsible for protecting and promoting the public health in the United States.

The FDA is responsible for protecting and promoting public health through the regulation and supervision of food safety, tobacco products, dietary supplements, prescription, and over-the-counter pharmaceutical drugs (medications), vaccines, biopharmaceuticals, blood transfusions, medical devices, electromagnetic radiation emitting devices, veterinary products, and cosmetics. This is accomplished through the regulatory review of sponsor submissions with data in standardized formats.

As the nation’s cybersecurity landscape continues to shift and expand, the FDA’s information technology infrastructure, network, systems, and applications will consistently face security threats, vulnerabilities, and risks. The proliferation of cloud technologies and mobile devices provide additional opportunities for malicious actors, trusted insiders, foreign governments, and transnational criminal organizations to exploit sensitive information for economic and cyber espionage purposes.

To protect the FDA’s business mission, the FDA Cybersecurity, Counterintelligence and

Insider Threat Program provides a best-in-class, intelligence-driven cybersecurity program that directly supports the FDA’s mission to protect and promote U.S. public health. Our program has been recognized at executive levels within the federal government and private sectors.

1.2 Objectives

As a direct result of Contract performance, the FDA Cybersecurity, Counterintelligence, and Insider Threat Program’s Cybersecurity Risk Management mission expects to achieve the following outcomes:

• Improve FDA’s cybersecurity posture and meet the following federal laws and mandates.

o Computer Fraud and Abuse Act of 1986 o Computer Security Act of 1987, PL 100-235 o Federal Managers Financial Integrity Act (FMFIA), September 8, 1982.

o OMB Circular A-130 and Appendix III, Security of Federal

Automated Information Resources o OMB Circular A-123, Management's Responsibility for Enterprise

Risk Management and Internal Control o OMB Memorandum M-14-03: Enhancing the Security of Federal

Information and Information Systems.

o Presidential Decision Directive 63 (PDD 63) o Computer Abuse Amendments Act of 1990 o Paperwork Reduction Act of 1980 as amended in 1995 (PRA), May

22, 1995.

o Freedom of Information Act of 1996 o Clinger-Cohen Act of 1996 o Federal Information Security Modernization Act 2014 (FISMA), part of the original E-Government Act of 2002 o The Privacy Act of 1974, May 2004 o FIPS 140-3, Security Requirements for Cryptographic Modules o FIPS PUB 199, Standards for Security Categorization of Federal

Information and Information Systems o FIPS PUB 200, Minimum Security Requirements for Federal

Information and Information Systems o NIST Special Publications – 800 Series o Federal Continuity Directives 1 and 2 o Federal Risk and Authorization Management Program (FedRAMP) o Food and Drug Administration Security and Privacy Language for

Information and Information Technology Procurements o Food and Drug Administration, SMG 3251.12 - Policy for Information

Security and Privacy Protection (IS2P) o NIST Cybersecurity Framework o Federal Cybersecurity Workforce Assessment Act of 2015 o Executive Order 13636 - Improving Critical Infrastructure

Cybersecurity and Presidential Policy Directive (PPD) 21 Critical

Infrastructure Security and Resilience o Executive Order 13800 - Strengthening the Cybersecurity of Federal

Networks and Critical Infrastructure o Executive Order 14306: Sustaining Select Efforts To Strengthen the

Nation's Cybersecurity and Amending Executive Order 13694 and

Executive Order 14144 o Executive Order 14028, Improving the Nation’s Cybersecurity

• Ensure that FDA security controls are implemented in accordance with

FISMA, NIST Special Publications 800-37, 800-53 (as amended), and other

NIST 800 series publications to maintain the confidentiality, integrity, and availability of FDA data and information systems.

• Strengthen the FDA’s information security posture against cybersecurity threats via compliance activities for security authorizations.

https://www.federalregister.gov/executive-order/13694 https://www.federalregister.gov/executive-order/14144

• Expand awareness, partnerships and collaboration with FDA Centers, Offices, and Programs (COPs) and external agencies.

