Section_H_-_DRAFT_Posting.docx

ExPRESS RFP TIB-2016-RFP-0002 DRAFT Section H – Special Contract Requirements

Table of Contents

ExPRESS RFP TIB-2016-RFP-0002 DRAFT Section H

ExPRESS RFP TIB-2016-RFP-0002 DRAFT Section H

H.1 INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY REQUIREMENTS FOR INFORMATION TECHNOLOGY CONTRACTS

H.1.A General

(a) For the purpose of this clause, “Contractor” shall include all Prime and Subcontractor organizations and their personnel

(b) All Contractors shall be subject to the same Federal laws (including the Privacy Act of 1974 and FISMA), regulations, standards (including FIPS 199 and 200), and FRTIB policies as FRTIB, and FRTIB personnel regarding information and information system security. Contractors shall follow the FRTIB’s Risk Management framework, policies, and procedures outlined in FRTIB Directive 61 “Enterprise Information Security Program and Policy Authorization” [see Attachment J.2(f)], its associated policies and programs to include FRTIB’s Information Assurance Vulnerability Management Program, and its handbooks to ensure appropriate security controls are in place.

(c) These security requirements shall apply to all FRTIB, TSP, and Contractor systems used to access FRTIB or TSP systems, process FRTIB or TSP data, or to take custody of FRTIB or TSP data.

(d) Contractor has no reasonable expectation of privacy while performing work in support of the contract on any information system that processes, transmits, or stores FRTIB data. Information systems in support of processing, transmitting, or storing FRTIB data are to be used in support of FRTIB data only. All data contained on information systems in support of FRTIB is owned by the FRTIB and may be monitored, intercepted, recorded, read, copied, or captured in any manner and disclosed in any manner, by authorized personnel.

H.1.B Access to FRTIB Information and Information Systems

(a) Contractors shall request logical (technical) and/or physical access to FRTIB information and FRTIB information systems for employees only to the extent necessary: (1) to perform the services specified in the contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the contract, and (3) for individuals who first satisfy the same conditions, requirements and restrictions that comparable FRTIB employees must meet in order to have access to the same type of FRTIB information.

(b) The following are FRTIB’s approved policy exceptions for meeting FRTIB’s background screenings/investigative requirements for certain types of Contractors:

(1) Contract personnel not accessing FRTIB information resources such as personnel hired to maintain the facility grounds, construction contracts, utility system Contractors, etc.,

(2) Contract personnel with limited and intermittent access to equipment connected to facility networks on which no FRTIB sensitive information is available, such as Contractors who install, maintain, and repair building equipment such as fire alarms; heating, ventilation, and air conditioning equipment; elevator control systems, etc. If equipment to be repaired is located within sensitive areas (e.g. computer room/communications closets) they must be escorted while on site.

H.1.C Information Custodial Requirements

(a) Information made available to the Contractor by FRTIB for the performance or administration of this contract or information developed by the Contractor in performance or administration of the contract is FRTIB property and shall be used only for those authorized purposes and shall not be used in any other way without the prior written agreement of the Contracting Officer. This clause expressly limits the Contractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d)(1).

(b) FRTIB information shall not be co-mingled with any other data on the Contractors/subcontractors information systems/media storage systems in order to ensure FRTIB requirements related to data protection and media sanitization can be met. FRTIB also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization procedures to ensure they are in compliance with FRTIB policy requirements [see Attachment J.2(h)].

(c) Prior to termination or completion of this contract, Contractor shall not destroy information received from FRTIB or gathered or created by the Contractor in the course of performing this contract without prior written approval by the FRTIB Contracting Officer. Any data destruction done on behalf of FRTIB by a Contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in FRTIB Directive 28A, Records Management Directive, and the FRTIB’s Media Protection Policy [see Attachment J.2(i)].

(d) The Contractor shall receive, gather, store, back up, maintain, use, disclose and dispose of FRTIB information only in compliance with the terms of the contract and applicable Federal and FRTIB information confidentiality and security laws, regulations and policies. Applicable Federal information security regulations include Federal Information Processing Standards (FIPS) and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST). If Federal or FRTIB information confidentiality and security laws, regulations and policies become applicable to the FRTIB information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies, including FIPS or SP, in this contract.

