Program: 391-s

Term: Date of Award to March 31, 2023

Title: Mid-Year Mailer (MYM) OCR Forms Notices

National Change of Address (NCOA) Notices

Step Parent Notices

Fee Adjustment Notices

1099/1042 and T2 COLA Large Print Notices

BASIS OF

ITEM NO. DESCRIPTION AWARD UNIT RATE COST UNIT RATE COST UNIT RATE COST UNIT RATE COST

I. COMPOSITION:

(a) Notices and Notices with Scannable Forms....

...........................per page........................ 218 100.00 21,800.00 20.00 4,360.00 50.00 10,900.00

(b) Envelopes.............per envelope.................. 16 50.00 800.00 10.00 160.00 50.00 800.00

II. PREPRODUCTION TESTS:

(a) Transmission Test.......per test..................... 1 100.00 100.00 N/C 0.00 N/C 0.00

(b) Preproduction Validation Test......per test...... 1 10,000.00 10,000.00 N/C 0.00 N/C 0.00

III. PROOFS:

(a) Digital Color Content Proof:

1. Notices and Notices with Sannable Forms......

.......................per trim/page-size unit.......... 1308 10.00 13,080.00 20.00 26,160.00 1.50 1,962.00

2. Envelopes...................per envelope............. 48 10.00 480.00 10.00 480.00 1.50 72.00

(b) PDF Soft Proof:

1 Notices and Notices with Sannable Forms......

.............per trim/page-size unit.................... 436 10.00 4,360.00 N/C 0.00 5.00 2,180.00

2. Envelopes...................per envelope............. 16 10.00 160.00 N/C 0.00 5.00 80.00

IV. PRINTING/IMAGING, BINDING, AND 

CONSTRUCTION:

(a) *Makeready/setup charge............................ 15 2,500.00 37,500.00 75.00 1,125.00 431.83 6,477.45

* Contractor will be alowed only one (1) 

makeready/setup charge per order. Shall 

include materials and operations necessary to 

makeready and/or set up the contractor's 

equipment for that run. Invoices submitted

with more than one makeready/setup charge

per order will be disallowed.

(b) Notices and Notices with Scannable Forms:

Printing in black................per 100 leaves...... 40609 6.00 243,654.00 0.80 32,487.20 1.14 46,294.26

(c) CRM and BRM Envelopes:

Printing in black, including construction.........

...........................per 100 envelopes............ 4749 2.00 9,498.00 5.75 27,306.75 1.57 7,455.93

(d) Mail-out Envelopes (6-1/4 x 9-1/2") With One

Window: Printing in black, including 

Due to changes in program

number and specification, 

current contractor prices 

cannot be shown

AMSIVE BMS DIRECT, INC. NPC, INC. CURRENT CONTRACTOR

Greenville, SC Lynchburg, VA Claysburg, PA Pinnacle Data Solutions

Page 1 of 2
Program: 391-s

Term: Date of Award to March 31, 2023

Title: Mid-Year Mailer (MYM) OCR Forms Notices

National Change of Address (NCOA) Notices

Step Parent Notices

Fee Adjustment Notices

1099/1042 and T2 COLA Large Print Notices

BASIS OF

ITEM NO. DESCRIPTION AWARD UNIT RATE COST UNIT RATE COST UNIT RATE COST UNIT RATE COST

AMSIVE BMS DIRECT, INC. NPC, INC. CURRENT CONTRACTOR

Greenville, SC Lynchburg, VA Claysburg, PA Pinnacle Data Solutions

construction..............per 100 envelopes........ 7118 3.00 21,354.00 6.34 45,128.12 2.22 15,801.96

(e) Mail-out Envelopes (6-1/4 x 9-1/2") With Two

Windows: Printing in black, including 

construction..............per 100 envelopes........ 4878 3.00 14,634.00 6.34 30,926.52 2.03 9,902.34

V. PAPER:

Notics and Scannable Forms: A charge will 

be allowed for each page-size leaf. CRM and

BRM Envelopes: One leaf will be allowed for

each envelope. Mail-out Envelopes: One leaf

will be allowed for each envelope.

(a) Notics with Scannable Forms (Mailers 1 

through 4): White Optical Character 

Recognition (OCR) Bond (20-lbs.).................. 16245 1.50 24,367.50 2.00 32,490.00 0.68 11,046.60

(b) Notics (Mailers 5 through 13): White Uncoated

Text (50-lbs.).............................................. 24364 1.50 36,546.00 2.00 48,728.00 0.65 15,836.60

(c) CRM and BRM Envelopes: White Writing 

Envelope (20-lbs.); or at contractor's option,

White Uncoated Text (50-lbs.)....................... 4749 1.88 8,928.12 5.75 27,306.75 1.57 7,455.93

(d) Mail-out Envelope: (6-1/4 x 9-1/2"): White

Writing Evelope 24-lbs.); or at contractor's

option, White Uncoated Text (60-lbs.)............. 11996 2.63 31,549.48 6.34 76,054.64 2.14 25,671.44

VI. INSERTING AND MAILING:

Per 100 Mailers

Mailers......................per 100 mailers.......... 11996 5.50 65,978.00 2.00 23,992.00 5.81 69,696.76

CONTRACTOR TOTALS $544,789.10 $376,704.98 $231,633.27

DISCOUNT 0.00% 0.00 0.00 0.25% $579.08

DISCOUNTED TOTALS $544,789.10 $376,704.98 $231,054.19

AWARDED

Page 2 of 2
Program 391-S (R-1) Page 1 of 74

Specifications by MRN

U.S. GOVERNMENT PUBLISHING OFFICE 

Washington, DC 

GENERAL TERMS, CONDITIONS, AND SPECIFICATIONS 

For the Procurement of 

Mid-Year Mailer (MYM) OCR Forms Notices 

National Change of Address (NCOA) Notices

Step Parent Notices 

Fee Adjustment Notices 

1099/1042 and T2 COLA Large Print Notices 

As requisitioned for the U.S. Government Publishing Office (GPO) by the 

Social Security Administration (SSA) 

Single Award 

TERM OF CONTRACT: The term of this contract is for the period beginning Date of Award and ending 

March 31, 2023, plus up to four (4) optional 12-month extension periods that may be added in accordance with 

the “OPTION TO EXTEND THE TERM OF THE CONTRACT” clause in SECTION 1 of this contract.

SSA to transmit test files, and conduct preproduction testing and validation, from Date of Award through 

June 30, 2022. Actual production begins July 1, 2022. 

BID OPENING: Bids shall be opened at 11:00 a.m., prevailing Washington, DC Time, on January 21, 2022, at 

the Government Publishing Office, Washington, DC. (Due to the COVID-19 pandemic, this will NOT be a 

public bid opening.) 

BID SUBMISSION: Due to the COVID-19 pandemic, the GPO physical office will NOT be open. Based on 

this, bidders must submit email bids to bidsapsdc@gpo.gov for this solicitation. No other method of bid 

submission will be accepted at this time. The Program 391-S and bid opening date must be specified in the subject 

line of the emailed bid submission. Bids received after 11:00 a.m. on the bid opening date specified above will 

not be considered for award. 

BID RESTRICTIONS: Due to time constraints, bidders must possess an SSA installed/active data connection 

between the exact location specified by the bidder and SSA’s National Computer Center (NCC). SSA must have 

security-cleared the bidder’s physical location(s) used for production of materials for this contract, and all 

employees have passed Final Suitability (for same locations) prior to bid submission in order to be eligible for 

award of this contract. NOTE: If bidder does not have these requirements completed prior to bid submission, then 

the bidder will be declared non-responsible. 

BIDDERS, PLEASE NOTE: This program was formerly Program 856-S. These specifications have been 

extensively revised; therefore, all bidders are cautioned to familiarize themselves with all provisions of these 

specifications before bidding with particular attention to the following: 

▪ 100% ACCOUNTABILITY

▪ SECURITY REQUIREMENTS

▪ 1099/1042 and T2 COLA Large Print Notices

▪ SECTION 3. – DETERMINATION OF AWARD

▪ SECTION 4. – SCHEDULE OF PRICES

Abstracts of contract prices are available at https://www.gpo.gov/how-to-work-with-us/vendors/contract-pricing.

For information of a technical nature, contact Starr Thompson at sthompson@gpo.gov or (202) 512-0307.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 2 of 74

391-S R-1 (03/23)

SECTION 1. - GENERAL TERMS AND CONDITIONS

GPO CONTRACT TERMS: Any contract which results from this Invitation for Bid will be subject to the 

applicable provisions, clauses, and supplemental specifications of GPO Contract Terms (GPO Pub. 310.2, 

effective December 1, 1987 (Rev. 01-18)) and GPO Contract Terms, Quality Assurance Through Attributes

Program for Printing and Binding (GPO Pub. 310.1, effective May 1979 (Rev. 09-19)).

GPO Contract Terms (GPO Publication 310.2) – https://www.gpo.gov/docs/default-source/forms-and-standardsfiles-for-vendors/contractterms2018.pdf. 

GPO QATAP (GPO Publication 310.1) – https://www.gpo.gov/docs/default-source/forms-and-standards-files-forvendors/qatap-rev-09-19.pdf.

PREDOMINANT PRODUCTION FUNCTIONS: The predominant production functions are the printing of 

notices, the laser/ion deposition printing/imaging of data at a minimum of 600 x 600 dpi for the notices from 

electronically transmitted files (inkjet is not allowed), folding, inserting, the presorting, mailing, and disposal of 

waste materials. Any bidder who cannot perform these functions of this contract will be declared non-responsible. 

SUBCONTRACTING: The contractor may subcontract the printing and manufacturing of the envelopes. 

The contractor shall be responsible for enforcing all contract requirements outsourced to a subcontractor. 

If the contractor needs to add a subcontractor at any time after award, the subcontractor must be approved by the 

Government prior to production starting in that facility. If the subcontractor is not approved by the Government, 

then the contractor must submit new subcontractor’s information to the Government for approval 30 calendar 

days prior to the start of production at that facility. 

QUALITY ASSURANCE LEVELS AND STANDARDS: The following levels and standards shall apply to

these specifications:

Product Quality Levels:

(a) Printing (page related) Attributes -- Level III.

(b) Finishing (item related) Attributes -- Level III.

Inspection Levels (from ANSI/ASQC Z1.4):

(a) Non-destructive Tests - General Inspection Level I.

(b) Destructive Tests - Special Inspection Level S-2.

(c) Transparent, low-gloss, poly-type window material, covering the envelope window, must pass readability 

test with a rejection rate of less than 1/4 of 1% when run through a United States Postal Service (USPS)

OCR Scanner.

(d) Exception: ANSI X3.17 “Character Set for Optical Character Recognition (OCR A)” shall apply to these 

specifications. The revisions of this standard that are effective as of the date of this contract are those which

shall apply.

(e) Exception: The Data Matrix 2D barcodes must be in accordance with the requirements of ANSI MH 

10.8.3M unless otherwise specified. 

ANSI Standards may be obtained from the American National Standards Institute, 25 West 43rd Street, 4th Floor, 

New York, NY 10036.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 3 of 74

391-S R-1 (03/23)

NOTE: Forms require precision spacing, printing, trimming, and folding to guarantee proper processing. The 

scannable forms produced under these specifications must be guaranteed to function properly when processed

through the WBDOC Integrated Based Data Capture System (IIDBCS). The barcoding must be readable by all 

standard barcode scanning devices regardless of the contractor’s method of reproducing the codes. SSA’s current 

equipment is: WDR Reader – Worthington Data Solutions and High-Speed Scanners.

All printing, folding, and insertion of the product are to be done by mechanical means. Fold variances that exceed 

plus or minus 1/16” shall be cause for rejection

Specified Standards: The specified standards for the attributes requiring them shall be:

Attribute Specified Standard

P-7. Type Quality and Uniformity O.K. Press Sheet

P-8. Solid and Screen Tint Color Match O.K. Press Sheet

Special Instructions: In the event the inspection of press sheets is waived by the Government, the following list of 

alternative standards (in order of precedence) shall become the Specified Standards:

P-7. O.K. Preproduction Test Samples; O.K. Proofs; Electronic Media; Camera Copy; Manuscript Copy.

P-8. Pantone Matching System

OPTION TO EXTEND THE TERM OF THE CONTRACT: The Government has the option to extend the 

term of this contract for a period of 12 months by written notice to the contractor not later than 30 days before the 

contract expires. If the Government exercises this option, the extended contract shall be considered to include this 

clause, except, the total duration of the contract may not exceed five years as a result of, and including, any 

extension(s) added under this clause. Further extension may be negotiated under the “EXTENSION OF 

CONTRACT TERM” clause. See also “ECONOMIC PRICE ADJUSTMENT” for authorized pricing 

adjustment(s).

EXTENSION OF CONTRACT TERM: At the request of the Government, the term of any contract resulting 

from this solicitation may be extended for such period as may be mutually agreeable to GPO and the contractor.

ECONOMIC PRICE ADJUSTMENT: The pricing under this contract shall be adjusted in accordance with this

clause, provided that in no event will any pricing adjustment be made that would exceed the maximum 

permissible under any law in effect at the time of the adjustment. There will be no adjustment for orders placed 

during the first period specified below. Pricing will thereafter be eligible for adjustment during the second and 

any succeeding performance period (s). For each performance period after the first, a percentage figure will be 

calculated as described below and that figure will be the economic price adjustment for that entire next period. 

Pricing adjustments under this clause are not applicable to reimbursable postage or transportation costs, or to

paper, if paper prices are subject to adjustment by separate clause elsewhere in this contract.

For the purpose of this clause, performance under this contract will be divided into successive periods. The first

period will extend from Date of Award to March 31, 2023, and the second and any succeeding period(s) will 

extend for 12 months from the end of the last preceding period, except that the length of the final period may 

vary. The first day of the second and any succeeding period(s) will be the effective date of the economic price 

adjustment for that period.

Pricing adjustments in accordance with this clause will be based on changes in the seasonally adjusted “Consumer

Price Index For All Urban Consumers – Commodities less Food” (Index) published monthly in the CPI Detailed

Report by the U.S. Department of Labor, Bureau of Labor Statistics.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 4 of 74

391-S R-1 (03/23)

The economic price adjustment will be the percentage difference between Index averages as specified in this 

paragraph. An index called the variable index will be calculated by averaging the monthly Indexes from the 12-

month interval ending three (3) months prior to the beginning of the period being considered for adjustment. This 

average is then compared to the average of the monthly Indexes for the 12-month interval ending 

December 31, 2021 called the base index. The percentage increase or decrease against the total price of variable 

index from the base index will be the economic price adjustment for the period being considered for adjustment.

The Government will notify the contractor by contract modification specifying the percentage increase or 

decrease to be applied to invoices for orders placed during the period indicated. The contractor shall apply the 

percentage increase or decrease against the total price of the invoice less reimbursement postage or transportation 

costs and separately adjusted paper prices. Payment discounts shall be applied after the invoice price is adjusted.

PAPER PRICE ADJUSTMENT: Paper prices charged under this contract will be adjusted in accordance with 

“Table 9 - Producer Price Indexes and Percent Changes for Commodity Groupings and Individual Items” in 

Producer Price Indexes report, published by the Bureau of Labor Statistics (BLS), as follows:

NOTE: For the purpose of this contract, the Paper Price Adjustment will be based on the date of actual 

production. Actual live production begins July 2022.

1. BLS code 0913 for All Paper will apply to all paper required under this contract.

2. The applicable index figures for the month of June 2022 will establish the base index.

3. There shall be no price adjustment for the first three months of the contract.

4. Price adjustments may be monthly thereafter, but only if the index varies by an amount (plus or minus) 

exceeding 5% by comparing the base index to the index for that month, which is two months prior to the 

month being considered for adjustment.

5. Beginning with order placement in the fourth month, index variances will be calculated in accordance 

with the following formula:

X – base index

__________________________ x 100 = ____________ %

base index

where X = the index for that month which is two months prior to the month being considered for 

adjustment.

6. The contract adjustment amount, if any, will be the percentage calculated in 5 above less 5%.

7. Adjustments under this clause will be applied to the contractor’s bid price(s) for Item V., “PAPER” in the 

“SCHEDULE OF PRICES” and will be effective on the first day of any month for which prices are to be 

adjusted.

The Contracting Officer will give written notice to the contractor of any adjustments to be applied to invoices for 

orders placed during months affected by this clause.

In no event, however, will any price adjustment be made which would exceed the maximum permissible under 

any law in effect at the time of the adjustment. The adjustment, if any, shall not be based upon the actual change 

in cost to the contractor, but shall be computed as provided above.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 5 of 74

391-S R-1 (03/23)

The contractor warrants that the paper prices set forth in this contract do not include any allowance for any 

contingency to cover anticipated increased costs of paper to the extent such increases are covered by this price 

adjustment clause.

SECURITY REQUIREMENTS: Clause 2352.224-1 Protection of Confidential Information (Dec 2008):

(a) “Confidential information,” as used in this clause, means information or data, or copies or extracts of 

information or data, that is: (1) provided by the Social Security Administration (SSA) to the contractor for, or 

otherwise obtained by the contractor in, the performance of this contract; and (2) of a personal nature about an 

individual, such as name, home address, and social security number, or proprietary information or data 

submitted by or pertaining to an institution or organization, such as employee pay scales and indirect cost 

rates. 

(b) The Contracting Officer and the contractor may, by mutual consent, identify elsewhere in this contract 

specific information or categories of information that the Government will furnish to the contractor or that the 

contractor is expected to generate which are confidential. Similarly, the Contracting Officer and the contractor 

may, by mutual consent, identify such confidential information from time to time during the performance of 

the contract. The confidential information will be used only for purposes delineated in the contract; any other 

use of the confidential information will require the Contracting Officer’s express written authorization. The 

Contracting Officer and the contractor will settle any disagreements regarding the identification pursuant to 

the “Disputes” clause.

(c) The contractor shall restrict access to all confidential information to the minimum number of employees and 

officials who need it to perform the contract. Employees and officials who need access to confidential 

information for performance of the contract will be determined in conference between SSA's Contracting 

Officer, Contracting Officer’s Technical Representative, and the responsible contractor official. Upon request, 

the contractor will provide SSA with a list of “authorized personnel,” that is, all persons who have or will 

have access to confidential information covered by this clause.

(d) The contractor shall process all confidential information under the immediate supervision and control of 

authorized personnel in a manner that will: protect the confidentiality of the records; prevent the unauthorized 

use of confidential information; and prevent access to the records by unauthorized persons. 

(e) The contractor shall assure that each contractor employee with access to confidential information knows the 

prescribed rules of conduct and that each contractor employee is aware that he/she may be subject to criminal 

penalties for violations of the Privacy Act and/or the Social Security Act. 

When the contractor employees are made aware of this information, they will be required to sign the SSA301, “Contractor Personnel Security Certification.” (See Exhibit A.) 

A copy of this signed certification must be forwarded to: Social Security Administration, Attn: Jamey 

Cunningham, DMIM, 3-B-10-F Annex Building, 6401 Security Boulevard, Baltimore, MD 21235-6401, or 

email to: Jamey.cunningham@ssa.gov. A copy must also be forwarded to: U.S. Government Publishing 

Office, 732 North Capitol Street, NW, CSAPS, APS DC, Attn: Contracting Officer, Room C-838, 

Washington, DC 20401 (email address to be provided after award). (See paragraph (f) below regarding the 

minimum standards that the safeguards must meet.)

(f) Whenever the contractor is storing, viewing, transmitting, or otherwise handling confidential information, the 

contractor shall comply with the applicable standards for security controls that are established in the Federal 

Information Security and Management Act (FISMA). (These standards include those set by the National 

Institute of Standards and Technology (NIST) via the Federal Information Processing Standards (FIPS) 

publications and NIST Special Publications, particularly FIPS 199, FIPS 200, and NIST Special Publications 

- 800 series.) 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 6 of 74

391-S R-1 (03/23)

(g) If the contractor, in the performance of the contract, uses any information subject to the Privacy Act of 1974, 

5 U.S.C. 552a, and/or section 1106 of the Social Security Act, 42 U.S.C. 1306, the contractor must follow the 

rules and procedures governing proper use and disclosure set forth in the Privacy Act, section 1106 of the 

Social Security Act, and the Commissioner’s regulations at 20 C.F.R. Part 401 with respect to that 

information. 

(h) For knowingly disclosing information in violation of the Privacy Act, the contractor and contractor employees 

may be subject to the criminal penalties as set forth in 5 U.S.C. Section 552(i)(1) to the same extent as 

employees of SSA. For knowingly disclosing confidential information as described in section 1106 of the 

Social Security Act (42 U.S.C. 1306), the contractor and contractor employees may be subject to the criminal 

penalties as set forth in that provision.

(i) The contractor shall assure that each contractor employee with access to confidential information is made 

aware of the prescribed rules of conduct, and the criminal penalties for violations of the Privacy Act and/or 

the Social Security Act.

(j) Whenever the contractor is uncertain how to handle properly any material under the contract, the contractor 

must obtain written instructions from the Contracting Officer addressing this question. If the material in 

question is subject to the Privacy Act and/or section 1106 of the Social Security Act or is otherwise 

confidential information subject to the provisions of this clause, the contractor must obtain a written 

determination from the Contracting Officer prior to any release, disclosure, dissemination, or publication. 

Contracting Officer instructions and determinations will reflect the result of internal coordination with 

appropriate program and legal officials.

(k) Performance of this contract may involve access to tax return information as defined in 26 U.S.C. Section 

6103(b) of the Internal Revenue Code (IRC). All such information shall be confidential and may not be 

disclosed without the written permission of the SSA Contracting Officer. For willfully disclosing confidential 

tax return information in violation of the IRC, the contractor and contractor employees may be subject to the 

criminal penalties set forth in 26 U.S.C. Section 7213.

(l) The Government reserves the right to conduct on-site visits to review the contractor's documentation and inhouse procedures for protection of and security arrangements for confidential information and adherence to 

the terms of this clause.

(m) The contractor must include this clause in all resulting subcontracts whenever there is any indication that the 

subcontractor(s), engaged by the contractor, and their employees or successor subcontractor(s) and their 

employees might have access to SSA’s confidential information.

(n) The contractor must assure that its subcontractor(s) and their employees or any successor subcontractor(s) and 

their employees with access to SSA confidential information are made aware of the prescribed rules of 

conduct. For knowingly disclosing SSA’s confidential information, any subcontractor(s) and their employees 

or successor subcontractor(s) and their employees may be subject to criminal penalties as described in section 

1106 of the Social Security Act (42 U.S.C. 1306) and the Privacy Act (5 U.S.C. 552a).

SSA EXTERNAL SERVICE PROVIDER SECURITY REQUIREMENTS: This resource identifies the basic 

information security requirements related to the procurement of Information Technology (IT) services hosted 

externally to SSA’s Network.

The following general security requirements apply to all External Service Providers (ESP): 

a. The solution must be located in the United States, its territories, or possessions.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 7 of 74

391-S R-1 (03/23)

NOTE: “United States” means the 50 States, the District of Columbia, Puerto Rico, the Northern 

Mariana Islands, American Samoa, Guam, the U.S. Virgin Islands, Johnston Island, Wake Island, and 

Outer Continental Shelf Lands as defined in the Outer Continental Shelf Lands Act (43 U.S.C. 1331, et 

seq.), but does not include any other place subject to U.S. jurisdiction or any U.S. base or possession 

within a foreign country (29 CFR 4.112).

b. Upon request from the SSA Contracting Officer Technical Representative (COTR), the ESP shall provide 

access to the hosting facility to the U.S. Government or authorized agents for inspection and facilitate an 

on-site security risk and vulnerability assessment.

c. The solution must meet Federal Information Processing Standards (FIPS) and guidance developed by the 

National Institute of Science and Technology (NIST) under its authority provided by the Federal 

Information Security Modernization Act (FISMA) to develop security standards for federal information 

processing systems, and Office of Management and Budget’s (OMB) Circular A-130 Appendix III.

d. ESPs classified as Cloud Service Providers (CSP) must be FedRAMP authorized. Further information 

may be found at: http://www.gsa.gov/portal/category/102371. As part of these requirements, CSPs must 

have a security control assessment performed by a Third Party Assessment Organization (3PAO).

e. The ESP shall submit to the SSA COTR documentation describing how the solution implements security 

controls in accordance with the designated categorization (FIPS 199) and the Minimum Security 

Requirements for Federal Information and Information Systems (FIPS 200) which requires the use of 

NIST SP 800-53 Rev 4 before SSA provides data.

f. All ESPs that process or store Personally Identifiable Information (PII) are considered a Moderate impact 

categorization. If PII or sensitive data (defined by the COTR) is stored or processed by the ESP, then the 

ESP shall provide a Security Assessment Package (SAP) created by an independent assessor. The SAP 

should include a System Security Plan (SSP), Security Assessment Report (SAR), Risk Assessment 

Report (RAR), and Plan of Action & Milestone Report (POA&M). The SAP must be reviewed by SSA 

before the SSA transfers data to the ESP. Refer to NIST SP 800-37 for more information on the Security 

Authorization Package.

NOTE: PII is any information about an individual maintained by an agency, including (1) any 

information that can be used to distinguish or trace an individual’s identity, such as name, social security 

number, date and place of birth, mother’s maiden name, or biometric records; and (2) any other 

information that is linked or linkable to an individual, such as medical, educational, financial, and 

employment information.

NOTE: Independent assessor is any individual or group capable of conducting an impartial assessment of

security controls employed within or inherited by an information system.

g. SSA will consider a self-assessment of security controls for solutions that do not involve sensitive 

information or PII.

For additional security requirements and NIST 800-53, REV 4 organization defined parameters, refer to “ESP 

Additional Security Requirements” document.

References - Refer to most up to date revision:

▪ Federal Information Security Modernization Act (P.L. 113-283), December 2014.

https://www.govinfo.gov/app/details/PLAW-113publ283
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 8 of 74

391-S R-1 (03/23)

▪ Clinger-Cohen Act of 1996 also known as the “Information Technology Management Reform Act of 

1996.”

▪ Privacy Act (P.L. 93-579), December 1974.

https://www.govinfo.gov/app/details/STATUTE-88/STATUTE-88-Pg1896

▪ Homeland Security Presidential Directive (HSPD‐12), “Policy for a Common Identification Standard for 

Federal Employees and Contractors,” August 27, 2004.

https://www.dhs.gov/homeland-security-presidential-directive-12

▪ Revision of OMB Circular No. A–130, “Managing Information as a Strategic Resource,” July 28, 2016.

https://www.govinfo.gov/content/pkg/FR-2016-07-28/pdf/2016-17872.pdf

▪ OMB Memorandum M-04-04, “E-Authentication Guidance for Federal Agencies,” December 16, 2003.

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf

and

ITL BULLETIN FOR DECEMBER 2011 REVISED GUIDELINE FOR ELECTRONIC 

AUTHENTICATION OF USERS HELPS ORGANIZATIONS PROTECT THE SECURITY OF THEIR 

INFORMATION SYSTEMS.

https://csrc.nist.gov/csrc/media/publications/shared/documents/itl-bulletin/itlbul2011-12.pdf

▪ FIPS PUB 199, National Institute of Standards and Technology Federal Information Processing Standards 

Publication 199, Standards for Security Categorization of Federal Information and Information Systems, 

February 2004.

https://doi.org/10.6028/NIST.FIPS.199

▪ FIPS PUB 200, National Institute of Standards and Technology Federal Information Processing Standards 

Publication 200, Minimum Security Requirements for Federal Information and Information Systems, 

March 2006. 

https://doi.org/10.6028/NIST.FIPS.200

▪ FIPS 140-3 Security Requirements for Cryptographic Modules, March 22, 2019.

https://csrc.nist.gov/publications/detail/fips/140/3/final

▪ NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information Systems, 

February 2006.

https://doi.org/10.6028/NIST.SP.800-18r1

▪ NIST SP 800-30, Guide for Conducting Risk Assessments, September 2012.

https://doi.org/10.6028/NIST.SP.800-30r1

▪ ITL Bulletin Contingency Planning for Information Systems NIST Special Publication (SP) 800-34, Rev. 

1.

https://csrc.nist.gov/CSRC/media/Publications/Shared/documents/itl-bulletin/itlbul2010-07.pdf

▪ NIST SP 800‐37 Revision 2, Risk Management Framework for Information Systems and Organizations -

A System Life Cycle Approach for Security and Privacy, December 2018.

https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 9 of 74

391-S R-1 (03/23)

▪ NIST SP 800-47, National Institute of Standards and Technology Special Publication 800-47, Security 

Guide for Interconnecting Information Technology Systems, August 2002.

https://csrc.nist.gov/publications/detail/sp/800-47/final

▪ NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and 

Organizations, April 2013.

https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final

▪ NIST SP 800-53A Revision 4, Assessing Security and Privacy Controls in Federal Information Systems 

and Organizations: Building Effective Assessment Plans, December 2014.

https://csrc.nist.gov/publications/detail/sp/800-53a/rev-4/final

▪ NIST SP 800-60 Volume 1 Revision 1, Guide for Mapping Types of Information and Information 

Systems to Security Categories, August 2008.

https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final

and

NIST SP 800-60 Volume 2 Revision 1, Guide for Mapping Types of Information and Information 

Systems to Security Categories: Appendices, August 2008.

https://csrc.nist.gov/publications/detail/sp/800-60/vol-2-rev-1/final

▪ OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information.

See Exhibit B, “SSA External Service Provider Additional Security Requirements” for complete details regarding 

this requirement.

Templates for Required Security Documents:

▪ Exhibit C: Security Assessment Report (SAR) Template

▪ Exhibit D: Risk Assessment Report (RAR) Template

▪ Exhibit E: Externally Hosted Information System Plan (ESP) Template FY17

PHYSICAL SECURITY: Contractor’s facilities storing SSA assets and information are required to meet the 

Interagency Security Committee’s standard for Federal facilities. This information can be found in the “Facility 

Security Plan: An Interagency Security Committee Guide,” dated February 2015, 1st Edition. SSA reserves the 

right to inspect contractor facilities to ensure compliance with the ISC guidelines. If facilities are found deficient, 

the contractor must implement corrective actions within 45 calendar days of notification. Requirements can 

include, but not be limited to, the physical security countermeasures, such as access control systems, closed 

circuit television systems, intrusion detection systems, and barriers.

Contractor must pass all External Service Provider Security and Physical Security requirements as specified 

above before the Government can award this contract. Any bidder who cannot obtain approval for any of these 

security requirements within 60 calendar days of approval of production plans and physical security inspection 

will be declared non-responsible.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 10 of 74

391-S R-1 (03/23)

SECURITY WARNING: “Personally identifiable information” (PII) means information that can be used to 

distinguish or trace an individual’s identity, either alone or when combined with other information that is linked 

or linkable to a specific individual. The PII may range from common data elements such as names, addresses, 

dates of birth, and places of employment, to identity documents, Social Security numbers (SSN) or other 

Government-issued identifiers, precise location information, medical history, and biometric records.

All employees working on this contract must:

▪ Be familiar with current information on security, privacy, and confidentiality as they relate to the 

requirements of this contract.

▪ Obtain pre-screening authorization before using sensitive or critical applications pending a final 

suitability determination as applicable to the specifications.

▪ Lock or logoff their workstation/terminal prior to leaving it unattended. 

▪ Act in an ethical, informed, and trustworthy manner.

▪ Protect sensitive electronic records.

▪ Be alert to threats and vulnerabilities to their systems.

▪ Be prohibited from having any mobile devices or cameras in sensitive areas that contain any confidential 

materials, including areas where shredding and waste management occurs.

Contractor’s managers working on this contract must:

▪ Monitor use of mainframes, PCs, LANs, and networked facilities to ensure compliance with national and 

local policies, as well as the Privacy Act statement.

▪ Ensure that employee screening for sensitive positions within their department has occurred prior to any 

individual being authorized access to sensitive or critical applications.

▪ Implement, maintain, and enforce the security standards and procedures as they appear in this contract 

and as outlined by the contractor.

▪ Contact the security officer within 24 hours whenever a systems security violation is discovered or 

suspected.

Applicability: The responsibility to protect PII applies during the entire term of this contract and all option year 

terms if exercised. All contractors must secure and retain written acknowledgement from their employees stating 

they understand these policy provisions and their duty to safeguard PII. These policy provisions include, but are 

not limited to, the following:

▪ Employees are required to have locking file cabinets or desk drawers for storage of confidential material, 

if applicable.

▪ Material is not to be taken from the contractor’s facility without express permission from the 

Government.

▪ Employees must safeguard and protect all Government records from theft and damage while being 

transported to and from contractor’s facility.

The following list provides examples of situations where PII is not properly safeguarded:

▪ Leaving an unprotected computer containing Government information in a non-secure space (e.g., leaving 

the computer unattended in a public place, in an unlocked room, or in an unlocked vehicle).

▪ Leaving an unattended file containing Government information in a non-secure area (e.g., leaving the file 

in a break-room or on an employee’s desk).

▪ Storing electronic files containing Government information on a computer or access device (flash drive, 

CD, etc.) that other people have access to (not password-protected).
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 11 of 74

391-S R-1 (03/23)

This list does not encompass all failures to safeguard PII but is intended to act as an alert to the contractor’s 

employees to situations that must be avoided. Misfeasance occurs when an employee is authorized to access 

Government information that contains sensitive or personally identifiable information and, due to the employee’s 

failure to exercise due care, the information is lost, stolen, or inadvertently released.

Clause 2352.224-2A Protecting and Reporting the Loss of Personally Identifiable Information (May 2019)

(a) Definitions. 

The following terms are defined for the purposes of this clause:

“Agency” means the Social Security Administration (SSA).

“Breach” means the loss of control, compromise, unauthorized disclosures, unauthorized acquisition, or 

any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses 

personally identifiable information (PII); or (2) an authorized user accesses or potentially accesses 

personally identifiable information for another than authorized purpose. A breach is not limited to an 

occurrence where a person other than an authorized user potentially accesses PII by means of a network 

intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email 

message or attachment. A breach may also include the loss or theft of physical documents that include PII 

and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, 

or an oral disclosure of PII to a person who is not authorized to receive that information. It may also 

include an authorized user accessing PII for other than an authorized purpose. Often, an occurrence may 

be first identified as an incident, but later identified as a breach once it is determined that the incident 

involves PII, as is often the case with a lost or stolen laptop or electronic storage device. 

Some common examples of a breach include: 

▪ A laptop or portable storage device storing PII is lost or stolen; 

▪ An email containing PII is inadvertently sent to the wrong person; 

▪ A box of documents with PII is lost or stolen during shipping; 

▪ An unauthorized third party overhears agency employees discussing PII about an individual seeking 

employment or Federal benefits; 

▪ A user with authorized access to PII sells it for personal gain or disseminates it to embarrass an 

individual; 

▪ An information technology system that maintains PII is accessed by a malicious actor; or 

▪ PII that should not be widely disseminated is posted inadvertently on a public website.

“Employee(s)” means individual(s) under a direct employee-employer relationship with the contractor, 

where the contractor has the power or right to control and direct the individual in the material details of 

how work is to be performed. 

“Handling of PII” or “handle(s) PII” means accessing, using, creating, collecting, processing, storing, 

maintaining, disseminating, disclosing, disposing, or destruction of PII, as defined in this clause. 

“Incident” means an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the 

integrity, confidentiality, or availability of information or an information system or (2) constitutes a 

violation or imminent threat of violation of law, security policies, security procedures, or acceptable use 

policies.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 12 of 74

391-S R-1 (03/23)

“Personally identifiable information” (PII) means information that can be used to distinguish or trace an 

individual’s identity, either alone or when combined with other information that is linked or linkable to a 

specific individual. The PII may range from common data elements such as names, addresses, dates of 

birth, and places of employment, to identity documents, Social Security numbers (SSN) or other 

government-issued identifiers, precise location information, medical history, and biometric records. 

Within this clause, “PII” shall specifically mean PII that is made or becomes available to the contractor, 

including its employees, as a result of performing under this contract. 

“Primary agency contact” means the SSA Contracting Officer’s Representative (COR) who is the 

Contracting Officer’s Technical Representative (COTR) or, for indefinite delivery contracts with 

individual orders issued against the contract, e.g., task-order contracts, the order’s Task Manager, if one 

has been assigned. The COR may have one or more designated alternates to act for the COR when the 

COR is unavailable. If neither the COR nor the designated alternate is available, the alternate shall be 

considered a responsible agency manager in the office.

“Secure area” or “Secure duty station” means, for the purpose of this clause, either of the following, 

unless the agency expressly states otherwise on a case-by-case basis: (1) a contractor employee’s official 

place of work that is in the contractor’s established business office in a commercial setting, or (2) a 

location within the agency or other Federal- or State-controlled premises. A person’s private home, even 

if it is used regularly as a “home office” (including that of a contractor management official), shall not be 

considered a secure area or duty station. 

“Suspected breach” means PII that, among other possibilities, has been lost or stolen, or accessed in an 

unauthorized fashion, but it is not yet confirmed that the PII has been compromised to meet the level of a 

breach. 

“Transport(ing)” or “transported” means the physical taking or carrying of PII from one location to 

another. For the purpose of this clause, the term does not include shipping by a common or contract 

carrier (as defined in Federal Acquisition Regulation (FAR) section 47.001), shipping by the U.S. Post 

Office, or electronic transmission. See “FILE TRANSFER MANAGEMENT SYSTEM (FTMS) 

REQUIREMENTS” specified herein for information regarding electronic transmission. SSA will review 

and approve the Material Handling and Inventory Control plans (see “PREAWARD PRODUCTION 

PLANS, Materials Handling and Inventory Control”). The plans shall describe in detail how the 

contractor will transport PII. 

(b) Responsibility for Safeguarding PII. 

(1) The contractor shall comply with applicable limitations on use, treatment, and safeguarding of PII 

under the Privacy Act of 1974 (5 U.S.C. § 552a); the Federal Information Security Management Act 

of 2002 (44 U.S.C. § 3541, et seq.), as amended by the Federal Information Security Modernization 

Act of 2014 (Pub. L. 113-283); related National Institute of Standards and Technology guidelines; the 

Paperwork Reduction Act, 44 U.S.C. § 3501-3521; the E-Government Act of 2002, 44 U.S.C. § 3501 

note; Office of Management and Budget (OMB) guidance relating to handling of PII, including OMB 

Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable 

Information”; SSA privacy and security policies and procedures relating to handling of PII; and other 

Federal laws governing handling of PII.

(2) The contractor shall establish, maintain, and follow its own policies and procedures to protect the 

confidentiality of PII (PII policies and procedures) in accordance with the laws, policies, and 

requirements referenced in this clause and elsewhere in the contract. The contractor’s PII policies 

and procedures shall include safeguards to protect PII from loss, theft, or inadvertent disclosure and 

breach procedures.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 13 of 74

391-S R-1 (03/23)

(3) The contractor shall restrict handling of PII to only those authorized employees who need it in 

connection with the performance of work under this contract.

(4) Unless authorized by this contract or otherwise in writing by SSA, the contractor shall not publish, 

disclose, release, or otherwise disseminate PII, internally or externally.

(5) The contractor shall inform its employees who will or may handle PII of their individual 

responsibility to safeguard it. In addition, the contractor shall educate and train employees as required 

by FAR 24.301 and enforce employees’ compliance with the contractor’s PII policies and procedures 

and other requirements relating to handling of PII in this contract. SSA may require the contractor to 

provide evidence of the performance of training and the content of the training.

(6) Additional policies, procedures, and requirements involving the handling of PII may be prescribed 

elsewhere in this contract, including but not limited to information security policies. The contractor 

shall follow all such policies, procedures, and requirements. If contract performance calls for the 

contractor handling of PII in a manner not addressed in this clause or elsewhere in the contract that 

may cause a security question or concern, the contractor shall seek clarification and direction from the 

agency, prior to commencing the handling of PII in question. 

(c) Safeguarding Requirements.

(1) The contractor is responsible for safeguarding PII at all times. The contractor shall ensure that PII 

remains under the immediate supervision and control of authorized employees in a manner that will 

protect the confidentiality and integrity of PII. Examples of proper safeguarding include, but are not 

limited to: maintaining the confidentiality of each employee’s individual password (by not sharing 

the password with any other individual or entity and not writing it down); verifying the identity of 

individuals before disclosing information to them; preventing others in the area from viewing PII on 

one's computer screen; consistently locking or logging off one's workstation when one is away; and 

ensuring that PII is appropriately returned or, upon receiving the agency’s approval, destroyed when 

no longer needed. The contractor may use its internal policies and practices, non-disclosure 

agreements, system security requirements or any other means to accomplish its safeguarding 

responsibilities.

(2) Transporting PII Outside a Secure Area/Secure Duty Station. 

(i) The contractor shall safeguard equipment, files, or documents containing PII when transporting 

information from a secure area/secure duty station. The contractor shall ensure that the laptops 

and other electronic devices/media being used to transport PII are encrypted and password 

protected. The contractor shall ensure that the encryption and password protection are in 

accordance with any agency-prescribed standards or policies, which shall be communicated 

separately from this clause. The contractor shall use reasonable protection measures when 

transporting PII, e.g., storing files in a locked briefcase, not leaving files and/or equipment in 

plain view. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 14 of 74

391-S R-1 (03/23)

(ii) The contractor shall ensure that its PII policies and procedures address transporting PII outside a 

secure area and emailing PII to and from non-SSA email addresses. The contractor shall provide 

employees, upon or immediately prior to their commencing work on the contract, with contact 

information and instructions relating to PII breaches and incidents, based on the contractor’s 

security/PII loss incident policy and procedures. (If the preceding requirement is introduced to the 

contract under a contract modification, the contractor shall ensure employees are provided this 

information and instructions within 10 working days of the modification.) The contractor shall 

periodically remind employees of the foregoing information and instructions per the regular 

training requirements at (d)(1) below. (NOTE: Agency-prescribed contact information and 

instructions for reporting lost or possibly lost PII are discussed in paragraph (d) below.) SSA 

may require that the contractor present evidence of compliance with these provisions.

(iii) Tracking PII-containing material (files, documents, etc.). 

(A) Unless the PII is being transported for disposal pursuant to the contract per (c)(3) below, or 

SSA grants an exception per (c)(2)(iii)(D) below, the contractor shall take appropriate and 

necessary action to ensure that the PII-containing material, such as file(s) or document(s) 

being physically transported or transmitted electronically outside the secure area/secure 

duty station, are tracked through a log. The PII-containing material shall be logged out 

prior to transport as well as logged back in upon return. The contractor can establish any 

mechanism for tracking as long as the process, at a minimum, provides for the following 

information to be logged: 

(1) first and last name of the employee taking/returning the material; 

(2) the identification of the PII-containing material, such as the name of the file(s) or 

document(s) containing PII; 

(3) the media used to transport the PII (e.g., electronic, such as laptop, portable drive, 

compact disc/digital versatile disc (CD/DVD), or email—be as specific as possible; 

paper, such as paper file folders or printouts);

(4) the reason he/she intends to transport the PII-containing material;

(5) the date he/she transported the PII-containing material from the secure area/secure duty 

station; 

(6) the date the PII-containing material is due to be returned to the secure area/duty station. 

See subparagraph (c)(2)(iii)(B) immediately below.

(7) the approver’s name and phone number.

(8) the actual return date of the PII-containing material.

(B) Materials shall be returned or, when authorized by paragraph (c)(3), documented as 

destroyed, within 90 calendar days of removal from the office or have contractor 

supervisory approval for being held longer.

(C) The log shall be maintained in a secure manner. Upon request by the agency, the contractor 

shall provide the information from the log in a format (e.g., electronic or paper) that can be 

readily accessed by the agency. The contractor shall retain the log in accordance with 

General Records Schedule 4.2, Information Access and Protection Records, Item 40 

(disposition authority DAA-GRS-2016-0002-0004). (See Exhibit F.)
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 15 of 74

391-S R-1 (03/23)

(D) SSA may relieve the contractor of having to comply with these logging requirements for 

certain transmissions when the contractor is engaged in routine and secure transmission of 

PII, and SSA determines that there are appropriate security controls in place to track the 

data through other means.

(3) Return and/or Disposal of PII. The contractor shall return and/or dispose of the PII when the PII is no 

longer required for performance of this contract, e.g., upon contract completion, per agency direction 

and requirements. The marked statement(s) below apply to this contract: 

[ x ] (i) This contract entails the return of PII. 

[ x ] (ii) This contract entails the disposal of PII. The contractor shall follow the procedures 

described in “Disposal of Waste Materials” (see ‘PREAWARD PRODUCTION PLANS, 

Disposal of Waste Materials”).

(4) Emailing PII. The contractor’s corporate or organizational email system is deemed not to be secure. 

Therefore, the contractor shall put policies and procedures in place to ensure that its employees email 

PII using only the following procedures in (i) and (ii), below: 

(i) Sending from an SSA email address. If employees have been given access to the SSA email 

system, they may use it to send email messages containing PII in the body or in an unencrypted 

attachment but only to other SSA email addresses (which contain the “name @ssa.gov” format) 

or to email addresses belonging to an SSA-certified email system. Email directed to any other 

address(es) may contain PII only if the PII is entirely contained in an encrypted attachment. The 

contractor shall encrypt PII in accordance with OMB Circular A-130, Managing Information as a 

Strategic Resource (July 28, 2016).

(ii) Sending from a non-SSA email system. If employees are using the contractor’s own or any other 

non-agency email system (e.g., Yahoo!, Gmail), they may send email messages transmitting PII 

only if the PII is entirely contained in an encrypted attachment, per OMB Circular A-130; none of 

the PII may be in the body of the email itself or in an unencrypted attachment. When emailing 

from such systems, this procedure applies when emailing PII to any email address, including but 

not limited to, an SSA email system address. Unless specifically noted otherwise, the contractor 

and its employees are expected to conduct business operations under this contract using the 

contractor’s own email system, i.e., in accordance with the foregoing rules for transmitting PII. 

SSA may grant written exceptions to compliance with the email requirements in paragraph (c)(4) 

above when the contractor’s corporate or organizational email system has been deemed by SSA 

to be secure. 

(d) Procedures for Reporting PII Breach or Incident. The agency has its own reporting requirements for PII 

breaches or incidents. The purpose of the following paragraphs is to ensure that the contractor meets the 

requirements and shares breach or incident information appropriately. The contractor’s report of a breach 

or incident will not, by itself, be interpreted as evidence that the contractor failed to provide adequate 

safeguards for PII.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 16 of 74

391-S R-1 (03/23)

(1) Contractor Responsibility. In addition to establishing and implementing its own internal procedures 

referenced in paragraph (b) above, the contractor shall provide regular training (at least annually and 

when new employees commence work) for contractors on how to identify and report a breach or 

incident and take reasonable actions to implement agency-prescribed procedures described in 

paragraph (d)(3) below for reporting PII breaches or incidents. These include training employees 

handling PII about these procedures, including how to identify and report a PII breach or incident, 

and otherwise taking appropriate and necessary steps to enforce their compliance in carrying them 

out. The contractor shall cooperate and exchange information with agency officials, as determined 

necessary by the agency, in order to report and manage a suspected or confirmed breach or incident 

effectively. The contractor shall maintain capabilities to determine what agency information was or 

could have been accessed and by whom, be able to construct a timeline of user activity, determine 

methods and techniques used to access agency information, and identify the initial attack vector. The 

contractor shall allow for an inspection, investigation, forensic analysis, and any other action 

necessary to ensure compliance with OMB memorandum M-17-12 and agency guidance and breach 

procedures to assist with responding to a breach or incident. SSA may require evidence of 

compliance with this guidance.

(2) Potential Need for Immediate, Direct Reporting by the Employee. The agency recognizes that 

contractor employees will likely make the initial discovery of a PII breach or incident. When an 

employee becomes aware or suspects that PII has been lost or compromised, he/she is required to 

follow the contractor’s established security/PII breach/incident reporting process (see paragraph 

(d)(1), above). The contractor’s reporting process, along with the agency’s (see paragraph (d)(3)

below), shall require the contractor, and not necessarily the employee, in such circumstances to notify 

the agency of the breach or incident. However, the contractor shall inform each employee handling 

or potentially handling PII that he/she must be prepared to notify outside authorities directly and 

immediately as described in paragraph (d)(3)(v) below, if, shortly following the breach or incident or 

discovery of the breach or incident, he/she finds it evident that neither an appropriate contractor nor 

the agency manager/contact can be reached. The contractor shall emphasize to the employee that 

timeliness in reporting the incident is critical.

(3) Procedures.

(i) When a contractor employee becomes aware of or suspects a PII breach or incident, the 

contractor, in accordance with its incident reporting process, shall provide immediate (as soon as 

possible and without unreasonable delay) notification of the breach or incident to the primary 

agency contact. If the primary agency contact is not readily available, the contractor shall 

immediately notify the contact’s alternate. (See the worksheet in agency-specific clause 

2352.224-2B (Exhibit G), for the identity of the designated primary and alternate agency 

contacts.) The contractor shall act to ensure that each employee, prior to commencing work on 

the contract, has been given information as to who the primary and alternate agency contacts are 

and how to contact them. In addition, the contractor shall act to ensure that each employee 

promptly receives any updates on such information, as they are made available. Whenever the 

employee removes PII from a secure area/secure duty station, he/she shall comply with the 

contractor’s security policies, including having on hand the current contact information for the 

primary agency contact and at least one alternate. 

(ii) The contractor shall provide the primary agency contact or the alternate, as applicable, updates on 

the status of the reported PII loss or compromise as they become available but shall not delay the 

initial report.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 17 of 74

391-S R-1 (03/23)

(iii)The contractor shall provide complete and accurate information about the details of the PII breach 

or incident to assist the agency contact/alternate, including the following information:

(A) Contact information;

(B) A description of the PII breach or incident (i.e., nature of the breach, scope, number of files 

or records, type of equipment or media, etc.) including the approximate time and location of 

the loss;

(C) A description of safeguards used, where applicable (e.g., locked briefcase, redacted personal 

information, password protection, encryption, etc.);

(D) An identification of agency components (organizational divisions or subdivisions) contacted, 

involved, or affected;

(E) Whether the contractor or its employee has contacted or been contacted by any external 

organizations (i.e., other agencies, law enforcement, press, etc.);

(F) Whether the contractor or its employee has filed any other reports (i.e., Federal Protective 

Service, local police, and agency reports); and

(G) Any other pertinent information. 

(iv) The contractor may use the worksheet following this clause to gather and organize information 

quickly about the incident. The contractor shall ensure that each employee with access to PII 

under the contract, prior to accessing the PII, has a copy of the worksheet with its instructions 

(see agency-specific clause 2352.224-2B (Exhibit G)), and particularly when transporting PII 

from a secure duty station.

(v) There may be rare instances (e.g., outside of business hours) when the contractor is unable to 

reach either the primary agency contact or the alternate immediately. In such a situation, the 

contractor shall immediately call the agency’s National Network Service Center (NNSC) toll-free 

at 1-877-697-4889 to file the initial report directly, providing the information in (d)(3)(iii) above 

and as requested by the NNSC (again, the worksheet in agency-specific clause 2352.224-2B

(Exhibit G) may be used to collect and organize the information prior to (and/or during) the call). 

Overall, during this time, the contractor shall cooperate as necessary with the NNSC or any of the 

other external organizations described in (d)(3)(iii) above.

(vi) If the contractor makes a direct report to the NNSC, the contractor shall document the call with 

the Change, Asset, and Problem Reporting System (CAPRS) number, which the NNSC will 

assign. The contractor shall provide the CAPRS number to the primary agency contact, or, if 

unavailable, his/her alternate. 

(vii) Subparagraphs (v) through (vi) apply to all contractor employees. The contractor shall ensure its 

internal procedures and PII breach/incident training make clear to employees these 

responsibilities. Reports to the NNSC should not be delayed because an employee could not 

reach the contractor’s management.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 18 of 74

391-S R-1 (03/23)

(viii) The contractor and its employee(s) shall limit disclosures about PII involved in a breach or 

incident to only those SSA and contractor employee(s) with a need for the information in order to 

respond to and take action to prevent, minimize, or remedy the breach or incident. The contractor 

may disclose breach or incident information to Federal, state, or local law enforcement agencies 

and other third parties with a need for the information; however, information about the specific 

PII involved may only be disclosed to such authorities and third parties as Federal law permits. 

The contractor shall not, without SSA approval, publicly disclose information about PII involved 

in a breach or incident or SSA’s involvement in a breach or incident. The contractor shall not, 

without SSA approval, notify individuals affected by the PII breach or incident. The contractor’s 

PII breach and incident reporting process shall ensure that disclosures are made consistent with 

these requirements. As used in this paragraph, the term PII references only PII covered by this 

clause.

(e) Additional Contractor Responsibilities When There Is a Suspected or Confirmed Breach. 

(1) The contractor shall have a formal security/PII breach or incident reporting process in place that 

outlines appropriate roles and responsibilities, as well as the steps that must be taken, in the event of a 

security/PII breach or incident. The plan shall designate who within the contractor’s organization has 

responsibility for reporting the PII breach or incident to the agency.

(2) In the event of a PII breach or incident, the contractor shall take immediate steps to address 

consequential security issues that have been identified, including steps to minimize further security 

risks to those individuals whose personal information was lost, compromised, or potentially 

compromised. 

(3) The contractor shall confer with SSA personnel in reviewing the actions the contractor has taken and 

plans to take in dealing with the breach or incident. Additionally, the contractor shall provide any 

documentation requested by SSA.

(4) The contractor shall bear the cost for any data breach or incident: (1) occurring outside of SSAcontrolled facilities, systems, or environments when the affected PII was in the possession or control 

of the contractor or its employees, agents, or representatives; or (2) resulting from the contractor or its 

employees, agents, or representatives’ failure to properly safeguard PII or facilities, systems, or other 

environments containing PII in accordance with this contract’s requirements. In addition, as SSA 

requires, the contractor shall be responsible for or shall assist SSA in taking preventative and 

remedial actions that SSA determines are necessary to address such a breach or incident. 

Preventative and remedial actions may include notification to individuals potentially affected by the 

breach and other countermeasures to mitigate the risk of harm or to protect PII (e.g., operating call 

centers and providing resources for potentially affected individuals). SSA will notify the contractor 

when SSA determines that preventative or remedial action(s) are necessary and instruct the contractor 

on whether the action(s) will be effectuated by the contractor or SSA. SSA may choose to effectuate 

the action(s) at the agency’s discretion. The contractor shall be responsible for the cost of all 

preventative or remedial action(s), including those actions effectuated by SSA, resulting from the 

breaches and incidents covered by this paragraph. Note: Nothing in this paragraph affects the 

contractor’s obligations in paragraph (e)(2) above to take immediate steps to address identified 

security issues.

(f) Subcontractor(s). 

(1) The contractor shall include this clause in all resulting subcontracts whenever there is any indication 

that the subcontractor(s) and their employees, or successor subcontractor(s) and their employees, will 

or may handle PII. When this clause is included in a subcontract, all references to “contractor” in 

paragraphs (a) through (e) and (h) shall be read to apply to the subcontractor(s).
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 19 of 74

391-S R-1 (03/23)

(2) The contractor shall take appropriate and necessary action to ensure its subcontractor(s) and their 

employees, or any successor subcontractor(s) and their employees, comply with this clause. 

(3) Notification of Subcontractor Handling of PII. If the contractor engages a subcontractor under this 

contract whose employee(s) will actually or potentially handle PII, the contractor shall do the 

following: 

(i) Notify the SSA COR-COTR and the Contracting Officer of this arrangement in advance of 

providing access to PII, providing the subcontractor name(s) and address(es) and, upon request, a 

description of the nature of the PII to which the employee(s) will actually or potentially be 

given/have access (e.g., phone numbers, SSN); and 

(ii) Provide the agency’s COR-COTR the names of the subcontractor employee(s) who will actually 

or potentially be assigned and/or have access to the PII. The contractor may satisfy this 

requirement when submitting the name(s) of the subcontractor employee(s) to the agency’s CORCOTR for the requisite security background check described in paragraph (g) below. 

(g) Security & Suitability Requirements Clause. For each contractor employee handling PII, the contractor 

shall fulfill the requirements of the Security & Suitability Requirements Clause, found elsewhere in this 

contract, to ensure that any such individual has the appropriate background checks.

(h) The contractor shall permit the agency to conduct security reviews and inspections to ensure that the 

contractor maintains adequate safeguards and security measures for PII in accordance with the terms of 

this contract. At SSA’s request, the contractor shall grant SSA, and its auditors, access to all systems, 

facilities, equipment, locations, and other environments that create, collect, use, process, store, maintain, 

disseminate, disclose, or dispose of PII for such reviews and inspections. The contractor is not required to 

provide SSA access to parts of those systems, facilities, equipment, locations, and other environments that 

are not impacted by such reviews and inspections

Clause 2352.204-1 – Security and Suitability Requirements (MAR 2018)

(a) Acronyms and Definitions – As used in this clause –

NOTE: For the purposes of this contract, the Contracting Officer’s Representative (COR) or Contracting 

Officer’s Technical Representative (COTR) is the SSA representative/Program Lead. The terms 

“vendor” and “contractor” are used interchangeably throughout this contract. Additionally, the terms 

“business days” and “workdays” are used interchangeably throughout this contract.

“Access to a facility, site, system, or information” means physical access to any Social Security 

Administration (SSA) facility or site, logical access to any SSA information system, or access to 

programmatic or sensitive information.

“CO” means Contracting Officer.

“Contractor” means any entity having a relationship with SSA because of this contract. This term 

includes, but is not limited to, corporations, limited liability partnerships, and sole proprietorships.

“Contractor personnel” means employees of the contractor, employees of the subcontractor, any 

consultant retained by the contractor or subcontractor, any volunteer or intern of the contractor or 

subcontractor, and if the contractor or subcontractor is a sole proprietorship, it refers to the sole 

proprietorship. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 20 of 74

391-S R-1 (03/23)

“CPOC” means company point of contact as specified by the contract.

“CSPS” means Center for Suitability and Personnel Security.

“e-QIP” means Electronic Questionnaire for Investigations Processing. 

“PIV” means Personal Identity Verification.

“Subcontractor” means any entity having a relationship with SSA’s contractor because of this contract. 

This term includes, but is not limited to, corporations, limited liability partnerships, and sole 

proprietorships

(b) Purpose 

This clause provides SSA’s policies and procedures concerning the conduct of background investigations 

(i.e. suitability determinations) of contractor personnel. A background investigation is required any time 

contractor personnel requires any type of access to a facility, site, system, or information, whether or not a 

PIV credential is required. Contractor personnel may be subject to periodic reinvestigation per SSA 

policy. The purpose of these investigations is to determine the suitability of contractor personnel needing 

access to a SSA facility, site, system, or information. If applicable, the clause also describes the process 

to obtain a PIV credential. 

(c) PIV Credentials

(1) A PIV credential is required for contractor personnel requiring access to an SSA information system 

or routine, unescorted access to a SSA facility or site for a period of six months or more. (See 

paragraph (k) for more information.)

(2) A PIV credential is not required for: 

(i) Contractor personnel requiring escorted access to an SSA facility or site for less than six months; 

or

(ii) Contractor personnel requiring infrequent escorted access to an SSA facility or site, even if the 

access may be longer than six months (e.g., contractor personnel who provide infrequent facilities 

or equipment maintenance or repair, or who conduct onsite shredding, etc.). 

(d) Authorities

(1) Homeland Security Presidential Directive 12 

(http://www.dhs.gov/homeland-security-presidential-directive-12). 

(2) Office of Management and Budget Memorandum M-05-24

(https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-

24.pdf).

(3) The Crime Control Act of 1990, Public Law 101-647, subtitle E, as amended by Public Law 102-190 

(for childcare center security requirements)

(http://www.gpo.gov/fdsys/pkg/USCODE-2010-title42/pdf/USCODE-2010-title42-chap132-

subchapV-sec13041.pdf).
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 21 of 74

391-S R-1 (03/23)

(4) Executive Orders 13764 and 12968

(https://www.hsdl.org/?abstract&did=798174) and

https://www.gpo.gov/fdsys/pkg/FR-1995-08-07/pdf/95-19654.pdf) 

(5) Title 5, Code of Federal Regulations (CFR), Parts 731, 736, and 1400 (for positions assigned a 

“National Security” designation) 

(http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&tpl=/ecfrbrowse/Title05/5cfr731_main_02.tpl, 

http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&tpl=/ecfrbrowse/Title05/5cfr736_main_02.tpl, and 

http://www.ecfr.gov/cgi-bin/textidx?SID=ea8d9b7f129b58c4b512ea9d68a44761&mc=true&node=pt5.3.1400&rgn=div5%23se5.3.14

00_1201)

(e) Suitability Process

The background investigation and adjudication processes are compliant with 5 CFR 731 or equivalent. 

Any new vendor personnel (i.e., those who have not previously received a suitability determination under 

this contract) requiring access to an SSA facility, site, information, or system, must complete and submit, 

through the COR-COTR, the documents listed in (a)(1) at least 30 workdays prior to the date vendor 

personnel are to begin work. The suitability process cannot begin until the vendor submits, and SSA 

receives, accurate and complete documents.

(1) Suitability Document Submission

a. Immediately upon award, the Company Point of Contact (CPOC) must provide to the Center for 

Suitability and Personnel Security (CSPS) and a copy to the Contracting Officer’s Representative 

(COR) for all vendor personnel requesting a suitability determination using a secured/encrypted 

email* with a password sent separately to dchr.ope.suitability@ssa.gov:

(i) An e-QIP applicant listing including the names of all vendor personnel requesting suitability;

(ii) Completed Optional Form (OF) 306, Declaration for Federal Employment. (See Exhibit H); 

(iii)Fair Credit Reporting Act (FCRA) Authorization Form (Exhibit I);

(iv) Additional Questions for Public Trust Positions Branching (Exhibit J); and,

(v) Work authorization for non-United States (U.S.) born applicants, if applicable.

b. The e-QIP applicant listing must include the vendor name, the Social Security Administration 

(SSA) vendor number, the CPOC’s name, the CPOC’s contact information, the COR’s name, the 

COR’s contact information, and the full name, Social Security Number, date of birth, place of 

birth (must show city and state if born in the U.S. OR city and country if born outside of the 

U.S.), and a valid email address for all vendor personnel requesting suitability. All spelling of 

names, email addresses, places, and numbers must be accurate and legible.

(2) e-QIP Application 

a. Once SSA receives all completed documents, listed in (a)(1), the Center for Suitability and 

Personnel Security (CSPS) will initiate the e-QIP process using the e-QIP applicant listing. CSPS 

will email the e-QIP notification to the CPOC and COR inviting vendor personnel to the e-QIP 

website to electronically complete the background investigation form (Standard Form (SF) 85P, 

Questionnaire for Public Trust Positions). (See Exhibit K.)
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 22 of 74

391-S R-1 (03/23)

b. Vendor personnel will have up to 10 business days to complete the e-QIP application. The 10-day 

timeframe begins the day CSPS sends the invitation to the CPOC and COR. Vendor personnel 

must electronically sign the signature pages before releasing the application in e-QIP. Signature 

pages include the Certification, Release, and Medical Release pages for the SF 85P. Find 

information about the e-QIP process in the e-QIP Quick Reference Guide for e-QIP Applicants at 

https://nbib.opm.gov/e-qip-background-investigations/.

c. If vendor personnel need assistance with e-QIP logon and navigation, they can call the e-QIP 

Hotline at 1-844-874-9940.

(3) Fingerprinting 

a. The e-QIP notification email also provides vendor personnel with instructions to obtain electronic 

fingerprinting services. Vendor personnel must report for fingerprint services immediately upon 

completion and release of the e-QIP application and within 10 business days from the day CSPS 

sends the invitation.

b. If vendor personnel cannot report to the designated fingerprint locations (in the notification 

email), CSPS will accept completed Field Division (FD) 258 fingerprint cards. (See Exhibit L.)

The COR can provide the FD 258, if required. Vendor personnel must complete all fields on the 

FD 258. Incomplete fields may delay suitability processing.

c. If the vendor needs to mail completed FD 258 fingerprint cards, the vendor can send them, via 

certified mail, along with a completed Vendor Personnel Suitability Cover Sheet to: Social 

Security Administration Center for Suitability and Personnel Security, Attn: Suitability Program 

Officer, 6401 Security Boulevard, 2246 Annex Building, Baltimore, MD 21235.

(4) Status Check

If vendor personnel have completed each of the steps in (e) in their entirety and do not receive a 

suitability determination within 15 business days of their last submission, call 1-844-874-9940 to 

determine suitability status.

(f) Suitability Determination

(1) CSPS uses a Federal Bureau of Investigation fingerprint check as part of the basis for making a 

suitability determination. 

This determination is final unless information obtained during the remainder of the full background 

investigation, conducted by the Office of Personnel Management, is such that SSA would find the 

vendor personnel unsuitable to continue performing under this contract. CSPS will notify the CPOC 

and the COR of the results of these determinations.

(2) SSA will not allow vendor personnel access to a facility, site, information, or system until CSPS 

issues a favorable suitability determination. A suitability determination letter issued by CSPS is valid 

only for performance on the vendor specified in the letter.

(3) If personnel have been cleared at a previous contractor’s facility and are to perform work under a new 

vendor, the CPOC must submit a fully completed, legible Contractor Personnel Rollover Request 

Form to the COR. (See Exhibit M.) CSPS will notify the CPOC, COR, and Contracting Officer (CO) 

of suitability to work under the new vendor.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 23 of 74

391-S R-1 (03/23)

(g) Vendor Personnel Previously Cleared by SSA or Another Federal Agency

If vendor personnel previously received a suitability determination from SSA or another Federal agency, 

the CPOC should include this information next to the vendor personnel’s name on the initial applicant 

listing (see paragraph (a)(1)(b)) along with the OF 306. CSPS will review the information. If CSPS 

determines another suitability determination is not required, it will provide a letter to the CPOC and the 

COR indicating the vendor personnel were previously cleared under another Federal contract and do not 

need to go through the suitability determination process again.

(h) A contractor is not entitled to an equitable adjustment of the contract because of an unfavorable suitability 

determination(s). Additionally, if SSA determines that the number or percentage of unfavorable 

determinations make successful contract performance unlikely, SSA may terminate the contract for cause 

or default. 

(i) Unsuitable Determinations

(1) The vendor must notify the contractor personnel of any unsuitable determinations as soon as possible 

after receipt of such a determination.

(2) The vendor must submit requests for clarification for unsuitable determinations in writing within 30 

calendar days of the date of the unsuitable determination to the email mailbox or address listed below. 

Vendor personnel must file their own requests; vendor may not file requests on behalf of vendor 

personnel.

dchr.ope.suitclarify@ssa.gov

OR

Social Security Administration; Center for Suitability and Personnel Security, Attn: Suitability 

Program Officer, 6401 Security Boulevard, 2246 Annex Building, Baltimore, MD 21235

(j) Vendor Notification to Government

The vendor shall notify the COR and CSPS within one business day if any vendor personnel are arrested 

or charged with a crime, or if there is any other change in the status of vendor personnel (e.g., leaves the 

company, no longer works under the vendor, the alien status changes, etc.) that could affect their 

suitability determination. 

The vendor must provide in the notification as much detail as possible, including, but not limited 

to: name(s) of vendor personnel whose status has changed, SSA vendor number, the type of charge(s), if 

applicable, date of arrest, the court date, jurisdiction, and, if available, the disposition of the charge(s).

(k) Obtaining a Credential

(1) This section applies only if contractor personnel will have access to a SSA information system or 

routine or unescorted access to a SSA facility or site for a period of six months or more as described 

in paragraph (c)(1).
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 24 of 74

391-S R-1 (03/23)

(2) Once the contractor personnel receive notification of an acceptable suitability determination, but prior 

to beginning work under the contract, the contractor personnel must appear at the respective Regional 

Security Office or SSA Headquarters Parking and Credentialing Office to begin the credentialing 

process. The contractor must contact the COR-COTR to arrange for credentialing. Once the CORCOTR makes the appointment, the COR-COTR must contact the contractor to inform the contractor 

of the credentialing appointment(s). The COR-COTR will also arrange for the contractor personnel 

to be escorted (by either the COR-COTR or a COR-COTR’s representative) to the appropriate 

credentialing office at the time of this appointment. The contractor personnel must present the 

suitability determination letter and two forms of identification at this meeting. At least one of the 

forms of identification must be a Government-issued photo identification (ID) (for acceptable forms 

of ID, see List of Acceptable Documents on OAG’s website). For SSA Headquarters access, a 

completed Form SSA-4395, Application for Access to SSA Facilities, signed by the contractor 

personnel and the COR-COTR is also required. The COR-COTR will provide the SSA-4395 Form to 

the contractor personnel when applicable. 

(3) Credentialing appointments last approximately 15 minutes. Depending on a contractor’s scheduling 

needs and availabilities, contractor personnel may be scheduled for credentialing all in one day (this 

process may take a few hours to complete, depending on the number of contractor personnel that need 

to be credentialed) or they may come in at separate times convenient to the contractor personnel’s and 

the COR-COTR’s schedules. 

(4) Contacts

a. SSA Headquarters’ Parking and Credentialing Office representatives can be reached at 

Parking.and.Credentialing@ssa.gov or 410-965-5910. 

b. Research Triangle Park Parking and Credentialing Office representatives can be reached at 

SSC.Parking.and.Credentialing@ssa.gov or 877-586-6650, extensions 25206 or 25207.

c. Regional Security Office contact information is in the Appendix at the end of this clause. 

(l) Contractor Return of PIV Credential 

The contractor must account for and ensure that all forms of Government-provided identification (PIV 

credential) issued to contractor personnel under this contract are returned to SSA’s Headquarters’ Parking 

and Credentialing Office or Regional Security Office, as appropriate, as soon as any of the following 

occur: when no longer needed for contract performance; upon completion of any contractor personnel 

employment; or upon contract completion or termination. 

(m)Government Control 

The Government has full control over and may grant, deny, or withhold access to a facility, site, system, 

or information and may remove contractor personnel, or require the contractor to remove contractor 

personnel from performing under the contract for reasons related to conduct even after contractor 

personnel are found suitable to work on the contract (see paragraph (n) below).
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 25 of 74

391-S R-1 (03/23)

(n) Removal From Duty 

The CO, in coordination with the COR-COTR and CSPS, may remove a contractor, or request the 

contractor immediately remove any contractor personnel from working under the contract based on 

conduct that occurs after a favorable suitability determination. This includes temporarily removing 

contractor personnel arrested for a violation of law pending the outcome of any judicial proceedings. The 

contractor must comply with these requests to remove any contractor personnel. The Government’s

determination may be made based on, but not limited to, these incidents involving the misconduct or 

delinquency: 

(1) Violation of the Rules and Regulations Governing Public Buildings and Grounds, 41 CFR 101-20.3. 

This includes any local credentialing requirements.

(2) Neglect of duty, including sleeping while on duty; unreasonable delays or failure to carry out 

assigned tasks; conducting personal affairs while on duty; and refusing to cooperate in upholding the 

integrity of SSA’s security program. 

(3) Falsification or unlawful concealment, removal, mutilation, or destruction of any official documents, 

records, or Government property or concealment of material facts by willful omissions from official 

documents or records.

(4) Disorderly conduct, use of abusive or offensive language, quarreling, intimidation by words or 

actions, or fighting. Also, participating in disruptive activities that interfere with the normal and 

efficient operations of the Government. 

(5) Theft, vandalism, or any other criminal actions. 

(6) Selling, consuming, possessing, or being under the influence of intoxicants, drugs, or substances that 

produce similar effects. 

(7) Improper use of official authority or credentials.

(8) Unauthorized use of communications equipment or Government property.

(9) Misuse of weapon(s) or tools used in the performance of the contract.

(10) Unauthorized access to areas not required for the performance of the contract.

(11) Unauthorized access to SSA’s employees’ personal property.

(12) Violation of security procedures or regulations. 

(13) Prior contractor personnel unsuitability determination by SSA or another Federal agency. 

(14) Unauthorized access to, or disclosure of, agency programmatic or sensitive information, or Internal 

Revenue Service Tax Return information.

(15) Failure to ensure the confidentiality of or failure to protect from disclosure, agency information 

entrusted to them. Certain provisions of these statutes and regulations apply to Federal employees, 

and apply equally to contractor personnel: The Privacy Act of 1974, The Tax Reform Act of 1976 

and the Taxpayer Browsing Protection Act of 1997, SSA regulation 1, The Computer Fraud and 

Abuse Act of 1986, and Section 1106 of the Social Security Act. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 26 of 74

391-S R-1 (03/23)

(16) Being under investigation by an appropriate authority for violating any of the above. 

(o) The contractor is required to include the substance of this clause in any subcontract requiring the 

subcontractor to access a SSA facility, site, system, or information. However, the contractor must obtain, 

review, and submit to SSA all of the completed and required forms (see paragraph (e) from the 

subcontractor. SSA will not accept completed forms from anyone other than the contractor. 

Regional Security Offices and Regional Credentialing Contacts for Contractor Personnel:

Region 1 – Boston

Management and Operations Support, Wilson Osorio, (617) 565-2840

Region 2 – New York

Center for Materiel Resources, Physical Security and Safety Team, Emmanuel Fernandez, (212) 264-

2603

Region 3 – Philadelphia

For Mid-Atlantic Social Security Center occupants: Center for Materiel Resources, Kevin Wiley, (215) 

597-1627

For all others: Center for Automation, Security and Integrity, (215) 597-5100

Region 4 – Atlanta

Center for Security and Integrity

Willie Martin, (404) 562-1761

Charlene C. Jones, (404) 562-1432

Glen Gaston, (404) 562-1871

Dennis Loewer, (404) 562-1340

Region 5 – Chicago

Management and Operations Support, Building Services Unit

Sharon Young, (312) 575-4150

Evelyn Principe, (312) 575-6342

Sofia Luna, (312) 575-5762

Carlon Brown, (312) 575-5957

Colleen Carrington, (312) 575-5242

Region 6 – Dallas

Center for Materiel Resources, Employee Relations, Veronica Drake, (214) 767-2221

Region 7 – Kansas City

Center for Automation Security Integrity, General Office Line, (816) 936-5555

Region 8 – Denver

Center for Security and Integrity, Phil Mocon, (303) 844-4016

Region 9 – San Francisco

Center for Security and Integrity, Cassandra Howard, (510) 970-4124

Region 10 –Seattle

Center for Security and Integrity

Mary Bates, (206) 615-2105

Lisa Steepleton, (206) 615-2183
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 27 of 74

391-S R-1 (03/23)

Clause 2352.204-2 Federal Information Security Modernization Act (FISMA) and Agency Privacy 

Management (MAY 2021)

(a) Definitions 

Terms defined for this clause:

“Agency” means the Social Security Administration (SSA).

“COR-COTR” means Contracting Officer’s Representative-Contracting Officer’s Technical 

Representative.

“Electronic Personnel Enrollment and Credentialing System (EPECS)” means the system supporting the 

Homeland Security Presidential Directive-12 credentialing process at SSA.

“OAG” means the Office of Acquisition and Grants at SSA.

“PIV Credential” means personal identity verification credentials required for contractor personnel 

requiring unescorted access to an SSA facility or access to SSA information systems. 

(b) Agency Responsibility Related to FISMA Training Requirements 

(1) The Federal Information Security Management Act of 2002 (44 U.S.C. § 3541, et seq.), as amended 

by the Federal Information Security Modernization Act of 2014 (Pub. L. 113-283) (collectively, 

“FISMA”), and the Office of Management and Budget Circular No. A-130 (published July 28, 2016) 

require all agency contractor and subcontractor personnel working under agency contracts who will 

have access to any kind of SSA information, receive periodic training in information technology (IT) 

security awareness and accepted IT security practice. This includes training for contractor personnel 

who do not have access to electronic information systems. The training level and content is tailored 

to the contractors’ assigned roles and responsibilities and the risk and magnitude of harm related to 

the required activities. 