• Expand the FDA Cybersecurity, Counterintelligence, and Insider Threat

Program to mitigate long-standing threats, vulnerabilities, risks, and weaknesses within the FDA IT Enterprise.

• Lead in the development of IT security policies, procedures, standards, and guidelines as necessary to enhance the FDA Cybersecurity, Counterintelligence, and Insider Threat Program, and monitor their implementation.

• Establish divisional and individual performance measures to meet IT security requirements and key objectives to include compliance activities for contingency planning, account management, awareness and policy development, and penetration testing.

• Improve efficiencies in procedures while ensuring implementation of appropriate security controls and effective account management and oversight.

• Align and improve program activities to meet federal standards and audit findings.

• Improve FDA cybersecurity governance, policies, strategies, and plans with responsive methodologies and requirements associated with federal guidance, including Zero Trust.

• Align and enhance program activities to meet federal standards regarding

FDA use of Artificial Intelligence (AI).

1.3 Technical Environment

The FDA is comprised of COPs that support over 20,000 staff members across the United

States and international offices. Much of the personnel are located within the

Washington DC metropolitan area. At quarter one of of Fiscal Year 2026, the FDA information systems that support the FDA business mission included 111 FISMA reportable systems which many contain subsystems and minor applications to include over 376 production systems.

1.4 Key Technologies

The FDA employs a variety of hardware and software technologies similar to other government agencies and commercial industries. The table below is a subset of some of the common technologies used at the FDA.

1. Database Management Systems

Oracle

SAS Share

Microsoft SQL Server

MySQL

2. Programming Languages

XML Programming

JAVA

Oracle Application Server

SAS

3. Servers/Operating Systems

Windows Server

Unix/Linux

4. Cloud Computing Environments

Amazon Web Services (AWS) GovCloud and AWS East/West

Appian

Salesforce

Microsoft O365

ServiceNow

ExLibris

DNA Nexus

Cornerstone OnDemand

Okta

CoSo Cloud

Google Cloud Platform

5. FDA CDM Capabilities as defined by DHS

WebInspect

DbProtect

BigFix

Centrify

Splunk

RSA Archer

Ping

CrowdStrike

6. FY-26 FDA FISMA System Impact Categorization (Includes Cloud and

Mobility Technologies and GSS)

Categorization

FY26 FDA Reportable

Systems

Low 13

Moderate 80

High 18

TOTAL: 111*

* This encompasses around 376 Operational Applications

7. FDA Cloud Systems – Quantity (subset of the FISMA System Inventory)

FY24 FY25 FY26

Authorized Cloud Systems 53 57 59

Projected Number of New Cloud

Systems

2 9 10

Projected Significant Changes in

Cloud Systems

3 2 5

8. FDA Cloud Systems –Impact (subset of the FISMA System Inventory)

FDA Cloud Systems Impact

Cloud - High 14

Cloud - Moderate 36

Cloud - Low 9

FDA authorized 37 Cloud Service Providers

2 Purpose

This Statement of Work (SOW) conveys the current FDA Cybersecurity, Counterintelligence, and Insider Threat Program’s Risk Management objectives, constraints, applicable scope, technical requirements, and applicable task areas.

Individual task orders will be issued to obtain specific services. In addition, the FDA will use the contract to acquire Original Equipment Manufacturer (OEM) support services for cybersecurity-related subscription services.

The FDA does not anticipate using the contract as a vehicle to renew cybersecurity maintenance licenses such as firewall, antivirus, and governance systems.

3 Scope

The scope of this contract encompasses the technical and management services and subscriptions/licenses necessary to permit the FDA and all its COPs to meet the objectives of the FDA Cybersecurity, Counterintelligence, and Insider Threat Program presented in Section 1.2 above.

