03_Task Order no. 1.pdf

NCATS Cybersecurity Services Program Support

Task Order No. 1

Contract Number: 75N95020##### PRISM Task Order: 75N95020F00001

A. Task Order Title

Cybersecurity Services Program Support

B. Task Order Technical Areas

This Task Order (TO) is to provide day-to-day support services to the Cybersecurity Services Program

C. Task Order Period of Performance

September 1, 2020 – August 31, 2021

D. Contract and Task Order Numbers Designation

On all correspondence submitted under the contract, the Contractor agrees to clearly identify the parent IDIQ contract and task order numbers as follows:

Contract Number: 75N95020##### Task Order Number: 75N95020F00001

E. Task Order Price

1. The total fixed price of this task order is $TBD.

2. Upon delivery and acceptance of the services described in SECTION G, Statement of Work, of this task order, the Government shall pay to the Contractor the following fixed prices. fixed-

F. Statement of Work

See Task Order No. 1 SOW, attached.

G. Core Hours

The Contractor shall provide support Monday through Friday during normal working hours. Specific hours are at the discretion of the Contractor; however, the Contractor must provide coverage between the core hours of 9:00 a.m. through 3:00 p.m. Coverage shall be coordinated with the COR, and the COR may require Contractor presence between 7 am and 6 pm. Services under this task

Line Description of Service Quantity (Hours)

Unit Price Total ($)

0001 Program Management TBD TBD TBD 0002 Information Security and Privacy Group support TBD TBD TBD 0003 NCATS Cybersecurity Integration Center support TBD TBD TBD

Contract No. 75N95020##### Task Order No. 75N95020F00001 order will not be required on Federal holidays or when NIH is closed. The Contractor must have staff available for incident or emergency response within 1 hour at all times.

H. Contracting Officer’s Representative (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this task order:

TBD

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this task order; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this task order. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this task order; (5) otherwise change any terms and conditions of this task order; or

(6) sign written licensing agreements.

The Government may unilaterally change its COR designation.

I. Invoice Submission/Contract Financing

The Contractor shall submit invoices in accordance with the instructions contained in the NIH Invoice and Payment Provisions (2/2014), attached to this task order.

J. Attachments

Attachment 1 – SOW Attachment 2 – Invoice Instructions

Project Initiation Form

Cybersecurity

Concept Proposal and Business Case

Cybersecurity Services Division Support will provide day-to-day support for the Division in the operation and futher development of the NCATS cybersecurity program.

High Level Goals

Under the direction of the Chief, Cybersecurity Services Division:

• Establish an NCATS information security program that compliments and fills the voids of the NIH Information Security Program and other top down programs.

o Stand up the Information Security and Privacy Group (ISPG) described in the contract Statement of Work, Section 2.2.

o Stand up the NCATS Cybersecurity Integration Center (NCIC) described in the contract Statement of Work, Section 2.3

Address the following Year 1 priorities:

• Establish a program that develops metrics to measure, report and enable decision making regarding compliance, security operations and policy effectiveness which meet Government mandates.

• Establish a policy to assist NCATS system owners, stakeholders, project managers and developers to incorporate security into the System/Application Development Lifecycle and meet compliance requirements.

• Assist NCATS security and operations teams in identifying opportunities evaluating and aligning with the NIH Risk Management Framework (RMF).

• ATO compliance reviews for all systems for on the G Suite Platform.

• Develop ATO checklist for NCATS systems and applications, including readiness review of documentation and review guidelines with system owners.

• Establish NCATS specific ATO guidelines and processes.

• NCATS Cloud environment review and compliance assessment.

• Create NCATS Cloud environment security checklist.

• Establish NCATS Vulnerability assessment guidelines.

• Establish NCATS on prem and cloud vulnerability scanning and remediation guidelines as per the NIH mandates.

• Authentication and authorization review and mandate guidance to meet compliance requirements.

• Establish and document security awareness and training documentation for NCATS as needed.

• Focus on client engagement to increase security compliance awareness across NCATS staff.

• Assess NCATS security and operational tools integration capabilities and determine opportunities for improvement.

• Help NCATS assess the current state of its security landscape as per the guidance of the Cybersecurity

Framework Maturity model.

Project Title Cybersecurity Services Division Support Division ITRB POC Chief, Cybersecurity Services Division Project Type Program Support Scope of Impact NCATS Project Size Large (>26 weeks)

Project Initiation Form

Cybersecurity

• Help prioritize cybersecurity mandates such as Continuous Diagnostic Mitigation (CDM), assessment management, identity and access management, System incident and Event Management (SIEM) implementation, optimization and reporting as well as data protection and encryption.

• Establish NCATS security status report formats for the executives with relevant data.

• Assist the NCATS support teams to improve the security incident response mechanism.

• Assist NCATS in establishing automated inventory process as well as software and Hardware asset management mandated compliance guidelines and procedures.

• Help NCATS evaluate and establish Penetration testing compliance guidelines.

Estimated Level of Effort: