Spreadsheet: 0bfa01f0-656d-433c-bdbf-d2e5e88245d9
Sheet: 3. CLINs Requested

RFQ # QTA-0-10-FK-B-0001
[NAME] Requested
CLIN# | Deliverable | Requested
Pre-C&A Review & Validation
001 | Pre-C&A documentation review and size/complexity confirmation per FIPS 199 & 200 (boundary & scope validation).  Includes review of system design documentation, security plans, and COOP/Disaster Recovery Plans.
RMF Step 1:  Categorize Information System (SOW Section 3.1)
002 | FIPS 199 Security Categorization
003 | Threat Assessment
004 | System Definition Document
005 | Information System Registration
RMF Step 2:  Select Security Controls (SOW Section 3.2)
006 | Security Control Selection Documentation
007 | Updated Security Control Selection Documentation
008 | System Security Plan
009 | Monitoring Strategy
010 | Briefing (slides and meeting support)
011 | Security Plan Approval Recommendation
RMF Step 3:  Implement Security Controls (SOW Section 3.3)
012 | Implementation Status Report
013 | Implemented Controls
014 | System Security Plan
RMF Step 4:  Assess Security Controls (SOW Section 3.4)
015 | Security Assessment Plan
016 | Rules of Engagement
017 | Securty Categorization Review
018 | System Security Plan Analysis
019 | Security Control Assessment
020 | Vulnerability Assessment
021 | Security Assessment Report
022 | Briefing (slides and meeting support)
023 | Issue Resolution Report
024 | Remediation Status Report
025 | Remediation Actions
RMF Step 5:  Authorize Information System (SOW Section 3.5)
026 | Plan of Action and Milestones
027 | Security Authorization Package
028 | Residual Risk Statement
029 | Briefing (slides and meeting support)
030 | Risk Acceptance Recommendation
031 | Briefing (slides and meeting support)
RMF Step 6:  Monitor Security Controls (SOW Section 3.6)
032 | Impact Assessment
033 | Selected Security Control Assessment
034 | Updated Security Assessment Report
035 | Updated Issue Resolution Report
036 | Updated Remediation Status Report
037 | Remediation Actions
038 | Updated System Security Plan
039 | Updated Security Assessment Report
040 | Updated Plan of Action & Milestones
041 | Daily Status Reports and Documentation
042 | Weekly Status Reports and Documentation
043 | Monthly Status Reports and Documentation
044 | Updated Residual Risk Statement
045 | Updated Risk Acceptance Recommendation
Other Security Services: Initial Risk Assessment  (SOW Section 4.1)
046 | Initial Risk Assessment Documentation
Other Security Services: Contingency Plan Documentation Development (SOW Section 4.2)
047 | Contingency Plan Documentation Development (Business Impact Analysis and Contingency Plan)
Other Security Services: [NAME] (SOW Section 4.3)
048 | [NAME] (Change Management Documentation with Risk Analysis, Security Assessment, Continuous Monitoring Test Plan, Assessment Report, Issue Resolution Report, [NAME], Plan of Action & Milestones, Updated System Security Plan)
Other Security Services: Privacy Impact Assessment (PIA) (SOW Section 4.4)
049 | Privacy Impact Assessment (PIA)  (Privacy Threshold Analysis and Privacy Impact Assessment (if applicable))
Other Security Services: E-Authentication Risk Assessment (SOW Section 4.5)
050 | E-Authentication Assessment Documentation
Other Security Services: Memorandums of Understand and Interconnection Security Agreements (SOW Section 4.6)
051 | Memorandums of Understanding and Interconnection Security Agreements
Other Security Services:  Information System Removal and Decommissioning (SOW Section 4.7)
052 | Information System Removal and Decommissioning  (Decommissioning Plan, Tracking and Management System Information, Decommissioning Security Status Report, Impact Assessment Report)
Other Security Services:  Incident Response Plan and Procedures (SOW Section 4.8)
053 | Incident Response Plan and Procedures
Other Security Services:  Updated Risk Assessment (SOW Section 4.9)
054 | Updated Risk Assessment Documentation
Other Security Services:  Briefings (SOW Section 4.10)
055 | Briefing Slides
056 | In-Person Briefing
057 | Telephone/Web Conference Briefing
 | TOTAL
Travel:  In accordance with Federal Travel Regulations
058 | Travel and ODC