4 Description of Task Areas

4.1 Task Area – Security Authorization Support

The FDA Compliance Program supports the requirements of the FDA Chief Information

Security Officer (CISO) under the Federal Information Security Modernization Act

(FISMA). These requirements support the FDA’s Risk Management objectives in identifying and characterizing system and enterprise risk.

The FDA information systems, networks, programs, as well as contractor operations and contractor facilities supporting the FDA, require annual assessments to validate the effectiveness of the security controls and to ensure that they meet and/or exceed federal standards, and continue to adequately mitigate the risks to the FDA. Cloud, AI, and mobile information systems, networks, and programs supporting the FDA, require security assessments to validate the effectiveness of the security controls and to ensure that they meet and/or exceed federal standards, and continue to adequately mitigate the risks to the FDA. These FDA systems and environments are subject to Government Accountability Office (GAO), HHS Office of Inspector

General (OIG), FISMA, and OMB A-123 audits.

The FDA is currently implementing an Ongoing Authorization process based on the

NIST Special Publication 800-37 for security authorizations. The Cybersecurity Risk

Management team is responsible for the execution, support, and oversight of the security authorization process to completion and the audit response for the information systems in accordance with FISMA and federal standards.

As tasked, the contractor shall provide support in executing the Cybersecurity Risk

Management program in accordance with FISMA compliance programs and audit responses for regulations governing FDA IT, e.g., A-123, FISMA, and any requirements from OMB/NIST/HHS/FDA. Security Authorization is defined as including on premises systems, cloud-based systems, Artificial Intelligence (AI), and emerging technology systems. Representative activities include:

• Audit Coordination and Liaison (FISMA, A-123, HHS) – Gather information and coordinate the response to requests for information from auditors, HHS, and FDA data calls.

• Security Authorization Completion and Coordination – Assist system owners, Information System Security Officers (ISSOs), and business owners in developing

Security Authorization packages in accordance with FDA processes and procedures.

• Conduct annual security controls assessment testing on a set of the controls, as defined in the FDA process and procedures, against each FISMA system, document findings, and recommend remediation as part of the Plan of Actions and

Milestone (POA&M) process.

• Prepare the Security Authorization package which includes a recommendation of authorization decision to the Authorizing Official, in accordance with FDA processes and procedures. The contractor shall continue to evolve the FDA

Authorization processes from the three-year cycle of NIST 800-53 controls evaluation to an Ongoing Authorization process.

• Conduct Ongoing Authorization for information systems in alignment with

National Institute of Standards and Technology (NIST) Risk Management

Framework (RMF) and the Federal Risk and Authorization Management Program

(FedRAMP).

• Privacy Management – Ensure privacy controls are assessed for compliance with

NIST 800-53 (as amended).

• Annually review and assess the contractor, Government to Government (G2G), Business to Government (B2G) infrastructure connectivity to the FDA in accordance with FDA processes and procedures.

• Annually perform oversight of IT contractor facilities (site visits) - Perform structured reviews of contractor operations and facilities that directly support the

FDA, in accordance with OMB/NIST/HHS/FDA standards.

• POA&M and Inventory Tracking -Perform POA&M remediation and system inventory tracking and validation of the systems and effectiveness of remediation efforts.

• Provide support and review exceptions, waivers, risk-based decisions, and deviations from standards in accordance with the FDA processes and procedures.

Make a recommendation based on assessed system and enterprise risk.

• Track and store completed risk based decision/waiver/Interconnection Security

Agreement (ISA) documentation for annual review, updates, and refresh.

• Provide Security Authorization Cost Estimate Report for use in FDA’s chargeback model back to COPs.

• Provide administration activities necessary to support the FDA Cybersecurity, Counterintelligence, and Insider Threat Program governance tool (e.g. RSA

Archer).

• Support the creation, updates, and configuration of Security Authorization templates and processes.

• Maintain guide documents that define the standard processes for FDA security authorizations.

