-This Memorandum of Agreement ("Agreement") is entered into by the General Services Administration, Office of Technology Policy (“OTP”), within the Office of Governmentwide Policy located at 1800 F Street, NW Washington, DC 20405 and the [name of the commercial SSP vendor ("Entity") located at [SSP vendor address], as of the date of OTP’s signature to this Agreement with a term of three years. The OTP and Entity will collectively be referred to as "Party" or the "Parties."
-
-
-
- - Definitions.
-
-
- - Federal Public Key Infrastructure ("FPKI" or " Federal PKl") is an implementation of a set of PKI policies, processes, and information technology systems that provide the U.S. Government with a common baseline to administer certificates and public-private key pairs. Federal PKI is one of several trust frameworks supporting federated trust of government devices and persons used by the U.S. Federal Government.
- - Federal Public Key Infrastructure Policy Authority ("FPKIPA" or " Policy Authority") is the federal trust framework governance body for a set of PKI systems and associated certificates used for federated trust across and between federal agencies and with entities that are not a U.S. Federal Government agency for mission delivery purposes. The Policy Authority is a group of representatives from U.S. Federal Government agencies (including cabinet-level departments) established pursuant to a charter under the Federal CIO council. It manages the policies governing the FPKI trust framework and approves or denies entities for certification into the trust framework.
- - Shared Service Provider (“SSP”) An Entity that adheres to the FPKI set of policies and processes, as well as GSA requirements to provide digital certificate services to federal agencies.
- - Shared Service Program (“SSP Program”)is a GSA program that provides technical support for the FPKI. Specifically, it supports the governmentwide implementation of HSPD-12 and the FICAM Initiative. It is recognized as robust secure PKI services that provide agencies with the capability to implement secure logical and physical access to federal resources through outsourced shared PKI services. By cross-certification, the shared PKI infrastructure is a part of the FPKI’s information technology systems governed by the FPKI. GSA has established a Special Item Number (SIN) 541519PKI that identifies these PKI services that contract holders offer governmentwide.
-
-
-
-
- Purpose. The purpose of this Agreement is to agree on the terms and conditions on which the Entity will participate in the SSP Program. The Office of Technology Policy (OTP) manages the SSP Program with managing partners from the following GSA offices:
-
-
- - Office of Chief Information Security Officer (“OCISO”)
- - Federal Acquisition Service, Office of Information Technology Category (“ITC”)
- - Office of Government-wide Policy, Office of Technology Policy (OTP)
-
-
-
- Specifically, the OCISO manages the security posture of the Entity’s information technology systems and the ITC makes the Entity’s shared PKI services available for purchase through a GSA contract vehicle. External to but in concert with GSA, the FPKIPA governs the certificate policies, requirements, and practices for the shared PKI services. This Agreement sets forth the respective responsibilities and obligations of the Parties.
- Authority. The basis of this Agreement and the subsequent inclusion of the Entity into the SSP Program aligns with the *Federal Information Security Modernization Act of 2014 (FISMA), GSA’s IT Security Procedural Guide: Managing Enterprise Cybersecurity Risk CIO-IT Security-06-30 GSA Security Policy, the Federal Acquisition Regulation*, the federal PKI certificate policies, and the Entity certificate policy or practices listed in the Entity’s MOA with the FPKIPA. It also complements the *SSP Operations Handbook*.
- Roles and Responsibilities of the Parties.
-
-
- - The OTP will do the following:
-
-
- - Serve as the GSA senior official to grant the Entity’s information technology system authorization to operate.
- - Determine program direction based on Federal Government need.
- - Ensure through the OCISO and ITC proper performance and delivery of PKI shared services.
- - Develop and manage operational processes to effectively deliver the shared PKI services.
- - Represent SSP and SSP Program interests in the FPKIPA.
- - Report quarterly on security posture to the FPKIPA and customer agencies.
- - Coordinate service improvement and feedback from customer agencies to SSP.
- - Collaborate with GSA managing partners to operate and maintain effective, secure, and reliable PKI services.
-
-
-
- - The OCISO will do the following:
-
-
- - Serve as the GSA senior official to recommend the Entity’s information technology system for authorization to operate (ATO).
- - Monitor and report on the Entity’s information technology system security posture.
- - Provide quarterly security reports to the Authorizing Official.
- - Collaborate with the OTP on security management concerns to operate and maintain an effective, secure, and reliable PKI shared service.
-
-
-
- - The ITC will do the following:
-
-
- - Own and manage SIN 541519PKI for the SSP Program on the GSA Multiple Award Schedule (MAS).
- - Review the Entity’s MAS Information Technology Package for a contract determination.
- - Collaborate with OTP and the ITC contract team to make the Entity’s PKI shared service available to purchase.
- - Collaborate with the OTP on contract management concerns to deliver effective, secure, and reliable PKI shared service.
- - Issue and revoke certificates to approved SSPs
-
-
-
- - The Entity will do the following:
-
-
- - Comply with all laws, ordinances, and regulations (Federal, State, or Local) covering work in the SSP Program.