(2) SSA requires contractor personnel to read and sign the Security Awareness Contractor Personnel 

Security Certification (CPSC) form, SSA-222. The SSA-222 is on OAG’s internet site (see 

paragraph (c)(3)(i) below) or contractors can ask the COR-COTR for a copy. This training does not 

preclude any additional role-based information security or privacy training specified elsewhere in this 

contract. 

(c) Contractor Responsibilities Related to FISMA Training Requirements

(1) Contractor Personnel Requiring an SSA-issued PIV Credential and Access to SSA’s Network

(i) Following contract award, the agency mandates contractor personnel requiring a PIV credential 

and access to SSA’s network to take security awareness training by reading and electronically 

signing the CPSC form, SSA-222, during the PIV credentialing process. This requirement also 

applies to contractor personnel requiring a PIV credential and access to SSA’s network 

subsequently added to the contract. If contractor personnel receive a PIV credential, contractors 

are not required to send an email per paragraph (c)(3)(iii). 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 28 of 74

391-S R-1 (03/23)

(ii) For each successive year of the contract, contractor personnel shall take annual security 

awareness training via a video on demand on an SSA-managed website. Contractor personnel 

with a valid SSA email address will receive an email to take this training at the appropriate time. 

Additionally, contractor personnel must electronically attest to the CPSC form, SSA-222, within 

EPECS. The COR-COTR will email this invitation to contractor personnel initiating this action.

(2) Contractor Personnel Requiring an SSA-issued PIV Credential but Not Access to SSA’s Network: 

(i) Following contract award, the agency mandates contractor personnel requiring a PIV credential to 

take security awareness training by reading and electronically signing the CPSC form, SSA-222, 

during the PIV credentialing process. This requirement also applies to contractor personnel 

subsequently added to the contract and requiring a PIV credential. For contractor personnel 

receiving a PIV credential, contractors are not required to send an email per paragraph (c)(3)(iii) 

for the first year of the contract.

(ii) For each successive year of the contract, the contractor shall repeat the processes described in 

paragraphs (c)(3)(i) through (iii), below, on an annual basis. The contractor must submit the 

information in paragraph (c)(3)(iii), below, within 45 calendar days of the date the option was 

renewed, or the anniversary of the contract award date, whichever comes first.

(3) Contractor Personnel Not Requiring an SSA-issued PIV Credential and No Access to SSA’s 

Network: 

(i) Following contract award, the contractor shall ensure that all contractor personnel performing 

under this contract take the security awareness training by reading and signing the CPSC form, 

SSA-222. This requirement also applies to contractor personnel subsequently added to the 

contract. A copy of this form is on OAG’s Internet website

(http://www.socialsecurity.gov/oag/acq/SSA-222.pdf) (See Exhibit N.)

(ii) The contractor must receive signed copies of the form from each contractor personnel working 

under the contract within 30 calendar days following contract award, or within 30 calendar days 

after a contractor personnel begins working under the contract, whichever comes first. 

(iii)The contractor shall send an email to the COR-COTR, within 45 calendar days following contract 

award. Similarly, the contractor shall send such email notification 45 calendar days of when new 

contractor personnel are added to perform work under the contract. The contractor will attach 

each signed form, completed per paragraph (c)(3)(ii), above, to the email along with a list of the 

names (first, middle initial, and last) of the contractor personnel who signed the form and the 

contract number they are working under.

(iv) For each successive year of the contract, the contractor shall repeat the processes described in 

paragraphs (c)(3)(i)-(iii), above, on an annual basis. The contractor must submit the information 

in paragraph (c)(3)(iii), above, within 45 calendar days of the date the option was renewed, or the 

anniversary of the contract award date, whichever comes first. 

(4) The contractor shall retain copies of signed CPSC forms, SSA-222, mentioned in paragraphs (c)(2) 

and (3) above for potential future SSA audits for a period of three years after final payment (per FAR,

Section 4.703). 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 29 of 74

391-S R-1 (03/23)

(d) Applicability of this Clause to Subcontractor Personnel. The contractor is required to include a clause 

substantially the same as this in all subcontracts awarded under the prime contract. This clause shall 

require the subcontractors to follow the instructions in paragraph (c) of this clause. For subcontractor 

personnel following paragraphs (c)(2) and (3), the subcontractor shall submit the signed forms to the 

contractor and the contractor will be responsible for submitting this information to SSA per paragraph 

(c)(3)(iii). The subcontractor shall be responsible for maintaining its signed forms as detailed in paragraph 

(c)(4). 

Email Procedures

For the contractor’s convenience, SSA has included the following instructions to send emails with sensitive 

documentation or messages containing personally identifiable information (e.g., SSNs, etc.) securely to an SSA 

email address. Contractor is to consult their local information technology staff for assistance. If the contractor 

utilizes an alternate secure method of transmission, it is recommended that the contractor contact the recipient to 

confirm receipt.

To Encrypt a File using WinZip

i. Save the file to contractor’s hard drive.

ii. Open Windows Explorer and locate the file.

iii. Right click on the file.

iv. Select “WinZip.”

v. Select “Add to Zip File.”

vi. An Add box pops up. Near the bottom of the box is an “Options” area.

vii. Click the “Encrypt added files” checkbox.

viii. Click the “Add” button.

ix. Check the “Hide Password” checkbox if not already checked.

a. Enter a string of characters as a password composed of letters, numbers, and special characters 

(minimum 8 characters – maximum 64 characters).

b. Select the 256-Bit AES encryption radio button.

c. Click “OK.”

x. The file has been encrypted successfully, and the new Zip file can now be attached to an email.

Providing the Recipient with the Password

Send the password to the intended recipient in a separate email message prior to sending the encrypted file or after 

sending the encrypted file. Do not send the password in the same email message to which the encrypted file is 

attached.

If possible, it is recommended to provide the password to the COR-COTR by telephone or establish a 

predetermined password between the contractor and the COR-COTR.

The COR-COTR should also submit the password in a separate email from the documentation when submitting to 

^DCHR OPE Suitability. Due to the large volume of submissions, the COR-COTR must always provide the 

password to ^DCHR OPE Suitability in a separate email, even if it is a pre-established password for a contract.

Sending an encrypted Zip File via email

1. Compose a new message.

2. Attach the Zip File.

3. Send message.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 30 of 74

391-S R-1 (03/23)

PREAWARD SURVEY: In order to determine the responsibility of the prime contractor or any subcontractor, 

the Government reserves the right to conduct an on-site preaward survey at the contractor's/subcontractor's facility 

or to require other evidence of technical, production, managerial, financial, and similar abilities to perform, prior 

to the award of a contract. As part of the financial determination, the contractor in line for award may be required 

to provide one (1) or more of the following financial documents: 

1) Most recent profit and loss statement

2) Most recent balance sheet(s)

3) Statement of cash flows

4) Current official bank statement

5) Current lines of credit (with amounts available)

6) Letter of commitment from paper supplier(s)

7) Letter of commitment from any subcontractor

The documents will be reviewed to validate that adequate financial resources are available to perform the contract 

requirements. Documents submitted will be kept confidential and used only for the determination of responsibility 

by the Government. 

Failure to provide the requested information in the time specified by the Government may result in the 

Contracting Officer not having adequate information to reach an affirmative determination of responsibility.

Additionally, the preaward survey will include a review of all subcontractors involved, along with their specific 

functions, and the contractor’s/subcontractor’s backup facility, quality control/recovery program, computer 

system, mail, material, personnel, production, and security control plans as required by this specification.

Contractor must have all necessary equipment installed and fully functional at time of award.

If the Government, during the Preaward survey, concludes that the contractor does not or cannot meet all of the 

requirements as described in this contract, the contractor will be declared non-responsive.

PREAWARD PRODUCTION PLANS: The contractor shall present, in writing, to the Contracting Officer

within five (5) workdays of being notified to do so by the Contracting Officer or his/her representative, detailed

plans for each of the following activities. The workday after notification to submit will be the first day of the

schedule. If the Government requests additional information after review of plans, the contractor must submit 

updated plans within two (2) workdays of request. 

Five (5) additional workdays will be permitted to provide a Security Assessment Package (SAP) as required. The 

contractor, at SSA’s discretion, may be granted three (3) additional workdays if additional information is required 

for the Security Authorization Package. The workday after notification to submit will be the first day of the 

schedule. 

These proposed plans are subject to review and approval by the Government, and award will not be made 

prior to approval of same. The Government reserves the right to waive some or all of these plans.

If the contractor intends to change processes described in the production plans during the term of the contract, 

they must provide updated plans to SSA and GPO for review and approval prior to implementing any changes. 

Option Years: For each option year that may be exercised, the contractor will be required to review their plans 

and re-submit in writing the above plans detailing any changes and/or revisions that may have occurred. The 

revised plans are subject to Government approval and must be submitted to the Contracting Officer or his/her 

representative within five (5) workdays of notification of the option year being exercised.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 31 of 74

391-S R-1 (03/23)

NOTE: If there are no changes/revisions, the contractor will be required to submit to the Contracting Officer or 

his/her representative a statement confirming that the current plans are still in effect.

Information Sheet – If the contractor is currently producing on other GPO contracts, they must submit an 

information sheet specifying how the workload(s) on this contract will fit into the pre-existing Government 

production without hampering the production/delivery schedules for all the contracts. (NOTE: This is a 

requirement of this program due to the legislated nature of certain GPO contracts.) 

At a minimum, the information sheet must include a list of the contracts currently held and the 

production/delivery schedules for each of those contracts. The sheet must also specify which of those contracts 

would run concurrently with the projected schedule for this contract.

Backup Facility – The failure to deliver these notices in a timely manner would have an impact on the daily

operations of SSA. Therefore, if for any reason(s) (act of God, labor disagreements, national emergencies, 

pandemics, etc.) the contractor is unable to perform at said locations for a period longer than 24 hours, the 

contractor must have a backup facility with the capability of producing the notices. 

Plans for their contingency production must include the location of the facility to be used, equipment available at 

the facility, and a timetable for the start of production at that facility.

Part of the plan must also include the transportation of Government materials from one facility to another and 

the transfer of notice files. SSA has the option to install a data connection into the backup facility.

NOTE: All terms and conditions of this contract will apply to the backup facility. Transfer of production to the 

backup facility must be approved by SSA. Due to the time-sensitive nature of the notices produced on this 

contract, the contractor must maintain the original schedule set forth in this contract.

Quality Control Plan – The contractor shall provide and maintain, within their own organization, an independent 

quality assurance organization of sufficient size and expertise to monitor the operations performed and inspect the 

products of each operation to a degree and extent that will ensure the Government’s quality assurance, inspection, 

and acceptance provisions specified herein are met. The contractor shall perform, or have performed, the process 

controls, inspections, and tests required to substantiate that the products provided under this contract conform to 

the specifications and contract requirements. The contractor shall describe in detail their quality control/quality

assurance and recovery plans describing how, when, and by whom the plans will be performed.

The quality control plan must also include examples and a detailed description of all quality control samples and

their corresponding inspection reports or logs the contractor will keep to document the quality control 

inspections performed on each run. Furthermore, the plan must include the names of all quality assurance 

officials and describe their duties in relationship to the quality control plan.

The quality control plan must account for the number of pieces mailed daily and must also cover the security over

the postage meters as well as the controls for the setting of the meters (if meters will be used).

Quality Control Sample Plan – The plan must provide a description of how the contractor will create quality 

control samples for periodic samplings to be taken during the production run, provide for backup and re-running

in the event of an unsatisfactory sample, and contain control systems that will detect defective, missing, or

mutilated pieces.

The plan should include the sampling interval the contractor intends to utilize. The contractor will be required to 

create two (2) control samples every 4,000 notices. 

The samples are to be drawn from the production stream at the same time: 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 32 of 74

391-S R-1 (03/23)

▪ One (1) sample will be drawn, inspected, and retained as part of the contractor’s quality assurance records. 

▪ One (1) sample will be drawn for the Social Security Administration and packed with the remaining 

samples associated with each task order and shipped to: SSA, Attn: Jamey Cunningham, DMIM, 3-B-10-

F Annex Building, 6401 Security Boulevard, Baltimore, MD 21235.

NOTE: Mailers with low volumes (less than 4,000) will require at least one (1) set of samples to be produced.

The plan shall detail the actions to be taken by the contractor when defective, missing, or mutilated items are 

discovered. These actions must be consistent with the requirements found in GPO Contract Terms (GPO

Publication 310.2, effective December 1, 1987 (Rev. 01-18)).

The plan shall monitor all aspects of the job including material handling and mail flow to assure that the

production and delivery of these notices meet specifications and Government requirements. This includes

maintaining 100% accountability in the accuracy of imaging and mailing of all pieces throughout each run. The

contractor must ensure that there are no missing or duplicate pieces.

The contractor must maintain quality control samples, inspection reports, and records for a period of no less than 

210 calendar days subsequent to the date of the check tendered for final payment by the Government Publishing

Office. The Government will periodically verify that the contractor is complying with the approved quality

control plan through on-site examinations and/or requesting copies of the contractor’s quality assurance records

and quality assurance random copies.

Computer System Plan – This plan must include a detailed listing of the contractor’s operating software 

platform and file transfer system necessary to interface with SSA’s National File Transfer Management System

(FTMS) for electronic transmission of files from SSA. The plan must also include the media type on which files 

from SSA will be received to the extent that operator intervention (e.g., a tape mount) is not required at SSA or

the contractor’s production facility.

The system plan shall demonstrate the contractor’s ability to provide complete hardware and software 

compatibility with SSA’s existing network (see “FILE TRANSFER MANAGEMENT SYSTEM (FTMS) 

REQUIRMENTS” and “PREPRODUCTION TESTS, Transmissions Test” for additional information). The 

contractor must complete a Computer System Plan (see Exhibit O).

Included with the Computer System Plan shall be a resume for each employee responsible for the monitoring 

and the programming of the contractor’s computer system and file transmissions. If the contractor plans to use a 

consultant, a resume must still be included. This plan must show that the programmer(s) is skilled in the handling

of record specifications and programming of the Advanced Function Presentation (Fully Composed) resources 

and files.

Mail Plan – This plan should include sufficient detail as to how the contractor will comply with all applicable 

U.S. Postal Service mailing requirements as listed in the USPS Domestic and International Mail Manuals in

effect at the time of the mailing and other USPS instructional material such as the Postal Bulletin. The contractor

must also disclose how they will achieve multi-level USPS automated presort postal discounts as outlined in the

contract.

Material Handling and Inventory Control – This plan should explain in detail how the following materials 

will be handled: incoming raw materials; work-in-progress materials; quality control inspection materials; 

USPS inspection materials; and all outgoing materials cleared for USPS pickup/delivery.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 33 of 74

391-S R-1 (03/23)

Personnel Plan – In conjunction with the required applicant listing (see “SECURITY AND SUITABILITY 

REQUIREMENTS FOR GOVERNMENT PRINTING (NOV 2018)”), this plan should include a listing of all

personnel who will be involved with this contract. For any new employees, the plan should include the source of

these employees and a description of the training programs the employees will be given to familiarize them with

the requirements of this program.

Production Plan – The contractor is to provide a detailed plan of the following:

▪ List of all production equipment and equipment capacities to be utilized on this contract; 

▪ The production capacity currently being utilized on this equipment;

▪ Capacity that is available for these workloads; and,

▪ If new equipment is to be utilized, documentation of the purchase order, source, delivery schedule, and

installation dates are required. 

The contractor must disclose in their production plan their intentions for the use of any subcontractors. The plan 

must include the same information required from the contractor for all items contained under “SECURITY

REQUIREMENTS” and “PREAWARD SURVEY.” If a subcontractor for any operation is added at any time

after award, the contractor must submit the subcontractor’s proposed plans which are subject to review and

approval by the Government.

The subcontractor must be approved by the Government prior to production starting in that facility. If the 

subcontractor is not approved by the Government, then the contractor has 30 calendar days prior to production to 

submit to the Government the new subcontractor’s information. 

Security Control Plan – The contractor shall maintain in operation an effective security system where items by

these specifications are manufactured and/or stored (awaiting distribution or disposal) to assure against theft

and/or the product ordered falling into unauthorized hands.

Contractor is cautioned that no Government provided information shall be used for non-Government business. 

Specifically, no Government information shall be used for the benefit of a third party.

The Government retains the right to conduct on-site security reviews at any time during the term of the contract. 

The plan shall contain at a minimum:

▪ How Government files (data) will be secured to prevent disclosure to a third party. 

▪ How the disposal of waste materials will be handled.

▪ How all applicable Government-mandated security/privacy/rules and regulations as cited in this 

contract shall be adhered to by the contractor and/or subcontractor(s).

▪ How contractors classified as Cloud Service Providers (CSP) will adhere to additional FedRAMP security 

control requirements. CSPs must have a security control assessment performed by a Third Party 

Assessment Organization (3PAO), (see Exhibit M); additional information is also available at:

http://www.gsa.gov/portal/category/102371.

▪ The contractor shall submit a System Security Plan which documents how the solution implements 

security controls in accordance with the designated FIPS 199 security categorization and the Minimum 

Security Requirements for Federal Information and Information Systems which requires the use of 

NISTSP 800-53, or the contractor shall provide a Security Assessment Package (SAP) completed by 

either an independent assessor or another Federal agency (see Exhibit C).

Materials – The contractor is required to explain how all accountable materials will be handled throughout all 

phases of production.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 34 of 74

391-S R-1 (03/23)

Production Area Plan – The contractor must provide a secure area(s) dedicated to the processing and storage of 

data for all notices produced on this contract, either a separate facility dedicated to these products or a walled-in 

limited access area within the contractor’s existing facility. Access to the area(s) shall be limited to securitytrained employees involved in the production of all notices. 

Part of the Production Area Plan shall include a floor plan detailing the area(s) to be used, showing existing

walls, equipment to be used, and the printing and finishing locations.

Contractor must have, in place, a building security system that is monitored 24 hours a day, seven (7) days a

week, and a badging/keypunch system that limits access to Government materials (data processing 

center/production facility and other areas where Government materials with PII are stored or are accessible) that

is only accessible by approved personnel. Contractor must present this information, in detail, in the production 

area plan.

Disposal of Waste Materials – The contractor is required to demonstrate how all waste materials used in the

production of sensitive SSA records will be definitively destroyed (ex., burning, pulping, shredding, macerating,

or other suitable similar means). Electronic Records must be definitively destroyed in a manner that prevents

reconstruction. Definitively destroying the records means the material cannot be reassembled and used in an

inappropriate manner in violation of law and regulations. Sensitive records are records that are national security

classified or exempted from disclosure by statute, including the Privacy Act or regulation.

The contractor, at a minimum, must crosscut shred all documents into squares not to exceed one-quarter inch. 

All documents to be destroyed cannot leave the security of the building, must be destroyed at contractor’s 

printing site, and cannot be subcontracted. The contractor must specify the method planned to dispose of the

material.

UNIQUE IDENTIFICATION NUMBER: Unique identification numbers will be used to track each individual 

notice, thereby providing 100% accountability. This enables the contractor to track each notice through 

completion of the project. The contractor will be required to create two (2) test samples every 4,000 notices. 

These samples must have unique numbers and must be produced on each notice. The contractor will generate a 

list of the unique identifying numbers for each sample. As samples are pulled, the unique numbers will be 

marked off the list. This enables the contractor to track which samples have been produced and pulled and what 

records have been produced. 

The contractor may create their own sequence number and run date to facilitate their presorting and inserting 

process but must maintain the original SSA identification number.

RECOVERY SYSTEM: A recovery system will be required to ensure that all defective, missing, or mutilated 

pieces detected are identified, reprinted, and replaced. The contractor’s recovery system must use the unique 

alpha/numeric identifiers assigned to each piece (including quality control samples) to aid in the recovery and 

replacement of any defective, missing, or mutilated pieces. Contractor must be capable of tracking and/or locating 

any individual piece of mail from the time it leaves the press, up to and including when it is off-loaded at the 

USPS facility. An explanation of the contractor’s sequential numbering system is required to understand the audit 

trail required for each notice.

100% ACCOUNTABILITY OF PRODUCTION AND MAILING: Contractor must have a closed loop 

process* to determine that the data from the original print file is in the correct envelope with the correct number 

of pages. Notices requiring print regeneration must be reprinted from their original print image with the original 

job ID and piece ID remaining unchanged as each mail piece continues through the inserting life cycle. This 

process will repeat itself (since subsequent reprint runs may yield damages) until all mail pieces from the original 

print run have been inserted and accounted for.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 35 of 74

391-S R-1 (03/23)

*Closed Loop Processing – A method for generating a plurality of mail pieces including error detection and 

reprinting capabilities. The method provides a mail handling process which tracks processing errors with the use 

of a first and second scan code which obtain information regarding each mail piece, diverts mail pieces in 

response to error detection, transmits such errors to a processor, and automatically generates a reconfigured print 

file to initiate reprints for the diverted mail pieces.

Contractor will be responsible for providing a unique identifying number that will be used to track each 

individual notice, thereby providing 100% accountability and validating the integrity of every notice produced in 

all phases of printing, inserting, and mailing, and to ensure all notices received from SSA were correctly entered 

into the U.S. Postal System.

NOTE: Contractor must have all hardware, programming, and finalized reports in place to meet this requirement 

and arrive at least 90 calendar days prior to the start of live production on or near July 1, 2022. Contractor must 

submit a sample of their proposed Audit and Summary reports with the required Preaward Production Plans for 

approval. The Government considers grounds for the immediate default of this contract if the contractor, at any

time, is unable to perform or found not complying with any part of this requirement. 

Notice integrity shall be defined as follows:

▪ Each notice shall include all pages (and only those pages) intended for the designated recipient as 

contained in the print files received from SSA.

▪ The contractor’s printing process must have automated systems which can detect all sync errors, stop 

printing when detected, and identify, remove, and reprint all effected notices.

Mailing integrity shall be defined as follows:

▪ All notices received from SSA for each file date were printed, inserted, and entered correctly into the U.S.

Postal System.

The contractor is responsible for providing the automated inserted notice tracking/reporting systems and processes 

required to validate that 100% of all notices received from SSA were printed, all pages for each notice are 

accounted for, inserted, and mailed correctly. 

The contractor’s inserting equipment must have automated systems that include notice coding and scanning

technology capable of:

(a) Uniquely identifying each notice and corresponding notice leaves within each individual file by mailer 

number and file date.

(b) Unique identifier to be scanned during insertion to ensure all notices and corresponding notice leaves are

present and accounted for.

(c) Entrance Scanning: A camera system must electronically track and scan all leaves of each mail piece as 

the inserting equipment pulls them into the machine to ensure each mail piece was produced and inserted. 

If there is any variance on a mail piece or if a mail piece is not verified that all leaves are present, that 

piece and the piece prior to and immediately following must be diverted and sent back for reprint. All 

instances of variance must be logged.

(d) Touch and Toss: All spoilage, diverted, mutilated, or mail pieces that are acted upon directly by a human 

hand prior to sealing must be immediately recorded, discarded, properly destroyed, and automatically 

regenerated in a new print file for reprint. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 36 of 74

391-S R-1 (03/23)

(e) Exit Scanning: A camera system must be mounted just aft of the inserting equipment. This camera system 

must read a unique code through the window of each mail piece and be capable of identifying and

reporting all missing notices that were lost or spoiled during production for each individual file by mailer 

number and file date. This system must ensure that no missing mail pieces have been inadvertently 

inserted into another mail piece. The equipment must check the mail pieces after insertion, verify that all 

leaves are accounted for, and divert any suspect product. During exit scanning, if a sequence number is 

missing, the notice prior to and immediately after must be diverted. The equipment must divert all 

products that exhibit missing or out of order sequence numbers and any other processing errors. All 

diverted pieces are to be automatically recorded and regenerated in a new print file for reprint.

(f) Reconciliation: All notices and the amount of correct finished product must be electronically accounted 

for after insertion through the use of the audit system that is independent of the inserting equipment as 

well as independent of the operator. The sequence numbers for each file must be reconciled, taking into 

account any spoilage, duplicate, or diverted product. If the reconciliation yields divergent results, 

corrective action must be taken to locate the mail pieces that are causing any difference between the input 

and outputs of the inserting process. Therefore, all finished mail for that sequence run must be held in an 

accessible area until this reconciliation is complete.

(g) Generate a new production file for all missing, diverted, or mutilated notices (reprint file).

(h) Contractor must generate an automated audit report from the information gathered from scanning for each 

mailer number, file date, and each notice (manual inputs are not allowed). This audit report will contain 

detailed information for each notice as outlined below for each individual file by mailer number and file 

date. Contractor must maintain this information for 210 calendar days after mailing. 

(i) Audit report must contain the following information:

1. Job name 

2. Mailer number, file date, and mail date(s)

3. Machine ID

4. Date of production with start and end date and time for each phase of the run (i.e., machine ID)

5. Start and end sequence numbers in each run 

6. Status of all sequence numbers in a run

7. Total volume in run

8. Status report for all incidents for each sequence number and cause (e.g., inserted, diverted, and reason 

for divert such as missing sequence number, missing leaves, mutilated, duplicate, pulled for 

inspection).

9. Bottom of audit report must contain total number of records for that run, quantity sent to reprint, 

number of duplicates, duplicates verified and pulled, and total completed. 

10. Audit report must contain the same information for all the reprints married with this report as listed 

above showing that all pieces for each mailer number and file date are accounted for with 

corresponding date stamp of completion of each.

(j) Contractor must generate a final automated 100% accountability summary report for each individual file 

by mailer number and file date. This information must be generated directly from the audit report. Manual 

inputs are not allowed. The summary report must contain the following:

1. Job information - Job name, file date, mailer number, piece quantity, sequence start and end number, 

if multiple batches for a single file include number of batches and batch number (i.e., 1 of 4, due date, 

etc.). 

2. Job start time and job end time

3. Volume of sequence numbers associated with an individual file by mailer number and file date that 

were inserted and date completed. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 37 of 74

391-S R-1 (03/23)

4. Volume of reprints that were inserted for each file date and when completed.

5. Total volume inserted for each file date and final date and time that each batch was completed.

A PDF copy of the summary report(s) and matching USPS Certificate of Bulk Mailing, USPS 3607R, and/or GPO 

712 form(s) must be submitted to Jamey Cunningham at Jamey.cunningham@ssa.gov within two (2) workdays of 

mailing. 

Contractor must submit a sample of their Audit and Summary reports (see Exhibit Q) with the required Preaward 

Production Plans for Government review and approval. The audit team must approve the audit and summary 

reports prior to award. During the term of the contract, NO changes are to be made to the approved audit and 

summary reports without prior approval from the audit team. The contractor must submit in writing a request to 

make changes to the audit and summary reports, along with samples of the proposed audit and summary reports 

for review and approval. 

Contractor must generate an automated audit report when necessary showing the tracking of all notices 

throughout all phases of production for each mail piece. This audit report will contain all information as outlined 

in item (i) above. Contractor is required to provide any requested Summary and/or Audit reports within one (1) 

hour of a request via email in an MS Word, MS Excel, or PDF file to Jamey Cunningham at 

Jamey.cunningham@ssa.gov. 

NOTE: The Government reserves the right to conduct an audit at any time during the term of the contract. The 

audit team will provide the contractor a minimum of a 24-hour notice prior to audit. If the contractor produces 

multiple SSA contracts, the audit team will provide a list of contracts and print orders they will require full audit 

reports, summary reports, and postal documentation for during the audit. 

The contractor must provide the required audit reports within one (1) hour of request; the audit team will grant 

one (1) hour for each report to be pulled. The audit team may request a full tour and demonstration of the 

accountability process at the time of the audit. A wrap-up meeting will occur at the conclusion of the audit. The 

audit team will review their findings with the contractor at this time. The contractor will need to provide in 

writing responses to all findings, questions, and concerns within one (1) week of the wrap-up meeting. If 

corrections are required to the contractor’s audit reports, the Government may grant the contractor 60 calendar

days to complete the changes. The audit team must approve the audit and summary report changes prior to the 

contractor implementing the changes. Once the new report is approved, the contractor must update the sample of 

the audit and summary provided with the production plans. The Government considers grounds for the immediate

default of this contract if the contractor, at any time, is unable to perform or found not in compliance with any

part of this requirement. 

All notice tracking/reporting data must be retained in electronic form for 210 calendar days after mailing and must 

be made available to SSA for auditing of contractor performance upon request.

NOTE: The Government will not routinely request that the contractor produce individual pieces in transit within 

the plant. However, the contractor must demonstrate that they will have an audit trail established that has the 

ability to comply with this type of request when and if the need arises.

REQUEST FOR NOTICES PULLS FROM PRODUCTION: Due to the sensitivity of notices in this contract, 

the Government may request that the contractor remove individual notices from the production stream. When this 

occurs, the Government will supply the contractor with a list of notices to be pulled. The contractor must be able 

to run a sort to find and eliminate the notice from the production run. If the list is provided after the notice has 

been produced, the contractor must be capable of identifying the notice and pulling it from the production floor.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 38 of 74

391-S R-1 (03/23)

ON-SITE REPRESENTATIVES: One (1) or two (2) full-time Government representatives may be placed on 

the contractor’s premises on a limited basis or throughout the term of the contract.

The contractor will be required to provide one (1) private office of not less than 150 square feet, furnished with at 

least one (1) desk, two (2) swivel arm chairs, secure internet access for Government laptop computers, a work 

table, and two (2) 4-drawer letter-size file cabinets with combination padlock, Pendaflex file folders, or equal.

On-site representative(s) may be stationed at the contractor’s facility to: provide project coordination in receipt of 

wire transmissions; verify addresses; monitor the printing, imaging, folding, inserting, mail processing, quality 

control, sample selections, and inspections; and monitor the packing and staging of the mail.

These coordinators will not have contractual authority and cannot make changes in the specifications or in 

contract terms, but will bring all defects detected to the attention of the company Quality Control Officer. The 

coordinators must have full and unrestricted access to all production areas where work on this program is being 

performed.

POSTAWARD CONFERENCE: Unless waived by the Contracting Officer, the total requirements of the job as 

indicated in these specifications will be reviewed by Government representatives with the contractor’s 

representatives at the Social Security Administration (SSA), 6401 Security Boulevard, Baltimore, MD, 21235 

immediately after award. At the Government’s option, the postaward conference may be held via teleconference.

Person(s) that the contractor deems necessary for the successful implementation of the contract must be in 

attendance.

PREPRODUCTION MEETING: A preproduction meeting covering the printing, imaging, folding, inserting, 

and mailing shall be held at the contractor’s facility after award of the contract to review the contractor’s 

production plan and to establish coordination of all operations. Attending this meeting will be representatives 

from the Government Publishing Office, Social Security Administration, and the U.S. Postal Service. The 

contractor shall present and explain their final plan for the printing, imaging, folding, inserting, and mailing. 

NOTE: At the Government’s option, the preproduction meeting may be held via teleconference. The Government 

reserves the right to waive the preproduction meeting.

The contractor shall meet with SSA and USPS representatives to present and discuss their plan for mailing. The

preproduction meeting will include a visit to the contractor’s mailing facility where the contractor is to furnish 

specific mail flow information.

In addition, the contractor shall be prepared to present detailed production plans, including such items as quality

assurance, projected commencement dates, equipment loading, pallet needs, etc. The contractor is to provide the 

name of the representative responsible for the mailing operation and that individual’s backup.

Person(s) that the contractor deems necessary for the successful implementation of the contract must be in

attendance.

ASSIGNMENT OF JACKET, PURCHASE ORDER, AND PRINT ORDERS: A GPO jacket number will be 

assigned and a purchase order issued to the contractor to cover the work performed. The purchase order will be 

supplemented by an individual print order for each job placed with the contractor. The print order, when issued, 

will indicate the quantity to be produced and any other information pertinent to the particular order.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 39 of 74

391-S R-1 (03/23)

ORDERING: Items to be furnished under the contract shall be ordered by the issuance of print orders by the 

Government. Orders may be issued under the contract from Date of Award through March 31, 2023, plus for 

such additional period(s) as the contract is extended. All print orders issued hereunder are subject to the terms and 

conditions of the contract. The contract shall control in the event of conflict with any print order. A print order 

shall be “issued” upon notification by the Government for purposes of the contract when it is electronically 

transmitted or otherwise physically furnished to the contractor in conformance with the schedule. 

REQUIREMENTS: This is a requirements contract for the items and for the period specified herein. 

Shipment/delivery of items or performance of work shall be made only as authorized by orders issued in 

accordance with the clause entitled “ORDERING.” The quantities of items specified herein are estimates only and 

are not purchased hereby. Except as may be otherwise provided in this contract, if the Government’s requirements 

for the items set forth herein do not result in orders in the amounts or quantities described as “estimated,” it shall 

not constitute the basis for an equitable price adjustment under this contract.

Except as otherwise provided in this contract, the Government shall order from the contractor all the items set 

forth which are required to be purchased by the Government activity identified on page 1. 

The Government shall not be required to purchase from the contractor requirements in excess of the limit on total 

orders under this contract, if any.

Orders issued during the effective period of this contract and not completed within that time shall be completed 

by the contractor within the time specified in the order, and the rights and obligations of the contractor and the 

Government respecting those orders shall be governed by the terms of this contract to the same extent as if 

completed during the effective period of this contract.

If shipment/delivery of any quantity of an item covered by the contract is required by reason of urgency prior

to the earliest date that shipment/delivery may be specified under this contract, and if the contractor will not

accept an order providing for the accelerated shipment/delivery, the Government may procure this requirement

from another source.

The Government may issue orders which provide for shipment/delivery to or performance at multiple 

destinations.

Subject to any limitations elsewhere in this contract, the contractor shall furnish to the Government all items set 

forth herein which are called for by print orders issued in accordance with the “ORDERING” clause of this

contract.

PRIVACY ACT NOTIFICATION: This procurement action requires the contractor to do one or more of the 

following: design, develop, or operate a system of records on individuals to accomplish an agency function in 

accordance with the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable 

agency regulations. Violation of the Act may involve the imposition of criminal penalties as stated in 5 U.S.C. 

552a (i)(1) CRIMINAL PENALTIES. It is incumbent upon the contractor to inform its officers and employees of 

the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a, specifically, 5 U.S.C. 

552a (i)(1) CRIMINAL PENALTIES and m(1) GOVERNMENT CONTRACTORS
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 40 of 74

391-S R-1 (03/23)

PRIVACY ACT

(a) The contractor agrees:

(1) to comply with the Privacy Act of 1974 and the rules and regulations issued pursuant to the Act in the 

design, development, or operation of any system of records on individuals in order to accomplish an 

agency function when the contract specifically identifies (i) the system or systems of records and (ii) the 

work to be performed by the contractor in terms of any one or combination of the following: (A) design, 

(B) development, or (C) operation;

(2) to include the solicitation notification contained in this contract in every solicitation and resulting 

subcontract and in every subcontract awarded without a solicitation when the statement of work in the 

proposed subcontract requires the design, development, or operation of a system of records on individuals 

to accomplish an agency function; and

(3) to include this clause, including this paragraph (3), in all subcontracts awarded pursuant to this contract 

which require the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved where the 

violation concerns the design, development, or operation of a system of records on individuals to accomplish 

an agency function, and criminal penalties may be imposed upon the officers or employees of the agency 

where the violation concerns the operation of a system of records on individuals to accomplish an agency 

function. For purposes of the Act when the contract is for the operation of a system of records on individuals 

to accomplish an agency function, the contractor and any employee of the contractor is considered to be an 

employee of the agency.

(c) The terms used in this clause have the following meanings:

(1) “Operation of a system of records” means performance of any of the activities associated with 

maintaining the system of records including the collection, use, and dissemination of records.

(2) “Record” means any item, collection or grouping of information about an individual that is maintained by 

an agency, including, but not limited to, his education, financial transactions, medical history, and 

criminal or employment history and that contains his name, or the identifying number, symbol, or other 

identifying particular assigned to the individual, such as a finger or voice print or a photograph.

(3) “System of records” on individuals means a group of any records under the control of any agency from 

which information is retrieved by the name of the individual or by some identifying number, symbol, or 

other identifying particular assigned to the individual;

ADDITIONAL EMAILED BID SUBMISSION PROVISIONS: The Government will not be responsible for 

any failure attributable to the transmission or receipt of the emailed bid including, but not limited to, the 

following:

1. Illegibility of bid.

2. Emails over 75 MB may not be received by GPO due to size limitations for receiving emails.

3. The bidder’s email provider may have different size limitations for sending email; however, bidders are 

advised not to exceed GPO’s stated limit.

4. When the email bid is received by GPO, it will remain unopened until the specified bid opening time. 

Government personnel will not validate receipt of the emailed bid prior to bid opening. GPO will use the 

prevailing time (specified as the local time zone) and the exact time that the email is received by GPO’s 

email server as the official time stamp for bid receipt at the specified location.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 41 of 74

391-S R-1 (03/23)

PAYMENT: Submitting invoices for payment via the GPO fax gateway (if no samples are required) utilizing the 

GPO barcode coversheet program application is the most efficient method of invoicing. Instruction for using this 

method can be found at the following web address: 

http://winapps.access.gpo.gov/fms/vouchers/barcode/instructions.html.

Invoices may also be mailed to: U.S. Government Publishing Office, Office of Financial Management, Attn: 

Comptroller, Stop: FMCE, Washington, DC 20401.

For more information about the billing process refer to the General Information of the Office of Finance web page 

located at https://www.gpo.gov/how-to-work-with-us/vendors/how-to-get-paid.

Contractor’s billing invoice must be itemized in accordance with the line items in the “SCHEDULE OF 

PRICES.”
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 42 of 74

391-S R-1 (03/23)

SECTION 2. - SPECIFICATIONS

SCOPE: These specifications cover the production of mailing packages from seven (7) identified workloads

consisting of a personalized English or Spanish notice (which may include a personalized scannable form as part 

of the notice) and any combination of, a Courtesy Reply Mail (CRM) envelope, a Business Reply Mail (BRM) 

envelope, and a mail-out envelope, which require such operations as the receipt and processing of files; 

composition; printing/imaging; binding; construction; inserting and packing; and, distribution.

TITLE: Mid-Year Mailer (MYM) OCR Forms Notices, National Change of Address (NCOA) Notices, Step 

Parent Notices, Fee Adjustment Notices, and 1099/1042 and T2 COLA Large Print Notices.

The seven (7) identified workloads are as follows:

1. Mid-Year Mailer OCR Form Notices

2. National Change of Address Notices 

3. Step Parent Notices

4. Fee Adjustment Notices

5. 1099/1042 Initial Large Print Notices (hereinafter referred to as 1099/1042 Initial Notices)

6. 1099/1042 Supplemental Large Print Notices (hereinafter referred to as 1099/1042 Supplemental Notices)

7. T2 COLA Large Print Notices (hereinafter referred to as T2 COLA Notices)

Future Workloads (during term of contract): During the term of this contract, the Government expects to develop 

new notice workloads with the same requirements as the seven (7) notice workloads described by these 

specifications. All terms and conditions in this specification will apply to these future notice workloads. It is

estimated that approximately one (1) to three (3) new notice workloads may be added during the term of this 

contract.

FREQUENCY OF ORDERS:

A print order will be issued for each transmission of files. More than one mailer’s transmission may be ordered 

on the same print order.

A separate print order will be issued after award for composition, proofs, and preproduction tests.

Below is the anticipated transmission schedule. Delays and changes to the schedule may occur. Contractor must 

be prepared to receive files 24/7/365.

Mid-Year Mailer Notices: 6 orders per year. The orders will transmit in June, August, September, and October of 

each contract year, with the majority of the quantity transmitting in June.

NCOA Notices: 4 orders per year. The orders will transmit in March, June, September, and December of each 

contract year. NOTE: During the course of the contract, the NCOA notice frequency may increase from 4 orders 

per year to 5 orders per year. Contractor will be notified of the month for the 5th order.

Step Parent Notices: 1 order per year. The order will transmit in December of each contract year. 

Fee Adjustment Notices: 1 order per year. The order will transmit in November of each contract year.

1099/1042 Initial Notices: 1 order per year. The order will transmit in December of each contract year. 

1099/1042 Supplemental Notices: 1 order per year. The order will transmit in January of each contract year. 

T2 COLA Notices: 1 order per year. The order will transmit the Friday prior to Thanksgiving each contract year. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 43 of 74

391-S R-1 (03/23)

QUANTITY: Combined total for all seven (7) workloads will be approximately 1,199,605 notices per year.

The Government reserves the right to increase or decrease the quantity by up to 20% for the total number of 

notices ordered annually. This 20% includes the additional notices occasioned by the one (1) to three (3) new 

notice workloads that may be added during the term of this contract.

The figures indicated under “MAKE-UP OF NOTICE MAILERS” are estimates only based on historical data of 

past production runs. Exact quantities will not be known until each run is electronically transmitted to the 

contractor. NO SHORTAGES WILL BE ALLOWED.

NUMBER OF PAGES:

Notices: 1 to 9 printed pages (1 to 5 leaves) per notice.

All Envelopes: Face and back (after manufacturing).

NOTE: The notices for Mailers 1 through 4 will contain scannable form pages as part of the notice. The 

scannable form portion will range from 1 to 3 pages.

TRIM SIZES:

Notices: 8-1/2 x 11”.

Scannable Forms: 8-1/2 x 11”.

CRM Return Envelope: 5-3/4 x 8-3/4”, plus flap. (There are six (6) different versions.)

BRM Return Envelope: 5-3/4 x 8-3/4”, plus flap. (There is only one (1) version.)

Mail-Out Envelopes: 6-1/4 x 9-1/2”, plus flap with one window. (There are eight (8) different versions.)

Mail-Out Envelopes: 6-1/4 x 9-1/2”, plus flap with two windows. (There is only one (1) version

FOR QUALITY CONTROL AND AUDITING PURPOSES: The contractor must not merge file dates and

mailers during processing, printing, and mailing. All files transmitted by SSA will be physical sequential. Any 

alteration of the notice content in the file is not permitted.

MAKE-UP OF NOTICE MAILERS: Combined total for the Mid-Year Mailer (MYM) OCR Notices, NCOA

Notices, Step Parent Notices and Fee Adjustment Notices, 1099/1042 Initial Notices, 1099/1042 Supplemental 

Notices, and T2 COLA Notices will be approximately 1,199,605 notices per year. All quantities and page 

numbers listed below are approximate. Actual quantities and page numbers are not known until files are 

delivered.

Mid-Year Mailers: Mid-Year Mailer OCR Notices workload has four (4) mailers consisting of 12 different mail 

packages, each consisting of a combination of components listed below:

▪ Personalized English or Spanish notice

▪ Personalized OCR scannable form

▪ CRM envelope

▪ BRM envelope

▪ Mail-out envelope (6-1/4 x 9-1/2” envelope with one window)

All Mailer 1 notices receive a BRM containing PO Box 13100.

All Mailer 2 notices receive a CRM containing PO Box 9790.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 44 of 74

391-S R-1 (03/23)

Each Mailer 3 and Mailer 4 notice receive a different CRM for each form type –

▪ if inserting form 9778, the CRM PO Box will be 9778

▪ if inserting form 9779, the CRM PO Box will be 9779

▪ if inserting form 9781, the CRM PO Box will be 9781

▪ if inserting form 9784, the CRM PO Box will be 9784

▪ if inserting form 9785, the CRM PO Box will be 9785

Mailer/Notice Transmits Quantity Leaves Printed Pages

Mailer 1 (M1) –

M1 - SSA-131-SM-SUP June 55,000 2 3

M1- SSA-131-SM-SUP Oct 2,000 2 3

Total Yearly Quantities for M1 57,000

Mailer 2 (M2) –

M2 – SSA-L9790 June 72,000 3 4

M2 – SSA-L9790 Oct 5,000 3 4

Total Yearly Quantities for M1 77,000

Mailer 3 (M3) –

M3 – SSA-L9778-SM-SUP June 47,000 4 7

SSA-L9779-SM-SUP June 100,000 4 8

SSA-L9781-SM-SUP June 80,000 3 5

SSA-L9784-SM-SUP June 2,000 3 6

SSA-L9785-SM-SUP June 8,000 4 8

M3 –SSA-L9781-SM-SUP Aug 30,000 4 8

Sep 30,000 4 8

Oct 30,000 4 8

Total Yearly Quantities for M3: 327,000

Mailer/Notice Transmits Quantity Leaves Printed Pages

Mailer 4 (M4) –

M4 – SSA-L9778-SM-SUP-SP June 2,000 4 7

SSA-L9779-SM-SUP-SP June 8,000 4 8

SSA-L9781-SM-SUP-SP June 2,000 3 5

SSA-L9784-SM-SUP-SP June 100 3 6

SSA-L9785-SM-SUP-SP June 300 4 8

M4 – SSA-L9781-SM-SUP-SP Aug 500 4 8

Sep 500 4 8

Oct 500 4 8

Total Yearly Quantities for M4: 13,900
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 45 of 74

391-S R-1 (03/23)

National Change of Address Notices: NCOA Notices workload has one (1) mailer consisting of two (2) different 

mail packages, each consisting of a personalized English or Spanish notice and a mail-out envelope (6-1/4 x 9-

1/2” envelope with one window).

Mailer/Notice Transmits Quantity Leaves Printed Pages

Mailer 5 (M5) –

M5 – SSA-L294-SM Mar 3,500 1 1

SSA-L294-SM-SP Mar 100 1 1

SSA-L294-SM Jun 3,500 1 1

SSA-L294-SM-SP Jun 100 1 1

SSA-L294-SM Sep 3,500 1 1

SSA-L294-SM-SP Sep 100 1 1

SSA-L294-SM Dec 3,500 1 1

SSA-L294-SM-SP Dec 100 1 1

Total Yearly Quantities for M5: 14,400

Step Parent Notices: Step Parent Notices workload has three (3) different mail packages, each consisting of a 

personalized English or Spanish notice and a mail-out envelope (6-1/4 x 9-1/2” envelope with one window).

Mailer/Notice Transmits Quantity Leaves Printed Pages

Mailer 6 (M6) -

M6 - SSA-L253-SM Dec 500 1 1

Mailer 7 (M7) –

M7 - SSA-L253-SM-SP Dec 30 1 1

Mailer 8 (M8) –

M8 - SSA-L253-SM-F Dec 5 1 1

Total Yearly Quantities for M6, M7, and M8: 535

Fee Adjustment Notices: Fee Adjustment Notices workload has two (2) different mail packages, each consisting 

of a personalized English or Spanish notice and a mail-out envelope (6-1/4 x 9-1/2” envelope with one window).

*This notice will not occur in years when there is no Cost of Living Adjustment (COLA) announced. The number 

shown is an estimate if COLA is provided.

Mailer/Notice Transmits Quantity Leaves Printed Pages

Mailer 9 (M9) –

M9 - SSA-L251-SM* Nov 2,000 1 1

Mailer 10 (M10) –

M10 - SSA-L252-SM Nov 220,000 1 1

 

Total Yearly Quantities for M9 and M10: 222,000
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 46 of 74

391-S R-1 (03/23)

1099/1042 Initial Notice: 1099/1042 Initial notices workload has one (1) mailer consisting of eight (8) different 

mail packages, each consisting of a contractor-generated cover page containing outgoing and return address for 

dual window mail-out envelope, personalized English, English Foreign, Spanish, or Spanish Foreign notice and a 

mail-out envelope (6-1/4 x 9-1/2” envelope with two windows).

Mailer/Notice Transmits Quantity Leaves Printed Pages

Mailer 11 (M11) -

M11 – 1042 Initial English Dec 10 4 7

1042 Initial English Foreign Dec 60 4 7

1042 Initial Spanish Dec 30 5 8

1042 Initial Spanish Foreign Dec 50 5 8

1099 Initial English Dec 250,000 5 9

1099 Initial English Foreign Dec 350 5 9

1099 Initial Spanish Dec 17,000 5 9

1099 Initial Spanish Foreign Dec 200 5 9

Total Yearly Quantities for M11 267,700

1099/1042 Supplemental Notice: 1099/1042 Supplemental notices workload has one (1) mailer consisting of four 

(4) different mail packages, each consisting of a contractor-generated cover page containing outgoing and return 

address for dual window envelope, personalized English, English Foreign, Spanish, or Spanish Foreign notice and 

a mail-out envelope (6-1/4 x 9-1/2” envelope with two windows).

Mailer/Notice Transmits Quantity Leaves Printed Pages

Mailer 12 (M12) -

M12 – 1042 Supplemental English Jan 10 4 7

1042 Supplemental English Foreign Jan 60 4 7

1099 Supplemental English Jan 5,500 5 9

1099 Supplemental English Foreign Jan 50 5 9

Total Yearly Quantities for Mailer 12 5,620

T2 COLA Notice: T2 COLA Large Print notices workload has one (1) mailer consisting of 6 different mail 

packages, each consisting of a contractor-generated cover page containing outgoing and return address for dual 

window envelope, personalized English, English Foreign, Spanish, or Spanish Foreign notice and a mail-out 

envelope (6-1/4 x 9-1/2” envelope with two windows).

Mailer/Notice Transmits Quantity Leaves Printed Pages

Mailer 13 (M13) -

M13 – RE- Retirement English Nov 105,000 4 6

RS – Retirement Spanish Nov 12,000 4 7

DE – Disability English Nov 90,000 4 6

DS – Disability Spanish Nov 7,000 5 8

FE – Foreign English Nov 300 3 5

FS – Foreign Spanish Nov 150 4 6

Total Yearly Quantities for Mailer 13 214,450
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 47 of 74

391-S R-1 (03/23)

Certified and Registered Mail Mailers: Mailers 1 through 10, when required, will have a duplicate, separate file 

transmitted at the same time as each of the above-named mailers. The contractor must process these files 

separately as certified mail files or in the case of foreign mail as registered mail files, in accordance with the 

Special Mailing Requirements section of this contract. Certified and registered mail is anticipated to be less than 

2% of total annual contract quantity.

GOVERNMENT TO FURNISH:

Manuscript copy for all 37 notices (including notices with scannable forms) and 16 envelopes.

Camera copy for the recycled paper logo and legend (English and Spanish).

PS Form 3615, Mailing Permit Application and Customer Profile.

Vendor Record Specifications

SSA will provide an Official Government Postage Meter head only. (NOTE: SSA will not provide the meter mail 

machine. All meter equipment and supplies must be borne by the contractor.)

CASS Certification and NCOA Certificate.

A data connection between the contractor’s specified location and the nearest available location or SSA’s 

National Computer Center in Baltimore, MD. 

Identification markings such as register marks, commercial identification marks of any kind, etc., except GPO 

imprint, form number, and revision date, carried in the furnished electronic files or furnished copy, must not print 

on the finished product.

EXHIBITS:

Exhibit A: Form SSA-301, Contractor Personnel Security Certification

Exhibit B: SSA External Service Provider Additional Security Requirements

Exhibit C: Security Assessment Report (SAR) Template

Exhibit D: Risk Assessment Report (RAR) Template

Exhibit E: Externally Hosted Information System Plan ((ESP) Template FY17 

Exhibit F: General Records Schedule 4.2, Information Access and Protection Records

Exhibit G: Clause 2352.224-2B: Worksheet for Reporting Loss or Suspected Loss of Personally Identifiable 

Information (May 2019)

Exhibit H: Declaration for Federal Employment (Optional Form 306)

Exhibit I: Fair Credit Reporting Act (FCRA) Authorization Form

Exhibit J: Additional Questions for Public Trust Positions Branching

Exhibit K: Questionnaire for Public Trust Positions (SF85P)

Exhibit L: Fingerprint Card (FD-258) 

Exhibit M: Contractor Personnel Rollover Request Form

Exhibit N: Form SSA-222

Exhibit O: Computer System Plan

Exhibit P: 3PAO-Obligations-and-Performance-Guide v1.0

Exhibit Q: Audit and Summary Reports

Exhibit R: Record Specifications

Exhibit S: MVRP Request letter

Exhibit T: Detailed Meter Report

Exhibit U: Postage Meter Activity log
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 48 of 74

391-S R-1 (03/23)

CONTRACTOR TO FURNISH: All materials and operations, other than those listed under “GOVERNMENT

TO FURNISH,” necessary to produce the products in accordance with these specifications.

Secure File Transfer Protocols (SFTP) Site: Contractor is required to set up, establish, and maintain an SFTP 

site that multiple users at SSA can access for passing PDF notice validation samples containing PII to SSA and

back. Appropriate log-on instructions and protocol must be provided at time of award.

DATA SET NAME*

The file name may be in the following formats (“vendor” would be an SSA-assigned vendor identifier):

OLBG.BTO.filename.vendor.RYYMMDD

*The actual data set names will be provided to the contractor at the postaward meeting, or shortly thereafter.

TRANSMISSIONS: Upon award of this contract, the Government will determine the connectivity method 

between SSA and the contractor. Internet Protocol (IP) will be the connection protocol for the transmissions. At 

the Government’s option, the Government will either place an order for a dedicated circuit data connection to be 

installed (within 60 calendar days) between the contractor’s location(s) and SSA’s network interface location or 

the connectivity method will be through the Internet using an encrypted VPN tunnel. The connection method is at 

the sole discretion of the Government. The Government shall not be responsible for installation delays of data 

connections due to any external influences such as employee strikes, weather, supplies, etc., which are conditions 

beyond the control of the Government.

If the Government selects a VPN Internet connection method, the contractor must have an Internet ready VPN IP 

security (IPsec) capable devise. The Government will not be responsible for any cost associated with the VPN 

Internet connection that the contractor may incur.

If the Government selects a dedicated circuit transmission, SSA will determine the appropriate bandwidth for the 

connection. The cost of this connection will be borne by the Government. The contractor shall immediately 

provide a complete delivery address with nearest cross-street, contact name, and phone number for installation of 

data transmission services and equipment. The contact person at the contractor’s site will be available for delivery 

of services at the specified location. The Government shall not be responsible for incorrect or lack of address 

information, nor for non-availability of contact person at the delivery site. SSA will provide the necessary 

dedicated data connection, including a router, modem, and firewall at the contractor’s specified location(s).

The contractor shall provide adequate rack space for securing the router and firewall and a dedicated analog dialup line within eight (8) feet of the router. This dedicated analog dial-up line will be used for router management 

and access for troubleshooting. The line must be in place and active prior to the installation of the circuit/router 

and equipment.

The contractor must provide capability to utilize the capacity of the connection(s) to fulfill the intended purposes 

of this contract. The contractor shall provide a suitable environment for installation of the equipment. Power 

specifications for the router(s) are: AC Power Dissipation (280W maximum) and AC input voltage (100 to 

240VAC). The cabinet specifications are: 36U enclosure; frame (72” H x 24” W x 36” D); 23-19 inch appropriate 

Revsa rails (10-32 tapped); louvered side panels; plexiglas locking front door; solid locking rear door; heavy duty 

lockable dual width casters; top fan assembly (4 fans); 10- or 12-outlet 20-amp power strip; 19” width slide-out 

shelf; cable management (wire loops); appropriate cabinet grounding for installation; or equivalent to previous 

specifications.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 49 of 74

391-S R-1 (03/23)

Any reprogramming and/or reformatting of data supplied by transmission or VPN Internet transmission 

necessitated due to the contractor’s method of production shall be the responsibility of the contractor (at no cost to 

the Government). It is solely the contractor’s responsibility to ensure proper printing and inserting in their 

environment.

FILE TRANSFER MANAGEMENT SYSTEM (FTMS) REQUIREMENTS: The contractor shall provide 

the capability to interface with SSA’s National File Transfer Management System (FTMS) for electronic 

transmission of notice files from SSA to the production facility. SSA will provide the necessary data connection 

into the contractor’s location. At the discretion of SSA, the line speed may be either increased or decreased 

depending on utilization. The contractor must provide, at their expense, the equipment and operating software 

platform and the file transfer software required at their location. The contractor assumes all responsibility for 

configuration, maintenance, and troubleshooting of their equipment and software. 

SSA utilizes, and the contractor must provide compatibility with, Managed File Transfer software from TIBCO. 

The contractor may implement the Managed File Transfer Platform Server that has embedded software encryption 

capable of being enabled. The personal computers/servers must have the capability to run Managed File Transfer 

software with encryption enabled using IP protocols on Windows, UNIX (i.e., IBM’s AIX, SUN or HP), or z/OS 

platforms. 

SSA will not permit any private class A, B, or C IP addresses (i.e., 10.xxx.xxx.xxx type IP addresses) from 

external users on its network. At connection time to SSA, the contractor will be provided a suitable IP address for 

access to SSA’s network via a firewall. SSA will provide the necessary subnet(s) for connection at the remote 

site. The contractor will be responsible for their own name/address translation to fulfill the intended purpose of 

data transfers. SSA will provide Managed File Transfer node information to the contractor as required to 

accomplish file transfer. 

The contractor may determine the media type on which files from SSA will be received to the extent that operator 

intervention (e.g., a tape mount) is not required at SSA or the contractor’s production facility. Simultaneous 

multiple transmission sessions must be possible on the contractor’s equipment. All files transmitted by the SSA 

will be written as Physical Sequential or “flat” files at the contractor’s location and will be distinguished with a 

“run date” in the contractor’s file name. Virtual Storage Access Method files and Generation Data Groups, 

supported by IBM/MVS or IBM z/OS operating systems, are not permitted under this contract. The contractor’s 

storage format must not preclude the availability of the Managed File Transfer software Checkpoint/Restart 

feature. 

NOTE: The contractor may not use VM/VSE/ESA on a mainframe system as this hampers automated file 

transmission.

The contractor’s FTMS software shall be operational for the receipt of data files 24 hours per day, seven (7) days 

per week, unless otherwise specified by the Government. The communications protocol between SSA and the 

contractor shall be the Internet Protocol (IP). The contractor must specify the type of Local Area Network (LAN) 

connection that will be used at the location where the SSA connection is to be installed. The contractor is 

responsible for providing complete hardware and software compatibility with SSA’s existing network. 

Production file transfers will be established according to SSA’s standard procedures for transmission control, 

dataset naming, and resource security. The contractor’s file management system must accommodate multiple file 

transmission sessions without intervention at either end. The contractor must have sufficient capacity to support 

the number of concurrent transmission file sessions as dictated by SSA. 

The above will apply regardless of the number of SSA contracts/workloads transmitted to the contractor daily. If 

the contractor is awarded multiple SSA contracts, there must be sufficient capacity at the contractor’s production 

facility to accept transmission of all files according to their schedules.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 50 of 74

391-S R-1 (03/23)

It is the contractor’s responsibility to notify SSA when systems or data line problems arise and transmission(s) 

cannot take place. SSA’s first point of contact for systems or data line problems shall be the HELP DESK at 877-

697-4978.

All data provided by the Government or duplicates made by the contractor or their representatives and any 

resultant printouts must be accounted for and kept under strict security to prevent their release to any 

unauthorized persons. Data may not be duplicated in whole or in part for any other purpose than to create 

material to be used in the performance of this contract.

Any duplicate data and any resultant printouts must be destroyed by the contractor. Data provided to the 

contractor must be retained for 21 workdays after mailing.

PREPRODUCTION TESTS: Prior to the commencement of production of orders placed under this contract, 

the contractor will be required to demonstrate their ability to perform the contract requirements by performing the 

following tests –

▪ Transmission Test

▪ Preproduction Validation Test

The Government will furnish electronic test files at the postaward conference, or shortly thereafter, to be used in 

performing the Transmission Test and the Preproduction Validation Tests.

The contractor will be required to have all material necessary to perform these tests. All composition and proofing 

must be completed prior to these tests, as applicable for each test (see “COMPOSITION” and “PROOFS” 

specified herein).

Failure by the contractor to perform any of the tests listed above to the satisfaction of the Government may be 

cause for default. 

The Government reserves the right to waive the requirements of any or all of these tests. The contractor will be 

notified at the postaward conference if any test(s) will be waived.

NOTE: All PDF’s containing PII must be sent via SFTP.

Transmission Test: After the appropriate data connection has been installed, the contractor will be required to 

receive within one (1) workday approximately 475,000 notices (Mailers 1 through 13). 

The contractor will be required to perform a Record Count Verification and a Coding Accuracy Support System 

(CASS) certification within one (1) workday after the complete transmission of the test files. 

The contractor will be required to copy the files to their own system and email Jamey.cunningham@ssa.gov with 

the exact counts received (broken down by dataset name) before proceeding with any other processing. 

SSA will respond within one (1) workday of receipt for verification.

The contractor will be required to run the test file through their CASS certification system to ensure there are no 

problems with the reading of the address file. The contractor will be required to report to SSA with the test 

results. 

Preproduction Validation Test: Prior to commencement of production of orders placed under this contract, the 

Government will furnish electronic test files (will use the files utilized for the transmission test) shortly after the 

postaward conference to be used in performing the Preproduction Validation Test.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 51 of 74

391-S R-1 (03/23)

The Government will issue a print order for the preproduction validation tests (see “FREQUENCY OF ORDERS” 

for more information). 

Within five (5) workdays after receipt of “O.K. to Print” on proofs for Mailers 1 through 13, the contractor must 

perform a validation test and furnish 1,225 printed samples as follows for validation. Forms must be complete and 

include all variable data from the Government furnished test files. 

▪ Mailers 1 through 13 – Contractor to submit 25 printed test samples (925 total printed samples) of each 

different notice (to include scannable form, if applicable) (inserts and mail-out envelopes not required). 

Contractor to submit the samples to: SSA, Attn: Jamey Cunningham, DMIM, 3-B-10-F Annex Building,

6401 Security Boulevard, Baltimore, MD 21235.

▪ Mailers 1 through 4 – Contractor to submit 25 duplicate test samples (300 total printed samples) of each 

different notice (to include scannable form, if applicable; inserts and mail-out envelopes not required).

Contractor to submit samples to: Social Security Administration Wilkes-Barre Direct Operations Center 

(WBDOC), Attn: Patrice Gallagher/Analyst Office 1150 East Mountain Drive Wilkes-Barre PA 18711. 

The Government will approve, conditionally approve, or disapprove the samples within five (5) workdays of 

receipt thereof. Approval or conditional approval shall not relieve the contractor from complying with the 

specifications and all other terms and conditions of the contract. A conditional approval shall state any further 

action required by the contractor. 

If the Government disapproves the samples, the Government at its option may require the contractor to submit 

additional samples for inspection and testing, in the time under the terms and under the terms and conditions 

specified in the notice of rejection. Additional samples must be furnished and necessary changed made at no 

additional cost to the Government. 

In the event the Government disapproves the additional samples, the contractor may be deemed to have failed to 

make delivery within the meaning of the default clause in which event this contract shall be subject to termination 

for default. A notice of disapproval shall state the reasons thereof. 

Contractor to submit revised samples, if necessary, due to author’s alterations (AA’s) by the Government, within 

three (3) workdays after receipt of notification and furnished materials. The Government will approve, 

conditionally approve, or disapprove the samples within three (3) workdays of receipt thereof.

Using the Government furnished test files, the contractor is required to furnish one (1) complete set of PDF files 

of the notices (to include scannable form, if applicable) validation test samples. The PDF samples are to be 

uploaded to the SFTP site. The contractor must email Jamey.cunningham@ssa.gov once the upload is complete. 

Upon completion of all validation test requirements, the contractor will be reimbursed for all applicable costs in 

accordance with “SECTION 4. - SCHEDULE OF PRICES.” If the contractor fails to meet all validation test 

requirements, they will not be reimbursed for any associated costs. 

The contractor must perform the preproduction validation tests in their facilities and on their equipment using 

their personnel.

COMPOSITION: The contractor will be required to set type for all components (notices, OCR scannable forms,

and envelopes) of each of the mailers. 

Contractor will be required to set type for 16 envelopes in Helvetica or similar typeface.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 52 of 74

391-S R-1 (03/23)

Contractor to set type for 37 notices and scannable OCR form (approximately 218 pages), flushed left, and ragged 

right. The laser imaging must not be conspicuously different in quality from images produced by 

photocomposition and must have a minimum resolution of 300 x 300 dpi. 

▪ Mailers 1 through 12 – Contractor to set type in Century Schoolbook, Times Roman, or similar Serif 

typeface (at contractor’s option). Contractor to use the largest typesize possible for the space available. 

▪ Mailers 11 through 13 – Contractor to set type in Times New Roman or Century Schoolbook (at 

contractor’s option), 18 pt.

No alternate typefaces will be allowed; however, manufacturers’ generic equivalents will be accepted for the 

above typefaces.

For the OCR scannable forms, exact spacing and locations of scan boxes and variable data must be maintained for 

readability of preprogrammed scanning equipment. The spacing and page layout of the form must be consistent 

between each English and Spanish form version although the contractor may vary font size between the English 

and Spanish form to fit available space.

Image position of all variable and/or static type matter, and data on the OCR scannable forms must meet GPO 

Quality Assurance Level III requirements. Form work will be defined as matter set in all sizes, and will include 

vertical, horizontal, and diagonal rules, box-heads, numbered lines, checkboxes, arrows, type matter, manuscripts, 

etc., positioned in the proper location to provide spaces for information to be filled in individually.

Mailers 11 through13 contain overlays. The contractor must update the overlays. 

The contractor must also create a standard print notice cover page which contains the mailing and return address 

to show through the envelope windows. 

Font for Intelligent Mail Barcode is required.

PROOFS: Proofs will be required with the initial order for each mailer type and any time that a copy change is

required during the term of the contract. 

Three (3) sets of digital content proofs of all components (scannable OCR form without variable data, scannable 

OCR form with variable data, personalized notices without variable data, personalized notices with variable data, 

and envelopes) will be required. Proofs must be created using the Raster Image Processor (RIP) that will be used 

to produce all products. Proofs must be collated with all elements in their proper position (not pasted up), imaged 

face and back, trimmed and folded to the finished size of the product. Proofs must also indicate margins.

One (1) press quality Adobe Acrobat (most current version) PDF soft proof (for content only – showing all 

elements) of all components (scannable OCR form without variable data, scannable OCR form with variable data, 

personalized notices without variable data, personalized notices with variable data, and envelopes) using the same 

Raster Image Processor (RIP) that will be used to produce the final printed product. PDF proof will be evaluated 

for text flow, image position, and color breaks. Proof will not be used for color match.

For the envelopes, the PDF proofs must show all margins and dimensions, indicate trim marks, show flap, and 

window size and placement, as applicable.

SSA reserves the right to make changes to all proofs. The Government may require one (1) or more sets of revised 

proofs before rendering an “O.K. to Print.”

The contractor will be responsible for performing all necessary proofreading to ensure that the proofs are in 

conformity with the copy submitted.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 53 of 74

391-S R-1 (03/23)

If any contractor’s errors are serious enough in the opinion of the GPO to require revised envelope proofs, the 

revised envelope proofs are to be provided at no additional expense to the Government. No extra time can be 

allowed for this reproofing operation; such operations must be accomplished within the original production 

schedule allotted in the specifications.

The contractor must not print prior to receipt of an “O.K. to Print.”

PRIOR TO PRODUCTION SAMPLES (All Orders): Prior to the commencement of the contract production 

quantity, the contractor shall submit not less than 25 printed/bound samples and 25 PDF samples of the notice or 

notice with scannable form, as ordered (envelopes are not required). The container and accompanying 

documentation shall be marked “PREPRODUCTION SAMPLES” and shall include the GPO jacket, purchase 

order, and program numbers. 

All samples shall be printed and bound, as specified herein, and must be of the size, kind, and quality that the 

contractor will furnish. Samples will be inspected and tested for conformance of materials and must comply with 

the specifications as to construction, kind, and quality of materials. 

All samples must be printed on the paper required, as specified herein.

Samples must contain the variable data. Contractor to provide samples for the first 25 files in the furnished 

production data for both the printed/bound samples and the PDF samples. 

▪ Mailers 1 through 13 – Contractor to furnish 25 PDF samples to: Jamey Cunningham at 

jamey.cunningham@ssa.gov. 

▪ Mailers 1 through 4 – Contractor to furnish 25 printed/bound hard copy samples to: Social Security 

Administration, Wilkes-Barre Direct Operations Center (WBDOC), Attn: Patrice Gallagher/Analyst 

Office, 1150 East Mountain Drive, Wilkes-Barre PA 18711.

Contractor must email the PDF samples within 24 hours of receipt of production files and furnish the hard copy 

samples within three (3) workdays of receipt of production files.

The Government will approve, conditionally approve, or disapprove the samples within two (2) or five (5) 

workdays (as applicable to the mailer) of the receipt thereof (see “SCHEDULE, Production Schedules”). 

Approval or conditional approval shall not relieve the contractor from complying with the specifications and all 

other terms and conditions of the contract. A conditional approval shall state any further action required by the 

contractor. A notice of disapproval shall state the reasons therefore.

If the samples are disapproved by the Government, the Government, at its option, may require the contractor to 

submit additional samples for inspection and test, in the time and under the terms and conditions specified in the 

notice of rejection. Such additional samples shall be furnished, and necessary changes made, at no additional cost 

to the Government and with no extension in the shipping schedule. The Government will require the time 

specified above to inspect and test any additional samples required.

In the event the additional samples are disapproved by the Government, the contractor shall be deemed to have 

failed to make delivery within the meaning of the default clause in which event this contract shall be subject to 

termination for default, provided however, that the failure of the Government to terminate the contract for default 

in such event shall not relieve the contractor of the responsibility to deliver the contract quantities in accordance 

with the shipping schedule.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 54 of 74

391-S R-1 (03/23)

In the event the Government fails to approve, conditionally approve, or disapprove the samples within the time 

specified, the Contracting Officer shall automatically extend the shipping schedule in accordance with Contract 

Clause 12, “Notice of Compliance with Schedules,” of GPO Contract Terms (GPO Publication 310.2, effective 

December 1, 1987 (Rev. 01-18)).

Manufacture of the final product prior to approval of the samples is NOT allowed. Samples will not be returned 

to the contractor. All costs, including the costs of all samples, shall be included in the contract price for the 

production quantity.

All samples shall be manufactured at the facilities and on the equipment in which the contract production 

quantities are to be manufactured.

PAPER: The specifications of all paper furnished must be in accordance with those listed herein or listed for the 

corresponding JCP Code numbers in the “Government Paper Specification Standards No. 13” dated September 

2019. 

Government Paper Specification Standards No. 13 – https://www.gpo.gov/docs/default-source/forms-andstandards-files-for-vendors/vol_13.pdf.

All paper used in each copy must be of a uniform shade.

Notices with Scannable Forms (Mailers 1 through 4): White Optical Character Recognition (OCR) Bond, basis 

weight: 20 lbs. per 500 sheets, 17 x 22”, equal to JCP Code O-25.

Notices (Mailers 5 through 13): White Uncoated Text, basis weight: 50 lbs. per 500 sheets, 25 x 38”, equal to 

JCP Code A60.

CRM and BRM Envelopes (5-3/4 x 8-3/4): White Writing Envelope, basis weight: 20 lbs. per 500 sheets, 17 x 

22”, equal to JCP Code V20; or, at contractor’s option, White Uncoated Texted, basis weight: 50 lbs. per 500 

sheets, 25 x 38”, equal to JCP Code A60. 

Mail-out Envelope (4-1/8 x 9-/2): White Writing Envelope, basis weight: 24 lbs. per 500 sheets, 17 x 22”, equal 

to JCP Code V20; or at contractor’s option, White Uncoated Text, basis weight: 60 lbs. per 500 sheets, 25 x 38”, 

equal to JCP Code A60.

Mail-Out Envelopes (6-1/4 x 9-1/2): White Writing Envelope, basis weight: 24 lbs. per 500 sheets, 17 x 22”,

equal to JCP Code V20; or, at contractor’s option, White Uncoated Text, basis weight: 60 lbs. per 500 sheets, 25 x 

38”, equal to JCP Code A60.

PRINTING/IMAGING: Contractor will be required to convert furnished data for either laser or ion deposition 

printing. All printing/imaging shall have a minimum resolution of 600 x 600 dpi. The notices and scannable forms 

contain both static text matter and variable data. NOTE: Inkjet printing is NOT allowed.

The Government reserves the right to make changes to the envelopes or the format(s)/text of the notices/scannable 

form at any time during the term of the contract. Notification of a proposed change will be given with sufficient 

time for the contractor to allow for the change and submit proofs to the Government. Therefore, the contractor is 

not to preprint or maintain more than a 90-calendar day surplus/inventory of any of the components required on 

this contract. The Government shall not be required to purchase from the contractor the surplus/inventory of any 

component remaining on hand in excess of what was authorized when an envelope or format/text change to 

notices/scannable forms is implemented.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 55 of 74

391-S R-1 (03/23)

Notices: Print face only or face and back, head-to-head, in black ink only. NOTE: Contractor shall be responsible 

for dating all notices. The date to be used is the date notices mail.

Scannable Forms: Print in black ink only.

All Envelopes: Print face and back (after manufacture) in black ink. Printing shall be in accordance with the 

requirements for the style of envelope ordered. All printing shall comply with all applicable U.S. Postal Service 

regulations. The envelope shall accept printing without feathering or penetrating to the reverse side.

All envelopes require a security tint printed on the inside (back - before manufacture) in black ink (lining is 

acceptable). The contractor may use their own design but must guarantee that the product will ensure complete 

opacity and prevent show through of any material contained therein. NOTE: Inside of CRM and BRM envelopes 

must contain a clear area (no pantograph design), approximately 3-1/2 x 5/8” in size, behind the barcode to ensure 

the readability of the bar code by the U.S. Postal Service equipment.

BRM Envelopes: Face of envelopes to be in BUSINESS REPLY FORMAT. Print Facing Identification Marks 

(FIM) and Intelligent Mail Barcodes (IMB) using the camera copy provided for each envelope. Contractor is 

responsible for placing the FIM and IMB on the mailing piece according to the current U.S. Postal Service 

Domestic Mail Manual.

CRM Envelopes: Face of envelopes to be in COURTESY REPLY FORMAT. Print Facing Identification Marks 

(FIM) and Intelligent Mail Barcodes (IMB) using the camera copy provided for each envelope. Contractor is 

responsible for placing the FIM and IMB on the mailing piece according to the current U.S. Postal Service 

Domestic Mail Manual.

RECYCLED PAPER LOGO AND LEGEND: See Government Paper Specification Standards No. 13 for 

recycled content requirements. If recycled paper is used, the recycled paper logo and legend must be printed in black 

ink as follows:

Notices/Scannable Forms: The recycled paper logo and legend prints on the face of the first page of the 

notice/scannable form in the bottom left-hand corner. 

Envelopes: The English recycled paper logo and legend prints on the back (side with seams) of all envelopes 

in the bottom left-hand corner. If the envelope is bilingual, then the Spanish recycled paper logo and legend 

must print on the back in the bottom right-hand corner.

CRITERIA FOR DATA IMAGING: Currently, all variable data fill-in requirements for the Mid-Year Mailer,

NCOA, Step Parent, Fee Adjustment, 1099/1042 Initial, 1099/1042 Supplemental, and T2 COLA notice

workloads are to be extracted from the files utilizing the Record Specifications for each workload. (See Exhibit R,

Record Specifications.) At any point during the term of the contract, the Government reserves the right to move 

the data from record specific to AFP Fully Composed.

The 1099/1042 Initial, 1099/1042 Supplemental, and T2 COLA notice workloads will contain overlays. It is the 

contractor’s responsibility to update the overlays annually.

NOTE: Record Specifications are subject to change for each run during the term of the contract.