(e) Contractors collecting, storing, or disseminating Personally Identifiable Information (PII) data shall conform to all pertinent regulations, laws, and FRTIB directives related to privacy. The Contractor shall only store PII data in FRTIB-owned applications and/or databases. Any exceptions to storing PII in FRTIB-owned application and/or databases must be approved by FRTIB. Pursuant to its requirements under the Privacy Act and its EISRM policies, the FRTIB will be conducting privacy reviews and assessments on any internal or external system which has FRTIB or TSP data. To that end, the FRTIB may require 1) immediate access to any non-FRTIB owned system with FRTIB or TSP data, 2) documentation relating to non-FRTIB owned systems, and 3) the ability to perform automated assessments of non-FRTIB owned systems.

(f) The Contractor shall not make copies of FRTIB information except as necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

(g) If FRTIB determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for FRTIB to terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) Part 12.

(h) Contractor shall store, transport or transmit FRTIB sensitive information in an encrypted form, using an FRTIB-approved technology or encryption application that meets the requirements of NIST’s FIPS 140-2 standard.

(i) Except for uses and disclosures of FRTIB information authorized by this contract for performance of the contract, the Contractor may use and disclose FRTIB information only in two other situations: (i) after notifying the FRTIB, in response to a qualifying order of a court of competent jurisdiction, or (ii) with FRTIB’s prior written approval. The Contractor shall refer all requests for, demands for production of, or inquiries about, FRTIB information and information systems to the FRTIB Contracting Officer for response.

(j) Notwithstanding the provision above, the Contractor shall not release PII records protected by the Privacy Act under any circumstances, including in response to a court order, and shall immediately refer such court orders or other inquiries to the FRTIB Contracting Officer for response.

(k) The Contractor shall not use technologies banned by FRTIB in meeting the requirements of the contract. See Attachment J.2 (g), FRTIB Banned Technologies.

H.1.D Information System Design and Development

(a) Information systems that are designed or developed for or on behalf of FRTIB at non-FRTIB facilities shall comply with all FRTIB policies developed in accordance with Federal Information Security Management Act (FISMA), NIST, and related FRTIB security and privacy control requirements for Federal information systems. This includes standards for the protection of information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization.

(b) During the analysis phase of the software development cycle, a Privacy Impact Assessment (PIA) will be completed, provided to the COR, and approved by the FRTIB Privacy Officer in accordance with the PTA/PIA Policies and Procedures, the FRTIB EISRM Policies and Procedures, and other applicable FRTIB policies.

(c) The security controls must be selected, and/or designed, developed, and implemented in accordance with the provisions of FRTIB security system development life cycle as outlined in NIST Special Publication 800-37 (see http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf) and FRTIB EISRM Policies. The controls will be specifically approved by the appropriate IAD staff. The Contractor shall provide to FRTIB a system security plan (SSP) that includes the approved security controls. The SSP will include the functions, ports, protocols, and services intended to support FRTIB under this contract.

(d) The Contractor shall be required to design, develop, or operate a System of Records on individuals to accomplish an FRTIB function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C.552a) and applicable FRTIB regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties. The Contractor agrees to –

(1) Comply with the Privacy Act of 1974 (the Privacy Act) and the FRTIB rules and regulations issued under the Privacy Act in the design, development, or operation of any system of records on individuals to accomplish an FRTIB function when the contract specifically identifies –

(i) The systems of records; and

(ii) The design, development, or operation work that the Contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Privacy Act; and,

(3) Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(e) In the event of violations of the Privacy Act, a civil action may be brought against the FRTIB involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an FRTIB function, and criminal penalties may be imposed upon the officers or employees of the FRTIB when the violation concerns the operation of a system of records on individuals to accomplish an FRTIB function. For purposes of the Privacy Act, when the contract is for the operation of a system of records on individuals to accomplish an FRTIB function, the Contractor is considered to be an employee of the FRTIB.

(f) Definitions for terms like system of records can be found in the Privacy Act of 1974.

