Attachment J-8 Applicable Regulations and References.rtf

REFM Logistics SERVICES TIRNO-11-R-00009 Section J – LIST OF ATTACHMENTS

ATTACHMENT J-9, APPLICABLE REGULATIONS AND REFERENCES

Attachment J-8

NUMBER TITLE PWS REFERENCE

1. INDUSTRY STANDARDS

Federal Register 60:13782-13831, (MARCH 14, 1995) http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=13456 Industrial Fork Lift Operation C.10 Federal Register 59:16334-16364, (April 6, 1994) http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=13370 Personal Protective Equipment for General Industry C.10 National Institute of Technology SP-800 Series http://csrc.nist.gov/publications/nistpubs/ Computer Security Resource Center C.5.4

2. INTERNAL REVENUE MANUALS (IRM)

IRM 10.9, (September 30, 2008) http://www.irs.gov/irm Description of National Security Clearance Levels H.9 IRM 10.9.1, (September 30, 2008) http://www.irs.gov/irm Procedures for Classifying Information H.9 IRM 10.9.1, (September 30, 2008) http://www.irs.gov/irm Safeguarding National Security Information H.7 IRM 10.9 (September 30, 2008) http://www.irs.gov/irm Loss or Compromise of Classified Information H.2 IRM 1.14.1, (August 5, 2008) http:///www.irs.gov/irm Logistics Management

C.1.1 IRM 1.14.5, (April 16, 2010) http://www.irs.gov/irm Occupational Safety and Health Program C.4.4 IRM 1.14.7, (July 25, 2008) http://www.irs.gov/irm Motor Vehicle Management C.1.3

IRM 1.15.38, (September 1, 2005) http://www.irs.gov/irm General Records Schedule C.5.7

IRM 1.10.2, (SEPTEMBER 18, 2008)

http://www.irs.gov/irm

Physical Security Standards C.11, C.13

IRM 10.2.3 (September 25, 2008) http://www.irs.gov/irm

Safeguard Reviews

C.5.7 IRM 1.10.2, (September 18, 2008) http://www.irs.gov/irm Facility and Property Protection C.7 IRM 10.2.13, (September 30, 2008) http://www.irs.gov/irm Storage, Handling Transmission and disposition of Sensitive Information C.1.3.1 IRM 10.23.2, (October 16, 2008) http://www.irs.gov/irm Contractor Investigations C.11.1 IRM 10.23.3, (October 16, 2008) http://www.irs.gov/irm Background Investigations Guide C.11 IRM 2.5.1, (September 1, 2006) http://www.irs.gov/irm Systems Development C.5 IRM 2.15.1, (September 1, 2006) http://www.irs.gov/irm Target Enterprise Architecture (EA) C.5 IRM 2.22.1, (November 15, 2007) http://www.irs.gov/irm Request for Information Services (RIS) C.5 IRM 2.1, (September 1, 2006) http://www.irs.gov/irm Information Technology Systems C.5

EXECUTIVE ORDERS

OMB Circular A-130, (FEBRUARY 8, 1996) http://www.whitehouse.gov/omb/circulars_a130_a130trans4" http://www.whitehouse.gov/omb/circulars_a130_a130trans4 Management of Federal Information Resources C.5.3 Executive Order 11246, (SEPTEMBER 24, 1965, appear at 30 FR 12319, 12935, 3 CFR, 1964-1965 Comp., p.339, unless otherwise noted.)

http://www.dol.gov/compliance/laws/comp-eeo.htm" http://www.dol.gov/compliance/laws/comp-eeo.htm Equal Employment Opportunity

L.2 – FAR Clause 52.222-24

OMB Circular Policy M-06-15, (MAY 22, 2006) file_0.pdf thumbnail_0.emf thumbnail_1.wmf

Protecting Personally Identifiable Information (PII) C.5.4

OMB Circular Policy M-06-19, (JULY 12, 2006) file_1.pdf

EXECUTIVE OFFICE OF THE PRESIDENT EXECUTIVE OFFICE OF THE PRESIDENT

OFFICE OF MANAGEMENT AND BUDGET OFFICE OF MANAGEMENT AND BUDGET

WASHINGTON, D .C . 20503 WASHINGTON, D .C . 20503

M-06-19 M-06-19 July 12, 2006 July 12, 2006

MEMORANDUM FOR CHIEF INFORMATION OFFICERS MEMORANDUM FOR CHIEF INFORMATION OFFICERS

FROM: Karen S. Evans FROM: Karen S. Evans Administrator Administrator Office of E-Government and Information Technology Office of E-Government and Information Technology

SUBJECT: Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments

SUBJECT: Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments

This memorandum provides updated guidance on the reporting of security incidents involving personally identifiable information1 and to remind you of existing requirements, and explain new requirements your agency will need to provide addressing security and privacy in your fiscal year 2008 budget submissions for information technology (IT).

This memorandum provides updated guidance on the reporting of security incidents involving personally identifiable information

1 and to remind you of existing requirements, and explain new requirements your agency will need to provide addressing security and privacy in your fiscal year 2008 budget submissions for information technology (IT).