PDF417 (Portable Data File) 2-D Barcodes: A 2D barcode will be required on all pages of all scannable forms, 

at least 1/4” margins (quiet zone) are required top, bottom, left, and right of each 2D barcode. Minimum 

resolution of 300 dpi, with 4.41 code words per inch. Height is 1/2”, plus or minus 1/16”; length/width is 1-1/4”, 

plus or minus 1/16”. Data columns are to be preceded and followed by the standard PDF417 stop/start patterns, 

left row indicator, and right row indicator. The 2D barcodes to be imaged on the scannable forms should contain 

the following data elements:
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 56 of 74

391-S R-1 (03/23)

Field Name Field Size

Form Number 17

Page Number 2 (contractor to insert)

Print Date 7 (MMCCYY)

SSN 10

BIC 3

First Name 16

Middle Name 2

Last Name 21

DOE 5

FRA 5

Earnings 7

Selection Date 7

PSC 2

DOB 7

Starting Month 10 (e.g., SEPTEMBER)

Language Indicator 1 (E for English and S for Spanish)

End Character 1

Applicant Suffix 4

The PDF417 2-D barcodes must be in accordance with the requirements of ANSIMH 10.8.3M, unless otherwise 

specified. All data elements contained in the barcode must begin in the specified positions. Data elements can be 

filled with blanks if necessary to begin the next element in the proper position.

PRESS SHEET INSPECTION: Final makeready press sheets may be inspected and approved at the contractor’s

plant for the purpose of establishing specified standards for use during the actual press run. Upon approval of the

sheets, contractor is charged with maintaining those standards throughout the press run (within QATAP tolerances

when applicable) and with discarding all make-ready sheets that preceded approval. When a press sheet inspection 

is required, it will be specified on the individual print order. See GPO Publication 315.3 (Guidelines for 

Contractors Holding Press Sheet Inspections) issued January 2015. NOTE: A press sheet inspection is for the 

purpose of setting specific standards that are to be maintained throughout the entire run. It does not constitute a 

prior approval of the entire run.

Press sheets must contain control bars for each color of ink on the sheet. Control bars must be placed parallel to 

the press’s ink rollers. The control bars (such as, BRUNNER, GATF, GRETAG, or RIT) must show areas 

consisting of 1/8 x 1/8” minimum solid color patches; tint patches of 25, 50, and 75%; dot gain scale; and gray 

balance patches for process color (if applicable). These areas must be repeated across the entire press sheet.

Viewing Light: Press sheets will be viewed under controlled conditions with 5000 degrees Kelvin overhead 

luminaries. The viewing conditions must conform to ISO 3664-2009; a viewing booth under controlled conditions 

with 5000 degrees Kelvin overhead luminaries with neutral gray surroundings must be provided.

MARGINS: Margins for the scannable forms must be a minimum of 1/4” on all sides. Unless otherwise 

indicated, contractor is to follow margins in the furnished copy or furnished electronic file. NOTE: Notices 

must appear exactly as approved during validation. Absolutely no deviation will be accepted.

BINDING (Notices and Notices with Scannable Forms): Trim each leaf four sides.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 57 of 74

391-S R-1 (03/23)

CONSTRUCTION (Envelopes):

CRM and BRM Return Envelopes: Envelope must be open side, with gummed, fold-over flap for sealing and 

contain side seams or high-cut diagonal seams, at contractor’s option. Flap depth must be 1-1/2”. Flap must be 

coated with suitable remoistenable glue that will securely seal the return envelope for mailing. Adhesive must not 

adhere to the contents of the envelope. 

Mail-out Envelopes With One Window: Envelopes must be open side, with gummed, fold-over flap for sealing 

and contain side seams or high-cut diagonal seams, at contractor’s option. Flap is at the contractor’s option but 

must meet all USPS requirements. Flap must be coated with suitable glue that will securely seal the envelope 

without adhering to contents, permit easy opening by the recipient, and not permit resealing of the envelope. 

Face of envelope to contain one (1) die-cut address window (1-1/2 x 4-1/4” in size) with slightly rounded corners. 

Die-cut window is to be located 2” from the bottom edge of the envelope and 3/4” from the left edge of the 

envelope (the long dimension of the window is to be parallel to the long dimension of the envelope). The 

contractor has the option to adjust the size and position of the window opening (subject to Government approval), 

providing the visibility of the computer-generated mailing address, keyline above the address field, and the IMB 

barcode on the notice is not obscured, and other extraneous information is not visible when material is inserted 

into the envelope. 

Mail-out Envelopes with Two Windows – Envelopes must be open side, with gummed, fold-over flap for sealing 

and contain side seams or high-cut diagonal seams, at contractor’s option. Flap is at the contractor’s option but 

must meet all USPS requirements. Flap must be coated with suitable glue that will securely seal the envelope 

without adhering to contents, permit easy opening by the recipient, and not permit resealing of the envelope. 

Face of envelope to contain two (2) die-cut windows as follows:

▪ Return Address Window – One die-cut window (1-1/4 x 3-1/4” in size) with rounded corners. Die-cut 

window is to be located 4-3/8” from the bottom edge of the envelope and 3/4” from the left edge of the 

envelope (the long dimension of the window is to be parallel to the long dimension of the envelope). 

The contractor has the option to adjust the size and position of the return address window opening 

(subject to Government approval), providing the visibility of the return address on the notice or 

contractor-generated cover letter is not obscured, and other extraneous information is not visible when 

material is inserted into the envelope. 

▪ Mailing Address Window – One die-cut window (1-5/8 x 4-1/4” in size) with rounded corners. Die-cut 

window is to be located 1-3/8” from the bottom edge of the envelope and 3/4” from the left edge of the 

envelope (the long dimension of the window is to be parallel to the long dimension of the envelope).

The contractor has the option to adjust the size and position of the mailing address window opening 

(subject to Government approval), providing the visibility of the computer-generated mailing address, 

keyline above the address field, and the IMB barcode on the notice or contractor-generated cover letter is 

not obscured, and other extraneous information is not visible when material is inserted into the envelope. 

All windows are to be covered with a suitable transparent, low-gloss, poly-type material that must be clear of 

smudges, lines, and distortions. Poly-type material must be securely affixed to the inside of the envelope so as not 

to interfere with insertion of contents. Window material must meet the current USPS readability 

standards/requirements. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 58 of 74

391-S R-1 (03/23)

NOTE: The Government reserves the right to make changes to the size and position of mail-out envelope window 

openings during the term of the contract to comply with the USPS new Intelligent Mail Barcode. Notification of a 

proposed change will be given sufficient time for the contractor to allow for the change and submit proofs to the

Government. Therefore, the contractor should not preprint or maintain more than a 90-day surplus/inventory of 

any of the mail-out envelopes required on this contract. The contractor is to bill for surplus/inventory within 90 

workdays of completion of workload otherwise the Government shall not be required to purchase from the 

contractor the surplus/inventory of any component. The Government shall not be required to purchase from the 

contractor the surplus/inventory of any of the mail-out envelopes remaining on hand in excess of what was 

authorized when an envelope change is implemented.

GATHERING AND INSERTING: 

Notices: Gather the appropriate number of leaves per the notice in numerical sequence (leaves are to be nested 

together with all faces forward) and fold from a flat size of 8-1/2 x 11” to 8-1/2 x 5-1/2”, title out. 

Notices with Scannable Forms: Gather the appropriate number of leaves per the notice in numerical sequence 

(leaves are to be nested together with all faces forward) and fold from a flat size of 8-1/2 x 11” to 8-1/2 x 5-1/2”, 

title out. 

NOTE: For notices requiring a contractor-generated cover letter, the cover letter is counted as one of the notice 

leaves and is to fold with the notice.

Mailers 1 through 10 – Insert folded notice or notice/scannable form, as applicable, into the mail-out envelope

(with one window) with the mailing address on first page facing out for visibility through envelope window. 

Mailers 11 through 13 – Insert folded notice or notice scannable form, as applicable, into the mail-out envelope 

(with two windows) with the return address and mailing address on the contractor-generated cover page facing 

out for visibility through the envelope windows. 

It is the contractor's responsibility to assure that only the computer-generated address and IMB on the notice or 

contractor-generated cover letter, as applicable, will be visible through the window in the envelope with only one 

notice or notice/scannable form, as applicable, inserted into mail-out envelope and that only one copy of each 

required insert (CRM envelope and/or BRM envelope) are inserted in the mail-out envelope.

It is the contractor’s responsibility to ensure that the correct material for each mailer will be matched with the

correct notices or notices/scannable forms (which contains a 2-D barcode with personalized data) for the same 

beneficiary and be inserted correctly into the envelope.

NOTE: The following equipment will be used for extracting the OCR scannable forms from the CRM or BRM

envelopes: OPEX MPE 7.5 Multiple Purpose Extractor.

PRODUCTION INSPECTION: Production inspection(s) may be required at the contractor’s plant for the 

purpose of establishing that the receipt of transmitted files, the printing of notices, notices/scannable forms, and/or 

envelopes, the imaging, folding, inserting and mailing is being accomplished in accordance with contract quality 

attributes and requirements. A production inspection is for the purpose of setting specific standards that are to be 

maintained throughout the entire run. It does not constitute a prior approval of the entire run. When a production 

inspection is required, the Government will notify the contractor.

NOTE: A production inspection(s) may be required at the contractor/subcontractor’s plant before production 

begins on any new workloads.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 59 of 74

391-S R-1 (03/23)

DISTRIBUTION:

▪ Deliver f.o.b. destination (on the first order and any order that requires a significant change to the 

language, format, or appearance of the notice) 25 complete sample mailers of each type of notice (along 

with any required insert(s)) inserted into the appropriate mail-out envelope. (DO NOT SEAL 

ENVELOPES.) Samples must be delivered to: SSA, Attn: Jamey Cunningham, DMM, 3-B-10-F Annex 

Building, 6401 Security Boulevard, Baltimore, MD 21235-6401.

▪ Deliver f.o.b. destination all required quality control samples to: SSA, Attn: Jamey Cunningham, DMM, 

3-B-10-F Annex Building, 6401 Security Boulevard, Baltimore, MD 21235-6401.

▪ Deliver f.o.b. destination (on the first order and any order that requires a copy change) 10 printed samples 

of the CRM envelope and/or BRM envelope to: SSA, Attn: Jamey Cunningham, DMM, 3-B-10-F 

Annex Building, 6401 Security Boulevard, Baltimore, MD 21235-6401.

▪ Mail f.o.b. contractor’s city each individual mailer. (The contractor is responsible for all costs incurred in 

transporting this product to the U.S. Postal Service facility).

All mailing shall be made at the First Class rate.

The contractor is cautioned that the “Postage and Fees Paid” indicia may be used only for the purpose of mailing

material produced under this contract.

Domestic First-Class Letter-Size Mail: The contractor is required to prepare domestic First-Class letter-size mail 

in accordance with appropriate USPS rules and regulations including the USPS Domestic Mail Manual and Postal 

Bulletins in effect at the time of the mailing. 

When volumes warrant, SSA requires the use of Permit Imprint. The contractor must use SSA’s “Postage and 

Fees Paid First Class Mail” permit imprint mailing indicia printed on each mail piece. Each mail piece sent 

under this payment method must bear a permit imprint indicia showing that postage is paid. Permit imprint 

indicia may be printed directly on mail pieces. Permit imprint mailings must contain at least 200 pieces or 50 

pounds. 

The contractor is cautioned that the mailing permit imprint may be used only for the purpose of mailing material 

produced under this contract. 

Contractors are strongly encouraged to apply for an exception in the Domestic Mail Manual section 604.5.1.2 

called the Minimum Volume Reduction Provision (MVRP) through their local BMEU (see Exhibit S, MVRP 

Request Letter, for local BMEU). 

The MVRP provides an exception to the “200 pieces or 50 pounds” rule for Permit Imprint mailings (including 

certified and foreign mail). With the MVRP exception, contractors will be allowed to mail pieces under the 200 

pieces or less than 50 pounds on a permit imprint eliminating metering (this includes certified and foreign mail). 

Mailers must submit USPS postal paperwork electronically, including piece level barcode information. 

Contractor will be required to contact USPS, prior to any MVRP expiration date (if specified by USPS) all 

MVRP agreements must be current.

This contract workload contains various weight pieces. The contractor is strongly encouraged to use manifest 

mail when postal regulations allow. The contractor must have a Manifest Mailing System (MMS) for First-Class 

Mail, which has been approved by USPS to document postage charges for this mailing. Each mail piece must be 

identified with a unique identification number or with a keyline containing a unique identification number and 

rate information about the piece. Requirements for the MMS are contained in Publication 401 “USPS Guide to 

the Manifest Mailing System” in effect at the time of the mailing. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 60 of 74

391-S R-1 (03/23)

NOTE: A copy of the USPS approval for the MMS must be presented at the Postaward Conference.

If a Government Meter Is Required: All meter equipment and supplies must be borne by the contractor. SSA 

will provide an Official Government Postage Meter head only, but will not supply the meter mail machine. SSA 

will fund the postage for meters through the USPS’ Official Mail Accounting System (OMAS). 

The contractor is responsible for the security of the Government postage meters and access is to be restricted to 

authorized personnel only. The contractor is to advise all staff there is a penalty for the private use of official 

Government postage meters (39USC3203).

Contractors should always maintain sufficient postage on the Government meter. The contractor should contact 

SSA if they are not sure of how much postage to load or the frequency.

The contractor is required to submit spoiled postage/postage error envelope(s)/meter strip(s) and prepare a Postal 

Service Form 3533, Application for Refund of Fees, Products and Withdraw of Customer Accounts. Forms are 

not obtainable from the USPS website since they contain a barcode making each form unique. Contractor will go 

to local Post Offices, postal retail units, or Bulk Mailing Units to obtain the hard copy version of the revised PS 

Form 3533. USPS will credit the postage refund to SSA through the Official Mail Accounting System (OMAS). 

SSA requires the contractor to submit a copy of Form 3533 along with the associated print order in which the 

spoilage occurred and all other postal documentation to the SSA Program Lead.

The contractor must have approval from SSA’s Postage Meter Accountability Team for turn-in of postage 

meter(s) to the meter manufacturer (e.g., excess meter, defective meter, etc.). If the contractor requires a 

replacement postage meter, USPS credits any remaining postage to SSA through the USPS’ Official Mail 

Accounting System, or the meter manufacturer may transfer the remaining postage from the old meter to the new 

meter. The contractor is to document the last meter reading (postage remaining amount) before the meter is 

checked out of service. The contractor may receive a PS Form 3601-C, Postage Meter Activity Report, from the 

meter manufacturer. The contractor is to forward a copy of this report to SSA within three (3) workdays of the 

transaction.

The Government reserves the right to request the contractor to upload funds at any time. These uploads are in 

addition to any routine meter replenishments. As a result of the postage uploads, the contractor may receive a 

Postage Meter Reset Activity Report Statement from the meter manufacturer. If received, the contractor should 

retain this documentation for 12 months.

Contractor is not to relocate any Government postage meter containing SSA postage funds to any other building. 

Contractor is required to contact the SSA Program Lead before any movement of a Government postage meter 

containing SSA postage funds.

The contractor is required to prepare all metered mail in accordance with the rules and regulations in USPS’s 

Domestic Mail Manual and International Mail Manual.

Contractors should not receive invoicing for meter rentals. If received, contractor is to contact the SSA Program 

Lead immediately.

Contractor Sites Using “Official Government” Postage Meters with Automated Reporting Capability 

(Detailed): Postage meters with “Detailed Account Reporting” are capable of providing detailed meter usage 

reports (Exhibit T). If contractor utilizes meters with the detailed account reporting, they will be required to 

provide copies of detailed meter usage reports to SSA with each print order. The detailed report must be 

contract/print order specific. 

NOTE: If the contractor produces multiple SSA contracts, they must submit a separate detailed report for each 

contract and each print order. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 61 of 74

391-S R-1 (03/23)

When setting up the detail report for SSA, contractor must set up the meter to record usage via contract program 

number, mailer number, and file date. The contractor may have to utilize the account and sub-account feature in 

order to capture the contract program number, mailer number, and file date. If contractor utilizes detailed 

reporting, they will be required to utilize the postage meter account feature for each SSA print program. If a 

contractor requires assistance with setup and operating the “accounting” features of the postage meters, they are to 

contact SSA along with the meter manufacturer. 

Contractor Sites Using an SSA Postage Meter Activity Log (Manual Process): If contractor uses mailing 

equipment that cannot support a postage meter with an internal accounting feature and/or is not capable of 

providing SSA with the detailed reporting, they will be required to complete an SSA Postage Meter Activity Log 

(Exhibit U). Contractor must submit a copy of the Postage Meter Activity Log to SSA with each print order. The 

Postage Meter Activity log must be contract/print order specific. 

NOTE: If the contractor produces multiple SSA contracts, they must submit a separate SSA Postage Meter 

Activity Log for each contract and each print order. 

Every field must contain an entry or an N/A if the field does not apply. SSA will return incomplete or incorrect 

activity logs to the contractor for correction. NOTE: If a primary meter fails and a back-up or replacement meter 

is needed to complete the workload, the contractor will need to document the primary meter log in the note field 

(i.e., meter failed and create a new activity log (documenting the necessary fields)) to use with the backup or 

replacement meter.

The contractor is required to obtain the maximum USPS postage discounts possible in accordance with the USPS 

First-Class Domestic Mail automated and non-automated mail discount structure in effect at the time of mailing: 

(a) Automation (5-digit); (b) Automation (3-digit); (c) Automation (AADC); (d) Automation (Mixed AADC); (e) 

Non-automation (Presorted); and, (f) Non-automation (Single Piece).

Mail addressed to United States possessions (e.g., American Samoa, Federated States of Micronesia, Guam, 

Marshall Islands, Northern Mariana Islands, Palau, Puerto Rico, U.S. Virgin Islands, and Wake Island) and 

Military Overseas Addresses (APO/FPO mail) is Domestic Mail, not International Mail, and should be included in 

the discount sorting above.

To maximize automation discounts, Intelligent Mail Barcode barcoding, delivery address placement and 

envelopes used for the mailing are among the items that must comply with USPS requirements for automationcompatible mail in effect at the time of the mailing.

Contractor will be required to produce and use a USPS Intelligent Mail Barcode Full-Service option and achieve 

the maximum postage discounts available with this option. The contractor will be required to comply with USPS 

requirements and place the IMB on all mail pieces of this contract workload. The contractor is required to be 

capable of achieving the postage discounts available with the Full-Service option of the IMB program. The FullService option requires the contractor to use Postal One.

SSA will provide the contractor with a 6-digit Mailer Identifier (MID) for the mailing. The Mailer Identifier 

(MID) is a field within the Intelligent Mail barcode that is used to identify the owner of the mail.

USPS has instituted a verification procedure called a “tap” test. This test is used to screen all mailings with 

barcoded inserts for proper barcode spacing within the envelope window. When the insert showing through the 

window is moved to any of its limits inside the envelope, the entire barcode must remain within the barcode clear 

zone. In addition, a clear space must be maintained that is at least 0.125 (1/8) inch between the barcode and the 

left and right edges of the window and at least 0.028-inch clearance between the Intelligent Mail Barcode and the 

top and bottom edges of the window.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 62 of 74

391-S R-1 (03/23)

All letters in a mailing must pass the “tap” test in order to obtain the maximum postal discounts for the agency. 

The contractor will be responsible for payment of any additional postage resulting from a loss of postage 

discounts due to failure to pass the “tap” test because of inaccuracy or failure to conform to USPS specifications.

The contractor should be aware that USPS uses the Mail Evaluation Readability Look-up Instrument (MERLIN) 

to evaluate barcodes. If MERLIN is in effect in the contractor’s geographic area, the contractor must ensure that 

all barcoded mail meets the new barcode standards. The contractor will be responsible for payment of any 

additional postage resulting from a loss of such discounts due to failure of the contractor-generated barcodes to 

pass the MERLIN test because of inaccuracy or failure to conform to USPS specifications.

National Change of Address (NCOA) and Coding Accuracy Support System (CASS): The contractor shall run

all addresses through NCOA and CASS software for address accuracy. The contractor cannot change the

addresses, but if an address fails CASS or NCOA or requires a NCOA move update, the contractor shall sort those

pieces into a separate file and mail at the non-automated presort rate or full postage rate as to avoid any USPS 

fines for failure to meet address accuracy rules imposed by USPS. If contractor fails to meet this requirement, the

Government will not reimburse for any USPS imposed fines.

IMPORTANT: Contractor CANNOT at any time perform move updates or address corrections on the notice 

address.

USPS Certified Mail: During the term of this contract, when required, Mailers 1 through 13 will have a separate 

file requiring the file to be produced as certified mail, or in the case of foreign mail, as registered mail files, in 

accordance with the USPS regulations contained in the Domestic Mail Manual (DMM) under section 503.3.0, 

Certified Mail. Notices associated with the certified mail file shall be inserted into envelopes and processed as 

certified mail. The contractor must place the current U.S. Postal Service 20-digit certified number and barcode on 

the envelope. The contractor must prepare the file as a separate permit imprint mailing of identical weight pieces 

using the appropriate U.S. Postal Service mailing statement. 

International Mail: The mail pieces included in these mailings may be required to be mailed using USPS 

International Registered Mail. The contractor will prepare these mail pieces according to USPS regulations 

contained in the International Mail Manual (IMM) under Section 330, Registered Mail.

Notices associated with the registered mail file shall be inserted into envelopes and processed as international 

registered mail. The contractor must place the current Postal Service Form 3806 (Receipt for Registered Mail) 

and PS Label 200 (13-digit registered number and barcode) on the envelope. 

International First Class Mail: All items mailed must conform to the appropriate USPS International Mail Manual 

(IMM), Postal Bulletins, and other USPS rules and regulations in effect at the time of mailing.

Permit Imprint is to be used for International Mail providing the mailing consists of at least 200 pieces. Permit 

imprint may not be used if the mailing is less than 200 pieces. Instead, the mail must be metered and any Permit 

Imprint must be covered/concealed by a meter strip. The contractor will be reimbursed for the metered postage by 

submitting a properly completed Postal Service form (or equivalent). All meter supplies must be borne by the 

contractor. 

If the mailing meets the qualifications for International Priority Airmail (IPA), it must be processed through IPA 

in accordance with USPS rules and regulations in effect at the time of the mailing. Contractor must prepare 

mail pieces in accordance with the shape-based requirements of First Class Mail International service listed in the 

USPS International Mail Manual (IMM) and the additional requirements for IPA as specified in the most recent 

IMM. The contractor is required to sort the mail to achieve the maximum postage discounts available with the 

IPA program. To maximize postage savings, the contractor shall sort to the IPA Rate Group 1 through 15. Due 

to heightened security, many foreign postal administrations require complete sender and addressee information in 

roman letters and arabic numerals on postal items.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 63 of 74

391-S R-1 (03/23)

The complete address of the sender, including ZIP Code and country of origin, should be shown in the upper 

left corner of the address side of the envelope. International Mail return addresses must show as the last line of 

the address “UNITED STATES OF AMERICA,” or “USA,” all in upper-case letters. All International Mail must be 

endorsed “PAR AVION” or “AIR MAIL” as described in the USPS IMM. The contractor may use a rubber stamp 

to meet these requirements.

NOTE: International mail cannot contain a presort endorsement. 

Mail addressed to United States possessions (e.g., American Samoa, Federated States of Micronesia, Guam, 

Marshall Islands, Northern Mariana Islands, Palua, Puerto Rico, Virgin Islands, and Wake Island), and 

Military Overseas addresses (APO/FPO mail) is Domestic Mail, NOT International Mail.

Certificate of Conformance: When using Permit Imprint Mail, the contractor must complete GPO Form 712 –

Certificate of Conformance (Rev. 10-15), and the appropriate mailing statement(s) supplied by the USPS. A 

fillable GPO Form 712 Certificate of Conformance can be found at https://www.gpo.gov/how-to-work-withus/vendors/forms-and-standards.

Mailing Documentation: The contractor must provide SSA with complete copies of all documents used by

USPS to verify and accept the mail (e.g., computer records of presort ZIP+4, barcode breakdown, press runs)

including USPS 3600, 3607R, and/or GPO’s Form 712 (Certificate of Conformance), and/or Certificate of Bulk 

mailing, etc., noted with file date and mailer number. The contractor must place the number that is on top of the

GPO Form 712 (the number that starts with “A”) in the space provided on the USPS mailing statements. If no

space is provided on the mailing statement, place the number in the upper right margin of the mailing statement. 

The contractor will use Federal Agency Cost Code 276-00038 on all postal mailing documents. 

Within 24 hours of completing the mailing, the contractor must provide PDF copies of the mail documentation, 

USPS 3600, 3607R, GPO’s Form 712 (Certificate of Conformance), and/or Certificate of Bulk mailings, etc., 

along with a copy of corresponding 100% Accountability Summary reports to Jamey Cunningham at: 

Jamey.cunningham@ssa.gov. All copies must be legible and include both obverse and reverse side.

Upon completion of this contract, the contractor must return all furnished material (as applicable) to: Social 

Security Administration, Attn: Jamey Cunningham, DMIM, 3B-10-F Annex Building, 6401 Security Boulevard, 

Baltimore, MD 21235-6401. 

All expenses incidental to picking up and returning materials (as applicable), submitting proofs, and furnishing

sample copies must be borne by the contractor.

SCHEDULE: Adherence to this schedule must be maintained. Contractor must not start production of any job 

prior to receipt of the print order (GPO Form 2511), as applicable.

In the event that it becomes necessary for the contractor to deviate from the specified mail out date or the quantity 

to be mailed, SSA must be notified immediately.

When required, furnished material must be picked up from and returned to: SSA, Attn: Jamey Cunningham, 

DMIM, 3-B-10-F Annex Building, 6401 Security Boulevard, Baltimore, MD 21235-6401.

When hard copy proofs are ordered, contractor to deliver to and pick up from: 

▪ Two (2) Sets: Social Security Administration, Attn: Jamey Cunningham, DMIM, 3-B-10-F Annex 

Building, 6401 Security Boulevard, Baltimore, MD 21235-6401.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 64 of 74

391-S R-1 (03/23)

▪ One (1) Set: Social Security Administration, Wilkes-Barre Direct Operations Center (WBDOC), Attn: 

Patrice Gallagher/Analyst Office, 1150 East Mountain Drive, Wilkes-Barre PA 18711. 

When PDF soft proofs are ordered, contractor to email to: Jamey.cunningham@ssa.gov, or uploaded to the SFTP 

site. (Email must be encrypted and must include program and print order numbers plus return name and email 

address.)

Proof Schedule: 

The following schedule begins the workday after notification of the availability of the print order and furnished 

material. The workday after notification will be the first workday of the schedule.

▪ When ordered, the contractor must submit all required PDF soft proofs for the envelopes, and all required 

hard copy proofs for the notices (without variable data), and notices with scannable forms (without 

variable data) within seven (7) workdays after receipt of furnished materials. 

▪ Proofs will be withheld no more than five (5) workdays from their receipt at the ordering agency until 

they are made available for pickup for hard copy proofs or changes/corrections/“O.K. to Print” is 

provided for via email for PDF soft proofs. (NOTE: The first workday after receipt of proofs at the 

ordering agency is day one (1) of the hold time.)

▪ If necessary due to author’s alterations, contractor to submit revised proofs without variable data within 

three (3) workdays of ordering agency’s changes. 

▪ Revised proofs without variable data will be withheld no more than three (3) workdays from their receipt 

at the ordering agency until the ordering agency provides changes/corrections/“O.K. to Print” via email. 

(NOTE: The first workday after receipt of revised proofs at the ordering agency is day one (1) of the hold 

time.)

▪ When ordered, contractor must submit all required hard copy proofs of notices (with variable data) and 

notices with scannable forms (with variable data) within two (2) workdays of “O.K. to Print” on proofs 

for notices/scannable forms without variable data.

▪ Proofs will be withheld no more than five (5) workdays from their receipt at the ordering agency until 

they are made available for pickup for hard copy proofs or changes/corrections/“O.K. to Print” is 

provided for via email for PDF soft proofs. (NOTE: The first workday after receipt of proofs at the 

ordering agency is day one (1) of the hold time.) 

▪ If necessary due to author’s alterations, contractor to submit revised proofs with variable data within three 

(3) workdays of ordering agency’s changes. 

▪ Revised proofs with variable data will be withheld no more than three (3) workdays from their receipt at 

the ordering agency until the ordering agency provides changes/corrections/“O.K. to Print” via email. 

(NOTE: The first workday after receipt of revised proofs at the ordering agency is day one (1) of the hold 

time.)

Preproduction Test Schedules:

Prior to receiving transmission of live production data files, the contractor will be required to perform the below 

tests. (The transmission tests will begin after the Government is notified of the availability of the system.)

In order for proper arrangements to be made, notification must be given at least 72 hours prior to all tests.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 65 of 74

391-S R-1 (03/23)

NOTE: Failure of the contractor to perform any of the below tests satisfactorily may be cause for default. The 

Government reserves the right to waive the requirements of these tests. The contractor will be notified at the 

Postaward Conference if any test(s) will be waived.

Transmission Test: 

▪ This test is to be performed within one (1) week of the data connection being installed.

▪ The contractor will be required to receive within one (1) workday approximately 475,000 notices. 

▪ The contractor will be required to perform a record count verification and perform the CASS 

certifications the within one (1) workdays after receipt of the complete transmission of the test file and 

must provide SSA with the exact counts and the CASS certification. 

▪ SSA will respond within one (1) workday of receipt thereof. 

Preproduction Validation Test: 

▪ Within five (5) workdays after receipt of “O.K. to Print” on proofs for Mailers 1 through 13, the 

contractor must perform a validation test.

▪ Contractor to submit 25 printed test samples for Mailers 1 through 13 and 25 duplicate test samples for 

Mailers 1 through 4 (a total of 1,225 printed test samples).

▪ The Government will approve, conditionally approve, or disapprove the samples within five (5) workdays

of receipt thereof.

▪ If required due to AAs, contractor to submit revised printed samples within three (3) workdays of 

notification.

▪ The Government will approve, conditionally approve, or disapprove the revised samples within three (3)

workdays of receipt thereof.

Production Schedules:

Workday - The term “workday” is defined as Monday through Friday* each week, exclusive of the days on which 

Federal Government holidays are observed.

Federal Government Holidays are as follows: New Year’s Day, Martin Luther King’s Birthday, President’s Day, 

Memorial Day, Juneteenth Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving 

Day, and Christmas Day.

*The contractor’s FTMS software shall be operational for the receipt of data files 24 hours a day, seven (7) days a 

week, unless otherwise specified by the Government. (See “FILE TRANSFER MANAGEMENT SYSTEM 

(FTMS) REQUIREMENTS” for additional information).

NOTE: Any or all mailers can include certified or registered mail files. These specific files will mail only when 

required and will mail with any of the print orders. The contractor is to adhere to the corresponding mail schedule 

for the print order in which the certified mail files occur.

The following schedule begins the workday after notification of the availability of the print order and furnished 

material. The workday after notification will be the first workday of the schedule.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 66 of 74

391-S R-1 (03/23)

Mid-Year Mailers: 

Furnished production files transmit as follows:

▪ Mailers 1 and 2: Transmit in June with a second transmission to occur in September.

▪ Mailers 3 and 4: Transmit in June, August, September, and October. Transmissions in August, 

September, and October will only include L9781-SM-SUP and L9781-SM-SUP-SP.

▪ Within 24 hours of receipt of the production files for Mailers 1 through 4, the contractor to submit 25 

PDF samples (with variable data) of the output for approval (see “PRIOR TO PRODUCTION 

SAMPLES”).

▪ Within three (3) workdays of receipt of production files for Mailers 1 through 4, the contractor must 

submit 25 printed/bound hard copy samples (with variable data) for approval (see “PRIOR TO 

PRODUCTION SAMPLES”).

▪ The Government will approve, conditionally approve, or disapprove the samples within five (5) workdays

of the receipt of hard copy samples. 

▪ All Mid-Year Mailers must mail within five (5) workdays of receipt of “O.K. to Print” on hard copy 

samples.

NCOA Mailers:

▪ Mailer 5: Furnished production files transmit in March, June, September, and December. 

▪ Within 24 hours of receipt of the production files, the contractor to submit 25 PDF samples (with variable 

data) of the output for approval (see “PRIOR TO PRODUCTION SAMPLES”).

▪ The Government will approve, conditionally approve, or disapprove the samples within two (2) workdays 

of the receipt thereof.

▪ All NCOA Mailers must mail on or before the last day of each month. 

Step Parent Mailers:

▪ Mailers 6, 7, and 8: Furnished production files transmit in December. 

▪ Within 24 hours of receipt of the production files, the contractor to submit 25 PDF samples (with variable 

data) of the output for approval (see “PRIOR TO PRODUCTION SAMPLES”).

▪ The Government will approve, conditionally approve, or disapprove the samples within two (2) workdays

of the receipt thereof.

▪ All Step Parent Mailers must mail on or before December 31st of each contract year.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 67 of 74

391-S R-1 (03/23)

Fee Adjustment Mailers:

▪ Mailers 9 and 10: Furnished production files transmit in November. 

▪ Within 24 hours of receipt of the production files, the contractor to submit 25 PDF samples (with variable 

data) of the output for approval (see “PRIOR TO PRODUCTION SAMPLES”).

▪ The Government will approve, conditionally approve, or disapprove the samples within two (2) workdays

of the receipt thereof.

▪ All Fee Adjustment Mailers must mail on or before December 1

st of each contract year.

1099/1042 Initial Notices:

▪ The order will transmit in December of each contract year. 

▪ Within 24 hours of receipt of the production files, the contractor to submit 25 PDF samples (with variable 

data) of the output for approval (see “PRIOR TO PRODUCTION SAMPLES”).

▪ The Government will approve, conditionally approve, or disapprove the samples within two (2) workdays

of the receipt thereof.

▪ All 1099/1042 Initial Notice Mailers must mail on or before December 31st of each contract year.

1099/1042 Supplemental Notices:

▪ The order will transmit in January of each contract year. 

▪ Within 24 hours of receipt of the production files, the contractor to submit 25 PDF samples (with variable 

data) of the output for approval (see “PRIOR TO PRODUCTION SAMPLES”).

▪ The Government will approve, conditionally approve, or disapprove the samples within two (2) workdays

of the receipt thereof.

▪ All 1099/1042 Supplemental Notice Mailers must mail on or before January 31st of each contract year.

T2 COLA Notices:

▪ The order will transmit the Friday prior to Thanksgiving each contract year. 

▪ Within 24 hours of receipt of the production files, the contractor to submit 25 PDF samples (with variable 

data) of the output for approval (see “PRIOR TO PRODUCTION SAMPLES”).

▪ The Government will approve, conditionally approve, or disapprove the samples within two (2) workdays

of the receipt thereof.

▪ All T2 COLA Notice Mailers must mail on or before the 3rd Friday of December. 
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 68 of 74

391-S R-1 (03/23)

The contractor must notify the GPO and SSA of the date and time the press sheet or production inspection can be 

performed. In order for proper arrangements to be made, notification must be given at least three (3) workdays 

prior to the inspection(s). Notify the U.S. Government Publishing Office, Quality Control for Published Products, 

Washington, DC 20401 at (202) 512-0542, and SSA at jamey.cunningham@ssa.gov. Telephone calls to GPO will 

only be accepted between the hours of 8:00 a.m. and 2:00 p.m., prevailing Eastern Time, Monday through Friday. 

NOTE: See contract clauses, paragraph 14(e) (1), Inspections and Tests in GPO Contract Terms (GPO Publication 

310.2, effective December 1, 1987 (Rev. 01-18)). When supplies are not ready at the time specified by the 

contractor for inspection, the Contracting Officer may charge to the contractor the additional cost of the 

inspection. 

NOTE: If the backup facility is used for the production of these notices, the Government will require a press 

sheet inspection. Prior to production, notification must be given at least 72 hours in advance of production 

startup.

The ship/deliver date indicated on the print order is the date products ordered for delivery f.o.b. destination must 

be delivered to the destinations specified and products ordered for mailing f.o.b. contractor’s city must be 

delivered to the USPS.

Unscheduled material such as shipping documents, receipts or instructions, delivery lists, labels, etc., will be 

furnished with each order or shortly thereafter. In the event such information is not received in due time, the 

contractor will not be relieved of any responsibility in meeting the shipping schedule because of failure to request 

such information.

For compliance reporting purposes, contractors are to report information regarding each order with date of 

shipment or delivery, as applicable, in accordance with the contract requirements by contacting the Shared 

Support Services Compliance Section via email at compliance@gpo.gov or via telephone at (202) 512-0520. 

Personnel receiving the email or call will be unable to respond to questions of a technical nature or to transfer any 

inquiries.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 69 of 74

391-S R-1 (03/23)

SECTION 3. - DETERMINATION OF AWARD

The Government will determine the lowest bid by applying the prices offered in the “SCHEDULE OF PRICES” 

to the following units of production which are the estimated requirements to produce one (1) year’s production 

under this contract. These units do not constitute, nor are they to be construed as, a guarantee of the volume of 

work which may be ordered for a like period of time.

The following item designations correspond to those listed in the “SCHEDULE OF PRICES.”

I. (a) 218

(b) 16

II. (a) 1

(b) 1

III. (a) 1. 1,308

2. 48

(b) 1. 436

2. 16

IV. (a) 15

(b) 40,609

(c) 4,749

(d) 7,118

(e) 4,878

V. (a) 16,245

(b) 24,364

(c) 4,749

(d) 11,996

VI. 11,996
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 70 of 74

391-S R-1 (03/23)

THIS PAGE IS INTENTIONALLY BLANK.
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 71 of 74

391-S R-1 (03/23)

SECTION 4. - SCHEDULE OF PRICES

Bids offered are f.o.b. destination for deliveries and f.o.b. contractor’s city for all mailing.

Prices must include the cost of all required materials and operations for each item listed in accordance with these 

specifications.

Bidder must make an entry in each of the spaces provided. Bids submitted with any obliteration, revision, or 

alteration of the order and manner of submitting bids may be declared nonresponsive. 

An entry of NC (No Charge) shall be entered if bidder intends to furnish individual items at no charge to the 

Government. Bids submitted with NB (No Bid), NA (Not Applicable), or blank spaces for an item may be 

declared nonresponsive.

The Contracting Officer reserves the right to reject any offer that contains prices for individual items of 

production (whether or not such items are included in the DETERMINATION OF AWARD) that is inconsistent 

or unrealistic in regard to other prices in the same offer or to GPO prices for the same operation if such action 

would be in the best interest of the Government. All invoices submitted to the GPO shall be based on the most

economical method of production.

All billing invoices submitted to the GPO shall be based on the most economical method of production. 

Fractional parts of 100 will be prorated at the per-100 rate.

Contractors billing invoices must be itemized in accordance with the line items in the “SCHEDULE OF 

PRICES.”

Cost of all required paper must be charged under Item V., “PAPER.”

I. COMPOSITION: Prices offered must include the cost of all operations and materials necessary for the 

notices, notices with scannable forms, six (6) CRM return envelopes, one (1) BRM return envelope, and nine 

(9) mail-out envelopes.

(a) Notices and Notices with Scannable Forms..................................................... per page......$___________

(b) Envelopes ...................................................................................................per envelope......$___________

II. PREPRODUCTION TESTS: Prices offered must include all costs incurred in performing the tests as 

specified in these specifications. These costs shall cover but are not limited to: machine time, personnel, all 

required materials, transmissions, electronic prepress, paper, printing, imaging, collating, inserting, mail 

preparation, and any other operations necessary to produce the required quantities of the product in the time 

specified and in accordance with specifications.

(a) Transmission Test................................................................................................ per test......$___________

(b) Preproduction Validation Test............................................................................. per test......$___________

______________

(Initials)
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 72 of 74

391-S R-1 (03/23)

III. PROOFS:

(a) Digital Color Content Proof:

1. Notices and Notices with Scannable Forms......................... per trim/page-size unit......$___________

2. Envelopes.............................................................................................per envelope......$___________

(b) PDF Soft Proof:

1. Notices and Notices with Scannable Forms......................... per trim/page-size unit......$___________

2. Envelopes.............................................................................................per envelope......$___________

IV. PRINTING/IMAGING, BINDING, AND CONSTRUCTION: Prices offered must include the cost of all 

materials and operations (including prior to production samples) necessary for the complete printing/imaging, 

binding, and construction of the product listed in accordance with these specifications.

(a) *Makeready/setup charge......................................................................................................$___________

*Contractor will be allowed only one (1) makeready/setup charge per order. This combined charge shall 

include all materials and operations necessary to makeready and/or set up the contractor’s equipment for that 

run. Invoices submitted with more than one makeready/setup charge per order will be disallowed.

(b) Notices and Notices with Scannable Forms: 

Printing in black ...................................................................................... per 100 leaves......$___________

(c) CRM and BRM Envelopes: 

Printing in black, including construction........................................... per 100 envelopes......$___________

(d) Mail-out Envelopes (6-1/4 x 9-1/2”) With One Window:

Printing in black, including construction........................................... per 100 envelopes......$___________

(e) Mail-out Envelope (6-1/4 x 9-1/2”) With Two Windows:

Printing in black, including construction........................................... per 100 envelopes......$___________

V. PAPER: Payment for all paper supplied by the contractor under the terms of these specifications, as ordered 

on the individual task order/print order, will be based on the net number of leaves furnished for the product(s) 

ordered. The cost of any paper required for makeready or running spoilage must be included in the prices 

offered.

Notices and Scannable Forms: A charge will be allowed for each page-size leaf.

CRM and BRM Envelopes: One leaf will be allowed for each envelope.

Mail-out Envelopes: One leaf will be allowed for each envelope.

______________

(Initials)
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 73 of 74

391-S R-1 (03/23)

Per 100 Leaves

(a) Notices with Scannable Forms (Mailers 1 through 4):

White Optical Character Recognition (OCR) Bond (20-lb)..................................................$___________

(b) Notices (Mailers 5 through 13): 

White Uncoated Text (50-lb.)................................................................................................$___________

(c) CRM and BRM Envelopes: White Writing Envelope (20-lb.);

or, at contractor’s option, White Uncoated Text (50-lb.)......................................................$___________

(d) Mail-out Envelope: (6-1/4 x 9-1/2”): White Writing Envelope (24-lb.);

or, at contractor’s option, White Uncoated Text (60-lb.)......................................................$___________

VI. INSERTING AND MAILING: Prices offered must include the cost of all required materials and operations 

necessary for the mailing of the notices including cost of collating notices (single or multiple leaves) in proper 

sequence and folding to required size in accordance with these specifications, insertion of notice(s) and any 

inserts (if required) into appropriate mail-out envelope; and, mailing in accordance with these specifications.

Per 100 Mailers

Mailers......................................................................................................... per 100 mailers......$___________

LOCATION OF POST OFFICE: All mailing will be made from the__________________________________

Post Office located at Street Address _____________________________________________________________,

City____________________________, State _____________________________, Zip Code ________________

______________

(Initials)
MYM, NCOA, Step Parent, Fee Adjustment, 1099/1042 and T2 COLA Large Print Notices Page 74 of 74

391-S R-1 (03/23)

SHIPMENT(S): Shipments will be made from: City __________________________, State ________________

The city(ies) indicated above will be used for evaluation of transportation charges when shipment f.o.b. 

contractor’s city is specified. If no shipping point is indicated above, it will be deemed that the bidder has 

selected the city and state shown below in the address block, and the bid will be evaluated and the contract 

awarded on that basis. If shipment is not made from evaluation point, the contractor will be responsible for any 

additional shipping costs incurred.

DISCOUNTS: Discounts are offered for payment as follows: __________ Percent, _________calendar days. 

See Article 12 “Discounts” of Solicitation Provisions in GPO Contract Terms (Publication 310.2).

AMENDMENT(S): Bidder hereby acknowledges amendment(s) number(ed) ___________________________

BID ACCEPTANCE PERIOD: In compliance with the above, the undersigned agree, if this bid is accepted 

within____________ calendar days (60 calendar days unless a different period is inserted by the bidder) from the 

date for receipt of bids, to furnish the specified items at the price set opposite each item, delivered at the 

designated points(s), in exact accordance with specifications. NOTE: Failure to provide a 60-day bid acceptance 

period may result in expiration of the bid prior to award.

BIDDER’S NAME AND SIGNATURE: Unless specific written exception is taken, the bidder, by signing and 

submitting a bid, agrees with and accepts responsibility for all certifications and representations as required by the 

solicitation and GPO Contract Terms – Publication 310.2. When responding by email, fill out and return one copy 

of all pages in “SECTION 4. – SCHEDULE OF PRICES,” including initialing/signing where indicated. Valid 

electronic signatures will be accepted in accordance with the Uniform Electronic Transactions Act, §2. Electronic 

signatures must be verifiable of the person authorized by the company to sign bids. Failure to sign the signature 

block below may result in the bid being declared non-responsive. 

Bidder _____________________________________________________________________________________

(Contractor Name) (GPO Contractor’s Code)

____________________________________________________________________________________________

(Street Address)

____________________________________________________________________________________________

(City – State – Zip Code)

By _________________________________________________________________________________________

(Printed Name, Signature, and Title of Person Authorized to Sign this Bid) (Date)

___________________________________________________________________________________________

(Person to be Contacted) (Telephone Number)

____________________________________________________________________________________________

(Email) (Fax Number)

_____________________________________ ______________________________________________________

THIS SECTION FOR GPO USE ONLY

Certified by: __________ Date: __________ Contracting Officer: __________ Date: __________

(Initials) (Initials)

_______________________________________________________________________________ ____________
EXHIBIT A
EXHIBIT A – Page 1 

CONTRACTOR PERSONNEL SECURITY CERTIFICATION 

Purpose: This form is used for contractor personnel to certify that they understand SSA's security and confidentiality 

requirements. 

I understand the SSA security and confidentiality requirements and agree that: 

1. I will follow all SSA rules of conduct and security policy/privacy rules/regulations. 

2. I agree not to construct and maintain, for a period of time longer than required by the contract, any file containing 

SSA data unless explicitly agreed to by SSA in writing as part of the task documentation. 

3. I agree to safeguard SSA information, whether electronic or hardcopy, in secured and locked containers during 

transportation. 

4. I will use all computer software according to Federal copyright laws and licensing agreements. 

5. I agree to keep confidential any third-party proprietary information which may be entrusted to me as part of the 

contract. 

6. I will comply with systems security requirements contained in the SSA Systems Security Handbook. 

7. I will not release or disclose any information subject to the Privacy Act of 1974, the Tax Return Act of 1976, SSA 

Regulation 1 and section 1106 of the Social Security Act to any unauthorized person. 

8. I understand that disclosure of any information to parties not authorized by SSA may lead to criminal prosecution 

under Federal law. 

----------------------------------------------- -------------------------------------- 

Contractor Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

Form SSA-301 (2-98) 
EXHIBIT A – Page 2 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

Form SSA-301 (2-98) 
EXHIBIT A – Page 3 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

------------------------------------------------ --------------------------------------- 

Contractor Employee Date 

Form SSA-301 (2-98) 
EXHIBIT B
Resource Page: SSA External Service Provider Security Guidance Page 1

EXHIBIT B

SSA External Service Provider Additional Security Requirements

DSPP Home

All External Service Providers (ESP) are subject to the following security requirements:

 All ESPs are subjected to SSA’s Security Authorization Process, which will entail security testing and

evaluation of the in-place security controls. For more information, see NIST SP 800-37, Revision 2 - Risk

Management Framework for Information Systems and Organizations - A System Life Cycle Approach for

Security and Privacy, December 2018.  ESPs must follow NIST SP 800-53 Revision 4 Recommended Security Controls for Federal Information

Systems and Organizations for protecting Low or Moderate impact level information as categorized by FIPS

199 for the information system. Note: Systems that contain Personally Identifiable Information (PII) are

considered “Moderate”.

 ESPs must document all deployed (applicable) and planned controls for an information system in a System

Security Plan that is in NIST-compliant format. SSA will provide the SSP template to be completed.

 ESPs classified as Cloud Service Providers (CSP) must adhere to additional FedRAMP security control

requirements. Further information may be found at: http://www.gsa.gov/portal/category/102371. As

part of these requirements, CSPs must have a security control assessment performed by a Third Party

Assessment Organization (3PAO).

 Upon request from SSA, the ESP shall provide the following network security information and

documentation for review and audit purposes:  All information security control artifacts required to support the Security Assessment and

Authorization (SA&A) process.  Intrusion Detection Systems (IDS) configuration.  Network firewall configuration.  Server and network device patching schedules and compliance.  Server, network device, and security logs.  Detailed hardware inventory including servers, network devices, and storage.

ESPs are required to adhere to NIST 800-53 Rev 4 security control framework based on their assigned categorization.

The following sections outline additional security controls and SSA organizational defined parameters for NIST 800- 53, Rev 4. Security requirements below are applicable to low and moderately categorized systems unless otherwise

designated. For additional information or supplement guidance for these controls, refer to Appendix F - SECURITY

CONTROL CATALOG in NIST 800-53, Rev 4.
Resource Page: SSA External Service Provider Security Guidance Page 2

Account Management Requirements

The purpose of the following is to address requirements for account and session management for External Service

Providers (ESPs). SSA Additional Requirements for ESPs:

 AC-2 - ESPs must employ individual account types on external service provider systems. The use of group,

anonymous or temporary accounts is strictly prohibited.

 AC-2 - ESPs must demonstrate the implementation of an approval process that describes how system

accounts are created, deleted, disabled, or modified. The process should account for roles in the system

and the appropriate authorizations to grant access. Public-facing systems may use a registration process in

place of the approval process.

 AC-2(3) - A deactivation process is required to manage inactive accounts. The process must describe how

the system identifies and deactivates inactive accounts that have not been in use for 90 days or more. ESPs

must automatically disable inactive accounts after 90 days and then remove these disabled accounts after

1 year.

 AC-2(4) - ESPs must provide the capability to produce a record of all account management activities that

occur on the system and develop an automated method to submit these records in the form of a report to

SSA.

 AC-6 - ESP administrator accounts and privileged user accounts must be customized to only allow access to

specific roles and functions on the system. ESP must provide a list of these functions to the Contract Officer

Technical Representative (COTR). (Moderate and High categorized systems only).

 AC-7 - ESPs must enforce a limit of 3 consecutive invalid login attempts by a user during a 20-minute period

and automatically lock the account/node for 30 minutes when the maximum number of unsuccessful

attempts is exceeded. The account shall remain locked for 30 minutes. (Moderate and High categorized

systems only).

 AC-8 - ESPs providing services to SSA internal users must display the internally used and approved warning

banner.

 The SSA internal banner is as follows:  Only authorized users can access the system.  The system is a U.S. Government computer system subject to Federal law.  Unauthorized attempts to access or modify any part of SSA’s systems are prohibited and

subject to disciplinary, civil action or criminal prosecution.

If the system is serving the public as its user base, the system must display a warning banner containing

language that is appropriate to the application. The SSA COTR must approve the public warning banner

language prior to implementation.

 AC-11 - ESPs must enforce termination of user sessions after 30 minutes of inactivity. Users must

authenticate again after sessions are terminated in order to continue using the application. (Moderate and

High categorized systems only).

 AC-17(4) - ESPs must restrict remote access to approved administrative functions and accounts.
Resource Page: SSA External Service Provider Security Guidance Page 3

Awareness and Training Requirements

The purpose of the following is to address requirements for awareness and training for External Service Providers

(ESPs).

SSA Additional Requirements for ESPs:

 AT-2 - ESP contractors and their employees or sub-contractors must complete SSA provided security

awareness training at least annually.

 AT-3 - ESPs must provide role-based training to all employees who fulfill special roles or duties in regards

to SSA data or systems.

 AT-4 - ESPs must retain and produce records of role based training completions for 3 years.

Auditing Requirements

The purpose of the following is to address requirements for auditing for External Service Providers (ESPs).

SSA Additional Requirements for ESPs:

 AU-2 - ESPs must maintain an audit log of transactions create, modify, or delete SSA information.

 AU-2 - ESPs must maintain an audit log of the following events: Logon/logoff events, account management,

privilege or role changes, and administrator activity.  AU-5 - ESPs must report any failure of audit processing that occurs to the SSA COTR within 24 hours.

 AU-6 - ESPs must review and analyze information system audit record for indications of inappropriate or

unusual activity and report those findings to SSA COTR within 24 hours. ESPs must support monitoring and

review of the system for unusual or inappropriate activity daily. This activity must be provided to the COTR

immediately for review.

 AU-6 - ESPs must provide user and transaction log reports to SSA when requested.  AU-7(1) - ESPs must allow for scoping of audit criteria for efficient reporting capability.

 AU-11 - ESPs must retain online audit logs for 90 days.  AU-11 - ESPs must retain audit records for seven (7) years.

Security Assessments and Authorization Requirements

The purpose of the following is to address requirements for security assessments and authorization for External

Service Providers (ESPs).

SSA Additional Requirements for ESPs:

 CA-2 - ESPs must develop an assessment plan that includes:

o Annual assessment of a subset of controls
Resource Page: SSA External Service Provider Security Guidance Page 4

o Triennial comprehensive assessment (full scope)

o Assessments as needed when a significant change occurs on the system.

 CA-2 - ESP and COTR must define what a significant change is and require a new assessment whenever a

significant change occurs. Significant change is defined in NIST Special Publication 800-37 Revision 1,

Appendix F.

 CA-3 - The contractor shall document in the SSA security plan, all connections to contractor resources made

to external information systems, and applications. Examples of connections would include: connections to

subcontractor sites, connections used for remote administration, connections made to contractor’s

company/corporate networks, etc. These connections shall be reviewed and monitored on an ongoing

basis, at least annually to determine the need for ongoing use by the contractor management. (Moderately

categorized systems only).

 CA-5 - For any security reports issued to the contractor, including internal independent reviews, the

contractor is responsible for developing a POA&M that identifies corrective actions and/or mitigating

controls for any identified vulnerabilities. Contractors shall report to COTR POA&M progress at least

monthly. In addition, the contractor must provide artifacts to update POA&M items at least 7 days prior to

milestone completion date to ensure SSA has sufficient time to review.

 CA-7 - ESP must monitoring the effectiveness of its security controls on a continual basis and take

appropriate corrective actions as necessary to ensure SSA data is protected from unauthorized access,

modification or disclosure.

Configuration Management Requirements

The purpose of the following is to address requirements for configuration management for External Service

Providers.

SSA Additional Requirements for ESPs:

 CM-2(3) - ESPs must define and deploy an approved device configuration on each device used to provide

services to SSA at least annually.  CM-6 - ESPs must periodically scan the device configuration of each device used to provide services to SSA

and identify deviations from the approved device configuration. Deviations shall be logged and corrected

within 24 hours. The ESP shall submit device scan reports to SSA upon request.

 CM-8 - ESPs must maintain an inventory all IT assets that store, process, or transmit SSA data and provide

to SSA upon request.  CM-9 - The contractor shall maintain a configuration management plan that addresses the roles,

responsibilities, processes, and procedures to manage inventory throughout the lifecycle.

Contingency Planning Requirements

The purpose of the following is to address requirements for contingency planning for External Service Providers.

SSA Additional Requirements for ESPs:
Resource Page: SSA External Service Provider Security Guidance Page 5

 CP-2 - ESP must submit a contingency plan that will support and meet the SSA supplied recovery objectives

and must be maintained, reviewed and, if necessary updated at least annually.

 CP-9 - ESPs must encrypt all Media used for backup and archiving purposes using Federal Information

Processing Standard (FIPS) 140-2 compliant solutions. (Moderate and High categorized systems only).

Identification and Authentication Requirements

The purpose of the following is to address requirements for identification and authentication for External Service

Providers (ESPs).

SSA Additional Requirements for ESPs:

 IA-2(12) - Identity, Authorization and Access Management (IdAAM) - The External Service Providers must

seamlessly integrate with the SSA’s Federation Service. This service is based on oAuth and SAML (Security

Assertion Markup Language) 2.0 standards and enables SSA to meet its two factor authentication

requirements as specified in Homeland Security Presidential Directive (HSPD)-12, dated August 12, 2004.

This service enables SSA to leverage an internal Microsoft’s Active Directory to create a single SSA-Wide

directory of all users. Currently, SSA users are required to authenticate using their SSA HSPD-12 PIV Smart

Card at the workstation. In certain acceptable instances, users can revert to user name and password, while

the Department is transitioning to HSPD-12 PIV Smart Card Authentication. The External Service Providers

must support both authentications methods.

 IA-6 - ESPs must mask all fields on a system that has a logon screen that requires credentials, to prevent

unauthorized exposure.

 IA-7 - The ESP must encrypt credentials used for e-authentication. The encryption solution must be

compliant with FIPS 140-2. (Moderate and High categorized systems only).

Incident Response Requirements

The purpose of the following is to address requirements for incident response for External Service Providers.

SSA Additional Requirements for ESPs:

 IR-6 - ESPs will receive the incident response capability timeframe and reporting requirements from the SSA

COTR.  IR-6 - ESPs Incident Response plan must require all security incidents of US CERT categories 1,2,3,4 and 6

must be reported to SSA COTR.  IR-7 - ESPs are responsible for notifying the appropriate SSA COTR when there is a security incident that has

been categorized 1,2,3,4 or 6 per US CERT regulations. The COTR is authorized to issue orders to take down

external systems or components to perform IR, forensics, further loss of data, etc.

Maintenance Requirements

The purpose of the following is to address requirements for maintenance for External Service Providers.
Resource Page: SSA External Service Provider Security Guidance Page 6

SSA Additional Requirements for ESPs:

 MA-2 - ESP must retain records of maintenance activities performed on IT devices used to provide services

to SSA. Maintenance activity logs must be made available upon request.

 MA-2 - IT equipment and media used to provide services to SSA must be sanitized prior to removal from

the ESP’s facility for maintenance or disposal purposes. The ESP must maintain a log as evidence that the

IT equipment or media was sanitized prior to removal. Logs must be made available upon request. Refer

to NIST SP 800-88 for more information on media sanitization.

Media Protection Requirements

The purpose of the following is to address requirements for media protection for External Service Providers.

SSA Additional Requirements for ESPs:

 MP-2 - Removable media used to store SSA data must be encrypted using a FIPS 140-2 compliant encryption

solution.

 MP-3 - ESP must label or mark (human readable) all media containing PII or other sensitive SSA data as “SSA

Confidential Unclassified Information”. (Moderate and High categorized systems only).

 MP-4 - ESP must have a documented process describing how IT equipment and media are controlled to

ensure the security and confidentiality of SSA data.

 MP-5 - ESP must maintain chain of custody for IT equipment and media during transport outside of

controlled-access facilities. Authorized personnel must perform transport of media outside of controlled

areas.

Planning Requirements

The purpose of the following is to address requirements for the planning for External Service Providers (ESPs).

SSA Additional Requirements for ESPs:

 PL-2 - ESP must develop a System Security Plan (SSP) compliant with NIST SP 800-18. The SSP shall be

submitted to the SSA COTR.  PL-2 - ESP must conduct an annual security review of the solution used to provide services to SSA. The

System Security Plan (SSP) must be updated to reflect changes affecting the security of SSA data.

 PL-4 - The SSA COTR will provide the SSA Rules of Behavior (within the SSA Information System Security

Handbook) for ESP systems that support internal users providing services to SSA. The rules of behavior

ensure users are familiar with information security, privacy, and confidentiality practices.

Personnel Security Requirements

The purpose of the following is to address requirements for personnel security for External Service Providers.

SSA Additional Requirements for ESPs:
Resource Page: SSA External Service Provider Security Guidance Page 7

 PS-4 - ESP must terminate employee and sub-contractor access to the solution used to provide services to

SSA immediately upon reassignment or separation.

 PS-6 - ESP personnel who are granted access to IT equipment, media or data used to provide services to

SSA must agree and sign a non-disclosure agreement prohibiting unauthorized disclosure of SSA data

encountered in the performance of their duties.

 PS-7 - ESP sub-contractors are bound to the same security requirements as employees.

 PS-8 - ESP must inform the SSA project officer of any violation of security requirements within 24 hours.

Risk Assessment Requirements

The purpose of the following is to address requirements for risk assessment for External Service Providers (ESPs).

SSA Additional Requirements for ESPs:

 RA-3 - ESPs shall conduct a risk assessment to assess the risk and magnitude of harm that could result from

the unauthorized access, use, disclosure, disruption, modification, or destruction of sensitive SSA

information. The risk assessment should be reviewed annually and updated every three years or when a

significant change occurs.

 RA-5 - ESP must scan IT equipment used to provide services to SSA for security vulnerabilities at least

monthly. The contractor must use a commercially available scanning tool. The scanning must include

vulnerabilities identified in DHS national vulnerability database. Vulnerability scan reports must be retained

for 12 months and submitted to the SSA COTR upon request.

System and Communication Requirements

The purpose of the following is to address requirements for system and communications for External Service

Providers (ESPs).

SSA Additional Requirements for ESPs:

 SC-4 - ESP must logically or physically segregate SSA data from that of other customer if a multi-tenant

environment is used to provide services to SSA. (Moderate and High categorized systems only).

 SC-7(1) - ESPs shall physically allocate publicly accessible information system components to separate

subnetworks with separate physical network interfaces.

 SC-7(4) - ESPs must provide traffic flow policy for each managed interface to SSA COTR for review and

approval prior to implementation.

 SC-8 - ESP must encrypt PII and other sensitive SSA data when stored on persistent storage devices, or when

transmitted over approved system interconnections, using a FIPS 140-2 compliant encryption solution

(Moderate and High categorized systems only).

 SC-10 - ESPs must terminate user sessions automatically after 15 minutes of inactivity. (Moderate and High

categorized systems only).

 SC-15 - ESPs use of collaborative computing devices (e.g., networked whiteboards, cameras, and

microphones) on systems hosting /processing/ shall have their remote activation capability

removed/disabled.
Resource Page: SSA External Service Provider Security Guidance Page 8

 SC-17 - For all ESPs, who manage information systems, the information system shall utilize automated

mechanisms with supporting procedures in place for digital certificate generation, installation, and

distribution. Subscriber key pairs are generated and stored using FIPS 140-2 Security Level 2 or higher

cryptographic modules. The same public/private key pair is not to be used for both encryption and digital

signature. Private keys are protected using, at a minimum, a strong password. A certificate is revoked if the

associated private key is compromised; management requests revocation; or the certificate is no longer

needed. (Moderate and High categorized systems only).

 SC-18 - Mobile code is software that is executed from a host machine to run scripts on a client machine,

including animation scripts, movies, etc. Mobile code is a powerful computing tool that can introduce risks

to the user’s information system. Whenever an ESP is developing or deploying the mobile code technology,

this shall be identified in the ESP’s security plan to SSA. Contractors, who use mobile code, shall be subject

to a source code review by SSA personnel to ensure that there is no potential risk in introducing malicious

code into the contractor/user’s environment. (Moderate and High categorized systems only).

System and Information Integrity Requirements

The purpose of the following is to address requirements for system and information integrity for External Service

Providers.

SSA Additional Requirements for ESPs:

 S1-2 - ESPs will remediate discovered flaws in the information system according to a process that is

approved by the COTR.  SI-3 - ESP must submit alerts on malicious code detection and actions performed on malicious code to the

SSA COTR for review.

 SI-4 - The ESP shall employ tools and techniques to monitor events on the information system to detect

attacks, vulnerabilities, and detect, deter, and report on unauthorized use of the information system.

Whenever there is an elevated security level, the monitoring efforts shall be increased as necessary to

enable deterrence, detection, and reporting to take place so that corrective actions shall be made to the

networked environment.

 SI-5 - ESPs must receive advisories (from US CERT) on a regular basis and take appropriate actions as

necessary.

 SI-11 - The information system shall identify security relevant error conditions and handle error conditions

in an expeditious manner. (Moderate and High categorized systems only).
EXHIBIT C
UNCLASSIFIED // FOR OFFICIAL USE ONLY 

UNCLASSIFIED // FOR OFFICIAL USE ONLY 

TEMPLATE VERSION (V1.3 FY17) - REMOVE BEFORE PUBLISHING

Security Assessment Report 

Social Security Administration 

(SSA) 

<System Name> (<Acronym>)

Security Categorization: <Enter Categorization>

<DRAFT/FINAL> Version <x.x>

<Month DD, YYYY>

Prepared by 

8229 Boone Blvd., Suite 750 

Vienna, VA 22182 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY ii 

<INSTRUCTIONS: Orange, bracketed text indicates instructions on how a section should be completed or 

sample text, which should be replaced with project specific information or removed. Ensure sample text is 

turned from orange to black where necessary (e.g., headings shall be changed to the standard heading 

color), and all instructions are removed (including this paragraph). Remove the template ID (e.g., TMP V1.3 

FY17) from the footer before publishing. All black text shall remain unchanged.> 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY iii 

Assessment Summary 

This document describes the Federal Information Security Modernization Act (FISMA) Security Assessment

Report (SAR) for Social Security Administration (SSA). The primary purpose of this document is to deliver

the independent security assessment findings for <System Name> (hereafter known as <System 

Acronym>). These findings will lead to the initiation of corrective actions or for making risk-based 

decisions. This independent security assessment supports the U.S. Government’s mandate that all 

U.S. Federal information systems comply with FISMA of 2014. 

The assessment took place between <MM DD, YYYY> and <MM DD, YYYY>. The independent 

security assessment followed the approved the Security Assessment Plan (SAP). All deviations from the 

approved SAP are located in Table 7. 

The table below represents the aggregate risk identified from the independent security assessment. 

Table 1: Executive Summary of Risks 

 NOTE: Total is the sum of high, moderate, and low risks with operationally required 

risks being represented as a subset of this total. 

Risk Category Total % of Total Risks 

High <# high risks> <% of total risks> 

Moderate <# moderate risks> <% of total risks> 

Low <# low risks> <% of total risks> 

Total Risks <Sum of all H, M, L 

risks> 

100% 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY iv 

Document Revision History 

Version Date Description Author 

1.0 <10/02/2015> Initial release Coalfire 

<1.1> <10/26/2015> <Final template updates FY17> Coalfire 

<1.2> <10/24/2017> <Template updates for FY17> Coalfire 

 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY v 

Table of Contents 

1 INTRODUCTION ....................................................................................................................... 1

1.1 Applicable Laws and Regulations ............................................................................................... 1

1.2 Applicable Standards and Guidance ........................................................................................... 1

1.3 Purpose ....................................................................................................................................... 2

2 SCOPE ................................................................................................................................... 3

2.1 Applicable Security Controls ....................................................................................................... 3

2.2 System Name/Title ...................................................................................................................... 3

2.3 Assessment Documentation ....................................................................................................... 4

2.4 Location of Components Tested ................................................................................................. 4

2.5 Subsystems, Users and Interfaces ............................................................................................. 4

2.6 Assessment Inventory ................................................................................................................. 5

3 SYSTEM OVERVIEW ................................................................................................................ 6

3.1 Security Categorization ............................................................................................................... 6

3.2 System Description and Purpose ................................................................................................ 6

4 ASSESSMENT METHODOLOGY ................................................................................................. 7

4.1 Perform Tests .............................................................................................................................. 7

4.1.1 Assessment Deviations ............................................................................................................. 7

4.2 Identification of Vulnerabilities ..................................................................................................... 7

4.3 Consideration of Threats ............................................................................................................. 8

4.4 Perform Risk Analysis ............................................................................................................... 14

5 SECURITY ASSESSMENT RESULTS ........................................................................................ 16

5.1 Security Assessment Summary ................................................................................................ 17

6 NON-CONFORMING CONTROLS .............................................................................................. 18

6.1 Risks Corrected During Testing ................................................................................................ 18

6.2 Risks with Mitigating Factors ..................................................................................................... 18

6.3 Risks Remaining Due to Operational Requirements ................................................................ 18

7 RISKS KNOWN FOR INTERCONNECTED SYSTEMS ................................................................... 20

8 RECOMMENDATIONS ............................................................................................................. 20

APPENDIX A. ACRONYMS AND TERMS ...................................................................................... 21

APPENDIX B. SECURITY RISK TRACEABILITY MATRIX (SRTM) .................................................. 24

APPENDIX C. INFRASTRUCTURE SCAN RESULTS ....................................................................... 25

Infrastructure Scans: Inventory of Items Scanned .............................................................................. 25

Infrastructure Scans: Raw Scan Results ............................................................................................ 25

Infrastructure Scans: False Positive Reports ...................................................................................... 25

APPENDIX D. DATABASE SCAN RESULTS ................................................................................. 26

Database Scans: Inventory of Databases Scanned ........................................................................... 26

Database Scans: False Positive Reports ........................................................................................... 26

APPENDIX E. WEB APPLICATION SCAN RESULTS...................................................................... 27

Web Application Scans: Inventory of Web Applications Scanned ...................................................... 27

Web Application Scans: False Positive Reports ................................................................................. 27

APPENDIX F. ASSESSMENT RESULTS ....................................................................................... 28
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY vi 

APPENDIX G. PENETRATION TEST REPORT ............................................................................... 29

APPENDIX H. SECURITY ASSESSMENT REPORT SIGNATURE ...................................................... 30

 

List of Tables 

Table 1: Executive Summary of Risks .......................................................................................................... iii

Table 2: Identified Security Controls Assessed ............................................................................................ 3

Table 3: Information System Name and Title ................................................................................................ 3

Table 4: Location of Components ................................................................................................................. 4

Table 5: Users and Interfaces ....................................................................................................................... 5

Table 6: Hardware and Software Inventory .................................................................................................. 5

Table 7: List of Assessment Deviations ........................................................................................................ 7

Table 8: Threat Categories and Type Identifiers........................................................................................... 8

Table 9: Potential Threats ............................................................................................................................. 9

Table 10: Likelihood Definitions from NIST 800-30 Rev. 1 Publication ....................................................... 14

Table 11: Impact Definitions from NIST 800-30 Rev. 1 Publication ............................................................. 14

Table 12: Risk Exposure Ratings from NIST 800-30 Rev. 1 Publication .................................................... 15

Table 13: Risk Exposure ............................................................................................................................. 18

Table 14: Summary of Risks Corrected During Testing ............................................................................. 18

Table 15: Summary of Risks with Mitigating Factors .................................................................................. 18

Table 16: Summary of Risks Remaining Due to Operational Factors ........................................................ 19

Table 17: Risks from Interconnected Systems ........................................................................................... 20

Table 18: Acronyms and Terms .................................................................................................................. 21

Table 19: Security Test Procedure Workbook ............................................................................................ 24

Table 20: Inventory of Items Scanned ........................................................................................................ 25

Table 21: Raw Scan Results ....................................................................................................................... 25

Table 22: Infrastructure Scans: False Positive Reports .............................................................................. 25

Table 23: Inventory of Databases Scanned ................................................................................................ 26

Table 24: Database Scans: False Positive Reports ................................................................................... 26

Table 25: Inventory of Web Applications Scanned ..................................................................................... 27

Table 26: Web Application Scans: False Positive Reports ......................................................................... 27

Table 27: Summary of System Security Risks from FISMA Testing ........................................................... 28

Table 28: SAR Signatures ........................................................................................................................... 30
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 1 

1 Introduction 

This SAR document for <System Acronym> is required by the National Institute of Standards and 

Technology (NIST) 800-53 Revision 4 (Rev 4) document. This SAR contains unbiased and factual 

security findings by an independent security assessment team. This SAR contains the <System Acronym>

system specific security controls tested as per the Security Assessment Plan (SAP) approved by SSA Office 

of Information Security (OIS), the <System Acronym> Security Authorization Manager (SAM), and the 

Coalfire (formally Veris Group) Project Manager (PM). The implementation status of these controls identify 

the residual risk (risk remaining after controls have been implemented). These controls are required per 

NIST 800-53 Rev. 4 to address known information system vulnerabilities. The results are in support of SSA 

Security Authorization program goals, efforts, and activities necessary to achieve compliance with FISMA 

security requirements. 

1.1 Applicable Laws and Regulations 

• Computer Fraud and Abuse Act [Public Law (PL) 99-474, 18 U.S. Code (USC) 1030] 

• E-Authentication Guidance for Federal Agencies [Office of Management and Budget (OMB) M-04-

04] 

• FISMA of 2014 [PL 113-283] 

• Freedom of Information Act (FOIA) As Amended in 2002 [PL 104-232, 5 USC 552] 

• Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy [OMB M-01-05] 

• Homeland Security Presidential Directive(HSPD)-7, Critical Infrastructure Identification, 

Prioritization and Protection [HSPD-7] 

• Internal Control Systems [OMB Circular A-123] 

• Management of Federal Information Resources [OMB Circular A-130] 

• Management’s Responsibility for Internal Control [OMB Circular A-123, Revised 12/21/2004] 

• Privacy Act of 1974 as amended [5 USC 552a] 

• Protection of Sensitive Agency Information [OMB M-06-16] 

• Records Management by Federal Agencies [44 USC 31] 

• Responsibilities for the Maintenance of Records About Individuals by Federal Agencies [OMB 

Circular A-108, as amended] 

• Security of Federal Automated Information Systems [OMB Circular A-130, Appendix III] 

1.2 Applicable Standards and Guidance 

• A NIST Definition of Cloud Computing [NIST SP 800-145] 

• Computer Security Incident Handling Guide [NIST SP 800-61, Revision 2] 

• Contingency Planning Guide for Federal Information Systems [NIST SP 800-34, Revision 1] 

• Engineering Principles for Information Technology Security (A Baseline for Achieving Security) 

[NIST SP 800-27, Revision A] 

• Assessing Security and Privacy Controls in Federal Information Systems and Organizations [NIST 

SP 800-53A, Revision 4] 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 2 

• Security and Privacy Controls for Federal Information Systems and Organizations [NIST SP 800-

53, Revision 4] 

• Guide for Developing Security Plans for Federal Information Systems [NIST SP 800-18, Revision 

1] 

• Guide for Applying the Risk Management Framework to Federal Information Systems: A Security 

Life Cycle Approach [NIST SP 800-37, Revision 1] 

• Guide for Mapping Types of Information and Information Systems to Security Categories [NIST SP 

800-60, Revision 1] 

• Guide for Security-Focused Configuration Management of Information Systems [NIST SP 800-128] 

• Information Security Continuous Monitoring for Federal Information Systems and Organizations 

[NIST SP 800-137] 

• Managing Information Security Risk: Organization, Mission, and Information System View [NIST 

SP 800-39] 

• Minimum Security Requirements for Federal Information and Information Systems [FIPS 

Publication 200] 

• Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS Publication 201-

2] 

• Recommended Security Controls for Federal Information Systems [NIST SP 800-53, Revision 4] 

• Guide for Conducting Risk Assessments [NIST SP 800-30, Revision 1] 

• Security Considerations in the System Development Life Cycle [NIST SP 800-64, Revision 2] 

• Security Requirements for Cryptographic Modules [Federal Information Processing Standard 

(FIPS) Publication 140-2] 

• Standards for Security Categorization of Federal Information and Information Systems [FIPS 

Publication 199] 

• Technical Guide to Information Security Testing and Assessment [NIST SP 800-115] 

1.3 Purpose 

The purpose of this document is to provide the System Owner (SO) and the SSA Authorization Official (AO)

with a detailed level of the residual risk for <System Acronym>. An independent security assessment team 

conducted a test for each system specific security control implemented by SSA stakeholders. These 

tests include a combination of interviews, document examinations, and actual technical testing of controls 

when applicable. These controls each had implementation statements listed in the <System Acronym>

System Security Plan (SSP). These statements identified how the controls are in place and the 

assessment team tested the controls based on that criteria. Additionally, the testing ensures the controls 

are in are in compliance with the FISMA baseline security control requirements as defined in NIST 800-53 

Rev 4. FISMA mandates that all Federal Agencies will comply with the NIST 800-53 Rev. 4 standards. 

Assessors from the independent security assessment team are members of contracted Coalfire Federal 

Services (formally Veris Group). 

The system specific security controls for this assessment are in section 2.1 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 3 

2 Scope 

2.1 Applicable Security Controls 

The applicable security controls as listed in the <System Acronym> SAP are in Table 2 of this <System 

Acronym> SAR. The security control assessment authorized by OIS and the <System Acronym> SAM 

gives authority to the Coalfire Independent Security Assessment team to assess the listed controls. 

