030ADV25R0017 - Attachment J-3 - Sample Order.pdf

Solicitation 030ADV25R0017 – J-3

STATEMENT OF WORK – SAMPLE ORDER

C.1 - Background:

The Library’s Office of the Chief Information Officer (OCIO) is dedicated to delivering secure, reliable, scalable, and seamlessly integrated technology solutions that enable successful operations across the Library while empowering the maximum use of the Library’s content and services.

In September 2020, OCIO completed a Data Center Transformation (DCT) effort — a three-year initiative to completely re-envision the Library’s IT infrastructure. The effort transitioned Library

IT from an outdated primary data center to a state-of-the-art hybrid hosting environment that leverages the cloud, a new Tier III data center outside of the Washington D.C. metro area, and legacy Library data centers, as well as Software-as-a-Service (SaaS) and Platforms-as-a-Service

(PaaS). A high-speed, high-bandwidth fiber loop was also implemented to more securely connect all the Library’s facilities.

With all Library technology activities centrally coordinated through OCIO, proper governance and oversight from the Library’s executive leadership ensures that IT operations and planning are aligned to meet the mission and goals established in the LC Strategic Plan, Digital Strategy, and service unit Directional Plans.

Although the Library is not covered by the Clinger-Cohen Act of 1996, 40 U.S.C. 1401, et seq., the

E-Government Act of 2002, Pub. L. 107-347 (Dec. 17, 2002), or Office of Management and Budget

Circulars relating to IT management, the Library recognizes the benefits and impact of centralized control and agency-wide coordination of planning, selection, funding, oversight, and evaluation of

IT resources and investments and adopts government and industry practices and policies that assist in accomplishing the Library’s goals.

The Library is not subject to the Federal Information Security Management Act (FISMA) or its amendments. See 44 U.S.C. 3502 (defining “agency” as including executive departments and establishments of the executive branch). However, the Library adopts National Institute of

Standards and Technology (NIST) guidance, such as NIST Special Publication 800-34, as revised, and industry best practices as stated in this regulation.

C.2 Scope:

The contractor shall independently perform an assessment of the Library’s cyber security controls and identify the optimal maturity levels that achieve cost-effective information security based on mission and risks faced, risk appetite, and risk tolerance.

C.3 - Requirements

Contractor shall assess the effectiveness of the Library of Congress’ (Library) information security program on a maturity model spectrum, in which the foundational levels ensure that the agency develops sounds policies and procedures and determine the extent that the Library has institutionalized those policies and procedures. Contractor shall define and asses specific metrics using five maturity model levels: ad hoc, defined, consistently implemented, managed and measurable, and optimized. Contractor shall independently perform an assessment and identify the optimal maturity levels that achieve cost-effective information security based on mission and risks faced, risk appetite, and risk tolerance in the following key metrics:

Metric Reference Examples OIG Notes

To what extent has the organization implemented the following security controls to protect its sensitive data, as appropriate, throughout the data lifecycle.

• Encryption of data at rest

• Encryption of data in transit

• Limitation of transfer to removable media

• Sanitization of digital media prior to disposal or reuse

NIST SP 800-53 REV. 4; SC-8, SC-28,

MP-3, and MP-6; NIST SP 800-37 (Rev.

2); FY 2021 CIO FISMA Metrics: 2.8, 2.12; DHS BOD 18-02; CSF PR.DS-1, PR.DS-2, PR.PT-2, and PR.IP-6

For data at rest/in-transit:

Base on an enumeration of the Library’s system inventory.

To what extent has the organization implemented security controls to prevent data exfiltration and enhance network defenses?

NIST SP 800-53 REV.

4: SI-3, SI-7(8), SI-4(4) and (18), SC-

7(10), and SC-18; FY 2021 CIO FISMA

Metrics: 3.8; CSF: PR.DS-5

To what extent has the organization developed and implemented a Data Breach

Response Plan, as appropriate, to respond to privacy events?