• Perform contingency planning activities including:

o Conduct periodic business impact analysis.

o Establish and maintain call lists.

o Integrate existing plans (e.g., building evacuation plans) into the Information

Technology emergency response activities.

o Establish and maintain FDA recovery tiers for critical systems and applications.

o Create, update, and maintain the Application Information Systems

Contingency Plans (ISCPs).

o Create new and update ISCP Exercise Plans, ISCP Exercise Reports, and standard POA&M items in response to Exercise weaknesses.

o Conduct annual ISCP exercises.

o Conduct Information Systems Contingency Plans (ISCP) After Action reviews.

• Assess using the Department of Homeland Security (DHS) – High Value Asset

(HVA) Control Overlay.

• Conduct DHS required assessments of FDA’s HVAs that are designated as DHS

Tier 2 in alignment with OMB M-19-03, Strengthening the Cybersecurity of

Federal Agencies by enhancing the High Value Asset Program.

• Utilize the designated eGRC tools for documenting the security assessments and obtain Security Authorizations to meet FDA and HHS standards.

• Review a standard process for key recovery metrics such as Recovery Time

Objectives (RTO), Recovery Point Objectives (RPO), Work Recovery Time

(WRT) and Maximum Tolerable Downtime (MTD) for FDA Stakeholders.

4.2 Task Area – Security Policy and Data Call Support

As tasked, the Contractor shall provide Cybersecurity Policy and Data Call Support services. Representative activities include:

• Prepare, develop, and coordinate the cybersecurity related policies for the FDA.

Submit draft versions of cybersecurity policies to FDA for final approval.

• Review and produce final versions of Policy, Awareness, and Training team communications, products, and training material.

• Update content on the FDA Cybersecurity Program web site and SharePoint site and other Inside. FDA intranet sites, as needed.

• Track, update, and maintain Policy, Awareness, and Training activities. Maintain training compliance records, and provide status reports that meet FISMA, OIG, or other recordkeeping requirements.

• Support the review, analysis, and response to Department of Homeland Security

(DHS) Binding Operation Directives (BOD), Emergency Operation Directives

(EOD), and other cybersecurity data call responses.

• Document the team processes and procedures, and update SOPs as necessary to ensure that they always reflect the most current FDA authorized procedures.

• Provide logistical support for cybersecurity awareness events, forums, and presentations located at FDA office locations or conducted online.

4.3 Enterprise Governance Risk and Compliance (eGRC) Support Services

As tasked, the Contractor shall facilitate the development, integration, operation, and maintenance of the eGRC system (e.g., Archer).

Representative activities under this task area may include:

• Obtain eGRC system certified professional administrators, architect, engineers to facilitate the FDA eGRC system integration, including Assessment and

Authorization solution (A&A) and Security Operation Solution (SECOPS).

• Provide integration and configuration services that include new interconnections with such as Continuous Diagnostic and Mitigation (CDM) solution, ServiceNow, Nessus Security COPs, and other critical operational applications.

• Effectively work with HHS and DHS stakeholders on future configuration and rollout tasks and activities.

• Provide eGRC administration services such as user account creation/provisioning, privileged access, template updates, customized reports, dashboards, and other key eGRC system administration activities.

• Support with eGRC system control panel and server administration tasks.

• Provide eGRC system training.

• Develop eGRC system communications and presentations for Cybersecurity professionals and senior business executives such as the FDA Chief Information

Officer and FDA Commissioner.

4.4 Cybersecurity Risk Management Documentation Services

As tasked, the contractor shall facilitate the development of the standard documentation that support the Cybersecurity Risk Management strategic priority. In fiscal year 2026, the FDA maintained 111 security authorizations comprised of subsystems, services, and minor applications.

• Provide security authorization and assessment document creation and updates;

• Develop and update templates;

• Provide librarian services to support document management.