Table 2: Identified Security Controls Assessed 

Security Control Family Security Control 

Access Control AC-2, AC-2(2), AC-2(3), AC-2(4) 

Awareness and Training 

Audit and Accountability AU-7(1) 

Security Assessment and Authorization CA-5, CA-6 

Configuration Management CM-9 

Contingency Planning 

Identification and Authentication IA-2, IA-(3), IA-5, IA-5(1) 

Planning PL-2, PL-2(3), PL-8 

Personnel Security PS-4, PS-5 

Risk Assessment RA-2, RA-3 

System and Services Acquisition SA-3, SA-4(9), SA-5, SA-8, SA-9, SA-9(2), SA-11 

System and Communications Protection SC-4, SC-39 

System and Information Integrity SI-10, SI-11, SI-16 

2.2 System Name/Title 

The <System Acronym> system unique identifier and system acronyms are in Table 3. Due to the 

number of applications located within <System Acronym>, <only two of the subsystems> fall within the 

scope of this assessment. The authority to use a representative sample is located within NIST 800-53 

Rev 4 Guide for Assessing the Security Controls in Federal Information Systems and Organizations. 

Table 3: Information System Name and Title 

Information System Name: <System Name> 

Information System Acronym: <System Acronym> 

Information System Identifier <System Identifier> 

Security Categorization: (High, Moderate, Low) <Categorization> 

PII data: (Yes/No) <Yes/No> 

e-Authentication Application: (Yes/No) <Yes/No> 

Production Data Used In Development/Test 

Environment (Yes/No) 

<Yes/No> 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 4 

Federal Tax Information (Yes/No) <Yes/No> 

2.3 Assessment Documentation 

Documentation used by the independent assessment team to perform the assessment of the <System 

Acronym> subsystems include the following: 

• <System Acronym> System Security Plan (SSP) 

• <System Acronym> Security Assessment Plan (SAP) 

• Security Operation Division (SOC) Nessus scanner with McAfee, McAfee ePolicy 

Orchestrator (EPO) instance scan statistic reports 

• SSA Information Security Policy (ISP) 

• The <System Acronym> Boundary Scope Memo (BSM) 

• The <System Acronym> Information System Contingency Plan (ISCP) 

• The <System Acronym> Federal Information Processing Standards Publication (FIPS) 199 

2.4 Location of Components Tested 

The physical locations of all the different functional components supporting the testing of the <System 

Acronym> information system is in Table 4. 

Table 4: Location of Components 

System Physical Location and Addresses 

Production Environment Site 

Name 

Address Description of Components 

<EXAMPLE: National Computer 

Center (NCC)>

6401 Security Blvd 

Baltimore, MD 21235 

Production Environment (i.e., 

hardware ) 

(Primary Support) 

Development/Test 

Environment Site Name 

Address Description of Components 

<EXAMPLE: National Support 

Center (NSC)>

3500 Campus Drive, Suite 106 

Urbana, MD 21704 

Development and Testing

Environment (Integration 

Testing) 

Disaster Recovery 

Environment Site Name 

Address Description of Components 

<EXAMPLE: Secondary Support 

Center (SSC)>

3004 Tower Blvd 

Durham, NC 27707 

Production Environment (i.e., 

hardware) 

(Secondary/Failover Support) 

Contractor Owned 

Environment Site Name 

Address Description of Components 

 

2.5 Subsystems, Users and Interfaces 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 5 

The <System Acronym> system contains the following subsystems, users and interfaces that were tested 

as part of this assessment. They are contained within the embedded Error! Reference source not found.. 

<Complete the embedded spreadsheet with system specific information.>

Table 5: Users and Interfaces 

T2 Internet - Users 

and Interfaces.doc

<Embed the applicable system’s Users and Interface, EXAMPLE attached.>

2.6 Assessment Inventory 

The <System Acronym> hardware and software inventories provided by the SO’s are in Table 6. 

<Complete the embedded spreadsheet with system specific information.> 

Table 6: Hardware and Software Inventory 

T2 Internet - 

HW-SW Inventory.xl

<Embed the applicable system’s Hardware and Software Inventory, EXAMPLE attached.> 

 NOTE: Any changes to the scope of the Authorization Boundary after the Boundary 

Scope Meeting and finalization of the Boundary Scope Memo (BSM) may impact the 

overall Independent Verification and Validation (IV&V) schedule. 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 6 

3 System Overview 

3.1 Security Categorization 

The FIPS 199 Security Categorization of a Federal Information and Information System publication

determines the risk impact level of data vulnerability exploitation. The identified impact level sets the

security control baseline that needs to be tested. The categorization for <System Acronym> determined 

by the FIPS 199 publication is a Moderate baseline. The NIST 800-53 Rev 4. <Moderate> baseline of 

controls are assessed during the security assessment. 

3.2 System Description and Purpose 

<In the sections below, insert a general description of the information system. Use a description that is 

consistent with the description found in the SSP. The description must only differ from the description in 

the SSP if additional information is going to be included that is not available in the SSP or if the description 

in the SSP is not accurate.> 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 7 

4 Assessment Methodology 

A summary of the assessment methodologies used to conduct the security assessment for the <System 

Acronym> subsystems are in the following steps: 

 Perform tests on the listed controls in the <System Acronym> SAP and record the results 

 Identify vulnerabilities related to <System Acronym>

 Identify known threats and determine which threats are associated with the cited vulnerabilities 

 Analyze risks based on vulnerabilities and associated threats after mitigating controls 

are implemented 

 Recommend corrective actions for controls that are not satisfied (other than satisfied) 

 Document all security assessment results, which include identified unmitigated risks, 

mitigated risks, and recommend corrective actions. 

4.1 Perform Tests 

Coalfire Federal Services performed security tests on the <System Acronym> subsystems, which 

concluded on <MM DD, YYYY>. The results of the tests are documented within the Security Risk

Traceability Matrix (SRTM) in Appendix B. The SRTM serves as input to this SAR. 

4.1.1 Assessment Deviations 

Table 7 contains any deviations from the SAP if applicable. Coalfire Federal Services did not deviate from

the testing plan. 

Table 7: List of Assessment Deviations 

Deviation ID Deviation Description Justification 

 

4.2 Identification of Vulnerabilities 

Coalfire Federal Services conducts an assessment to identify vulnerabilities for <System 

Acronym> subsystems. These vulnerabilities should have controls in place to mitigate the risk of 

exploitation. 

A vulnerability is an inherent weakness in an information system that can be exploited by a threat or 

threat agent, resulting in an undesirable impact on the protection of the confidentiality, integrity, or 

availability of the system (application and associated data). A vulnerability may be due to a design 

flaw or error in a configuration that makes the network or a host on the network, susceptible to malicious 

attacks from local or remote users. Vulnerabilities can exist in multiple areas of the system or facilities, 

such as in firewalls, application servers, Web servers, operating systems, or fire suppression systems. 

Whether or not a vulnerability has the potential to be exploited by a threat depends on a number of 

variables including (but not limited to): 

• The strength of the security controls in place 

• The ease at which a human actor could purposefully launch an attack 

• The probability of an environmental event or disruption in a given local area 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 8 

An environmental disruption is usually unique to a geographic location. Depending on the level of the risk

exposure, the successful exploitation of a vulnerability can vary from disclosure of information about the

host to a complete compromise of the host. Risk exposure to organizational operations can affect the

business mission, functions, and/or reputation of the organization. 

4.3 Consideration of Threats 

A threat is an adversarial force or phenomenon that could affect the availability, integrity, or confidentiality

of an information system, its networks, and the facility that houses the hardware and software. A threat

agent is an element that provides the delivery mechanism for a threat. An entity that initiates the launch of

a threat agent is referred to as a threat actor. 

A threat actor might purposefully launch a threat agent (e.g., a terrorist igniting a bomb). A threat actor

could also be a trusted employee that acts as an agent by making an unintentional human error (e.g., a

trusted employee clicks on a phishing email that downloads malware). Threat agents may also be

environmental in nature with no purposeful intent (e.g., a hurricane). Threat agents working alone, or in

concert, exploit vulnerabilities to create incidents. FISMA categorizes threats using a threat origination

taxonomy of purposeful (P), unintentional (U), or environmental (E) type threats as described in Table 8. 

Table 8: Threat Categories and Type Identifiers 

Threat Origination Category Type Identifier 

Threats launched purposefully P 

Threats created by unintentional human or machine error U 

Threats caused by environmental agents or disruptions E 

Threat actors for a variety of reasons launch purposeful threats and the reasons may never be fully known.

Curiosity, monetary gain, political gain, social activism, revenge or many other driving forces could motivate

threat actors. It is possible that some threats could have more than one threat origination category. 

Some threat types are more likely to occur than others are. FISMA considers threat types to help 

determine the likelihood that a vulnerability could be exploited. The threat table shown in 

Table 9 describes typical threats to information systems; these threats have been considered for <System 

Acronym>.
So

Secu

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 9 

Table 9: Potential Threats 

ID Threat Name Type Identifier Description Typical Impact to 

Confidentiality Inte

T-1. Alteration U, P, E Alteration of data, files, or records. ModiT-2. Audit 

Compromise P 

An unauthorized user gains access to the audit trail and could cause audit records to be deleted or modified, or prevents future audit records from being recorded, thus masking a security relevant event. 

Modior destr

T-3. Bomb P An intentional explosion. 

Modior destr

T-4. Communications 

Failure U, E Cut fiber optic lines, trees falling on telephone lines. 

T-5. Compromising 

Emanations P 

Eavesdropping can occur via electronic media directed against large scale electronic facilities that do not process classified National Security Information. 

Disclosure 

T-6. Cyber Brute 

Force P 

Unauthorized user could gain access to the information systems by random or systematic guessing of passwords, possibly supported by password cracking utilities. 

Disclosure 

Modior destr

T-7. Data Disclosure 

Attack P 

An attacker uses techniques that could result in the disclosure of sensitive information by exploiting weaknesses in system design or configuration. 

Disclosure 

T-8. Data Entry Error U 

Human inattention, lack of knowledge, and failure to cross-check system activities could contribute to errors becoming integrated and ingrained in automated systems. 

Modi

T-9. Denial of Service 

Attack P 

An adversary uses techniques to attack a single target rendering it unable to respond; could cause denial of service for users of the targeted information systems. 
So

Secu

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 10 

ID Threat Name Type Identifier Description Typical Impact to 

Confidentiality Inte

T-10. Distributed Denial 

of Service Attack P 

An adversary uses multiple compromised information systems to attack a single target; could cause denial of service for users of the targeted information systems. 

T-11. Earthquake E 

Seismic activity can damage the information system or its facility. Refer to the following document for earthquake probability maps http://pubs.usgs.gov/of/2008/1128/pdf/OF08-

1128_v1.1.pdf . 

Dest

T-12. Electromagnetic 

Interference E, P 

Disruption of electronic and wire transmissions could be caused by high frequency (HF), very high frequency (VHF), and ultra-high frequency (UHF) communications devices (jamming) or sun spots. 

T-13. Espionage P The illegal, covert act of copying, reproducing, recording, photographing or intercepting sensitive 

information. 

Disclosure Modi

T-14. Fire E, P Fire can be caused by arson, electrical problems, lightning, chemical agents, or other unrelated proximity 

fires. 

Dest

T-15. Floods E Water damage caused by flood hazards can be caused by proximity to local flood plains. Flood maps and base 

flood elevation must be considered. 

Dest

T-16. Fraud P 

Intentional deception regarding data or information about an information system could compromise the confidentiality, integrity, or availability of an information 

system. 

Disclosure 

Modior destr

T-17. 

Hardware or Equipment Failure 

E Hardware or equipment may fail due to a variety of 

reasons. 

T-18. Hardware 

Tampering P An unauthorized modification to hardware that alters the proper functioning of equipment in a manner that Modi
So

Secu

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 11 

ID Threat Name Type Identifier Description Typical Impact to 

Confidentiality Inte

degrades the security functionality provided by the asset. 

T-19. Hurricane E A category 1, 2, 3, 4, or 5 land falling hurricane could impact the facilities that house the information systems. DestT-20. Malicious 

Software P Software that damages a system such a virus, Trojan, or worm. Modi

or destr

T-21. Phishing Attack P 

Adversary attempts to acquire sensitive information such as usernames, passwords, or SSNs, by pretending to be communications from a legitimate/trustworthy source. Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to Web sites that appear to be legitimate sites, while actually stealing the entered information. 

Disclosure 

Modior destr

T-22. Power 

Interruptions E 

Power interruptions may be due to any number of reasons such as electrical grid failures, generator failures, uninterruptable power supply (UPS) failures (e.g. spike, surge, brownout, or blackout). 

T-23. Procedural Error U An error in procedures could result in unintended 

consequences. 

Disclosure 

Modior destr

T-24. Procedural 

Violations P Violations of standard procedures. Disclosure 

Modior destr

T-25. Resource 

Exhaustion U 

An errant (buggy) process may create a situation that 

exhausts critical resources preventing access to services. 
So

Secu

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 12 

ID Threat Name Type Identifier Description Typical Impact to 

Confidentiality Inte

T-26. Sabotage P Underhanded interference with work. 

Modior destr

T-27. Scavenging P Searching through disposal containers (e.g., dumpsters) to acquire unauthorized data. Disclosure T-28. Severe Weather E 

Naturally occurring forces of nature could disrupt the operation of an information system by freezing, sleet, hail, heat, lightning, thunderstorms, tornados, or snowfall. 

Dest

T-29. Social 

Engineering P 

An attacker manipulates people into performing actions, divulging confidential information, or providing access to computer systems or facilities. 

Disclosure 

T-30. Software 

Tampering P 

Unauthorized modification of software (e.g., files, programs, database records) that alters the proper operational functions. 

Modior destr

T-31. Terrorist P An individual performing a deliberate violent act could use a variety of agents to damage the information 

system, its facility, and/or its operations. 

Modior destr

T-32. Theft P An adversary could steal elements of the hardware. T-33. Time and State P 

An attacker exploits weaknesses in timing or state of functions to perform actions that would otherwise be prevented (e.g., race conditions, manipulation of user state). 

Disclosure Modi

T-34. Transportation 

Accidents E 

Transportation accidents include train derailments, river barge accidents, trucking accidents, and airline 

accidents. Local transportation accidents typically occur when airports, sea ports, railroad tracks, and major trucking routes occur in close proximity to systems facilities. Likelihood of HAZMAT cargo must 

Dest
So

Secu

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 13 

ID Threat Name Type Identifier Description Typical Impact to 

Confidentiality Inte

be determined when considering the probability of local transportation accidents. 

T-35. Unauthorized 

Facility Access P 

An unauthorized individual accesses a facility which may result in comprises of confidentiality, integrity, or availability. 

Disclosure 

Modior destr

T-36. Unauthorized 

Systems Access P An unauthorized user accesses a system or data. Disclosure 

Modior destr

T-37. Volcanic Activity E 

A crack, perforation, or vent in the earth’s crust followed by molten lava, steam, gases, and ash forcefully ejected into the atmosphere. For a list of volcanoes in the U.S. see: http://volcanoes.usgs.gov/about/volcanoes/volcanolist.

php . 

Dest
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 14 

4.4 Perform Risk Analysis 

NIST identifies risk assessment as the first process in the risk management methodology. Organizations

use the risk assessment to determine the extent of the potential threat and the risk associated with an

information system. NIST defines Risk as “a function of the likelihood of a given threat-source’s exercising

a particular vulnerability and the resulting impact of the adverse event on the organization”. The outcome

of performing risk analysis yields risk exposure metrics that can be used to make risk-based decisions. 

The FISMA risk analysis process is a qualitative risk analysis. In qualitative risk analysis, the risk level of

exploiting a threat may be subjective and the justification for each risk is explained in terms of probability.

The following tables have probabilities associated with the likelihood and the impact level of the risk. For

example, when a system is easy to exploit, it has a “Very High” likelihood that a threat could exploit the

vulnerability. Likelihood definitions and probabilities are in Table 10. 

Note: The likelihood levels should not be confused or used interchangeably with the security categorization

of the system even though they use the some of the same terminology. The security categorization is

determined by the sensitivity of the data residing on the information system and is in the FIPS 199

publication. 

Table 10: Likelihood Definitions from NIST 800-30 Rev. 1 Publication 

Likelihood 

Probability Level 

Description 

Very Low If the threat event is initiated or occurs, it is almost certain to have adverse impacts. 

Low If the threat event is initiated or occurs, it is unlikely to have adverse impacts. 

Moderate If the threat event is initiated or occurs, it is somewhat likely to have adverse

impacts. 

High If the threat event is initiated or occurs, it is highly likely to have adverse impacts. 

Very High If the threat event is initiated or occurs, it is almost certain to have adverse impacts. 

Impact refers to the magnitude of potential harm to the information system (or its data) by successful

vulnerability exploitation. Definitions for the impact are in Table 11. Since exploitation has not yet occurred,

these values are perception values based on available information system information if the exploitation of

a vulnerability can cause significant loss to a system (or its data) then the impact is “Very High”. 

Table 11: Impact Definitions from NIST 800-30 Rev. 1 Publication 

Impact 

Probability 

Description 

Very Low The threat event could be expected to have a negligible adverse effect on

organizational operations, organizational assets, individuals other organizations, or 

the Nation. 

Low The threat event could be expected to have a limited adverse effect on

organizational operations, organizational assets, individuals other organizations, or 

the Nation. A limited adverse effect means that, for example, the threat event might: 

(i) cause a degradation in mission capability to an extent and duration that the 

organization is able to perform its primary functions, but the effectiveness of the 

functions is noticeably reduced; (ii) result in minor damage to organizational assets; 

(iii) result in minor financial loss; or (iv) result in minor harm to individuals 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 15 

Moderate The threat event could be expected to have a serious adverse effect on

organizational operations, organizational assets, individuals other organizations, or 

the Nation. A serious adverse effect means that, for example, the threat event might: 

(i) cause a significant degradation in mission capability to an extent and duration 

that the organization is able to perform its primary functions, but the effectiveness 

of the functions is significantly reduced; (ii) result in significant damage to 

organizational assets; (iii) result in significant financial loss; or (iv) result in 

significant harm to individuals that does not involve loss of life or serious lifethreatening injuries. 

High The threat event could be expected to have a severe or catastrophic adverse

effect on organizational operations, organizational assets, individuals, other

organizations, or the Nation. A severe or catastrophic adverse effect means that, for 

example, the threat event might: (i) cause a severe degradation in or loss of mission 

capability to an extent and duration that the organization is not able to perform 

one or more of its primary functions; (ii) result in major damage to organizational 

assets; (iii) result in major financial loss; or (iv) result in severe or catastrophic harm 

to individuals involving loss of life or serious life-threatening injuries. 

Very High The threat event could be expected to have multiple severe or catastrophic

adverse effects on organizational operations, organizational assets, individuals,

other organizations, or the Nation. 

The combination of the Likelihood Probability and the Impact Probability creates the risk exposure. The risk

exposure matrix shown in Table 12 presents the same likelihood and impact severity ratings as those found

in NIST SP 800-30 Rev. 1 Risk Management Guide for Information Technology Systems. 

Table 12: Risk Exposure Ratings from NIST 800-30 Rev. 1 Publication 

Likelihood Impact 

Very Low Low Moderate High Very High 

Very High Very Low Low Moderate High Very High 

High Very Low Low Moderate High Very High 

Moderate Very Low Low Moderate Moderate High 

Low Very Low Low Low Low Moderate 

Very Low Very Low Very Low Very Low Very Low Very Low 

Using Table 12 as a reference, Coalfire Federal Services reviewed all identified vulnerabilities and assigned

a risk exposure located in the <System Acronym> SRTM in Appendix B. 

Documenting the results of security control testing creates a record of the security posture for the system

at a given moment in time. The record can be used by the AO to make risk-based decision and to create

plans of action to mitigate unacceptable residual risks. 

FISMA requires that a Plan of Action and Milestones (POA&M) be developed. The POA&M is a mitigation

plan designed to address specific residual security risks and includes information on costing, resources,

and target dates for remediation efforts resolving the identified security weaknesses. The plan is utilized as

the primary mechanism for tracking all the residual risks and other issues. SSA will leverage the SAR to

create a POA&M for <System Acronym>. 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 16 

5 Security Assessment Results 

This section describes all security risks found during assessment. The following elements for each security

risk are reported. 

• Identifier 

• Name 

• Source of Discovery 

• Description 

• Affected internet protocol (IP) Address/Hostname/Database 

• Applicable Threats 

• Likelihood (before mitigating controls/factors) 

• Impact (before mitigating controls/factors) 

• Risk Exposure (before mitigating controls/factors) 

• Risk Statement 

• Mitigating Controls/Factors 

• Likelihood (after mitigating controls/factors) 

• Impact (after mitigating controls/factors) 

• Risk Exposure (after mitigating controls/factors) 

• Recommendation 

Below is a description of the SAR security risk elements. 

• Identifier: All weaknesses are assigned a vulnerability identifier (ID) in the form of V#-Security 

Control ID. For example, the first vulnerability listed would be reported as V1-AC-2(2) if the 

vulnerability is for control ID AC-2(2). If there are multiple vulnerabilities for the same security 

control ID, the first part of the vulnerability ID must be incremented, for example V1-AC-2(2), V2-

AC-2(2). 

• Name: A short, unique name for each vulnerability. 

• Source of Discovery: The source of discovery refers to the method that was used to discover the 

vulnerability (e.g., web application scanner, manual testing, security test procedure workbook, 

interview, document review). References must be made to scan reports, security test case 

procedure IDs, staff that were interviewed, manual test results, and document names. All scans 

reports are attached in Appendix C, Appendix D, Appendix E, and Appendix F. Results of manual 

tests can be found in Appendix G. If the source of discovery is from one of the security test 

procedure workbooks, a reference must point to the workbook name, the sheet number, and the 

cell number. Workbook tests results are found in Appendix B. If the source of discovery is from 

an interview, the date of the interview and the people who were present at the interview are named. 

If the source of discovery is from a document, the document must be named. 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 17 

• Description: All security weaknesses must be described in enough detail to be reproduced by the 

stakeholder, the Information System Security Officer (ISSO), or the AO. If a test was performed 

manually, the exact manual procedure and any relevant screenshots must be included. If a test 

was performed using a tool or scanner, a description of the reported scan results for that 

vulnerability must be included along with the vulnerability identifier (e.g., Common Vulnerabilities 

and Exposures (CVE), Common Vulnerability Scoring System (CVSS), Nessus Plugin ID) and 

screenshots of the particular vulnerability being described. If the tool or scanner reports a severity 

level, that level must be reported in this section. Any relevant login information and role information 

must be included for vulnerabilities discovered with scanners or automated tools. If any security 

weaknesses affect a database transaction, a discussion of atomicity violations must be included. 

• Affected IP Address/Hostname(s)/Database: For each reported vulnerability, all affected IP 

addresses/hostnames/databases must be included. If multiple hosts/databases have the same 

vulnerability, list all affected hosts/databases. 

• Applicable Threats: The applicable threats describe the unique threats that have the ability to 

exploit the security vulnerability. (Use threat numbers from Error! Reference source not found..) 

• Likelihood (before mitigating controls/factors): Very High, High, Moderate, Low, or Very Low 

(see Error! Reference source not found.). 

• Impact (before mitigating controls/factors): Very High, High, Moderate, Low, or Very Low (see 

Error! Reference source not found.). 

• Risk Exposure (before mitigating controls/factors): Very High, High, Moderate, Low, or Very 

Low (see Error! Reference source not found.). 

• Risk Statement: Provide a risk statement that describes the risk to the business. (See examples 

in Error! Reference source not found.). Also indicate whether the affected machine(s) is/are 

internally or externally facing. 

• Mitigating Controls/Factors: Describe any applicable mitigating controls/factors that could 

downgrade the likelihood or risk exposure. Also indicate whether the affected machine(s) is/are 

internally or externally facing. Include a full description of any mitigating factors and/or 

compensating controls if the risk is an operational requirement. 

• Likelihood (after mitigating controls/factors): Moderate or Low (see Error! Reference source 

not found.) after mitigating control/factors have been identified and considered. 

• Impact (after mitigating controls/factors): Moderate or Low (see Error! Reference source not 

found.) after mitigating control/factors have been identified and considered. 

• Risk Exposure (after mitigating controls/factors): Moderate or Low (see Error! Reference 

source not found.) after mitigating controls/factors have been identified and considered. 

• Recommendation: The recommendation describes how the vulnerability should be resolved. 

Indicate if there are multiple ways that the vulnerability could be resolved or recommendation for 

acceptance of operational requirement. 

5.1 Security Assessment Summary 

<Two (2) vulnerabilities, (0 high, zero moderate, 2 low)> have been discovered as part of the manual 

security assessment testing. Vulnerability scans provided did not provide enough information to provide 

analysis of scan vulnerability to assessment result. 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 18 

The vulnerabilities summary is contained in the following embedded file: 

Table 13: Risk Exposure 

T2 Risk Exposure 

Table.xlsx

<Embed applicable system’s Risk Exposure table, EXAMPLE attached.> 

6 Non-conforming Controls 

In some cases, the initial risk exposure to the system has been adjusted due to either corrections that 

occurred during testing or to other mitigating factors. Additional detail is provided in the following sections. 

6.1 Risks Corrected During Testing 

Any risks that were discovered during the testing of the <System Acronym> subsystems and subsequently 

mitigated prior to authorization are listed in Table 14. Coalfire Federal Services verified risks corrected 

during testing. The verification method used to determine correction is noted in the right-hand column of 

Table 14. 

Table 14: Summary of Risks Corrected During Testing 

Identifier Description Source of 

Discovery 

Initial Risk 

Exposure 

Remediation 

Description 

Date of 

Remediation 

Verification 

Statement/Testing 

Procedures 

 

6.2 Risks with Mitigating Factors 

Risks that have had their severity levels changed due to mitigating factors are summarized in Table 15.

The factors used to justify changing the initial risk exposure rating are noted in the right-hand column of the

table. See Table 13 for more information on these risks. 

Table 15: Summary of Risks with Mitigating Factors 

Identifier Description Source of 

Discovery 

Initial Risk 

Exposure 

Current Risk 

Exposure 

Description of 

Mitigating 

Factors 

 

6.3 Risks Remaining Due to Operational Requirements 

Risks that reside in the <system acronym> that cannot be corrected due to operational constraints are 

summarized in Error! Reference source not found.. An explanation of the operational constraints and 

risks are included in Error! Reference source not found. as well as in the appropriate security assessment 

test cases and SSP. Because these risks will not be corrected, they are not tracked in the POA&M. See 

Error! Reference source not found.for more information on these risks. 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 19 

Table 16: Summary of Risks Remaining Due to Operational Factors 

Identifier Description Source of Discovery Current Risk Exposure Operational 

Requirements 

Rationale 

 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 20 

7 Risks Known for Interconnected Systems 

Inherent relationships between the system and other interconnected systems may affect the overall system

security posture. A summary of the risks known for systems that connect to <System Acronym> is provided 

in Table 17. 

Table 17: Risks from Interconnected Systems 

System Authorization 

Date/Status 

Date of POA&M Control Family 

Identifier 

 

8 Recommendations 

<System Acronym> subsystem risks that were discovered during the assessment have an impact on 

the security posture of the SSA Federal Agency as a whole. These risks must be mitigated and Coalfire 

Federal Services has made recommendations in the Risk Exposure section, Table 14. These

recommendations should be addressed by the SAM, system owners, OIS, and other stakeholders that have

a responsibility for the controlling the overall risk of <System Acronym>. 

 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 21 

Appendix A. Acronyms and Terms 

Acronyms and terms used throughout this SAR are defined in Table 18. 

Table 18: Acronyms and Terms 

Acronym/Term SAR Acronym Definitions

AC Associate Commissioner 

AC Access Control 

AO Authorizing Official 

ARB Architecture Review Board 

ART Analysis and Reporting Tool 

AU Audit and Accountability 

BRI Benefit Rate Increase 

BSM Boundary Scope Memo 

CA Security Assessment and Authorization 

CCB Configuration Control Board 

CIC Customer Information Control System 

CM Configuration Management 

CMP Contingency Management Plan 

COTR Contract Officer’s Technical Representative 

CSAM Cyber Security Assessment & Management 

CSO Component Security Officer 

CVE Common Vulnerabilities and Exposures 

CVSS Common Vulnerability Scoring System 

DCS Deputy Commissioner for Systems 

DSPP Division of Security Policy & PII 

EPECS Electronic Personal Enrollment Credential System 

EPO ePolicy Orchestrator 

FIPS Federal Information Processing Standard 

FISMA Federal Information Security Modernization Act 

FOIA Freedom of Information Act 

HRMIS Human Resources Management Information System 

HRODS Human Resources Operational Data Store 

HSPD Homeland Security Presidential Directive 

IA Identification and Authentication 

ID Identification 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 22 

IP Internet Protocol 

ISCP Information System Contingency Plan 

ISO Information Security Officers

ISP Information Security Policy

ISSO Information System Security Officer 

LIS Low Income Subsidy 

NIST National Institute of Standards and Technology 

NSC National Support Center 

OIS Office of Information Security 

OMB Office of Management and Budget 

OSOHE Office of Systems Operations and Hardware Engineering

OTSO Office of Telecommunications and Systems Operations 

PAM Payment Application Modernization 

PCCB Project Configuration Control Board

PIN Personal Identification Number

PIV Personal Identification Verification 

PL Public Law 

PL (Control) Planning 

PM Program Manager 

POA&M Plan of Action and Milestones 

PRIDE Project Resource Guide 

PS (Control) Personnel Security 

P, U, E Purposeful, Unintentional, Environmental 

SA System and Services Acquisition 

SAM Security Authorization Manager 

SAP Security Assessment Plan 

SARA Security Administration Report Application (User Guide)

SAR Security Assessment Report

SC Systems and Communications Protection 

SDLC System Development Life Cycle 

SI System and Information Integrity 

SMACS Security Management Access Control Systems

SO System Owner

SOC Security Operation Division 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 23 

SP Special Publication 

SRC System Release Certificate

SRTM Security Requirements Traceability Matrix

SSA Social Security Administration 

SSC Secondary Support Center 

SSP System Security Plan 

SVR Security Violations Report

Threat An adversarial force or phenomenon that could affect the availability,

integrity, or confidentiality of an information system, its networks, and the

facility that houses the hardware and software.

Threat Actor An entity that initiates the launch of a threat agent is referred to as a threat

actor. 

Threat Agent An element that provides the delivery mechanism for a threat. 

UPS uninterruptable power supply 

USC United States Code 

Vulnerability An inherent weakness in an information system that can be exploited by a

threat or threat agent, resulting in an undesirable impact in the protection

of the confidentiality, integrity, or availability of the system (application and

associated data). 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 24 

Appendix B. Security Risk Traceability Matrix (SRTM) 

The Security Risk Traceability Matrix (SRTM) with test results and test procedures are within the following

embedded document in Table 19. 

Table 19: Security Test Procedure Workbook 

T2 SRTM 

Worksheet.xlsx

<Embed the applicable system’s Security Risk Traceability Matrix (SRTM), EXAMPLE attached.>
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 25 

Appendix C. Infrastructure Scan Results 

The Nessus scanner along with the McAfee ePolicy Orchestrator (EPO) deployed by the SOC was used to

scan SSA servers. Associated Windows Database servers that have the EPO agent deployed within the

<System Acronym > boundary were scanned. The other <System Acronym> servers did not have 

any vulnerability scanning tools available, which allowed for scanning of mainframe or storage hardware, 

and therefore were not scanned. 

Infrastructure Scans: Inventory of Items Scanned 

Table 20 provides an inventory of infrastructure items scanned during this assessment. 

Table 20: Inventory of Items Scanned 

T2 Scanned 

Inventory Items.xlsx

<Embed the applicable system’s Inventory of Items Scanned, EXAMPLE attached.>

Infrastructure Scans: Raw Scan Results 

Table 21 has the <System Acronym> raw scan results: 

Table 21: Raw Scan Results 

T2 Raw Scan 

Results.xlsx

<Embed the applicable system’s Raw Scan Results, EXAMPLE attached.>

Infrastructure Scans: False Positive Reports 

Table 22 provides a list of false positive reports collected during infrastructure scans if applicable. 

Table 22: Infrastructure Scans: False Positive Reports 

ID# IP Address Scanner Severity Level Finding False Positive 

Explanation 

 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 26 

Appendix D. Database Scan Results 

Database scan results are included in this appendix. 

Database Scans: Inventory of Databases Scanned 

Table 23 provides an inventory of any databases scanned during this assessment if applicable. 

Table 23: Inventory of Databases Scanned 

IP Address Hostname Software and Version Function Comment 

 

Database Scans: False Positive Reports 

Table 24 provides a list of false positive reports collected during database scans if applicable. 

Table 24: Database Scans: False Positive Reports 

ID# IP Address Scanner Severity Level Finding False Positive 

Explanation 

 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 27 

Appendix E. Web Application Scan Results 

Web application scan results are included in this appendix. 

Web Application Scans: Inventory of Web Applications 

Scanned 

Table 25 provides an inventory of all web applications scanned during this assessment if applicable. 

Table 25: Inventory of Web Applications Scanned 

Login URL IP Address of Login Host Function Comments 

 

Web Application Scans: False Positive Reports 

Table 26 provides a list of false positive reports collected during web application scans if applicable. 

Table 26: Web Application Scans: False Positive Reports 

ID# IP Address Scanner Severity Level Finding False Positive 

Explanation 

 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 28 

Appendix F. Assessment Results 

Assessment results are summarized in Table 27. 

Table 27: Summary of System Security Risks from FISMA Testing 

Risk Level Assessment Test Cases Total 

High <# high risks> <% of total risks> 

Moderate <# moderate risks> <% of total risks> 

Low <# low risks> <% of total risks> 

Operationally 

Required 

<# operationally required 

high risks> 

<% of total risks> 

Total <Sum of all H, M, L risks> 100%

 NOTE: Total is the sum of high, moderate, and low risks with operationally required 

risks being represented as a subset of this total. 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 29 

Appendix G. Penetration Test Report 

<Update the text below to reflect actual penetration test results for this assessment. Embed the penetration 

test report as appropriate.> 

Coalfire Federal Services is not authorized as per the Statement of Work (SOW) to perform a formal

Penetration Test for the <System Acronym> Batch and Internet Services subsystems. Therefore, no data 

from a penetration test is available for this assessment. 
Social Security Administration 

<System Name> 

Security Assessment Report (SAR) 

Version <X.X>

TMP V1.3 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 30 

Appendix H. Security Assessment Report Signature 

Table 28: SAR Signatures 

Acceptance and Signature 

I have read the above Security Assessment Report prepared by the third party assessment organization,

Coalfire Federal Services. I acknowledge the assessment was completed as per the <System 

Acronym> SAP and understand the findings detailed herein. 

Security Authorization Manager/ 

<SAM>: 

OIS Division of Compliance and 

Assessments Director: 

<DD> 
EXHIBIT D
UNCLASSIFIED // FOR OFFICIAL USE ONLY 

UNCLASSIFIED // FOR OFFICIAL USE ONLY 

Social Security Administration (SSA) 

Security Categorization: <Enter Categorization>

Risk Assessment Report (RAR)

FOR 

<System Name> (<Acronym>) 

<DRAFT/FINAL> Version <x.x>

<Month DD, YYYY>

Prepared by 

Office of Information Security
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY ii 

<INSTRUCTIONS: Orange, bracketed text indicates instructions on how a section should be 

completed or sample text, which should be replaced with project specific information or removed. 

Ensure sample text is turned from orange to black where necessary (e.g., headings shall be 

changed to the standard heading color), and all instructions are removed (including this paragraph). 

All black text shall remain unchanged.>
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY iii 

Document Revision History 

Revision 

History Date Summary of Changes Author 

1.0 <Month DD, YYYY> Initial release <name>

<x.x> <Month DD, YYYY> <description> <name>

<x.x> <Month DD, YYYY> <description> <name>
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY iv 

Table of Contents 

1 RISK ASSESSMENT REPORT (RAR) BACKGROUND ...................................................... 6

2 RAR EXECUTIVE SUMMARY FOR <SYSTEM NAME> ...................................................... 6

3 <SYSTEM NAME> SYSTEM PURPOSE .............................................................................. 6

3.1 System Name/Title/Unique Identifier ........................................................................................... 6

3.2 Responsible Organization ............................................................................................................ 7

3.3 Security Categorization ................................................................................................................ 8

4 RISK ASSESSMENT APPROACH ....................................................................................... 8

4.1 Risk Assessment Purpose ........................................................................................................... 8

4.2 Risk Assessment Objective ......................................................................................................... 8

4.3 Risk Assessment Scope .............................................................................................................. 9

4.4 Limitations .................................................................................................................................... 9

4.5 Risk Assessors ............................................................................................................................ 9

4.6 Results ....................................................................................................................................... 10

4.7 Recommendation ....................................................................................................................... 11

5 SUMMARY OF FINDINGS .................................................................................................. 12

APPENDIX A. REFERENCE DOCUMENTS .......................................................................... 15
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY v 

List of Tables 

Table 1: <SYSTEM ACRONYM> Points of Contact ..................................................................................... 7

Table 2: <System Name> Security Categorization ....................................................................................... 8

Table 3: Assessment Team Points of Contact ......................................................................................... 9

Table 4: Overall Risk Level ......................................................................................................................... 10

Table 5: <SYSTEM ACRONYM> Results Summary .................................................................................. 12

Table 6: Acronym List ................................................................................................................................. 14
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 6

1 Risk Assessment Report (RAR) Background 

The Office of Management and Budget (OMB) directive requires the Social Security Administration (SSA) 

to assess and re-authorize its major information technology (IT) systems at least once every three years 

and in the event of a major change, when that change occurs. This information must be reported in the 

annual Federal Information Security Modernization Act (FISMA) report to OMB and Congress during the 

fourth quarter (Q4) of each year. OMB has directed Chief Information Officers (CIO) of Federal agencies to 

follow the guidance found in the National Institute of Standards and Technology (NIST) Special Publication 

(SP) 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information 

Systems, to assess and re-authorize their information systems. This security authorization process contains 

subordinate efforts including performing risk-based reviews of the systems, developing/updating system 

security plans (SSP), and assessing and testing the security controls implemented for SSA’s information 

systems. 

2 RAR Executive Summary for <System Name> The Office of Information Security (OIS) contracted with Coalfire Federal Services, a third party assessment 

organization (3PAO), to conduct a system specific risk assessment on <system name> (<ACRONYM>). 

The acting Director of the Division of Compliance and Assessments, and the Security Authorization 

Manager (SAM) of <SYSTEM ACRONYM> approved the controls selected for this risk assessment. Thirtytwo (32) controls were tested over eleven (11) different NIST 800-53 Rev 4 control families. These controls 

were selected out of the <system categorization> baseline due to <SYSTEM ACRONYM> being 

categorized as a <system categorization> system as per the FIPS 199. During the assessment, there were 

<55 manual tests conducted, 62 interviews, and 84 document examinations>. Each of these is a 

requirement of a specific control. At the conclusion of the assessment, two controls were identified as “not 

implemented”. It should be noted that these controls have since been identified as common and should be 

added to the common control list. The controls that were not implemented, identified as PS4 (personnel 

termination), and PS 5 (personnel transfer), requires the SSA Information Security Policy (ISP) to document 

specific exit interview security debrief policies and procedures and the defined time period in which these 

must be carried out. Please refer to Table 5 for specific details. The likelihood of these vulnerabilities being 

exploited combined with the potential system impact is considered an overall LOW risk to the system. It is 

recommended that the <system name> assigned representative from the Security Assessment and 

Authorization Branch (SAAB) work with the System Authorization Manager (SAM) to mitigate these risks. 

Due to the overall identified risk being LOW, it is recommended that this be considered an acceptable risk 

and the system be given an authority to operate (ATO) for the next three years. 

3 <system name> System Purpose 

The <system name> (<ACRONYM>) system, has a <system categorization> Security Categorization. The 

boundaries are designed to aid SSA in the accomplishment of its mission to provide cost-effective and 

reliable services to other Federal agencies, and the public at large. 

<Insert detailed information> 

Coalfire Federal Services’ objective is to provide IT Independent Verification and Validation (IV&V) Support 

Services for <SYSTEM ACRONYM>. 

3.1 System Name/Title/Unique Identifier 

System/Application Name: <system name> (<SYSTEM ACRONYM>)

Unique Identifier : <016-00-SSA/DCS-M-001> 
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 7

3.2 Responsible Organization 

Table 1: <SYSTEM ACRONYM> Points of Contact 

Title II Batch 

POCs.xlsx

Title II Internet 

Applications POCs.xlsx

<Embed the applicable system’s POCs, EXAMPLE attached.>
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 8

3.3 Security Categorization 

This authorization boundary has been categorized as <system categorization> risk according to FIPS 

199. Refer to Table 5 below for supporting documentation regarding the determination of the 

application’s security categorization. 

Table 2: <System Name> Security Categorization 

Information Type Confidentiality Integrity Availability 

Accounting 

Mission Area: Financial Management 

Explanation: Selected risk values derived from NIST SP-800-

60, and FIPS 199, considering SSA business case.

L M L

Payments 

Mission Area: Financial Management 

Explanation: Selected risk values derived from NIST SP-800-

60, and FIPS 199, considering SSA business case.

L M L

Reporting & Information 

Mission Area: Financial Management 

Explanation: Based on the protection requirements for 

confidentiality, integrity and availability, the overall system 

sensitivity is <SYSTEM CATEGORIZATION>. The loss, 

misuse or unauthorized access to Agency data can be 

expected to have a serious adverse effect on SSA operations 

and assets.

L M L

Entitlement Event Information 

Mission Area: General Government 

Explanation: Selected risk values derived from NIST SP-800-

60, and FIPS 199, considering SSA business case.

M M M

Personal Identity and Authentication 

Mission Area: General Government

M M M

Information Sharing 

Mission Area: Information and Technology Management 

Explanation: Selected risk values derived from NIST SP-800-

60, and FIPS 199, considering SSA business case.

N/A N/A N/A

Overall M M M 

4 Risk Assessment Approach 

4.1 Risk Assessment Purpose 

The purpose of this Risk Assessment Report (RAR) is to summarize the residual risk identified during the 

security assessment of <SYSTEM ACRONYM>. Risk is a factor derived from a vulnerability that can be 

exploited and the likelihood that it will be exploited. Please see Appendix A for the NIST 800-60 Volume II 

publication for the definition of risk. 

4.2 Risk Assessment Objective 

The objective of the risk assessment is to identify any controls that are not fully implemented as required 

by FISMA. Controls that are not implemented pose a measureable risk to SSA and that risk must be 

mitigated in a timely manner based on the level or risk the non-implemented control creates. For example, 

a low risk may only require an update to a policy or a POA&M that the system’s SAM must execute. Another 

example is a High risk that must have immediate action taken by the SAM and other stakeholders in order 

to prevent a threat actor(s) from exploiting the discovered risk. 
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 9

4.3 Risk Assessment Scope 

The previous system specific risk assessment was conducted on <SYSTEM ACRONYM> in <date>. The 

residual risk was identified and submitted to the SSA’s CIO. This submission was in accordance with OMB 

and FISMA guidelines to present the risk level of <SYSTEM ACRONYM> and ask for the ATO <SYSTEM 

ACRONYM> for the next three years. The CIO granted the ATO on <Month DD, YYYY> and allowed 

<SYSTEM ACRONYM> to operate from <Month DD, YYYY> to <Month DD, YYYY>. 

A new risk assessment is required by OMB and FISMA in order to identify the current residual risk and any 

risks associated with controls that are not fully implemented. The assessed controls were selected based 

on the <SYSTEM ACRONYM> Security Assessment Plan (SAP) approved by the OIS Director and the 

<SYSTEM ACRONYM> SAM. 

In addition to the controls selected, SSA uses the Nessus scanner along with the McAfee ePolicy 

Orchestrator (EPO) deployed by the SOC to look for signature based vulnerabilities in accordance with the 

SSA ISP. Associated Windows Database servers that have the EPO agent deployed within the <SYSTEM 

ACRONYM> boundary were scanned. The other <SYSTEM ACRONYM> servers did not have any 

vulnerability scanning tools available that could scan mainframe or storage hardware, and therefore were 

not scanned. 

The risk assessment was performed in accordance with all applicable laws, regulations, rules and orders 

of all governmental agencies and authorities. A complete list of referenced publications and regulations can 

be found in Appendix A. All risks associated with <SYSTEM ACRONYM> that were identified during the 

assessment and the potential impact of those risks are documented in this RAR. 

The RAR complies with the following SSA guidance: 

 SSA ISP

4.4 Limitations 

The <SYSTEM ACRONYM> subsystems, which reside within the National Support Center (NSC), rely on 

the Office of Systems Operations and Hardware Engineering (OSOHE) for hardware, software, and 

maintenance support. Additionally, user access and user profile provisioning for <SYSTEM ACRONYM>

subsystems residing on the mainframe, are provided by CA Top Secret, and managed by the Office of 

Systems Operations and Hardware Engineering (OSOHE), not by <SYSTEM ACRONYM>. Therefore, 

some access controls specific to <SYSTEM ACRONYM> are tested during an enterprise level common 

control assessment, and not during the <SYSTEM ACRONYM> system specific assessment reported 

within this RAR. 

This assessment was limited to the 32 system specific controls as listed in the approved SAP. 

4.5 Risk Assessors 

The participants in this risk assessment included the following Coalfire Federal Services personnel: 

Table 3: Assessment Team Points of Contact 

Name Role Contact Information 

<TJ Crews> Program Manager <Tj.crews@ssa.gov> 

<Kenneth Free> Lead Assessor (Senior Analyst) <kenneth.free@ssa.gov> 

<Gregory Bonham> Junior Assessor <gregory.bonham@ssa.gov> 

<Thomas G. Volpe, Sr.> Lead Assessor (Surge Support) <Thomas.G.Volpe@ssa.gov> 
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 10

The following techniques and NIST/FIPS publications were used to gather information relevant to the 

<SYSTEM ACRONYM>: 

 NIST SP 800-60 Volume II Revision 1/ and FIPS 199. The Risk Assessment (RA) Team utilized 

the <SYSTEM ACRONYM> Security Categorization, dated February 16, 2017 to determine 

associated system security categorization for the <SYSTEM ACRONYM>. System security 

categorization determines which recommended set of minimum (baseline) security controls from 

NIST SP 800-53 Revision 4 must be implemented. 

 NIST SP 800-53 Revision 4. The RA Team utilized NIST SP 800-53 Revision 4 to determine the 

recommended set of minimum-security controls. The security controls (management, operational, 

and technical safeguards or countermeasures) were reviewed to ensure they adequately protect 

the confidentiality, integrity, and availability of the <SYSTEM ACRONYM>, and that the selected 

security controls have been implemented, or there is a plan for future implementation. 

 Interviews. Interviews were conducted on-site with the SAM, System Administrator, and Database 

Administrator by the RA Team to collect useful information about the <SYSTEM ACRONYM>. 

Follow-up communications were conducted via email and by telephone to collect additional 

information about the <SYSTEM ACRONYM>. 

 Examination/Document Reviews. The RA Team reviewed documentation from the SSA for 

<SYSTEM ACRONYM>, such as policy and implementation guidance. POA&M, and the prior 

Security Assessment and Authorization (SA&A) Package, including the previous SSP, Risk 

Assessment, and the Security Control Assessment (SCA) Plan were reviewed. 

 Testing of Systems. Testing and Evaluation of security controls for <SYSTEM ACRONYM> was 

based on System Specific and Hybrid security controls defined by the OIS Rev4 SSA Control 

Inheritance Structure Worksheet with a <SYSTEM CATEGORIZATION> Baseline. Using the NIST 

Guidance from NIST SP 800-53A Revision 4, the RA Team tested and evaluated these controls for 

specified conditions that compare actual with expected behavior, the results of which are used to 

support the determination of security control existence, functionality, correctness, completeness, 

and potential for improvement over time. 

4.6 Results 

The overall risk level of the <SYSTEM ACRONYM> was determined to be Low, which is the combination 

of the likelihood of identified threats being able to exploit known system vulnerabilities and the potential the 

impact to <SYSTEM ACRONYM>. 

Low risk indicates that corrective actions are needed and a plan must be developed to incorporate these 

actions within a reasonable period of time. The preliminary review of security measures for the protection 

of the <SYSTEM ACRONYM> identified two low threat-vulnerability pairs (risks) in the overall risk 

assessment as summarized below in Table 2. 

Table 4: Overall Risk Level 

Risk Rating Control Category

Management Operational Technical Total 

Very High 0 0 0 0 

High 0 0 0 0 

Moderate 0 0 0 0 

Low 2 0 0 2 

Very Low 0 0 0 0 

Total 2 0 0 2 
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 11

4.7 Recommendation 

It is the recommendation from the Office of Information Security that an issuance of an Authority to Operate 

(ATO) for <system name> (<ACRONYM>) be given. This recommendation comes from the assessment 

findings from the 3PAO that conducted a system specific security assessment. The overall security 

categorization of <SYSTEM ACRONYM> is <system categorization> and the findings have an overall risk 

of LOW. 
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 12

5 Summary of Findings 

Table 5: <SYSTEM ACRONYM> Results Summary

Item 

No. 

Finding 

(In Order by Control 

Family) 

Threat Source Likelihood 

Level 

Impact 

Level 

Risk 

Level 

Recommended 

Corrective 

Action(s) 

V-1 PS-4.c.1 

PS-4.c.2 

Personnel 

Termination 

SSA ISP does not 

define the security 

debrief topics or policy 

to discuss with 

separating employees. 

In addition, the SSA 

ISP has no policy, 

guidelines for including 

the security debrief 

actions, or SSA specific 

information security 

topics during the exit 

interview as defined in 

PS-4.c.1 and PS-4.c.2. 

Insider Threat with 

Intent (e.g., Poorly 

Trained, 

Disgruntled, 

Malicious, 

Negligent, 

Dishonest, or 

Terminated 

Employees) 

Insider Threat 

without Intent or 

Knowledge 

Computer 

Crime/Hackers 

Espionage (e.g., 

Companies, 

Foreign 

Governments, or 

Other Government 

Interests) 

Low Low Low This is an agency 

requirement that 

must be reflected in 

the SSA ISP and is 

the responsibility of 

Division of Security 

Customer Service 

(DSCS). The 

Security 

Authorization 

Manager (SAM) is 

not responsible for 

updating policy. The 

SSA ISP should be 

updated to include a 

requirement that 

employees sign a 

Non-Disclosure 

Agreement (NDA), 

and have a security 

debrief to discuss 

the importance of 

not disclosing 

knowledge of 

specifics pertaining 

to the SSA 

information system 

environment. The 

ISP section 2.1.1.3 

should be updated 

to reflect this. In 

addition, section 

2.1.1.3 should be 

updated to reflect 

that a security 

debrief must be 

included as part of 

the exit interview. 

Exit interview 

guidance is currently 

located here: 

http://personnel.ba.s

sa.gov/OPE/cpps/exi

tprocedures.html 
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 13

Item 

No. 

Finding 

(In Order by Control 

Family) 

Threat Source Likelihood 

Level 

Impact 

Level 

Risk 

Level 

Recommended 

Corrective 

Action(s) 

V-2 PS-5.b.1 

PS-5.b.2 

Personnel Transfer 

SSA ISP does not 

define what security 

actions are to be taken 

when an employee is 

transferred or 

reassigned. The SSA 

ISP also does not 

specify the time period 

in which security 

actions that are defined 

in must occur. 

Insider Threat with 

Intent (e.g., Poorly 

Trained, 

Disgruntled, 

Malicious, 

Negligent, 

Dishonest, or 

Terminated 

Employees) 

Insider Threat 

without Intent or 

Knowledge 

Low Low Low This is an agency 

requirement that 

must be reflected in 

the SSA ISP and is 

the responsibility of 

DSCS. The ISP 

section 2.4 should 

be updated to define 

what security actions 

need to occur, in 

what period of time 

and what personnel 

or role is to be 

identified to be 

notified when an 

employee is 

transferred or 

reassigned. 

Authority To Operate (ATO) 

Recommendation 

Acceptance and Signature 

As the Security Authorization Manager (SAM) for <system name>, I hereby certify that this Risk 

Assessment Report provides an accurate representation of the system and its subsystems that were 

assessed. I also certify that it is my recommendation based on the findings that the SSA Chief 

Information Officer (CIO) grant an Authority to Operate (ATO) for <system name> for the next three (3) 

years. 

Security Authorization Manager: 

<name> 

As the Acting Director of the Division of Compliance and Authorization (DCA) in the Office of Information 

Security (OIS), I hereby certify that this Risk Assessment Report provides an accurate representation of 

the system and its subsystems that were assessed. I also certify that it is my recommendation based on 

the findings that the SSA Chief Information Officer (CIO) grant an Authority to Operate (ATO) for <system 

name> for the next three (3) years. 

Division of Compliance and 

Assessments Director 

Steven Harkness 

(Acting)
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 14

Table 6: Acronym List 

Acronym Definition 

AO Authorizing Official 

BSM Boundary Scope Memorandum 

CET Customer Engagement Tool 

CICS Customer Information Control System 

CIO Chief Information Officer 

CSO Component Security Officer 

DCA Division of Compliance and Authorization 

DCS Deputy Commissioner for Systems 

EPO McAfee ePolicy Orchestrator 

FIPS Federal Information Processing Standard 

FISMA Federal Information Security Modernization Act 

FOUO For Official Use Only 

ISA Interconnection Security Agreement 

ISP Information Security Policy 

IT Information Technology 

IV&V Independent Verification and Validation 

L2TP Layer 2 Tunneling Protocol 

LAN Local Area Network 

LIS Low Income Subsidy 

MKS Mortise Kern Systems 

MOA Memorandum of Agreement 

MOU Memorandum of Understanding 

NDA Non-disclosure Agreement 

NSC National Support Center 

NIST National Institute of Standards and Technology 

OIS Office of Information Security 

OMB Office of Management and Budget 

OSOHE Office of Systems Operations and Hardware Engineering 

OTSO Office of Telecommunications and System Operations 

PII Personally Identifiable Information 

POA&M Plan of Action and Milestones 

PSC Program Service Centers 

RA Risk Assessment or Risk Assessor 
Social Security Administration 

<System Name> 

Risk Assessment Report (RAR) 

Version <x.x>

 UNCLASSIFIED // FOR OFFICIAL USE ONLY 15

Acronym Definition 

RAR Risk Assessment Report 

RSDI Retirement, Survivor, or Disability Insurance 

SA&A Security Assessment and Authorization 

SAM Security Authorization Manager 

SAP System Assessment Plan 

SBU Sensitive But Unclassified 

SCA Security Control Assessment 

SO System Owner 

SP Special Publication 

SSA Social Security Administration 

SSP System Security Plan 

VPN Virtual Private Network 

3PAO Third Party assessment Organization 

 

APPENDIX A. REFERENCE DOCUMENTS 

The following documents were reviewed during the risk assessment process of the SSA’s security 

controls: 

 Federal Information Processing Standard (FIPS) 199 

 NIST Special Publication 800-30 Rev. 1, “Guide for Conducting Risk Assessments” 

 Office of Management and Budget (OMB) Circular A-130. 

 NIST Special Publication 800-39 

 NIST Special Publication 800-60 Revision 1, Volumes 1&2 

 NIST Special Publication 800-53 Revision 4 

 SSA Information Security Policy (ISP) 
EXHIBIT E
UNCLASSIFIED // FOR OFFICIAL USE ONLY 

UNCLASSIFIED // FOR OFFICIAL USE ONLY 

TEMPLATE VERSION (V2.2 FY17) 

Social Security Administration (SSA) 

Security Categorization: <Enter Categorization>

 NOTE: The Security Categorization for the system may not be available at the time of 

the development of this document if the system is a newly developed system or has 

undergone a major change which has augmented the data types processed by the 

system. Additional information on completing the security categorization of the 

information system can be found on the DSPP website at: 

http://sharepoint.ba.ssa.gov/DCS/OIS/DSPP/Veris%20TO14%20IVV%20and%20OA/

Forms/AllItems.aspx?RootFolder=%2fDCS%2fOIS%2fDSPP%2fVeris%20TO14%20I

VV%20and%20OA%2fIVV%2fTEMPLATES%2fOIS%20TEMPLATES%20FY16&Fol

derCTID=0x0120003BC3DC1169B0CE47BB662BC248F5B5EE. 

<Document Name> 

FOR 

<Externally Hosted Information System Name> 

<(Acronym)> 

<DRAFT/FINAL> Version <X.X> 

<Month DD, YYYY> 

Prepared by 

[COMPANY LOGO] 

[COMPANY STREET ADDRESS] 

[COMPANY CITY, STATE ZIP]
Social Security Administration 

<System Name><System Acronym> 

<Document Name> 

Version <X.X>

TMP V2.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY ii

Document Revision History 

Revision 

Number Revision Date Page Number Revision Summary Name of Reviewer 

V[X.X] MM/DD/YYYY All/Page 

No. [E.g. Initial Draft, Annual Review, etc.] 

[Company/Agency 

Name: Contact 

Name] 

 

 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY iii 

PREFACE

To carry out its wide-ranging responsibilities, the Social Security Administration (SSA), and its employees 

and managers have access to diverse and complex automated information systems, which includes, file 

servers, local and wide area networks (LANs/WANs) running on various platforms, and 

telecommunications systems. The components and offices within the SSA depend on the confidentiality, 

integrity, and availability (as defined by the Federal Information Processing Standard (FIPS) 199) of these 

systems and their data in order to accomplish day-to-day operations. 

In accordance with Office of Management and Budget (OMB) Circular A-130, Appendix III, all federal 

systems have value and require some level of protection. The generic term “system” is used to mean 

either a general support system or a major application. (See NIST Special Publication 800-18, Guide for 

Developing Security Plans for Federal Information Systems for additional information). 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY iv 

EXECUTIVE SUMMARY

The SSA relies on its information technology (IT) systems, including the [Enter SYSTEM NAME 

(Acronym)], to accomplish its undertaking of providing cost-effective and reliable services to the SSA, 

other Federal agencies, and the public at large. Since this externally hosted information system is part of 

an SSA security authorization boundary, it is subject to meet some or all of the SSA specific security 

requirements depending upon the information it processes and the services it provides for the SSA. 

[Provide an EXECUTIVE SUMMARY and overview of the information system. This summary should 

describe what the information system is, what its importance is to SSA, who is in the user audience, and 

any additional subsystems that is encompassed in the system.] 

The purpose of this system security plan is to provide an overview of the security requirements of the 

[ENTER SYSTEM NAME HERE] system and describe the controls in place or planned for meeting those 

requirements. The system security plan also delineates responsibilities and expected behavior of all 

individuals who access the system. 

The SSP documents the structured process of planning adequate, cost-effective security protection for a 

system. It shall reflect input from various managers/stakeholders with responsibilities concerning the 

system from the hosting company and from the SSA component for which the system provides services. 

 [Note: This SSP template shall be used to document an external hosted Information 

Systems that “IS” associated with one of the existing SSA Security Authorization 

Boundaries. 

As part of the development of this SSP document, the external system ISO or designee along with the 

SSA SAM and the Office of Information Security (OIS) will need to follow the instructions to determine 

which new application/system/sub-system should be included or associated with SSA. See section 1.1 

below for more details related to this process.]  DELETE THESE INSTRUCTIONS UPON 

COMPLETION 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY v 

SYSTEM SECURITY PLAN AGREEMENT SUMMARY

This SSP documents a formal agreement among the organizational officials approving the security 

controls designed to meet the security requirements for the [SYSTEM NAME]. These officials are the 

SSA System Owner (SO), (External Contractor) Information System Security Officer (ISSO), SSA 

Security Authorization Manager (SAM) and the SSA Authorizing Official (AO). 

Each organizational official has signed this agreement summary for the reasons identified below and has 

concurred with the security category of this Controlled Unclassified Information (CUI) system to be 

[LOW/MODERATE]. See Executive Order 13556 for more information on CUI. 

 [Check the box below that is applicable  DELETE] 

Initiation of the System Security Plan (including FIPS 199 security categorization)1

Annual Update of the System Security Plan (no significant changes) 

Acceptance and Signature 

As the Designated Representative(s) for <System Name>, I hereby certify that the <System 

Acronym> System Security Plan described in this document provides an accurate representation 

of the <System Acronym> and its subsystems. 

SSA Security Authorization Manager 

[ENTER NAME OF SAM  DELETE 

<Insert digital signature> 

SSA DSP Director 

[ENTER NAME OF DSP DIRECTOR] 

DELETE 

<Insert digital signature> 

 

1 When there are no significant changes, the System Owner, Information System Security Officer and SSA Security Authorization Manager must sign 

the agreement summary for an annual update. The Authorizing Official is not required to sign if there are no significant changes affecting the 

security posture of the system requiring reauthorization. Reauthorization is addressed via a formal memorandum approving the security plan and 

authorizing the system to operate for a specified period of time.
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY vi 

Table of Contents 

1 INFORMATION SYSTEM IDENTIFICATION ....................................................................... 1

1.1 DETERMINATION OF SYSTEM .......................................................................................................... 1

1.2 RESPONSIBLE ORGANIZATION ......................................................................................................... 1

1.3 INFORMATION SYSTEM CATEGORIZATION ........................................................................................ 1

1.4 GENERAL DESCRIPTION OF INFORMATION SENSITIVITY .................................................................... 2

1.5 IMPACT LEVEL FOR INFORMATION TYPES ......................................................................................... 2

1.6 SYSTEM POINTS OF CONTACT ........................................................................................................ 3

1.7 ASSIGNMENT OF SECURITY RESPONSIBILITY ................................................................................... 4

1.8 SYSTEM OPERATIONAL STATUS ...................................................................................................... 4

1.9 INFORMATION SYSTEM TYPE ........................................................................................................... 4

1.10 SECURITY STATUS ......................................................................................................................... 5

1.11 GENERAL DESCRIPTION AND PURPOSE ........................................................................................... 5

1.12 DATA TYPES .................................................................................................................................. 5

1.13 INFORMATION SYSTEM BOUNDARY .................................................................................................. 6

1.14 SYSTEM ARCHITECTURE/ENVIRONMENT .......................................................................................... 6

1.15 SECURITY AUTHORIZATION BOUNDARY ........................................................................................... 6

1.16 SYSTEM INVENTORY ....................................................................................................................... 6

1.17 SYSTEM INTERCONNECTIONS.......................................................................................................... 7

2 [SYSTEM ACRONYM] NIST SP 800-53 - REV 4 MINIMUM SECURITY CONTROLS ....... 8

2.1 SECURITY CONTROLS .................................................................................................................... 8

2.1.1 Access Control (AC) ................................................................................................................ 8

2.1.1.1 AC-1 Access Control Policy and Procedures .......................................................................... 8

2.1.1.2 AC-2 Account Management .................................................................................................... 9

2.1.1.3 AC-3 Access Enforcement .................................................................................................... 11

2.1.1.4 AC-4 Information Flow Enforcement ..................................................................................... 12

2.1.1.5 AC-5 Separation of Duties ..................................................................................................... 13

2.1.1.6 AC-6 Least Privilege .............................................................................................................. 13

2.1.1.7 AC-7 Unsuccessful Logon Attempts ..................................................................................... 16

2.1.1.8 AC-8 System Use Notification ............................................................................................... 16

2.1.1.9 AC-11 Session Lock .............................................................................................................. 17

2.1.1.10 AC-12 Session Termination .................................................................................................. 18

2.1.1.11 AC-14 Permitted Actions without Identification or Authentication ......................................... 19

2.1.1.12 AC-17 Remote Access .......................................................................................................... 20

2.1.1.13 AC-18 Wireless Access ......................................................................................................... 22

2.1.1.14 AC-19 Access Control for Mobile Devices ............................................................................ 23

2.1.1.15 AC-20 Use of External Information Systems ......................................................................... 24

2.1.1.16 AC-21 Information Sharing .................................................................................................... 26

2.1.1.17 AC-22 Publicly Accessible Content ....................................................................................... 26

2.1.2 Awareness and Training (AT) ................................................................................................ 27

2.1.2.1 AT-1 Security Awareness and Training Policy and Procedures ........................................... 27

2.1.2.2 AT-2 Security Awareness Training ........................................................................................ 28

2.1.2.3 AT-3 Role-Based Security Training ....................................................................................... 29

2.1.2.4 AT-4 Security Training Records ............................................................................................ 30

2.1.3 Audit and Accountability (AU) ................................................................................................ 30
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY vii 

2.1.3.1 AU-1 Audit and Accountability Policy and Procedures.......................................................... 30

2.1.3.2 AU-2 Audit Events ................................................................................................................. 31

2.1.3.3 AU-3 Content of Audit Records ............................................................................................. 32

2.1.3.4 AU-4 Audit Storage ............................................................................................................... 33

2.1.3.5 AU-5 Response to Audit Processing Failures ....................................................................... 34

2.1.3.6 AU-6 Audit Review, Analysis, and Reporting ........................................................................ 34

2.1.3.7 AU-7 Audit Reduction and Report Generation ...................................................................... 36

2.1.3.8 AU-8 Time Stamps ................................................................................................................ 37

2.1.3.9 AU-9 Protection of Audit Information ..................................................................................... 38

2.1.3.10 AU-11 Audit Record Retention .............................................................................................. 39

2.1.3.11 AU-12 Audit Generation ........................................................................................................ 40

2.1.4 Security Assessment and Authorization (CA) ....................................................................... 40

2.1.4.1 CA-1 Security Assessment and Authorization Policies and Procedures .............................. 41

2.1.4.2 CA-2 Security Assessments .................................................................................................. 41

2.1.4.3 CA-3 System Interconnections .............................................................................................. 43

2.1.4.4 CA-5 Plan of Action and Milestones ...................................................................................... 44

2.1.4.5 CA-6 Security Authorization .................................................................................................. 44

2.1.4.6 CA-7 Continuous Monitoring ................................................................................................. 45

2.1.4.7 CA-9 Internal System Connections ....................................................................................... 46

2.1.5 Configuration Management (CM) .......................................................................................... 47

2.1.5.1 CM-1 Configuration Management Policy and Procedures .................................................... 47

2.1.5.2 CM-2 Baseline Configuration ................................................................................................ 48

2.1.5.3 CM-3 Configuration Change Control ..................................................................................... 50

2.1.5.4 CM-4 Security Impact Analysis ............................................................................................. 51

2.1.5.5 CM-5 Access Restrictions for Change .................................................................................. 52

2.1.5.6 CM-6 Configuration Settings ................................................................................................. 52

2.1.5.7 CM-7 Least Functionality ....................................................................................................... 53

2.1.5.8 CM-8 Information System Component Inventory .................................................................. 55

2.1.5.9 CM-9 Configuration Management Plan ................................................................................. 57

2.1.5.10 CM-10 Software Usage Restrictions ..................................................................................... 58

2.1.5.11 CM-11 User-Installed Software ............................................................................................. 58

2.1.6 Contingency Planning (CP) ................................................................................................... 59

2.1.6.1 CP-1 Contingency Planning Policy and Procedures ............................................................. 59

2.1.6.2 CP-2 Contingency Plan ......................................................................................................... 60

2.1.6.3 CP-3 Contingency Training ................................................................................................... 62

2.1.6.4 CP-4 Contingency Plan Testing ............................................................................................ 63

2.1.6.5 CP-6 Alternate Storage Site .................................................................................................. 64

2.1.6.6 CP-7 Alternate Processing Site ............................................................................................. 65

2.1.6.7 CP-8 Telecommunications Services ..................................................................................... 67

2.1.6.8 CP-9 Information System Backup ......................................................................................... 69

2.1.6.9 CP-10 Information System Recovery and Reconstitution ..................................................... 70

2.1.7 Identification and Authentication (IA) .................................................................................... 71

2.1.7.1 IA-1 Identification and Authentication Policy and Procedures .............................................. 71

2.1.7.2 IA-2 Identification and Authentication .................................................................................... 72

2.1.7.3 IA-3 Device Identification and Authentication ........................................................................ 75

2.1.7.4 IA-4 Identifier Management ................................................................................................... 76

2.1.7.5 IA-5 Authenticator Management............................................................................................ 76

2.1.7.6 IA-6 Authenticator Feedback ................................................................................................. 79

2.1.7.7 IA-7 Cryptographic Module Authentication ............................................................................ 80

2.1.7.8 IA-8 Identification and Authentication (Non-Organizational Users) ....................................... 80

2.1.8 Incident Response (IR) .......................................................................................................... 82

2.1.8.1 IR-1 Incident Response Policy and Procedures .................................................................... 83

2.1.8.2 IR-2 Incident Response Training ........................................................................................... 83

2.1.8.3 IR-3 Incident Response Testing ............................................................................................ 84
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY viii 

2.1.8.4 IR-4 Incident Handling ........................................................................................................... 85

2.1.8.5 IR-5 Incident Monitoring ........................................................................................................ 86

2.1.8.6 IR-6 Incident Reporting ......................................................................................................... 87

2.1.8.7 IR-7 Incident Response Assistance ...................................................................................... 88

2.1.8.8 IR-8 Incident Response Plan ................................................................................................. 89

2.1.9 Maintenance (MA) ................................................................................................................. 89

2.1.9.1 MA-1 System Maintenance Policy and Procedures .............................................................. 90

2.1.9.2 MA-2 Controlled Maintenance ............................................................................................... 90

2.1.9.3 MA-3 Maintenance Tools ...................................................................................................... 91

2.1.9.4 MA-4 Nonlocal Maintenance ................................................................................................. 92

2.1.9.5 MA-5 Maintenance Personnel ............................................................................................... 93

2.1.9.6 MA-6 Timely Maintenance ..................................................................................................... 94

2.1.10 Media Protection (MP) ........................................................................................................... 95

2.1.10.1 MP-1 Media Protection Policy and Procedures ..................................................................... 95

2.1.10.2 MP-2 Media Access .............................................................................................................. 95

2.1.10.3 MP-3 Media Marking ............................................................................................................. 96

2.1.10.4 MP-4 Media Storage ............................................................................................................. 97

2.1.10.5 MP-5 Media Transport ........................................................................................................... 97

2.1.10.6 MP-6 Media Sanitization ....................................................................................................... 98

2.1.10.7 MP-7 Media Use .................................................................................................................... 99

2.1.11 Physical and Environmental Protection (PE) ...................................................................... 100

2.1.11.1 PE-1 Physical and Environmental Protection Policy and Procedures ................................ 100

2.1.11.2 PE-2 Physical Access Authorizations ................................................................................. 101

2.1.11.3 PE-3 Physical Access Control ............................................................................................. 102

2.1.11.4 PE-4 Access Control for Transmission Medium .................................................................. 102

2.1.11.5 PE-5 Access Control for Output Devices ............................................................................ 103

2.1.11.6 PE-6 Monitoring Physical Access........................................................................................ 104

2.1.11.7 PE-8 Visitor Access Records .............................................................................................. 105

2.1.11.8 PE-9 Power Equipment and Cabling ................................................................................... 105

2.1.11.9 PE-10 Emergency Shutoff ................................................................................................... 106

2.1.11.10 PE-11 Emergency Power .................................................................................................... 107

2.1.11.11 PE-12 Emergency Lighting .................................................................................................. 107

2.1.11.12 PE-13 Fire Protection .......................................................................................................... 108

2.1.11.13 PE-14 Temperature and Humidity Controls ........................................................................ 109

2.1.11.14 PE-15 Water Damage Protection ........................................................................................ 110

2.1.11.15 PE-16 Delivery and Removal .............................................................................................. 110

2.1.11.16 PE-17 Alternate Work Site .................................................................................................. 111

2.1.12 Planning (PL) ....................................................................................................................... 112

2.1.12.1 PL-1 Security Planning Policy and Procedures ................................................................... 112

2.1.12.2 PL-2 System Security Plan .................................................................................................. 113

2.1.12.3 PL-4 Rules of Behavior ....................................................................................................... 114

2.1.12.4 PL-8 Information Security Architecture ............................................................................... 115

2.1.13 Personnel Security (PS) ...................................................................................................... 116

2.1.13.1 PS-1 Personnel Security Policy and Procedures ................................................................ 116

2.1.13.2 PS-2 Position Risk Designation ........................................................................................... 117

2.1.13.3 PS-3 Personnel Screening .................................................................................................. 117

2.1.13.4 PS-4 Personnel Termination ............................................................................................... 118

2.1.13.5 PS-5 Personnel Transfer ..................................................................................................... 119

2.1.13.6 PS-6 Access Agreements ................................................................................................... 119

2.1.13.7 PS-7 Third-Party Personnel Security .................................................................................. 120

2.1.13.8 PS-8 Personnel Sanctions .................................................................................................. 121

2.1.14 Risk Assessment (RA) ........................................................................................................ 121

2.1.14.1 RA-1 Risk Assessment Policy and Procedures .................................................................. 122

2.1.14.2 RA-2 Security Categorization .............................................................................................. 122
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY ix 

2.1.14.3 RA-3 Risk Assessment ........................................................................................................ 123

2.1.14.4 RA-5 Vulnerability Scanning ................................................................................................ 124

2.1.15 System and Services Acquisition ........................................................................................ 126

2.1.15.1 SA-1 System and Services Acquisition Policy and Procedures .......................................... 126

2.1.15.2 SA-2 Allocation of Resources .............................................................................................. 127

2.1.15.3 SA-3 System Development Life Cycle ................................................................................ 127

2.1.15.4 SA-4 Acquisition Process .................................................................................................... 128

2.1.15.5 SA-5 Information System Documentation ........................................................................... 130

2.1.15.6 SA-8 Security Engineering Principles ................................................................................. 131

2.1.15.7 SA-9 External Information System Services ....................................................................... 132

2.1.15.8 SA-10 Developer Configuration Management .................................................................... 133

2.1.15.9 SA-11 Developer Security Testing and Evaluation ............................................................. 134

2.1.16 System and Communications Protection ............................................................................ 135

2.1.16.1 SC-1 System and Communications Protection Policy and Procedures .............................. 135

2.1.16.2 SC-2 Application Partitioning ............................................................................................... 136

2.1.16.3 SC-4 Information in Shared Resources .............................................................................. 136

2.1.16.4 SC-5 Denial of Service Protection ....................................................................................... 137

2.1.16.5 SC-7 Boundary Protection ................................................................................................... 137

2.1.16.6 SC-8 Transmission Confidentiality and Integrity ................................................................. 140

2.1.16.7 SC-10 Network Disconnect ................................................................................................. 141

2.1.16.8 SC-12 Cryptographic Key Establishment and Management ............................................... 142

2.1.16.9 SC-13 Cryptographic Protection .......................................................................................... 142

2.1.16.10 SC-15 Collaborative Computing Devices ............................................................................ 143

2.1.16.11 SC-17 Public Key Infrastructure Certificates ....................................................................... 144

2.1.16.12 SC-18 Mobile Code ............................................................................................................. 144

2.1.16.13 SC-19 Voice Over Internet Protocol .................................................................................... 145

2.1.16.14 SC-20 Secure Name / Address Resolution Service (Authoritative Source) ........................ 146

2.1.16.15 SC-21 Secure Name / Address Resolution Service (Recursive or Caching Resolver) ...... 146

2.1.16.16 SC-22 Architecture and Provisioning for Name / Address Resolution Service ................... 147

2.1.16.17 SC-23 Session Authenticity ................................................................................................. 148

2.1.16.18 SC-28 Protection of Information at Rest ............................................................................. 148

2.1.16.19 SC-39 Process Isolation ...................................................................................................... 149

2.1.17 System and Information Integrity......................................................................................... 149

2.1.17.1 SI-1 System and Information Integrity Policy and Procedures ............................................ 149

2.1.17.2 SI-2 Flaw Remediation ........................................................................................................ 150

2.1.17.3 SI-3 Malicious Code Protection ........................................................................................... 151

2.1.17.4 SI-4 Information System Monitoring .................................................................................... 153

2.1.17.5 SI-5 Security Alerts, Advisories, and Directives .................................................................. 155

2.1.17.6 SI-7 Software, Firmware, and Information Integrity ............................................................. 156

2.1.17.7 SI-8 Spam Protection .......................................................................................................... 157

2.1.17.8 SI-10 Information Input Validation ....................................................................................... 159

2.1.17.9 SI-11 Error Handling ............................................................................................................ 159

2.1.17.10 SI-12 Information Handling and Retention .......................................................................... 160

2.1.17.11 SI-16 Memory Protection ..................................................................................................... 161

3 APPENDIX LISTING ......................................................................................................... 162

3.1 REQUIRED APPENDICES ............................................................................................................. 162

3.2 SYSTEM SPECIFIC APPENDICES .................................................................................................. 162

3.3 ACRONYM LIST .......................................................................................................................... 163

3.4 DEFINITIONS/GLOSSARY ............................................................................................................. 165

3.5 APPLICABLE LAWS AND REFERENCES ......................................................................................... 169
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V1.2 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY x 

LIST OF FIGURES 

Figure 1: [System Acronym] Architecture Diagram ....................................................................................... 6

Figure 2: [System Acronym] Accreditation Boundary ................................................................................... 6

LIST OF TABLES 

Table 1: System Name/Identifier ................................................................................................................... 1

Table 2: Responsible Organization ............................................................................................................... 1

Table 3: Security Categorization ................................................................................................................... 1

Table 4: Impact Level for Information Types ................................................................................................. 3

Table 5: <System Name> Points of Contact ................................................................................................. 3

Table 6: [System Acronym] (Contractor) Information System Security Officer (ISSO) ................................. 4

Table 7: SSA Security Authorization Manager (SAM) ................................................................................. 4

Table 8: Information System Operational Status .......................................................................................... 4

Table 9: Information System Type ................................................................................................................ 5

Table 10: NIST SP 800-60 Vol 2. Information Data Types ........................................................................... 5

Table 11: Inventory: List of Technologies ..................................................................................................... 6

Table 12: [System Acronym] System Interconnections ................................................................................ 7
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 1 

1 Information System Identification 

1.1 Determination of System 

Table 1: System Name/Identifier 

System Name/Title: System ID No: 

<System name: external information system 

name> ( short name-subsystem short name)

1.2 Responsible Organization 

Table 2: Responsible Organization 

Organization Address 

 

1.3 Information System Categorization 

Security categorizations are to be performed as the first step in the security authorization process as 

required by Federal Information Processing Standard (FIPS) 199 in order to select appropriate system 

security controls to be addressed throughout the rest of the security authorization. FIPS 199 categories 

are derived according to the potential impact on the agency that would occur if its Confidentiality, 

Integrity, or Availability were compromised. FIPS 199 category definitions are as follows: 

 High Impact: The loss of confidentiality, integrity, or availability could be expected to have a 

severe or catastrophic adverse effect on organizational operations, organizational assets, or 

individuals. 