NIST SP 800-122; NIST SP 800-53

REV. 4: Appendix J, SE-2; FY 2020

SAOP FISMA metrics, Section 12;

OMB M-17-12; and OMB M-17-25

To what extent does the organization perform information system backup and storage, including use of alternate storage and processing sites, as appropriate?

NIST SP 800-53 REV. 4: CP-6, CP-7,

CP8, and CP-9; NIST SP 800-34: 3.4.1, 3.4.2, 3.4.3; FCD-1; NIST CSF: PR.IP-4;

FY 2021 CIO FISMA Metrics, Section

5; and NARA guidance on information systems security records

The contractor shall conclude on the current maturity level being achieved by the Library in each key area. Contractor’s evaluation shall be conducted using federally recognized methods or best practices even though the Library may not have a legal requirement for specific practices.

Contractor’s evaluation should utilize a mode-based scoring approach to assess the Library’s maturity levels. Deficiencies in implementing controls should be identified as issues and/or findings during the course of the review and documented as Notification of Findings and Recommendations when appropriate.

The Library’s key information risks and the relevant controls, best practices, and metrics to ensure information security within the areas of:

1. Identification of high-value assets,

2. Data encryption for data at rest and in-transit,

3. Sanitization of media.

4. Detective and preventive controls for data exfiltration and enhanced network defenses,

5. Data Breach response plans and readiness

6. System backups and storage locations

C.4 Other Requirements

C.4.1 - Preliminary Planning Meeting

(a) Prior to the meeting’s occurrence, contractor shall provide to the Contracting Officer’s Representative

(COR) the following documentation: on-boarding forms, resumes, declarations of independence, non-disclosure agreements, conflict of interest statements, and non-employee information forms.

(b) Contractor shall submit other onboarding documents, as needed, to the COR for review and approval.

All contractor’s engagement personnel must have attained clearance from the Library’s Personnel

Security Division (PSD) to attend the Preliminary Planning Meeting.

(c) Conduct a Preliminary Planning Meeting with OIG management and COR to:

(i) discuss contractual requirements,

(ii) review issues affecting the engagement, and discuss planning objectives, timelines, and logistical matters.

C.4.2 - Evaluation Plan

Contractor shall prepare and submit a detailed evaluation plan to the COR for review and approval following the Preliminary Planning Meeting. The plan must identify the standards, policies, regulations, etc. to serve as criteria; the methodological approach to conducting the engagement; and the schedule for completing the evaluation, including milestones and due dates for the steps that address the requirements in this Statement of Work. The plan must be cross-referenced to the working papers as steps are completed.

The evaluation must include three phases: planning (development of the evaluation plan), fieldwork (to include testing and interviewing), and reporting

C.4.3 - Entrance Conference

As requested by the COR, contractor shall conduct an entrance conference with the OIG and Library management to introduce the evaluation team and establish stakeholders; provide an overview of the evaluation objectives; explain the scope of the evaluation; discuss the planned evaluation approach; and present the initial prepared-by-client list to management. The entrance conference shall include a discussion regarding the anticipated timing of the work, how management prefers to communicate with the contractor, and whether there are any issues that may impact the evaluation going forward.

C.4.4 - Progress Reports and Status Update Meetings

Contractor shall complete progress reports and status update meetings on a weekly basis in coordination with the COR to document progress. The COR may adjust the meeting frequency, if deemed necessary.

The format of the progress reports shall serve as the agenda for the Status Update Meetings, which shall include the following:

(i) the time and date of the meeting,

(ii) an update on work performed since the last status meeting,

(iii) progress against milestones and deliverables,

(iv) outstanding documentation requests/potential delays,

(v) a listing of current or potential findings,

(vi) planned work to be completed by the next status meeting,

(vii) upcoming milestones, and

(viii) a list of assigned staff and planned absences (e.g., vacation leave).

On a limited basis, contractor shall conduct other status update meetings with OIG (and potentially

Library management) to discuss the status of the engagement, as requested by the COR. The agenda for these meetings will be the same elements as outlined above for the status update meetings.