4.5 Transition In or Out Services

As tasked, the Contractor shall facilitate the transition of contracted activities and services to the Federal Government or to a follow-on contractor at the beginning or at the end of the contract period of performance.

• Provide the FDA with current versions of all system and user documentation;

• Provide FDA all licensing and renewal information, asset management records, software documentation, and training materials;

• Provide FDA with a current inventory of all Government-owned assets used by the Contractor along with full support in the reconciliation of this inventory;

• Provide FDA with current versions of all CONOPS, operational procedures, standard operating procedures, guidelines, performance reports, specifications for hardware and software, and other pertinent information needed to continue the services being performed by the Contractor;

• Provide “shadowing” and other knowledge transfer meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor and;

• Provide up-to-date-EPLC and program/project management documents.

• Meet staffing level requirement and document management on a schedule as defined by the government.

5 Applicable Documents

The work to be performed under this contract will assist the FDA in better meeting legislative mandates and associated implementation guidance from DHHS and Federal agencies. The contractor must comply with, but not limited to, the following Statutes, and Acts:

• Computer Security Act of 1987, PL 100-235

• Federal Information Security Modernization Act of 2014 (FISMA)

• Federal Cybersecurity Workforce Assessment Act of 2015

• OMB Memorandum M-14-03: Enhancing the Security of Federal Information and Information Systems.

• OMB Circular A-130 and Appendix III, Security of Federal Automated

Information Resources

• OMB Circular A-123, Management's Responsibility for Internal Control

• Presidential Decision Directives

• Homeland Security Presidential Directives (such as HSPD-12)

• Executive Orders (such as 13636 and 13800)

• NIST Cybersecurity Framework

• Department of Health and Human Services, current policies for Information

Security and Privacy Protection

• E-Government Act of 2002

• Clinger-Cohen Act of 1996

• Computer Fraud and Abuse Act of 1986

• FDA Staff Manual Guides – primarily Information Resources Management –

Information Security and Privacy Protection Policy – 3251.12.

• NIST Special Publications – 800 Series

• NIST Federal Information Processing Standards

• The Privacy Act of 1974

• Section 508 of the Rehabilitation Act of 1973

6 Constraints

6.1 FDA Information Technology

Current standards and guidelines that must be considered in the execution of all FDA

Information Technology contracts include:

1. FDA Approved Technologies List - The FDA Product Service Catalog a list of approved and not approved technologies including applications (software), infrastructure and peripherals (hardware), and scientific software and devices.

2. FDA Security Authorization Process - Security Authorization is the approach

FDA follows to fulfill Federal Information Security Modernization Act (FISMA), Office of Management and Budget (OMB) and Department of Health and Human

Services (HHS) requirements to ensure that information resources have adequate security to protect the Confidentiality, Integrity and Availability of information collected, processed, transmitted, stored, or disseminated by the agency. For further information see: FDA Security Authorization Toolkit (see attachment entitled Security Authorization Toolkit) SP 800-37 Rev. 1: Guide for Applying the Risk Management Framework to Federal Information Systems: A Security

Life Cycle Approach.

3. National Institute of Standards and Technology (NIST) SP 800-53 - This publication was developed by the Joint Task Force Transformation Initiative

Interagency Working Group with representatives from the Civil, Defense, and

Intelligence Communities in an ongoing effort to produce a unified information security framework for the federal government— including a consistent process for selecting and specifying safeguards and countermeasures (i.e., security controls) for federal information systems (The latest revision applies). SP 800-53

Rev. 4: Security and Privacy Controls for Federal Information Systems and

Organizations.

