<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
	  <concept id="SRAESDHY"
            audience="GSAR"
            ditaarch:DITAArchVersion="1.3"
            class="- topic/topic concept/concept ">
		    <title xtrc="GSAR" class="- topic/title ">
			      <ph props="autonumber" class="- topic/ph ">539.7001</ph> Policy.</title>
		    <conbody class="- topic/body  concept/conbody ">
			      <ol id="d682e13" class="- topic/ol ">
				        <li class="- topic/li " audience="GSAR">
					          <p id="d676e17" class="- topic/p " audience="GSAR">
                  <ph props="autonumber" class="- topic/ph ">(a)</ph>
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
						             GSA must provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Section 3544(a)(1)(A)(ii) of the Federal Information Security Management Act (FISMA) describes Federal agency security responsibilities as including “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.”</p>
				        </li>
				        <li class="- topic/li " audience="GSAR">
					          <p id="d676e26" class="- topic/p " audience="GSAR">
                  <ph props="autonumber" class="- topic/ph ">(b)</ph>
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
						             Employees responsible for or procuring information technology supplies, services and systems shall possess the appropriate security clearance associated with the level of security classification related to the acquisition. They include, but are not limited to contracting officers, contract specialists, project/program managers, and contracting officer representatives.</p>
				        </li>
				        <li class="- topic/li " audience="GSAR">
					          <p id="d676e35" class="- topic/p " audience="GSAR">
                  <ph props="autonumber" class="- topic/ph ">(c)</ph>
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
						             Contracting activities shall coordinate with requiring activities and program officials to ensure that the solicitation documents include the appropriate information security requirements. The information security requirements must be sufficiently detailed to enable service providers to fully understand the information security regulations, mandates, and requirements that they will be subject to under the contract or task order.</p>
				        </li>
				        <li class="- topic/li " audience="GSAR">
					          <p id="d676e44" class="- topic/p " audience="GSAR">
                  <ph props="autonumber" class="- topic/ph ">(d)</ph>
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
						             GSA’s Office of the Senior Agency Information Security Officer issued CIO IT Security Procedural Guide 09-48, “Security Language for Information Technology Acquisitions Efforts,” to provide IT security standards, policies and reporting requirements that shall be inserted in all solicitations and contracts or task orders where an information system is contractor owned and operated on behalf of the Federal Government. The guide can be accessed at <xref href="http://www.gsa.gov/portal/category/25690"
                        format="html"
                        scope="external"
                        class="- topic/xref ">http://www.gsa.gov/portal/category/25690</xref>
						            <xref href="http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3"
                        format="html"
                        scope="external"
                        class="- topic/xref ">.</xref>
					          </p>
				        </li>
			      </ol>
		    </conbody>
	  </concept>
</dita>