H.1.E Information System Hosting, Operation, Maintenance or Use

(a) For information systems that are hosted, operated, maintained, or used on behalf of FRTIB at non-FRTIB facilities, Contractors are fully responsible and accountable for ensuring compliance with applicable Privacy Act, FISMA, NIST, FIPS, SP, and FRTIB security and privacy directives and handbooks to include monitoring under FRTIB’s Information Assurance Vulnerability Management Program. The Contractor security control procedures shall be identical, not equivalent, to those procedures used to secure FRTIB systems. A PIA shall also be provided to the COR and approved by FRTIB Privacy Office prior to operational approval. All external Internet connections involving non-FRTIB information systems shall be reviewed and approved by FRTIB prior to implementation.

(b) Adequate security controls for collecting, processing, transmitting, and storing of PII (as determined by the FRTIB Privacy Office), must be in place, tested, and approved by FRTIB prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of FRTIB. These security controls need to be stated within the PIA and supported by a risk assessment. The Contractor shall then produce a plan for the continuous monitoring of the effectiveness of their security controls to FRTIB for approval. If these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) shall be submitted and approved prior to the collection of PII.

(c) Outsourcing (Contractor facility/Contractor equipment/Contractor staff) of systems or network operations, telecommunications services, or other managed services requires an Assessment and Authorization (A&A) of the Contractor’s systems in accordance with NIST Special Publication 800-37, FRTIB EISRM Policies, and a PIA of the Contractor’s systems prior to operation of the systems. At the conclusion of the Assessment and Authorization of the Contractor’s information system(s), the Contractor’s Authorizing Official (Chief Information Officer, Chief Technology Officer, or equivalent) must authorize and provide a copy of the final authorization letter (as part of the final authorization package) to FRTIB. The final authorization package (as defined by NIST) to include the Security Categorization, Security Assessment Report (SAR), System Security Plan (SSP), Plan of Action and Milestones (POAM), Contingency Plan, PTA/PIA and authorization letter is due to FRTIB within 120 days of the issuance of the contract or modification of the existing contract for review and/or acceptance under reciprocity. After review of the authorization package, if FRTIB does not accept the authorization package as meeting the information security requirements of the ESIRM policies, FRTIB can terminate the contract or issue guidance to the Contractor which will allow them to be in compliance. The Contractor shall maintain updated A&A artifacts as necessary and will perform a re-authorization at least every three years. The Contractor shall provide copies of the authorization package(s) and artifacts to FRTIB at least every three years for review and/or acceptance. FRTIB-owned (FRTIB facility/FRTIB equipment) Contractor-operated systems, third party or business partner networks require a system interconnection agreement for all external connections and a memorandum of understanding (MOU) which detail what data types will be shared, who will have access, and the appropriate level of security controls for all systems connected to FRTIB networks.

(d) The Contractor shall adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment shall be provided to the FRTIB Contracting Officer and the designated Information System Security Officer (ISSO) for entry into FRTIB’s POA&M management process. The Contractor shall use FRTIB’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes approved by the FRTIB. Contractor procedures shall be subject to periodic, unannounced assessments by FRTIB officials. The physical security aspects associated with Contractor activities will also be subject to such assessments. As updates to the system occur, an updated PIA shall be submitted to the FRTIB Privacy Office through the COR for approval.

(e) All storage media used within non-FRTIB owned information systems that is used to store, process, or access FRTIB sensitive information shall have all FRTIB sensitive information removed, cleared, sanitized, or destroyed in accordance with FRTIB policies and procedures (including its Media Protection Policy) upon: (1) completion or termination of the contract or (2) disposal or return of the storage media by the Contractor or any person acting on behalf of the Contractor, whichever is earlier.

(f) FRTIB may monitor and audit any employee’s network activity or workstation use, which includes but is not limited to electronic communication, Internet access, local disk files and server files, that occurs on any equipment (contractor or government owned) that is used to process FRTIB data or that is used in support of this contract. Monitoring and auditing user activity is a means by which FRTIB ensures compliance with the ESIRM Policies and FRTIB policies. FRTIB performs continuous monitoring of all FRTIB information systems and devices used to process or transmit FRTIB data in order to ensure the integrity of FRTIB networks and systems. Activities found in the course of continuous monitoring that appear to be in violation of applicable law, regulation, or policy will be referred to the contracting officer and/or law enforcement officials as required. Continuous monitoring includes but is not limited to: review of audit logs of any networking device used to support FRTIB; review for inappropriate access and use of the Internet; review of electronic communication activity for inappropriate content; and review of any workstations or servers used to process FRTIB data (regardless if the workstation or server is owned by FRTIB or the Contractor).

