Attachment_2_(Security_Requirements).pdf

ATTACHMENT 2 – SECURITY REQUIREMENTS

1. INFORMATION PROTECTION

The Contractor's employees, facilities, services and product(s) shall meet applicable United States (U.S.)

federal government directives, executive orders, guidelines, standards and other requirements for information security, personnel security, physical security, data encryption and procedures for proper handling of Sensitive but Unclassified (SBU) and Personally Identifiable Information (PII). The Contractor may be required to assist with security reviews by providing information about processes, software, facilities, personnel, and equipment through interviews, on-site inspections (if necessary), and documentary evidence.

Information systems and services performing work on behalf of the Fiscal Service shall be located, operated and maintained within the U.S.; operations and maintenance of systems shall be conducted by personnel physically located within the U.S or its territories. Operated means administrator/privileged user functions such as database administration, patching, upgrades and maintenance. No administrator/elevated access is permitted from outside of the U.S. Foreign remote maintenance, systems monitoring, foreign “call service centers,” “help desks,” and the like are prohibited. Fiscal Service information shall be accessed only by personnel meeting or surpassing the Treasury citizenship requirements (as determined by Personnel Security, see section 3 below). Extra cautions should be in place for other types of access from foreign locations.

Work shall be performed on systems secured at least at a FIPS 199 “LOW RISK” security category level.

Contracts and/or task orders for the acquisition of information systems or services processing sensitive information for Fiscal Service shall clearly specify the delivery date of an acceptable Security Assessment & Authorization (SA&A) or similar security assessment package as may be prescribed by Fiscal Service.

The Contractor shall grant access to Fiscal Service to review any existing SA&A documentation.

When needed per Fiscal Service direction, the Contractors and Fiscal Service officials shall prepare an Interconnection Security Agreement (ISA) prior to connecting to external information systems and in accordance with Fiscal Service processes.

The Contractors and subcontractors who require access to Fiscal Service information or information systems will be required to review and sign rules of behavior and complete security awareness training prior to being granted access. For the first 60 days of user access, reviewing and signing the Rules of Behavior is adequate for meeting the security awareness training requirement. Security and Privacy training will be required on a recurring annual basis, of all contractor and subcontractor staff performing work for Fiscal Service on a recurring annual basis. (Training can be taken online and typically takes two hours per year to complete.) When necessary due to contract sensitivity level as determined by Fiscal Service Personnel Security, Contractors and subcontractors will be required to sign Non-disclosure agreements.

Any computer equipment used by or on behalf of the Fiscal Service shall support Transport Layer Security (TLS) v1.0 or greater unless predetermined to be a standalone system.

The Contractor shall be subject to periodic audits and reviews, as required by law. The Contractor shall provide reports with findings that result from audits and reviews to the Fiscal Service within five business days of receipt. Within 15 business days, the Contractor shall propose a response and a plan of action with milestones. The Contractor shall resolve all findings prior to recurrence, and the contract shall include financial disincentives for repeat findings.

The Contractor may be required to provide the Fiscal Service access to, and information regarding systems the contractor operates on behalf of the Fiscal Service as part of its responsibility to ensure compliance with security requirements. Fiscal Service access may include independent validation testing of controls, system penetration testing FISMA data reviews, and access by agency Inspector General for its review.

Attachment 2 (TFSAFSA15CI0013)

The Contractor shall allow for physical inspection of facilities by the Fiscal Service or representatives within 30 calendar days of a Fiscal Service request. The Contractor may propose to limit the number of physical inspection requests from the Fiscal Service; the limit shall not be less than two times per calendar year. In addition to scheduled visits at the request of the Fiscal Service, the Contractor shall allow scheduled physical inspections in support of Security Assessment & Authorization and physical inspections on demand in the event of a computer security incident. A computer security incident is defined as any adverse event that threatens computer security and may include but is not limited to: loss of data confidentiality, disruption to data or system integrity, and denial of availability.

The Contractor shall report any suspected security incident by phone to the Fiscal Service IT Service Desk within one hour of identification of a suspected security incident: 304-480-7777.