 Moderate Impact: The loss of confidentiality, integrity, or availability could be expected to have 

a serious adverse effect on organizational operations, organizational assets, or individuals. (At 

SSA, the highest security categorization is currently Moderate) 

 Low Impact: The loss of confidentiality, integrity, or availability could be expected to have a 

limited adverse effect on organizational operations, organizational assets, or individuals. 

Based on the system categorization of this externally hosted system the [SYSTEM ACRONYM] system 

has been categorized as a [LOW/MODERATE] system according to FIPS 199. 

 [Enter an “X” in the applicable section]  DELETE 

Table 3: Security Categorization 

Low 

Moderate 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 2 

1.4 General Description of Information Sensitivity 

Sensitive information is defined by the Computer Security Act (section 552a of Title 5, United States 

Code) as any information, the loss, misuse, or unauthorized access to or modification of which could 

adversely affect the national interest or the conduct of federal programs, or the privacy to which 

individuals are entitled. The National Institute of Standards and Technology (NIST) Special Publication 

800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) further defines 

the requirements for Personal Identity Information (PII) which SSA follows with regard to protecting its 

sensitive PII. 

FIPS 199 defines security categories for information systems based on potential impact on organizations, 

assets, or individuals should there be a breach of security—that is, a loss of confidentiality, integrity, or 

availability. FIPS 199 security categories play an important part in defining information system security 

boundaries by partitioning the agency's information systems according to the criticality or sensitivity of the 

information and information systems and the importance of those systems in accomplishing the agency's 

mission. This is particularly important when there are various FIPS 199 impact levels contained in one 

information system. The FIPS 199 requirement to secure an information system to the high watermark or 

highest impact level must be applied when grouping minor applications/subsystems with varying FIPS 

199 impact levels into a single general support system or major application unless there is adequate 

boundary protection, e.g., firewalls and encryption, around those subsystems or applications with the 

highest impact level. Additionally, there must be assurance that the shared resources, i.e., networks, 

communications, and physical access within the whole general support system or major application, are 

protected adequately for the highest impact level. Having the ability to isolate the high impact systems will 

not only result in more secure systems, but will also reduce the amount of resources required to secure 

many applications/systems that do not require that level of security. NIST SP 800-53 provides three 

security control baselines, i.e., low, moderate, and high (high is not addressed by this SSP), that are 

associated with the three FIPS 199 impact levels; as the impact level increases, so do the minimum 

assurance requirements. For reporting purposes, i.e., FISMA annual report, when an information system 

has varying FIPS 199 impact levels, that system is categorized at the highest impact level on that 

information system. 

1.5 Impact Level for Information Types 

The following tables identify the information types that are input, stored, processed, and/or output from 

[System Acronym]. The selection of the information types is based on guidance provided by OMB 

Federal Enterprise Architecture Program Management Office Business Reference Model 2.0 

(http://www.whitehouse.gov/omb/e-gov/fea), and the FIPS 199, Standards for Security Categorization of 

Federal Information and Information Systems, and NIST Special Publication (SP) 800-60, Guide for 

Mapping Types of Information and Information Systems to Security Categories. SP 800-60 includes two 

volumes: Volume I is a basic guideline and Volume II contains appendices. Users should review the 

guidelines provided in Volume I, then refer to only the material from the appendices that is applicable. 

NIST SP 800-60 is available for download at http://csrc.nist.gov/publications/. 

The potential impact is LOW if— 

The loss of confidentiality, integrity, or availability could be expected to have a limited adverse 

effect on organizational operations, organizational assets, or individuals. 

A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availability 

might: (i) cause a degradation in mission capability to an extent and duration that the organization 

is able to perform its primary functions, but the effectiveness of the functions is noticeably 

reduced; (ii) result in minor damage to organizational assets; (iii) result in minor financial loss; or 

(iv) result in minor harm to individuals. 

The potential impact is MODERATE if— 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 3 

The loss of confidentiality, integrity, or availability could be expected to have a serious adverse 

effect on organizational operations, organizational assets, or individuals. 

A serious adverse effect means that, for example, the loss of confidentiality, integrity, or 

availability might: (i) cause a significant degradation in mission capability to an extent and 

duration that the organization is able to perform its primary functions, but the effectiveness of the 

functions is significantly reduced; (ii) result in significant damage to organizational assets; (iii) 

result in significant financial loss; or (iv) result in significant harm to individuals that does not 

involve loss of life or serious life threatening injuries. 

The potential impact is HIGH if— 

The loss of confidentiality, integrity, or availability could be expected to have a severe or 

catastrophic adverse effect on organizational operations, organizational assets, or individuals. 

A severe or catastrophic adverse effect means that, for example, the loss of confidentiality, 

integrity, or availability might: (i) cause a severe degradation in or loss of mission capability to an 

extent and duration that the organization is not able to perform one or more of its primary 

functions; (ii) result in major damage to organizational assets; (iii) result in major financial loss; or 

(iv) result in severe or catastrophic harm to individuals involving loss of life or serious life 

threatening injuries. 

 [List the different information types per NIST SP 800-60 and indicate provisional impact level. Add or 

modify information types if necessary]. This information can be copy/pasted from the SSA Parent 

System FIPS199 Security Categorization Review documentation, Section 4.  DELETE THESE 

INSTRUCTIONS UPON COMPLETION 

Table 4: Impact Level for Information Types 

NIST Information 

Type 

NIST 

SP 800-60, 

Volume II 

Reference 

NIST Recommended Provisional Impact Levels 

System Owner 

Selected Impact Levels Comments 

Confidentiality Integrity Availability Confidentiality Integrity Availability 

EXAMPLE: 

Personal 

Identity and 

Authentication 

Information 

Type

C.2.8.9 M M M M M M None

 

1.6 System Points of Contact 

<Complete the attached spreadsheet with system specific information.> 

Table 5: <System Name> Points of Contact 

SSP-Point of 

Contacts.xlsx
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 4 

1.7 Assignment of Security Responsibility 

Table 6: [System Acronym] (Contractor) Information System Security Officer (ISSO) 

Name: 

Title: 

Agency: 

Address: 

Telephone: 

Email: 

Responsibility: Individual with assigned responsibility for maintaining the appropriate operational 

security posture for an information system or program. Information System Security 

Officer (ISSO). 

Table 7: SSA Security Authorization Manager (SAM) 

Name: 

Title: 

Agency: 

Address: 

Telephone: 

Email: 

Responsibility: SSA Security Authorization Manager 

1.8 System Operational Status 

The [SYSTEM ACRONYM] and its component systems are in the [INITIATION, 

ACQUISITION/DEVELOPMENT, IMPLEMENATION, OPERATIONAL/MAINTENANCE] phase of their 

System Development Life Cycles (SDLC). 

 [Enter an “X” in the applicable section]  DELETE 

Table 8: Information System Operational Status 

Initiation Development Implementation Operational 

 

1.9 Information system Type 

 [Enter an “X” in the applicable section below]  DELETE 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 5 

Table 9: Information System Type 

Subsystem/Application Major Application General Support System 

 

1.10 Security Status 

[SECURTIY AUTHORIZATION ACRONYM/ EXTERNAL INFORMATION SYSTEM ACRONYM] received 

a full Authority to Operate (ATO) on [Enter DATE of ATO]. 

1.11 General Description and Purpose 

 [This section should contain a detailed general description and overall purpose for the information 

system. It should identify the system's purpose, capabilities, users, arrangements for hosting, 

connection and/or interface to SSA, and information data flow; discuss the hardware, software and 

firmware implemented in support of the information system]  DELETE 

1.12 Data Types 

Table 10: NIST SP 800-60 Vol 2. Information Data Types 

NIST 

Information 

Type 

NIST SP 800-60, Volume II 

Reference Data Type Description 

EXAMPLE: 

Personal 

Identity 

Information 

Type

C.2.8.9 Personal identity and authentication information includes that 

information necessary to ensure that all persons who are 

potentially entitled to receive any federal benefit are 

enumerated and identified so that Federal agencies can 

have reasonable assurance that they are paying or 

communicating with the right individuals. This information 

include individual citizen’s Social Security Numbers, names, 

dates of birth, places of birth, parents’ names, etc. 

 

 

 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 6 

1.13 Information System Boundary 

The [SYSTEM ACRONYM] system architecture, environment and agreement boundary is described 

below. 

1.14 System Architecture/Environment 

[Provide a description of the information system architecture/environment, explaining where and by whom 

it is hosted, whether it is a web-based (or cloud, etc.) application, what Software (SW) it is utilizing, what 

SW sits on the front end, back end, OS, how many users access the system, describe user interfaces, 

and designate whether connectivity to SSA and/or the outside is through VPN or WAN, etc.]  DELETE 

 [INSERT a diagram of the information system architecture, including its connections/interfaces/other 

relationships to SSA].  DELETE 

Figure 1: [System Acronym] Architecture Diagram 

1.15 Security Authorization Boundary 

[Provide information of where the information system is located; where backups and restores are 

conducted, and specifically where databases are housed. Provide an explanation of where the servers 

are located (company facility, datacenter, etc.), personnel, public access or not, how the systems are 

connected, how remote users can connect and how in and outbound internet connections are secured 

and maintained].  DELETE 

 [INSERT a diagram of the information security authorization boundary showing its 

connections/interfaces/other relationships to SSA.] DELETE

Figure 2: [System Acronym] Accreditation Boundary

1.16 System Inventory 

The hardware (HW) and software (SW) components included in the externally hosted, non-SSA [System 

Acronym] boundary are listed in the tables below. <System acronym> consists of multiple technologies. 

Table 11 contains a listing of technologies (hardware, software, technologies and platforms) that reside 

within the <system acronym> authorization boundary. Technology is listed per system and subsystem: 

<Complete the embedded spreadsheet with system specific information.> 

Table 11: Inventory: List of Technologies 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 7 

Table 6_Inventory - 

List of Technologies - 

 NOTE: Any changes to the scope of the Authorization Boundary after the Boundary 

Scope Meeting and finalization of the BSM may impact the overall IV&V schedule. 

1.17 System Interconnections 

The externally hosted [SYSTEM ACRONYM] requires that written agreements (e.g., Memorandums of 

Understanding (MOUs), Memorandums of Agreement (MOAs), Interconnection Security Agreements 

(ISAs), etc., on the security controls to be enforced on interconnecting systems and must be obtained 

prior to connecting and/or sharing sensitive data/information. Table 18 shows the status of these 

agreements between [SYSTEM ACRONYM] and the external systems that share its information. 

[SYSTEM ACRONYM] [Has /does not have] external communications requiring MOUs or ISAs. 

Table 12: [System Acronym] System Interconnections 

Information 

System 

Organization Type 

(GSS/MA) 

Agreement 

(ISA/MOU/MOA) 

Date FIPS 199 

Category 

C&A 

Status 

DAA 

N/A N/A N/A N/A N/A N/A N/A N/A 

 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 8 

2 [System Acronym] NIST SP 800-53 - Rev 4 

MINIMUM SECURITY CONTROLS 

The minimum security control baseline for [LOW/MODERATE]-impact systems from NIST SP 800-53 

Revision 4 is documented below. Specifically, this section provides a description of how all the minimumsecurity controls in the baseline are being implemented, planned, and compensated or how they will be 

implemented in the future. The table contains: (1) the NIST SP Publication and revision number (2) the 

security control family and specific control with applicable enhancements; (3) if the security control is a 

common control, hybrid or system specific (4) the implementation statement; how the security control is 

being implemented or how it will be implemented (5) the implementation status to determine whether the 

control is in place, not in place, compensated or not applicable and (6) comments to capture specific 

notes about the control’s implementation. (Note: if not in place, an explanation will need to be provided 

under this section). Implementation statements of controls identified as common will reference the system 

and/or SSP that the control is inherited from.

2.1 Security Controls 

Organizations employ security controls in federal information systems and the environments in which 

those systems operate in accordance with FIPS Publication 199, FIPS Publication 200, and NIST Special 

Publications 800-37 and 800-39. Security categorization of federal information and information systems, 

as required by FIPS Publication 199, is the first step in the risk management process. Next, organizations 

select an appropriate set of security controls for their information systems by satisfying the minimumsecurity requirements set forth in FIPS Publication 200. Appendix D includes three security control 

baselines that are associated with the designated impact levels of information systems as determined 

during the security categorization process. After baseline selection, organizations tailor the baselines by: 

(i) identifying/designating common controls; (ii) applying scoping considerations; (iii) selecting 

compensating controls, if needed; (iv) assigning control parameter values in selection and assignment 

statements; (v) supplementing the baseline controls with additional controls and control enhancements 

from the security control catalog; and (vi) providing additional information for control implementation. 

2.1.1 Access Control (AC) 

2.1.1.1 AC-1 Access Control Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

b. An access control policy that addresses purpose, scope, roles, responsibilities, management 

commitment, coordination among organizational entities, and compliance; and 

c. Procedures to facilitate the implementation of the access control policy and associated 

access controls; and 

d. Reviews and updates the current: 

e. Access control policy [Assignment: organization-defined frequency]; and 

f. Access control procedures [Assignment: organization-defined frequency]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 9 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-1] 

Implementation Statement: 

AC-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.1.2 AC-2 Account Management 

The organization: 

a. Identifies and selects the following types of information system accounts to support 

organizational missions/business functions: [Assignment: organization-defined information 

system account types]; 

b. Assigns account managers for information system accounts; 

c. Establishes conditions for group and role membership; 

d. Specifies authorized users of the information system, group and role membership, and 

access authorizations (i.e., privileges) and other attributes (as required) for each account; 

e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to 

create information system accounts; 

f. Creates, enables, modifies, disables, and removes information system accounts in 

accordance with [Assignment: organization-defined procedures or conditions]; 

g. Monitors the use of, information system accounts; 

h. Notifies account managers: 

1. When accounts are no longer required; 

2. When users are terminated or transferred; and 

3. When individual information system usage or need-to-know changes; 

i. Authorizes access to the information system based on: 

1. A valid access authorization; 

2. Intended system usage; and 

3. Other attributes as required by the organization or associated missions/business 

functions; 

j. Reviews accounts for compliance with account management requirements [Assignment: 

organization-defined frequency]; and 

k. Establishes a process for reissuing shared/group account credentials (if deployed) when 

individuals are removed from the group. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 10 

(1) ACCOUNT MANAGEMENT | AUTOMATED SYSTEM ACCOUNT MANAGEMENT 

The organization employs automated mechanisms to support the management of information 

system accounts. 

(2) ACCOUNT MANAGEMENT | REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS 

The information system automatically [Selection: removes; disables] temporary and 

emergency accounts after [Assignment: organization-defined time period for each type of 

account]. 

(3) ACCOUNT MANAGEMENT | DISABLE INACTIVE ACCOUNTS 

The information system automatically disables inactive accounts after [Assignment: 

organization-defined time period]. 

(4) ACCOUNT MANAGEMENT | AUTOMATED AUDIT ACTIONS 

The information system automatically audits account creation, modification, enabling, 

disabling, and removal actions, and notifies [Assignment: organization-defined personnel or 

roles]. 

NIST SP 800-53 Access Controls Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-2] 

Implementation Statement: 

AC-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AC-2(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 11 

Comments: 

Control Enhancement AC-2(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-2(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-2(4) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.1.3 AC-3 Access Enforcement 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 12 

The information system enforces approved authorizations for logical access to information and system 

resources in accordance with applicable access control policies. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-3] 

Implementation Statement: 

AC-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.1.4 AC-4 Information Flow Enforcement 

The information system enforces approved authorizations for controlling the flow of information within the 

system and between interconnected systems based on [Assignment: organization-defined information 

flow control policies]. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-4] 

Implementation Statement: 

AC-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 13 

Comments:

2.1.1.5 AC-5 Separation of Duties 

The organization: 

a. Separates [Assignment: organization-defined duties of individuals]; 

b. Documents separation of duties of individuals; and 

c. Defines information system access authorizations to support separation of duties. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-5] 

Implementation Statement: 

AC-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.1.6 AC-6 Least Privilege 

The organization employs the principle of least privilege, allowing only authorized accesses for users (or 

processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance 

with organizational missions and business functions. 

Control Enhancements: 

(1) LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY FUNCTIONS 

The organization explicitly authorizes access to [Assignment: organization-defined security functions 

(deployed in hardware, software, and firmware) and security-relevant information]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 14 

(2) LEAST PRIVILEGE | NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS 

The organization requires that users of information system accounts, or roles, with access to 

[Assignment: organization-defined security functions or security-relevant information], use non-privileged 

accounts or roles, when accessing nonsecurity functions. 

(5) LEAST PRIVILEGE | PRIVILEGED ACCOUNTS 

The organization restricts privileged accounts on the information system to [Assignment: organizationdefined personnel or roles]. 

(9) LEAST PRIVILEGE | AUDITING USE OF PRIVILEGED FUNCTIONS 

The information system audits the execution of privileged functions. 

(10) LEAST PRIVILEGE | PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED 

FUNCTIONS 

The information system prevents non-privileged users from executing privileged functions to include 

disabling, circumventing, or altering implemented security safeguards/countermeasures. 

NIST SP 800-53 Access Controls Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-6] 

Implementation Statement: 

AC-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AC-6(1) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 15 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-6(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-6(5) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-6(9) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 16 

Control Enhancement AC-6(10) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.1.7 AC-7 Unsuccessful Logon Attempts 

The information system: 

a. Enforces a limit of [Assignment: organization-defined number] consecutive invalid logon 

attempts by a user during a [Assignment: organization-defined time period]; and 

b. Automatically [Selection: locks the account/node for an [Assignment: organization-defined 

time period]; locks the account/node until released by an administrator; delays next logon 

prompt according to [Assignment: organization-defined delay algorithm]] when the maximum 

number of unsuccessful attempts is exceeded. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-7] 

Implementation Statement: 

AC-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.1.8 AC-8 System Use Notification 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 17 

The information system: 

a. Displays to users [Assignment: organization-defined system use notification message or 

banner] before granting access to the system that provides privacy and security notices 

consistent with applicable federal laws, Executive Orders, directives, policies, regulations, 

standards, and guidance and states that: 

1. Users are accessing a U.S. Government information system; 

2. Information system usage may be monitored, recorded, and subject to audit; 

3. Unauthorized use of the information system is prohibited and subject to criminal and civil 

penalties; and 

4. Use of the information system indicates consent to monitoring and recording; 

b. Retains the notification message or banner on the screen until users acknowledge the usage 

conditions and take explicit actions to log on to or further access the information system; and 

c. For publicly accessible systems: 

1. Displays system use information [Assignment: organization-defined conditions], before 

granting further access; 

2. Displays references, if any, to monitoring, recording, or auditing that are consistent with 

privacy accommodations for such systems that generally prohibit those activities; and 

3. Includes a description of the authorized uses of the system. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-8] 

Implementation Statement: 

AC-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.1.9 AC-11 Session Lock 

The information system: 

a. Prevents further access to the system by initiating a session lock after [Assignment: 

organization-defined time period] of inactivity or upon receiving a request from a user; and 

b. Retains the session lock until the user reestablishes access using established identification 

and authentication procedures. 

Control Enhancements: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 18 

(1) SESSION LOCK | PATTERN-HIDING DISPLAYS 

The information system conceals, via the session lock, information previously visible on the display with a 

publicly viewable image. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-11] 

Implementation Statement: 

AC-11 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Implementation Statement: 

AC-11(1) 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.1.10 AC-12 Session Termination 

The information system automatically terminates a user session after [Assignment: organization-defined 

conditions or trigger events requiring session disconnect].
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 19 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-12] 

Implementation Statement: 

AC-12 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.1.11 AC-14 Permitted Actions without Identification or Authentication 

The organization: 

a. Identifies [Assignment: organization-defined user actions] that can be performed on the 

information system without identification or authentication consistent with organizational 

missions/business functions; and 

b. Documents and provides supporting rationale in the security plan for the information system, 

user actions not requiring identification or authentication. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-14] 

Implementation Statement: 

AC-14 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 20 

Comments:

2.1.1.12 AC-17 Remote Access 

The organization: 

a. Establishes and documents usage restrictions, configuration/connection requirements, and 

implementation guidance for each type of remote access allowed; and 

b. Authorizes remote access to the information system prior to allowing such connections. 

Control Enhancements: 

(1) REMOTE ACCESS | AUTOMATED MONITORING / CONTROL 

The information system monitors and controls remote access methods. 

(2) REMOTE ACCESS | PROTECTION OF CONFIDENTIALITY / INTEGRITY USING ENCRYPTION 

The information system implements cryptographic mechanisms to protect the confidentiality and integrity 

of remote access sessions. 

 

(3) REMOTE ACCESS | MANAGED ACCESS CONTROL POINTS 

The information system routes all remote accesses through [Assignment: organization-defined number] 

managed network access control points. 

(4) REMOTE ACCESS | PRIVILEGED COMMANDS / ACCESS 

The organization: 

(a) Authorizes the execution of privileged commands and access to security-relevant 

information via remote access only for [Assignment: organization-defined needs]; and 

(b) Documents the rationale for such access in the security plan for the information system. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-17] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 21 

Implementation Statement: 

AC-17 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AC-17(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-17(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-17(3) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 22 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-17(4) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.1.13 AC-18 Wireless Access 

The organization: 

a. Establishes usage restrictions, configuration/connection requirements, and implementation 

guidance for wireless access; and 

b. Authorizes wireless access to the information system prior to allowing such connections. 

Control Enhancements: 

(1) WIRELESS ACCESS | AUTHENTICATION AND ENCRYPTION 

The information system protects wireless access to the system using authentication of [Selection (one or 

more): users; devices] and encryption. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-18] 

Implementation Statement: 

AC-18 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 23 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AC-18(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.1.14 AC-19 Access Control for Mobile Devices 

The organization: 

a. Establishes usage restrictions, configuration requirements, connection requirements, and 

implementation guidance for organization-controlled mobile devices; and 

b. Authorizes the connection of mobile devices to organizational information systems. 

(5) ACCESS CONTROL FOR MOBILE DEVICES | FULL DEVICE / CONTAINER-BASED 

ENCRYPTION 

The organization employs [Selection: full-device encryption; container encryption] to protect the 

confidentiality and integrity of information on [Assignment: organization-defined mobile devices]. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-19] 

Implementation Statement: 

AC-19 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 24 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AC-19(5) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.1.15 AC-20 Use of External Information Systems 

The organization establishes terms and conditions, consistent with any trust relationships established with 

other organizations owning, operating, and/or maintaining external information systems, allowing 

authorized individuals to: 

a. Access the information system from external information systems; and 

b. Process, store, or transmit organization-controlled information using external information 

systems. 

Control Enhancements: 

(1) USE OF EXTERNAL INFORMATION SYSTEMS | LIMITS ON AUTHORIZED USE 

The organization permits authorized individuals to use an external information system to access the 

information system or to process, store, or transmit organization-controlled information only when the 

organization: 

(a) Verifies the implementation of required security controls on the external system as 

specified in the organization’s information security policy and security plan; or 

(b) Retains approved information system connection or processing agreements with the 

organizational entity hosting the external information system. 

(2) USE OF EXTERNAL INFORMATION SYSTEMS | PORTABLE STORAGE DEVICES 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 25 

The organization [Selection: restricts; prohibits] the use of organization-controlled portable storage 

devices by authorized individuals on external information systems. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-20] 

Implementation Statement: 

AC-20 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AC-20(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement AC-20(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 26 

Comments: 

2.1.1.16 AC-21 Information Sharing 

The organization: 

a. Facilitates information sharing by enabling authorized users to determine whether access 

authorizations assigned to the sharing partner match the access restrictions on the 

information for [Assignment: organization-defined information sharing circumstances where 

user discretion is required]; and 

b. Employs [Assignment: organization-defined automated mechanisms or manual processes] to 

assist users in making information sharing/collaboration decisions. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-21] 

Implementation Statement: 

AC-21 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.1.17 AC-22 Publicly Accessible Content 

The organization: 

a. Designates individuals authorized to post information onto a publicly accessible information 

system; 

b. Trains authorized individuals to ensure that publicly accessible information does not contain 

nonpublic information; 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 27 

c. Reviews the proposed content of information prior to posting onto the publicly accessible 

information system to ensure that nonpublic information is not included; and 

d. Reviews the content on the publicly accessible information system for nonpublic information 

[Assignment: organization-defined frequency] and removes such information, if discovered. 

NIST SP 800-53 Access Control Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [AC-22] 

Implementation Statement: 

AC-22 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.2 Awareness and Training (AT) 

2.1.2.1 AT-1 Security Awareness and Training Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A security awareness and training policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and 

2. Procedures to facilitate the implementation of the security awareness and training policy 

and associated security awareness and training controls; and 

b. Reviews and updates the current: 

1. Security awareness and training policy [Assignment: organization-defined frequency]; 

and 

2. Security awareness and training procedures [Assignment: organization-defined 

frequency]. 

NIST SP 800-53 Awareness and 

Training 

 Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 28 

Revision 4 [AT-1] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: 

AT-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.2.2 AT-2 Security Awareness Training 

The organization provides basic security awareness training to information system users (including 

managers, senior executives, and contractors): 

a. As part of initial training for new users; 

b. When required by information system changes; and 

c. [Assignment: organization-defined frequency] thereafter. 

Control Enhancements: 

(2) SECURITY AWARENESS | INSIDER THREAT 

The organization includes security awareness training on recognizing and reporting potential indicators of 

insider threat. 

NIST SP 800-53 Awareness and 

Training 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AT-2] 

Implementation Statement: 

AT-2 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 29 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AT-2(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.2.3 AT-3 Role-Based Security Training 

The organization provides role-based security training to personnel with assigned security roles and 

responsibilities: 

a. Before authorizing access to the information system or performing assigned duties; 

b. When required by information system changes; and 

c. [Assignment: organization-defined frequency] thereafter. 

NIST SP 800-53 Awareness and 

Training 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AT-3] 

Implementation Statement: 

AT-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 30 

Comments:

2.1.2.4 AT-4 Security Training Records 

The organization: 

a. Documents and monitors individual information system security training activities including 

basic security awareness training and specific information system security training; and 

b. Retains individual training records for [Assignment: organization-defined time period]. 

NIST SP 800-53 Awareness and 

Training 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AT-4] 

Implementation Statement: 

AT-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.3 Audit and Accountability (AU) 

2.1.3.1 AU-1 Audit and Accountability Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. An audit and accountability policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 31 

2. Procedures to facilitate the implementation of the audit and accountability policy and 

associated audit and accountability controls; and 

b. Reviews and updates the current: 

1. Audit and accountability policy [Assignment: organization-defined frequency]; and 

2. Audit and accountability procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-1] 

Implementation Statement: 

AU-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.3.2 AU-2 Audit Events 

The organization: 

a. Determines that the information system is capable of auditing the following events: 

[Assignment: organization-defined auditable events]; 

b. Coordinates the security audit function with other organizational entities requiring auditrelated information to enhance mutual support and to help guide the selection of auditable 

events; 

c. Provides a rationale for why the auditable events are deemed to be adequate to support 

after-the-fact investigations of security incidents; and 

d. Determines that the following events are to be audited within the information system: 

[Assignment: organization-defined audited events (the subset of the auditable events defined 

in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified 

event]. 

Control Enhancements: 

(3) AUDIT EVENTS | REVIEWS AND UPDATES 

The organization reviews and updates the audited events [Assignment: organization-defined frequency]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 32 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-2] 

Implementation Statement: 

AU-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AU-2(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.3.3 AU-3 Content of Audit Records 

The information system generates audit records containing information that establishes what type of 

event occurred, when the event occurred, where the event occurred, the source of the event, the outcome 

of the event, and the identity of any individuals or subjects associated with the event. 

Control Enhancements: 

(1) CONTENT OF AUDIT RECORDS | ADDITIONAL AUDIT INFORMATION 

The information system generates audit records containing the following additional information: 

[Assignment: organization-defined additional, more detailed information]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 33 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-3] 

Implementation Statement: 

AU-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AU-3(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.3.4 AU-4 Audit Storage 

The organization allocates audit record storage capacity in accordance with [Assignment: organizationdefined audit record storage requirements]. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-4] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 34 

Implementation Statement: 

AU-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.3.5 AU-5 Response to Audit Processing Failures 

The information system: 

a. Alerts [Assignment: organization-defined personnel or roles] in the event of an audit 

processing failure; and 

b. Takes the following additional actions: [Assignment: organization-defined actions to be taken 

(e.g., shut down information system, overwrite oldest audit records, stop generating audit 

records)]. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-5] 

Implementation Statement: 

AU-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.3.6 AU-6 Audit Review, Analysis, and Reporting 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 35 

The organization: 

a. Reviews and analyzes information system audit records [Assignment: organization-defined 

frequency] for indications of [Assignment: organization-defined inappropriate or unusual 

activity]; and 

b. Reports findings to [Assignment: organization-defined personnel or roles]. 

Control Enhancements: 

(1) AUDIT REVIEW, ANALYSIS, AND REPORTING | PROCESS INTEGRATION 

The organization employs automated mechanisms to integrate audit review, analysis, and reporting 

processes to support organizational processes for investigation and response to suspicious activities. 

(3) AUDIT REVIEW, ANALYSIS, AND REPORTING | CORRELATE AUDIT REPOSITORIES 

The organization analyzes and correlates audit records across different repositories to gain organizationwide situational awareness. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-6] 

Implementation Statement: 

AU-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AU-6(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 36 

Scoped 

Comments: 

Control Enhancement AU-6(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.3.7 AU-7 Audit Reduction and Report Generation 

The information system provides an audit reduction and report generation capability that: 

a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact 

investigations of security incidents; and 

b. Does not alter the original content or time ordering of audit records. 

Control Enhancements: 

(1) AUDIT REDUCTION AND REPORT GENERATION | AUTOMATIC PROCESSING 

The information system provides the capability to process audit records for events of interest based on 

[Assignment: organization-defined audit fields within audit records]. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-7] 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

AU-7 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 37 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Implementation Statement: 

AU-7(1) 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.3.8 AU-8 Time Stamps 

The information system: 

a. Uses internal system clocks to generate time stamps for audit records; and 

b. Records time stamps for audit records that can be mapped to Coordinated Universal Time 

(UTC) or Greenwich Mean Time (GMT) and meets [Assignment: organization-defined 

granularity of time measurement]. 

Control Enhancements: 

(1) TIME STAMPS | SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE 

The information system: 

(a) Compares the internal information system clocks [Assignment: organization-defined 

frequency] with [Assignment: organization-defined authoritative time source]; and 

(b) Synchronizes the internal system clocks to the authoritative time source when the time difference 

is greater than [Assignment: organization-defined time period]. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 [AU-8] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 38 

 System Specific Control

Implementation Statement: 

AU-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AU-8(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.3.9 AU-9 Protection of Audit Information 

The information system protects audit information and audit tools from unauthorized access, modification, 

and deletion. 

Control Enhancements: 

(4) PROTECTION OF AUDIT INFORMATION | ACCESS BY SUBSET OF PRIVILEGED USERS 

The organization authorizes access to management of audit functionality to only [Assignment: 

organization-defined subset of privileged users]. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 39 

Revision 4 [AU-9] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: 

AU-9 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement AU-9(4) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.3.10 AU-11 Audit Record Retention 

The organization retains audit records for [Assignment: organization-defined time period consistent with 

records retention policy] to provide support for after-the-fact investigations of security incidents and to 

meet regulatory and organizational information retention requirements. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-11] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 40 

Implementation Statement: 

AU-11 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.3.11 AU-12 Audit Generation 

The information system: 

a. Provides audit record generation capability for the auditable events defined in AU-2 a. at 

[Assignment: organization-defined information system components]; 

b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events 

are to be audited by specific components of the information system; and 

c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3. 

NIST SP 800-53 Audit and 

Accountability 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [AU-12] 

Implementation Statement: 

AU-12 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.4 Security Assessment and Authorization (CA) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 41 

2.1.4.1 CA-1 Security Assessment and Authorization Policies and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A security assessment and authorization policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and 

2. Procedures to facilitate the implementation of the security assessment and authorization 

policy and associated security assessment and authorization controls; and 

b. Reviews and updates the current: 

1. Security assessment and authorization policy [Assignment: organization-defined 

frequency]; and 

2. Security assessment and authorization procedures [Assignment: organization-defined 

frequency]. 

NIST SP 800-53 Security Assessment 

and Authorization 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CA-1] 

Implementation Statement: 

CA-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.4.2 CA-2 Security Assessments 

The organization: 

a. Develops a security assessment plan that describes the scope of the assessment including: 

1. Security controls and control enhancements under assessment; 

2. Assessment procedures to be used to determine security control effectiveness; and 

3. Assessment environment, assessment team, and assessment roles and responsibilities; 

b. Assesses the security controls in the information system and its environment of operation 

[Assignment: organization-defined frequency] to determine the extent to which the controls 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 42 

are implemented correctly, operating as intended, and producing the desired outcome with 

respect to meeting established security requirements; 

c. Produces a security assessment report that documents the results of the assessment; and 

d. Provides the results of the security control assessment to [Assignment: organization-defined 

individuals or roles]. 

Control Enhancements: 

(1) SECURITY ASSESSMENTS | INDEPENDENT ASSESSORS 

The organization employs assessors or assessment teams with [Assignment: organization-defined level 

of independence] to conduct security control assessments. 

NIST SP 800-53 Security Assessment 

and Authorization 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CA-2] 

Implementation Statement: 

CA-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CA-2(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 43 

2.1.4.3 CA-3 System Interconnections 

The organization: 

a. Authorizes connections from the information system to other information systems through the 

use of Interconnection Security Agreements; 

b. Documents, for each interconnection, the interface characteristics, security requirements, and 

the nature of the information communicated; and 

c. Reviews and updates Interconnection Security Agreements [Assignment: organizationdefined frequency]. 

Control Enhancements: 

(5) SYSTEM INTERCONNECTIONS | RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS 

The organization employs [Selection: allow-all, deny-by-exception; deny-all, permit-by-exception] policy 

for allowing [Assignment: organization-defined information systems] to connect to external information 

systems. 

NIST SP 800-53 Security Assessment 

and Authorization 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CA-3] 

Implementation Statement: 

CA-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CA-3(5) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 44 

Scoped 

Comments: 

2.1.4.4 CA-5 Plan of Action and Milestones 

The organization: 

a. Develops a plan of action and milestones for the information system to document the 

organization’s planned remedial actions to correct weaknesses or deficiencies noted during 

the assessment of the security controls and to reduce or eliminate known vulnerabilities in 

the system; and 

b. Updates existing plan of action and milestones [Assignment: organization-defined frequency] 

based on the findings from security controls assessments, security impact analyses, and 

continuous monitoring activities. 

NIST SP 800-53 Security Assessment 

and Authorization 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CA-5] 

Implementation Statement: 

CA-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.4.5 CA-6 Security Authorization 

The organization: 

a. Assigns a senior-level executive or manager as the authorizing official for the information 

system; 

b. Ensures that the authorizing official authorizes the information system for processing before 

commencing operations; and 

c. Updates the security authorization [Assignment: organization-defined frequency]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 45 

NIST SP 800-53 Security Assessment 

and Authorization 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CA-6] 

Implementation Statement: 

CA-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.4.6 CA-7 Continuous Monitoring 

The organization develops a continuous monitoring strategy and implements a continuous monitoring 

program that includes: 

a. Establishment of [Assignment: organization-defined metrics] to be monitored; 

b. Establishment of [Assignment: organization-defined frequencies] for monitoring and 

[Assignment: organization-defined frequencies] for assessments supporting such monitoring; 

c. Ongoing security control assessments in accordance with the organizational continuous 

monitoring strategy; 

d. Ongoing security status monitoring of organization-defined metrics in accordance with the 

organizational continuous monitoring strategy; 

e. Correlation and analysis of security-related information generated by assessments and 

monitoring; 

f. Response actions to address results of the analysis of security-related information; and 

g. Reporting the security status of organization and the information system to [Assignment: 

organization-defined personnel or roles] [Assignment: organization-defined frequency]. 

Control Enhancements: 

(1) CONTINUOUS MONITORING | INDEPENDENT ASSESSMENT 

The organization employs assessors or assessment teams with [Assignment: organization-defined level 

of independence] to monitor the security controls in the information system on an ongoing basis. 

NIST SP 800-53 Security Assessment 

and Authorization 

 Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 46 

Revision 4 [CA-7] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: 

CA-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CA-7(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.4.7 CA-9 Internal System Connections 

The organization: 

a. Authorizes internal connections of [Assignment: organization-defined information system 

components or classes of components] to the information system; and 

b. Documents, for each internal connection, the interface characteristics, security requirements, 

and the nature of the information communicated. 

NIST SP 800-53 Security Assessment 

and Authorization 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CA-9] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 47 

Implementation Statement: 

CA-9 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.5 Configuration Management (CM) 

2.1.5.1 CM-1 Configuration Management Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A configuration management policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and 

2. Procedures to facilitate the implementation of the configuration management policy and 

associated configuration management controls; and 

b. Reviews and updates the current: 

1. Configuration management policy [Assignment: organization-defined frequency]; and 

2. Configuration management procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-1] 

Implementation Statement: 

CM-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 48 

Comments:

2.1.5.2 CM-2 Baseline Configuration 

The organization develops, documents, and maintains under configuration control, a current baseline 

configuration of the information system. 

Control Enhancements: 

(1) BASELINE CONFIGURATION | REVIEWS AND UPDATES 

The organization reviews and updates the baseline configuration of the information system: 

(a) [Assignment: organization-defined frequency]; 

(b) When required due to [Assignment organization-defined circumstances]; and 

(c) As an integral part of information system component installations and upgrades. 

(3) BASELINE CONFIGURATION | RETENTION OF PREVIOUS CONFIGURATIONS 

The organization retains [Assignment: organization-defined previous versions of baseline configurations 

of the information system] to support rollback. 

(7) BASELINE CONFIGURATION | CONFIGURE SYSTEMS, COMPONENTS, OR DEVICES FOR 

HIGH-RISK AREAS 

The organization: 

(a) Issues [Assignment: organization-defined information systems, system components, or 

devices] with [Assignment: organization-defined configurations] to individuals traveling to 

locations that the organization deems to be of significant risk; and 

(b) Applies [Assignment: organization-defined security safeguards] to the devices when the 

individuals return. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-2] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 49 

Implementation Statement: 

CM-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CM-2(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CM-2(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CM-2(7) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 50 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.5.3 CM-3 Configuration Change Control 

The organization: 

a. Determines the types of changes to the information system that are configuration-controlled; 

b. Reviews proposed configuration-controlled changes to the information system and approves 

or disapproves such changes with explicit consideration for security impact analyses; 

c. Documents configuration change decisions associated with the information system; 

d. Implements approved configuration-controlled changes to the information system; 

e. Retains records of configuration-controlled changes to the information system for 

[Assignment: organization-defined time period]; 

f. Audits and reviews activities associated with configuration-controlled changes to the 

information system; and 

g. Coordinates and provides oversight for configuration change control activities through 

[Assignment: organization-defined configuration change control element (e.g., committee, 

board] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; 

[Assignment: organization-defined configuration change conditions]]. 

Control Enhancements: 

(2) CONFIGURATION CHANGE CONTROL | TEST / VALIDATE / DOCUMENT CHANGES 

The organization tests, validates, and documents changes to the information system before implementing 

the changes on the operational system. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-3] 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

CM-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 51 

Scoped 

Comments:

Control Enhancement CM-3(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.5.4 CM-4 Security Impact Analysis 

The organization analyzes changes to the information system to determine potential security impacts 

prior to change implementation. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-4] 

Implementation Statement: 

CM-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 52 

2.1.5.5 CM-5 Access Restrictions for Change 

The organization defines documents, approves, and enforces physical and logical access restrictions 

associated with changes to the information system. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-5] 

Implementation Statement: 

CM-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.5.6 CM-6 Configuration Settings 

The organization: 

a. Establishes and documents configuration settings for information technology products 

employed within the information system using [Assignment: organization-defined security 

configuration checklists] that reflect the most restrictive mode consistent with operational 

requirements; 

b. Implements the configuration settings; 

c. Identifies, documents, and approves any deviations from established configuration settings 

for [Assignment: organization-defined information system components] based on 

[Assignment: organization-defined operational requirements]; and 

d. Monitors and controls changes to the configuration settings in accordance with organizational 

policies and procedures. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-6] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 53 

Implementation Statement: 

CM-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.5.7 CM-7 Least Functionality 

The organization: 

a. Configures the information system to provide only essential capabilities; and 

b. Prohibits or restricts the use of the following functions, ports, protocols, and/or services: 

[Assignment: organization-defined prohibited or restricted functions, ports, protocols, 

and/or services]. 

Control Enhancements: 

(1) LEAST FUNCTIONALITY | PERIODIC REVIEW 

The organization: 

(a) Reviews the information system [Assignment: organization-defined frequency] to identify 

unnecessary and/or nonsecure functions, ports, protocols, and services; and 

(b) Disables [Assignment: organization-defined functions, ports, protocols, and services 

within the information system deemed to be unnecessary and/or nonsecure]. 

(2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION 

The information system prevents program execution in accordance with [Selection (one or more): 

[Assignment: organization-defined policies regarding software program usage and restrictions]; rules 

authorizing the terms and conditions of software program usage]. 

(4) LEAST FUNCTIONALITY | UNAUTHORIZED SOFTWARE / BLACKLISTING 

The organization: 

(a) Identifies [Assignment: organization-defined software programs not authorized to execute 

on the information system]; 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 54 

(b) Employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized 

software programs on the information system; and 

(c) Reviews and updates the list of unauthorized software programs [Assignment: organizationdefined frequency]. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-7] 

Implementation Statement: 

CM-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CM-7(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CM-7(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 55 

Comments: 

Control Enhancement CM-7(4) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.5.8 CM-8 Information System Component Inventory 

The organization: 

a. Develops and documents an inventory of information system components that: 

1. Accurately reflects the current information system; 

2. Includes all components within the authorization boundary of the information system; 

3. Is at the level of granularity deemed necessary for tracking and reporting; and 

4. Includes [Assignment: organization-defined information deemed necessary to achieve 

effective information system component accountability]; and 

b. Reviews and updates the information system component inventory [Assignment: 

organization-defined frequency]. 

Control Enhancements: 

(1) INFORMATION SYSTEM COMPONENT INVENTORY | UPDATES DURING INSTALLATIONS / 

REMOVALS 

The organization updates the inventory of information system components as an integral part of 

component installations, removals, and information system updates. 

(3) INFORMATION SYSTEM COMPONENT INVENTORY | AUTOMATED UNAUTHORIZED 

COMPONENT DETECTION 

The organization: 

(a) Employs automated mechanisms [Assignment: organization-defined frequency] to detect 

the presence of unauthorized hardware, software, and firmware components within the 

information system; and 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 56 

(b) Takes the following actions when unauthorized components are detected: [Selection (one 

or more): disables network access by such components; isolates the components; notifies 

[Assignment: organization-defined personnel or roles]]. 

(5) INFORMATION SYSTEM COMPONENT INVENTORY | NO DUPLICATE ACCOUNTING OF 

COMPONENTS 

The organization verifies that all components within the authorization boundary of the information system 

are not duplicated in other information system inventories. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-8] 

Implementation Statement: 

CM-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CM-8(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CM-8(3) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 57 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CM-8(5) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.5.9 CM-9 Configuration Management Plan 

The organization develops, documents, and implements a configuration management plan for the 

information system that: 

a. Addresses roles, responsibilities, and configuration management processes and procedures; 

b. Establishes a process for identifying configuration items throughout the system development 

life cycle and for managing the configuration of the configuration items; 

c. Defines the configuration items for the information system and places the configuration items 

under configuration management; and 

d. Protects the configuration management plan from unauthorized disclosure and modification. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-9] 

Implementation Statement: 

CM-9 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 58 

Scoped 

Comments:

2.1.5.10 CM-10 Software Usage Restrictions 

The organization: 

a. Uses software and associated documentation in accordance with contract agreements and 

copyright laws; 

b. Tracks the use of software and associated documentation protected by quantity licenses to 

control copying and distribution; and 

c. Controls and documents the use of peer-to-peer file sharing technology to ensure that this 

capability is not used for the unauthorized distribution, display, performance, or reproduction 

of copyrighted work. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-10] 

Implementation Statement: 

CM-10 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.5.11 CM-11 User-Installed Software 

The organization: 

a. Establishes [Assignment: organization-defined policies] governing the installation of 

software by users; 

b. Enforces software installation policies through [Assignment: organization-defined 

methods]; and 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 59 

c. Monitors policy compliance at [Assignment: organization-defined frequency]. 

NIST SP 800-53 Configuration 

Management 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [CM-11] 

Implementation Statement: 

CM-11 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.6 Contingency Planning (CP) 

2.1.6.1 CP-1 Contingency Planning Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A contingency planning policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and 

2. Procedures to facilitate the implementation of the contingency planning policy and 

associated contingency planning controls; and 

b. Reviews and updates the current: 

1. Contingency planning policy [Assignment: organization-defined frequency]; and 

2. Contingency planning procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-1] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 60 

Implementation Statement: 

CP-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.6.2 CP-2 Contingency Plan 

The organization: 

a. Develops a contingency plan for the information system that: 

1. Identifies essential missions and business functions and associated contingency 

requirements; 

2. Provides recovery objectives, restoration priorities, and metrics; 

3. Addresses contingency roles, responsibilities, assigned individuals with contact 

information; 

4. Addresses maintaining essential missions and business functions despite an information 

system disruption, compromise, or failure; 

5. Addresses eventual, full information system restoration without deterioration of the 

security safeguards originally planned and implemented; and 

6. Is reviewed and approved by [Assignment: organization-defined personnel or roles]; 

b. Distributes copies of the contingency plan to [Assignment: organization-defined key 

contingency personnel (identified by name and/or by role) and organizational elements]; 

c. Coordinates contingency planning activities with incident handling activities; 

d. Reviews the contingency plan for the information system [Assignment: organization-defined 

frequency]; 

e. Updates the contingency plan to address changes to the organization, information system, or 

environment of operation and problems encountered during contingency plan 

implementation, execution, or testing; 

f. Communicates contingency plan changes to [Assignment: organization-defined key 

contingency personnel (identified by name and/or by role) and organizational elements]; and 

g. Protects the contingency plan from unauthorized disclosure and modification. 

Control Enhancements: 

(1) CONTINGENCY PLAN | COORDINATE WITH RELATED PLANS 

The organization coordinates contingency plan development with organizational elements responsible for 

related plans. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 61 

(3) CONTINGENCY PLAN | RESUME ESSENTIAL MISSIONS / BUSINESS FUNCTIONS 

The organization plans for the resumption of essential missions and business functions within 

[Assignment: organization-defined time period] of contingency plan activation. 

(8) CONTINGENCY PLAN | IDENTIFY CRITICAL ASSETS 

The organization identifies critical information system assets supporting essential missions and business 

functions. 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-2] 

Implementation Statement: 

CP-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CP-2(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CP-2(3) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 62 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CP-2(8) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.6.3 CP-3 Contingency Training 

The organization provides contingency training to information system users consistent with assigned roles 

and responsibilities: 

a. Within [Assignment: organization-defined time period] of assuming a contingency role or 

responsibility; 

b. When required by information system changes; and 

c. [Assignment: organization-defined frequency] thereafter. 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-3] 

Implementation Statement: 

CP-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 63 

Comments:

2.1.6.4 CP-4 Contingency Plan Testing 

The organization: 

a. Tests the contingency plan for the information system [Assignment: organization-defined 

frequency] using [Assignment: organization-defined tests] to determine the effectiveness of 

the plan and the organizational readiness to execute the plan; 

b. Reviews the contingency plan test results; and 

c. Initiates corrective actions, if needed. 

Control Enhancements: 

(1) CONTINGENCY PLAN TESTING | COORDINATE WITH RELATED PLANS 

The organization coordinates contingency plan testing with organizational elements responsible for 

related plans. 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-4] 

Implementation Statement: 

CP-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CP-4(1) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 64 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.6.5 CP-6 Alternate Storage Site 

The organization: 

a. Establishes an alternate storage site including necessary agreements to permit the storage 

and retrieval of information system backup information; and 

b. Ensures that the alternate storage site provides information security safeguards equivalent to 

that of the primary site. 

Control Enhancements: 

(1) ALTERNATE STORAGE SITE | SEPARATION FROM PRIMARY SITE 

The organization identifies an alternate storage site that is separated from the primary storage site to 

reduce susceptibility to the same threats. 

. 

(3) ALTERNATE STORAGE SITE | ACCESSIBILITY 

The organization identifies potential accessibility problems to the alternate storage site in the event of an 

area-wide disruption or disaster and outlines explicit mitigation actions. 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-6] 

Implementation Statement: 

CP-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 65 

Comments:

Control Enhancement CP-6(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CP-6(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.6.6 CP-7 Alternate Processing Site 

The organization: 

a. Establishes an alternate processing site including necessary agreements to permit the 

transfer and resumption of [Assignment: organization-defined information system operations] 

for essential missions/business functions within [Assignment: organization-defined time 

period consistent with recovery time and recovery point objectives] when the primary 

processing capabilities are unavailable; 

b. Ensures that equipment and supplies required to transfer and resume operations are 

available at the alternate processing site or contracts are in place to support delivery to the 

site within the organization-defined time period for transfer/resumption; and 

c. Ensures that the alternate processing site provides information security safeguards 

equivalent to that of the primary site. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 66 

Control Enhancements: 

(1) ALTERNATE PROCESSING SITE | SEPARATION FROM PRIMARY SITE 

The organization identifies an alternate processing site that is separated from the primary processing site 

to reduce susceptibility to the same threats. 

(2) ALTERNATE PROCESSING SITE | ACCESSIBILITY 

The organization identifies potential accessibility problems to the alternate processing site in the event of 

an area-wide disruption or disaster and outlines explicit mitigation actions. 

(3) ALTERNATE PROCESSING SITE | PRIORITY OF SERVICE 

The organization develops alternate processing site agreements that contain priority-of-service provisions 

in accordance with organizational availability requirements (including recovery time objectives). 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-7] 

Implementation Statement: 

CP-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CP-7(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 67 

Comments: 

Control Enhancement CP-7(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement CP-7(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.6.7 CP-8 Telecommunications Services 

The organization establishes alternate telecommunications services including necessary agreements to 

permit the resumption of [Assignment: organization-defined information system operations] for essential 

missions and business functions within [Assignment: organization-defined time period] when the primary 

telecommunications capabilities are unavailable at either the primary or alternate processing or storage 

sites. 

Control Enhancements: 

(1) TELECOMMUNICATIONS SERVICES | PRIORITY OF SERVICE PROVISIONS 

The organization: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 68 

(a) Develops primary and alternate telecommunications service agreements that contain priorityof-service provisions in accordance with organizational availability requirements (including 

recovery time objectives); and 

(b) Requests Telecommunications Service Priority for all telecommunications services used for 

national security emergency preparedness in the event that the primary and/or alternate 

telecommunications services are provided by a common carrier. 

(2) TELECOMMUNICATIONS SERVICES | SINGLE POINTS OF FAILURE 

The organization obtains alternate telecommunications services to reduce the likelihood of sharing a 

single point of failure with primary telecommunications services. 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-8] 

Implementation Statement: 

CP-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Implementation Statement: 

CP-8(1) 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 69 

Implementation Statement: 

CP-8(2) 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.6.8 CP-9 Information System Backup 

The organization: 

a. Conducts backups of user-level information contained in the information system [Assignment: 

organization-defined frequency consistent with recovery time and recovery point objectives]; 

b. Conducts backups of system-level information contained in the information system 

[Assignment: organization-defined frequency consistent with recovery time and recovery 

point objectives]; 

c. Conducts backups of information system documentation including security-related 

documentation [Assignment: organization-defined frequency consistent with recovery time 

and recovery point objectives]; and 

d. Protects the confidentiality, integrity, and availability of backup information at storage 

locations. 

Control Enhancements: 

(1) INFORMATION SYSTEM BACKUP | TESTING FOR RELIABILITY / INTEGRITY 

The organization tests backup information [Assignment: organization-defined frequency] to verify media 

reliability and information integrity. 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-9] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 70 

Implementation Statement: 

CP-9 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement CP-9(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.6.9 CP-10 Information System Recovery and Reconstitution 

The organization provides for the recovery and reconstitution of the information system to a known state 

after a disruption, compromise, or failure. 

Control Enhancements: 

(2) INFORMATION SYSTEM RECOVERY AND RECONSTITUTION | TRANSACTION RECOVERY 

The information system implements transaction recovery for systems that are transaction-based. 

NIST SP 800-53 Contingency Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [CP-10] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 71 

Implementation Statement: 

CP-10 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Implementation Statement: 

CP-10(2) 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.7 Identification and Authentication (IA) 

2.1.7.1 IA-1 Identification and Authentication Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. An identification and authentication policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and 

2. Procedures to facilitate the implementation of the identification and authentication policy 

and associated identification and authentication controls; and 

b. Reviews and updates the current: 

1. Identification and authentication policy [Assignment: organization-defined frequency]; and 

2. Identification and authentication procedures [Assignment: organization-defined 

frequency]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 72 

NIST SP 800-53 Identification and 

Authentication 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [IA-1] 

Implementation Statement: 

IA-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.7.2 IA-2 Identification and Authentication 

The information system uniquely identifies and authenticates organizational users (or processes acting on 

behalf of organizational users). 

Control Enhancements: 

(1) IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO PRIVILEGED ACCOUNTS 

The information system implements multifactor authentication for network access to privileged accounts. 

(2) IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO NON-PRIVILEGED 

ACCOUNTS 

The information system implements multifactor authentication for network access to non-privileged 

accounts. 

(3) IDENTIFICATION AND AUTHENTICATION | LOCAL ACCESS TO PRIVILEGED ACCOUNTS 

The information system implements multifactor authentication for local access to privileged accounts. 

(8) IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO PRIVILEGED ACCOUNTS - 

REPLAY RESISTANT 

The information system implements replay-resistant authentication mechanisms for network access to 

privileged accounts. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 73 

(11) IDENTIFICATION AND AUTHENTICATION | REMOTE ACCESS - SEPARATE DEVICE 

The information system implements multifactor authentication for remote access to privileged and nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining 

access and the device meets [Assignment: organization-defined strength of mechanism requirements]. 

(12) IDENTIFICATION AND AUTHENTICATION | ACCEPTANCE OF PIV CREDENTIALS 

The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials. 

NIST SP 800-53 Identification and 

Authentication 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [IA-2] 

Implementation Statement: 

IA-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement IA-2(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement IA-2(2) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 74 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement IA-2(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement IA-2(8) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement IA-2(11) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 75 

Comments: 

Control Enhancement IA-2(12) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.7.3 IA-3 Device Identification and Authentication 

The information system uniquely identifies and authenticates [Assignment: organization-defined specific 

and/or types of devices] before establishing a [Selection (one or more): local; remote; network] 

connection. 

NIST SP 800-53 Identification and 

Authentication 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [IA-3] 

Implementation Statement: 

IA-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 76 

2.1.7.4 IA-4 Identifier Management 

The organization manages information system identifiers by: 

a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign 

an individual, group, role, or device identifier; 

b. Selecting an identifier that identifies an individual, group, role, or device; 

c. Assigning the identifier to the intended individual, group, role, or device; 

d. Preventing reuse of identifiers for [Assignment: organization-defined time period]; and 

e. Disabling the identifier after [Assignment: organization-defined time period of inactivity]. 

NIST SP 800-53 Identification and 

Authentication 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [IA-4] 

Implementation Statement: 

IA-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.7.5 IA-5 Authenticator Management 

The organization manages information system authenticators by: 

a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, 

role, or device receiving the authenticator; 

b. Establishing initial authenticator content for authenticators defined by the organization; 

c. Ensuring that authenticators have sufficient strength of mechanism for their intended use; 

d. Establishing and implementing administrative procedures for initial authenticator distribution, 

for lost/compromised or damaged authenticators, and for revoking authenticators; 

e. Changing default content of authenticators prior to information system installation; 

f. Establishing minimum and maximum lifetime restrictions and reuse conditions for 

authenticators; 

g. Changing/refreshing authenticators [Assignment: organization-defined time period by 

authenticator type]; 

h. Protecting authenticator content from unauthorized disclosure and modification; 

i. Requiring individuals to take, and having devices implement, specific security safeguards to 

protect authenticators; and 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 77 

j. Changing authenticators for group/role accounts when membership to those accounts 

changes. 

Control Enhancements: 

 

(1) AUTHENTICATOR MANAGEMENT | PASSWORD-BASED AUTHENTICATION 

The information system, for password-based authentication: 

a. Enforces minimum password complexity of [Assignment: organization-defined requirements 

for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, 

numbers, and special characters, including minimum requirements for each type]; 

b. Enforces at least the following number of changed characters when new passwords are 

created: [Assignment: organization-defined number]; 

c. Stores and transmits only encrypted representations of passwords; 

d. Enforces password minimum and maximum lifetime restrictions of [Assignment: organizationdefined numbers for lifetime minimum, lifetime maximum]; 

e. Prohibits password reuse for [Assignment: organization-defined number] generations; and 

f. Allows the use of a temporary password for system logons with an immediate change to a 

permanent password. 

(2) AUTHENTICATOR MANAGEMENT | PKI-BASED AUTHENTICATION 

The information system, for PKI-based authentication: 

a. Validates certifications by constructing and verifying a certification path to an accepted trust 

anchor including checking certificate status information; 

b. Enforces authorized access to the corresponding private key; 

c. Maps the authenticated identity to the account of the individual or group; and 

d. Implements a local cache of revocation data to support path discovery and validation in case 

of inability to access revocation information via the network. 

(3) AUTHENTICATOR MANAGEMENT | IN-PERSON OR TRUSTED THIRD-PARTY REGISTRATION 

The organization requires that the registration process to receive [Assignment: organization-defined types 

of and/or specific authenticators] be conducted [Selection: in person; by a trusted third party] before 

[Assignment: organization-defined registration authority] with authorization by [Assignment: organizationdefined personnel or roles]. 

(11) AUTHENTICATOR MANAGEMENT | HARDWARE TOKEN-BASED AUTHENTICATION 

The information system, for hardware token-based authentication, employs mechanisms that satisfy 

[Assignment: organization-defined token quality requirements]. 

NIST SP 800-53 Identification and 

Authentication 

 Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 78 

Revision 4 [IA-5] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: 

IA-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement IA-5(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement IA-5(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 79 

Control Enhancement IA-5(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement IA-5(11) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.7.6 IA-6 Authenticator Feedback 

The information system obscures feedback of authentication information during the authentication 

process to protect the information from possible exploitation/use by unauthorized individuals. 

NIST SP 800-53 Identification and 

Authentication 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [IA-6] 

Implementation Statement: 

IA-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 80 

Scoped 

Comments:

2.1.7.7 IA-7 Cryptographic Module Authentication 

The information system implements mechanisms for authentication to a cryptographic module that meet 

the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, 

and guidance for such authentication. 

NIST SP 800-53 Identification and 

Authentication 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [IA-7] 

Implementation Statement: 

IA-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.7.8 IA-8 Identification and Authentication (Non-Organizational Users) 

The information system uniquely identifies and authenticates non-organizational users (or processes 

acting on behalf of non-organizational users). 

Control Enhancements: 

(1) IDENTIFICATION AND AUTHENTICATION | ACCEPTANCE OF PIV CREDENTIALS FROM 

OTHER AGENCIES 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 81 

The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials 

from other federal agencies. 

(2) IDENTIFICATION AND AUTHENTICATION | ACCEPTANCE OF THIRD-PARTY 

CREDENTIALS 

The information system accepts only FICAM-approved third-party credentials. 

(3) IDENTIFICATION AND AUTHENTICATION | USE OF FICAM-APPROVED PRODUCTS 

The organization employs only FICAM-approved information system components in [Assignment: 

organization-defined information systems] to accept third-party credentials. 

(4) IDENTIFICATION AND AUTHENTICATION | USE OF FICAM-ISSUED PROFILES 

The information system conforms to FICAM-issued profiles. 

NIST SP 800-53 Identification and 

Authentication 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [IA-8] 

Implementation Statement: 

IA-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement IA-8(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 82 

Comments: 

Control Enhancement IA-8(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement IA-8(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement IA-8(4) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.8 Incident Response (IR) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 83 

2.1.8.1 IR-1 Incident Response Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. An incident response policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and 

2. Procedures to facilitate the implementation of the incident response policy and 

associated incident response controls; and 

b. Reviews and updates the current: 

1. Incident response policy [Assignment: organization-defined frequency]; and 

2. Incident response procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Incident Response Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [IR-1] 

Implementation Statement: 

IR-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.8.2 IR-2 Incident Response Training 

The organization provides incident response training to information system users consistent with 

assigned roles and responsibilities: 

a. Within [Assignment: organization-defined time period] of assuming an incident response role 

or responsibility; 

b. When required by information system changes; and 

c. [Assignment: organization-defined frequency] thereafter. 

NIST SP 800-53 Incident Response Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [IR-2] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 84 

Implementation Statement: 

IR-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.8.3 IR-3 Incident Response Testing 

The organization tests the incident response capability for the information system [Assignment: 

organization-defined frequency] using [Assignment: organization-defined tests] to determine the incident 

response effectiveness and documents the results. 

Control Enhancements: 

(2) INCIDENT RESPONSE TESTING | COORDINATION WITH RELATED PLANS 

The organization coordinates incident response testing with organizational elements responsible for 

related plans. 

NIST SP 800-53 Incident Response Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [IR-3] 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

IR-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 85 

Comments:

Control Enhancement IR-3(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.8.4 IR-4 Incident Handling 

The organization: 

a. Implements an incident handling capability for security incidents that includes preparation, 

detection and analysis, containment, eradication, and recovery; 

b. Coordinates incident handling activities with contingency planning activities; and 

c. Incorporates lessons learned from ongoing incident handling activities into incident response 

procedures, training, and testing/exercises, and implements the resulting changes 

accordingly. 

Control Enhancements: 

(1) INCIDENT HANDLING | AUTOMATED INCIDENT HANDLING PROCESSES 

The organization employs automated mechanisms to support the incident handling process. 

NIST SP 800-53 Incident Response Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [IR-4] 

Implementation Statement: 

IR-4 

Implementation Status: Status (check all that apply): 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 86 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement IR-4(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.8.5 IR-5 Incident Monitoring 

The organization tracks and documents information system security incidents. 

NIST SP 800-53 Incident Response Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [IR-5] 

Implementation Statement: 

IR-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 87 

2.1.8.6 IR-6 Incident Reporting 

The organization: 

a. Requires personnel to report suspected security incidents to the organizational incident 

response capability within [Assignment: organization-defined time period]; and 

b. Reports security incident information to [Assignment: organization-defined authorities]. 

Control Enhancements: 

(1) INCIDENT REPORTING | AUTOMATED REPORTING 

The organization employs automated mechanisms to assist in the reporting of security incidents. 

NIST SP 800-53 Incident Response Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [IR-6] 

Implementation Statement: 

IR-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement IR-6(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 88 

2.1.8.7 IR-7 Incident Response Assistance 

The organization provides an incident response support resource, integral to the organizational incident 

response capability that offers advice and assistance to users of the information system for the handling 

and reporting of security incidents. 

Control Enhancements: 

(1) INCIDENT RESPONSE ASSISTANCE | AUTOMATION SUPPORT FOR AVAILABILITY OF 

INFORMATION / SUPPORT 

The organization employs automated mechanisms to increase the availability of incident response-related 

information and support. 

NIST SP 800-53 Incident Response Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [IR-7] 

Implementation Statement: 

IR-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement IR-7(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 89 

2.1.8.8 IR-8 Incident Response Plan 

The organization: 

a. Develops an incident response plan that: 

1. Provides the organization with a roadmap for implementing its incident response 

capability; 

2. Describes the structure and organization of the incident response capability; 

3. Provides a high-level approach for how the incident response capability fits into the 

overall organization; 

4. Meets the unique requirements of the organization, which relate to mission, size, 

structure, and functions; 

5. Defines reportable incidents; 

6. Provides metrics for measuring the incident response capability within the 

organization; 

7. Defines the resources and management support needed to effectively maintain and 

mature an incident response capability; and 

8. Is reviewed and approved by [Assignment: organization-defined personnel or roles]; 

b. Distributes copies of the incident response plan to [Assignment: organization-defined incident 

response personnel (identified by name and/or by role) and organizational elements]; 

c. Reviews the incident response plan [Assignment: organization-defined frequency]; 

d. Updates the incident response plan to address system/organizational changes or problems 

encountered during plan implementation, execution, or testing; 

e. Communicates incident response plan changes to [Assignment: organization-defined incident 

response personnel (identified by name and/or by role) and organizational elements]; and 

f. Protects the incident response plan from unauthorized disclosure and modification. 

NIST SP 800-53 Incident Response Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [IR-8] 

Implementation Statement: 

IR-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.9 Maintenance (MA) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 90 

2.1.9.1 MA-1 System Maintenance Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A system maintenance policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and 

2. Procedures to facilitate the implementation of the system maintenance policy and 

associated system maintenance controls; and 

b. Reviews and updates the current: 

1. System maintenance policy [Assignment: organization-defined frequency]; and 

2. System maintenance procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Maintenance Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MA-1] 

Implementation Statement: 

MA-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.9.2 MA-2 Controlled Maintenance 

The organization: 

a. Schedules, performs, documents, and reviews records of maintenance and repairs on 

information system components in accordance with manufacturer or vendor specifications 

and/or organizational requirements; 

b. Approves and monitors all maintenance activities, whether performed on site or remotely and 

whether the equipment is serviced on site or removed to another location; 

c. Requires that [Assignment: organization-defined personnel or roles] explicitly approve the 

removal of the information system or system components from organizational facilities for offsite maintenance or repairs; 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 91 

d. Sanitizes equipment to remove all information from associated media prior to removal from 

organizational facilities for off-site maintenance or repairs; 

e. Checks all potentially impacted security controls to verify that the controls are still functioning 

properly following maintenance or repair actions; and 

f. Includes [Assignment: organization-defined maintenance-related information] in 

organizational maintenance records. 

NIST SP 800-53 Maintenance Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MA-2] 

Implementation Statement: 

MA-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.9.3 MA-3 Maintenance Tools 

The organization approves, controls, and monitors information system maintenance tools. 

Control Enhancements: 

(1) MAINTENANCE TOOLS | INSPECT TOOLS 

The organization inspects the maintenance tools carried into a facility by maintenance personnel for 

improper or unauthorized modifications. 

(2) MAINTENANCE TOOLS | INSPECT MEDIA 

The organization checks media containing diagnostic and test programs for malicious code before the 

media are used in the information system. 

NIST SP 800-53 Maintenance Common (Fully Inherited Control) 

Revision 4 Hybrid (Partially Inherited Control) [MA-3] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 92 

 System Specific Control

Implementation Statement: 

MA-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement MA-3(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.9.4 MA-4 Nonlocal Maintenance 

The organization: 

a. Approves and monitors nonlocal maintenance and diagnostic activities; 

b. Allows the use of nonlocal maintenance and diagnostic tools only as consistent with 

organizational policy and documented in the security plan for the information system; 

Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions; 

Maintains records for nonlocal maintenance and diagnostic activities; and terminates session and network 

connections when nonlocal maintenance is completed. 

Control Enhancements: 

(2) NONLOCAL MAINTENANCE | DOCUMENT NONLOCAL MAINTENANCE 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 93 

The organization documents in the security plan for the information system, the policies and procedures 

for the establishment and use of nonlocal maintenance and diagnostic connections. 

NIST SP 800-53 Maintenance Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MA-4] 

Implementation Statement: 

MA-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement MA-4(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.9.5 MA-5 Maintenance Personnel 

The organization: 

a. Establishes a process for maintenance personnel authorization and maintains a list of 

authorized maintenance organizations or personnel; 

b. Ensures that non-escorted personnel performing maintenance on the information system 

have required access authorizations; and 

c. Designates organizational personnel with required access authorizations and technical 

competence to supervise the maintenance activities of personnel who do not possess the 

required access authorizations. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 94 

NIST SP 800-53 Maintenance Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MA-5] 

Implementation Statement: 

MA-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.9.6 MA-6 Timely Maintenance 

The organization obtains maintenance support and/or spare parts for [Assignment: organization-defined 

information system components] within [Assignment: organization-defined time period] of failure. 

NIST SP 800-53 Maintenance Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MA-6] 

Implementation Statement: 

MA-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 95 

2.1.10 Media Protection (MP) 

2.1.10.1 MP-1 Media Protection Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A media protection policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and 

2. Procedures to facilitate the implementation of the media protection policy and associated 

media protection controls; and 

b. Reviews and updates the current: 

1. Media protection policy [Assignment: organization-defined frequency]; and 

2. Media protection procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Media Protection Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MP-1] 

Implementation Statement: 

MP-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.10.2 MP-2 Media Access 

The organization restricts access to [Assignment: organization-defined types of digital and/or non-digital 

media] to [Assignment: organization-defined personnel or roles 

NIST SP 800-53 Media Protection Common (Fully Inherited Control) 

Revision 4 Hybrid (Partially Inherited Control) [MP-2] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 96 

 System Specific Control

Implementation Statement: 

MP-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.10.3 MP-3 Media Marking 

The organization: 

a. Marks information system media indicating the distribution limitations, handling caveats, and 

applicable security markings (if any) of the information; and 

b. Exempts [Assignment: organization-defined types of information system media] from marking 

as long as the media remain within [Assignment: organization-defined controlled areas]. 

NIST SP 800-53 Media Protection Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MP-3] 

Implementation Statement: 

MP-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 97 

2.1.10.4 MP-4 Media Storage 

The organization: 

a. Physically controls and securely stores [Assignment: organization-defined types of digital 

and/or non-digital media] within [Assignment: organization-defined controlled areas]; and 

b. Protects information system media until the media are destroyed or sanitized using approved 

equipment, techniques, and procedures. 

NIST SP 800-53 Media Protection Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MP-4] 

Implementation Statement: 

MP-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.10.5 MP-5 Media Transport 

The organization: 

a. Protects and controls [Assignment: organization-defined types of information system media] 

during transport outside of controlled areas using [Assignment: organization-defined security 

safeguards]; 

b. Maintains accountability for information system media during transport outside of controlled 

areas; 

c. Documents activities associated with the transport of information system media; and 

d. Restricts the activities associated with the transport of information system media to 

authorized personnel. 

Control Enhancements: 

(4) MEDIA TRANSPORT | CRYPTOGRAPHIC PROTECTION 

The information system implements cryptographic mechanisms to protect the confidentiality and integrity 

of information stored on digital media during transport outside of controlled areas. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 98 

NIST SP 800-53 Media Protection Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MP-5] 

Implementation Statement: 

MP-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement MA-5(4) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.10.6 MP-6 Media Sanitization 

The organization: 

a. Sanitizes [Assignment: organization-defined information system media] prior to disposal, 

release out of organizational control, or release for reuse using [Assignment: organizationdefined sanitization techniques and procedures] in accordance with applicable federal and 

organizational standards and policies; and 

b. Employs sanitization mechanisms with the strength and integrity commensurate with the 

security category or classification of the information. 

NIST SP 800-53 Media Protection Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 99 

Revision 4 [MP-6] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: 

MP-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.10.7 MP-7 Media Use 

The organization [Selection: restricts; prohibits] the use of [Assignment: organization-defined types of 

information system media] on [Assignment: organization-defined information systems or system 

components] using [Assignment: organization-defined security safeguards]. 

Control Enhancements: 

(1) MEDIA USE | PROHIBIT USE WITHOUT OWNER 

The organization prohibits the use of portable storage devices in organizational information systems when 

such devices have no identifiable owner. 