H.1.F Security Incident Investigation

(a) The term “security incident” means an event that has resulted, or could result, in unauthorized access, loss, or damage to FRTIB assets; unauthorized access to sensitive information; or an action that breaches FRTIB security procedures. Even if outside regular business hours, the Contractor shall immediately, within one hour of first becoming aware, notify the COR and the designated Information System Security Officer (ISSO) for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor has access.

(b) To the extent known by the Contractor, the Contractor’s notice to FRTIB will identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the FRTIB information/assets were placed at risk or compromised), and any other relevant information available.

(c) The Contractor shall simultaneously report the incident to the appropriate law enforcement entities in instances of theft or break-in or other criminal activity. The Contractor, its employees, and its subcontractors and their employees will cooperate with FRTIB and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violations associated with any incident. The Contractor shall cooperate with FRTIB in any civil litigation to recover FRTIB information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from or related to the incident.

(d) The FRTIB shall have the right to participate in any investigation relating to a suspected or actual breach and, pursuant to such an investigation, shall have access to any and all related data including but not limited to affected files, systems, briefings, devices (including hard drives), and interim and final reports and analyses.

(e) To the extent practicable, the Contractor shall mitigate any harmful effects on individuals whose FRTIB information was accessed or disclosed in a security incident. In the event of a data breach with respect to any FRTIB Sensitive Information processed or maintained by the Contractor or subcontractor under the contract, the Contractor is responsible for consequential damages to be paid to FRTIB.

(f) Contractor shall bear the losses and expenses (including attorneys’ fees) associated with a data breach, including, without limitation, any costs (1) of providing notices of a data breach to affected individuals and to applicable regulatory bodies and (2) of remedying and otherwise mitigating any potential damage or harm of the incident, including, without limitation, establishing call centers, providing credit monitoring, or credit restoration services.

H.1.G Security Controls Compliance Testing On a periodic basis, FRTIB reserves the right to evaluate any or all of the security controls and privacy practices implemented by the Contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the FRTIB, the Contractor shall fully cooperate and assist in an FRTIB-sponsored security controls assessment at each location wherein FRTIB information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of FRTIB. The FRTIB may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by FRTIB in the event of a security incident or at any other time.

H.1.H Security and Privacy Training

(a) All Contractor employees and subcontractor employees requiring access to FRTIB information and FRTIB information systems shall complete the following before being granted access to FRTIB networks:

(1) Sign and acknowledge understanding of and responsibilities for compliance with the attached Rules of Behavior relating to access to FRTIB information and information systems;

(2) Successfully complete FRTIB Cyber Security Awareness training and annual refresher training as required;

(3) Successfully complete FRTIB General Privacy training and annual refresher training as required; and

(4) Successfully complete any additional cyber security or privacy training, as required for FRTIB personnel with equivalent information system access [to be defined by the FRTIB program official and provided to the Contracting Officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

(b) The Contractor shall provide to the Contracting Officer a copy of the training certificates or other proof of training for each applicable employee within one week of the initiation of the contract and annually thereafter, as required. It is the Contractor’s responsibility to ensure the FRTIB is notified of new staff members who require training.

(c) Failure to complete this mandatory training within the timeframe required will be grounds for suspension or termination of all physical and/or electronic access privileges and removal from work on the contract until such time as the training is completed.

H.1.I Contractor Requirements, Confidentiality and Non-Disclosure

(a) Contractor personnel will have access to privileged and confidential materials of the FRTIB. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of the FRTIB. These materials are protected by the Privacy Act of 1974 (revised by PL 93-5791). Unauthorized disclosure of Privacy Act covered materials is a criminal offense.

(b) The preliminary and final deliverables and all associated working papers, application source code, and other material generated by the Contractor in the performance of this SOW are the exclusive property of the FRTIB.

(c) The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this SOW. The Contractor shall release no information. Any request for information relating to this SOW presented to the Contractor shall be submitted to the CO for response.

