_Statement_of_Work_-_FCHS2_Attachment_2_Authorities_and_Prohibitions.docx

Section C – Statement of Work Attachment 1 Authorities and Prohibitions

The Statement of Work (SOW) Attachment 2 identifies applicable laws, policies, directives, regulations, standards, and guideline authorities and prohibitions related to the products and services offered under the Foundation Cloud Hosting Services or FCHS2 contract.

1 Department of the Interior Policies and Directives The following are Department of the Interior cloud related policies and directives all DOI bureaus and offices comply.

· Department Manual Series 02 Part 112, Chapter 24 – OCIO Oversight Responsibilities

· OCIO Directive 2018-006 DOI Privacy Threshold Analysis Guide

· DOI Secretary Order 3340 Strengthening and Securing Information Management and Technology at the Department of the Interior (FITARA compliance), August 2016

· DOI Mandatory Use of Cloud Contracts Policy Aug 2018

· OCIO Pre-approved Enterprise and Mandatory Use Cloud Contracts Sept 2020 (addendum)

· OCIO Cloud Definition and Registration Policy Apr 2021

1.1 Federal Authorities

The FCHS2 contract is a federal wide procurement umbrella provisioned to acquire cloud services, either positioned “Ready” or already “Authorized” according to the 2019 Federal Cloud Computing Strategy – Cloud Smart, a long-term, high-level strategy to drive cloud adoption in Federal agencies. FCHS2 shall offer Cloud Smart services that focus on three inter-related areas to drive cloud adoption through building knowledge in government and removing burdensome policy barriers.

Table of Cloud Smart Adoption Areas

1.2 National Institute of Standards Technologies

Task orders under FCHS2 shall align and meet minimum Risk Management Framework thresholds according to the IT System(s) categorization level (Low, Moderate, High) and relative Security and Privacy Controls.

Contractors shall identify barriers or incidences in task order proposals that do not meet NIST standards and thresholds, along with recommendations for closing elevated risk gaps.

FCHS2 task order services will have a wide range of service requests whether partial or full support services within the IT System life-cycle. Agencies may request just cloud service license and/or ongoing technical support for both managing the IT System Management and/or assisting with the Assessment & Authorization process.

Federal Information Security Modernization Act (FISMA) of 2014 requires federal agencies to develop, document, and implement an agency-wide program to provide information security for the information and systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other sources.

FCHS2 services shall align and meet minimum thresholds identified under the National Institute of Standards Technologies (NIST) publications including, but not limited to the following Special Publications (SP) identified below under the Risk Management Framework – Security Life Cycle diagram.

2 Applicable Laws and Executive Orders The following are the most common and applicable federal laws and executive orders aligned with the FCHS2 contract requirements. Contractors shall be familiar and within compliance of applicable federal laws and orders.

3 Prohibitions This section is related to various prohibitions within cloud services and contractors under the FCHS2 contract.

DOI requests contractors to refrain from and to actively prevent adware, spam, and remarketing of information. The Contractor shall not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the DOI. The Contractor and/or their agents shall not resell nor otherwise redistribute information gained from its access to FCHS2 contract users.

Contractors shall require each of their administrative employees that interfaces with the cloud services customized applications and government data to sign non-disclosure agreements at onset of project implementation. Non-disclosure agreements will be supplied by the Contracting Officer, or the Contractor may elect equivalent and approved alternative.

A government approved logon banner must be displayed on the first page of any public access web pages. Logon warning banners must be automatically incorporated into IT Systems initial logon process and require periodic credentialed acceptance for all (federal and contractor) personnel accessing the federal IT System.

image1.jpg