NIST SP 800-53 Media Protection Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [MP-7] 

Implementation Statement: 

MP-7 

Implementation Status: Status (check all that apply): 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 100 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

MP-7(1) Control Enhancement 

Implementation Statement: 

Implementation Status: Status (check all that apply 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.11 Physical and Environmental Protection (PE) 

2.1.11.1 PE-1 Physical and Environmental Protection Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A physical and environmental protection policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and 

2. Procedures to facilitate the implementation of the physical and environmental protection 

policy and associated physical and environmental protection controls; and 

b. Reviews and updates the current: 

1. Physical and environmental protection policy [Assignment: organization-defined 

frequency]; and 

2. Physical and environmental protection procedures [Assignment: organization-defined 

frequency]. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-1] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 101 

Implementation Statement: 

PE-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.2 PE-2 Physical Access Authorizations 

The organization: 

a. Develops, approves, and maintains a list of individuals with authorized access to the facility 

where the information system resides; 

b. Issues authorization credentials for facility access; 

c. Reviews the access list detailing authorized facility access by individuals [Assignment: 

organization-defined frequency]; and 

d. Removes individuals from the facility access list when access is no longer required. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-2] 

Implementation Statement: 

PE-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 102 

2.1.11.3 PE-3 Physical Access Control 

The organization: 

a. Enforces physical access authorizations at [Assignment: organization-defined entry/exit 

points to the facility where the information system resides] by; 

1. Verifying individual access authorizations before granting access to the facility; and 

2. Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: 

organization-defined physical access control systems/devices]; guards]; 

b. Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; 

c. Provides [Assignment: organization-defined security safeguards] to control access to areas 

within the facility officially designated as publicly accessible; 

d. Escorts visitors and monitors visitor activity [Assignment: organization-defined circumstances 

requiring visitor escorts and monitoring]; 

e. Secures keys, combinations, and other physical access devices; 

f. Inventories [Assignment: organization-defined physical access devices] every [Assignment: 

organization-defined frequency]; and 

g. Changes combinations and keys [Assignment: organization-defined frequency] and/or when 

keys are lost, combinations are compromised, or individuals are transferred or terminated. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-3] 

Implementation Statement: 

PE-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.4 PE-4 Access Control for Transmission Medium 

The organization controls physical access to [Assignment: organization-defined information system 

distribution and transmission lines] within organizational facilities using [Assignment: organization-defined 

security safeguards]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 103 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-4] 

Implementation Statement: 

PE-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.5 PE-5 Access Control for Output Devices 

The organization controls physical access to information system output devices to prevent unauthorized 

individuals from obtaining the output. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-5] 

Implementation Statement: 

PE-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 104 

2.1.11.6 PE-6 Monitoring Physical Access 

The organization: 

a. Monitors physical access to the facility where the information system resides to detect and 

respond to physical security incidents; 

b. Reviews physical access logs [Assignment: organization-defined frequency] and upon 

occurrence of [Assignment: organization-defined events or potential indications of events]; 

and 

c. Coordinates results of reviews and investigations with the organizational incident response 

capability. 

Control Enhancements: 

(1) MONITORING PHYSICAL ACCESS | INTRUSION ALARMS / SURVEILLANCE EQUIPMENT 

The organization monitors physical intrusion alarms and surveillance equipment. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-6] 

Implementation Statement: 

PE-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement PE-6(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 105 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.11.7 PE-8 Visitor Access Records 

The organization: 

a. Maintains visitor access records to the facility where the information system resides for 

[Assignment: organization-defined time period]; and 

b. Reviews visitor access records [Assignment: organization-defined frequency]. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-8] 

Implementation Statement: 

PE-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.8 PE-9 Power Equipment and Cabling 

The organization protects power equipment and power cabling for the information system from damage 

and destruction. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-9] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 106 

Implementation Statement: 

PE-9 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.9 PE-10 Emergency Shutoff 

The organization: 

a. Provides the capability of shutting off power to the information system or individual system 

components in emergency situations; 

b. Places emergency shutoff switches or devices in [Assignment: organization-defined location 

by information system or system component] to facilitate safe and easy access for personnel; 

and 

c. Protects emergency power shutoff capability from unauthorized activation. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-10] 

Implementation Statement: 

PE-10 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 107 

2.1.11.10 PE-11 Emergency Power 

The organization provides a short-term uninterruptible power supply to facilitate [Selection (one or more): 

an orderly shutdown of the information system; transition of the information system to long-term alternate 

power] in the event of a primary power source loss. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-11] 

Implementation Statement: 

PE-11 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.11 PE-12 Emergency Lighting 

The organization employs and maintains automatic emergency lighting for the information system that 

activates in the event of a power outage or disruption and that covers emergency exits and evacuation 

routes within the facility. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-12] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 108 

Implementation Statement: 

PE-12 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.12 PE-13 Fire Protection 

The organization employs and maintains fire suppression and detection devices/systems for the 

information system that are supported by an independent energy source. 

Control Enhancements: 

(3) FIRE PROTECTION | AUTOMATIC FIRE SUPPRESSION 

The organization employs an automatic fire suppression capability for the information system when the 

facility is not staffed on a continuous basis. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-13] 

Implementation Statement: 

PE-13 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 109 

Comments:

Control Enhancement PE-13(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.11.13 PE-14 Temperature and Humidity Controls 

The organization: 

a. Maintains temperature and humidity levels within the facility where the information system 

resides at [Assignment: organization-defined acceptable levels]; and 

b. Monitors temperature and humidity levels [Assignment: organization-defined frequency]. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-14] 

Implementation Statement: 

PE-14 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 110 

Comments:

2.1.11.14 PE-15 Water Damage Protection 

The organization protects the information system from damage resulting from water leakage by providing 

master shutoff or isolation valves that are accessible, working properly, and known to key personnel. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-15] 

Implementation Statement: 

PE-15 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.15 PE-16 Delivery and Removal 

The organization authorizes, monitors, and controls [Assignment: organization-defined types of 

information system components] entering and exiting the facility and maintains records of those items. 

NIST SP 800-53 Physical and 

Environmental 

 Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 111 

Protection Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-16] 

Implementation Statement: 

PE-16 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.11.16 PE-17 Alternate Work Site 

The organization: 

a. Employs [Assignment: organization-defined security controls] at alternate work sites; 

b. Assesses as feasible, the effectiveness of security controls at alternate work sites; and 

c. Provides a means for employees to communicate with information security personnel in case 

of security incidents or problems. 

NIST SP 800-53 

Physical and 

Environmental 

Protection 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 System Specific Control [PE-17] 

Implementation Statement: 

PE-17 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 112 

2.1.12 Planning (PL) 

2.1.12.1 PL-1 Security Planning Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A security planning policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and 

2. Procedures to facilitate the implementation of the security planning policy and associated 

security planning controls; and 

b. Reviews and updates the current: 

1. Security planning policy [Assignment: organization-defined frequency]; and 

2. Security planning procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PL-1] 

Implementation Statement: 

PL-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 113 

2.1.12.2 PL-2 System Security Plan 

The organization: 

a. Develops a security plan for the information system that: 

1. Is consistent with the organization’s enterprise architecture; 

2. Explicitly defines the authorization boundary for the system; 

3. Describes the operational context of the information system in terms of missions and 

business processes; 

4. Provides the security categorization of the information system including supporting 

rationale; 

5. Describes the operational environment for the information system and relationships with 

or connections to other information systems; 

6. Provides an overview of the security requirements for the system; 

7. Identifies any relevant overlays, if applicable; 

8. Describes the security controls in place or planned for meeting those requirements 

including a rationale for the tailoring and supplementation decisions; and 

9. Is reviewed and approved by the authorizing official or designated representative prior to 

plan implementation; 

b. Distributes copies of the security plan and communicates subsequent changes to the plan to 

[Assignment: organization-defined personnel or roles]; 

c. Reviews the security plan for the information system [Assignment: organization-defined 

frequency]; 

d. Updates the plan to address changes to the information system/environment of operation or 

problems identified during plan implementation or security control assessments; and 

e. Protects the security plan from unauthorized disclosure and modification. 

Control Enhancements: 

(1) SYSTEM SECURITY PLAN | PLAN / COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES 

The organization plans and coordinates security-related activities affecting the information system with 

[Assignment: organization-defined individuals or groups] before conducting such activities in order to 

reduce the impact on other organizational entities. 

NIST SP 800-53 Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PL-2] 

Implementation Statement: 

PL-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 114 

Scoped 

Comments:

Control Enhancement PL-2(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.12.3 PL-4 Rules of Behavior 

The organization: 

a. Establishes and makes readily available to individuals requiring access to the information 

system, the rules that describe their responsibilities and expected behavior with regard to 

information and information system usage; 

b. Receives a signed acknowledgment from such individuals, indicating that they have read, 

understand, and agree to abide by the rules of behavior, before authorizing access to 

information and the information system; 

c. Reviews and updates the rules of behavior [Assignment: organization-defined frequency]; 

and 

d. Requires individuals who have signed a previous version of the rules of behavior to read and 

resign when the rules of behavior are revised/updated. 

Control Enhancements: 

(1) RULES OF BEHAVIOR | SOCIAL MEDIA AND NETWORKING RESTRICTIONS 

The organization includes in the rules of behavior, explicit restrictions on the use of social 

media/networking sites and posting organizational information on public websites. 

NIST SP 800-53 Planning Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PL-4] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 115 

Implementation Statement: 

PL-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement PL-4(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.12.4 PL-8 Information Security Architecture 

The organization: 

a. Develops an information security architecture for the information system that: 

1. Describes the overall philosophy, requirements, and approach to be taken with regard to 

protecting the confidentiality, integrity, and availability of organizational information; 

2. Describes how the information security architecture is integrated into and supports the 

enterprise architecture; and 

3. Describes any information security assumptions about, and dependencies on, external 

services; 

b. Reviews and updates the information security architecture [Assignment: organization-defined 

frequency] to reflect updates in the enterprise architecture; and 

c. Ensures that planned information security architecture changes are reflected in the security 

plan, the security Concept of Operations (CONOPS), and organizational 

procurements/acquisitions. 

NIST SP 800-53 Planning Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 116 

Revision 4 [PL-8] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

PL-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.13 Personnel Security (PS) 

2.1.13.1 PS-1 Personnel Security Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A personnel security policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and 

2. Procedures to facilitate the implementation of the personnel security policy and 

associated personnel security controls; and 

b. Reviews and updates the current: 

1. Personnel security policy [Assignment: organization-defined frequency]; and 

2. Personnel security procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PS-1] 

Implementation Statement: 

PS-1 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 117 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.13.2 PS-2 Position Risk Designation 

The organization: 

a. Assigns a risk designation to all organizational positions; 

b. Establishes screening criteria for individuals filling those positions; and 

c. Reviews and updates position risk designations [Assignment: organization-defined 

frequency]. 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PS-2] 

Implementation Statement: 

PS-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.13.3 PS-3 Personnel Screening 

The organization: 

a. Screens individuals prior to authorizing access to the information system; and 

b. Rescreens individuals according to [Assignment: organization-defined conditions requiring 

rescreening and, where rescreening is so indicated, the frequency of such rescreening]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 118 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PS-3] 

Implementation Statement: 

PS-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.13.4 PS-4 Personnel Termination 

The organization, upon termination of individual employment: 

a. Disables information system access within [Assignment: organization-defined time period]; 

b. Terminates/revokes any authenticators/credentials associated with the individual; 

c. Conducts exit interviews that include a discussion of [Assignment: organization-defined 

information security topics]; 

d. Retrieves all security-related organizational information system-related property; 

e. Retains access to organizational information and information systems formerly controlled by 

terminated individual; and 

f. Notifies [Assignment: organization-defined personnel or roles] within [Assignment: 

organization-defined time period]. 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PS-4] 

Implementation Statement: 

PS-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 119 

Scoped 

Comments:

2.1.13.5 PS-5 Personnel Transfer 

The organization: 

a. Reviews and confirms ongoing operational need for current logical and physical access 

authorizations to information systems/facilities when individuals are reassigned or transferred 

to other positions within the organization; 

b. Initiates [Assignment: organization-defined transfer or reassignment actions] within 

[Assignment: organization-defined time period following the formal transfer action]; 

c. Modifies access authorization as needed to correspond with any changes in operational need 

due to reassignment or transfer; and 

d. Notifies [Assignment: organization-defined personnel or roles] within [Assignment: 

organization-defined time period]. 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PS-5] 

Implementation Statement: 

PS-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.13.6 PS-6 Access Agreements 

The organization: 

a. Develops and documents access agreements for organizational information systems; 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 120 

b. Reviews and updates the access agreements [Assignment: organization-defined frequency]; 

and 

c. Ensures that individuals requiring access to organizational information and information 

systems: 

1. Sign appropriate access agreements prior to being granted access; and 

2. Re-sign access agreements to maintain access to organizational information systems 

when access agreements have been updated or [Assignment: organization-defined 

frequency]. 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PS-6] 

Implementation Statement: 

PS-6 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.13.7 PS-7 Third-Party Personnel Security 

The organization: 

a. Establishes personnel security requirements including security roles and responsibilities for 

third-party providers; 

b. Requires third-party providers to comply with personnel security policies and procedures 

established by the organization; 

c. Documents personnel security requirements; 

d. Requires third-party providers to notify [Assignment: organization-defined personnel or roles] 

of any personnel transfers or terminations of third-party personnel who possess 

organizational credentials and/or badges, or who have information system privileges within 

[Assignment: organization-defined time period]; and 

e. Monitors provider compliance. 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PS-7] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 121 

Implementation Statement: 

PS-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.13.8 PS-8 Personnel Sanctions 

The organization: 

a. Employs a formal sanctions process for individuals failing to comply with established information 

security policies and procedures; and 

b. Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organizationdefined time period] when a formal employee sanctions process is initiated, identifying the 

individual sanctioned and the reason for the sanction. 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [PS-8] 

Implementation Statement: 

PS-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.14 Risk Assessment (RA) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 122 

2.1.14.1 RA-1 Risk Assessment Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A risk assessment policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and 

2. Procedures to facilitate the implementation of the risk assessment policy and associated 

risk assessment controls; and 

b. Reviews and updates the current: 

1. Risk assessment policy [Assignment: organization-defined frequency]; and 

2. Risk assessment procedures [Assignment: organization-defined frequency]. 

NIST SP 800-53 Risk Assessment Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [RA-1] 

Implementation Statement: 

RA-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.14.2 RA-2 Security Categorization 

The organization: 

a. Categorizes information and the information system in accordance with applicable federal 

laws, Executive Orders, directives, policies, regulations, standards, and guidance; 

b. Documents the security categorization results (including supporting rationale) in the security 

plan for the information system; and 

c. Ensures that the security categorization decision is reviewed and approved by the authorizing 

official or authorizing official designated representative. 

NIST SP 800-53 Risk Assessment Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 123 

Revision 4 [RA-2] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: 

RA-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.14.3 RA-3 Risk Assessment 

The organization: 

a. Conducts an assessment of risk, including the likelihood and magnitude of harm, from the 

unauthorized access, use, disclosure, disruption, modification, or destruction of the 

information system and the information it processes, stores, or transmits; 

b. Documents risk assessment results in [Selection: security plan; risk assessment report;

[Assignment: organization-defined document]]; 

c. Reviews risk assessment results [Assignment: organization-defined frequency]; 

d. Disseminates risk assessment results to [Assignment: organization-defined personnel or 

roles]; and 

e. Updates the risk assessment [Assignment: organization-defined frequency] or whenever 

there are significant changes to the information system or environment of operation (including 

the identification of new threats and vulnerabilities), or other conditions that may impact the 

security state of the system. 

NIST SP 800-53 Risk Assessment Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [RA-3] 

Implementation Statement: 

RA-3 

Implementation Status: Status (check all that apply): 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 124 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.14.4 RA-5 Vulnerability Scanning 

The organization: 

a. Scans for vulnerabilities in the information system and hosted applications [Assignment: 

organization-defined frequency and/or randomly in accordance with organization-defined 

process] and when new vulnerabilities potentially affecting the system/applications are 

identified and reported; 

b. Employs vulnerability scanning tools and techniques that facilitate interoperability among 

tools and automate parts of the vulnerability management process by using standards for: 

1. Enumerating platforms, software flaws, and improper configurations; 

2. Formatting checklists and test procedures; and 

3. Measuring vulnerability impact; 

c. Analyzes vulnerability scan reports and results from security control assessments; 

d. Remediates legitimate vulnerabilities [Assignment: organization-defined response times] in 

accordance with an organizational assessment of risk; and 

e. Shares information obtained from the vulnerability scanning process and security control 

assessments with [Assignment: organization-defined personnel or roles] to help eliminate 

similar vulnerabilities in other information systems (i.e., systemic weaknesses or 

deficiencies). 

Control Enhancements: 

(1) VULNERABILITY SCANNING | UPDATE TOOL CAPABILITY 

The organization employs vulnerability scanning tools that include the capability to readily update the 

information system vulnerabilities to be scanned. 

(2) VULNERABILITY SCANNING | UPDATE BY FREQUENCY / PRIOR TO NEW SCAN / WHEN 

IDENTIFIED 

The organization updates the information system vulnerabilities scanned [Selection (one or more): 

[Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified 

and reported]. 

(5) VULNERABILITY SCANNING | PRIVILEGED ACCESS 

The information system implements privileged access authorization to [Assignment: organizationidentified information system components] for selected [Assignment: organization-defined vulnerability 

scanning activities]. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 125 

NIST SP 800-53 Personnel Security Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control

Revision 4 [RA-5] 

Implementation Statement: 

RA-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement RA-5(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement RA-5(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 126 

Control Enhancement RA-5(5) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.15 System and Services Acquisition 

2.1.15.1 SA-1 System and Services Acquisition Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A system and services acquisition policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and 

2. Procedures to facilitate the implementation of the system and services acquisition policy 

and associated system and services acquisition controls; and 

b. Reviews and updates the current: 

1. System and services acquisition policy [Assignment: organization-defined frequency]; 

and 

2. System and services acquisition procedures [Assignment: organization-defined 

frequency]. 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SA-1] 

Implementation Statement: 

SA-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 127 

Scoped 

Comments:

2.1.15.2 SA-2 Allocation of Resources 

The organization: 

a. Determines information security requirements for the information system or information 

system service in mission/business process planning; 

b. Determines, documents, and allocates the resources required to protect the information 

system or information system service as part of its capital planning and investment control 

process; and 

c. Establishes a discrete line item for information security in organizational programming and 

budgeting documentation. 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SA-2] 

Implementation Statement: 

SA-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.15.3 SA-3 System Development Life Cycle 

The organization: 

a. Manages the information system using [Assignment: organization-defined system 

development life cycle] that incorporates information security considerations; 

b. Defines and documents information security roles and responsibilities throughout the system 

development life cycle; 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 128 

c. Identifies individuals having information security roles and responsibilities; and 

d. Integrates the organizational information security risk management process into system 

development life cycle activities. 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SA-3] 

Implementation Statement: 

SA-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.15.4 SA-4 Acquisition Process 

The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, 

in the acquisition contract for the information system, system component, or information system service in 

accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, 

guidelines, and organizational mission/business needs: 

a. Security functional requirements; 

b. Security strength requirements; 

c. Security assurance requirements; 

d. Security-related documentation requirements; 

e. Requirements for protecting security-related documentation; 

f. Description of the information system development environment and environment in which 

the system is intended to operate; and 

g. Acceptance criteria. 

Control Enhancements: 

(1) ACQUISITION PROCESS | FUNCTIONAL PROPERTIES OF SECURITY CONTROLS 

The organization requires the developer of the information system, system component, or information 

system service to provide a description of the functional properties of the security controls to be 

employed. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 129 

(2) ACQUISITION PROCESS | DESIGN / IMPLEMENTATION INFORMATION FOR SECURITY 

CONTROLS 

The organization requires the developer of the information system, system component, or information 

system service to provide design and implementation information for the security controls to be employed 

that includes: [Selection (one or more): security-relevant external system interfaces; high-level design; 

low-level design; source code or hardware schematics; [Assignment: organization-defined 

design/implementation information]] at [Assignment: organization-defined level of detail]. 

(9) ACQUISITION PROCESS | FUNCTIONS / PORTS / PROTOCOLS / SERVICES IN USE 

The organization requires the developer of the information system, system component, or information 

system service to identify early in the system development life cycle, the functions, ports, protocols, and 

services intended for organizational use. 

(10) ACQUISITION PROCESS | USE OF APPROVED PIV PRODUCTS 

The organization employs only information technology products on the FIPS 201-approved products list 

for Personal Identity Verification (PIV) capability implemented within organizational information systems. 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SA-4] 

Implementation Statement: 

SA-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SA-4(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 130 

Scoped 

Comments: 

Control Enhancement SA-4(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement SA-4(9) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement SA-4(10) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.15.5 SA-5 Information System Documentation 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 131 

The organization: 

a. Obtains administrator documentation for the information system, system component, or 

information system service that describes: 

1. Secure configuration, installation, and operation of the system, component, or service; 

2. Effective use and maintenance of security functions/mechanisms; and 

3. Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) 

functions; 

b. Obtains user documentation for the information system, system component, or information 

system service that describes: 

1. User-accessible security functions/mechanisms and how to effectively use those security 

functions/mechanisms; 

2. Methods for user interaction, which enables individuals to use the system, component, or 

service in a more secure manner; and 

3. User responsibilities in maintaining the security of the system, component, or service; 

c. Documents attempts to obtain information system, system component, or information system 

service documentation when such documentation is either unavailable or nonexistent and 

[Assignment: organization-defined actions] in response; 

d. Protects documentation as required, in accordance with the risk management strategy; and 

e. Distributes documentation to [Assignment: organization-defined personnel or roles]. 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SA-5] 

Implementation Statement: 

SA-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.15.6 SA-8 Security Engineering Principles 

The organization applies information system security engineering principles in the specification, design, 

development, implementation, and modification of the information system. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 132 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SA-8] 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

SA-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.15.7 SA-9 External Information System Services 

The organization: 

a. Requires that providers of external information system services comply with organizational 

information security requirements and employ [Assignment: organization-defined security 

controls] in accordance with applicable federal laws, Executive Orders, directives, policies, 

regulations, standards, and guidance; 

b. Defines and documents government oversight and user roles and responsibilities with regard 

to external information system services; and 

c. Employs [Assignment: organization-defined processes, methods, and techniques] to monitor 

security control compliance by external service providers on an ongoing basis. 

Control Enhancements: 

(2) EXTERNAL INFORMATION SYSTEMS | IDENTIFICATION OF FUNCTIONS / PORTS / 

PROTOCOLS / SERVICES 

The organization requires providers of [Assignment: organization-defined external information system 

services] to identify the functions, ports, protocols, and other services required for the use of such 

services. 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

Revision 4 [SA-9] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 133 

 System Specific Control

Implementation Statement: 

SA-9 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SA-9(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.15.8 SA-10 Developer Configuration Management 

The organization requires the developer of the information system, system component, or information 

system service to: 

a. Perform configuration management during system, component, or service [Selection (one or 

more): design; development; implementation; operation]; 

b. Document, manage, and control the integrity of changes to [Assignment: organization-defined 

configuration items under configuration management]; 

c. Implement only organization-approved changes to the system, component, or service; 

d. Document approved changes to the system, component, or service and the potential security 

impacts of such changes; and 

e. Track security flaws and flaw resolution within the system, component, or service and report 

findings to [Assignment: organization-defined personnel]. 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 134 

Revision 4 [SA-10] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

SA-10 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.15.9 SA-11 Developer Security Testing and Evaluation 

The organization requires the developer of the information system, system component, or information 

system service to: 

a. Create and implement a security assessment plan; 

b. Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation at 

[Assignment: organization-defined depth and coverage]; 

c. Produce evidence of the execution of the security assessment plan and the results of the 

security testing/evaluation; 

d. Implement a verifiable flaw remediation process; and 

e. Correct flaws identified during security testing/evaluation. 

NIST SP 800-53 System and Services 

Acquisition 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SA-11] 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

SA-11 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 135 

Comments:

2.1.16 System and Communications Protection 

2.1.16.1 SC-1 System and Communications Protection Policy and Procedures 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A system and communications protection policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and 

2. Procedures to facilitate the implementation of the system and communications protection 

policy and associated system and communications protection controls; and 

b. Reviews and updates the current: 

1. System and communications protection policy [Assignment: organization-defined 

frequency]; and 

2. System and communications protection procedures [Assignment: organization-defined 

frequency]. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-1] 

Implementation Statement: 

SC-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 136 

2.1.16.2 SC-2 Application Partitioning 

The information system separates user functionality (including user interface services) from information 

system management functionality. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-2] 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

SC-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.3 SC-4 Information in Shared Resources 

The information system prevents unauthorized and unintended information transfer via shared system 

resources. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-3] 

Implementation Statement: 

SC-4 

Implementation Status: Status (check all that apply): 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 137 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.4 SC-5 Denial of Service Protection 

The information system protects against or limits the effects of the following types of denial of service 

attacks: [Assignment: organization-defined types of denial of service attacks or reference to source for 

such information] by employing [Assignment: organization-defined security safeguards]. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-5] 

Implementation Statement: 

SC-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.5 SC-7 Boundary Protection 

The information system: 

a. Monitors and controls communications at the external boundary of the system and at key 

internal boundaries within the system; 

b. Implements subnetworks for publicly accessible system components that are [Selection: 

physically; logically] separated from internal organizational networks; and 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 138 

c. Connects to external networks or information systems only through managed interfaces 

consisting of boundary protection devices arranged in accordance with organizational 

security architecture. 

Control Enhancements: 

(3) BOUNDARY PROTECTION | ACCESS POINTS 

The organization limits the number of external network connections to the information system. 

Supplemental Guidance: Limiting the number of external network connections facilitates more 

comprehensive monitoring of inbound and outbound communications traffic. The Trusted Internet 

Connection (TIC) initiative is an example of limiting the number of external network connections. 

(4) BOUNDARY PROTECTION | EXTERNAL TELECOMMUNICATIONS SERVICES 

The organization: 

(a) Implements a managed interface for each external telecommunication service; 

(b) Establishes a traffic flow policy for each managed interface; 

(c) Protects the confidentiality and integrity of the information being transmitted across each 

interface; 

(d) Documents each exception to the traffic flow policy with a supporting mission/business 

need and duration of that need; and 

(e) Reviews exceptions to the traffic flow policy [Assignment: organization-defined frequency] 

and removes exceptions that are no longer supported by an explicit mission/business 

need. 

(5) BOUNDARY PROTECTION | DENY BY DEFAULT / ALLOW BY EXCEPTION 

The information system at managed interfaces denies network communications traffic by default and 

allows network communications traffic by exception (i.e., deny all, permit by exception). 

(7) BOUNDARY PROTECTION | PREVENT SPLIT TUNNELING FOR REMOTE DEVICES 

The information system, in conjunction with a remote device, prevents the device from simultaneously 

establishing non-remote connections with the system and communicating via some other connection to 

resources in external networks. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-7] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 139 

Implementation Statement: 

SC-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SC-7(3) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement SC-7(4) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement SC-7(5) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 140 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement SC-7(7) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.16.6 SC-8 Transmission Confidentiality and Integrity 

The information system protects the [Selection (one or more): confidentiality; integrity] of transmitted 

information. 

Control Enhancements: 

(1) TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CRYPTOGRAPHIC OR ALTERNATE 

PHYSICAL PROTECTION 

The information system implements cryptographic mechanisms to [Selection (one or more): prevent 

unauthorized disclosure of information; detect changes to information] during transmission unless 

otherwise protected by [Assignment: organization-defined alternative physical safeguards]. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-8] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 141 

Implementation Statement: 

SC-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SC-8(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.16.7 SC-10 Network Disconnect 

The information system terminates the network connection associated with a communications session at 

the end of the session or after [Assignment: organization-defined time period] of inactivity.

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-10] 

Implementation Statement: 

SC-10 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 142 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.8 SC-12 Cryptographic Key Establishment and Management 

The organization establishes and manages cryptographic keys for required cryptography employed within 

the information system in accordance with [Assignment: organization-defined requirements for key 

generation, distribution, storage, access, and destruction]. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-12] 

Implementation Statement: 

SC-12 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.9 SC-13 Cryptographic Protection 

The information system implements [Assignment: organization-defined cryptographic uses and type of 

cryptography required for each use] in accordance with applicable federal laws, Executive Orders, 

directives, policies, regulations, and standards. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 143 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-13] 

Implementation Statement: 

SC-13 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.10 SC-15 Collaborative Computing Devices 

The information system: 

a. Prohibits remote activation of collaborative computing devices with the following exceptions: 

[Assignment: organization-defined exceptions where remote activation is to be allowed]; and 

b. Provides an explicit indication of use to users physically present at the devices. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-15] 

Implementation Statement: 

SC-15 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 144 

2.1.16.11 SC-17 Public Key Infrastructure Certificates 

The organization issues public key certificates under an [Assignment: organization-defined certificate 

policy] or obtains public key certificates from an approved service provider 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-17] 

Implementation Statement: 

SC-17 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.12 SC-18 Mobile Code 

The organization: 

a. Defines acceptable and inacceptable mobile code and mobile code technologies; 

b. Establishes usage restrictions and implementation guidance for acceptable mobile code and 

mobile code technologies; and 

c. Authorizes, monitors, and controls the use of mobile code within the information system. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 145 

Revision 4 [SC-18] Hybrid (Partially Inherited Control) 

 System Specific Control

Implementation Statement: 

SC-18 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.13 SC-19 Voice Over Internet Protocol 

The organization: 

a. Establishes usage restrictions and implementation guidance for Voice over Internet Protocol 

(VoIP) technologies based on the potential to cause damage to the information system if 

used maliciously; and 

b. Authorizes, monitors, and controls the use of VoIP within the information system. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-19] 

Implementation Statement: 

SC-19 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 146 

2.1.16.14 SC-20 Secure Name / Address Resolution Service (Authoritative Source) 

The information system: 

a. Provides additional data origin and integrity artifacts along with the authoritative name 

resolution data the system returns in response to external name/address resolution queries; 

and 

Provides the means to indicate the security status of child zones and (if the child supports secure 

resolution services) to enable verification of a chain of trust among parent and child domains, when 

operating as part of a distributed, hierarchical namespace. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-20] 

Implementation Statement: 

SC-20 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.15 SC-21 Secure Name / Address Resolution Service (Recursive or Caching 

Resolver) 

The information system requests and performs data origin authentication and data integrity verification on 

the name/address resolution responses the system receives from authoritative sources. 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 147 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-21] 

Implementation Statement: 

SC-21 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.16 SC-22 Architecture and Provisioning for Name / Address Resolution 

Service 

The information systems that collectively provide name/address resolution service for an organization are 

fault-tolerant and implement internal/external role separation 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-22] 

Implementation Statement: 

SC-22 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 148 

Comments:

2.1.16.17 SC-23 Session Authenticity 

The information system protects the authenticity of communications sessions. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-23] 

Implementation Statement: 

SC-23 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.18 SC-28 Protection of Information at Rest 

The information system protects the [Selection (one or more): confidentiality; integrity] of [Assignment: 

organization-defined information at rest]. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-28] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 149 

Implementation Statement: 

SC-28 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.16.19 SC-39 Process Isolation 

The information system maintains a separate execution domain for each executing process. 

NIST SP 800-53 System and 

Communications 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SC-39] 

Implementation Statement: 

SC-39 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.17 System and Information Integrity 

2.1.17.1 SI-1 System and Information Integrity Policy and Procedures 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 150 

The organization: 

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or 

roles]: 

1. A system and information integrity policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and 

2. Procedures to facilitate the implementation of the system and information integrity policy 

and associated system and information integrity controls; and 

b. Reviews and updates the current: 

1. System and information integrity policy [Assignment: organization-defined frequency]; 

and 

2. System and information integrity procedures [Assignment: organization-defined 

frequency]. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-1] 

Implementation Statement: 

SI-1 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.17.2 SI-2 Flaw Remediation 

The organization: 

a. Identifies, reports, and corrects information system flaws; 

b. Tests software and firmware updates related to flaw remediation for effectiveness and 

potential side effects before installation; 

c. Installs security-relevant software and firmware updates within [Assignment: organizationdefined time period] of the release of the updates; and 

d. Incorporates flaw remediation into the organizational configuration management process. 

Control Enhancements: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 151 

(2) FLAW REMEDIATION | AUTOMATED FLAW REMEDIATION STATUS 

The organization employs automated mechanisms [Assignment: organization-defined frequency] to 

determine the state of information system components with regard to flaw remediation. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-2] 

Implementation Statement: 

SI-2 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SI-2(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.17.3 SI-3 Malicious Code Protection 

The organization: 

a. Employs malicious code protection mechanisms at information system entry and exit points 

to detect and eradicate malicious code; 

b. Updates malicious code protection mechanisms whenever new releases are available in 

accordance with organizational configuration management policy and procedures; 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 152 

c. Configures malicious code protection mechanisms to: 

1. Perform periodic scans of the information system [Assignment: organization-defined 

frequency] and real-time scans of files from external sources at [Selection (one or more); 

endpoint; network entry/exit points] as the files are downloaded, opened, or executed in 

accordance with organizational security policy; and 

2. [Selection (one or more): block malicious code; quarantine malicious code; send alert to 

administrator; [Assignment: organization-defined action]] in response to malicious code 

detection; and 

d. Addresses the receipt of false positives during malicious code detection and eradication and 

the resulting potential impact on the availability of the information system. 

Control Enhancements: 

(1) MALICIOUS CODE PROTECTION | CENTRAL MANAGEMENT 

The organization centrally manages malicious code protection mechanisms. 

(2) MALICIOUS CODE PROTECTION | AUTOMATIC UPDATES 

The information system automatically updates malicious code protection mechanisms. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-3] 

Implementation Statement: 

SI-3 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SI-3(1) 

Implementation Statement: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 153 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement SI-3(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.17.4 SI-4 Information System Monitoring 

The organization: 

a. Monitors the information system to detect: 

1. Attacks and indicators of potential attacks in accordance with [Assignment: 

organization-defined monitoring objectives]; and 

2. Unauthorized local, network, and remote connections; 

b. Identifies unauthorized use of the information system through [Assignment: organizationdefined techniques and methods]; 

c. Deploys monitoring devices: (i) strategically within the information system to collect 

organization-determined essential information; and (ii) at ad hoc locations within the system 

to track specific types of transactions of interest to the organization; 

d. Protects information obtained from intrusion-monitoring tools from unauthorized access, 

modification, and deletion; 

e. Heightens the level of information system monitoring activity whenever there is an indication 

of increased risk to organizational operations and assets, individuals, other organizations, or 

the Nation based on law enforcement information, intelligence information, or other credible 

sources of information; 

f. Obtains legal opinion with regard to information system monitoring activities in accordance 

with applicable federal laws, Executive Orders, directives, policies, or regulations; and 

g. Provides [Assignment: organization-defined information system monitoring information] to 

[Assignment: organization-defined personnel or roles] [Selection (one or more): as needed;

[Assignment: organization-defined frequency]]. 

Control Enhancements: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 154 

(2) INFORMATION SYSTEM MONITORING | AUTOMATED TOOLS FOR REAL-TIME ANALYSIS 

The organization employs automated tools to support near real-time analysis of events. 

(4) INFORMATION SYSTEM MONITORING | INBOUND AND OUTBOUND COMMUNICATIONS 

TRAFFIC 

The information system monitors inbound and outbound communications traffic [Assignment: 

organization-defined frequency] for unusual or unauthorized activities or conditions. 

(5) INFORMATION SYSTEM MONITORING | SYSTEM-GENERATED ALERTS 

The information system alerts [Assignment: organization-defined personnel or roles] when the following 

indications of compromise or potential compromise occur: [Assignment: organization-defined compromise 

indicators]. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-4] 

Implementation Statement: 

SI-4 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SI-4(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 155 

Control Enhancement SI-4(4) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement SI-4(5) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.17.5 SI-5 Security Alerts, Advisories, and Directives 

The organization: 

a. Receives information system security alerts, advisories, and directives from [Assignment: 

organization-defined external organizations] on an ongoing basis; 

b. Generates internal security alerts, advisories, and directives as deemed necessary; 

c. Disseminates security alerts, advisories, and directives to: [Selection (one or more):

[Assignment: organization-defined personnel or roles]; [Assignment: organization-defined 

elements within the organization]; [Assignment: organization-defined external organizations]]; 

and 

d. Implements security directives in accordance with established time frames, or notifies the 

issuing organization of the degree of noncompliance. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-5] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 156 

Implementation Statement: 

SI-5 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.17.6 SI-7 Software, Firmware, and Information Integrity 

The organization employs integrity verification tools to detect unauthorized changes to [Assignment: 

organization-defined software, firmware, and information]. 

Control Enhancements: 

(1) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRITY CHECKS 

The information system performs an integrity check of [Assignment: organization-defined software, 

firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined 

transitional states or security-relevant events]; [Assignment: organization-defined frequency]]. 

(7) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRATION OF DETECTION 

AND RESPONSE 

The organization incorporates the detection of unauthorized [Assignment: organization-defined securityrelevant changes to the information system] into the organizational incident response capability. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-7] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 157 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

SI-7 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SI-7(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

Control Enhancement SI-7(7) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.17.7 SI-8 Spam Protection 

The organization: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 158 

a. Employs spam protection mechanisms at information system entry and exit points to detect 

and take action on unsolicited messages; and 

b. Updates spam protection mechanisms when new releases are available in accordance with 

organizational configuration management policy and procedures. 

Control Enhancements: 

(1) SPAM PROTECTION | CENTRAL MANAGEMENT 

The organization centrally manages spam protection mechanisms. 

(2) SPAM PROTECTION | AUTOMATIC UPDATES 

The information system automatically updates spam protection mechanisms. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-8] 

Implementation Statement: 

SI-8 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

Control Enhancement SI-8(1) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 159 

Control Enhancement SI-8(2) 

Implementation Statement: 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments: 

2.1.17.8 SI-10 Information Input Validation 

The information system checks the validity of [Assignment: organization-defined information inputs]. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-10] 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

SI-10 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.17.9 SI-11 Error Handling 

The information system: 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 160 

a. Generates error messages that provide information necessary for corrective actions without 

revealing information that could be exploited by adversaries; and 

b. Reveals error messages only to [Assignment: organization-defined personnel or roles]. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-11] 

Implementation Statement: 

SI-11 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:

2.1.17.10 SI-12 Information Handling and Retention 

The organization handles and retains information within the information system and information output 

from the system in accordance with applicable federal laws, Executive Orders, directives, policies, 

regulations, standards, and operational requirements. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-12] 

Implementation Statement: 

SI-12 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 161 

Scoped 

Comments:

2.1.17.11 SI-16 Memory Protection 

The information system implements [Assignment: organization-defined security safeguards] to protect its 

memory from unauthorized code execution. 

NIST SP 800-53 System and 

Information Integrity 

 Common (Fully Inherited Control) 

 Hybrid (Partially Inherited Control) 

 System Specific Control Revision 4 [SI-16] 

Implementation Statement: Does not apply to Low systems according to NIST SP 800-53 Rev 4. 

SI-16 

Implementation Status: Status (check all that apply): 

 Implemented (In Place) Planned (Not in Place) Compensated Not Applicable 

Scoped 

Comments:
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 162 

3 APPENDIX LISTING 

3.1 Required Appendices 

APPENDIX DESCRIPTION STATUS 

A Acronym List Refer to Appendix 3.2 below 

B Definitions Refer to Appendix 3.3 below 

C Applicable Laws and References Refer to Appendix 3.4 below 

D Agency IT Master Inventory System Security Plan Appendices.doc 

E Security Assessment Report Matrix SecurityAssessmentReport.pdf 

G System Documentation [ENTER NAME OF SSP]

H System Rules of Behavior System Security Plan Appendices.doc 

I Security Awareness and Training 

Plan 

System Security Plan Appendices.doc 

J Incident Response Plan System Security Plan Appendices.doc 

K Configuration Management Plan System Security Plan Appendices.doc 

3.2 System Specific Appendices 

APPENDIX DESCRIPTION STATUS 

E2 Prior Security Assessment Report 

Matrix 

[System Name] SAR Matrix.doc 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 163 

3.3 Acronym List 

TERM DEFINITION 

AO Authorizing Official 

ASSERT Automated Security Self-Evaluation and Remediation Tracking 

ATO Authorization to Operate 

BSM Boundary Scope Memo 

CIO Chief Information Officer 

CISO Chief Information Security Officer 

CONOPS Concept of Operations 

COTS Commercial off the Shelf 

CSAM Cyber Security and Asset Management 

CSO Component Security Officer 

FICAM Federal Identity, Credential, and Access Management 

FIPS Federal Information Processing Standard(s) 

FISMA Federal Information Security Management Act 

GMT Greenwich Mean Time 

HW Hardware 

ISA Interconnection Security Agreement 

ISSH Information System Security Handbook 

IT Information Technology 

MD Maryland 

MOA Memorandum of Agreement 

MOU Memorandum of Understanding 

NCC National Coordinating Center for Communications 

NIST National Institute of Standards and Technology 

OIG Office of Inspector General 

OIS Office of Information Security 

OMB Office of Management and Budget 

OS Operating System 

PIV Personal Identity Verification 

POA&M Plan of Action and Milestones 

POC Point of Contact 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 164 

TERM DEFINITION 

PRIDE Project Resource Guide 

PSC Program Support Center 

RBD Risk-Based Decision 

SAM Security Authorization Manager 

SAR Security Assessment Report 

SBU Sensitive But Unclassified 

SDLC Systems Development Life Cycle 

SDLCM Systems Development Life Cycle Methodology 

SME Subject Matter Expert 

SO System Owner 

SP Special Publication 

SPM System Project Manager 

SRA Security Risk Assessment 

SSA Social Security Administration 

SSC Secure Standards Council 

SSP System Security Plan 

SW Software 

TIC Trusted Internet Connection 

TSL Transport Layer Security 

U.S.C. United States Code 

UTC Coordinated Universal Time 

VoIP Voice Over Internet Protocol 

VPN Virtual Private Network 

WAN Wide Area Network 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 165 

3.4 Definitions/Glossary 

Term Definition 

Accreditation The official management decision given by a senior agency official to 

authorize operation of an information system and to explicitly accept the risk 

to agency operations (including mission, functions, image, or reputation), 

agency assets, or individuals, based on the implementation of an agreedupon set of security controls. 

Accreditation 

Boundary 

All components of an information system to be accredited by an authorizing 

official and excludes separately accredited systems, to which the information 

system is connected. 

Accreditation Package The evidence provided to the authorizing official to be used in the security 

accreditation decision process. Evidence includes, but is not limited to: (i) the 

system security plan; (ii) the assessment results from the security 

certification; and (iii) the plan of action and milestones. 

Assessment 

Procedure 

A set of activities or actions employed by an assessor to determine the extent 

to which a security control is implemented correctly, operating as intended, 

and producing the desired outcome with respect to meeting the security 

requirements for the system. 

Automated Information 

System (AIS) 

An assembly of computer hardware, software and/or firmware configured to 

collect, create, communicate, compute, disseminate, process, store, and/or 

control data or information. 

Certification The comprehensive evaluation of the technical and non-technical security 

features of an AIS and other safeguards, made in support of the accreditation 

process that establishes the extent to which a particular design and 

implementation meet a specified set of security requirements. 

Common Security 

Control 

Security control that can be applied to one or more agency information 

systems and has the following properties: (i) the development, 

implementation, and assessment of the control can be assigned to a 

responsible official or organizational element (other than the information 

system owner); and (ii) the results from the assessment of the control can be 

used to support the C&A processes of an agency information system where 

that control has been applied. 

Confidentiality Preserving authorized restrictions on information access and disclosure, 

including means for protecting personal privacy and proprietary information. 

[44 U.S.C., Sec. 3542] 

Configuration Control Process for controlling modifications to hardware, firmware, software, and 

documentation to ensure the information system is protected against 

improper modifications prior to, during, and after system implementation. 

[CNSS Inst. 4009] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 166 

Term Definition 

General Support 

System 

An interconnected set of information resources under the same direct 

management control that shares common functionality. It normally includes 

hardware, software, information, data, applications, communications, and 

people. [OMB Circular A-130, Appendix III] 

Information Owner Official with statutory or operational authority for specified information and 

responsibility for establishing the controls for its generation, collection, 

processing, dissemination, and disposal. [CNSS Inst. 4009] 

Information Security The protection of information and information systems from unauthorized 

access, use, disclosure, disruption, modification, or destruction in order to 

provide confidentiality, integrity, and availability. [44 U.S.C., Sec. 3542] 

Information Security 

Policy 

Aggregate of directives, regulations, rules, and practices that prescribe how 

an organization manages, protects, and distributes information. [CNSS Inst. 

4009] 

Information System A discrete set of information resources organized for the collection, 

processing, maintenance, use, sharing, dissemination, or disposition of 

information. [44 U.S.C., Sec. 3502] [OMB Circular A-130, Appendix III] 

Information Type A specific category of information (e.g., privacy, medical, proprietary, 

financial, investigative, contractor sensitive, security management), defined 

by an organization or in some instances, by a specific law, Executive Order, 

directive, policy, or regulation. [FIPS 199] 

Integrity Guarding against improper information modification or destruction, and 

includes ensuring information non-repudiation and authenticity. [44 U.S.C., 

Sec. 3542] 

Major Application An application that requires special attention to security due to the risk and 

magnitude of harm resulting from the loss, misuse, or unauthorized access to 

or modification of the information in the application. [OMB Circular A-130, 

Appendix III] 

Management Controls The security controls (i.e., safeguards or countermeasures) for an information 

system that focus on the management of risk and the management of 

information system security. [NIST SP 800-18] 

Minor Application An application, other than a major application, that requires attention to 

security due to the risk and magnitude of harm resulting from the loss, 

misuse, or unauthorized access to or modification of the information in the 

application. Minor applications are typically included as part of a general 

support system. 

Operational Controls The security controls (i.e., safeguards or countermeasures) for an information 

system that primarily are implemented and executed by people (as opposed 

to systems). [NIST SP 800-18] 

Plan of Action and 

Milestones 

A document that identifies tasks needing to be accomplished. It details 

resources required to accomplish the elements of the plan, any milestones in 

meeting the tasks, and scheduled completion dates for the milestones. [OMB 

Memorandum M-02-09] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 167 

Term Definition 

Risk The level of impact on agency operations, (including mission, functions, 

image, or reputation), agency assets, or individuals, resulting from the 

operation of an information system given the potential impact of a threat and 

the likelihood of that threat occurring. [NIST SP 800-30] 

Risk Assessment The process of identifying risks to agency operations (including mission, 

functions, image, or reputation), agency assets, or individuals by determining 

the probability of occurrence, the resulting impact, and additional security 

controls that would mitigate this impact. Part of risk management, 

synonymous with risk analysis, and incorporates threat and vulnerability 

analyses. [NIST SP 800-30] 

Risk Management The process of managing risks to agency operations (including mission, 

functions, image, or reputation), agency assets, or individuals resulting from 

the operation of an information system. It includes risk assessment; costbenefit analysis; the selection, implementation, and assessment of security 

controls; and the formal authorization to operate the system. The process 

considers effectiveness, efficiency, and constraints due to laws, directives, 

policies, or regulations. [NIST SP 800-30] 

Security Category The characterization of information or an information system based on an 

assessment of the potential impact that a loss of confidentiality, integrity, or 

availability of such information or information system would have on 

organizational operations, organizational assets, or individuals. [FIPS 199] 

Security Controls The management, operational, and technical controls (i.e., safeguards or 

countermeasures) prescribed for an information system to protect the 

confidentiality, integrity, and availability of the system and its information. 

[FIPS 199] 

Subsystem A major subdivision or component of an information system consisting of 

information, information technology, and personnel that performs one or more 

specific functions. 

System Security Plan Formal document that provides an overview of the security requirements for 

the information system and describes the security controls in place or planned 

for meeting those requirements. [NIST SP 800-18] 

System-specific 

Security Control 

A security control for an information system that has not been designated as 

a common security control. 

Technical Controls The security controls (i.e., safeguards or countermeasures) for an information 

system that are primarily implemented and executed by the information 

system through mechanisms contained in the hardware, software, or firmware 

components of the system. [NIST SP 800-18] 

Threat Any circumstance or event with the potential to adversely impact agency 

operations (including mission, functions, image, or reputation), agency assets, 

or individuals through an information system via unauthorized access, 

destruction, disclosure, modification of information, and/or denial of service. 

[CNSS Inst. 4009, Adapted] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 168 

Term Definition 

User Person or process accessing an AIS either by direct connections (e.g., via 

terminals), or indirect connections (e.g., prepare input data or receive output 

that is not reviewed for content or classification by a responsible individual). 

Vulnerability Weakness in an information system, system security procedures, internal 

controls, or implementation that could be exploited or triggered by a threat 

source. [CNSS Inst. 4009, Adapted] 

Vulnerability 

Assessment 

Formal description and evaluation of the vulnerabilities in an information 

system. [CNSS Inst. 4009] 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 169 

3.5 Applicable Laws and References 

Applicable Laws or Regulations Affecting the System 

Federal Policies/Directives/Guidance 

Committee on National Security Systems (CNSS) Instruction 4009, National Information Assurance 

Glossary, June 2006 

Committee on National Security Systems (CNSS) Instruction 1253, Security Categorization and Control 

Selection for National Security Systems, October 2009 

Freedom of Information Act (FOIA) 

Federal Information Security Management Act (FISMA) of 2002 

Federal Information Security Modernization Act (FISMA) of 2014 

Federal Managers’ Financial Integrity Act (FMFIA) 

Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of 

Federal Information and Information Systems, February 2004 

FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, March 

2006 

Homeland Security Presidential Directive (HSPD)-7, Critical Infrastructure Identification, Prioritization, 

and Protection 

Homeland Security Presidential Directive/HSPD-12, Policy for a Common Identification Standard for 

Federal Employees and Contractors 

Homeland Security Presidential Directive/HSPD-20, National Continuity Policy 

National Archives & Records Administration (NARA) 

National Institute of Standards and Technology (NIST) Special Publications (SP) 800-18, Revision 1, 

Guide for Developing Security Plans for Federal Information Systems, February 2006 

NIST SP 800-27, Revision A, Engineering Principles for Information Technology Security (A Baseline 

for Achieving Security), June 2004 

NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments, September 2012 

NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, May 2010 

NIST SP 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal 

Information Systems: A Security Life Cycle Approach, February 2010 

NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System 

View, March 2011 

NIST SP 800-50, Building an Information Technology Security Awareness and Training Program, 

October 2003 

NIST SP 800-52, Guidelines for Selecting and Use of Transport Layer Security (TSL) Implementations, 

April 2014 

NIST SP 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and 

Organizations, April 2013 

NIST SP 800-53A, Revision 4, Assessing Security and Privacy Controls in Federal Information 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 170 

Applicable Laws or Regulations Affecting the System 

Systems and Organizations: Building Effective Assessment Plans, December 2014 

NIST SP 800-59, Guideline for Identifying an Information System as a National Security System, 

August 2003. 

NIST SP 800-60, Revision 1, Guide for Mapping Types of Information and Information Systems to 

Security Categories, August 2008. 

NIST SP 800-64, Rev 2, Security Consideration in the Information System Development Life Cycle, 

October 2008 

NIST SP 800-70, Revision 3, National Checklist Program for IT Products: Guidelines for Checklist 

Users and Developers, March 2015 

NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), 

April 2010 

NIST SP 800-126, Revision 1, The Technical Specification for the Security Content Automation 

Protocol (SCAP): SCAP Version 1.2, February 2011. 

Office of Management and Budget (OMB) Circular A-123 Management Accountability and Control, 

1995 

OMB Circular A-127 Financial Management Systems, 1993 

OMB Circular A-130 Management of Federal Information Resources, 2000 

NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing, December 2011 

NIST SP 800-145, The NIST Definition of Cloud Computing, September 2011 

NIST SP 800-146, Cloud Computing Synopsis and Recommendations, May 2012 

OMB Circular M-02-01, Guidance for Preparing and Submitting Security Plans of Action and 

Milestones, October 2001. 

Paperwork Reduction Act, May 1995 

Privacy Act of 1974, as amended 

Social Security Act of 2013 

SSA Departmental Guidance 

ISSH, Information System Security Handbook - http://eis.ba.ssa.gov/ssasso/issh/tableofcontents.htm

OIS Guidance, http://ois.ssahost.ba.ssa.gov/dspp/fisma/security_assessment_authorization.htm 

PRIDE, http://pride.ssahost.ba.ssa.gov/ 

CSAM, https://csamssa.justapps.doj.gov/CSAM/login.aspx?ReturnUrl=%2fCSAM%2fDefault.aspx 

ISAHB, Information Security Authorization Handbook (dated June 2014) 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 171 

Appendix A. <Appendix Name>Appendix body 

 NOTE: Automatic section numbering (Heading 1, Heading 2, etc.) should not be 

applied to the appendix body. The numbering will be a continuation of the numbering 

from the body of the document, and will not accurately reflect the appendix location. 

 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 172 

Appendix B. Acronym List 

 Make sure all acronyms within this document are included in the acronym list. Delete 

any that are not used. 

Acronym Definition 

AO Authorizing Official 

APM Application Portfolio Management 

APP Application 

BRM Business Reference Model 

BSM Boundary Scope Memorandum 

CSAM Cybersecurity Assessment and Management 

CSO Component Security Officer 

DB Database 

DBMS Database Management System 

DCS Deputy Commissioner for Systems 

FIPS Federal Information Processing Standard 

FISMA Federal Information Security Modernization Act 

FOUO For Official Use Only 

FTP File Transfer Protocol 

HW Hardware 

ID Identification 

IPSEC Internet Protocol Security 

ISA Interconnection Security Agreement 

IT Information Technology 

IV&V Independent Verification and Validation 

L2TP Layer 2 Tunneling Protocol 

MA Major Application 

MOA Memorandum of Agreement 

MOU Memorandum of Understanding 

NCC National Computer Center 

NIST National Institute of Standards and Technology 

NMS Network Management System 

OIS Office of Information Security 

OS Operating System 

PDA Personal Digital Assistant 
Social Security Administration 

<System Name><(System Acronym)> 

<Document Name> 

Version <X.X> 

TMP V7.4 FY17 UNCLASSIFIED // FOR OFFICIAL USE ONLY 173 

Acronym Definition 

SAM Security Authorization Manager 

SBU Sensitive But Unclassified 

SCQ Significant Change Questionnaire 

SO System Owner 

SP Special Publication 

SSA Social Security Administration 

SSC Secondary Support Center 

SSP System Security Plan 

V-HW Virtual Hardware 

VPN Virtual Private Network 
EXHIBIT F
Transmittal No. 31 General Records Schedule 4.2

April 2020

50

GENERAL RECORDS SCHEDULE 4.2: Information Access and Protection Records 

This schedule covers records created in the course of agencies (1) responding to requests for access to Government information and (2) protecting information 

that is classified or controlled unclassified, or contains personal data that is required by law to be protected. 

Agencies must offer any records created prior to January 1, 1921, to the National Archives and Records Administration (NARA) before applying disposition 

instructions in this schedule.

Item Records Description Disposition Instruction Disposition 

Authority

001 FOIA, Privacy Act, and classified documents administrative records.

Records on managing information access and protection activities. Records include:

• correspondence related to routine implementation of the FOIA and Privacy Act and 

administration of document security classification

• associated subject files

• feeder and statistical reports

Exclusion: This item does not cover records documenting policies and procedures accumulated in

offices having agency-wide responsibilities for FOIA, Privacy Act, and classified documents. These

records must be scheduled by the agency on an agency-specific schedule.

Temporary. Destroy when 3 

years old, but longer retention 

is authorized if needed for 

business use.

DAA-GRS2019-0001-

0001 

010 General information request files.

Requests for information, publications, photographs, and other information involving no 

administrative action, policy decision, or special compilations or research. Also includes 

acknowledgements, replies, and referrals of inquiries to other offices for response.

Temporary. Destroy when 90 

days old, but longer retention is 

authorized if required for 

business use.

DAA-GRS2013-0007-

0001

020 Access and disclosure request files.

Case files created in response to requests for information under the Freedom of Information Act 

(FOIA), Mandatory Declassification Review (MDR) process, Privacy Act (PA), Classification 

Challenge, and similar access programs, and completed by: 

• granting the request in full 

• granting the request in part 

• denying the request for any reason including:

o inability to fulfill request because records do not exist

o inability to fulfill request because request inadequately describes records

Temporary. Destroy 6 years 

after final agency action or 3 

years after final adjudication by 

the courts, whichever is later, 

but longer retention is 

authorized if required for 

business use. 

DAA-GRS2016-0002-

0001 
Transmittal No. 31 General Records Schedule 4.2

April 2020

51

Item Records Description Disposition Instruction Disposition 

Authority

o inability to fulfill request because search or reproduction fees are not paid

• final adjudication on appeal to any of the above original settlements

• final agency action in response to court remand on appeal

Includes:

• requests (either first-party or third-party)

• replies 

• copies of requested records

• administrative appeals

• related supporting documents (such as sanitizing instructions)

Note 1: Record copies of requested records remain covered by their original disposal authority, but 

if disposable sooner than their associated access/disclosure case file, may be retained under this 

item for disposition with that case file.

Note 2: Agencies may wish to retain redacted copies of requested records for business use after 

the rest of the associated request case file is destroyed. 

030 Information 

access and 

protection 

operational

records. 

Records tracking and controlling access to protected information.

Includes:

• records documenting receipt, internal routing, dispatch, or destruction of 

classified and controlled unclassified records 

• tracking databases and other records used to manage overall access program

• requests and authorizations for individuals to have access to classified and 

controlled unclassified records and information

Note: Records documenting individuals’ security clearances are covered under GRS 

5.6, items 180 and 181.

Temporary. Destroy 2 years 

after last form entry, reply, or 

submission; or when associated 

documents are declassified, 

decontrolled, or destroyed; or 

when an individual’s 

authorization expires; 

whichever is appropriate. 

Longer retention is authorized 

if required for business use.

DAA-GRS2019-0001-

0002 

031 Access control records. 

Includes:

• safe and padlock combinations

• names or other personal identifiers of individuals who know combinations

Temporary. Destroy when 

superseded or obsolete, but 

longer retention is authorized if 

required for business use.

DAA-GRS2013-0007-

0020
Transmittal No. 31 General Records Schedule 4.2

April 2020

52

Item Records Description Disposition Instruction Disposition 

Authority

• comparable data used to control access into classified document containers

032 Records relating to classified or controlled unclassified document containers. 

Includes forms placed on safes, cabinets, or vaults that record opening, closing, and 

routine checking of container security, such as SF-701 and SF-702. 

Note: Forms involved in investigations are not covered by this item. They are 

instead retained according to the schedule item for records of the investigation.

Temporary. Destroy 90 days 

after last entry on form, but 

longer retention is authorized if 

required for business use.

DAA-GRS2016-0002-

0003 

040 Records of accounting for and controlling access to records requested under FOIA, PA, and MDR.

Records documenting identity of, and internal routing, control points, and accountability for 

information to which access has been requested. Includes: 

• forms, registers, ledgers, logs, and tracking systems documenting requester identity and contact 

information, request date, and nature or purpose of request

• inventories

• forms accompanying documents to ensure continuing control, showing names of people 

handling the documents, inter-office routing, and comparable data

• agent and researcher files

Temporary. Destroy 5 years 

after date of last entry or final 

action by agency, as 

appropriate, but longer 

retention is authorized if 

required for business use.

DAA-GRS2019-0001-

0003 

050 Privacy Act accounting of disclosure files.

Files maintained under the provisions of 5 U.S.C. §552a(c) for an accurate accounting of the date, 

nature, and purpose of each disclosure of a record to any person or to another agency. Includes: 

• forms with the subject individual's name

• records of the requester's name and address

• explanations of the purpose for the request

• date of disclosure

• proof of subject individual's consent

Temporary. Dispose of in 

accordance with the approved 

disposition instructions for the 

related subject individual's 

records, or 5 years after the 

disclosure for which the 

accountability was made, 

whichever is later.

NC1-64-77-

1 item 27
Transmittal No. 31 General Records Schedule 4.2

April 2020

53

Item Records Description Disposition Instruction Disposition 

Authority

060 Erroneous release records.

Files relating to the inadvertent release of privileged 

information to unauthorized parties, containing 

information the disclosure of which would constitute 

an unwarranted invasion of personal privacy. Includes:

• requests for information

• copies of replies 

• all related supporting documents

May include:

• official copy of records requested or copies

Records filed with the record-keeping 

copy of the erroneously released 

records. 

Temporary. Follow the 

disposition instructions 

approved for the released 

record copy or destroy 6 years 

after the erroneous release, 

whichever is later.

DAA-GRS2015-0002-

0001

061 Records filed separately from the 

record-keeping copy of the released 

records. 

Temporary. Destroy 6 years 

after the erroneous release, 

but longer retention is 

authorized if required for 

business use. 

DAA-GRS2015-0002-

0002

065 Privacy complaint files.

Records of privacy complaints (and responses) agencies receive in these categories: 

• process and procedural (consent, collection, and appropriate notice)

• redress (inquiries seeking resolution of difficulties or concerns about privacy matters not 

specifically outlined in the Privacy Act)

• operational (inquiries regarding Privacy Act matters but not including Privacy Act requests for 

access and/or correction)

• complaints referred to another organization

Temporary. Destroy 3 years 

after resolution or referral, as 

appropriate, but longer 

retention is authorized if 

required for business use.

DAA-GRS2019-0001-

0004 

070 Agency reports to the Congress, Department of Justice, or other entities regarding FOIA, MDR, PA, 

and similar access and disclosure programs.

Note: This item does not apply to summary reports incorporating government-wide statistics. 

These must be scheduled separately by the summarizing agent.

Temporary. Destroy 2 years 

after date of report, but longer 

retention is authorized if 

required for business use. 

DAA-GRS2013-0007-

0006

080 Legal and regulatory compliance reporting records.

Reports prepared in compliance with Federal laws and 

regulations, such as the E-Government Act (Public Law 

107-347), Federal Information Security Modernization 

Act of 2014, and Title V (Confidential Information 

Annual reports by agency CIO, Inspector 

General, or Senior Agency Official for 

Privacy.

Legal citation: OMB M-07-16.

Temporary. Destroy 5 years 

after submission of report, but 

longer retention is authorized if 

required for business use.

DAA-GRS2013-0007-

0022
Transmittal No. 31 General Records Schedule 4.2

April 2020

54

Item Records Description Disposition Instruction Disposition 

Authority

081 Protection and Statistical Efficiency Act), as codified in 

44 U.S.C. §101.

All other agency reports and internal 

reports by individual system owners to 

the Senior Agency Official for Privacy 

(SAOP). 

Temporary. Destroy 2 years 

after submission of report, but 

longer retention is authorized if 

required for business use.

DAA-GRS2013-0007-

0023

090 Privacy Act amendment request files.

Files relating to an individual’s request to amend a record pertaining to that individual under 5 

U.S.C. §552a(d)(2), to the individual’s request for review of an agency’s refusal to amend a record 

under 5 U.S.C. §552a(d)(3), and to any civil action or appeal brought by the individual against the 

refusing agency under 5 U.S.C. §552a(g). Includes: 

• requests to amend and to review refusal to amend

• copies of agency’s replies 

• statement of disagreement 

• agency justification for refusal to amend a record 

• appeals 

• related materials

Temporary. Destroy with the 

records for which amendment 

was requested or 4 years after 

close of case (final 

determination by agency or 

final adjudication, whichever 

applies), whichever is later. 

Longer retention is authorized 

if required for business use.

DAA-GRS2013-0007-

0007

100 Automatic and systematic declassification review program records. 

Files related to the review of permanent records in anticipation of automatic declassification at 25, 

50, or 75 years per Executive Order 13526, and the periodic review of records exempted from 

automatic declassification. Files include program records documenting declassification decisions.

Temporary. Destroy or delete 

30 years after completion of 

review, but longer retention is 

authorized if required for 

business use.

DAA-GRS2013-0007-

0008

110 Fundamental classification guidance review files.

Reports, significant correspondence, drafts, received comments, and related materials responding 

to “fundamental classification guidance review” as required by Executive Order 13526 Section 1.9.

Note: This item does not cover reports and correspondence received at the Information Security 

Oversight Office (ISOO).

Temporary. Destroy 5 years 

after report is submitted to 

ISOO, but longer retention is 

authorized if required for 

business use. 

DAA-GRS2013-0007-

0011

120 Classified information nondisclosure agreements.

Copies of nondisclosure agreements, such as SF 312, 

Classified Information Nondisclosure Agreement, 

Records maintained in the individual’s 

official personnel folder.

Apply the disposition for the 

official personnel folder.
Transmittal No. 31 General Records Schedule 4.2

April 2020

55

Item Records Description Disposition Instruction Disposition 

Authority

121 signed by civilian and military personnel with access to 

information that is classified under standards put forth 

by executive orders governing security classification. 

Records maintained separately from the 

individual’s official personnel folder.

Legal citations: 

ICD 703, Protection of Classified National 

Intelligence; 32 CFR 2001.80(d)(2)(vii).

Temporary. Destroy when 50 

years old.

DAA-GRS2015-0002-

0003

130 Personally identifiable information extracts.

System-generated or hardcopy print-outs generated for business purposes that contain Personally 

Identifiable Information.

Legal citation: OMB M-07-16 (May 22, 2007), Attachment 1, Section C, bullet “Log and Verify.”

Temporary. Destroy when 90 

days old or no longer needed 

pursuant to supervisory 

authorization, whichever is 

appropriate.

DAA-GRS2013-0007-

0012

140 Personally identifiable information extract logs.

Logs that track the use of PII extracts by authorized users, containing some or all of: date and time 

of extract, name and component of information system from which data is extracted, user 

extracting data, data elements involved, business purpose for which the data will be used, length 

of time extracted information will be used. Also includes (if appropriate): justification and 

supervisory authorization for retaining extract longer than 90 days, and anticipated disposition 

date.

Temporary. Destroy when 

business use ceases.

DAA-GRS2013-0007-

0013

150 Privacy Act System of Records Notices (SORNs).

Agency copy of notices about the existence and character of systems of records, documenting 

publication in the Federal Register when the agency establishes or revises the system, per the 

Privacy Act of 1974 [5 U.S.C. 552a(e)(4) and 5 U.S.C. 552a(e)(11)], as amended. Also significant 

material documenting SORN formulation, other than Privacy Impact Assessment records (see item 

161).

Temporary. Destroy 2 years 

after supersession by a revised 

SORN or after system ceases 

operation, but longer retention 

is authorized if required for 

business use.

DAA-GRS2016-0003-

0002

160 Records analyzing Personally Identifiable 

Information (PII). 

Records documenting whether certain privacy 

and data security laws, regulations, and 

agency policies are required; how the agency 

collects, uses, shares, and maintains PII; and 

incorporation of privacy protections into 

Records of Privacy Threshold Analyses (PTAs)

and Initial Privacy Assessments (IPAs). 

Records of research on whether an agency 

should conduct a Privacy Impact Assessment 

(PIA).

Temporary. Destroy 3 years 

after associated PIA is 

published or determination 

that PIA is unnecessary, but 

longer retention is authorized if 

required for business use.

DAA-GRS2016-0003-

0003 
Transmittal No. 31 General Records Schedule 4.2

April 2020

56

Item Records Description Disposition Instruction Disposition 

Authority

161 records systems as required by the EGovernment Act of 2002 (Public Law 107-347, 

section 208), the Privacy Act of 1974 (5 U.S.C. 

552a), and other applicable privacy laws, 

regulations, and agency policies. Includes

significant background material documenting 

formulation of final products. 

Records of Privacy Impact Assessments (PIAs). Temporary. Destroy 3 years 

after a superseding PIA is 

published, after system ceases 

operation, or (if PIA concerns a 

website) after website is no 

longer available to the public, 

as appropriate. Longer 

retention is authorized if 

required for business use.

DAA-GRS2016-0003-

0004

170 Computer matching program notices and agreements.

Agency copy of notices of intent to share data in systems of records with other Federal, state, or 

local government agencies via computer matching programs, and related records documenting 

publication of notice in the Federal Register per the Privacy Act of 1974 [5 U.S.C. 552a(e)(12)], as 

amended. Also agreements between agencies, commonly referred to as Computer Matching 

Agreements, prepared in accordance with Office of Management and Budget Final Guidance. 

Includes documentation of Data Integrity Board (DIB) review and approval of matching programs 

and agreements, and significant background material documenting formulation of notices and 

agreements. 

Temporary. Destroy upon 

supersession by a revised 

notice or agreement, or 2 years

after matching program ceases

operation, but longer retention 

is authorized if required for 

business use.

DAA-GRS2016-0003-

0005 

180 Virtual public access library records.

Records published by an agency on line to fulfill the requirement in 5 U.S.C. 552(a)(2)(A) through 5 

U.S.C. 552(a)(2)(D) and 5 U.S.C. 552(g)(1) through 5 U.S.C. 552(g)(3) that agencies must make those 

records available for public inspection and copying. Includes:

• final concurring and dissenting opinions and orders agencies issue when adjudicating cases

• statements of policy and interpretations the agency adopts but does not publish in the Federal 

Register

• administrative staff manuals and instructions to staff that affect a member of the public

• copies of records requested under the Freedom of Information Act (FOIA) which, because of the 

nature of their subject matter, the agency determines are, or are likely to become, the subject of 

subsequent requests for substantially the same records or which have been requested three or 

more times

• indexes of agency major information systems

Temporary. Destroy when no 

longer needed. 

DAA-GRS2016-0008-

0001
Transmittal No. 31 General Records Schedule 4.2

April 2020

57

Item Records Description Disposition Instruction Disposition 

Authority

• descriptions of agency major information and record locator systems

• handbooks for obtaining various types and categories of agency public information

Exclusion: This item refers only to copies an agency publishes on line for public reference. The 

agency record copy of such material may be of permanent value and the agency must schedule it.

Not media neutral. Applies to electronic records only.

Controlled Unclassified Information (CUI) program records.

Exclusion: Records of the Controlled Unclassified Information Executive Agent office at the National Archives (NARA must schedule these records 

separately).

190 CUI program implementation records. 

Records of overall program management. Includes:

• records documenting the process of planning agency policy and procedure 

• agency submissions to the CUI Executive Agent of authorities (laws, Federal regulations, or 

Government-wide policies containing safeguarding or dissemination controls) the agency 

proposes to include in the CUI Registry to designate unclassified information as CUI

• agency submissions to the CUI Executive Agent of proposed laws, Federal regulations, or 

Government-wide policies that would establish, eliminate, or modify a category of CUI, or 

change information controls applicable to CUI

• correspondence with CUI Executive Agent

Exclusion 1: CUI directives and formal policy documents (agencies must schedule these 

separately). 

Exclusion 2: Records of CUI self-inspections (GRS 5.7, item 020 covers these). 

Exclusion 3: Records of annual program reports to the CUI Executive Agent (GRS 5.7, item 050 

covers these).

Temporary. Destroy when 7 

years old, but longer retention 

is authorized if required for 

business use.

DAA-GRS2019-0001-

0005 

191 CUI information sharing agreements.

Agreements in which agencies agree to share CUI with non-executive branch entities (e.g., state 

and local police) and foreign entities that agree to protect the CUI.

Temporary. Destroy 7 years 

after canceled or superseded, 

but longer retention is 

DAA-GRS2019-0001-

0006 
Transmittal No. 31 General Records Schedule 4.2

April 2020

58

Item Records Description Disposition Instruction Disposition 

Authority

Exclusion: Contracts involving CUI and contractor access to CUI; GRS 1.1, item 010 covers 

contracts.

authorized if required for 

business use.

192 Records of waivers of CUI requirements.

Description of and rationale for each waiver, documentation of alternate steps the agency takes to 

ensure it sufficiently protects the CUI covered by the waiver, and records of the agency notifying 

authorized recipients and the public of the waiver.

Temporary. Destroy when 

waiver is rescinded, system is 

no longer in use, or all affected

records are destroyed, as 

applicable, but longer retention 

is authorized if required for 

business use.

DAA-GRS2019-0001-

0007 

193 Records of requests for decontrol and challenges to CUI 

designations.

Requests to decontrol CUI or challenging a CUI marking as 

incorrect (either improperly assigned or lacking), responses to 

requests, records of adjudication, and records of dispute 

resolution if adjudication is appealed.

Records filed with the recordkeeping copy of the CUImarked records.Follow the disposition 

instructions approved for the 

records at issue. 

194 Records filed separately from 

the record-keeping copy of the 

CUI-marked records.

Temporary. Destroy 6 years 

after change in CUI status, but 

longer retention is authorized if 

required for business use.

DAA-GRS2019-0001-

0008

195 Records of CUI misuse.

Allegations of CUI misuse, records of internal investigations, communications with and reports of 

findings from the CUI Executive Agent, and records of corrective actions.

Exclusion: If the agency assigns such investigations to its Inspector General (IG), the agency 

schedule for IG records covers the records created in the IG office.

Temporary. Destroy 5 years 

after completing the 

investigation or completing all 

corrective actions, whichever is 

later, but longer retention is 

authorized if required for 

business use.

DAA-GRS2019-0001-

0009
EXHIBIT G
2352.224-2B – Worksheet for Reporting a Loss or a Suspected Loss of Personally 

Identifiable Information (PII) (MAY 2019) 

INSTRUCTIONS 

The purpose of this worksheet is to assist individuals, entities (including contractors), or agencies 

who lose or suspect the loss of Social Security Administration (SSA) PII. (See Note number 1, 

below.) This worksheet should be used as an information-gathering tool to quickly organize and 

report to SSA the needed information about the loss or suspected loss. However, do not include 

PII specific to the loss on this worksheet. 

Employees and individuals should not wait until confirmation of loss occurred before reporting. 

Both confirmed and suspected losses should be timely reported. A delay may undermine the 

agency’s ability to apply preventative and remedial measures to protect the PII or reduce the risk 

of harm to potentially affected individuals. 

All PII losses, suspected or confirmed, should be reported within one (1) hour of discovery using 

the online PII Loss Reporting Tool (see Note number 2, below) or by calling SSA’s National 

Network Service Center (NNSC) at 1-877-697-4889. 

Notes: 

1. PII is information that can be used to distinguish or trace an individual’s identity, either 

along or when combined with other information that is linked or linkable to a specific 

individual (e.g., name, date of birth, Social Security number). 

2. The “PII Loss Reporting Tool” is located on the SSA Intranet and may not be accessible 

to all contractors. 

Basic Information for the Contractor for Reporting PII Loss (Suspected or Confirmed): 

a. Your primary agency contact for reporting PII breach incidents. This is: [Contracting 

Officer: Fill in the name and contact information (phone number(s), address, etc.) of the 

primary agency contact. This should be COR-COTR. For task-order contracts with various 

COR-TMs, write, “Also, contact the Task Manager.”] 

b. The alternates to this primary contact. They are as follows: 

 First Alternate: [Contracting Officer: Fill in the name and contact information (work 

phone number(s), address, etc.) of the First Alternate agency contact. This should be the 

Alternate COR-COTR.] 

 Second Alternate: [Contracting Officer: Fill in the name and contact information (work 

phone number(s), address, etc.) of the Second Alternate agency contact. If none, write “N/A.”] 

c. The contract number: [Contracting Officer: Fill in the contract number when available.] 
d. Agency/Entity/Office (see Item #1 of the worksheet): [Contracting Officer: fill in the office 

name of the program office where the contractor will be working, including the Deputy 

Commissioner-level office. If the answer can vary, e.g., under a task-order contract where there 

are a number of offices, you may write “Various” and instruct the COTR to have each Task 

Manager fill in this information and provide the filled-in copy to the contractor for distribution 

to its employees working under the task order.] 

1. Information about the individual making the report: 

 

Name: 

Position: 

 Agency/Entity/Office: 

Work Email Address: 

Work Phone Number: 

Date of Report to SSA: 

2. Is the individual, who was in possession of the data or to whom the data was 

assigned, different from the person making the report (as listed in #1)? 

Same as person making the report? [ ] Yes [ ] No 

If no, complete the following for the individual who was in possession/assigned the data: 

Name: 

Position: 

 

Agency/Entity/Office: 

 Work Email Address: 

Work Phone Number: 

3. Circumstances of the breach: 

Is the incident a result of robbery or theft? [ ] Yes [ ] No 

Did the incident include equipment? [ ] Yes [ ] No 
Full description of how the incident occurred: 

 

Date/Time of Incident: 

4. Information about the data that was lost/stolen: 

Describe what was lost or stolen: 

 

Did the incident occur while teleworking or performing duties at (or traveling to/from an 

alternative worksite? 

 

 Estimated number of individuals affected: 

What elements of PII did the data contain? 

[ ] Name [ ] Bank Account Information 

[ ] Social Security number [ ] Medical/Health Information

 [ ] Date of Birth [ ] Benefit Payment Information 

 [ ] Place of Birth [ ] Mother’s Maiden Name 

 [ ] Address [ ] Medicare Beneficiary Identifier 

[ ] Other (describe): 

Are you able to identify the individual(s) whose information was compromised? 