The Contractor shall destroy all PII information, obtained under this contract, from contractor-owned information technology assets. Certification of data destruction will be performed by the contractor’s Project Manager and written notification confirming certification will be delivered to the contracting officer within 15 days of termination/expiration of contractor work.

2. SUBCONTRACTORS

Subcontractors shall meet applicable U.S. federal government standards and requirements for information security, personnel security, physical security, data encryption and procedures for proper handling of Personally Identifiable Information (PII) in addition to information protection requirements covered in this attachment.

3. THE BUREAU OF THE FISCAL SERVICE (BFS) PERSONNEL SECURITY AND SUITABILITY

REQUIREMENTS FOR CONTRACTORS AND SUBCONTRACTORS WHEN HSPD-12 IS NOT

APPLICABLE AND THE SENSITIVITY IS EVALUATED AS “LIMITED RISK”.

This contract was evaluated by Bureau Personnel Security as "Limited Risk" and does not meet the HSPD-12 duration requirement nor does it meet the investigative requirements. The HSPD-12 credentialing process/background investigation process is not applicable to the contractor personnel working on this contract. No action is needed at this point by the contractor.

If it is further determined that accessed government information warrants a higher sensitivity, then a higher level background investigation will be conducted. During performance of the contract, the Contractor will keep the COR apprised of any changes in personnel to ensure that work performance is not delayed by compliance with credentialing process.

4. FEDERAL REGULATORY REQUIREMENTS AND INDUSTRY STANDARDS

The Contractor's performance and systems shall comply with the most current versions of the following applicable Federal and industry information technology regulatory requirements and standards. For purposes of this acquisition, the highlighted documents are most relevant:

Federal Information Security Management Act of 2002 (FISMA) FIPS 140-2, Security Requirements for Cryptographic Modules FIPS 191, Guideline for the Analysis of Local Area Network Security FIPS 199, Standards for Security Categorization of Federal Information and Information Systems FIPS 200, Minimum Security Requirements for Federal Information and Information Systems FIPS 201-1, Personal Identity Verification for Federal Employees and Contractors Fiscal Service Baseline Security Requirements (BLSRs) National Institute of Science and Technology (NIST) SP 800-12, An Introduction to Computer Security - The NIST Handbook NIST SP 800-16, Information Technology Security Training Requirements: A Role and Performance Based Model NIST SP 800-18, Guide for Developing Security Plans for Information Technology Systems

NIST SP 800-27, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), Revision A NIST SP 800-28, Guidelines on Active Content and Mobile Code NIST SP 800-30, Guide to Conducting Risk Assessments NIST SP 800-34, Contingency Planning Guide for Federal Information Systems NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View NIST SP 800-40, Procedures for Handling Security Patches NIST SP 800-41, Guidelines on Firewalls and Firewall Policy NIST SP 800-42, Guideline for Network Security Testing NIST SP 800-45, Guidelines for Electronic Mail Security NIST SP 800-46, Security for Telecommuting and Broadband Communications NIST SP 800-47, Security Guide for Interconnecting Information Technology Systems NIST SP 800-48, Wireless Network Security NIST SP 800-50, Building an Information Technology Security Awareness and Training Program NIST SP 800-52, Guidelines for Selection and Use of Transport Layer Security NIST SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations NIST SP 800-55, Performance Measurement Guide for Information Security NIST SP 800-58, Security Considerations for Voice Over IP Systems NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories NIST SP 800-61, Computer Security Incident Handling Guide NIST SP 800-63-1, Electronic Authentication Guideline NIST SP 800-68, Guidance for Securing Microsoft Windows XP Systems for IT Professionals: A NIST Security Configuration Checklist NIST SP 800-70, National Checklist Program for IT Products – Guidelines for Checklist Users and Developers NIST SP 800-77, Guide to IPSec VPNs NIST SP 800-81, Secure Domain Name System (DNS) Deployment Guide NIST SP 800-83, Guide to Malware Incident Prevention and Handling NIST SP 800-88, Media Sanitization Guide NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS) NIST SP 800-100, Information Security Handbook: A Guide for Managers NIST SP 800-114, User's Guide to Securing External Devices for Telework and Remote Access NIST SP 800-115, Technical Guide to Information Security Testing and Assessment NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) NIST SP 800-125, Guide to Security for Full Virtualization Technologies NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing NIST SP 800-145, A NIST Definition of Cloud Computing NIST SP 800-147, Basic Input/Output System (BIOS) Protection Guidelines NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs) Office of Management and Budget (OMB) Circular A-123, Management Accountability and Control OMB Circular A-130, Management of Federal Information Resources OMB M-04-04, E-Authentication Guidance for Federal Agencies OMB M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors OMB M-06-16, Protection of Sensitive Agency Information OMB M-07-11, Implementation of Commonly Accepted Security Configurations for Windows Operating Systems OMB M-07-16, Safeguarding Against and Responding to the Breach of PII OMB M-07-18, Ensuring New Acquisitions Include Common Security Configurations

