TMR RFI Attach 3 Submission Forum.docx

ATTACHMENT 3, SUBMISSION FORUM AND INFORMATION PROTECTION

1.0 Purpose

The current IRES contract provides all administrative and general services information technology support to the MDA. To minimize the risk of the current IRES workforce access to interested party submissions related to the MIOES acquisition, the following measures will be followed. Use of unencrypted email by the submitter is done at the submitter’s own risk, but will be accepted by the contracting officer.

2.0 Unencrypted email

The use of unencrypted email by the submitter is always an option but is done at the submitter’s own risk, but will be accepted by the contracting officer. There will be some communication and inquiries that are not sensitive and is appropriate to send through an unencrypted email. In those instances, that is the preferred approach. An example might be your request to participate in the Industry Day.

3.0 DoD Secure Access File Exchange (DoD SAFE)

3.1 The acquisition team will utilize DoD SAFE to receive the required submissions associated with this RFI that are considered sensitive to a particular vendor. DoD SAFE (https://safe.apps.mil) is an enterprise technical solution that provides the capability of secure data transfer of large files (8 GB maximum). There are no user accounts for SAFE; authentication is performed via common access card (CAC) and notification is done via email. SAFE is available for use by unauthenticated users also; however, a DoD CAC holder will initiate the exchange process. Users are identified as DoD users that authenticate to DoD SAFE using a CAC and non-DoD or non-CAC holders are referenced as Guests.

3.2 In order to initiate each submission, an email request must be sent to Matthew Stevens (matthew.stevens.ctr@mda.mil ) with a Cc to the following email: MDAMIOES@MDA.mil. It is suggested this request is made 24 hours before any submission deadlines.

3.3 After the request is made, take the following steps to upload the required artifacts to DoD SAFE:

· Open the received Drop-off request email from DoD SAFE, which contains a link

· Click the link in the Drop-off email to navigate directly to the Drop-off form

· Complete the following fields in the Drop-off form

· From: Enter your name

· To: The name of the authenticated user who sent the request is pre-populated

· Short Note to the Recipients: Enter a message to be sent in the body of the email if desired

· Check Boxes as Applicable:

· Encrypt every file (Required for CUI, PII, and PHI)

· Note: none of the required artifacts associated with this RFI should require encryption

· Send me an email when the Drop-off is completed,

· Send me an email when each recipient picks up the files

· Click to Add Files or Drag Them Here: Either click to browse for the correct files or drag one or more files into this location

· Click Drop-off Files to send the file package

4.0 Information Protection

The following information protection procedures will be followed by the acquisition team throughout the life of the acquisition.

4.1 The MDA remote source selection process allows controlled access and data protection through the use of secure audio collaboration, file protection via Information Rights Management (IRM), and the use of data collaboration via a secured SharePoint site. The file protection and SharePoint site are managed by the MDA Identity Management Gateway (MIMG) security groups established for the AT. The AT Lead or PCO will establish permissions.

4.2 File-Level Encryption – Persistent file-level encryption is the cornerstone of the Government’s information protection plan and the OCI mitigation plan. All sensitive emails and documents are encrypted and access restricted to authorized users. This encryption stays with the file in transport and at rest regardless of the system in which it is transferred to. The encryption technologies utilized in this plan (e.g. IRM) nearly eliminate the risk of unauthorized access to sensitive information.

4.3 Active Monitoring & Auditing – While the encryption technologies nearly eliminate the risk of unauthorized exposure, we also perform active monitoring and auditing requirements to ensure compliance and to monitor any attempt of an Unauthorized Privileged User to gain access to sensitive information.

4.4 Documents containing sensitive information shall be secured using IRM where practical. IRM provides numerous security and usability advantages over password-based encryption (i.e., 256-bit encryption, auditing, CAC/Active Directory (AD)/2-factor/single sign-on authentication, ability to add / revoke access based on AD Security Groups

5.0 Government-furnished Resources

As a reminder, contractors are not authorized to use Government-furnished resources—including Government email accounts, information technology, and communications resources—to pursue new business opportunities.

Attachment 3 Page 3 image1.jpeg