[ ] Yes [ ] No 

5. How was the data physically stored, packaged and/or contained? If electronic, check 

the appropriate response below: 

[ ] Laptop [ ] Workstation 

[ ] Hard Drive [ ] CD/DVD
 [ ] USB Drive [ ] Tablet 

 [ ] Server [ ] Cloud 

[ ] Cell Phone/Black Berry Phone Number: 

Hardware Make/Model: Hardware Serial Number: 

 

[ ] Email 

 

[ ] Other (describe): 

Was the device encrypted? [ ] Yes [ ] No 

Was the device password protected? [ ] Yes [ ] No 

Was a VPN SmartCard lost? [ ] Yes [ ] No 

6. Others contacted and reports filed about the breach: (Include Deputy 

Commissioner level, agency level, regional/associate level component names) 

Federal Protective Service Report: [ ] Yes [ ] No 

Local Police Report: [ ] Yes [ ] No 

AIRS Incident Reporting Form: [ ] Yes [ ] No 

SSA-342: [ ] Yes [ ] No 

Other: 

Have other SSA components been contacted? [ ] Yes [ ] No 

If so, please list other contacted SSA components (including the OIG): 

 

Media Interest: [ ] Yes [ ] No 

Congressional Interest: [ ] Yes [ ] No 

Actions Taken: 

 
Other Information: 

(End of clause) 
EXHIBIT H



EXHIBIT I
Updated 5/2016

Federal Investigations Notice

Fair Credit Reporting Act of 1970, as amended 

PLEASE TAKE NOTICE THAT ONE OR MORE CONSUMER CREDIT REPORTS MAY BE 

OBTAINED FOR EMPLOYMENT PURPOSES PURSUANT TO THE FAIR CREDIT 

REPORTING ACT, AS AMENDED, 15 U. S. C., §1681, ET SEQ. SHOULD A DECISION TO 

TAKE ANY ADVERSE ACTION AGAINST YOU BE MADE, BASED EITHER IN WHOLE 

OR IN PART ON THE CONSUMER CREDIT REPORT, THE CONSUMER REPORTING 

AGENCY THAT PROVIDED THE REPORT PLAYED NO ROLE IN THE AGENCY'S 

DECISION TO TAKE SUCH ADVERSE ACTION. 

Information provided by you on this form will be furnished to the consumer reporting agency in 

order to obtain information in connection with an investigation to determine your (1) fitness for 

Federal employment, (2) clearance to perform contractual service for the Federal Government, 

and/or (3) security clearance or access. The information obtained may be redisclosed to other 

Federal agencies for the above purposes and in fulfillment of official responsibilities to the extent 

that such disclosure is permitted by law. 

I hereby authorize the _____________________________ to obtain such report(s) from any 

(Name of Requesting Agency) 

consumer/credit reporting agency for employment purposes. 

________________________________ _______________________ 

 (Print Name) (SSN) 

_________________________________ _______________________ 

 (Signature) (Date)

Your Social Security Number is needed to keep records accurate, because other people may have 

the same name. Executive Order 9397 also asks Federal agencies to use this number to help 

identify individuals in agency records. 
Updated 5/2016

FAIR CREDIT AUTHORIZATION FORM 

A Summary of Your Rights Under the Fair Credit Reporting Act 

The federal Fair Credit Reporting Act (FCRA) promotes the accuracy, fairness, and privacy of 

information in the files of consumer reporting agencies. There are many types of consumer 

reporting agencies, including credit bureaus and specialty agencies (such as agencies that sell 

information about check writing histories, medical records, and rental history records). Here is a 

summary of your major rights under the FCRA. For more information, including information 

about additional rights, go to www.consumerfinance.gov/learnmore or write to: Consumer 

Financial Protection Bureau, 1700 G Street N.W., Washington, DC 20552. 

 You must be told if information in your file has been used against you. Anyone who 

uses a credit report or another type of consumer report to deny your application for credit, 

insurance, or employment – or to take another adverse action against you – must tell you, 

and must give you the name, address, and phone number of the agency that provided the 

information. 

 You have the right to know what is in your file. You may request and obtain all the 

information about you in the files of a consumer reporting agency (your “file 

disclosure”). You will be required to provide proper identification, which may include 

your Social Security number. In many cases, the disclosure will be free. You are entitled 

to a free file disclosure if: 

o a person has taken adverse action against you because of information in your 

credit report; 

o you are the victim of identity theft and place a fraud alert in your file; 

o your file contains inaccurate information as a result of fraud; 

o you are on public assistance; 

o you are unemployed but expect to apply for employment within 60 days. 

In addition, all consumers are entitled to one free disclosure every 12 months upon request from 

each nationwide credit bureau and from nationwide specialty consumer reporting agencies. See 

www.consumerfinance.gov/learnmore for additional information. 

 You have the right to ask for a credit score. Credit scores are numerical summaries of 

your credit-worthiness based on information from credit bureaus. You may request a 

credit score from consumer reporting agencies that create scores or distribute scores used 

in residential real property loans, but you will have to pay for it. In some mortgage 

transactions, you will receive credit score information for free from the mortgage lender. 

 You have the right to dispute incomplete or inaccurate information. If you identify 

information in your file that is incomplete or inaccurate, and report it to the consumer 

reporting agency, the agency must investigate unless your dispute is frivolous. See 

www.consumerfinance.gov/learnmore for an explanation of dispute procedures. 

 Consumer reporting agencies must correct or delete inaccurate, incomplete, or 

unverifiable information. Inaccurate, incomplete, or unverifiable information must be 

removed or corrected, usually within 30 days. However, a consumer reporting agency 

may continue to report information it has verified as accurate. 
Updated 5/2016

 Consumer reporting agencies may not report outdated negative information. In most 

cases, a consumer reporting agency may not report negative information that is more than 

seven years old, or bankruptcies that are more than 10 years old. 

 Access to your file is limited. A consumer reporting agency may provide information 

about you only to people with a valid need -- usually to consider an application with a 

creditor, insurer, employer, landlord, or other business. The FCRA specifies those with a 

valid need for access. 

 You must give your consent for reports to be provided to employers. A consumer 

reporting agency may not give out information about you to your employer, or a potential 

employer, without your written consent given to the employer. Written consent generally 

is not required in the trucking industry. For more information, go to 

www.consumerfinance.gov/learnmore. 

 You many limit “prescreened” offers of credit and insurance you get based on 

information in your credit report. Unsolicited “prescreened” offers for credit and 

insurance must include a toll-free phone number you can call if you choose to remove 

your name and address from the lists these offers are based on. You may opt out with the 

nationwide credit bureaus at 1-888-5-OPTOUT (1-888-567-8688). 

 You may seek damages from violators. If a consumer reporting agency, or, in some 

cases, a user of consumer reports or a furnisher of information to a consumer reporting 

agency violates the FCRA, you may be able to sue in state or federal court. 

 Identity theft victims and active duty military personnel have additional rights. For 

more information, visit www.consumerfinance.gov/learnmore. 

States may enforce the FCRA, and many states have their own consumer reporting laws. In 

some cases, you may have more rights under state law. For more information, contact your 

state or local consumer protection agency or your state Attorney General. For information 

about your federal rights, contact:

TYPE OF BUSINESS: CONTACT:

1.a. Banks, savings associations, and credit 

unions with total assets of over $10 billion and 

their affiliates 

b. Such affiliates that are not banks, savings 

associations, or credit unions also should list, 

in addition to the CFPB: 

a. Consumer Financial Protection Bureau 

1700 G Street, N.W. Washington, DC 20552

b. Federal Trade Commission: Consumer 

Response Center – FCRA

Washington, DC 20580 

(877) 382-4357 

2. To the extent not included in item 1 above: 

a. National banks, federal savings associations, 

and federal branches and federal agencies of 

foreign banks 

b. State member banks, branches and agencies 

of foreign banks (other than federal branches, 

federal agencies, and Insured State Branches of 

a. Office of the Comptroller of the Currency 

Customer Assistance Group 

1301 McKinney Street, Suite 3450 

Houston, TX 77010-9050 

b. Federal Reserve Consumer Help Center 

P.O. Box. 1200 

Minneapolis, MN 55480
Updated 5/2016

Foreign Banks), commercial lending 

companies owned or controlled by foreign 

banks, and organizations operating under 

section 25 or 25A of the Federal Reserve Act 

c. Nonmember Insured Banks, Insured State 

Branches of Foreign Banks, and insured state 

savings associations 

d. Federal Credit Unions 

c. FDIC Consumer Response Center 

1100 Walnut Street, Box #11 

Kansas City, MO 64106 

d. National Credit Union Administration 

Office of Consumer Protection (OCP) 

Division of Consumer Compliance and 

Outreach (DCCO) 

1775 Duke Street 

Alexandria, VA 22314 

3. Air carriers Asst. General Counsel for Aviation 

Enforcement & Proceedings 

Aviation Consumer Protection Division 

Department of Transportation 

1200 New Jersey Avenue, S.E. 

Washington, DC 20590 

4. Creditors Subject to the Surface 

Transportation Board 

Office of Proceedings, Surface Transportation 

Board, Department of Transportation 

395 E Street, S.W. Washington, DC 20423 

5. Creditors Subject to the Packers and 

Stockyards Act, 1921 

Nearest Packers and Stockyards 

Administration Area Supervisor 

6. Small Business Investment Companies Associate Deputy Administrator for Capital 

Access, United States Small Business 

Administration 

409 Third Street, S.W., 8th Floor 

Washington, DC 20416 

7. Brokers and Dealers Securities and Exchange Commission 

100 F Street, N.E.

Washington, DC 20549 

8. Federal Land Banks, Federal Land Bank 

Associations, Federal Intermediate Credit 

Banks, and Production Credit Associations 

Farm Credit Administration 

1501 Farm Credit Drive 

McLean, VA 22102-5090 

9. Retailers, Finance Companies, and All Other 

Creditors Not Listed Above 

FTC Regional Office for region in which the 

creditor operates or Federal Trade

Commission: Consumer Response Center –

FCRA 

Washington, DC 20580 (877) 382-4357 

Para información en español, visite www.consumerfinance.gov/learnmore o escribe a la 

Consumer Financial Protection Bureau, 1700 G Street N.W., Washington, DC 20552.
EXHIBIT J
 

 

 

 

 

 

Additional Questions for Public Trust Positions - Branching

INSTRUCTIONS 

This form is a supplement to the Standard Form 85P, Questionnaire for Public Trust Positions, currently in use in NBIB automated systems. Use 

of this form in addition to the e-QIP SF85P equates to the SF85P approved by OMB in October 2017. This is an interim collection method until 

 such time the SF85P is updated in e-QIP.

IDENTIFICATION INFORMATION 

1 - FULL NAME: Enter your name as it appears on your SF 85P, Questionnaire for Public Trust Positions.

Last Name First Name Middle Name Jr., II, etc. 

2 - NBIB CASE NUMBER: If applicable. 

PUBLIC TRUST QUESTIONS 

3 - EDUCATION: Have you received a degree more than seven (7) years ago? If YES, 

provide details in section 3A. 

Yes No 

3A – Education Details 

Dates of Attendance 

FROM: 

TO: 

(MM/YY Month and Year)

Choose Type of 

Qualification 





Degree 

Other 

If other please provide: 

Date Awarded 

MONTH:

YEAR: 

Choose the most appropriate 

characterization of the school 





College/University/Military 

College 

Vocational/Technical/Trade 

School 

 Correspondence/Distance/ 

Extension/Online School 

Name of School 

Street Address of School City State Zip code 

Use the continuation sheet on the back if you have more than one degree earned more than 7 years ago.

For each Yes response on questions 4 through 30, corresponding branching questions starting 

on page 5 must be completed.

Yes/No Questions Yes No 

4 – Have you EVER been issued a passport (or identity card for travel) by a country other 

than the U.S.? 

5 – In the last seven (7) years, have you received a written warning, been officially 

reprimanded, suspended, or disciplined for misconduct in the workplace, such as violation of 

a security policy? 

6 – In the last seven (7) years, have you been subject to court martial or other disciplinary 

procedure under the Uniform Code of Military Justice (UCMJ), such as Article 15, Captain’s 

Mast, Article 135 Court of Inquiry, etc.? (If no prior military service, answer “No”.) 

7 – Have you EVER served as a civilian or military member, in a foreign country’s military, 

intelligence, diplomatic, security forces, militia, other defense force, or government agency? 

8 – Have you EVER been convicted of an offense involving domestic violence or a crime 

of violence (such as battery or assault) against your child, dependent, cohabitant, spouse 

or legally recognized civil union/domestic partner, former spouse or former legally 

recognized civil union/domestic partner, or someone with whom you share a child in 

common? 
9 – Is there currently a domestic violence protective order or restraining order issued against 

you? 

 

 

 

 

 

 

 

 

10 – In the last seven (7) years, have you illegally used any drugs or controlled substances? 

Use of a drug or controlled substance includes injecting, snorting, inhaling, swallowing, 

experimenting with or otherwise consuming any drug or controlled substance. 

11 – In the last seven (7) years, have you been involved in the illegal purchase, 

manufacture, cultivation, trafficking, production, transfer, shipping, receiving, handling or 

sale of any drug or controlled substance? 

12 – In the last seven (7) years, have you illegally used or otherwise been involved with a 

drug or controlled substance while employed as a law enforcement officer, prosecutor, or 

courtroom official; or while in a position directly and immediately affecting the public safety 

other than previously listed? 

13 – In the last seven (7) years, have you intentionally engaged in the misuse of prescription 

drugs, regardless of whether or not the drugs were prescribed for you or someone else? 

Yes/No Questions Yes No 

14 – In the last seven (7) years, have you been ordered, advised, or asked to seek 

counseling or treatment as a result of your illegal use of drugs or controlled substances? 

15 – In the last seven (7) years, have you voluntarily sought counseling or treatment as a 

result of your use of a drug or controlled substance? 

16 – In the last seven (7) years, have you filed a petition under any chapter of the 

bankruptcy code? 

17 – In the last seven (7) years, have you failed to meet financial obligations due to 

gambling? 

18 – In the past seven (7) years, have you failed to file or pay Federal, state or other taxes 

when required by law or ordinance? 

19 – In the past seven (7) years, have you been over 120 days delinquent on any debt? 

(Include financial obligations for which you were the sole debtor, as well as those for which 

you were a cosigner or guarantor.) 

20 – In the last seven (7) years, has your use of alcohol had a negative impact on your work 

performance, your professional relationships, or resulted in intervention by law 

enforcement/public safety personnel? 

21 – In the last seven (7) years, have you illegally or without proper authorization 

accessed or attempted to access any information technology system? 
 

 

 

 

 

 

Yes/No Questions Yes No 

22 – In the last seven (7) years, have you illegally or without authorization, modified, 

destroyed, manipulated, or denied others access to information residing on an information 

technology system or attempted any of the above? (Above refers to the actions listed in this 

question) 

23 – In the last seven (7) years, have you introduced, removed, or used hardware, 

software, or media in connection with any information technology system without 

authorization, when specifically prohibited by rules, procedures, guidelines, or regulations or 

attempted any of the above? (Above refers to the actions listed in this question) 

24 – Are you now or have you EVER been a member of an organization dedicated to 

terrorism, either with an awareness of the organization’s dedication to that end, or with the 

specific intent to further such activities? 

25 – Have you EVER knowingly engaged in any acts of terrorism? 

26 – Have you EVER advocated any acts of terrorism or activities designed to overthrow 

the U.S. Government by force? 

27 – Have you EVER been a member of an organization dedicated to the use of violence 

or force to overthrow the U.S. Government, and which engaged in activities to that end with 

an awareness of the organization’s dedication to that end or with the specific intent to 

further such activities? 

28 – Have you EVER been a member of an organization that advocates or practices 

commission of acts of force or violence to discourage others from exercising their rights 

under the U.S. Constitution or any state of the United States with the specific intent to further 

such action? 

29 – Have you EVER knowingly engaged in activities designed to overthrow the 

U.S. Government by force? 

30 – Have you EVER associated with anyone involved in activities to further terrorism? 

CERTIFICATION 

Certification That My Answers Are True 

My statements on this form, and any attachments to it, are true, complete, and correct to the best of my 

knowledge and belief and are made in good faith. I understand that a knowing and willful false statement on 

this form can be punished by fine or imprisonment or both. (See section 1001 of title 18, United States Code). 

Signature Date 
Question 4

4a. Country in which the passport (or identity card ) was issued

4b. Date the passport (or identity card) was issued

4c. Place the passport (or identity card) was issued (City and Country)

4d. Full Name under which passport (or identity card) was issued 

4e. Passport (or identity card) Number

4f. Passport (or identity card) expiration date

4g. What is the reason for the foreign passport (or identity card)?

4h. Have you ever used this passport (or identity card) for foreign travel? No Yes 

4i. Countries to which you have traveled on this passport (or identity card) and the dates involved with each

4j. Do you have an additional foreign passport (or identity card)?

If yes, please use the continuation sheet on page 20 to provide the information

Question 5

5a. Date of incident (Month/Year)

5b. Reason/details

5c. Location of incident (Street address, City, State, Zip Code or Country)

5d. Final outcome/result

5e. Date of outcome/result (Month/Year)

Country From To

Country From To

Country From To 

Country From To

Country From To

Country From To

5f. Do you have other incidents to report? Yes No

Yes No

Estimated

Estimated

If yes, please use the continuation sheet on page 20 to provide the information
Question 6

6a. Date of the court martial or other disciplinary procedure

(month/year)

6b. Description of the Uniform Code of Military Justice (UCMJ) offense(s) for which you were charged

6c. Name of the disciplinary procedure, such as court martial, Article15, Captains Mast, Article 135 Court of inquiry, etc...

6d. Description of the military court or other authority in which you were charged (title of court 

or convening authority, address, to include city and state or country if overseas)

6e. Description of the final outcome of the disciplinary procedure, such as found guilty, found not 

guilty, fine, reduction of rank, imprisonment, etc.

6f. Do you have other instances of military discipline in the last seven years? Yes No

If yes, please use the continuation sheet on page 20 to provide the information

Question 7

7a. During your foreign service, which organization were you serving under:

Military (Army, Navy, Air Force, Marines, etc. Intelligence Service

Diplomatic Service 

Militia 

Security Forces

Other Defense Forces (Specify)

Other Government Agency (Specify)

If other Government Agency or Defense Forces, please specify

7b. Name of the foreign organization

7c. Period of Service (Estimated)

7d. Name of Country Served 7e. Highest position/rank held 

7f. Division/department/office in which you served 

7g. Describe the circumstances of your association with this organization

7h. Describe reason for leaving this service

7i. Do you have further foreign service? Yes No

If yes, please use the continuation sheet on page 20 to provide the information

Estimated
Question 8

8a. Date of the offense (Month/Year) Estimated

8b. Describe the nature of the offense 

8c. Name of the court 8d. Court location (Street address, City, State, Zip Code or Country

8e. Provide all charges brought against you for this offense, and the outcome of each charged offense (such as 

found guilty, found not guilty, or charge dropped or "nolle pros," etc.). If you were found guilty of or plead guilty to a 

lesser offense, list both the original charge and the lesser offense separately.

8f. Felony/Misdemeanor/Other? 8g. What was the charge

8h. Date of the outcome (Month/Year)

8i. Were you sentenced as a result of these charges? Yes No

1. If yes, describe the sentence

2. Were you sentenced to imprisonment for a term exceeding one year? No

3. Were you incarcerated as a result of that sentence for not less than 1 year? Yes No

4. If the conviction resulted in

imprisonment, provide the dates that

you were incarcerated

From

To

8j. If no to being sentenced, are you currently on trial, awaiting trial, or awaiting sentencing on

criminal charges for this offense? Explain

8k. Do you have any other offenses? 

If yes, please use the continuation sheet on page 20 to provide 

information Question 9

 9a. Date the order was issued Estimated

 9b. Name of the court or agency that issued the order.

9c. Location of court or agency that issued the order (Street address, City, State, Zip Code, Country) 

9d. Do you have any other domestic violence protective orders or restraining 

orders currently issued against you? Yes No

Yes

Yes No

If yes, please use the continuation sheet on page 20 to provide information
 Estimated

Question 10

10a. Type of drug or controlled substance:

Cocaine or crack cocaine (Such as rock, freebase, etc.) 

Stimulants (Such as amphetamines, speed, crystal meth, ecstasy, etc.)

THC (Such as marijuana, weed, pot, hashish, etc.)

Depressants (Such as barbituates, methaqualone, tranquilizers, etc)

Ketamine (Such as special K, jet, etc)

Narcotics (Such as opium, morphine, codeine, heroine, etc.)

Hallucinogenic (Such as LSD, PCP, mushrooms, etc.)

Steroids (Such as the clear, juice, etc.)

Inhalants (Such as toluene, amyl nitrate, etc.)

Other (Provide Explanation)

10b. Estimate month and year of first use Estimated

10c. Estimate month and year of most recent use

10d. Nature of use, frequency and number of times used

10e. Was your use while you were employed as a law enforcement officer, prosecutor, or courtroom

official, or while in a position directly and immediately affecting public safety? Yes No

10f. Was your use while possessing a security clearance? Yes No

10g. Do you intend to use this drug or controlled substance in the future? Yes No

10h. Explain why you intend or do not intend to use this drug or controlled substance in the future.

Yes No

10i. Do you have an additional instance(s) of illegal use of a drug or controlled substance?

If yes, please use the continuation sheet on page 20 to provide information

Question 11

11a. Type of drug or controlled substance:

Cocaine or crack cocaine (Such as rock, freebase, etc.) 

Stimulants (Such as amphetamines, speed, crystal meth, ecstasy, etc.)

THC (Such as marijuana, weed, pot, hashish, etc.)

Depressants (Such as barbituates, methaqualone, tranquilizers, etc)

Ketamine (Such as special K, jet, etc)

Narcotics (Such as opium, morphine, codeine, heroine, etc.)

Hallucinogenic (Such as LSD, PCP, mushrooms, etc.)

Steroids (Such as the clear, juice, etc.)

Inhalants (Such as toluene, amyl nitrate, etc.)

Other (Provide Explanation)

11b. Estimate month and year of first involvement 

11c. Estimate month and year of most recent involvement Estimated

Estimated
11d. Nature of involvement and frequency

11e. Reason for engagement in the activity

11f. Was your involvement while you were employed as a law enforcement officer, prosecutor, or courtroom 

official, or while in a position directly and immediately affecting public safety? Yes No

11g. Was your involvement while possessing a security clearance? Yes No

11h. Do you intend to be involved with this drug or controlled substance in the future? Yes No

11i. Explain why you intend or do not intend to be involved with this drug or controlled substance in the future

11j. Do you have an additional instance(s) of illegal involvement with any drug or controlled substance?

If yes, please use the continuation sheet on page 20 to provide information Yes No

Question 12

12a. Describe the drugs or controlled substances used and your involvement

12b. Dates of involvement From To Estimated

12c. Estimate the number of times you used and/or were involved with this drug or controlled substance

 while employed in this capacity

12d. Do you have an additional instance(s) of illegal use or involvement with a drug or controlled 

substance while employed as a law enforcement officer, prosecutor, or courtroom official; or while in 

a position directly and immediately affecting the public safety? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 13

13a. Name of the prescription drug that you misused

13b. Dates of involvement From To Estimated

13c. Reason(s) for and circumstances of the misuse of the prescription drug
13d. Was your involvement while you were employed as a law enforcement officer, prosecutor, or courtroom 

official, or while in a position directly and immediately affecting the public safety?

Yes No

13e. Was your involvement while possessing a security clearance? Yes No

13f. Do you have additional instance(s) of intentionally engaging in the misuse of prescription 

drugs in the last seven (7) years? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 14

14a. Have any of the following ordered, advised, or asked you to seek counseling or treatment as a result of

your illegal use of drugs or controlled substances?

An employer, military commander, or employee assistance program

A medical professional

A mental health professional

A court official/judge

14b. If you have not been ordered, advised, or asked to seek counseling or treatment by one of partie

already mentioned, explain

s

14c. Did you take action to receive counseling or treatment? Yes No

1. If no, explain

2. If yes, type of drug or controlled substance for which you were treated:

A. Type of drug or controlled substance for which you were treated:

Cocaine or crack cocaine (Such as rock, freebase, etc.) 

Stimulants (Such as amphetamines, speed, crystal meth, ecstasy, etc.)

THC (Such as marijuana, weed, pot, hashish, etc.)

Depressants (Such as barbituates, methaqualone, tranquilizers, etc)

Ketamine (Such as special K, jet, etc)

Narcotics (Such as opium, morphine, codeine, heroine, etc.)

Hallucinogenic (Such as LSD, PCP, mushrooms, etc.)

Steroids (Such as the clear, juice, etc.)

Inhalants (Such as toluene, amyl nitrate, etc.)

Other (Provide Explanation)

B. Name of the treatment provider (Last name, First Name)

C. Address for the treatment provider (address, City, State, Zip Code, or Country )
D. Phone Number of the treatment provider

E. Dates of Treatment From To Estimated

F. Did you successfully complete the treatment? Yes No

1. If no, explain?

14d. Do you have any other instances of having been ordered, advised, or asked to seek drug or

controlled substance counseling or treatment in the last seven (7) years? Yes No

If yes, please us the continuation sheet on page 20 to provide information

Question 15

15a. Type of drug or controlled substance for which you were treated:

Cocaine or crack cocaine (Such as rock, freebase, etc.) 

Stimulants (Such as amphetamines, speed, crystal meth, ecstasy, etc.)

THC (Such as marijuana, weed, pot, hashish, etc.)

Depressants (Such as barbituates, methaqualone, tranquilizers, etc)

Ketamine (Such as special K, jet, etc)

Narcotics (Such as opium, morphine, codeine, heroine, etc.)

Hallucinogenic (Such as LSD, PCP, mushrooms, etc.)

Steroids (Such as the clear, juice, etc.)

Inhalants (Such as toluene, amyl nitrate, etc.)

Other (Provide Explanation)

15b. Name of the treatment provider (Last name, First name)

15c. Address for the treatment provider (address, City, State, Zip Code, or Country )

15d. Phone Number of the treatment provider

15e. Dates of Treatment From To Estimated 

15f. Did you successfully complete the treatment? Yes No

If no, explain?

15g. Do you have any other instances of ever voluntarily seeking counseling or treatment as a result 

of your use of a drug or controlled substance? Yes No

If yes, please use the continuation sheet on page 20 to provide information

 

 
Question 16

16a. Type of bankrupcy petition: Chapter 7 Chapter 11 Chapter 12 Chapter 13

1. If Chapter 12 or 13, provide: Name of Trustee

2. Address of Trustee (Street address, City, State, Zip Code or Country)

16b. Bankrupcy court docket/account number

16c. Date bankrupcy was filed Estimated

16d. Date of bankrupcy discharge Estimated

16e. Total amount (in U.S. dollars) involved in the bankrupcy Estimated

16f. Name debt is recorded under (Last, First, Middle, Suffix)

16g. Name of court involved

16h. Address of court involved (Street address, City, State, Zip Code or Country)

16i. Were you discharged of all debts claimed in the bankrupcy? Explain

16j. In the past seven (7) years, have you filed any additional petitions under any chapter of the bankrupcy

code? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 17

17a. Date range of your financial problems due to gambling From To Estimated

17b. Estimate the amount (in U.S. dollars) of gambling losses incurred

17c. Describe your financial problems due to gambling

17d. If you have taken any action(s) to rectify your financial problems due to gambling, describe 

your actions. If you have not taken any action(s), explain

 
17e. In the last seven (7) years, have you failed to meet other financial obligations due to gambling?

Yes 

If yes, please use the continuation sheet on page 20 to provide information

Question 18

18a. Did you fail to file, pay as required, or both?

To file Pay as required Both

18b. Year you failed to file or pay your federal, state, or other taxes

18c. Reason(s) for your failure to file or pay required taxes

18d. Federal, state or other agency to which you failed to file or pay taxes

18e. Type of taxes you failed to file or pay (such as property, income, sales, etc.)

18f. Amount (in U.S. dollars) of the taxes Estimated

18g. Date satisfied (Estimated), if applcable

18h. Describe any action(s) you have taken to satisfy this debt (such as withholdings, frequency and 

amount of payments, etc.) If you have not taken any action(s), explain

18i. Are there any other instances in the past seven (7) years where you failed to file or pay federal,

state or other taxes when required by law or ordinance? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 19

19a. Loan/account number(s) involved

19b. Identify/describe the type of property involved (if any)

19c. Amount (in U.S. dollars) of the financial issue (Estimated)

19d. Reason(s) for the financial issue

19e. Current status of the financial issue

19f. Date the financial issue began

19g. Date the financial issue was resolved, if applicable

 

No
19h. Describe any action(s) you have taken to satisfy this debt (such as withholdings, fequency and 

amount of payments, etc.). If you have not taken any action(s), explain 

19i. Do you have another delinquent debt of 120 days or more in the last seven(7) years?

Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 20

20a. Month/Year when this negative impact occurred Estimated

20b. Explain the circumstances and the negative impact

20c. Dates of involvement or use From To Estimated

20d. Has the use of alcohol had any other negative impacts on your work performance, your professional 

relationships, or resulted in intervention by law enforcement/public safety personnel?

Yes No

If so, please use the continuation sheet on page 19 to provide information

20e. In the last seven (7) years, have you been ordered, advised, or asked to seek counseling or 

treatment as a result of your use of alcohol? Yes No

1. If yes, did you take action to seek counseling or treatment? Yes No

2. If no action taken, please explain

20f. If yes to taking action to seek counseling or treatment

1. Dates of counseling or treatment From To Estimated

2. Name of the individual counselor or treatment provider

3. Address of the counseling/treatment provider (Street address, City, State, Zip Code or Country)

4. Telephone number (Number/extension)

5. Did you successfully complete the treatment program? Yes No

6. If no, please explain
20g. Do you have additional instances of having been ordered, advised, or asked to seek counseling or 

treatment as a result of your use of alcohol? Yes No

If so, please use the continuation sheet on page 20 to provide information 

20h. In the last seven (7) years, have you voluntarily sought counseling or treatment as a result of your use 

of alcohol? Yes No

1. Dates of counseling or treatment From To Estimated

2. Name of the individual counselor or treatment provider

3. Address of the counseling/treatment provider (Street address, City, State, Zip Code or Country)

4. Telephone number (Number/extension)

5. Did you successfully complete the treatment program? Yes No

6. If no, please explain

20i. Do you have additional instances where you have voluntarily sought counseling or 

treatment resulting from your use of alcohol? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 21

21a. Date of the incident (Month/Year) Estimated

21b. Describe the nature of the incident or offense

21c. Location of the incident (Street address and City, State, Zip Code or Country)

21d. Describe the action (administrative, criminal, or other) taken as a result of this incident

21e. Are there any other incidents? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 22

22a. Date of the incident (Month/Year) Estimated

22b. Describe the nature of the incident or offense

 
22c. Location of the incident (Street address and City, State, Zip Code or Country)

22d. Describe the action (administrative, criminal, or other) taken as a result of this incident

22e. Are there any other incidents? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 23

23a. Date of the incident (Month/Year) Estimated

23b. Describe the nature of the incident or offense

23c. Location of the incident (Street address and City, State, Zip Code or Country)

23d. Describe the action (administrative, criminal, or other) taken as a result of this incident

23e. Are there any other incidents? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 24

24a. Full name of the organization

24b. Address/location of the organization (Street address, City, State, Zip Code or Country)

24c. Dates of your involvement with the organization

From To Estimated

24d. All positions held in the organization, if any

24e. All contributions made to the organization, if any

24f. Describe the nature of and reasons for your involvement with the organization

 
24g. Do you have any other instances of being a member of an organization dedicated to 

terrorism, either with an awareness of the organizations dedication to that end, or with 

the specific intent to further such activities? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 25

25a. Describe the nature and reasons for the activity

25b. Dates for any such activities From To Estimated

25c. Do you have any other instances of knowingly engaging in acts of terrorism? 

Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 26

26a. Reason(s) for advocating acts of terrorism

26b. Dates of advocating acts of terrorism From To Estimated

26c. Do you have any other instances of advocating acts of terrorism or activities designed 

to overthrow the U.S. Government by force? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 27

27a. Full name of the organization

27b. Address/location of the organization (Street address, City, State, Zip Code or Country)

27c. Dates of your involvement with the organization From To Estimated

27d. All positions held in the organization, if any

27e. All contributions made to the organization, if any

27f. Describe the nature of and reasons for your involvement with the organization
27g. Do you have any other instances of being a member of an organization dedicated to the use 

of violence or force to overthrow the U.S. Government, which engaged in activities to that end

with an awareness of the organizations dedication to that end or with the specific intent to further

such activities? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 28

28a. Full name of the organization

28b. Address/location of the organization (Street address, City, State, Zip Code or Country)

28c. Dates of your involvement with the organization 

From To

28d. All positions held in the organization, if any

28e. All contributions made to the organization, if any

28f. Describe the nature of and reasons for your involvement with the organization

28g. Do you have any other instances of being a member of an organization that advocates or 

practices commission of acts of force or violence to discourage others from exercising their 

rights under the U.S. Constitution or any state of the United States with the specific intent to 

further such action? Yes No

If yes, please use the continuation sheet on page 20 to provide information

Question 29

29a. Describe the nature and reasons for the activity

29b. Dates of such activities From To Estimated

29c. Do you have any other instances of having knowingly engaged in activities designed to

overthrow the U.S. government by force? Yes No

If yes, please use the continuation sheet on page 20 to provide information
30a. Have you ever associated with anyone involved in activities to further terrorism? Explain

Question 30
Continuation sheet

For any questions you have additional information for, please refer to the question number, then provide 

all information that was requested in that section. 
EXHIBIT K
Standard Form 85P 

Revised September 1995 

U.S. Office of Personnel Management 

5 CFR Parts 731, 732, and 736 

Form approved: 

0MB No. 3206-0191 

NSN 7540-01-317-7372 

85-1602 

Questionnaire for Public Trust Positions 

Follow instructions fully or we cannot process your form. Be sure to sign and date the certification statement on Page 7 and the release on 

Page 8. If you have any questions, call the office that gave you the form. 

Purpose of this Form 

The U.S. Government conducts background investigations and 

reinvestigations to establish that applicants or incumbents either 

employed by the Government or working for the Government under 

contract, are suitable for the job and/or eligible for a public trust or 

sensitive position. Information from this form is used primarily as the 

basis for this investigation. Complete this form only after a conditional 

offer of employment has been made. 

Giving us the information we ask for is voluntary. However, we may 

not be able to complete your investigation, or complete it in a timely 

manner, if you don't give us each item of information we request. This 

may affect your placement or employment prospects. 

Authority to Request this Information 

The U.S. Government is authorized to ask for this information under 

Executive Orders 10450 and 10577, sections 3301 and 3302 of title 5, 

U.S. Code; and parts 5, 731, 732, and 736 of Title 5, Code of Federal 

Regulations. 

Your Social Security number is needed to keep records accurate, 

because other people may have the same name and birth date. Executive 

Order 9397 also asks Federal agencies to use this number to help 

identify individuals in agency records. 

The Investigative Process 

Background investigations are conducted using your responses on this 

form and on your Declaration for Federal Employment (OF 306) to 

develop information to show whether you are reliable, trustworthy, of 

good conduct and character, and loyal to the United States. The 

information that you provide on this form is confirmed during the 

investigation. Your current employer must be contacted as part of the 

investigation, even if you have previously indicated on applications or 

other forms that you do not want this. 

In addition to the questions on this form, inquiry also is made about a 

person's adherence to security requirements, honesty and integrity, 

vulnerability to exploitation or coercion, falsification, misrepresentation, and any other behavior, activities, or associations that 

tend to show the person is not reliable, trustworthy, or loyal. 

Your Personal Interview 

Some investigations will include an interview with you as a normal part 

of the investigative process. This provides you the opportunity to 

update, clarify, and explain information on your form more completely, 

which often helps to complete your investigation faster. It is important 

that the interview be conducted as soon as possible after you are 

contacted. Postponements will delay the processing of your 

investigation, and declining to be interviewed may result in your 

investigation being delayed or canceled. 

You will be asked to bring identification with your picture on it, such as 

a valid State driver's license, to the interview. There are other 

documents you may be asked to bring to verify your identity as well. 

These include documentation of any legal name change, Social Security 

card, and/or birth certificate. 

You may also be asked to bring documents about information you 

provided on the form or other matters requiring specific attention. 

These matters include alien registration, delinquent loans or taxes, 

bankruptcy, judgments, liens, or other financial obligations, agreements 

involving child custody or support, alimony or property settlements, 

arrests, convictions, probation, and/or parole. 

Instructions for Completing this Form 

1. Follow the instructions given to you by the person who gave you the

form and any other clarifying instructions furnished by that person to

assist you in completion of the form. Find out how many copies of the

form you are to tum in. You must sign and date, in black ink, the

original and each copy you submit.

2. Type or legibly print your answers in black ink (if your form is not

legible, it will not be accepted). You may also be asked to submit your

form in an approved electronic format.

3. All questions on this form must be answered. If no response is

necessary or applicable, indicate this on the form (for example, enter

"None" or "N/A"). If you find that you cannot report an exact date,

approximate or estimate the date to the best of your ability and indicate

this by marking "APPROX." or "EST."

4. Any changes that you make to this form after you sign it must be

initialed and dated by you. Under certain limited circumstances,

agencies may modify the form consistent with your intent.

5. You must use the State codes (abbreviations) listed on the back of

this page when you fill out this form. Do not abbreviate the names of

cities or foreign countries.

6. The 5-digit postal ZIP codes are needed to speed the processing of

your investigation. The office that provided the form will assist you in

completing the ZIP codes.

7. All telephone numbers must include area codes.

8. All dates provided on this form must be in Month/Day/Year or

Month/Year format. Use numbers (1-12) to indicate months. For

example, June 10, 1978, should be shown as 6/10/78.

9. Whenever "City (Country)" is shown in an address block, also

provide in that block the name of the country when the address is

outside the United States.

10. If you need additional space to list your residences or

employments/self-employments/unemployments or education, you

should use a continuation sheet, SF 86A. If additional space is needed

to answer other items, use a blank piece of paper. Each blank piece of

paper you use must contain your name and Social Security Number 

at the top of the page. 
Final Determination on Your Eligibility 

Final determination on your eligibility for a public trust or sensitive 

position and your being granted a security clearance is the responsibility 

of the Office of Personnel Management or the Federal agency that 

requested your investigation. You may be provided the opportunity 

personally to explain, refute, or clarify any information before a final 

decision is made. 

Penalties for Inaccurate or False Statements 

The U.S. Criminal Code (title 18, section 1001) provides that knowingly 

falsifying or concealing a material fact is a felony which may result in 

fines of up to $10,000, and/or 5 years imprisonment, or both. In 

addition, Federal agencies generally fire, do not grant a security 

clearance, or disqualify individuals who have materially and 

deliberately falsified these forms, and this remains a part of the 

permanent record for future placements. Because the position for which 

you are being considered is one of public trust or is sensitive, your 

trustworthiness is a very important consideration in deciding your 

suitability for placement or retention in the position. 

Your prospects of placement are better if you answer all questions 

truthfully and completely. You will have adequate opportunity to 

explain any information you give us on the form and to make your 

comments part of the record. 

Disclosure of Information 

The information you give us is for the purpose of investigating you for a 

position; we will protect it from unauthorized disclosure. The 

collection, maintenance, and disclosure of background investigative 

information is governed by the Privacy Act. The agency which 

requested the investigation and the agency which conducted the 

investigation have published notices in the Federal Register describing 

the system of records in which your records will be maintained. You 

may obtain copies of the relevant notices from the person who gave you 

this form. The information on this form, and information we collect 

during an investigation may be disclosed without your consent as 

permitted by the Privacy Act (5 USC 552a(b)) and as follows: 

PRIVACY ACT ROUTINE USES 

1. To the Department of Justice when: (a) the agency or any component thereof; or 

(b) any employee of the agency in his or her official capacity; or (c) any employee of 

the agency in his or her individual capacity where the Department of Justice has 

agreed to represent the employee; or (d) the United States Government, is a party to 

litigation or has interest in such litigation, and by careful review, the agency 

determines that the records are both relevant and necessary to the litigation and the 

use of such records by the Department of Justice is therefore deemed by the agency 

to be for a purpose that is compatible with the purpose for which the agency 

collected the records. 

2. To a court or adjudicative body in a proceeding when: (a) the agency or any 

component thereof; or (b) any employee of the agency in his or her official capacity; 

or (c) any employee of the agency in his or her individual capacity where the 

Department of Justice has agreed to represent the employee; or (d) the United 

States Government is a party to litigation or has interest in such litigation, and by 

careful review, the agency determines that the records are both relevant and 

necessary to the litigation and the use of such records is therefore deemed by the 

agency to be for a purpose that is compatible with the purpose for which the agency 

collected the records. 

3. Except as noted in Question 21, when a record on its face, or in conjunction with 

other records, indicates a violation or potential violation of law, whether civil, criminal, 

or regulatory in nature, and whether arising by general statute, particular program 

statute, regulation, rule, or order issued pursuant thereto, the relevant records may 

be disclosed to the appropriate Federal, foreign, State, local, tribal, or other public 

authority responsible for enforcing, investigating or prosecuting such violation or 

charged with enforcing or implementing the statute, rule, regulation, or order. 

4. To any source or potential source from which information is requested in the 

course of an investigation concerning the hiring or retention of an employee or other 

personnel action, or the issuing or retention of a security clearance, contract, grant, 

license, or other benefit, to the extent necessary to identify the individual, inform the 

source of the nature and purpose of the investigation, and to identify the type of 

information requested. 

5. To a Federal, State, local, foreign, tribal, or other public authority the fact that this 

system of records contains information relevant to the retention of an employee, or 

the retention of a security clearance, contract, license, grant, or other benefit. The 

other agency or licensing organization may then make a request supported by 

written consent of the individual for the entire record if it so chooses. No disclosure 

will be made unless the information has been determined to be sufficiently reliable to 

support a referral to another office within the agency or to another Federal agency for 

criminal, civil, administrative, personnel, or regulatory action. 

6. To contractors, grantees, experts, consultants, or volunteers when necessary to 

perform a function or service related to this record for which they have been 

engaged. Such recipients shall be required to comply with the Privacy Act of 1974, 

as amended. 

7. To the news media or the general public, factual information the disclosure of 

which would be in the public interest and which would not constitute an unwarranted 

invasion of personal privacy. 

8. To a Federal, State, or local agency, or other appropriate entities or individuals, or 

through established liaison channels to selected foreign governments, in order to 

enable an intelligence agency to carry out its responsibilities under the National 

Security Act of 1947 as amended, the CIA Act of 1949 as amended, Executive Order 

12333 or any successor order, applicable national security directives, or classified 

implementing procedures approved by the Attorney General and promulgated 

pursuant to such statutes, orders or directives. 

9. To a Member of Congress or to a Congressional staff member in response to an 

inquiry of the Congressional office made at the written request of the constituent 

about whom the record is maintained. 

10. To the National Archives and Records Administration for records management 

inspections conducted under 44 USC 2904 and 2906. 

11. To the Office of Management and Budget when necessary to the review of 

private relief legislation. 

STATE CODES (ABBREVIATIONS) 

Alabama AL Hawaii HI Massachusetts MA New Mexico NM South Dakota SD 

Alaska AK Idaho ID Michigan Ml New York NY Tennessee TN 

Arizona AZ Illinois IL Minnesota MN North Carolina NC Texas TX 

Arkansas AR Indiana IN Mississippi MS North Dakota ND Utah UT 

California CA Iowa IA Missouri MO Ohio OH Vermont VT 

Colorado co Kansas KS Montana MT Oklahoma OK Virginia VA 

Connecticut CT Kentucky KY Nebraska NE Oregon OR Washington WA 

Delaware DE Louisiana LA Nevada NV Pennsylvania PA West Virginia WV 

Florida FL Maine ME New Hampshire NH Rhode Island RI Wisconsin WI 

Georgia GA Maryland MD New Jersey NJ South Carolina SC Wyoming WY 

American Samoa AS District of Columbia DC Guam GU Northern Marianas CM Puerto Rico PR 

Trust Territory TT Virgin Islands VI 

PUBLIC BURDEN INFORMATION 

Public burden reporting for this collection of information is estimated to average 60 minutes per response, including time for reviewing instructions, 

searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send 

comments regarding the burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Reports 

and Forms Management Officer, U.S. Office of Personnel Management, 1900 E Street, N.W., Room CHP-500, Washington, D.C. 20415. Do not send 

your completed form to this address. 
Standard Form 85P (EG) 

Revised September 1995 

U.S. Office of Personnel Management 

5 CFR Parts 731, 732, and 736 

QUESTIONNAIRE FOR 

PUBLIC TRUST POSITIONS 

Form approved: 

OMB No. 3206-0191 

NSN 7540-01-317- 7372 

85-1602 

f)DATEOF 

BIRTH 

Case Number 

Telephone Number 

- If you are a "Jr.," "Sr.," "II," etc., enter this in the 

box after your middle name. 

Codes 

Coverage 

• It you have only initials in your name, use them and state (10). 

• If you have no middle name, enter "NMN". 

OPM 

USE 

ONLY 

H Position Position 

Code Title 

J K ocatton None Other Address ZIP Code 

SON of Official 

Pe NPRC rsonnel 

Folder At SON 

L MLocation None Other Address ZIP Code 

SOI of Security At SOI 

Folder 

NPI 

NOPAC-ALC 0 Accounting Data and/or 

Number Agency Case Number 

QFULL 

NAME 

8PLACE OF BIRTH - Use the two letter code for the State. 

City County 

Last Name First Name Middle Name 

State Country (if not in the United States) 

Month Day Year 

• OTHER NAMES USED 

Name Month/Year Month/Year Name Month/Year Month/Year 

#1 To #3 To 

Name Month/Year Month/Year Name Month/Year Month/Year 

#2 To #4 To 

. Height (feet and inches) Weight (pounds) Hair Color Eye Color S (M k b 

I I 

ex er. one ox 

I

I

D

NF

E

O

NT

R

I

M

FY

A

I

T

N

I

G 

ON n Female n Male 

@TELEPHONE Work (include Area Code and extension) Home (include Area Code) Fl Day Fl Day NUMBERS Night ( ) Night ( ) 

.CITIZENSHIP I am a U.S. citizen or national by birth in the U.S. or U.S. territory/possession. Answer G) Your Mother's Maiden Name 

0 items b and d. Mark the box at the right that 

reflects your current citizenship I am a U.S. citizen, but I was NOT born in the U.S. Answer items b, c and d. 

status, and follow its instructions. I am not a U.S. citizen. Answer items band e. 

eoTHER 

9 UNITED STATES CITIZENSHIP If you are a U.S. Citizen, but were not born in the U.S., provide information about one or more of the following proofs of your citizenship. 

Naturalization Certificate (Where were you naturalized?) 

Court City State Certificate Number Month/Day/Year Issued 

Citizenship Certificate (Where was the certificate issued?) 

City State Certificate Number Month/Day/Year Issued 

State Department Form 240 - Report of Birth Abroad of a Citizen of the United States 

Give the date the form was Month/Day/Year 

prepared and give an explanation 

if needed. 

Explanation 

U.S. Passport 

This may be either a current or previous U.S. Passport 

Passport Number Month/Day/Year Issued 

m DUAL CITIZENSHIP If you are (or were) a dual citizen of the United States and another country, Country 

provide the name of that country in the space to the right. 

Q ALIEN If you are an alien, provide the following information: 

������---.-�C�t-i�y ������������---,S�at _t___, e D�a-t-�e Y�o-u�E�n-et _r_e��d U�S. .,,.-��. �A�ie-ln--=-ge �-ts-ar -t�o-in�N�u-m�b-e-r��-C�o-u-n-rt-y�ie(-s�-o��f C�t�zi-i-sn �h�pi���- 

Place You Month I Day I Year 

Entered the 

United States: 

Exception to SF85, SF85P, SF85P-S, SF86, and SF86A approved by GSA September, 1995. 

Designed using Perform Pro, WHS/DIOR, Sep 95 

Page 1 
OwHERE You HAVE uvsn 

List the places where you have lived, beginning with the most recent (#1) and working back 7 years. All periods must be accounted for in your list. Be sure to indicate the 

actual physical location of your residence: do not use a post office box as an address, do not list a permanent address when you were actually living at a school address, 

etc. Be sure to specify your location as closely as possible: for example, do not list only your base or ship, list your barracks number or home port. You may omit 

temporary military duty locations under 90 days (list your permanent address instead), and you should use your APO/FPO address if you lived overseas. 

For any address in the last 5 years, list a person who knew you at that address, and who preferably still lives in that area (do not list people for residences completely 

outside this 5-year period, and do not list your spouse, former spouses, or other relatives). Also for addresses in the last 5 years, if the address is "General Delivery," a 

Rural or Star Route, or may be difficult to locate, provide directions for locating the residence on an attached continuation sheet. 

Month/Year Month/Year Street Address Apt. # I City (Country) State I ZIP Code 

#1 To Present 

Name of Person Who Knows You Street Address Apt.# I City (Country) I State I ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Street Address Apt. # I City (Country) State I ZIP Code 

#2 To 

Name of Person Who Knew You Street Address Apt.# I City (Country) I State I ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Street Address Apt. # I City (Country) State I ZIP Code 

#3 To 

Name of Person Who Knew You Street Address Apt.# I City (Country) I State I ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Street Address Apt. # I City (Country) State I ZIP Code 

#4 To 

Name of Person Who Knew You Street Address Apt.# I City (Country) I State I ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Street Address Apt. # I City (Country) State I ZIP Code 

#5 To 

Name of Person Who Knew You Street Address Apt.# I City (Country) I State I ZIP Code Telephone Number 

( ) 

G) WHERE YOU WENT TO SCHOOL 

List the schools you have attended, beyond Junior High School, beginning with the most recent (#1) and working back 7 years. List all College or University degrees 

and the dates they were received. If all of your education occurred more than 7 years ago, list your most recent education beyond high school, no matter when that 

education occurred. 

-Use one of the following codes in the "Code" block: 

1 - High School 2 - College/University/Military College 3 - Vocational/Technical/Trade School 

et=or schools you attended in the past 3 years, list a person who knew you at school (an instructor, student, etc.). Do not list people for education 

completely outside this 3-year period. 

9For correspondence schools and extension classes, provide the address where the records are maintained. 

Month/Year Month/Year Code I Name of School I Degree/Diploma/Other Month/Year Awarded 

#1 To 

Street Address and City (Country) of School I State ZIP Code 

Name of Person Who Knew You Street Address Apt.# I City (Country) I State I ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Code I Name of School I Degree/Diploma/Other Month/Year Awarded 

#2 To 

Street Address and City (Country) of School I State ZIP Code 

Name of Person Who Knew You Street Address Apt.# I City (Country) I State I ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Code I Name of School I Degree/Diploma/Other Month/Year Awarded 

#3 To 

Street Address and City (Country) of School I State ZIP Code 

Name of Person Who Knew You Street Address Apt.# I City (Country) I State I ZIP Code Telephone Number 

( ) 

Enter your Social Security Number before going to the next page--------------• 

Page 2 
• YOUR EMPLOYMENT ACTIVITIES 

List your employment activities, beginning with the present (#1) and working back 7 years. You should list all full-time work, part-time work, military service, 

temporary military duty locations over 90 days, self-employment, other paid work, and all periods of unemployment. The entire ?-year period must be accounted for 

without breaks, but you need not list employments before your 16th birthday. 

• Code. Use one of the codes listed below to identify the type of employment: 

1 - Active military duty stations 

2 - National Guard/Reserve 

3 - U.S.P.H.S. Commissioned Corps 

4 - Other Federal employment 

5 - State Government (Non-Federal 

employment) 

6 - Self-employment (Include business 

and/or name of person who can verify) 

7 - Unemployment (Include name of 

person who can verify) 

8 - Federal Contractor (List Contractor, 

not Federal agency) 

9 - Other 

• Employer/Verifier Name. List the business name of your employer or the name of the person who can verify your self-employment or unemployment in this block. If 

military service is being listed, include your duty location or home port here as well as your branch of service. You should provide separate listings to reflect changes in 

your military duty locations or home ports. 

• Previous Periods of Activity. Complete these lines if you worked for an employer on more than one occasion at the same location. After entering the most recent 

period of employment in the initial numbered block, provide previous periods of employment at the same location on the additional lines provided. For example, if you 

worked at XY Plumbing in Denver, CO, during 3 separate periods of time, you would enter dates and information concerning the most recent period of employment first, 

and provide dates, position titles, and supervisors for the two previous periods of employment on the lines below that information. 

Month/Year Month/Year I Code Employer/Verifier Name/Military Duty Location Your Position Title/Military Rank 

#1 To Present 

Employer's/Verifier's Street Address City (Country) State ZIP Code Telephone Number 

( ) 

Street Address of Job Location (if different than Employer's Address) City (Country) State ZIP Code Telephone Number 

( ) 

Supervisor's Name & Street Address (if different than Job Location) City (Country) State ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Position Title Supervisor 

PREVIOUS To 

PERIODS Month/Year Month/Year Position Title Supervisor 

OF 

ACTIVITY To 

(Block #1) Month/Year Month/Year Position Title Supervisor 

To 

Month/Year Month/Year I Code Employer/Verifier Name/Military Duty Location Your Position Title/Military Rank 

#2 To 

Employer's/Verifier's Street Address City (Country) State ZIP Code Telephone Number 

( ) 

Street Address of Job Location (if different than Employer's Address) City (Country) State ZIP Code Telephone Number 

( ) 

Supervisor's Name & Street Address (if different than Job Location) City (Country) State ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Position Title Supervisor 

PREVIOUS To 

PERIODS Month/Year Month/Year Position Title Supervisor 

OF 

ACTIVITY To 

(Block#2) Month/Year Month/Year Position Title Supervisor 

To 

Month/Year Month/Year I Code Employer/Verifier Name/Military Duty Location Your Position Title/Military Rank 

#3 To 

Employer's/Verifier's Street Address City (Country) State ZIP Code Telephone Number 

( ) 

Street Address of Job Location (if different than Employer's Address) City (Country) State ZIP Code Telephone Number 

( ) 

Supervisor's Name & Street Address (if different than Job Location) City (Country) State ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Position Title Supervisor 

PREVIOUS To 

PERIODS Month/Year Month/Year Position Title Supervisor 

OF 

ACTIVITY To 

(Block#3) Month/Year Month/Year Position Title Supervisor 

To 

Enter your Social Security Number before going to the next page------------• 

Page 3 
YOUR EMPLOYMENT ACTIVITIES (CONTINUED) 

Month/Year Month/Year I Code Employer/Verifier Name/Military Duty Location Your Position Title/Military Rank 

#4 To 

Employer's/Verifier's Street Address City (Country) State ZIP Code Telephone Number 

( ) 

Street Address of Job Location (if different than Employer's Address) City (Country) State ZIP Code Telephone Number 

( ) 

Supervisor's Name & Street Address (if different than Job Location) City (Country) State ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Position Title Supervisor 

PREVIOUS To 

PERIODS Month/Year Month/Year Position Title Supervisor 

OF 

ACTIVITY To 

(Block #4) Month/Year Month/Year Position Title Supervisor 

To 

Month/Year Month/Year I Code Employer/Verifier Name/Military Duty Location Your Position Title/Military Rank 

#5 To 

Employer's/Verifier's Street Address City (Country) State ZIP Code Telephone Number 

( ) 

Street Address of Job Location (if different than Employer's Address) City (Country) State ZIP Code Telephone Number 

( ) 

Supervisor's Name & Street Address (if different than Job Location) City (Country) State ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Position Title Supervisor 

PREVIOUS To 

PERIODS Month/Year Month/Year Position Title Supervisor 

OF 

ACTIVITY To 

(Block#5) Month/Year Month/Year Position Title Supervisor 

To 

Month/Year Month/Year I Code Employer/Verifier Name/Military Duty Location Your Position Title/Military Rank 

#6 To 

Employer's/Verifier's Street Address City (Country) State ZIP Code Telephone Number 

( ) 

Street Address of Job Location (if different than Employer's Address) City (Country) State ZIP Code Telephone Number 

( ) 

Supervisor's Name & Street Address (if different than Job Location) City (Country) State ZIP Code Telephone Number 

( ) 

Month/Year Month/Year Position Title Supervisor 

PREVIOUS To 

PERIODS Month/Year Month/Year Position Title Supervisor 

OF 

ACTIVITY To 

(Block#6) Month/Year Month/Year Position Title Supervisor 

To 

0 YOUR EMPLOYMENT RECORD 

Yes No 

Has any of the following happened to you in the last 7 years? If "Yes," begin with the most recent occurrence and go backward, providing date 

fired, quit, or left, and other information requested. 

Use the following codes and explain the reason your employment was ended: 

1 - Fired from a job 

2 - Quit a job after being told 

you'd be fired 

3 - Left a job by mutual agreement following allegations of misconduct 

4 - Left a job by mutual agreement following allegations of 

unsatisfactory performance 

5 - Left a job for other reasons 

under unfavorable circumstances 

Month/Year Code Specify Reason Employer's Name and Address (Include city/Country if outside U.S.) State ZIP Code 

Enter your Social Security Number before going to the next page------------ .... 

Page4 
Cl) PEOPLE WHO KNOW YOU WELL 

List three people who know you well and live in the United States. They should be good friends, peers, colleagues, college roommates, etc., whose combined 

association with you covers as well as possible the last 7 years. Do not list your spouse, former spouses, or other relatives, and try not to list anyone who is listed 

elsewhere on this form. 

Name Dates Known hone Number 

#1 MonthNear MonthNear Day ( To Night 

Home or Work Address City (Country) 

Name Dates Known hone Number 

#2 MonthNear MonthNear Day ( To Night 

Home or Work Address City (Country) 

Name Dates Known hone Number 

#3 MonthNear MonthNear Day ( To Night 

Home or Work Address City (Country) 

State ZIP Code 

State ZIP Code 

State ZIP Code 

• YOUR MARITAL STATUS 

Mark one of the following boxes to show your current marital status: 

1 - Never married (go to question 15) 3 - Separated 

2 - Married 4 - Legally Separated 

Current Spouse Complete the following about your current spouse. 

Full Name Date of Birth (Mo.!Day/Yr.) 

5 - Divorced 

6-Widowed 

Place of Birth (Include country if outside the U.S.) Social Security Number 

Other Names Used (Specify maiden name, names by other marriages, etc., and show dates used for each name) 

Country of Citizenship 

If Separated, Date of Separation (Mo./Day!Yr.) 

Date Married (Mo.!Day!Yr.) I Place Married (Include country if outside the U.S.) 

If Legally Separated, Where is the Record Located? City (Country) 

State 

State 

Address of Current Spouse (Street, city, and country if outside the U.S.) 

CD YOUR RELATIVES 

Give the full name, correct code, and other requested information for each of your relatives, living or dead, specified below. 

1 - Mother (first) 3 - Stepmother 5 - Foster Parent 

2 - Father (second) 4 - Stepfather 6 - Child (adopted also) 

I State I ZIP Code 

7 - Stepchild 

Full Name (If deceased, check box on the Code Date of Birth Country of Birth Country(ies) of Current Street Address and City (country) of State left before entering name) Month/Day Near Citizenship Living Relatives 

1 

2 

Enter your Social Security Number before going to the next page------------• 

Page 5 
e YOUR MILITARY HISTORY Yes No 

0 Have you served in the United States military? 

0) Have you served in the United States Merchant Marine? 

List all of your military service below, including service in Reserve, National Guard, and U.S. Merchant Marine. Start with the most recent period of service (#1) and work 

backward. If you had a break in service, each separate period should be listed. 

•Code. Use one of the codes listed below to identify your branch of service: 

1 -Air Force 2-Army 3 - Navy 4 - Marine Corps 5 - Coast Guard 6 - Merchant Marine 7 - National Guard 

•OIE. Mark "O" block for Officer or "E" block for Enlisted. 

•status. "X" the appropriate block for the status of your service during the time that you served. If your service was in the National Guard, do not use 

an "X": use the two-letter code for the state to mark the block. 

•Country. If your service was with other than the U.S. Armed Forces, identify the country for which you served. 

Month/Year Month/Year Code Service/Certificate No. 0 E Status Country 

Active Active Inactive National 

Reserve Reserve Guard 

(State) 

To 

To 

� YOUR SELECTIVE SERVICE RECORD Yes No 

0 Are you a male born after December 31, 1959? If "No," go to 18. If "Yes," go to b. 

0) Have you registered with the Selective Service System? If "Yes," provide your registration number. If "No," show the reason for your legal 

exemption below. 

Heqtstratlon Number Legal Exemption Explanation 

I G, YOUR INVESTIGATIONS RECORD Yes No 

0 Has the United States Government ever investigated your background and/or granted you a security clearance? If "Yes," use the codes that 

follow to provide the requested information below. If "Yes," but you can't recall the investigating agency and/or the security clearance 

received, enter "Other" agency code or clearance code, as appropriate, and "Don't know" or "Don't recall" under the "Other Agency" 

heading, below. If your response is "No," or you don't know or can't recall if you were investigated and cleared, check the "No" box. 

Codes for Investigating Agency Codes for Security Clearance Received 

1 - Defense Department 4- FBI 0 - Not Required 3 - Top Secret 6-L 

2 - State Department 5 - Treasury Department 1 - Confidential 4 - Sensitive Compartmented Information 7-0ther 

3 - Office of Personnel Management 6 - Other (Specify) 2 - Secret 5-Q 

Month/Year Agency Other Agency Clearance Month/Year Agency Other Agency Clearance 

Code Code Code Code 

0) To your knowledge, have you ever had a clearance or access authorization denied, suspended, or revoked, or have you ever been debarred Yes No 

from government employment? If "Yes," give date of action and agency. Note: An administrative downgrade or termination of a security 

clearance is not a revocation. 

Month/Year Department or Agency Taking Action Month/Year Department or Agency Taking Action 

G) FOREIGN COUNTRIES YOU HAVE VISITED 

List foreign countries you have visited, except on travel under official Government orders, beginning with the most current (#1) and working back 7 years. (Travel as a 

dependent or contractor must be listed.) 

•Use one of these codes to indicate the purpose of your visit: 1 - Business 2 - Pleasure 3 - Education 4-0ther 

•Include short trips to Canada or Mexico. If you have lived near a border and have made short (one day or less) trips to the neighboring country, you do 

not need to list each trip. Instead, provide the time period, the code, the country, and a note ("Many Short Trips"). 

•Do not repeat travel covered in items 9, 10, or 11. 

Month/Year Month/Year Code Country Month/Year Month/Year Code Country 

#1 To #5 To 

#2 To #6 To 

#3 To #7 To 

#4 To #8 To 

Enter your Social Security Number before going to the next page 

Page 6 
@) YOUR POLICE RECORD (Do not include anything that happened before your 16th birthday.) Yes No 

In the last 7 years, have you been arrested for, charged with, or convicted of any offense(s)? (Leave out traffic fines of less than $150.) 

If you answered "Yes," explain your answer(s) in the space provided. 

Month/Year Offense Action Taken Law Enforcement Authority or Court (City and county/country it outside the U.S.) State ZIP Code 

� ILLEGAL DRUGS 

Yes No 

The following questions pertain to the illegal use of drugs or drug activity. You are required to answer the questions fully and truthfully, and your 

failure to do so could be grounds for an adverse employment decision or action against you, but neither your truthful responses nor information 

derived from your responses will be used as evidence against you in any subsequent criminal proceeding. 

E) In the last year, have you�used any controlled substance, for example, marijuana, cocaine, crack cocaine, hashish, narcotics (opium, 

morphine, codeine, heroin, etc.), amphetamines, depressants (barbiturates, methaqualone, tranquilizers, etc.), hallucinogenics (LSD, PCP, etc.), or 

prescription drugs? 

0, In the last 7 years, have you been involved in the illegal purchase, manufacture, trafficking, production, transfer, shipping, receiving, or sale of any 

narcotic, depressant, stimulant, hallucinogen, or cannabis, for your own intended profit or that of another? 

If you answered "Yes" to "a" above, provide information relating to the types of substance(s), the nature of the activity, and any other details relating 

to your involvement with illegal drugs. Include any treatment or counseling received. 

Month/Year Month/Year Controlled Substance/Prescription Drug Used Number of Times Used 

To 

To 

To 

fl) YOUR FINANCIAL RECORD Yes No 

E) In the last 7 years, have you, or a company over which you exercised some control, filed for bankruptcy, been declared bankrupt, been subject to a 

tax lien, or had legal judgment rendered against you for a debt? If you answered "Yes," provide date of initial action and other information requested 

below. 

Month/Year Type of Action Name Action Occurred Under Name/Address of Court or Agency Handling Case State ZIP Code 

0, Are you now over 180 days delinquent on any loan or financial obligation? Include loans or obligations funded or guaranteed by the Federal Yes No 

Government. 

If you answered "Yes," provide the information requested below: 

Month/Year Type of Loan or Obligation Name/Address of Creditor or Obligee State ZIP Code 

and Account # 

After completing this form and any attachments, you should review your answers to all questions to make sure the form is complete and accurate, and then sign and date the 

following certification and sign and date the release on Page 8. 

Certification That My Answers Are True 

My statements on this form, and any attachments to it, are true, complete, and correct to the best of my knowledge and belief and are 

made in good faith. I understand that a knowing and willful false statement on this form can be punished by fine or imprisonment or 

both. (See section 1001 of title 18, United States Code). 

Signature (Sign in ink) 

Enter your Social Security Number before going to the next page 

Date 

Page 7 
Standard Form 85P 

Revised September 1995 

U.S. Office of Personnel Management 

5 CFR Parts 731, 732, and 736 

UNITED STATES OF AMERICA 

AUTHORIZATION FOR RELEASE OF INFORMATION 

Carefully read this authorization to release information about you, then sign and date it in ink. 

Form approved: 

OMB No. 3206-0191 

NSN 7540-01-317- 7372 

85-1602 

I Authorize any investigator, special agent, or other duly accredited representative of the authorized Federal agency conducting my 

background investigation, to obtain any information relating to my activities from individuals, schools, residential management 

agents, employers, criminal justice agencies, credit bureaus, consumer reporting agencies, collection agencies, retail business 

establishments, or other sources of information. This information may include, but is not limited to, my academic, residential, 

achievement, performance, attendance, disciplinary, employment history, criminal history record information, and financial and 

credit information. I authorize the Federal agency conducting my investigation to disclose the record of my background 

investigation to the requesting agency for the purpose of making a determination of suitability or eligibility for a security clearance. 

I Understand that, for financial or lending institutions, medical institutions, hospitals, health care professionals, and other sources of 

information, a separate specific release will be needed, and I may be contacted for such a release at a later date. Where a separate 

release is requested for information relating to mental health treatment or counseling, the release will contain a list of the specific 

questions, relevant to the job description, which the doctor or therapist will be asked. 

I Further Authorize any investigator, special agent, or other duly accredited representative of the U.S. Office of Personnel 

Management, the Federal Bureau of Investigation, the Department of Defense, the Defense Investigative Service, and any other 

authorized Federal agency, to request criminal record information about me from criminal justice agencies for the purpose of 

determining my eligibility for assignment to, or retention in a sensitive National Security position, in accordance with 5 U.S.C. 9101. 

I understand that I may request a copy of such records as may be available to me under the law. 

I Authorize custodians of records and other sources of information pertaining to me to release such information upon request of the 

investigator, special agent, or other duly accredited representative of any Federal agency authorized above regardless of any previous 

agreement to the contrary. 

I Understand that the information released by records custodians and sources of information is for official use by the Federal 

Government only for the purposes provided in this Standard Form 85P, and that it may be redisclosed by the Government only as 

authorized by law. 

Copies of this authorization that show my signature are as valid as the original release signed by me. This authorization is valid for 

five (5) years from the date signed or upon the termination of my affiliation with the Federal Government, whichever is sooner. 

Signature (Sign in ink) Full Name (Type or Print Legibly) Date Signed 

Other Names Used Social Security Number 

Current Address (Street, City) State ZIP Code Home Telephone Number 

(Include Area Code) 

( ) 

Pages 
Standard Form 85P 

Revised September 1995 

U.S. Office of Personnel Management 

5 CFR Parts 731, 732, and 736 

UNITED STATES OF AMERICA 

AUTHORIZATION FOR RELEASE OF MEDICAL INFORMATION 

Carefully read this authorization to release information about you, then sign and date it in black ink. 

Instructions for Completing this Release 

Form approved: 

OMB No. 3206-0191 

NSN 7540-01-317- 7372 

85-1602 

This is a release for the investigator to ask your health practitioner(s) the three questions below concerning your mental health 

consultations. Your signature will allow the practitioner(s) to answer only these questions. 

I am seeking assignment to or retention in a position of public trust with the Federal Government as a(n) 

(Investigator instructed to write in position title.) 

As part of the investigative process, I hereby authorize the investigator, special agent, or duly accredited representative of the 

authorized Federal agency conducting my background investigation, to obtain the following information relating to my mental health 

consultations: 

Does the person under investigation have a condition or treatment that could impair his/her judgment or reliability? 

If so, please describe the nature of the condition and the extent and duration of the impairment or treatment. 

What is the prognosis? 

I understand that the information released pursuant to this release is for use by the Federal Government only for purposes provided in 

the Standard Form 85P and that it may be redisclosed by the Government only as authorized by law. 

Copies of this authorization that show my signature are as valid as the original release signed by me. This authorization is valid for 1 

year from the date signed or upon termination of my affiliation with the Federal Government, whichever is sooner. 

Signature (Sign in ink) Full Name (Type or Print Legibly) Date Signed 

Other Names Used Social Security Number 

Current Address (Street, City) State ZIP Code Home Telephone Number 

(Include Area Code) 

( ) 
EXHIBIT L
FD-258 (Rev. 5-15-17) 1110-0046

LEAVE BLANK

APPLICANT

TYPE OR PRINT ALL INFORMATION IN BLACK FBI LEAVE BLANK

LAST NAME FIRST NAME MIDDLE NAME NAM

ALIASES AKA

DATE OF BIRTH DOB

Month Day Year

SEX RACE HGT. WGT. EYES HAIR PLACE OF BIRTH POB

LEAVE BLANK

CITIZENSHIP CTZ

YOUR NO. OCA

O

R

I

CLASS

REF.

UNIVERSAL CONTROL NO. UCN

ARMED FORCES NO. MNU

SOCIAL SECURITY NO. SOC

MISCELLANEOUS NO. MNU

SIGNATURE OF PERSON FINGERPRINTED

RESIDENCE OF PERSON FINGERPRINTED

DATE

EMPLOYER AND ADDRESS

REASON FINGERPRINTED

SIGNATURE OF OFFICIAL TAKING FINGERPRINTS

 1. R. THUMB 2. R. INDEX 3. R. MIDDLE 4. R. RING 5. R. LITTLE

6. L. THUMB 7. L. INDEX 8. L. MIDDLE 9. L. RING 10. L. LITTLE

LEFT FOUR FINGERS TAKEN SIMULTANEOUSLY L. THUMB R. THUMB RIGHT FOUR FINGERS TAKEN SIMULTANEOUSLY

* See Privacy Act Notice on Back
FEDERAL BUREAU OF INVESTIGATION

UNITED STATES DEPARTMENT OF JUSTICE

CJIS DIVISION/CLARKSBURG, WV 26306

APPLICANT

THIS CARD FOR USE BY:

1. LAW ENFORCEMENT AGENCIES IN FINGERPRINTING APPLICANTS FOR LAW ENFORCEMENT POSITIONS.*

2. OFFICIALS OF STATE AND LOCAL GOVERNMENTS FOR PURPOSES OF EMPLOYMENT, LICENSING, AND

PERMITS, AS AUTHORIZED BY STATE STATUTES AND APPROVED BY THE ATTORNEY GENERAL OF THE

UNITED STATES. LOCAL AND COUNTY ORDINANCES, UNLESS SPECIFICALLY BASED ON APPLICABLE 

STATE STATUTES DO NOT SATISFY THIS REQUIREMENT.*

3. U.S. GOVERNMENT AGENCIES AND OTHER ENTITIES REQUIRED BY FEDERAL LAW.**

4. OFFICIALS OF FEDERALLY CHARTERED OR INSURED BANKING INSTITUTIONS TO PROMOTE OR MAINTAIN

THE SECURITY OF THOSE INSTITUTIONS.

1. PRINTS MUST GENERALLY BE CHECKED THROUGH THE APPROPRIATE STATE IDENTIFICATION BUREAU, AND ONLY THOSE

FINGERPRINTS FOR WHICH NO DISQUALIFYING RECORD HAS BEEN FOUND LOCALLY SHOULD BE SUBMITTED FOR FBI SEARCH.

2. IDENTITY OF PRIVATE CONTRACTORS SHOULD BE SHOWN IN SPACE “EMPLOYER AND ADDRESS”. THE

CONTRIBUTOR IS THE NAME OF THE AGENCY SUBMITTING THE FINGERPRINT CARD TO THE FBI.

UNIVERSAL CONTROL NUMBER, IF KNOWN, SHOULD ALWAYS BE FURNISHED IN THE APPROPRIATE SPACE.

3. MISCELLANEOUS NO. - RECORD: OTHER ARMED FORCES NO. PASSPORT NO. [FP], ALIEN REGISTRATION NO.

(AR), PORT SECURITY CARD NO. (PS), SELECTIVE SERVICE NO. (SS) VETERANS’ ADMINISTRATION CLAIM NO. (VA).

**

*

INSTRUCTIONS:

ARCHES HAVE NO DELTAS

FD-258 (REV. 5-15-17)

3. ARCH

THESE LINES RUNNING BETWEEN

DELTAS MUST BE CLEAR

CENTER

OF LOOP

2. WHORL

DELTAS

THE LINES BETWEEN CENTER OF

LOOP AND DELTA MUST SHOW

DELTA

1. LOOP

Please review this helpful information to aid in the successful processing of hard copy civil fingerprint submissions in order to prevent delays or 

rejections. Hard copy fingerprint submissions must meet specific criteria for processing by the Federal Bureau of Investigation.

Ensure all information is typed or legibly printed using blue or black ink.

Enter data within the boundaries of the designated field or block.

Complete all required fields. (If a required field is left blank, the fingerprint card may be immediately rejected without further processing.)

• The required fields for hard copy civil fingerprint cards are: ORI, Date of Birth, Place of Birth, NAM, Sex, Date 

fingerprinted, Reason Fingerprinted, and proper completion of fingerprint impression boxes.

Do not use highlighters on fingerprint cards. 

Do not enter data or labels within ‘Leave Blank’ areas.

Ensure fingerprint impressions are rolled completely from nail to nail.

Ensure fingerprint impressions are in the correct sequence.

Ensure notations are made for any missing fingerprint impression (i.e. amputation).

Do not use more than two retabs per fingerprint impression block.

Ensure no stray marks are within the fingerprint impression blocks.

Training aids can be ordered online via the Internet by accessing the FBI’s website at: fbi.gov, click on ‘Fingerprints’, then click on 

‘Ordering Fingerprint Cards & Training Aids’. Direct questions to the Biometric Services Section’s Customer Service Group at (304) 625-5590 or by email at <identity@fbi.gov>.

PRIVACY ACT STATEMENT

Authority: The FBI's acquisition, preservation, and exchange of fingerprints and associated information is generally authorized under 

28 U.S.C. 534. Depending on the nature of your application, supplemental authorities include Federal statutes, State statutes pursuant to

Pub.L. 92-544, Presidential Executive Orders, and federal regulations. Providing your fingerprints and associated information is voluntary; 

however, failure to do so may affect completion or approval of your application.

