33 System Security Compliant with the NIST SP 800-18 , As required by the Plan Guide for Developing Security Plans Government for Federal Information Systems ubs/800-18-Rev1/sp800-18-Rev1- PERIODS: final.pdf), the Federal Information BASE Processing Standard (FIPS) 200, OP1 Recommended Security Controls for OP2 Federal Information Systems OP3 ips200/FIPS-200-final-march.pdf), OP4 and NIST SP 800-53 (latest revision) OP5 Security and Privacy Controls for Federal Information Systems and Organizations and other applicable NIST guidance. 34 Security Conducted by an independent As required by the Assessment assessor and consistent with NIST SP Government Plan/Report 800-53A, NIST SP 800-30 (latest PERIODS: (SAP/SAR) revisions) and any additions or BASE augmentations described in the DOT OP1 IS2P. The assessor will document the OP2 assessment results in the SAR. The OP3 Contractor shall update the SAR at OP4 annually thereafter. OP5 35 Plan of Actions Plan for mitigating all security risks As required by the and Milestones found during continuous monitoring Government PERIODS: (POA&M) and security reviews. BASE OP1 OP2 OP3 OP4 OP5 36 Contingency Plan Developed in accordance with NIST As required by the and Contingency SP 800-34, latest revision, DOTAR, Government Plan Test and DOT IS2P. PERIODS: BASE OP1 OP2 OP3 OP4 OP5
33 System Security Plan Compliant with the NIST SP 800-18 , Guide for Developing Security Plans for Federal Information Systems ubs/800-18-Rev1/sp800-18-Rev1- final.pdf), the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems ips200/FIPS-200-final-march.pdf), and NIST SP 800-53 (latest revision) Security and Privacy Controls for Federal Information Systems and Organizations and other applicable NIST guidance. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5 34 Security Assessment Plan/Report (SAP/SAR) Conducted by an independent assessor and consistent with NIST SP 800-53A, NIST SP 800-30 (latest revisions) and any additions or augmentations described in the DOT IS2P. The assessor will document the assessment results in the SAR. The Contractor shall update the SAR at annually thereafter. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5 35 Plan of Actions and Milestones (POA&M) Plan for mitigating all security risks found during continuous monitoring and security reviews. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5 36 Contingency Plan and Contingency Plan Test Developed in accordance with NIST SP 800-34, latest revision, DOTAR, and DOT IS2P. As required by the Government PERIODS: BASE OP1 OP2 OP3 OP4 OP5
J-2__-_DOT_EITSS_-_Infrastructure_Operations_PWS_-_6-12-2018.docx