4. The E-Government Act [Public Law 107-347] passed by the 107th Congress and signed into law by the President in December 2002 recognized the importance of information security to the economic and national security interests of the United

States. Title III of the E-Government Act, entitled the Federal Information

Security Modernization Act of 2014 (FISMA), included duties and responsibilities for the Computer Security Division in Section 303 of the National

Institute of Standards and Technology document: NIST: Computer Security

Division - Computer Security Resource Center.

http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://csrc.nist.gov/index.html http://csrc.nist.gov/index.html

5. NIST Federal Information Security Modernization Act of 2014 (FISMA)—An update to the E-Government Act (Public Law 107-347), passed by the 107th

Congress and signed into law by the President in December 2002 recognized the importance of information security to the economic and national security interests of the United States. Title III of FISMA requires each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.

6. SMG 3251.12 - The FDA Staff Manual Guides (SMGs) are the Agency directives that document organizations and functions; delegations of authority; and administrative and program policies, responsibilities and procedures.

7. Security and Privacy Language for Information and Information Technology

Procurements-Requirements for meeting this requirement are defined in

Appendix A.

8. FDA’s Project Management (PM) – Project Management processes include a variety of project management methodologies which may be employed in the task orders released under this contract including, but not limited to, the Project

Management Body of Knowledge (PMBOK).

9. Section 508 of the Rehabilitation Act of 1973. Requirements for meeting this requirement are defined in Appendix A.

6.2 Data Quality Standards

The FDA has approved data standards for e-submissions and their regulatory review process. For example, CDER data standards references and resources can be found at:

https://www.fda.gov/industry/study-data-standards-resources/study-data-submission-cder-and-cber Specific data standards requirements will be detailed in each task order release under this contract.

6.3 HHS Enterprise Performance Life Cycle (EPLC) Framework

The Contractor, shall, where applicable, conform to the EPLC Framework. A guide to the

HHS EPLC Framework is located at https://www.hhs.gov/sites/default/files/ocio/eplc-lifecycle-framework.pdf.

6.4 ServiceNow

FDA has instituted the ServiceNow services to track technologies across the agency. The introduction of a new technology or a different version of an already approved technology requires the submission and approval of request. The Contractor may be responsible for supporting the ServiceNow process including writing and submitting requests and tracking them from inception through completion. FDA Center IT

Investment Review Boards may need to be included in a coordinated review process.

https://www.fda.gov/industry/study-data-standards-resources/study-data-submission-cder-and-cber https://www.fda.gov/industry/study-data-standards-resources/study-data-submission-cder-and-cber https://www.hhs.gov/sites/default/files/ocio/eplc-lifecycle-framework.pdf https://www.hhs.gov/sites/default/files/ocio/eplc-lifecycle-framework.pdf

6.5 FDA Data Centers

FDA has the following primary data centers the White Oak Data Center (WODC), the

Ashburn Data Center (ADC), t, and the National Center for Toxicological Research

(NCTR) Data Center. The NCTR Data Center supports the FDA NCTR located in

Arkansas.

In addition, FISMA reportable systems utilize cloud hosted Data Centers and other SaaS and PaaS cloud service providers. .

7 Contract Type

The contract type is Blanket Purchase Agreement (BPA). Task orders issued under the

BPA contract may be Firm Fixed Price (FFP), Labor Hour (LH), Time and Material

(T&M), or a hybrid combination thereof.

8 Deliverables

Deliverables shall be specified in the task orders released under this contract. Deliverable products shall be reviewed, validated and tested as appropriate to ensure that they meet applicable/specified standards, policy, business requirements and quality measures.

Draft versions of the contract level Program Management Plan (PMP) and Quality

Assurance Plan (QAP) shall be submitted with the Offeror’s proposal. Final versions of the PMP and QAP shall be delivered within 30 days of contract award. When approved by the COR, the Contractor shall operate under the PMP and QAP.

9 Other Requirements

9.1 Contract Level Program Management

As tasked in a task order, the Contractor shall establish the program plans, structures, processes, schedules, reporting requirements, communication channels, and quality control functions necessary to steward the project throughout the contract’s period of performance and fully achieve contract objectives.