(d) The Contractor recognizes that in the performance of this contract the Contractor may receive or have access to sensitive information, including information provided on a proprietary basis by other private or public entities. The Contractor agrees to safeguard these privileges and use the information exclusively in the performance of this contract. The Contractor shall follow all FRTIB rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

(e) The Contractor shall maintain approval documentation for their respective users which the Contractor granted network access while these users are employed. The Contractor shall maintain the network access approval documentation up until 180 days after the individual departs from the contract or is terminated from the contract. The Contractor shall make this documentation immediately available upon FRTIB request.

H.1.J Proprietary Information Requirement

(a) The Contractor may be required to negotiate agreements with commercial system vendors relating to non-disclosure of vendor-proprietary information. If the Contractor uses copyright or otherwise licensed software in any deliverable under this order, use will be based on the terms of the commercial license. In addition, the Contractor is required to pass all software licenses on to the FRTIB within 30 days after completion of the tasks.

(b) The Contractor shall limit access to the minimum number of employees necessary for order performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the order then the Contractor has a responsibility to ask the FRTIB representative.

(c) The Contractor shall instruct all personnel employed by the Contractor and any subcontractors involved in this order on their roles and responsibilities for proper handling and nondisclosure of sensitive FRTIB or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information.

H.1.K Security: Information System Security The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with FRTIB policies and standard operating procedures, conditions, laws, and regulations. The Contractor’s routers, switches, applications, databases, firewall and web servers shall meet or exceed the FRTIB minimum requirements for security. All FRTIB data shall be protected behind an approved firewall and other Data Loss Prevention (DLP) mechanisms. Any security violations or attempted violations shall be reported to the COR and to the designated ISSO as soon as possible. The Contractor shall follow all applicable FRTIB policies and procedures governing information security.

H.1.L Security Requirements for Unclassified Information Technology Resources

(a) The Contractor and their personnel shall be subject to the same Federal laws, regulations, standards and FRTIB policies as FRTIB personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), and NIST guidance and standards. This also includes the use of common security configurations available from NIST at: http://web.nvd.nist.gov/view/ncp/repository.

(b) To ensure that appropriate security controls are in place, Contractors shall follow the procedures set forth in the FRTIB’s EISRM policies which are in Section J.

H.1.M Service Organizational Control (SOC) Audits

(a) At least once every twelve months following the contract signing date, Contractor, at its own expense, shall cause to be conducted a SOC 1 Type 2 or SOC 2 Type 2 audit (or any successor standard) on its operations, including the operations of its affiliates and subcontractors, that are involved in the provision of the Services under this Contract. The SOC 2 Type 2 will include the attributes of security, availability, processing integrity, confidentiality and privacy. The SOC 1 Type 2 or SOC 2 Type 2 Audit shall be performed by an independent auditing firm registered and in good standing with the Public Company Accounting Oversight Board and any successor thereto. The time period covered for each annual SOC 1 Type 2 or SOC 2 Type 2 Audit shall be for October 1 through September 30. Contractor shall provide the FRTIB with the auditor’s scope, description of controls, testing results and opinion, as well as the auditor’s recommendations and any required planned or completed corrective actions; complete copies of such reports; and Contractor corrective action plans (if any) with committed delivery dates related to the results of such SOC 1 Type 2 or SOC 2 Type 2 Audit.

(b) If any SOC 1 Type 2 or SOC 2 Type 2 Audit as set forth above results in a qualified opinion, upon the first such occurrence, the Contractor shall perform such corrective plan in accordance with the committed delivery dates to successfully resolve the applicable deficiency.

H.1.N Physical Security and Environmental Controls The Contractor shall maintain physical security in accordance with NIST and EISRM requirements at all facilities housing the activities under this SOW, including any subcontractor facilities. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to sensitive data must comply with published procedures to protect the privacy and confidentiality of such information as required by FRTIB. The following clauses are outlined in accordance with NIST 800-53 and FIPS 201-2.

(a) Each facility must have a physical security and environmental protection policy and procedures. These policies and procedures should take into account and address internal and external threats to the facilities.

(b) The policy and procedures must be widely disseminated to ensure compliance, and reviewed on an annual basis. Updates shall be completed as needed.