- - Comply with the FPKI policies to the include the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework (FCPF), hereafter referenced as COMMON and its complementary documents:
-
-
- - Change proposals
- - Key Recovery Policy
- - U.S. Federal Certificate Profiles: X.509 Certificate and Certificate Revocation List (CRL) Extensions Profile for the Shared Service Providers (SSP) Program
- - Memorandum of Agreements (MOAs) established between the FPKIPA and Entity.
-
-
-
- - Obtain an Authorization to Operate (ATO) declaration through GSA’s formal program for information security management before rendering PKI services.
- - Ensure adequate resources to maintain an ATO and comply with binding operational directives, and GSA requirements for protecting GSA IT resources. This includes addressing critical gaps (e.g., multifactor authentication, database encryption, no outdated software, high and critical findings, etc.) in the timeframe specified in GSA guidance.
- - Ensure any certificates, associated certificates, and public key pairs issued to the federal agencies will be owned by the government.
- - Use the SSP Operations Handbook as the program’s established guidelines while complying with regulations and GSA expectations.
- - Prepare for and facilitate monthly Security Dashboard and Plan of Action and Milestones meetings.
- - Attend and/or participate in monthly program, security, and contract meetings to exchange information or provide feedback on proposed changes to the program.
-
-
-
-
-
- Third Parties. This Agreement is binding only upon the Parties, by and through their officials, agents, employees, and successors. Entity may not assign its rights or delegate its duties or obligations under this Agreement without prior written consent from OTP. No person or entity is intended to be a third-party beneficiary of the provisions of this Agreement for purposes of any civil, criminal, or administrative action, and accordingly, no third person or entity may assert any claim or right as a beneficiary or protected class under this Agreement in any civil, criminal, or administrative action.
- This Agreement does not authorize, nor shall it be construed to authorize, or add to any systems, documents or other technology, persons or entities not a Party to this Agreement nor intended to have authorization under this Agreement.
- Entity Change. If Entity anticipates changes or has changed due to a merger, acquisition, bankruptcy, or other means that modifies the Entity ownership or security boundary, then Entity shall:
-
-
- - Provide written notification to OTP about the intent to change the business relationship in a timely manner not to disrupt any PKI services.
- - Provide a transition plan that includes all activities from transferring a PKI solution to resolution of impacts on end users and the delivery environment. The depth of a transition plan should be appropriate for the type of transition and the criticality of the PKI components going through transition. At minimum, the activities in the transition plan must be compliant with the COMMON and address the following:
-
-
-
-
-
- - The coordination and scheduling of transferring system archives, system inventory and
- configuration data, certificate profiles, key recovery databases (if applicable), private
- keys, key shares, audit records, hardware security modules, certificate and certificate
- revocation list (CRL) databases, and all policy and security documents applicable to the
- operations of the PKI solution.
-
- - The estimated costs for terminating, transferring, selling, or disposing a PKI
- solution must be shared if direct or indirect expenses are transferred to the new approved
- SSP and/or the impacted customer agency.
-
- - The continued services for all certificates, certificate revocation, and status
- checking until the expiration of the longest-lived certificate or transference of the
- control for the DNS Names in URLs for these services.
-
- - The continued support to collect and review system audit logs for the PKI solution.
- - The continued support required to obtain and provide annual PKI compliance audits until revocation of all issued certificates or the expiration of the longest-lived issue certificate.
-
-
- Compliance with Laws, Regulations and Policies. Entity agrees to comply with all applicable policies listed in Appendix A.
- The following is applicable if Entity is not a U.S. Federal Government agency: Entity shall comply with applicable U.S. Federal laws and regulations including but not limited to trade compliance, economic and trade sanctions, and blocked, denied, and debarred persons lists. If the Entity is not in compliance with these applicable laws and regulations, OTP reserves the right to change or remove the Entity's participation in the SSP Program in the interest of national security.
- Updates: The OCISO and OTP are responsible for the maintenance and update of the *IT Security Procedural Guide: Managing Enterprise Cybersecurity Risk CIO-IT Security-06-30 GSA Security Policy and SSP Operations Handbook*respectively.
- Entity shall review the document updates each time they are updated and implement the necessary changes to practices to comply.
- MOA Updates and Evolving Security Requirements. This MOA may be updated only by mutual written agreement signed by an authorized representative of each party.
- Notwithstanding the foregoing, due to the nature of evolving national security threats and updates to technology and security, the Parties shall work in good faith to implement required updates to applicable laws, regulations, and policies through the following steps:
-
-
- - OTP, OCISO, or ITC will provide the Entity with written notice of the required updates, the number of days in which the updates must be implemented, and an updated version of Attachment A that incorporates the changes. The updated version of Attachment A will automatically replace the previous version of Attachment A and be deemed incorporated into this Agreement without further actions.
- - Upon notification, the Entity shall have three (3) business days to confirm via written response whether it will be implementing the changes.
- - If the Entity declines to implement the requirements, the OTP, ITC, and OCISO may decide to terminate this agreement, revoke ATO status, notify customer agencies of the situation, or take any such other action necessary to maintain the delivery of secure PKI services.