OMB M-99-20, Security of Federal Automated Information Resources Public Law 93-579, The Privacy Act of 1974 TD P 85-01 -Treasury Information Technology Security Program TD P 15-71 - Department of the Treasury Security Manual

New regulatory requirements and standards shall be adhered to as they are enacted or become effective, as applicable. The Contractor shall implement a process to support timely compliance with new requirements imposed by external authorities.

The Contractor shall comply with both Fiscal Service and Treasury requirements that extend above federal government and industry information technology regulatory requirements and standards. For example, Treasury has implemented more stringent security requirements in the Treasury Security Manual, TD P 85-01, than is typical for the federal government or the general information technology community. There are approximately 100 additional security control extensions in a variety of areas that go beyond NIST SP 800-53 guidance.

5. BUREAU OF THE FISCAL SERVICE IT RULES OF BEHAVIOR

The Contractor shall sign the IT Rules of Behavior. See attachment herein.

6. PROPOSAL INSTRUCTIONS IN REGARD TO READING ROOM (SECURITY CONTROL REVIEW)

Prior to proposal submission, the offeror may schedule an appointment to review documentation for the security control requirements. Due to the security sensitive nature of this documentation, the Fiscal Service will not release this information as part of a Request for Proposals. Appointments will be scheduled for three (3) hour blocks based on Fiscal Service’s representative’s availability if needed.

Documentation reviews will be conducted in Hyattsville, MD in Treasury offices. To schedule a security control requirements documentation review, the offeror shall contact the Contract Specialist (Steve Nulter) at steven.nulter@fiscal.treasury.gov prior to solicitation closing to schedule any such appointment.

The offeror shall be permitted to send a maximum of three (3) staff to review documentation. The offeror’s staff performing documentation review shall be U.S. Citizens. The offeror shall provide the Fiscal Service with the full name, for each staff member the offeror plans to send to review documentation. A signed Fiscal Service Security Controls Rules of Behavior Agreement and a signed Non-disclosure Agreement is required prior to the review. This information shall be provided to the Contract Specialist (Steve Nulter) at steven.nulter@fiscal.treasury.gov no later than 1:00PM (ET) at least five (5) Government business days prior to the scheduled appointment.

The offeror’s staff members who have not supplied the requested information will not be permitted to review security control requirements documentation. The offeror’s staff shall present a photo ID issued by a federal or state government organization when they arrive to review documentation. The name on the photo ID must match the name previously provided to Fiscal Service. The offeror staff will be escorted and will not be permitted to remove copies of any documentation.

The offeror shall provide Fiscal Service with the full name, for each staff member, subcontractor, or others whom the offeror intends to grant access to information about security control requirements; the offeror shall provide this information to Fiscal Service at least five (5) Government business days prior to scheduled reading room access appointment. All persons provided access to information about security control requirements by offeror shall be US citizens. The offeror shall not permit any individuals of whom Fiscal Service does not approve to have access to security control requirements information.

If the offeror intends to send staff with portable electronic devices (PEDs), the offeror shall provide Fiscal Service with the name of the encryption software product and the version number of the software at the time appointments are scheduled -- before 4:00 PM Eastern Time at least five (5) Government business days prior to scheduled reading room access appointment. Fiscal Service will not permit notes about security control requirements to be made using any unencrypted PED. Fiscal Service will confirm FIPS

140-2 validation and inspect PEDs. Should an offeror arrive with a PED that does not have FIPS 140-2 validated full disk encryption software in use, the Fiscal Service will not permit the PED to be used.