C.4.5 - Mid-Fieldwork Meeting

Contractor shall conduct a mid-fieldwork meeting with Library and OIG management to discuss the status of the engagement, including the engagement’s preliminary findings, potential obstacles to completing the engagement, and other issues of concern.

C.4.6 - Draft and Final Notice of Findings and Recommendations (NFRs)

Contractor shall prepare NFRs describing the condition, cause, effect, criteria, and recommended actions to remediate. Contractor shall complete draft and final NFRs and submit to the COR for review and comment during fieldwork and prior to the delivery of the draft report to the OIG. The NFRs shall be fully indexed to the evaluation documentation (i.e., workpapers).

The contractor shall:

(i) review and incorporate OIG edits/comments on draft NFRs,

(ii) resubmit updated draft NFRs to the OIG COR for review and approval, and

(iii) submit final draft NFRs to the OIG COR for distribution to the Library for review and comment.

Contractor shall complete Final NFRs and submit them to the COR within 10 business days after draft

NFRs have been accepted by the COR, which will be after all OIG and Library comments have been addressed to the extent appropriate.

C.4.7 - Exit Conference and Draft Report

Contractor shall conduct an exit Conference with OIG and Library management within 10 business days after final NFRs have been completed and submitted to the OIG COR.

Contractor shall complete and submit a draft report, fully indexed to workpapers, to the COR for review and comment. The COR will provide the contractor with edits/comments for the contractor to incorporate into the draft report. The contractor shall review and incorporate the edits/comments and resubmit the draft report to the COR. Once approved by the COR, the draft report will be distributed to the Library by the COR for review and comment. The Library is provided 15 business days to provide official written comments on the draft report.

The Draft and Final Report must at a minimum include the following:

(i) Executive Summary – Highlight the major problems found and recommendations that address the specific problems.

(ii) Background – Provide pertinent information needed to understand the subject matter being evaluated.

(iii) Findings and Recommendations - Describe each major vulnerability found using the standard elements of a finding (i.e., criteria, condition, cause, and effect) and make recommendations to address the underlying cause. These findings and recommendations will have been previously presented and accepted by management stakeholders in NFRs.

(iv) Objectives, Scope, and Methodology– Describe the objectives, scope, and all testing methodology used in the evaluation.

C.4.8 - Final Report and Evaluation Documentation

Within 10 business days of receipt of the Library’s official comments on the draft report, contractor shall incorporate the comments, if agreeable (as determined in coordination with the COR), into a final report and submit it to the COR for review, approval, and distribution. Contractor shall submit final, reviewed workpapers to the COR with the final report.

All written products provided by the contractor shall be of professional quality in terms of technical content and quality of writing. If a written product in a draft or final version is not technically correct or professionally written, the COR will return it to the contractor for correction.

Contractor shall provide the COR with access to the contractor’s workpapers on an on-going basis to facilitate the understanding of the contractor’s review and observations.

All final workpapers shall be provided in electronic format. The documentation must include an index for ease in review and retrieval of information. Electronic files should be created using Microsoft Office products, Acrobat-PDF, or other application as appropriate and mutually agreed to by the parties. The files shall not be created using any software that requires the OIG to download the software and/or obtain a software license that the OIG does not have already.

C.5 - CONTRACT PERFORMANCE

C.5.1 General Performance Requirements

All individuals assigned to work on the engagement will be required to submit clearance request documents. The COR will facilitate the review process with the PSD. Individuals will not be approved to work on the engagement until PSD has granted clearance.

During the planning phase, the contractor must provide documents to include, but not limited to, resumes, Library security mandatory training completion certification (up to two hours), clearance forms, independence statements, and continuing professional education records.

The contractor must perform quality assurance reviews on all deliverables to the OIG prior to submission.

The contractor must make available to the COR their most recent documentation of peer reviews and quality control program compliance.

C.6 - Schedule of Events/Deliverables

The contractor shall provide electronic copies of all deliverables to COR in a format editable and readable by OIG. Once created, all deliverables and work products of the contract (including but not limited to all software documentation, reports, records, summaries and other matters and materials prepared or developed by the contractor in performance of this contract) are considered the property of the

Government, free from any claim or retention of right on the part of the contractor, its agents, sub-consultants, officers or employees and is subject to attorney/client privilege.

