Attachment 3-DOI IT Baseline Compliance Contract Guidelines

United States Department of the Interior

OFFICE OF THE SECRETARY

Washington, DC 20240
August 15, 2022
Memorandum
To:
From:

Heads of the Contracting Activity
Associate Chief Information Officers

Digitally signed by DEBORAH

DEBORAH HARTLEY HARTLEY

Deborah (June) Hartley
Acting Chief Information Officer
Office of the Chief Information Officer

Date: 2022.08.15 14:24:58 -06'00'

Digitally signed by MEGAN

MEGAN OLSEN OLSEN

Date: 2022.08.15 16:14:39 -04'00'

Megan Olsen
Director, Office of Acquisition and Property Management and Senior Procurement Executive
Subject:

Information Technology Baseline Compliance Contract Guidelines

Purpose
This memorandum transmits the mandatory Department of the Interior (DOI, Department) Information Technology (IT) Baseline Compliance Contract Guidelines necessary to ensure that information security controls are implemented and operating effectively in accordance with pertinent policies and procedures.
Background
Bureaus and offices rely on third parties (Contractor, its subcontractors, and Contractor employees—hereafter referred to collectively as “Contractor”) to provide certain IT services, including the operation and maintenance of IT systems, when it is deemed to be in the DOI’s best interest to outsource these services. The Office of the Chief Information Officer (OCIO) has the responsibility to oversee and manage contractors who operate information systems or provide IT services on behalf of the Department. The baseline compliance contract guidelines detail the roles and responsibilities for government oversight, monitoring, and reporting of contracted IT systems and services. The guidelines are intended to ensure contractors are performing, monitoring, and reporting required security controls in accordance with the Department’s security and contractual requirements. The guidelines align with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 requirements. Effective Date
This policy is effective from the date of signature.
Applicability
All bureaus and offices shall ensure that the DOI IT Baseline Compliance Contract Guidelines are incorporated to applicable contract actions that involve IT products and services. Policy

requirements include:
•

Information systems and system services provided to the DOI by the Contractor must comply with DOI IT Cybersecurity and Privacy Control Standards, privacy policies, and other related guidance.

•

Contractors and information system service providers shall be responsible for