7. SECURITY CONTROL IMPLEMENTATIONS

The offeror shall explain in proposal how the offeror plans to secure Fiscal Service information in accordance with the requirements of this solicitation.

The offeror shall explain in proposal their process to support timely compliance with new security requirements and standards imposed by external authorities.

DEPARTMENT OF THE TREASURY

BUREAU OF THE PUBLIC DEBT

DATE: January 23, 2006

SUBJECT:

Department of the Treasury (Treasury), Bureau of the Public Debt (Public Debt) Information Technology (IT) Security Rules of Behavior.

PURPOSE:

Pursuant to Treasury Directive 85-01, these rules ensure that “Public Debt IT system users” (USERS) are made aware of their security responsibilities before accessing Public Debt’s IT resources. All USERS are required to read and sign these rules acknowledging their responsibilities in protecting Public Debt’s IT systems and data. Noncompliance with these rules may result in termination of access privileges, administrative actions, and/or criminal prosecution if warranted.

SCOPE:

This standard is applicable to all USERS who access IT systems where Public Debt information is processed, transmitted, and stored. For the purpose of this document, USERS are defined as employees, contractors, FRB staff, or others who are granted access to Public Debt operated IT systems for performing work. At Public Debt's discretion, individuals who have access to Public Debt IT systems may not be considered USERS under this definition and as such may not be required to sign these Rules of Behavior.

In addition to the rules and requirements contained within this document, USERS should note that other federal laws and regulations apply when accessing Public Debt IT resources (i.e., licensing agreements and copyright laws), but are considered outside the scope of this document.

RULES OF BEHAVIOR:

USERS MUST:

ACCESS:

• Not read, alter, insert, copy, or delete any Public Debt data except in accordance with assigned job responsibilities. Ability to access data does not equate to authority to manipulate data. In particular, USERS must not browse or search Public Debt data except in the performance of authorized duties.

• Notify their Supervisor when access to IT resources is no longer required, and make no further attempts to access the resources.

• Protect Public Debt IT systems and networks. Dial-in or other remote access to Public Debt systems and networks is prohibited, unless specifically authorized in a manner approved by the Network Security Officer (NSO).

ACTIONS:

• Not attempt to circumvent any Public Debt IT security control mechanisms. Reverse engineering or tampering with IT resources is prohibited.

• Protect Public Debt equipment, software, and data from loss, theft, damage, and unauthorized use or disclosure.

• Protect the confidentiality, integrity, and availability of all information.

• Not view, send, retain, or reproduce content that is fraudulent, harassing, or obscene in nature.

AWARENESS:

• Understand that the use of Public Debt IT resources gives consent for monitoring and security testing to ensure proper security procedures and appropriate usage are being observed.

• Complete IT security awareness, training, and education as required by Treasury and Public Debt policies.

• Become knowledgeable about Public Debt IT policies and standards. As systems change, USERS are required to seek additional information from sources such as their Information System Security Representative (ISSR), the Information System Security Officer (ISSO) for specific systems, the Public Debt Information Technology Security Manual (ITSM), or the IT Security Zone on PDWeb in order to ensure current policies and procedures are followed.

EMAIL:

• Not access any external (non-Public Debt) email account from any Public Debt IT resource, except where the Network Security Officer (NSO) has approved a written request from the Division Director or higher level supervisor of the requestor.

• Not subscribe to email lists that generate incoming non-work-related email such as “joke of the day” or

“recipe of the day.” Work related email newsletters are permitted.

EQUIPMENT & SOFTWARE:

• Understand that any unauthorized use of government owned or non-government owned hardware or software on any Public Debt IT resource (network, workstation, laptop, wireless devices, etc.) is prohibited. If the use of non-standard items is necessary, a written request from the Division Director or higher level management official must be approved by the Network Security Officer (NSO) before such items are used on Public Debt IT resources.

• Report improper or suspicious use of Public Debt equipment (viruses, unauthorized access, theft, inappropriate use, etc.) and any known or suspected breaches of IT security to their supervisor and the Public Debt IT Service Desk at 304-480-7777 immediately after discovery of the occurrence.