(c) The facility must have physically secured perimeters, and external entry points must be suitably protected against unauthorized access by a Physical Access Control System (PACS). The PACS will be HSPD-12 compliant and capable of providing immediate management of access privileges, protection to sensitive areas (i.e. compartmentalization for highly sensitive projects), and immediate actions (i.e. access revocation/termination).

(d) Develop, approve, and maintain a list of individuals with authorized access to the facility where the information system resides.

(e) Issue authorization credentials for facility access.

(f) Review the access list detailing authorized facility access by individuals annually and update, as necessary.

(g) Upon separation or termination, access cards and/or keys must be collected immediately, and access profile must be deactivated within 24 hours. In the event that the access card cannot be recovered, access profile must be deactivated immediately.

(h) Public access areas shall have security controls in place to prevent unauthorized access.

(i) All locations must possess an Intrusion Detection System that is monitored 24/7 and has a guard response time of less than 5 minutes.

(j) Access to all locations must be limited to contract staff and authorized visitors.

(k) Visitors must sign a register and be escorted or observed at all times, upon each entry to and exit from the premises. The information recorded in the register must include:

(1) Name and organization of the person visiting

(2) Signature of the visitor

(3) Form of identification

(4) Date of access

(5) Time of entry and departure

(6) Purpose of visit

(7) Name and organization of person visited

(l) Out of hours access must be monitored, recorded and controlled. Logs detailing access must be stored for a period of 36 months or to the extent permitted by local law.

(m) All contract employees and authorized visitors must be issued identification cards. Identification cards must be visibly displayed between shoulders and waist, at all times, while on the premises.

(n) Visitor identification cards must be easily distinguishable from contract employees identification cards, and retrieved and inventoried daily.

(o) Contractor must monitor and manage the possession of access cards and keys to ensure access is limited to authorized personnel only.

(p) A clean desk policy must be enforced throughout all facilities where networks are accessed and/or information related to this contract is stored or accessed. The contractor will provide the means to secure sensitive information when not in use.

(q) Protect power equipment and power cabling for the information system from damage and destruction by:

(1) Limiting access to the power equipment.

(2) Ensuring protective conduits are used for housing the cabling where necessary.

(3) Ensuring power equipment and cabling are maintained according to local building codes.

(4) Inspect power equipment and cabling annually and update as necessary.

(r) Emergency Shut Off Switch:

(1) The contractor shall provide an emergency shut off switch to be used in the event of a fire, flood or other emergency. The switch must be in a location that facilitates safe and easy access, and does not endanger personnel when required to access it.

(2) An emergency shut off switch must be available in each location that contains concentration of information system resources, to include data centers, server rooms, and mainframe rooms.

(3) The emergency shut off switch must be protected from unauthorized activation due to accidental access by authorized personnel, or unauthorized access.

(s) Emergency Power Supply:

(1) The contractor shall provide a short-term stable power supply to facilitate an orderly shutdown of Information Systems in the event of a primary power source loss.

(2) The contractor shall provide a long-term alternate power supply (e.g., a generator) capable of maintaining minimally required operational capability for critical FRTIB information systems in the event of an extended loss of the primary power source.

(t) The contractor shall employ and maintain automatic emergency lighting that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes.

(u) The contractor shall employ and maintain devices/systems that automatically detect smoke, heat, and fire. These devices/systems must also activate local alarms for personnel evacuation, and notify emergency responders, FRTIB emergency personnel, and/or designated contractors.

(v) The contractor shall employ an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis.

(w) The contractor shall continuously monitor and maintain temperature and humidity levels within the facility where the information system resides at manufacturer recommended acceptable levels.

(x) The contractor shall protect the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.

(y) The contractor shall authorize, monitor, and control information system-related items or components exiting the facility. A detailed record of those items must be maintained.

(z) Alternate Work Sites:

(1) All contract employees shall employ appropriate physical and environmental security controls at alternate work sites, and outline them in telework agreements.

(2) The contractor shall assess, as feasible, the effectiveness of security controls at alternate work sites.

(3) The contractor shall establish procedures for contract employees to communicate with Information Security personnel in case of security incidents, or any other issues with alternate work sites or telework agreements.

H.1.O Change in Threat Levels or Interruption of Security Support Services If new or unanticipated man-made or natural threats or hazards are discovered or existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the designated point of contact within the facility. The Contractor will report real or suspected incidents or violations to the Contracting Officer’s Representative (COR), and local authorities, if appropriate. The notification process and any investigation and restoration efforts that may follow will be in accordance with section H.1.F(c).