Reporting Security Incidents Reporting Security Incidents

As you know, the Federal Information Security Management Act of 2002 requires all agencies to report security incidents to a Federal incident response center. The center (US-CERT) is located within the Department of Homeland Security. The specific reporting procedures are found in the concept of operations for US-CERT. 2

As you know, the Federal Information Security Management Act of 2002 requires all agencies to report security incidents to a Federal incident response center. The center (US-CERT) is located within the Department of Homeland Security. The specific reporting procedures are found in the concept of operations for US-CERT. 2

As you know, the reporting procedures require agencies to report according to various timeframes based on type of incident. This memorandum revises those reporting procedures to now require agencies to report all

As you know, the reporting procedures require agencies to report according to various timeframes based on type of incident. This memorandum revises those reporting procedures to now require agencies to report all incidents involving personally identifiable information to US-CERT within one hour of discovering the incident. You should report all incidents involving personally identifiable information in electronic or physical form and should not distinguish between suspected and confirmed breaches.

US-CERT will forward all agency reports to the appropriate Identity Theft Task Force point-of-contact also within one hour of notification by an agency.

Incorporating Security Funding Into Information Technology Investments

1 For purposes of this policy, the term Personally Identifiable Information means any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.

2 See US-CERT website at http://www.us-cert.gov/federal/reportingRequirements.html 3 Loss of PII information on Department of Defense or Intelligence Community networks must also be reported by the individual agency CERTs to US-CERT within one hour.

http://www.us-cert.gov/federal/reportingRequirements.html

On April 25, 2006, Clay Johnson sent to the heads of departments and agencies planning guidance for the President’s fiscal year 2008 budget request.4 In that context, I wanted to

(1) remind you of the security and privacy requirements you should include within your IT investments and (2) explain additional items you will need to provide in your materials.

In particular, I want to remind you of Office of Management and Budget (OMB) Memorandum M-00-07, of February 28, 2000, "Incorporating and Funding Security in Information Systems Investments," instructs agencies on how to include security into the funding for information technology.5 This guidance is also included in OMB’s budget preparation policy, i.e., Circular A-11 and requires you to do two specific things. Under these existing guidance requirements, first, you must integrate security into and fund it over the lifecycle of each system undergoing development, modernization, or enhancement. Second, your steady-state system operations must meet existing security requirements before new funds are spent on system development, modernization or enhancement.

In addition, please provide additional detail on how you are allocating your resources between correcting existing security weaknesses in stead-state investments and proposing funds for system development, modernization, or enhancement.

Finally, for those agencies having significant isolated or wide-spread weaknesses identified by the agency Inspector General or the Government Accountability Office, please identify the specific funds you are requesting for proposed development, modernization, or enhancement efforts to correct these security weaknesses. This includes correcting weaknesses found during your privacy program reviews required by OMB Memorandum M-06-15, “Safeguarding Personally Identifiable Information”6 and for implementing the specific security controls set forth in OMB Memorandum M-06-16, “Protection of Sensitive Agency Information.”7

4 See OMB’s website at http://www.whitehouse.gov/omb/memoranda/fy2006/m06-14.pdf 5 See OMB’s website at http://www.whitehouse.gov/omb/memoranda/m00-07.html 6 See OMB’s website at http://www.whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf 7 See OMB’s website at http://www.whitehouse.gov/omb/memoranda/fy2006/m06-16.pdf http://www.whitehouse.gov/omb/memoranda/fy2006/m06-14.pdf http://www.whitehouse.gov/omb/memoranda/m00-07.html http://www.whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf http://www.whitehouse.gov/omb/memoranda/fy2006/m06-16.pdf

EXECUTIVE OFFICE OF THE PRESIDENT

thumbnail_2.emf thumbnail_3.wmf

Reporting Incidents Involving Personally Identifiable Information

C.5.4

4. DEPARTMENT OF TREASURY DIRECTIVES

Treasury Directive 71-10, (AUGUST 23, 1999) http://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td71-10.aspx" http://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td71-10.aspx Treasury Security Manual H-2 Treasury Directive 85-01, (March 10, 2008) http://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td85-01.aspx" http://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td85-01.aspx Department of the Treasury Information Technology (IT) Security Program C.1.7.2 Treasury Directive 87-04, (December 21, 2009) http://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td87-04.aspx" http://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td87-04.aspx Personal Use of Government Office Equipment Including Information Technology H.8

5. FEDERAL LAWS

Section 508 of the Rehabilitation Act (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), (August 7, 1998) http://www.section508.gov/index.cfm?FuseAction=Content&ID=14 Section 508 of the Rehabilitation Act H.19 Title III, Section 301, U.S.C.

http://csrc.nist.gov/drivers/documents/FISMA-final.pdf" http://csrc.nist.gov/drivers/documents/FISMA-final.pdf Federal Information Security Management Act of 2002 C.5.2

FEDERAL ACQUISITION REGULATIONS –

http://www.acquisition.gov/far