Representative activities include:

• Provide overall coordination, management, and reporting for all the activities and tasks specified in all task orders under this contract;

• Develop and maintain an overall FDA Cybersecurity Support Contract Transition

Plan to successfully transition existing support services from incumbent contractors per FDA-approved priorities and timelines;

• Develop, maintain and manage an overall FDA Cybersecurity Support Contract

Management Plan that links the high-level activities of all task orders to overall contract objectives;

• Develop, maintain and communicate FDA Cybersecurity Support Contract

Integrated Master Schedule (IMS) to ensure that all contract deliverables and products are produced according to established schedules;

• Develop, maintain and manage a unified Risk Management Plan to identify, document, and communicate risks including their impact on FDA Cybersecurity

Support Contract objectives;

• Develop, maintain and manage an FDA Cybersecurity Support Contract

Communication Plan and associated capability that takes into account a broad range of modes and requirements from ad hoc, informal check-ins and progress updates to weekly status reports to formal briefings to FDA Executive

Management and other key stakeholders;

• Provide a monthly contract level status report to the COR, incorporating all tasks at a high level and their progress. Actively inform the designated government

Project Managers and Contracting Officer Representatives of any issues and recommendations that should be addressed for the overall effective accomplishment of the contract. Recommendations for actions that need to be taken by FDA staff, or other contractors, shall be clearly defined and communicated to the responsible party and the FDA, and have identified dates for completion.

9.2 Quality Assurance

The Contractor shall establish the quality assurance necessary to oversee the cybersecurity risk management project activities throughout the contract’s period of performance and fully achieve contract objectives.

• Provide an overall Quality Assurance Plan (QAP) covering all task areas required for this contract as part of their proposal. When accepted by the COR, the

Contractor shall operate under the QAP.

• Establish control, monitoring and notification mechanisms to ensure that contract activities and processes stay on track and important milestones are met. This includes meeting all deliverables on time and applying appropriate quality reviews and processes to ensure documentation is concise and accurate.

• Provide Strategic Leadership to ensure the contractor’s performance is focused on

Counterintelligence, and Insider Threat Program and security posture to protect the

FDA’s public health mission.

9.3 Personnel

The Contractor shall ensure that all Contractor support personnel are adequately trained, possess the credentials specified in the appropriate labor categories, and are otherwise fully qualified to provide the high level of support required by this SOW prior to being assigned to task orders awarded.

The Contractor shall assure that their personnel are trained in the agency’s software applications necessary to complete the contract tasks.

The Contractor shall assure that their personnel complete all required annual agency training (i.e. cybersecurity awareness training, records management training).

The Contractor shall assure that only FDA business is performed on FDA Government

Furnished Equipment and FDA Government site locations. Further, FDA work should only be performed on GFE.

The Contractor shall provide personnel with management authority at the government site.

Key Personnel:

Program Manager

Provides overall management support for the task orders to ensure all projects move together toward meeting established goals and objectives. The Program Manager aligns work activities following PMBOK standards. This person provides strategic leadership that identifies and recommends opportunities to advance the FDA’s Cybersecurity

Program. Implements active communications between the contractor’s team and government team. Performs research activities for effective planning of project activities.

Quickly identifies and corrects contract deficiencies in work product and personnel issues. Implements quality management of deliverables and ad hoc reports. Possesses the necessary skills to develop and edit executive-level reports and presentations for executive-level audience such as the FDA Commissioner, FDA COPs Directors, FDA

Chief Information Officer, and the FDA Chief Information Security Officer.

Certifications: PMP

Experience: Minimum, 10 years managing enterprise cybersecurity capabilities including

3 years with a large (minimum 20,000 user base) federal agency focused on delivery of a mature cybersecurity to meet presidential Executive Orders, the Federal Information

System Modernization Act 2014 and the NIST federal Cybersecurity Framework (CSF).

Minimum, 15 years managing Information Technology projects and programs.

