Executive Order 13103, Computer Software Piracy, September 1998 This order establishes policy that each executive agency shall work diligently to prevent and combat software piracy in order to give effect to copyrights associated with computer software. Presidential Decision Directive 63: Critical Infrastructure Protection, May 1998 This directive requires that the United States take all necessary measures to swiftly eliminate any significant vulnerability to both physical and cyber attacks on critical infrastructures, including our cyber systems. Executive Order 13231, Critical Infrastructure Protection in the Information Age, October 2001 This order establishes policy that ensures protection of information systems for critical infrastructure, including emergency preparedness communications, and the physical assets that support such information systems. The following are Executive branch policies established through directives published by OMB based on the applicable laws passed by Congress. OMB Circular Description A-11, Section 53, Information Technology and E-Government This directive specifies the identification of security and privacy safeguards for managing sensitive information. A-123, Management Accountability and Control, as revised December 21, 2004 This directive specifies the policies and standards for establishing, assessing, correcting, and reporting on management controls in Federal agencies. A-127, Financial Management Systems, as revised by Transmittal Memorandum Number 3, December 1, 2004 This directive prescribes policies and standards for executive departments and agencies to follow in developing, operating, evaluating, and reporting on financial management systems. A-130, Appendix I, Federal Agency Responsibilities for Maintaining Records About Individuals This directive prescribes policy to agencies for the implementation of the Privacy Act and reporting requirements related to the management of personally identifiable information (PII). A-130, Appendix III, Security of Federal Automated Information Resources, as revised by Transmittal Memorandum Number 4, November 28, 2000 This directive stipulates that each agency shall implement a comprehensive automated information security program. The appendix establishes basic managerial and procedural controls that shall be included in Federal automated information systems. The Contractor shall also ensure conformance and compliance with, and provide services that implement and meet, the following requirements: OMB Memorandum M-05-24, Implementation of Homeland Security Presidential (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors.
Vulnerability and Security Configuration Scan Report As described in, and in accordance with, the FCHS IT Security and Privacy Requirements document. Monthly Contracting Officer’s Representative (COR), Government system owner Continuous Monitoring Report As described in, and in accordance with, the FCHS IT Security and Privacy Requirements document. Monthly Contracting Officer’s Representative (COR), Government system owner, Government Authorizing Official (AO) Independent Penetration Testing and Report As described in, and in accordance with, the FCHS IT Security and Privacy Requirements document. Annually Contracting Officer’s Representative (COR), Government system owner, Government Authorizing Official (AO) Documentation for Audit Requirements As described in, and in accordance with, the FCHS IT Security and Privacy Requirements document. 30 calendar days after written request Contracting Officer’s Representative (COR), Government system owner, Government Authorizing Official (AO) Training Compliance Report As described in, and in accordance with, the FC IT Security and Privacy Requirements document. Annually Contracting Officer’s Representative (COR), Government system owner Security Incidents As described in, and in accordance with, the FCHS IT Security and Privacy Requirements document. Per Incident (immediately but not more than 2 hours) Contracting Officer (CO), Contracting Officer’s Representative (COR), Government system owner, Government Authorizing Official (AO), Contractor Employee Report Report of all contractor employees that have access to DOI Data with status of required Annually on contract award anniversary date and within 3 business days upon written request Contracting Officer’s Representative (COR)