H.1.P Personal Identification Verification Requirements At the FRTIB’s request, and with its guidance, the Contractor must be willing and able to provide staff with Personal Identification Verification (PIV) cards. These cards will be used for physical and logical access to information systems at a date to be determined by the FRTIB. To obtain this type of identification, all contract employees must complete, at a minimum, a Special Agreement Check. Upon favorable results are received contractor employees will make an appointment for enrollment, and provide two forms of identification as instructed in FIPS 201-2.

· U.S. Passport

· Green Card

· Foreign Passport (temp I-551 stamp)

· Employment Authorization Document (Form I-776)

· Driver’s License or State Issued ID card

· School ID with photograph

· U.S. Military card

· U.S. Coast Guard Merchant Mariner Card

· Military Dependent’s ID card

· Passport from Federated (Form I-94 or Form I-94A)

· Social Security Card

· Original or certified Birth Certificate

· Certification of Birth Abroad (Form FS-545)

· Certification of report of Birth (Form DS-1350)

· Voter’s Registration Card

· U.S. Citizen Card (From I-97)

· Employment Authorization issued by Homeland Security

· Identification Card (Form I-179)

· Native Tribal Document

· Canadian Driver’s license

Further enrollment instructions will be provided once process is established.

H.1.Q Personnel Security

(a) All Contractor staff assigned to work under this Contract shall be U.S. citizens or resident aliens with current valid green cards.

(b) Contractor shall not allow any of its employees to access FRTIB information and systems except to the extent that an employee needs access to facilitate work under this contract. Contractor shall coordinate with FRTIB to ensure that all such individuals are screened according to the EISRM policies and standards prior to being provided access to FRTIB information and systems. The Contractor shall follow FRTIB’s “Contractor Fitness Requirements” as defined by the Office of Resource Management. The level of screening required shall be dependent upon a risk designation assigned to this Contract and the individual’s responsibilities and access required to perform services. Contractor shall ensure that all individuals on the Contract are re-screened according to the policies and standards in FRTIB’s Personal Security program and EISRM program. Failure to coordinate these rescreening activities could result in individuals being denied access.

(c) Contractor shall notify the COR and designated FRTIB security administration functions of the termination of any individual assigned to work on this Contract not more than 2 hours after termination. Contractor shall retrieve any and all credentials, property, documentation, etc. from the terminated employee. Contractor shall ensure that at all times it retains complete control of Contractor- and FRTIB-owned information systems and information.

(d) Contractor shall notify the COR and designated FRTIB security administration functions of the transfer of any individual permanently assigned to work on this Contract between major Services functions not more than 2 business days after the effective date of the transfer.

(e) Contractor shall ensure that all individuals assigned to perform Services on this Contract periodically accept and sign Non-Disclosure Agreements, Rules of Behavior, and applicable Ethics Agreements.

(f) Contractor shall immediately (within 60 minutes) revoke all system access rights and restrict security (e.g., access badges) of its personnel who are no longer employed on this contract. Contractor shall provide documentation of its compliance with this requirement upon FRTIB request.

(g) For FRTIB review, Contractor shall maintain a system of sanctions against individuals who perform Services under this Contract for failure to comply with any Contractor or FRTIB security requirements.

H.2 NON-DISCLOSURE REQUIREMENTS

(a) Attachments J.2 (m)and (n) are required Non-Disclosure Agreements and it shall be completed by each Contractor (and Subcontractor) employee and delivered to the CO before performing work under this contract.

(b) Restrictions on Use, Disclosure, and Duplication of Confidential and Non-Public Information. Confidential and non-public information, for purposes of this clause is, but is not limited to, all financial, statistical, personnel, or technical data which is furnished, produced, generated, or otherwise available to the Contractor, during the performance of this contract. Unless otherwise specified, confidential and non-public information shall not be used for purposes other than performance of work under this contract without the prior written consent of the CO. The Contractor and its employees, agents, subcontractors, and subcontractor personnel are restricted from duplicating or disclosing confidential or non-public information, in whole or in part, outside FRTIB for purposes other than fulfillment of the requirements set forth in this contract. Any presentation of any confidential or non-public information, or any reports or material derived from confidential or non-public information shall be subject to CO review and approval prior to publication or dissemination. Any questions about whether information is confidential or non-public shall be referred to the CO and the designated ISSO to initiate review prior to its use, disclosure, or duplication.