The deliverables shall be considered final upon receiving Government approval. The Government shall provide written notification of acceptance or rejection of all deliverables, apart from invoicing, within five business days of receipt. All notifications of rejection will be accompanied with an explanation of the specific deficiencies causing the rejection. Items must be approved by the COR to be considered

"accepted."

C.7 - Quality Control

The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this contract. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is how it assures itself that its work complies with the requirement of the contract.

C.8 - Key Personnel

Refer to section C.4 in solicitation 030ADV25R0017 for qualification of Key Personnel. Contractor shall identify Key Personnel assigned to the engagement. The personnel specified as Key Personnel are considered essential to the work being performed under this contract. The following staff members are identified as Key Personnel:

i. IT Engagement Partner/Quality Review Partner

C.9 - Government furnished property

Contractor will be required to use their own equipment and supplies. The contractor will not be reimbursed for any material used for the performance of this requirement.

C.10 - Organizational or Individual Agreement for Utilizing Library IT Systems or Processing

Library Information Using a Foreign System

When using their own systems in the performance of this contract, contractor shall ensure that all Library of Congress (“LOC” or “Library”) information (“information”) is protected from unauthorized use and mishandling. Information includes both hard copy (paper) and soft copy (electronically stored). A signed agreement with specific compliance measures will be signed to enable this and may be provided on request prior to the contractor submitting a proposal.

C.11 - Contractor Travel

Travel is not authorized for this requirement. Costs for transportation, lodging, meals or incidental expenses incurred by the contractor will not be reimbursed or authorized under this agreement.

F.1 – Deliverables Schedule

Deliverable Date [Note: The guidance below is for initial planning purposes. The Contractor will establish fixed dates.]

C.4.1 – On-Boarding Documentation

No later than (NLT) 5 business days after the period of performance start date and prior to the preliminary planning meeting, deliver on-boarding documentation as described to the OIG COR for review and approval to attain Library security clearances for individuals to start work.

NLT 5 business days after the start date

C.4.1 – Conduct a Preliminary Planning Meeting. All attendees must have attained clearance from the Library’s Personnel Security

Division.

NLT 15 business days after the period of performance start date

C.4.2 – Deliver Evaluation Plan to the COR for review and approval.

NLT 15 business days after the

Preliminary Planning Meeting.

C.4.3 – Conduct an Entrance Conference. NLT 20 business days after the

Preliminary Planning Meeting.

C.4.4 – Complete Progress Reports and Status Update Meetings with the COR.

Meetings conducted weekly or as needed

C.4.5 – Conduct a Mid-Fieldwork Meeting and other Status Update

Meetings with OIG and/or Library management.

NLT 45 business days after the

Entrance Conference

C.4.6 – Submit Draft NFRs fully indexed to the workpapers. NLT 90 business days after the

Entrance Conference

Note: The OIG COR will distribute Draft NFRs to the

Library.

C.4.6 – Submit Final NFRs fully indexed to workpapers. NLT 10 business days after

Draft NFRs have been accepted by the OIG COR

C.4.7 – Conduct an Exit Conference. NLT 10 business days after

Final NFRs have been completed and submitted to the

OIG COR.

C.4.7 – Complete and submit an INITIAL Draft Report, fully indexed to workpapers, to the OIG COR for review and comment.

Allow 10 business days for OIG comments.

NLT 15 business days after

Final NFRs have been completed and submitted to the

OIG COR

C.4.7 – Complete and submit a FINAL Draft Report, fully indexed to workpapers, to the OIG COR for delivery to Library Management for comments.

Allow 15 business days for

Library comments.

C.4.8 – Complete and submit the Final Report incorporating any necessary changes resulting from Library Management review, fully indexed to final workpapers, to the OIG COR.

NLT 10 business prior to the end of the Period of

Performance.

F.2 - Period and Place of Performance: The contractor should commence the engagement no later than

10/09/2024 and complete it by 08/09/2025