Fill and Sign the Information Security Program Requirements

INFORMATION SECURITY PROGRAM REQUIREMENTS Checklist and Certifcatiin (2/2013) RFP Ni: _______________________________ _________________ Pre Silicitatiin Review Date: Cintract Ni:___________________________ _____________________ Pre-Award Review Date: Priject Title: _______________________________________________________________________________ Cintracting Officer:_________________________________________________________________________ [Name & Contact Information] Cintracting Officer:_________________________________________________________________________ [Name & Contact Information] PRE-SOLICITATION [ ] INFORMATION SECURITY IS NOT APPLICABLE fir this RFP. [ ] INFORMATION SECURITY IS APPLICABLE and the following information is required for RFP preparation: A. INFORMATION TYPE [ ] Administrative, Management and Suppirt Infirmatiin: [ ] Missiin Based Infirmatiin: B. SECURITY CATEGORIES AND LEVELS Confidentiality: Integrity: Availability: [ ] Low [ ] Moderate[ ] High [ ] Low [ ] Moderate[ ] High [ ] Low [ ] Moderate[ ] High Overall: [ ] Liw [ ] Miderate [ ] High C. POSITION SENSITIVITY DESIGNATIONS The following position sensitivity designations and associated clearance and investigation requirements apply under this contract: [ ] Level 6: Public Trust - High Risk (Requires Suitability Determinatiin with a BI). Contractor employees assigned to a Level 6 position are subject to a Background Investigation (BI). [ ] Level 5: Public Trust - Miderate Risk (Requires Suitability Determinatiin with MBI ir LBI). Contractor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI). IT-Certification (Rev 2/2013) 1 [ ] Level 1: Nin Sensitive (Requires Suitability Determinatiin with an NACI). Contractor employees assigned to a Level 1 position are subject to a National Agency Check and Inquiry Investigation (NACI). D. PROSPECTIVE OFFEROR NON-DISCLOSURE AGREEMENT [ ] Offerors WILL NOT require access to sensitive information in order to prepare an offer. [ ] Offerors WILL require access to sensitive information in order to prepare an offer: Descriptiin if sensitive infirmatiin: ________________________________________________________________________________ ________________________________________________________________________________ ________________________________________________________________________________ ________________________________________________________________________________ Select appropriate position sensitivity designation below. [ ] Level 6C: Sensitive - High Risk [ ] Level 5C: Sensitive - Miderate Risk CERTIFICATION: Based on the above, and contingent upon inclusion of all applicable solicitation language prescribed in the NIH Workform, we certify that the solicitation specifies appropriate security requirements necessary to protect the Governmentss interest and is in compliance with all Federal and DHHS security requirements. _________________________________________ Project Ofcer Signature ___________________ Date _________________________________________ Project Ofcer Typed Name _________________________________________ ___________________ Information Systems Security Ofcer Signature Date _________________________________________ Information Systems Security Ofcer Typed Name IT-Certification (Rev 2/2013) 2 INFORMATION SECURITY PROGRAM REQUIREMENTS Checklist and Certifcatiin (2/2013) RFP Ni: _______________________________ _________________ Pre Silicitatiin Review Date: Cintract Ni:___________________________ _____________________ Pre-Award Review Date: Priject Title: _______________________________________________________________________________ Cintracting Officer:_________________________________________________________________________ [Name & Contact Information] Cintracting Officer:_________________________________________________________________________ [Name & Contact Information] PRE-AWARD A. SYSTEMS SECURITY PLAN (SSP) [ ] SSP Apprived. The SSP dated ______________, submitted by the contractor has been reviewed by the Government, is considered acceptable, and should be incorporated into the awarded contract. [ ] This project requires a full SSP conforming to the NIST Guide for developing Security Plans for federal Information Systems http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf which must be submitted to the I/C, ISSO no later than 90 calendar days after the effective date of the contract. [ ] The SSP submitted by the contractor does not meet the minimum requirements for IT Security in the following area(s): [ ] Security Awareness Training [ ] Access Control [ ] Protection against data loss [ ] Malicious Code Protection [ ] Physical Security A revised SSP shall be submitted no later than 90 calendar days after the assignment of task (eg. hosting a government website) that would require such a plan. [ ] No SSP is required for this work. B. OFFEROR’S PROPOSAL [ ] Notwithstanding the information regarding the SSP, above, the offerorss proposal dated___________, specifies appropriate security requirements necessary IT-Certification (Rev 2/2013) 3 to comply with the Federal and Departmental policy. [ ] The offerorss proposal dated, __________ is deficient in the following areas: ________________________________________________________________________________ ________________________________________________________________________________ ________________________________________________________________________________ ________________________________________________________________________________ [ ] No Award is recommended until the offeror submits additional information to resolve the deficiencies sited above. [ ] Award may be made contingent upon the inclusion of contract language stipulating the submission of additional information resolving the deficiencies cited above. This information must be submitted no later than 90 calendar days after the effective date of this contract. CERTIFICATION: Based on the above, and contingent upon inclusion of all applicable Contract language prescribed in the NIH Contract Workform, we certify that the contract specifies appropriate security requirements necessary to protect the Governmentss interest and is in compliance with all Federal and DHHS security requirements. _________________________________________ Project Ofcer Signature ___________________ Date _________________________________________ Project Ofcer Typed Name _________________________________________ ___________________ Information Systems Security Ofcer Signature Date _________________________________________ Information Systems Security Ofcer Typed Name IT-Certification (Rev 2/2013) 4