Principal Purpose: Certain determinations, such as employment, licensing, and security clearances, may be predicated on fingerprintbased background checks. Your fingerprints and associated information/biometrics may be provided to the employing, investigating, or

otherwise responsible agency, and/or the FBI for the purpose of comparing your fingerprints to other fingerprints in the FBI's Next Generation 

Identification (NGI) system or its successor systems (including civil, criminal, and latent fingerprints repositories) or other available records of 

the employing, investigating, or otherwise responsible agency. The FBI may retain your fingerprints and associated information/biometrics in 

NGI after the completion of this application and, while retained, your fingerprints may continue to be compared against other fingerprints 

submitted to or retained by NGI.

Routine Uses:

 

During the processing of this application and for as long thereafter as your fingerprints and associated information/

biometrics are retained in NGI, your information may be disclosed pursuant to your consent, and may be disclosed without your consent as

permitted by the Privacy Act of 1974 and all applicable Routine Uses as may be published at any time in the Federal Register, including the 

Routine Uses for the NGI system and the FBI's Blanket Routine Uses. Routine uses include, but are not limited to, disclosures to:

employing, governmental or authorized non-governmental agencies responsible for employment, contracting, licensing, security clearances, 

and other suitability determinations; local, state, tribal, or federal law enforcement agencies; criminal justice agencies; and agencies

responsible for national security or public safety.

1110-0046

Social Security Account Number (SSAN): Pursuant to the Privacy Act of 1974, any Federal, state, or local government agency that 

requests an individual to disclose his or her SSAN, is responsible for informing the person whether disclosure is mandatory or voluntary, by 

what statutory or other authority the SSAN is solicited, and what uses will be made of it. In this instance, the SSAN is solicited pursuant to 

28 U.S.C 534 and will be used as a unique identifier to confirm your identity because many people have the same name and date of birth. 

Disclosure of your SSAN is voluntary; however, failure to disclose your SSAN may affect completion or approval of your application.

PAPERWORK REDUCTION ACT NOTICE

According to the Paperwork Reduction Act of 1995, no persons are required to provide the information requested unless a valid OMB 

control number is displayed. The valid OMB control number for this information collected is 1110-0046. The time required to complete this 

information collected is estimated to be 10 minutes, including time reviewing instructions, gathering, completing, reviewing and submitting 

the information collection. If you have any comments concerning the accuracy of this time estimate or suggestions for reducing this 

burden, please send to: Department Clearance Officer, United States Department of Justice, Justice Management Division, Policy and 

Planning Staff, Washington, DC 20530.
EXHIBIT M
CONTRACTOR PERSONNEL ROLLOVER REQUEST FORM

Social Security Administration (SSA)                                                       Center for Suitability and Personnel Security (CSPS)

March 2018

Submit this document to your designated contracting officer’s representative‐contracting officer’s technical

representative (COR‐COTR) via secure email.  The COR‐COTR must ensure the information is complete and

accurate (all fields are required) and then submit to ^DCHR OPE Suitability.   

  

Only use this form when contractor personnel already working on an SSA contract need to move to another SSA

contract.  The information on this form must be typed, complete, and accurate.  Failure to do so may result in a

delay in receiving a suitability letter.  The company point of contact (CPOC) and COR‐COTR will receive suitability

letters from the Center for Suitability and Personnel Security (CSPS) once the rollover is complete.

FULL NAME

SOCIAL

SECURITY

NUMBER

DATE OF BIRTH FROM TO ACTIVE ON BOTH   

CONTRACTS?

  LAST           FIRST         MIDDLE    000‐00‐0000    MM/DD/YYYY   CONTRACT NUMBER   CONTRACT NUMBER    YES   NO

      

CPOC INFORMATION:

NAME: ______________________________________      EMAIL ADDRESS: _________________________________

PHONE: _____________________________________      DATE OF SUBMISSION:_____________________________

COR‐COTR INFORMATION:

NAME: ______________________________________      EMAIL ADDRESS: _________________________________

PHONE: _____________________________________
EXHIBIT N
Security Awareness 

Contractor / Affiliate Personnel Security Certification 

Purpose This form is to be signed by contractor or affiliate : personnel to certify that they have received and understand 

SSA's Security Awareness Training requirements detailed below.

Background: I understand that SSA maintains a variety of sensitive information about the agency's operations and 

programs (hereinafter "SSA information"), which may be information pertaining to program (e.g., information about SSA's 

clients) or non-program (e.g., administrative and personnel records) matters. I understand that SSA may authorize me to 

have access to SSA information and that my access to and use of SSA information must be in accordance with the 

provisions of the contract under which I am performing work for SSA and/or the terms of any other written agreement that 

authorizes me to access SSA information.

I have read, understand, and agree that:

1. I will not inspect, access, or attempt to access any SSA information that SSA has not expressly authorized me

 to access.

2. I will not release or disclose any SSA information to any unauthorized person, agency, or entity. I understand

 that unauthorized disclosure of SSA information may lead to civil penalties and/or criminal prosecution under

 Federal law (i.e., The Privacy Act of 1974, 5 U.S.C. 552a; SSA's regulations at 20 C.F R. Part 401; The Social

 Security Act, 42 U.S.C. 1306(a); and 5 U.S.C. Section 552(i)). I further understand that additional privacy and

 disclosure protections may apply to certain types of SSA information, including Federal Tax Information (i.e.,

 earnings information), which may be subject to additional penalties under sections 6103, 7213, 7213A, and 7431 

 of the Internal Revenue Service (IRS) Code (Title 26 of the United States Code). 

3. I will follow all access, retention, and/or destruction requirements in the contract and/or agreement under which I

 am authorized to access SSA information. I understand that such requirements may require me to cease access

 to, return, or destroy SSA information upon completion of my work for SSA or termination of my contract or

 agreement that authorized my access to SSA information.

4. I will not take SSA information off-site, unless expressly authorized to do so by contract or other written 

 authorization from SSA. If SSA authorizes me to take SSA information off-site, I agree to safeguard all SSA

 information in accordance with agency policy and standards so that no unauthorized person, agency, or entity can

 access SSA's information.

5. I will keep confidential any third-party proprietary information that may be entrusted to me as part of the contract,

 including safeguarding such information from unauthorized access and not disclosing or releasing such

 information unless expressly authorized to do so.

6. I will follow all SSA terms, conditions, and policies in the contract under which I am performing work for SSA

 and/or the terms of any other written agreement that authorizes me to access SSA information, including but not

 limited to those governing confidential information or personally identifiable information.

7. I will follow all SSA Standards of Conduct, and Rules of Behavior for Users and Managers of SSA's Automated

 Information Resources.

8. I understand that the contract and/or agreement terms take precedent over this document.

9. I understand that any questions I may have concerning authorization(s) should be directed to the Contracting

 Officer designated in my company's contract.

Contractor Employee Name (Print/Type) Date (MM/DD/YYYY)

Contractor Employee Signature (Sign)

Contract Number Company Name (Print/Type)

Company Point Of Contact (Print/Type) Company Point of Contact Phone Number

Form SSA-222 (10-2016)

Discontinue Previous Editions

Social Security Administration Page 1 of 2
Privacy Act

42 U.S.C. § 904(a); 20 C.F.R. § 401.90; 44 U.S.C. §§ 3541-3549; 41 C.F.R. Chapter 101;

5 U.S.C. § 552a(e)(9)-(10); and Executive Order 13488 allow us to collect the information on this form. We will 

use the information to authorize you to have access to Social Security Administration (SSA) information. The 

Privacy Act (5 U.S.C. & 552a(b)) permits us to disclose the information you provide on this form in accordance 

with approved routine uses. Providing us your information is voluntary. However, not providing the information 

could prevent us from authorizing you access to SSA information. Additional information regarding this form, 

routine uses of information, and other Social Security programs, is available on our Internet website,

www.socialsecurity.gov, or at your local Social Security office. 

Form SSA-222 (10-2016) Page 2 of 2
EXHIBIT O
SYSTEM PLAN 

TYPE OF PROPOSED MAINFRAME PLATFORM_____________________________ 

TYPE OF PERSONAL COMPUTER_________________________________________ 

MEDIA TO BE USED FOR RECEIPT OF FILE TRANSMISSION_________________ 

FILE STORAGE MEDIUM_________________________________________________ 

MANAGED FILE TRANSFER PLATFORM SERVER INSTALLED?______________ 

AMOUNT OF AVAILABLE FILE STORAGE SPACE___________________________ 

TYPE OF PRINT STREAM MAIL RUN CONTROL SYSTEM____________________ 

TYPE OF NETWORK PLATFORM (i.e., NOVELL/NT/UNIX)____________________ 
EXHIBIT P
Page 91 of 98 

Page 1 of 7 

3PAO-Obligatinos-and-Performance-Guide 

v1.0 
Page 92 of 98 

Page 2 of 7 

3PAO-Obligatinos-and-Performance-Guide v1.0 
Page 93 of 98 

Page 3 of 7 

3PAO-Obligatinos-and-Performance-Guide v1.0 
Page 94 of 98 

Page 4 of 7 

3PAO-Obligatinos-and-Performance-Guide v1.0 
Page 95 of 98 

Page 5 of 7 

3PAO-Obligatinos-and-Performance-Guide v1.0 
Page 96 of 98 

Page 6 of 7 

3PAO-Obligatinos-and-Performance-Guide v1.0 
Page 97 of 98 

Page 7 of 7 

3PAO-Obligatinos-and-Performance-Guide v1.0 
EXHIBIT Q
Full Audit report must include the following information (reprints must have the same information): 

1. Program Number/Job Name/Print Order/File Date

2. PC#/Sequence numbers/Total Volume 

3. Inserter ID and Operator

4. Date of insertion

5. Start and End time 

6. Start and End Range (sequence numbers) 

7. Total for each Start and End Range 

8. Event (i.e. Processed, Spoiled, Diverted and reason: Missing Piece, Unverified, Misread etc.)

9. Status (i.e. Inserted, Routed to Reprint Area, etc.)

10. Totals

a. Machine inserted

b. Sent to Reprint 

c. Reprints Recovered

d. Records Accounted For 

e. Duplicates

f. Duplicated Verified

g. Records less duplicates

h. Reported Output 

i. Variances

Example: 

Inserter ID Date Start Time End Time Start Range End Range Total EVENT STATUS

Inserter 1 05/10/12 10:31:04 AM 11:12:45 AM 19386 21567 2182 Standard Processing Inserted

Operator Joe 05/10/12 11:12:50 AM 11:12:50 AM 21568 1 Diverted Routed to Reprint

05/10/12 11:13:10 AM 11:28:06 AM 21569 22516 948 Standard Processing Inserted

05/10/12 11:28:07 AM 11:28:10 AM 22517 22518 2 Diverted/ leave count unverified Routed to Reprint

05/10/12 11:29:30 AM 11:29:35 AM 22519 22521 3 Diverted/missing piece Routed to Reprint

05/10/12 11:29:45 AM 11:30:15 AM 22522 1 Diverted/manual insertion of pub Manual Scan

05/10/12 11:30:34 AM 11:40:35 AM 22523 1 Diverted/misread Manual Scan

Inserter 2 05/11/12 8:12:50 AM 8:12:50 AM 21568 1 Standard Processing Inserted

(REPRINTS) 05/11/12 8:28:07 AM 8:28:10 AM 22517 22518 2 Standard Processing Inserted

Operator Sue 05/11/12 8:29:30 AM 8:29:35 AM 22519 22521 3 Standard Processing Inserted

26604

582

Reprints Recovered: 582

27186

16

16

27170

27170

0

TOTALS

Records Accounted for:

Duplicates:

Duplicates Verified:

Records Less Duplicates:

Reported Output:

Variance:

Audit Report

Program 123-S/SSA Notices Name/PO#54001/File Date

PC # and Sequence Numbers and Volume

Machine Inserted:

Sent to Reprints:

Exhibit Q

100% Accountability and Summary Reports 
The Summary Report must include the following; Reprints must also have all of the same information: 

1. Job Name/Print Order 

2. Piece Quantity 

3. Sequence number range (Start and End Range) 

4. Start date and time

5. End date and time 

6. Total Processed Pieces

7. Total Reprints

8. Total Pieces Inserted

9. Total Variances

10. Job Complete or Incomplete

Summary Report

Job Information Operation Information

Job Name: XYZ Notice

PO # 54001 Start Range: 1

Piece Quantity: 35862 End Range 35862

Job Status: Completed

Start Date &Time: 05/10/12 10:29:54

End Date & Time: 05/11/12 14:22:34

Statistical Summary

35537 Processed Pieces - Completed 05/10/12 

10:29:54 

325 Processed Reprints - Completed 05/11/12

14:22:34 

35862 Total Pieces Inserted - 

0 Variances - 

Completed 05/11/12

14:22:34

Job Complete 
EXHIBIT R
EXHIBIT R – Record Specifications

Enforcement Mailer 1 SSA 131 File Layout

Field 

Location Field Name

Field 

Size

SSA 

131

01 11 Blank

12 13 BIC 2 X

14 24 BOAN (999-99-9999) 11 X

25 39 MBR FIRST NAME 15 X

40 40 MBR MIDDLE INITIAL 1 X

41 60 MBR LAST NAME 20 X

61 64 TAX YEAR 4 X

65 70 EARNINGS 6 X

71 79 EIN 9 X

80 119 EMPLOYER ADDRESS – LINE 1 40 X

120 159 EMPLOYER ADDRESS – LINE 2 40 X

160 199 EMPLOYER ADDRESS – LINE 3 40 X

200 239 EMPLOYER ADDRESS – LINE 4 40 X

240 279 EMPLOYER ADDRESS – LINE 5 40 X

280 319 EMPLOYER ADDRESS – LINE 6 40 X

320 333 ZDPC(*ZIP+ZDPC*) 14 X

 
MYM L9790 RECORD LAYOUT FOR MAILER 2

ANNUAL EARNINGS TEST MID-YEAR PHYSICAL--VENDOR FILES (SSA-L9790)

(CSMY.WDOC)

Record Prog. Field Field

Location Field Name Pnem. Size Type

1 Data Operation Center 1 A

2 Blank 1 A

3-8 Notice Number 6 AN

9-18 Zip Code + 4 10 NC

19-32 Barcode Print Representation 14 NC

33 PSC 1 N

34 Blank 1 A

35-45 Claim Account Number 11 NC

46 Blank 1 A

47-48 Beneficiary Identification Code

(BIC) 2 AN

49 Blank 1 A

50-74 Beneficiary Name 25 ANC

75-96 Beneficiary Address - Line 1 22 ANC

97-118 Beneficiary Address - Line 2 22 ANC

119-140 Beneficiary Address - Line 3 22 ANC

141-162 Beneficiary Address - Line 4 22 ANC

163-184 Beneficiary Address - Line 5 22 ANC

185-203 Blank 19 A
204-206 Group Number 3 AN

MYM RECORD LAYOUT FOR MAILER 2 L9790

ATTACHMENT 1

ANNUAL EARNINGS TEST MID-YEAR PHYSICAL--VENDOR FILES (SSA-L9790)

(CSMY.WDOC)

207-208 Blank 2 A

209-308 NonWork Months (NWM) 100 ANC

309-310 Blank 2 A

311-315 Month and Year of Full Retirement Age

Attainment 5 NC

316-317 Blank 2 A

318-322 Date of Entitlement Current 5 NC

323-324 Blank 2 A

325-328 Tax Year 4 N

329 Blank 1 A

330-335 Annual Exempt Amount ($$,$$$) 6 NC

336 Blank 1 A

337-341 Monthly Exempt Amount ($,$$$) 5 N

342 Blank 1 A

343 Special Notice Option (SNO) Code 1 N

344-346 Telephone Area Code 3 N

347 Dash 1 C

348-350 Telephone Exchange 3 N

351 Dash 1 C
352-355 Telephone Number 4 N

356 Dash 1 C

357-361 Telephone Extension 5 N

MYM RECORD LAYOUT FOR MAILER 2 L9790

ATTACHMENT 1

ANNUAL EARNINGS TEST MID-YEAR PHYSICAL--VENDOR FILES (SSA-L9790)

(CSMY.WDOC)

362 Special Notice Option Priority Code 1 A

363 Blank 1 A

364-385 Field Office (FO) Physical Address 22 ANC

386-407 Field Office (FO) Physical Address 22 ANC

408-429 Field Office (FO) Physical Address 22 ANC

430-451 Field Office (FO) Physical Address 22 ANC

452-479 Field Office (FO) Physical Address City 28 A

480-481 Field Office (FO) Physical Address State 2 A

482 Blank 1 A

483-487 Field Office (FO) Physical Address Zip 5 5 N

488 Dash 1 C

489-492 Field Office (FO) Physical Address Zip 4 4 N

Additional information:

Record Location 209-308 Nonwork Months (NWM)

When the fill-in = NONE (THIS MEANS THAT OUR RECORDS INDICATE YOU ARE

WORKING IN EVERY MONTH IN YYYY), the year fill-in should be obtained

from record location 325-328.
The Special Notice Option Priority Code isn’t on the SNO database. It’s

a field that NTIS requested us to send them with an ‘S’ in it, record

location is 362. The SNO Priority Code is only for SNO values equal to

3, 4, 6 or 7.

NOTE:

A file for the data derived from record location 343 (SNO CODE)

should be sent out accordingly:

SNO CODE 3, 4, 6 and 7 goes to NTIS and to the print vendor.

SNO CODE 2 goes to WBDOC and to the print vendor. This is the only

option that should have a telephone number associated with it.
SUMMARY

DATE PAGE # EXPLANATION OF CHANGE

10/22/10 Updated the record location

layout with the Special Notice

Option (SNO) Code, SNO Priority Code

and the Telephone Number for

beneficiaries, who are blind or

visually imparied.

04/28/11 Updated the requirements with the

file names for the vendor, WBDOC and

NTIS. To add Attachment 2 for when

SNO values equal 2, 3, 4, 6 or 7.

05/04/11 To correct the numbers for the record

location.

05/11/12 Changed the ATTACHMENT number from

‘2’ to ‘1’.

03/12/14 Updated the record layout to include

the data for the Field Office (FO)

address.
MYM RECORD LAYOUT FOR MAILER 3 AND 4

ANNUAL EARNINGS TEST MID-YEAR MAILING--VENDOR TAPE FILES

(CSMY.WDOC)

Record Prog. Field Field

Location Field Name Pnem. Size Type

1 Data Operation Center = W 1 A

2-7 Notice code – 9781, 9778S, 9779S,

9784SM, 9785SM 6 AN

8-12 Zip 5 N

13 Dash 1 C

14-17 Zip+4 4 N

18-31 Barcode Print Representation 14 NC

32 PSC 1 N

33-35 Claim Account Number Area 3 N

36 Dash 1 C

37-38 Claim Account Number Group 2 N

39 Dash 1 C

40-43 Claim Account Number Serial 4 N

44-45 Beneficiary Identification Code (BIC) 2 AN

46-55 Beneficiary Given Name (BGN) 10 ANC

56-56 Beneficiary Middle Initial (BMI) 1 ANC

57-68 Beneficiary Last Name (BGN) 12 ANC

69-90 Beneficiary Address 1 22 ANC

91-112 Beneficiary Address 2 22 ANC
113-134 Beneficiary Address 3 22 ANC

MYM RECORD LAYOUT FOR MAILER 3 AND 4

ATTACHMENT 1

ANNUAL EARNINGS TEST MID-YEAR MAILING--VENDOR TAPE FILES

(CSMY.WDOC)

135-156 Beneficiary Address 4 22 ANC

157-178 Beneficiary Address 5 22 ANC

179-187 Amount of Reported Earnings(AORE) 9 NC

188-197 First Nonwork Month 10 A

198-200 Group Number 3 AN

201-300 NonWork Months (NWM) 100 ANC

301-302 Date of Entitlement Current (DOEC) MM 2 NC

303-303 Slash 1 C

304-305 Date of Entitlement Current (DOEC) YY 2 NC

306-310 Month and Year of Full Retirement Age

Attainment MM/YY 5 NC

311-320 Month (spelled out) of FRA attainment. 10 A

321-322 Year of FRA CC 2 NC

323-324 Year of FRA YY 2 NC

325-325 Special Notice Option (SNO) Code 1 N

326-328 Telephone Area Code 3 N

329-329 Dash 1 C

330-332 Telephone Exchange 3 N

333-333 Dash 1 C
334-337 Telephone Number 4 N

338-338 Dash 1 C

MYM RECORD LAYOUT FOR MAILER 3 AND 4

ATTACHMENT 1

ANNUAL EARNINGS TEST MID-YEAR MAILING--VENDOR TAPE FILES

(CSMY.WDOC)

339-343 Telephone Extension 5 N

344-344 Special Notice Option Priority Code 1 A

345 Blank 1 A

346-367 Field Office (FO) Physical Address 22 ANC

368-389 Field Office (FO) Physical Address 22 ANC

390-411 Field Office (FO) Physical Address 22 ANC

412-433 Field Office (FO) Physical Address 22 ANC

434-461 Field Office (FO) Physical Address City 28 A

462-463 Field Office (FO) Physical Address State 2 A

464 Blank 1 A

465-469 Field Office (FO) Physical Address Zip 5 5 N

470 Dash 1 C

471-474 Field Office (FO) Physical Address Zip 4 4 N

475 Blank 1 A

476-485 Field Office (FO) Business Telephone 10 N
Additional information:

SSA-L9784 and SSA-L9785 (only). The fill-in for “f” should be shown

(spelled out) as month. The field size should be 10 characters to

accommodate the longest month. The data for this fill-in will be

obtained from record location 311-320.

SSA – L9778, SSA-L9779 and SSA-L9781 coversheet page 2 fill-in

The month in the fill-in for “a” should be shown (spelled out) as month.

The field size should be 10 characters to accommodate the longest month.

The data for this fill-in will be obtained

from record location 311-320. The year fill-in for “b” should be

obtained from record location 321-324.

The Special Notice Option Priority Code isn’t on the SNO database. It’s

a field NTIS requested us to send them with an ‘S’ in it, record

location is 344. The SNO Priority Code is only for SNO values equal to

3, 4, 6 or 7.

NOTE:

A file for the data derived from record location 325 (SNO CODE) should

be sent out accordingly:

SNO CODE 3, 4, 6 and 7 goes to NTIS and to the print vendor.

SNO CODE 2 goes to WBDOC and to the print vendor. This is the only

option that should have a telephone number associated with it.

SNO CODE 1 goes to the print vendor.
Barcode Data - Form SSA - 131

Record 

Location Field Name

Field 

Size

1-4 Form Number (131) 4

5-8 Tax Year (YYYY) 4

9-23 Employee First Name 15

24-38 Employee Middle Name 15

39-58 Employee Last Name 20

59-69 BOAN Employee SSN(######### - no dashes) 11

70-82 CAN & BIC (Claim Number) 13

83-122 Employer Address Line 1 40

123-133 EIN 11

134 PC code 1

Note: All data elements are left justified and space filled.

Barcode Data - Form SSA –9790

Record 

Location Field Name

Field 

Size

1-20 Form Name (ex. SSA-L9790-SM ) 20

21 Page Number (1 = Front 2 = Back) 1

22-28 Print Date (MMDDYY) 7

29-38 Employee SSN(######### no dashes) 10

39-41 BIC 3

42-57 Employee First Name 16

58-59 Employee Middle Name 2

60-80 Employee Last Name 21

81-85 FRA 5

86-98 Filler (Spaces) 13

99 PC code (numeric only X in ex. is a place holder) 1

Example: SSA-L9790-SM 1081708 999999999 C1 CHOMPTON B FADE 06/01 

X
Barcode Data - Form SSA –9778

Record 

Location Field Name

Field 

Size

1-20 Form Name (ex. SSA-L9778-SM ) 20

21 Page Number (1 = Front 2 = Back) 1

22-28 Print Date (MMDDYY) 7

29-38 Employee SSN(######### no dashes) 10

39-41 BIC 3

42-57 Employee First Name 16

58-59 Employee Middle Name 2

60-80 Employee Last Name 21

81-85 FRA 5

86-90 DOE 5

91-98 Estimated Earnings 8

99 PC code (numeric only X in ex. is a place holder) 1

Example: SSA-L9778-SM-SUP 1081010 999999999 A BLANK D FONALD 

08/0803/1220800 X

Barcode Data - Form SSA –9784

Record 

Location Field Name

Field 

Size

1-20 Form Name (ex. SSA-L9784-SM ) 20

21 Page Number (1 = Front 2 = Back) 1

22-28 Print Date (MMDDYY) 7

29-38 Employee SSN(######### no dashes) 10

39-41 BIC 3

42-57 Employee First Name 16

58-59 Employee Middle Name 2

60-80 Employee Last Name 21

81-85 FRA 5

86-90 DOE 5

91-98 Estimated Earnings 8

99 PC code (numeric only X in ex. is a place holder) 1

Example: SSA-L9784-SM 1081010 999999999 A FILET G DUCK 10/0609/1040000 

X
Barcode Data - Form SSA –9785

Record 

Location Field Name

Field 

Size

1-20 Form Name (ex. SSA-L9785-SM ) 20

21 Page Number (See Note Below) 1

22-28 Print Date (MMDDYY) 7

29-38 Employee SSN(######### no dashes) 10

39-41 BIC 3

42-57 Employee First Name 16

58-59 Employee Middle Name 2

60-80 Employee Last Name 21

81-85 FRA 5

86-90 DOE 5

91-98 Estimated Earnings 8

99 PC code (numeric only X in ex. is a place holder) 1

100-111 Preprinted Months 12

Note: Preprinted Months = “Y” where the month is preprinted. Example, “YNNNNNNNNNNN” indicates 

January was the only preprinted month.

Note: Page number values are:

1 = Page 1 front 

2 = Page 1 back 

3 = Page 2 front 

4 = Page 2 back 

Example: SSA-L9785-SM 1081010 999999999 A FREESELAN A IDA 

05/1008/1051600 XNYNNNNNNNYYY

Barcode Data - Form SSA –9779

Record 

Location Field Name

Field 

Size

1-20 Form Name (ex. SSA-L9779-SM ) 20

21 Page Number (See Note below) 1

22-28 Print Date (MMDDYY) 7

29-38 Employee SSN(######### no dashes) 10

39-41 BIC 3

42-57 Employee First Name 16

58-59 Employee Middle Name 2

60-80 Employee Last Name 21
81-85 FRA 5

86-90 DOE 5

91-98 Estimated Earnings 8

99

100-111

PC code (numeric only X in ex. is a place holder)

Preprinted Months

1

12

Note: Preprinted Months = “Y” where the month is preprinted. Example, “YNNNNNNNNNNN” indicates 

January was the only preprinted month.

Note: Page number values are:

1 = Page 1 front 

2 = Page 1 back 

3 = Page 2 front 

4 = Page 2 back 

Example: SSA-L9779-SM-SUP 1081010 999999999 A BIELES ORTON BERONLOA 

01/1012/1314344 XNYNNNNNNNYYY

Barcode Data - Form SSA –9781

Record 

Location Field Name

Field 

Size

1-20 Form Name (ex. SSA-L9781-SM ) 20

21 Page Number (See Note below) 1

22-28 Print Date (MMDDYY) 7

29-38 Employee SSN(######### no dashes) 10

39-41 BIC 3

42-57 Employee First Name 16

58-59 Employee Middle Name 2

60-80 Employee Last Name 21

81-85 FRA 5

86-90 DOE 5

91-98 Estimated Earnings 8

99 PC code (numeric only X in ex. is a place holder) 1

100-111 Preprinted Months 12

Note: Preprinted Months = “Y” where the month is preprinted. Example, “YNNNNNNNNNNN” indicates 

January was the only preprinted month.

Note: Page number values are:

1 = Page 1 front 

2 = Page 1 back 

3 = Page 2 front 

4 = Page 2 back 

Example: SSA-L9781-SM 1081210 999999999 A TEREO L JOAN 03/1003/1414160 

XNYNNNNNNNYYY
NCOA

---------------------- VIEW LAYOUT --------------- Row 1 to 19 of 115 

 

-------- FIELD LEVEL/NAME --------- --PICTURE-- FLD START END LENGTH 

NOTIC-TO-VENDOR 1 815 815 

5 NOTIC-CAN X(9) 1 1 9 9 

5 NOTIC-PIC XX 2 10 11 2 

5 NOTIC-NAME GROUP 3 12 99 88 

 10 FILLER(1) OCCURS 4 TIMES 

 X(22) 4 12 33 22 

 10 FILLER(2) X(22) 4 34 55 22 

 10 FILLER(3) X(22) 4 56 77 22 

 10 FILLER(4) X(22) 4 78 99 22 

5 NOTIC-ADD GROUP 5 100 187 88 

 10 FILLER(1) OCCURS 4 TIMES 

 X(22) 6 100 121 22 

 10 FILLER(2) X(22) 6 122 143 22 

 10 FILLER(3) X(22) 6 144 165 22 

 10 FILLER(4) X(22) 6 166 187 22 

5 NOTIC-CITY X(20) 7 188 207 20 

5 NOTIC-STATE XX 8 208 209 2 

5 NOTIC-ZIP GROUP 9 210 218 9 

 10 NOTIC-ZIP-5 X(5) 10 210 214 5 

 10 NOTIC-ZIP-PLUS4 X(4) 11 215 218 4 

5 NOTIC-ZDPC XXX 12 219 221 3 

5 NOTIC-LAF XX 13 222 223 2 

5 NOTIC-EDA GROUP 14 224 231 8 

 10 NOTIC-EDA-MM XX 15 224 225 2 

 10 NOTIC-EDA-DD XX 16 226 227 2 

 10 NOTIC-EDA-CC XX 17 228 229 2 

 10 NOTIC-EDA-YY XX 18 230 231 2 

5 NOTIC-FLOA X 19 232 232 1 

5 NOTIC-DDCO X 20 233 233 1 

5 NOTIC-TOP X 21 234 234 1 

5 NOTIC-BGN GROUP 22 235 244 10 

 10 NOTIC-BGN-1 XXX 23 235 237 3 

 10 NOTIC-BGN-2 X(7) 24 238 244 7 

5 NOTIC-BMI X 25 245 245 1 

5 NOTIC-BLN GROUP 26 246 257 12 

 10 NOTIC-BLN-1 X(5) 27 246 250 5 

 10 NOTIC-BLN-2 X(7) 28 251 257 7 

5 NOTIC-BIC XX 29 258 259 2 

5 NOTIC-DOST GROUP 30 260 265 6 

 10 NOTIC-DOST-MM XX 31 260 261 2 

 10 NOTIC-DOST-CC XX 32 262 263 2 

 10 NOTIC-DOST-YY XX 33 264 265 2 

5 NOTIC-SISC X 34 266 266 1 

5 NOTIC-DOB GROUP 35 267 274 8 

 10 NOTIC-DOB-MM XX 36 267 268 2 

 10 NOTIC-DOB-DD XX 37 269 270 2 

 10 NOTIC-DOB-CC XX 38 271 272 2 

 10 NOTIC-DOB-YY XX 39 273 274 2 

5 NOTIC-OC X 40 275 275 1 
5 NOTIC-LANG X 41 276 276 1 

5 NOTIC-SELECT-DATE GROUP 42 277 284 8 

 10 NOTIC-SEL-MM XX 43 277 278 2 

 10 NOTIC-SEL-DD XX 44 279 280 2 

 10 NOTIC-SEL-CC XX 45 281 282 2 

 10 NOTIC-SEL-YY XX 46 283 284 2 

5 NOTIC-PAYEE-NAME-ETC GROUP 47 285 372 88 

 10 NOTIC-ORIG-NAME(1) OCCURS 4 TIMES 

 X(22) 48 285 306 22 

 10 NOTIC-ORIG-NAME(2) X(22) 48 307 328 22 

 10 NOTIC-ORIG-NAME(3) X(22) 48 329 350 22 

 10 NOTIC-ORIG-NAME(4) X(22) 48 351 372 22 

5 NOTIC-SNO-CODE X 49 373 373 1 

5 NOTIC-BENE-PHONE GROUP 50 374 383 10 

 10 NOTIC-BENE-PHNAREA XXX 51 374 376 3 

 10 NOTIC-BENE-PHNEXCH XXX 52 377 379 3 

 10 NOTIC-BENE-PHNNUM X(4) 53 380 383 4 

5 NOTIC-SNO-PRIORITY X 54 384 384 1 

5 NOTIC-MAIL-DATE X(10) 55 385 394 10 

5 FILLER X(5) 56 395 399 5 

5 NOTIC-MOVE-IND X 57 400 400 1 

5 NOTIC-USPS-STREET X(40) 58 401 440 40 

5 FILLER X(10) 59 441 450 10 

5 NOTIC-USPS-CITY X(13) 60 451 463 13 

5 NOTIC-USPS-STATE XX 61 464 465 2 

5 NOTIC-USPS-ZIP GROUP 62 466 474 9 

 10 NOTIC-USPS-ZIP-5 9(5) 63 466 470 5 

 10 NOTIC-USPS-ZIP-4 9(4) 64 471 474 4 

5 NOTIC-USPS-ZIP-D-P-C XXX 65 475 477 3 

5 NOTIC-USPS-NEW-ADDRESS X(40) 66 478 517 40 

5 NOTIC-USPS-NEW-CITY X(13) 67 518 530 13 

5 NOTIC-USPS-NEW-STATE XX 68 531 532 2 

5 NOTIC-USPS-NEW-ZIP GROUP 69 533 541 9 

 10 NOTIC-USPS-NEW-ZIP-5 9(5) 70 533 537 5 

 10 NOTIC-USPS-NEW-ZIP-4 9(4) 71 538 541 4 

5 NOTIC-USPS-NEW-ZIP-D-C 999 72 542 544 3 

5 NOTIC-USPS-EFF-DATE GROUP 73 545 552 8 

 10 NOTIC-USPS-MM 99 74 545 546 2 

 10 NOTIC-USPS-DD XX 75 547 548 2 

 10 NOTIC-USPS-CC 99 76 549 550 2 

 10 NOTIC-USPS-YY 99 77 551 552 2 

5 NOTIC-LIND X 78 553 553 1 

5 NOTIC-OLD-DOC XXX 79 554 556 3 

5 NOTIC-OLD-DOC-SCC X(5) 80 557 561 5 

5 NOTIC-OLD-DOC-ADDR-L1 X(22) 81 562 583 22 

5 NOTIC-OLD-DOC-ADDR-L2 X(22) 82 584 605 22 

5 NOTIC-OLD-DOC-ADDR-L3 X(22) 83 606 627 22 

5 NOTIC-OLD-DOC-CITY X(20) 84 628 647 20 

5 NOTIC-OLD-DOC-ST XX 85 648 649 2 

5 NOTIC-OLD-DOC-ZIP X(10) 86 650 659 10 

5 NOTIC-OLD-DOC-PHONE X(12) 87 660 671 12 

5 NOTIC-NEW-DOC XXX 88 672 674 3 

5 NOTIC-NEW-DOC-SCC X(5) 89 675 679 5 

5 NOTIC-NEW-DOC-ADDR-L1 X(22) 90 680 701 22 

5 NOTIC-NEW-DOC-ADDR-L2 X(22) 91 702 723 22 
5 NOTIC-NEW-DOC-ADDR-L3 X(22) 92 724 745 22 

5 NOTIC-NEW-DOC-CITY X(20) 93 746 765 20 

5 NOTIC-NEW-DOC-ST XX 94 766 767 2 

5 NOTIC-NEW-DOC-ZIP X(10) 95 768 777 10 

5 NOTIC-NEW-DOC-PHONE X(12) 96 778 789 12 

5 FILLER X(11) 97 790 800 11 

5 NOTIC-BNC GROUP 98 801 815 15 

 10 NOTIC-BNC-YEAR XX 99 801 802 2 

 10 NOTIC-BNC-SYSTEM XX 100 803 804 2 

 10 NOTIC-BNC-ID X(9) 101 805 813 9 

 10 NOTIC-BNC-BIC XX 102 814 815 2 

******************************* Bottom of data ********************************

STEPPARENT

 Record Length = 281 Block Size = 29,786 

 Record Program Field Foot 

 Location Field Name Mnemonic Size Note 

 1-11 Account Number CAN 11 B 

 (includes dashes (-)) 

 12-13 Beneficiary 

 Identification Code BIC 2 C 

 14-145 Beneficiary Name & PNA 132 D 

 Address (6 lines of 

up to 22 characters

each) 

 146-150 5-digit Zip Code ZIP 5 E 

 151-154 Zip +4 +4 4 F 

 155-157 Zip Point ZDPC 3 G 

 Delivery Code

 158-171 Barcode Representation 14 H 

 (*999999999999* or spaces) 

 172-183 District Office (DO) 

 Phone 12 I 

(Format: XXX-XXX-XXXX) 

 

 184-205 DO Address Line 1 22 J 

 206-227 DO Address Line 2 22 K 

 228-249 DO Address Line 3 22 L 

 250-269 DO City 20 M 

 270-271 DO State 2 N 

 272-281 DO Zip Code 10 O 
 (XXXXX-XXXX) 
Here is the record layout of this file:

 

FILE-TO-VENDOR 1 281 281

5 STEP-CAN-AREA XXX 1 1 3 3

5 STEP-DASH1 X 2 4 4 1

5 STEP-CAN-GROUP XX 3 5 6 2

5 STEP-DASH2 X 4 7 7 1

5 STEP-CAN-SERIAL X(4) 5 8 11 4

5 STEP-BIC XX 6 12 13 2

5 STEP-PNAS GROUP 7 14 145 132

 10 STEP-PNA1 X(22) 8 14 35 22

 10 STEP-PNA2 X(22) 9 36 57 22

 10 STEP-PNA3 X(22) 10 58 79 22

 10 STEP-PNA4 X(22) 11 80 101 22

 10 STEP-PNA5 X(22) 12 102 123 22

 10 STEP-PNA6 X(22) 13 124 145 22

5 STEP-ZIP5 X(5) 14 146 150 5

5 STEP-ZIP4 X(4) 15 151 154 4

5 STEP-ZDPC XXX 16 155 157 3

5 STEP-BARCODE X(14) 17 158 171 14

5 STEP-DOCPHONE GROUP 18 172 183 12

 10 STEP-DOC XXX 19 172 174 3

 10 STEP-DOC-FIL X(9) 20 175 183 9

5 STEP-DOC-ADD1 X(22) 21 184 205 22

5 STEP-DOC-ADD2 X(22) 22 206 227 22

5 STEP-DOC-ADD3 X(22) 23 228 249 22

5 STEP-DOC-ADD4 X(22) 24 250 271 22

5 STEP-DOC-ZIP X(10) 25 272 281 10
SNO PROCESSING EFFECTIVE DECEMBER 2010

Modifications were made to the RETAP stepparent process to comply with the class 

action court ruling on Special Notice Options (SNO) for the Blind or Visually Impaired 

as follows:

The developer creates a second (intermediate) file. This file will get information 

from the SNO database for the records selected in the first file. It has 381 bytes. 

Data in positions 282 through 381 contain information needed for SNO and Spanish 

language notice processing. The layout follows: 

 Record Program Field Foot 

 Location Field Name Mnemonic Size Note 

 1-11 Account Number CAN 11 B 

 (includes dashes (-) 

 12-13 Beneficiary 

 Identification Code BIC 2 C 

 14-145 Beneficiary Name & PNA 132 D 

 Address (6 lines of 

up to 22 characters

each) 

 146-150 5-digit Zip Code ZIP 5 E 

 151-154 Zip +4 +4 4 F 

 155-157 Zip Point Delivery

Code ZDPC 3 G 

 158-171 Barcode Representation 14 H 

 (*999999999999* or spaces) 

 172-183 District Office (DO) 

 Phone 12 I 

(Format: XXX-XXX-XXXX) 

 

 184-205 DO Address Line 1 22 J 

 206-227 DO Address Line 2 22 K 

 228-249 DO Address Line 3 22 L 

 250-269 DO City 20 M 

 270-271 DO State 2 N 

 272-281 DO Zip Code 10 O 

 (XXXXX-XXXX) 

 282 SNO CODE 1

 283 SNO Priority Code 1
 284-298 Beneficiary or Rep Payee’s 15

 phone number

 299-313 DECEMBER 31, 20 15

 314-315 Current Year 2

 316-378 Filler 63 

 379 Payment Center no-Office Code 1

 380-381 Language indicator 2
Below is the record layout for the preceding file, which will be known as the 

intermediate file. 

 INTERMEDIATE-FILE-DOCUMENTATION 1 381 381

5 STEP-CAN-AREA XXX 1 1 3 3

5 STEP-DASH1 X 2 4 4 1

5 STEP-CAN-GROUP XX 3 5 6 2

5 STEP-DASH2 X 4 7 7 1

5 STEP-CAN-SERIAL X(4) 5 8 11 4

5 STEP-BIC XX 6 12 13 2

5 STEP-PNAS GROUP 7 14 145 132

 10 STEP-PNA1 X(22) 8 14 35 22

 10 STEP-PNA2 X(22) 9 36 57 22

 10 STEP-PNA3 X(22) 10 58 79 22

 10 STEP-PNA4 X(22) 11 80 101 22

 10 STEP-PNA5 X(22) 12 102 123 22

 10 STEP-PNA6 X(22) 13 124 145 22

5 STEP-ZIP5 X(5) 14 146 150 5

5 STEP-ZIP4 X(4) 15 151 154 4

5 STEP-ZDPC XXX 16 155 157 3

5 STEP-BARCODE X(14) 17 158 171 14

5 STEP-DOCPHONE GROUP 18 172 183 12

 10 STEP-DOC XXX 19 172 174 3

 10 STEP-DOC-FIL X(9) 20 175 183 9

5 STEP-DOC-ADD1 X(22) 21 184 205 22

5 STEP-DOC-ADD2 X(22) 22 206 227 22

5 STEP-DOC-ADD3 X(22) 23 228 249 22

5 STEP-DOC-ADD4 X(22) 24 250 271 22

5 STEP-DOC-ZIP X(10) 25 272 281 10

5 STEP-SNO-DATA GROUP 26 282 381 100

 10 STEP-SNO-CODE X 27 282 282 1

 10 STEP-SNO-PRIORITY X 28 283 283 1

 10 STEP-BTN-RPN-PHONE-NUMBER X(15) 29 284 298 15

 10 STEP-FILLER X(59) 30 299 357 59

 10 STEP-COUNTERS GROUP 31 358 369 12

 15 STEP-SNO0 X 32 358 358 1

 15 STEP-SNO1 X 33 359 359 1

 15 STEP-SNO2 X 34 360 360 1

 15 STEP-SNO3 X 35 361 361 1

 15 STEP-SNO4 X 36 362 362 1

 15 STEP-SNO5 X 37 363 363 1

 15 STEP-SNO6 X 38 364 364 1

 15 STEP-SNO7 X 39 365 365 1

 15 STEP-SNO8 X 40 366 366 1

 15 STEP-SNO9 X 41 367 367 1

 15 STEP-SNOOTHER X 42 368 368 1

 15 STEP-TOT X 43 369 369 1

 10 STEP-RPN-NUMBER X(9) 44 370 378 9

 10 STEP-OC X 45 379 379 1

 10 STEP-MBR-LANG-RIC XX 46 380 381 2

The OC and the language indicators are on this file to help the developer sort the 

notices. The OC will also alert WBD what payment center will make the telephone calls 

for the SNO code 2 records.
The office code is used to indicate which Program Service Center has the jurisdiction 

over the Claim Account Number. The Program Service Center will make the phone call. 

The STEP-MBR-LANG-RIC indicates whether the notice is English, Spanish or Foreign. AA 

is for English, BB is for Spanish and CC is for Foreign. 

Files:

Create files as follows: 

NOTE: For file transmission purposes, the current print mail vendor, NPC, is known as 

NPI, and the current SNO Vendor, NTIS, is known as NTI.

Files for the print mail vendor:

• Foreign -- if M-FRGNPAY-SW=Y, there is a foreign address. Production file name 

is:

OLBG.BTI.NPCNPI.CSTP.FOR.RYYMMDD

• Spanish -- if BIC "A" has Spanish language code (LANG = "S") and M-FRGN-SW is 

blank. Production file name is:

OLBG.BTI.NPCNPI.CSTP.SPA.RYYMMDD 

• English -- if not Foreign or Spanish above, for English. Production file name 

is:

OLBG.BTI.NPCNPI.CSTP.ENG.RYYMMDD

• Foreign -- if M-FRGNPAY-SW=Y, there is a foreign address and SNO code equal to 1 

(certified mail). Production file name is:

OLBG.BTI.NPCNPI.CSTP.FORC.RYYMMDD

• Spanish -- if BIC "A" has Spanish language code (LANG = "S") and M-FRGN-SW is 

blank and SNO code equal to 1 (certified mail). Production file name is:

OLBG.BTI.NPCNPI.CSTP.SPAC.RYYMMDD 

• English -- if not Foreign or Spanish above, for English and SNO code equal to 1 

(certified mail). Production file name is: OLBG.BTI.NPCNPI.CSTP.ENGC.RYYMMDD
Files for the SNO vendor(s)

• Foreign -- if M-FRGNPAY-SW=Y, there is a foreign address and SNO code is equal 

to 3 or 4 or 6 or 7. Production file name is:

OLBG.BTI.NTI.SNORSPRD.CSTP253F.RYYMMDD

• Spanish -- if BIC "A" has Spanish language code (LANG = "S") and M-FRGN-SW is 

blank and SNO code is equal to 3 or 4 or 6 or 7. Production file name is:

OLBG.BTI.NTI.SNORSPRD.CSTP253S.RYYMMDD

• English -- if not Foreign or Spanish above, for English and SNO code is equal to 

3 or 4 or 6 or 7. Production file name is:

OLBG.BTI.NTI.SNORSPRD.CSTP253E.RYYMMDD

• Foreign -- if M-FRGNPAY-SW=Y, there is a foreign address and SNO code is equal 

to 2 (follow-up telephone contact). Production file name is:

OLBG.BTI.WBD.SNORSPRD.CSTP253F.RYYMMDD

• Spanish -- if BIC "A" has Spanish language code (LANG = "S") and M-FRGN-SW is 

blank and SNO code is equal to 2 (follow-up telephone contact). Production file 

name is:

OLBG.BTI.WBD.SNORSPRD.CSTP253S.RYYMMDD

• English -- if not Foreign or Spanish above, for English 2 and SNO code is equal 

to 2 (follow-up telephone contact). Production file name is:

OLBG.BTI.WBD.SNORSPRD.CSTP253E.RYYMMDD

NOTE: SNO code ‘5’ is equal to ‘Other’ and is currently not in use.

Sorting:

Sort all files as follows:

1. Foreign -- if M-FRGNPAY-SW=Y, there is a foreign address. If foreign, sort file 

by ZIP Code (will be in Consular Office Code order) in ascending order. APO/FPO 

addresses will be in this file.

2. Spanish -- if BIC "A" has Spanish language code (LANG = "S") and M-FRGN-SW is 

blank, sort files by ZIP +4 (9-digit ZIP code) in ascending order.

3. English -- if not Foreign or Spanish above, sort files by ZIP +4 (9-digit ZIP 

code) in ascending order. 
SNO EXTRACTION

A call is made to the SNO database. Each CAN in the SNO database has a SNO 

indicator that designates what Special Notice Option applies. If the SNO 

indicator is ‘0’, it means that no Special Notice Option is on file and a 

regular notice is sent. If the SNO indicator is a ‘1’, a ‘1’ is moved to space 

282 of the stepparent record (see Record Specification at the end of this 

document). A ‘1’ in this space indicates the notice is sent, via certified 

mail, to the address listed for the CAN on the stepparent notice record. If 

the SNO indicator on the SNO data base is a ‘2’, a ‘2’ will be moved to the 

step parent record. A ‘2’ in this space indicates that the notice will be 

sent, via first class mail, to the address listed for the CAN on the stepparent 

notice record. In addition, a phone call will be made. For the 2011 mailing, 

the servicing program service center will handle the phone call. The phone 

call will be made after the beneficiaries have been identified. A file that 

identifies the beneficiaries who need to be called will be sent by the 

developer. This file will contain the same information as the file that is 

sent to the vendor. The Wilkes-Barre DOC has built CSNO, which is a repository 

for telephone contacts. Notices which require a phone call are separated by PC 

Codes. The PC will make the phone call. There is a space on the Record 

Specification for the beneficiary’s phone number. This phone number is the one 

that is on the SNO data base. A ‘3’in the SNO indicator field will be moved to 

space 282. A ‘3’ means that a Braille notice must be sent to the address for 

the beneficiary. A ‘4’ in the SNO indicator will be moved to space 282. A ‘4’ 

means that a data CD must be sent to the beneficiary. Other values for Space 

282 are ‘5’ for other that is currently not in use, ‘6’ for audio CD and ‘7’ 

for large print notice. 

The print mail vendor who handles the regular stepparent notices will get the 

files with the SNO indicator of ‘1’. SNO indicator of 1 records will be 

further sorted into three files—one for SNO ‘1’ English, one for SNO ‘1’ 

Spanish, and one for SNO ‘1’ Foreign

The SNO vendor will get the SNO indicators of ‘2’. The PC code on the file

will identify the Servicing PC for Wilkes-Barre DOC, who will store the notices 

requiring phone contacts. The SNO vendor will get the SNO indicators of ‘3’ 

and ‘4’, as well as those of ‘6’ and ‘7’. 

For each record identified and selected: 

If Rep Payee Data exists on the Post MBR 

(REPD-IND = ‘Y’) 

and a Rep Payee exists (RPNI = ‘1’ and TOP ≠ ‘A’)

and a RPN exists, access the SNO database

using the RPN

else if Rep Payee Data exists on Post MBR 

(REPD-IND = ‘Y’) 

and a Rep Payee exists (RPNI = ‘1’ and TOP ≠ A’)
and a RPN does not exist, do not access the 

SNO database and generate a record on the Regular Notice file 

else if Rep Payee Data exists on the Post MBR 

(REPD-IND = ‘Y’)

and Rep Payee Data exists (RPNI = ‘1’ and TOP = ‘A’)

access the SNO database using the CAN/BIC or BOAN of the beneficiary

else if Rep Payee Data exists on the Post MBR 

(REPD-IND = ‘Y’)

and a Rep Payee does not exist (RPNI ≠ ‘1’),

do not access the SNO database and generate a record on the Regular Notice file 

else if Rep Payee Data does not exist on the Post MBR 

(REPD-IND ≠ ‘Y’), access the SNO database 

using the CAN/BIC or BOAN of the beneficiary. 

If a match is found on the SNO database and the 

SNO Code equals ‘1’ generate a record on the Certified Notice file 

else if a match is found on the SNO database and the

SNO Code equals (‘3’ or ‘4’ or ‘6’ or ‘7’) move the SNO Code to the SNO 

Indicator, generate a record on the SNO Notice file and generate a duplicate 

record, without the SNO Code, on the Regular Notice file 

else if a match is found on the SNO database and 

the SNO Code equals ‘2’ 

move the SNO Phone Number to the Telephone Contact, generate a record on the 

Blind Notice file and generate a duplicate record, without the Telephone 

Contact, on the Regular Notice file 

else if a match is not found on the SNO database 

generate a record on the Regular Notice file If the SNO Code equals ‘2’, use 

the domestic phone number. If the domestic phone number doesn’t exist use the 

foreign phone number else move spaces to the Telephone Contact. 
 DOORS Match Operation: 

 This operation will use the domestic and Spanish language stepchild

 files from RETAP as input. 

 If domestic or Spanish, the district office phone number and address

 must be obtained from the DOORS database.

 Exceptions to the DOORS match will be handled by creating a listing 

 titled "Exception List - Stepparent" in the following format: 

 "EXCEPTION LIST - STEPPARENT" 

 SSN PNA 

 Perform the match as follows: 

1. If the district office code (DOC) = blanks, do not access the

 DOORS data base and do NOT build a notice record. Add

 beneficiary (BIC "A") account number and PNA of the record to

 "Exception List - Stepparent". 

 2. If the DOC = last 3 positions of the DOC on the DOORS data base: 

a. If district office phone number is present, move this phone

 number to the stepchild record (DO Phone - positions 172-

 183). 

b. If district office phone number is not present, move spaces 

 to the stepchild record (DO Phone -positions 172-183). 

 

 c. If the office physical location is present, move this

 address to the Stepchild record (DO Address Information 

 positions 184-281). 

 d. If the office physical location is not present, move blanks 

to the Stepchild record (DO address information positions

184-281). 

e. If the DOC not = last 3 positions of DOC on DOORS data

base, do not build a notice record. Add beneficiary (BIC "A") account number and PNA 

of record to "Exception List - Stepparent" 
Special Instructions: 

• Produce yearly test files by the last day of November. No test files 

are sent to the SNO vendor unless a change is made to the intermediate 

file. Notify Stephen McGill, ORSIS, MPB, extension 6-3709, for review of 

the test files prior to transmission.

Test file names: OLBG.BTI.NPC.SNORSTST.CSTP253E.RYYMMDD-English

 OLBG.BTI.NPC.SNORSTST.CSTP253S.RYYMMDD-Spanish

OLBG.BTI.NPC.SNORSTST.CSTP253F.RYYMMDD-Foreign

 OLBG.BTI.NPC.SNORSTST.CSTP25EC.RYYMMDD-English Certified 

Mail

OLBG.BTI.NPC.SNORSTST.CSTP25ES.RYYMMDD-Spanish

 Certified Mail

OLBG.BTI.NPC.SNORSTST.CSTP25EF.RYYMMDD-Foreign

 Certified Mail

• Production files are transmitted to the vendors yearly upon completion 

of the December RETAP selection run. Notices must be mailed by December 

31st. 

• Provide ORSIS, MPB with the total number of record counts selected by 

each category (i.e. Domestic, Spanish and Foreign) and SNO Code. 

C. INPUTS 

 Current MBR File 

 DOORS Database 

 SNO Database

D. OUTPUTS 

• Files - see ‘Sorting’

• Exception List - See DOORS Match Operation.

• Test Files in November, and

• Production files in December

E. Service Level Requirements

 N/A 

F. Security and Privacy Requirements

 N/A 
G. Vendor Notice Validation Strategy 

 

To validate the RETAP files created for the stepparent process, test files are 

produced every year in November. The analyst will review the files. After file 

validation, the analyst will notify the developer to transmit the files to the regular 

print mail vendor. Files for the SNO vendor are transmitted only if a change was made 

to the SNO record layout.

NOTE: We are not validating the RETAP process. IVEN is not used. 

The regular print mail vendor will produce printout of notice records (100 records to 

include English, Spanish and Foreign records, if available). 

Produce TRIDE/DOORS Exception Listing

 

 

Data Review 

 Validation listing will be reviewed by OITPBS, DT2MA, T2EMD,

Stephen McGill, extension 6-3422. 

 

 Size 

Validation files- 100 records for each version, if available.

Production files- Full selections of set criteria.
H. Production Reports

Report

A report, similar to the one shown below for the 2012 mailing, is sent to all contacts 

upon completion of the production stepparent notice run in December of each year. If 

records are shown in one of the SNO Code 3, 4, 6, or 7 buckets, the SNO code 

applicable for each record should also be listed. 

12/21/12 STEP PARENT 

VENDOR COUNTS 

 NPC ENGLISH (SNO CODE 0 2 3 4 5 6 7) 612 

 NPC SPANISH (SNO CODE 0 2 3 4 5 6 7) 23 

 NPC FOREIGN (SNO CODE 0 2 3 4 5 6 7) 3 

 NPC ENGLISH CERTIFIED (SNO CODE 1) 0 

 NPC SPANISH CERTIFIED (SNO CODE 1) 0 

 NPC FOREIGN CERTIFIED (SNO CODE 1) 0 

 NTI ENGLISH (SNO CODE 3 4 6 7) 

 BRAILLE, DATA CD, AUDIO CD, 

 LARGE PRINT 1* 

 NTI SPANISH (SNO CODE 3 4 6 7) 

 BRAILLE, DATA CD, AUDIO CD, 

 LARGE PRINT 0 

 NTI FOREIGN (SNO CODE 3 4 6 7) 

 BRAILLE, DATA CD, AUDIO CD, 

 LARGE PRINT 0 

WBD (SNO CODE 2) 

 FIRST CLASS MAIL WITH CALL 0

* 1 - LARGE PRINT 

 
 

 Record Specification 

 ANNUAL NOTIFICATION OF STEPPARENTS 

 Record Length = 381 Block Size = 29,786 

 Record Program Field Foot 

 Location Field Name Mnemonic Size Note 

 1-11 Account Number CAN 11 B 

 (includes dashes (-) 

 12-13 Beneficiary 

 Identification Code BIC 2 C 

 14-145 Beneficiary Name & PNA 132 D 

 Address (6 lines of 

up to 22 characters each) 

 146-150 5-digit Zip Code ZIP 5 E 

 151-154 Zip +4 +4 4 F 

 155-157 Zip Point Delivery Code ZDPC 3 G 

 158-171 Barcode Representation 14 H 

 (*999999999999* or spaces) 

 172-183 District Office (DO) 

 Phone 12 I 

(Format: XXX-XXX-XXXX) 

 

 184-205 DO Address Line 1 22 J 

 206-227 DO Address Line 2 22 K 

 228-249 DO Address Line 3 22 L 

 250-269 DO City 20 M 

 270-271 DO State 2 N 

 272-281 DO Zip Code 10 O 

 (XXXXX-XXXX) 

282 SNO indicator- 1,2,3,4,6 or 7 1 P

 

283 Priority Code 1 

284-298 Beneficiary’s or Rep Payee’s 15 Q 

Phone number from SNO database

 299-313 DECEMBER 31, 20 15 R

 314-315 Current Year 2 S
 316-378 Filler 63 T

 379 Payment Center no-Office Code 1 U

 380-381 Language indicator 2 V
Here is the record layout for this file.

FILE-TO-NTIS 1 381 381

5 STEP-CAN-AREA XXX 1 1 3 3

5 STEP-DASH1 X 2 4 4 1

5 STEP-CAN-GROUP XX 3 5 6 2

5 STEP-DASH2 X 4 7 7 1

5 STEP-CAN-SERIAL X(4) 5 8 11 4

5 STEP-BIC XX 6 12 13 2

5 STEP-PNAS GROUP 7 14 145 132

 10 STEP-PNA1 X(22) 8 14 35 22

 10 STEP-PNA2 X(22) 9 36 57 22

 10 STEP-PNA3 X(22) 10 58 79 22

 10 STEP-PNA4 X(22) 11 80 101 22

 10 STEP-PNA5 X(22) 12 102 123 22

 10 STEP-PNA6 X(22) 13 124 145 22

5 STEP-ZIP5 X(5) 14 146 150 5

5 STEP-ZIP4 X(4) 15 151 154 4

5 STEP-ZDPC XXX 16 155 157 3

5 STEP-BARCODE X(14) 17 158 171 14

5 STEP-DOCPHONE GROUP 18 172 183 12

 10 STEP-DOC XXX 19 172 174 3

 10 STEP-DOC-FIL X(9) 20 175 183 9

5 STEP-DOC-ADD1 X(22) 21 184 205 22

5 STEP-DOC-ADD2 X(22) 22 206 227 22

5 STEP-DOC-ADD3 X(22) 23 228 249 22

5 STEP-DOC-ADD4 X(22) 24 250 271 22

5 STEP-DOC-ZIP X(10) 25 272 281 10

5 STEP-SNO-DATA GROUP 26 282 381 100

 10 STEP-SNO-CODE X 27 282 282 1

 10 STEP-SNO-PRIORITY X 28 283 283 1

 10 STEP-BTN-RPN-PHONE-NUMBER

 X(15) 29 284 298 15

 10 STEP-FILLER X(83) 30 299 381 83

 Foot Notes/Field Definitions: 

 A. Date/Fecha 

 The vendor will need to put the date on all the Notices, for the last 

 business day of the calendar year. 

 NOTE: The notices will all be dated for December -- The

 Spanish translation for December is "Diciembre". 

 B. Account Number 

 Account number of beneficiary 

 The record will show hyphens (-) normally associated with this data. 

 

 C. BIC 

 Beneficiary Identification Code (may be 1 or 2 positions)

D. Beneficiary Name and Address (6 lines of address of up to 22
 characters each) 

 This is taken from PNA1-PNA6 on the MBR for PIC A. Ensure that spaces 

right fill records with less than 6 PNAs. 

 E. 5-Digit Zip Code 

 This is the 5-digit Zip Code associated with the address. 

 (Foreign -- if first 2 positions of Zip Code are spaces, make the

 whole Zip code spaces) 

 F. Zip +4 

 This is the +4 add-on that is associated with the Zip code. 

 Note: All records may not have a +4. If there is no +4, move spaces

 to this field. 

 G. Zip Point Delivery Code 

 This is the Zip Point Delivery Code. 

 (NOTE: This will not be shown on the notice -- it is part of the

 barcode). If there is no Zip Point Delivery Code, put spaces. 

 H. Barcode Representation 

 The POSTNET barcode representation will be produced on the record in 

 the following format: 

 

 (*999999999999*) 

1. Where the barcode font starts.....(*)

2. The actual 12 digits of the Zip Code Data (i.e., the 5-digit Zip 

(positions 146-150), the +4 (positions 151-154) and the Zip Point Delivery Code 

(positions 155-157)) 

 3. Where the barcode font stops.....(*)

 4. If only 5 or 9-digit Zip, do not print barcode. 

 NOTE: This will always be underneath the last line of the address and 

 will only be on domestic and Spanish notices. The vendor will be 

 responsible for converting the numerics into a barcode suitable for

 mailing. 

 I. District Office Telephone Number 

 The record will display the hyphens (-) normally associated with this 

 data (i.e., XXX-XXX-XXXX). The district office phone number will always be 

present on domestic and Spanish notices. 

NOTE: The District Office Address, City, State and Zip Code will appear on all 

Domestic and Spanish notices. 

 J. First Line of District Office Address 

 K. Second Line of District Office Address
 L. Third Line of District Office Address 

 J, K, L = the address of the physical location of the district office

 extracted from the DOORS data base. Initialize this field to blanks

 before accessing the DOORS data base. 

 M. District Office City 

 The city of the district office extracted from the DOORS data base. 

 Initialize this field to blanks before accessing the DOORS data base. 

 N. District Office State 

 The State of the district office extracted from the DOORS data base. 

 Initialize this field to blanks before accessing the DOORS data base. 

 O. District Office Zip Code 

 XXXXX-XXXX (Zip Code +4) 

 The record shows hyphens normally associated with this data. 

 The ZIP Code and +4 of the district office extracted from the DOORS 

 data base. Initialize this field to blanks before accessing the DOORS 

 data base. 

NOTE: The DO Zip code may not have a Zip +4. If there is no +4 for the DO, show 

spaces.

 P. SNO indicator –‘1’ indicates certified mail, ‘2’ indicates telephone 

contact, ‘3’ indicates a Braille notice will be sent, along with a first class 

print notice. A ‘4’ indicates a Data CD will be sent, along with a first class 

print notice. A ‘6’ indicates an audio CD, and a ‘7’ indicates a large print 

notice. 

Q. Beneficiary’s telephone number-phone number from the SNO database. If 

there is a Representative Payee on the SNO database, the telephone number must 

be that of the Rep Payee. If no Rep Payee, the telephone number is the 

beneficiary’s phone number as given on the SNO database. The telephone number 

on the SNO database is preferred over the one on the MBR because the SNO 

database is more current than the MBR. 

The files are sorted by zip codes. The SNO vendor gets the English, Spanish 

and the foreign files for SNO Codes 2-7. The print mail vendor gets the 

English, Spanish and Foreign files for SNO Codes 0 (no SNO code) and 1 

(certified mail). There is no provision for Certified Mail in the foreign 

file. The print mail vendor will send them by registered mail.

The SNO vendor gets the English, Spanish and Foreign files for SNO Codes 3, 4, 

6, and 7.
Fee Adjustment 

A. Background

Authorized Organizational representatives are permitted to charge a fee for services. The 

amount charged is limited to 10% of the beneficiaries’ payment amount, but no more than 

$??* for no DA/A involvement and $??* for DA/A involvement. 

 The COLA is due annually in December , and although some will be Non-COLA years, all 

parties must be notified of the potential increase in the fee to be collected.

 Notices of an increase in fee or no increase need to be sent to the Representative 

Payee and the Beneficiary/Recipient. The number of beneficiary letters sent will depend 

upon the COLA.

* The exact amount of the fee will not be known until the amount of the COLA is announced 

annually in October. (See fee table – last page, for current amounts).

B. Processing

1. Representative Payee notice:

From the RPS database RP record, select the RPs who have an:

• RPIDQ = 9 numeric and alpha O, and

• ORGFEEAPVL = Y and

• NO date in the ORGFEESTP

• NO date in the ORGZNSTPDT

2. Beneficiary notice:

For each Representative Payee selected in step 1,

• select each Beneficiary/Recipient that is linked to the RP record with 

an R3 record or a pending decision type 98 in the R2 record.

 For each R2/R3 record selected, 

• compare against the MBR/SSR to verify that the current entitlement 

status is "in pay" on the MBR/SSR.

 What is in pay?

o For T2: LAF = [C/D]

o For T16: PSY = [C01]
For each record that meets the above criteria, 

• we will check the MBR/SSR for the DA&A code

For - T2 select MBR = DIB DATA LINE - last iteration, DAA field, Codes 

{X/Y/Z]

For - T16 select SSR = CMPH LINE and the last iteration of the DA&A field, D 

field (DRUG-M), Codes [X/Y/Z]

For multiple entitlements, finding the indicator on any entitlement will count as 

one DA&A record.

Annotate the records found with the DA&A codes [X/Y/Z].

3. Beneficiary SNO Notice:

For each bene record, read SNO database to determine if there is a SNO 

code.

• If SNO code = 1 - a separate file is sent to the regular print Vendor. 

o For this SNO code, the record is not written to the regular file, 

only the certified file. The name indicates that it is to be mailed 

certified instead of first class.

 

For all other SNO codes, a record is written to the regular file and another 

record is written to the NTIS file or the WBDOC file

 

• If SNO code = 2 – Write to regular file and write to WBDOC file

• If SNO code = 3, 4, 6 or 7 – Write to regular file and write to NTIS file in 

exact layout as the regular file.

C. Output

Output files will be produced according to record specifications .
1. Representative Payee Notice:

• The information for the payee name and address (#1-6) and Zip code 

on Attachment 2 will be obtained from the RP record and will consist 

of:

o RPMLGD

o RPMADDR

o RPMCITY

o RPMSTATE

o RPMZIP5

Note: Exact fees are unknown until the annual COLA figures are released each year in October. 

The new fee amounts will be parmed into the program. 

 2. Beneficiary Notice:

• The information for the beneficiary name and address (#1-6) and Zip 

code Attachment 1 will be obtained from the R2 and R3 records and 

will consist of:

o BCFNAM

o BCLNAM

o BCSFFX

If the name fields together exceed 22 bytes, build the name backwards; i.e., last 

name,

then as many letters of the first name as possible.

For the BN address, use the BCLCTNIDQ from the R1 to 

access the RP record and pull:

o RPMADDR

o RPMCITY

o RPMSTATE

o RPMZIP5

The notice fill-ins will consist of:

Fill in #1 - BICID
Fill in #2 - (DAA max/min amount)

To determine the DA&A maximum/minimum amount, use the codes from the 

MBR/SSR: 

[X/Y/Z] fill in = ??*

All other codes or low values (blanks),

fill in = ??*

*Note = Exact fill-in is unknown until the COLA figures are released annually in October.

 
Attachment 1

RECORD SPECIFICATIONS -- BENEFICIARY NOTICE (Form SSA-L251-SM)

Record Field Foot

Location Field Name Size A/N/C Note

01 - 11 SSN 11 N/C (1)

12 - 33 Bene Name and Address 1 22 A/N/C

34 - 55 Bene Name and Address 2 22 A/N/C

56 - 77 Bene Name and Address 3 22 A/N/C

78 - 99 Bene Name and Address 4 22 A/N/C

100 - 121 Bene Name and Address 5 22 A/N/C

122 - 143 Bene Name and Address 6 22 A/N/C

144 - 148 Zip code 5 N (2)

149 - 150 Fill-in #1-Fee amount 2 N

151 SNO Code 1 N

152 SNO Priority Code 1 A

153-154 T2 – T16 2 

155-156 Regional Office Number 2 A (3)

[A] = ALPHA

[N] = NUMERIC

[C] = CHARACTER

(1) Includes Hyphens

(2) This is a two position dollar amount used for fill-in.

(3) Used to determine which signature block to use on the notice.
Social Security Administration 

Important Information 

Date: December 1, (Current Year)

 SSN (1-11)

 

(12-33)

(34-55)

(56-77)

(78-99)

(100-121)

(122-143)(144-148)

We are writing to let you know about a change in the fee your representative payee may 

collect for serving as your representative payee.

Amount of Fee

Beginning December YYYY, your representative payee may collect a fee of up to 10 percent of 

your total monthly benefits, but no more than $XX.00 each month.

This increase should be taken from the payment received in January YYYY.

If you Have Any Questions

If you have any questions, you may call us toll-free at 1-800-772-1213. We can answer most 

questions over the phone. You may also write or visit any Social Security office. Written 

inquiries may be sent to:

PO Box 17746

Baltimore, MD 21235-7746
If you do call or visit an office, please have this letter with you. It will help to answer your 

questions.

 Signature Block 

 (See attached table)

 

 Form SSA-L251-SM (11-2008)

 

 Form SSA-L251-SM (11-2008)

 Form SSA-L251-SM (11-2008)

Attachment 2

RECORD SPECIFICATIONS -- REPRESENTATIVE PAYEE NOTICE

 (Form SSA-L252-SM)

Record Field Foot

Location Field Name Size A/N/C Note

01 - 22 Payee Name and Address 1 22 A/N/C

23 - 44 Payee Name and Address 2 22 A/N/C

45 - 66 Payee Name and Address 3 22 A/N/C

67 - 88 Payee Name and Address 4 22 A/N/C

89 - 110 Payee Name and Address 5 22 A/N/C

111 - 132 Payee Name and Address 6 22 A/N/C

133 - 137 Zip Code 5 N

138 - 139 Region Code 2 N 

NOTE: $($$) amounts on this letter will be set amounts supplied to the Vendor as soon as they are known.

[A] = ALPHA

[N] = NUMERIC

[C] = CHARACTER
 
Social Security Administration 

Important Information 

Date: December 1, (Current Year)

(1-22)

(23-44)

(45-66)

(67-88)

(89-110)

(111-132)(133-137)

We are writing to let you know about a change in the fee your may collect for serving as a 

representative payee for Social Security and Supplemental Security Income beneficiaries.

Amount of Fee

Beginning December YYYY, you may collect a fee of up to 10 percent of the total monthly 

benefits from beneficiaries entitled to disability benefits who have a drug addiction and/or 

alcoholism condition. The maximum amount that you can collect is $ per month.

This increase should be taken from the payment you receive in January YYYY.

In all other cases, you may collect a fee of up to 10 percent of the total monthly benefits, up to 

a maximum amount of $ XX.00 per month.

If You Have Any Questions

If you have any questions, you may call us toll-free at 1-800-772-1213, or you may call your 

local Social Security office. We can answer most questions over the phone. You may also 

write or visit any Social Security office. If you do call or visit an office, please have this letter 

with you. It will help us answer your questions.

Signature Block

 (See attached table) 
 Form SSA-L252-SM (11-2008)

Attachment 3

RECORD SPECIFICATIONS -- WBDOC CSNO EMAIL 

Record Field Foot

Location Field Name Size A/N/C Note

01 - 09 SSN 9 N 

10 - 11 BIC 2 A/N

12 - 33 Name (1st line of Address) 22 A/N/C (1)

34 - 55 Bene Name and Address 2 22 A/N/C

56 - 77 Bene Name and Address 3 22 A/N/C

78 – 99 Bene Name and Address 4 22 A/N/C

100 - 121 Bene Name and Address 5 22 A/N/C

122 - 143 Bene Name and Address6 22 A/N/C 

144 - 148 Zip Code 5 A

149 SNO Code 1 N

150 SNO Priority Code (S) 1 A

151 - 152 T2 – T16 (‘02’ or ‘16’) 2 A

153 - 154 Regional Office Code 2 A (2)

155 - 157 SNO-Telephone Area Code 3 N

158 - 160 SNO-Telephone Exchange 3 N

161 - 164 SNO-Telephone Number 4 N

165 - 169 SNO-Telephone Extension 5 N

170 - 186 Spoken Language Preference 17 A

187 Sex 1 A

188 - 190 ROC-ACR 3 A

191 - 193 Servicing Field Office Code 3 N (3)

194 - 197 Form Type (‘L251’) 4 A

198 - 207 System ID 10 A

208 - 209 Fill-In: Fee Amount 2 N (4)

210- 220 Filler 11 A 

 
[A] = ALPHA

[N] = NUMERIC

[C] = CHARACTER

(1) Beneficiary First Name, 1st line of address.

(2) Use to determine which signature block to use on the notice.

(3) This is the field office initially assigned to make the phone call.

(4) Two position dollar amount used as the fill-in.
Social Security Administration

Important Information

(12-33) Date: December 1, (current year)

(34-55) SSN/Claim Number: (1-9) 

(56-77)

(78-99)

(100-121)

(122-143) (144-148) 

We are writing to let you know about a change in the fee your representative payee may collect for 

serving as your representative payee. 

Amount of Fee

Beginning December YYYY, your representative payee may collect a fee of up to 10 percent of your 

total monthly benefits, but no more than $XX.00 each month.

This increase should be taken from the payment received in January YYYY.

If You Have Any Questions

If you have any questions, you may call us toll-free at 1-800-772-1213. We can answer most questions 

over the phone. You may also write or visit any Social Security office. Written inquiries may be sent 

to:

PO Box 17746

Baltimore, MD 21235-7746

If you do call or visit an office, please have this letter with you. It will help us answer your questions.

SIGNATURE BLOCK

(See attached table)

Form SSA-L251-SM (11-2008)
PC Code Notice Signature Block 

1 Social Security Administration 

2 Social Security Administration 

3 Social Security Administration 

4 Social Security Administration 

5 Social Security Administration 

6 Social Security Administration 

7 or 8 Social Security Administration 
The fee should be the lesser of 10% of the monthly benefit amount (MBA).
EXHIBIT S
YOUR LETTERHEAD 

DATE: 

TO: Business Mailer Support 

RE: USPS Minimum Volume Reduction Program 

To Whom It May Concern: 

I am writing to request approval to use USPS Minimum Volume Reduction Program as shown in 

Publication 401 - Guide to the Manifest Mailing System. The exception is for the “200 piece or 

50 pound” rule for permit imprint mailings (including certified and foreign mail). 

If approved, we would submit the paperwork electronically and include piece level barcode 

information. 

A large portion of our business is government mailings and the use of this exception would 

greatly expedite our mail processing. 

Please let me know if any additional information is required. My contact information is below. 

Thank you for your time and consideration. 

NAME AND PHONE NUMBER OF YOUR CONTACT 
EXHIBIT T
Account Name Meter Serial Number Job ID 1 Operator Transaction Start Time

####### SSA Mailer # 

and File Date

Grand Total

SSA Contract Program # 
Transaction End Time Date Location Meter Model Class of Mail
Pieces Postage Fee Amount Surcharge Total Charged
EXHIBIT U
TODAY'S

DATE METER DATE

WORKLOAD MAILER NUMBER /

NAME

SSA PRINT ORDER # /

CONTRACTOR ORDER #

FILE

DATE

BEGINNING

METER BALANCE

AMOUNT

METER REPLENISH‐

MENT AMOUNT (if

applicable) METER RATE

CERT. BULK

MAILING

CHARGES

applicable)

TOTAL

NUMBER OF

PIECES

METERED

SPOILED

POSTAGE /

POSTAGE

ERRORS

(actual cost)

TOTALMETER

POSTAGE

USED

ENDING

METER

BALANCEAMOUNT

SSA POSTAGE METER ACTIVITY LOG

METER MANUFACTURER:METER SERIAL NUMBER:

CONTRACT NUMBER: