W81K00-21-Q-0052_Exhibit 1_RMF Timelines.pdf
PDF 12 KB Posted
- Attached to
- Amendment 0001 - Hematology Testing; Brooke Army Medical Center, JBSA Fort Sam Houston, Texas
- Solicitation number
- W81K00-21-Q-0052
- Issued by
-
Department of the Army Medical Command
About this file
This document outlines requirements and timeframes for Risk Management Framework compliance for solicitation W81K00-21-Q-0052. The vendor must contact the government point of contact within 10 business days of award, and submit initial hardware, software, and architecture documents within 15 business days. The vendor then has 6 weeks to produce RMF documentation and 1 month to complete initial Nessus, STIG, and SCAP scans. The government will hold a kickoff meeting within 15 business days, generate a security assessment plan within 20 days, and provide RMF templates and STIG copies within 30 days. It will recommend Authorization to Operate with Conditions within 2 weeks of receiving final documentation and scans from the vendor. The government will then schedule Independent Verification and Validation with a third party validator within 3 weeks of final receipt.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
EXHIBIT 1
RMF Assessment Timeframes
Required Vendor Timeframes: The Government shall complete its required actions within the following referenced timeframes but no later than one year after order/contract issuance. If the vendor has completed all required actions in a timely manner and acceptable manner while the Government experiences delays, the vendor would be given additional time for future actions corresponding to the amount of Government delay.
Vendor Requirements: Initial Draft Date Due Final Date Due
Vendor to contact Gov POC:
dha.detrick.med-log.mbx.cyberlog@mail.mil
10 business days post award
Hardware/Software/Architecture Documents 15 business days post award
20 business days post
RMF Documentation Production
6 weeks post award
4 months post
Technical Nessus Scans
1 month post award
6 months post
Technical STIG Checklists
Technical SCAP
Required Vendor Timeframes: The Government shall complete its required actions within the following referenced timeframes but no later than one year after order/contract issuance. If the vendor has completed all required actions in a timely manner and acceptable manner while the Government experiences delays, the vendor would be given additional time for future actions corresponding to the amount of Government delay.
Government Requirements Initial Draft Date Due Final Date Due
Kickoff Meeting 15 business days post award -
Security Assessment Plan Generation 20 business days post award 30 days post award
RMF Templates sent to Vendor 5 business days post vendor initial contact
Copies of Applicable STIGs sent to Vendor 17 business days post award
30 days post award
Authorization to Operate with Conditions (ATO-C) Recommendation
ATO-C recommendation submitted to
3rd party validator 2 weeks after final documentation/technical scans received
Independent Verification and Validation (IV&V) Scheduling
Scheduling request to 3rd party validator 3 weeks after final documentation/technical scans received
File details come from the government source that posted it. Updated .