• Not use Public Debt IT resources (including but not limited to email, fax machines, and copiers) to produce chain letters.

• Comply with guidance on limited personal use of Government office equipment.

PASSWORDS:

• Follow proper logon/logoff procedures: don’t divulge account access procedures to any unauthorized user, don’t disclose password to other people, don’t allow someone else to watch as USERS enter passwords to logon, and logoff of systems.

• Understand and follow the rules and recommendations for password protection as stated in the Public

Debt IT Security Manual (Chapter 6) and the Department of the Treasury Security Program TD P 85- 01 (5.1.1) and agree to use only the User-ID for which they are authorized.

ACCEPTANCE

I agree to follow the Public Debt information technology (IT) Security Rules of Behavior. By signing this Acceptance, I acknowledge that I have read and am aware of the security rules and regulations contained in this document. I understand that violation of these rules may be grounds for administrative and/or disciplinary action by Public Debt and may result in, actions up to and including, termination of employment or prosecution under federal law.

User’s Name: ______________________________________________(printed)

User’s Name: ______________________________________________(signed)

Date: _____________________________ ftp://ntpdweb/oais/aDoc/aAissb/aISSRs/issrlist.pdf ftp://ntpdweb/oais/aDoc/aAissb/aISSRs/issrlist.pdf http://ntpdweb/OIT/security/itsm.htm http://ntpdweb/OIT/security/default.htm http://ntpdweb.bpd.treas.gov/rrp/dodont9.pdf http://ntpdweb/OIT/security/itsm.htm

Security Controls Rules of Behavior Agreement

Bureau of the Fiscal Service Security Controls Rules of Behavior Agreement

I, ____________________________, hereby consent to the terms in this Agreement in consideration of my being granted conditional access to certain United States Government documents or material containing sensitive but unclassified information. I understand and agree to the following terms and conditions:

Upon signing this Security Controls Rules of Behavior and a Non-Disclosure Agreement, I will be permitted access to official Bureau of the Fiscal Service documents containing sensitive but unclassified information related to security controls and understand that no copies may be made from the originals.

Any notes I take during the course of such access shall be provided to Fiscal Service for review prior to my departure. I shall not allow any individuals access to security control requirements information without Fiscal Service’s approval and the individual’s signed ‘Security Controls Rules of Behavior’ (this information includes notes Fiscal Service permits to leave the controlled Reading Room appointment area along with notes and working papers created after the review appointment).

If I take any notes during the security control requirement documentation review using a portable electronic device (PED), such as but not limited to a laptop computer, the PED shall have FIPS 140-2 validated full disk encryption in use.

At no time will I transmit, transport, process, or store information about security control requirements in any location located outside of the United States.

I will return all paper copies of any notes about the security control requirements, including notes and working papers created after the security control requirement documentation review appointment, to Fiscal Service with my proposal or when I determine a proposal will not be submitted. I will destroy all electronic copies of any notes relating to security control requirements in accordance with NIST SP 800- 12 and NIST SP 800-88. I will include in my proposal a notice to the Fiscal Service attesting to such file destruction; should I not make a proposal, I will send notice to the Fiscal Service attesting to the destruction of the files.

I make this Agreement in good faith, without mental reservation or purpose of evasion.

Printed Name

Signature Date

Bureau of the Fiscal Service Conditional Access to Sensitive but Unclassified Information

Non-Disclosure Agreement

I, ____________________________, hereby consent to the terms in this Agreement in consideration of my being granted conditional access to certain United States Government documents or material containing sensitive but unclassified information.

I understand and agree to the following terms and conditions:

1. By being granted conditional access to sensitive but unclassified information, the United States Government has placed special confidence and trust in me and I am obligated to protect this information from unauthorized disclosure, in accordance with the terms of this Agreement.

2. As used in the Agreement, sensitive but unclassified information is any information the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Title 5 U.S.C. 522a, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.

3. I am being granted conditional access contingent upon my execution of this Agreement for the sole purpose of . This approval will permit me conditional access to certain information, and/or to attend meetings in which such information is discussed or otherwise made available to me.

