62 N/A C.5.2 Information N/A N Quoters shall obtain an adjudicated Authorization-To-Operate at Par. 2 Technology (IT) the appropriate level through their BPA customer before fulfillment Systems of any ordering activity. Security Requirements 62 N/A C.5.2 IT Systems N/A N The cost of meeting all security requirements and maintaining Par. 3 Security authorization shall be incorporated into the quoted prices. Requirements 62 N/A C.5.2 IT Systems N/A Y Quoters shall maintain a security management environment that Par. 4 Security meets or exceeds the requirements described in section D.8 based Requirements upon the latest edition of NIST Special Publication 800-53. 62 N/A C.5.2 IT Systems N/A Y Within 180 days of either the Federal Risk and Authorization Par. 5 Security Management Program (FedRAMP) achieving Initial Operating Requirements Capability or BPA award, whichever comes later, the Quoter shall submit appropriate documentation necessary to commence the FedRAMP security authorization process for offerings at the moderate impact level. The security authorization process for Secret Enclave high impact level service offerings will be conducted by the Ordering Activity. 62 N/A C.5.3 Privacy N/A N (a)The Contractor shall not publish or disclose in any manner, (a) Requirements without the Contracting the details of any Officer’s written consent, safeguards either designed or developed by the Contractor under this award or otherwise provided by the Government. N/A C.5.3 Privacy N/A N (b) To the extent required to carry out a program of inspection to 63 (b) Requirements safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases. 63 N/A C.5.3 Privacy N/A N (c) If new or unanticipated threats or hazards are discovered by (c) Requirements either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. 63 N/A C.5.3 Privacy N/A Y (d) The Contractor shall safeguard any Personally Identifiable (d) Requirements Information (PII) stored in the information system in accordance
62 N/A C.5.2 Par. 2 Information Technology (IT) Systems Security Requirements N/A N Quoters shall obtain an adjudicated Authorization-To-Operate at the appropriate level through their BPA customer before fulfillment of any ordering activity. 62 N/A C.5.2 Par. 3 IT Systems Security Requirements N/A N The cost of meeting all security requirements and maintaining authorization shall be incorporated into the quoted prices. 62 N/A C.5.2 Par. 4 IT Systems Security Requirements N/A Y Quoters shall maintain a security management environment that meets or exceeds the requirements described in section D.8 based upon the latest edition of NIST Special Publication 800-53. 62 N/A C.5.2 Par. 5 IT Systems Security Requirements N/A Y Within 180 days of either the Federal Risk and Authorization Management Program (FedRAMP) achieving Initial Operating Capability or BPA award, whichever comes later, the Quoter shall submit appropriate documentation necessary to commence the FedRAMP security authorization process for offerings at the moderate impact level. The security authorization process for Secret Enclave high impact level service offerings will be conducted by the Ordering Activity. 62 N/A C.5.3 (a) Privacy Requirements N/A N (a)The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this award or otherwise provided by the Government. 63 N/A C.5.3 (b) Privacy Requirements N/A N (b) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases. 63 N/A C.5.3 (c) Privacy Requirements N/A N (c) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. 63 N/A C.5.3 (d) Privacy Requirements N/A Y (d) The Contractor shall safeguard any Personally Identifiable Information (PII) stored in the information system in accordance
gsa-eaas-bpa-requirements-document-1.2.docx