-
-
- Confidentiality. If Entity is not a U.S. Federal Government agency, the following applies:
-
-
- - Entity assumes full responsibility for and guarantees the security and confidentiality of all documents, data, and other information supplied or gleaned from the customer agency, Federal PKI, and provided, obtained, or accessed through being a party to this Agreement ("Confidential Information").
- - Entity will prevent disclosure of this Confidential Information to any person not authorized by the U.S. Federal Government or Policy Authority to have access to such documents or information.
-
-
- Liability. Neither Party shall be liable to the other for any loss, liability, damage or expense (including attorney fees) arising out of the operation of the PKI services. This Agreement is entered into for the convenience of the Parties and shall not give rise to any cause of action by Entity or by any third party.
Conflict Resolution. If Entity is a private sector entity, the Contract Disputes Act, 41 U.S.C. 7101 et seq, is applicable to all disputes under this Agreement.
Governing Law. This Agreement is governed by the laws of the United States.
- Termination. If Entity is not in compliance with this Agreement or applicable security or technical requirements, the OTP shall notify the Entity and may unilaterally suspend participation in the SSP Program. The OTP shall provide the Entity an opportunity to cure the issues and regain its participation if there is a government business need as determined at the sole discretion of OTP. If the Entity does not cure within six months, OTP may terminate this Agreement in entirety. Either party may terminate this Agreement for convenience at its sole discretion with 30 days prior written notice.
- The Entity must provide a transition plan as described in Section 6 if termination is decided.
- This MOA is valid for one year from the last date in the signature section.
- System Disruption. If there is a material issue in the operability of the PKI service in accordance with the documents in Section 3 that will have a substantial adverse effect on a customer’s operations, OTP, the customer agency, OCISO, and Entity will determine a planned resolution within 10 days.
-
- Entity will promptly notify the OTP:
-
- - In the event of any material problem or inability to operate Entity's certification authorities in accordance with the documents in Section 3.
- - If the Entity becomes aware of a material noncompliance on the part of any other party that the Entity has formed an agreement with to use Entity's certification authorities covered by this agreement.
- - If the Entity becomes aware of a material noncompliance on the part of supporting vendors that the Entity has formed an agreement covered by this agreement.
-
-
- If the issue is a security incident, the Entity must comply with GSA’s Incident-Response-[CIO-IT-Security-01-02-Rev-19] and report incident to the OTP and OCISO, as well as submit an incident report for follow-on reporting to the Cybersecurity Infrastructure Security Agency (CISA), the Office of Inspector General (OIG), and the United States Congress, as applicable.
- Signatures:
-
-
- Name: Laura Stanton
- Title: Assistant Commissioner
- Organization: Federal Acquisition Service
- Office: Office of Information Technology Category (ITC)
- Date:
-
-
-
- Name: Dan Pomeroy
- Title: Deputy Associate Administrator
- Organization: Office of Governmentwide Policy
- Office: Office of Technology Policy (OTP)
- Date:
-
-
-
- Name: Bo Berlas
- Title: Chief Information Security Officer
- Organization: Office of the Chief Information Officer
- Office: Office of Chief Information Security
- Date:
-
-
-
-
diff --git a/_university/pacs101.md b/_university/pacs101.md
index 80ad1377a..f737e6b0e 100644
--- a/_university/pacs101.md
+++ b/_university/pacs101.md
@@ -51,7 +51,7 @@ The following table defines common PACS components:
| **Component** | **Description** |
|----------------|----------|
| **Access point** | Entrance point or physical barrier where an employee or contractor interacts with the PACS. Example access points include turnstiles, gates, and locking doors. |
-| **PIV credential** | Federal employees and contractors use [Personal Identity Verification (PIV) credentials]({{site.baseurl}}/arch/services/#physical-features){:target="_blank"}{:rel="noopener noreferrer"} to *physically access* federal facilities and *logically access* federal information systems. |
+| **PIV credential** | Federal employees and contractors use [Personal Identity Verification (PIV) credentials]({{site.baseurl}}/fips201ep/#personal-identity-verification-credentials){:target="_blank"}{:rel="noopener noreferrer"} to *physically access* federal facilities and *logically access* federal information systems. |
| **Credential reader and keypad** | The reader provides power to and reads data from a PIV credential. The reader also sends this data to a control panel to authenticate the PIV credential and request access authorization. Employees and contractors may need to enter a PIN into the keypad and add a biometric, depending on the facility's security classification and risk levels. |
| **Biometric reader** | Captures biometric data (for example, fingerprint or iris scan) and verifies it against the PIV credential's biometric data. |
| **Control panel** | Receives the credential data sent by the reader and verifies its presence in the credential holder data repository. It then makes an access decision and transmits authorization data to the access control server and access point. |
@@ -235,7 +235,7 @@ The table below gives the possible authentication mechanisms for the three (3) s
Visit the [PKI 101]({{site.baseurl}}/university/piv/) to learn more about certificate trust.
-{% include alert-info.html content="A good starting point that will help you understand Physical Access Control System procurements is GSA’s