DOJ BOP - Information Security and Compliance Support Service - MRAS

The Department of Justice (DOJ), through the General Services Administration (GSA), is conducting market research to support the Federal Bureau of Prisons' Information Technology & Data Division (ITDD). The primary goal of this initiative is to enhance information security and compliance across various systems. This effort aligns with broader federal objectives under the Federal Information Security Modernization Act (FISMA) and leverages the Risk Management Framework (RMF) as outlined by the National Institute of Standards and Technology (NIST). The RMF provides a structured methodology to integrate risk management into the System Development Lifecycle, ensuring that information security measures are effectively implemented and maintained.

The work requested involves comprehensive support services in information security and compliance. This includes preparing for and categorizing information systems, selecting and tailoring security controls, implementing these controls, assessing their effectiveness, authorizing systems for operation, and continuously monitoring security measures. Each phase consists of multiple subtasks designed to ensure thoroughness in execution. For instance, during system categorization, tasks include describing information systems accurately, determining their categorization based on risk levels, and reviewing these categorizations for accuracy.

Further tasks involve selecting appropriate security and privacy controls tailored to specific system needs. This includes documenting control implementations and establishing continuous monitoring plans to ensure ongoing compliance. Additionally, there are requirements for developing authorization packages that include risk analysis and response strategies. These efforts culminate in making informed authorization decisions regarding system operations.

Moreover, ongoing tasks are required to monitor changes in security environments continuously. This involves updating authorization packages as needed based on new assessments or changes in risk posture. Other essential services include managing interconnection agreements between systems, developing incident response plans, conducting updated risk assessments regularly, ensuring configuration management protocols are followed, preparing privacy impact analyses where applicable, and providing monthly status reports on all activities related to information security compliance.