4. I will never divulge any sensitive but unclassified information that is provided to me pursuant to this Agreement to anyone unless I have been advised in writing by Bureau of the Fiscal Service or in the case of bureau sensitive but unclassified information released to the Office of Inspector General (OIG) or Treasury Inspector General for Tax Administration (TIGTA), in accordance with a written arrangement related to the official audit/investigative functions of the OIG or TIGTA for that particular matter). Should I desire to make use of any sensitive but unclassified information, I will do so in accordance with paragraph 6 of this Agreement. I will submit to Bureau of the Fiscal Service for security review, prior to any submissions for publication, any book, article, column or other written work for general publication that is based upon any knowledge I obtained during the course of my work on to ensure that no Bureau of the Fiscal Service sensitive but unclassified information is disclosed.

5. I hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may result from any disclosure, publication, or revelation of sensitive but unclassified information not consistent with the terms of this Agreement.

6. Upon signing this non-disclosure agreement, I will be permitted access to official Bureau of the Fiscal Service documents containing sensitive but unclassified information and understand that any copies shall be protected in the same manner as the originals. Any notes taken during the course of such access shall also be protected in the same manner as the originals.

7. If I violate the terms and conditions of this Agreement, I understand that the unauthorized disclosure of sensitive but unclassified information could compromise Bureau of the Fiscal Service security.

8. If I violate the terms and conditions of this Agreement, such violation may result in the cancellation of my conditional access to sensitive but unclassified information. This may serve as a basis for my being denied conditional access to Bureau of the Fiscal Service or other Treasury bureaus’ information, both classified and sensitive but unclassified information in the future. If I violate the terms and conditions of this Agreement, the United States may institute a civil action for damages or any other appropriate relief. The willful disclosure of information to which I have agreed herein not to divulge may constitute a criminal offense.

9. Unless and until I am provided a written release by Bureau of the Fiscal Service from this Agreement or any portions of it, all conditions and obligations contained in this Agreement apply both during my period of conditional access, which shall terminate at the conclusion of my work on , and at all times thereafter.

10. Each provision of this Agreement is severable. If a court should find any provisions of this Agreement unenforceable, all other provisions shall remain in full force and effect.

11. I understand that the United States Government may seek any remedy available to it to enforce this Agreement, including, but not limited to, application for a court order prohibiting disclosure of information in breach of this Agreement.

12. By granting me conditional access to information in this context, the United States Government does not waive any statutory or common law evidentiary privileges or protections that it may assert in any administrative or court proceeding to protect any sensitive but unclassified information to which I have been given conditional access under the terms of this Agreement.

13. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or liabilities created by Executive Order 12958, as amended; Section 7211 of Title 5, United States Code (governing disclosures to Congress); Section 1034 of Title 10, United States Code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by members of the military); Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 USC 421 et seq.)(governing disclosures that could expose confidential Government agents), and the statutes that protect against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, and 952 of Title 128, United States Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 USC Section 783 (b)). The definitions, requirements, obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement and are controlling.

14. My execution of this Agreement shall not nullify or effect in any manner any other secrecy or nondisclosure Agreement which I have executed or may execute with the United States Government except within the Department of the Treasury as noted in item 8, above.

15. I make this Agreement in good faith, without mental reservation or purpose of evasion.

Name and Date

Signature

This Agreement was accepted by the undersigned on behalf of Bureau of the Fiscal Service as a prior condition on conditional access to sensitive but unclassified information. Further release to any other third party requires execution of a nondisclosure agreement.

When information is shared with the Office of Inspector General or the Treasury Inspector General for Tax Administration, for official audit/investigative purposes, the following statement shall be added below the signature line. “This Agreement was accepted by the undersigned on behalf of Bureau of the Fiscal Service and (the Office of Inspector General or Treasury Inspector General for Tax Administration, as applicable) for conditional access to sensitive but unclassified information. Further release and dissemination of Bureau of the Fiscal Service sensitive but unclassified information under this non-disclosure agreement shall be in accordance with a written arrangement related to the official audit/investigative functions of the OIG or TIGTA for that particular matter. Further release to any other third party requires execution of a nondisclosure agreement.”

Bureau of the Fiscal Service Official and Date

(When applicable OIG or TIGTA signatory) and Date