(c) Non-Disclosure Agreement For Confidential And Non-Public Information. Section 5 CFR 2635.703 and the Privacy Act of 1974 (5 U.S.C. § 552a) expressly prohibit unauthorized disclosure and improper use of confidential or non-public information or documents. The Contractor and its employees, agents, subcontractors, and subcontractor personnel who will have access to confidential or non-public information or documents in the performance of the contract, agree to be bound by Section 5 CFR 2635.703 and the Privacy Act of 1974 (5 U.S.C. § 552a) and the terms set forth in the attached Non- Disclosure Agreements (Attachment J.2 (q)). The Contractor and all personnel assigned to the contract agree not to divulge any non-public or confidential information obtained from the FRTIB in performance of their duties under the contract without the prior written consent of the FRTIB. Violation of this clause by the Contractor or its employees, agents, subcontractors, or subcontractor personnel may result in termination of the contract, and/or civil suits, and/or criminal prosecution.

(d) Non-Disclosure Agreements and Federal Employees. Federal Employees are prohibited from disclosing confidential contractor information by 18 U.S.C. § 1905. Further, any confidential information provided by the Contractor is exempt from release under the Freedom of Information Act. Accordingly, FRTIB personnel will not ordinarily sign vendor NDAs.

H.3 CONTRACTOR RESPONSIBILITIES/STANDARDS OF CONDUCT

The FRTIB will not exercise any supervision over the personal or professional conduct Contractor’s employees. The Contractor’s employees, if on-site at FRTIB facilities under this contract, shall only engage in duties specified in this contract, and not in other business, or political, charitable or other duties. The Contractor shall not recruit on FRTIB premises or otherwise act to disrupt official FRTIB business. The Contractor shall be responsible for maintaining satisfactory standards of employee competency, conduct, appearance, and integrity, and shall be responsible for taking such disciplinary action with respect to its employees as may be necessary. The Contractor shall include the substance of this clause in any of its subcontracts.

H.4 CONTRACTOR CONSENT TO BACKGROUND INVESTIGATION

(a) Contractor personnel shall be required to undergo a U.S. Government background investigation. The required level of Contractor staff’s background investigation will be determined by FRTIB staff based on the nature of Contractor staff’s tasks and access. Such a background investigation may be the equivalent of an Office of Personnel Management National FRTIB Check Inquiry (NACI), Minimum Background Investigation (MBI), Background Investigation (BI), or a background investigation appropriate for matters dealing with national security, and may include, but is not limited to, an FBI fingerprint check, credit check, inquiries into current and past employers, schools attended, references, and local, state, and federal law enforcement authorities criminal records check.

(b) The Contractor shall follow FRTIB’s “Contractor Fitness Requirements” as defined by the Office of Resource Management. All completed background investigations will be adjudicated by an FRTIB Personnel Security Officer for a Fitness Determination. If a Contractor employee receives an unfavorable fitness determination, it is the responsibility of the Contractor to provide a replacement in accordance with the contract.

NOTE: ‘‘Contractor Employee Fitness’’ is the level of character and conduct determined necessary for an individual to perform work for or on behalf of a Federal FRTIB as a Contractor employee. ‘‘Fitness determination’’ means a decision by an FRTIB that an individual has or does not have the required level of character and conduct necessary to perform work for or on behalf of a Federal FRTIB as a Contractor employee. A favorable fitness determination is not a decision to appoint or contract with an individual.

(c) Contractor shall ensure their employees and those of their subcontractors have the proper credentials allowing them to work in the United States. Persons later found to be undocumented or illegal aliens will be remanded to the proper authorities.

(d) The Contractor shall not be entitled to any compensation for delays or expenses associated with complying with the provisions of this clause. Furthermore, nothing in this clause shall excuse the Contractor from proceeding with the contract as required.

(e) Contractor shall use an electronic fingerprinting (live-scan) system as the primary method for capturing and transmitting fingerprints to the Office…