Demonstrated expertise communicating throughout all levels of an organization, from peers to senior level managers on complex Information Technology Cybersecurity solutions.

Technical Writer – Level 2

Experienced in developing life-cycle, project management, and information technology documents to meet Enterprise Performance Life Cycle framework. Experienced in translating technical information into written documents and presentations for executive-level audience such as the FDA Commissioner, FDA COPs Directors, FDA Chief

Information Officer, and the FDA Chief Information Security Officer.

Minimum, five (5) years in Information Technology projects and programs.

Demonstrated expertise communicating throughout all levels of an organization, from peers to senior level managers on complex Information Technology Cybersecurity solutions.

10 Place of Performance

Most FDA COPs operate predominantly in the Washington, DC Metropolitan area with concentrations in the FDA's Maryland locations of Bethesda, College Park, Laurel, Landover, Rockville, and White Oak. The contractor may be requested to travel to FDA office outside the Washington, DC metropolitan offices.

The FDA will support a contractor’s remote workforce program if the program meets the follow criteria:

1. The contractor shall have a remote workforce program that includes rules of behavior.

2. The contractor shall coordinate with the COR the number of days per week per person. The number of remote workdays may be up to five

(5) days per week.

3. Per the COR, the contractor shall agree on the percentage of staff present on site always unless travel safety issues are identified (e.g., weather).

4. The contractor shall maintain all meeting obligations onsite.

5. The contractor shall reduce or eliminate the use of the contractor’s remote workforce program for this contract at the request of the government.

SECURITY AND PRIVACY REQUIREMENTS

Cybersecurity and/or Physical Access Security Section

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A

Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical

(electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of

“information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services

(including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and

Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the

FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC)

Commented [NS1]: Please replace this with the latest contract document.

within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Cybersecurity, Counterintelligence, and Insider Threat

Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy

Protection Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information

Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors

(Confidentiality, Integrity, and Availability) of the information or information system are the following:

NOT APPLICABLE – Contractor will be assessing applications but not creating an application.

The eGRC solution is RSA Archer and has a rating of:

Confidentiality: [ ] Low [ ] Moderate [X] High Integrity: [ ] Low [ ] Moderate [X] High

Availability: [ ] Low [X] Moderate [ ] High Overall Risk Level: [ ] Low [ ] Moderate [X] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [x] Yes PII

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ]

High http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The

Contractor (and/or any subcontractor) must comply with Executive Order

13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81

Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy

Controls for Information Systems and Organizations

d. applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified

Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

e. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with

NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix

T: Sanitization of Computer-Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive by securing it with a FIPS 140-3 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The contractor assumes responsibility for protection of the confidentiality of

Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-21.07, Completing the Transition to Internet Protocol Version 6 (IPv6).

7) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol

Secure (HTTPS) using the most recent version of Transport Layer Security

(TLS). In addition, HTTPS shall enable HTTP Strict Transport Security

(HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

8) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

9) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing

Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-3 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet

HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-

3. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398

Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The

Contractor shall assist the procuring activity representative, program office, and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA

SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy

Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an

Authorization to Operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance

Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first. Note: PTAs and Internal PIAs are reviewed as part of the security authorization process but are not required to be reapproved on the three-year cycle and are only required to be updated and reapproved upon a major change.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Cybersecurity Awareness Training, Privacy, and Records

Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA

Commented [HD2]: Should mention: PTAs and Internal PIAs are reviewed as part of the SA&A process but are not required to be reapproved on the three-year cycle and are only required to be updated and reapproved upon a major change.

http://inside.fda.gov:9003/downloads/administrative/forms/fda/ucm013733.pdf http://inside.fda.gov:9003/downloads/administrative/forms/fda/ucm013733.pdf

Cybersecurity Awareness Training, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and

FDA Role-Based Training (RBT) of Personnel with Significant Security

Responsibilities Standard Operating Procedures (SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology

General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the

Rules of Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Cybersecurity Awareness

Training.