04_Task Order no. 2.pdf

NCATS Cybersecurity Services Program Support

Task Order No. 2

Contract Number: 75N95020##### PRISM Task Order: 75N95020F00002

A. Task Order Title

Security Controls Assessment for the General Support System

B. Task Order Technical Areas

This Task Order (TO) is to provide a security controls assessment (SCA) for the general support system (GSS).

C. Task Order Period of Performance

September 1, 2020 – August 31, 2021

D. Contract and Task Order Numbers Designation

On all correspondence submitted under the contract, the Contractor agrees to clearly identify the parent IDIQ contract and task order numbers as follows:

Contract Number: 75N95020##### Task Order Number: 75N95020F00002

E. Task Order Price

1. The total fixed price of this task order is $TBD.

2. Upon delivery and acceptance of the deliverables described in SECTION G, Statement of Work, of this task order, the Government shall pay to the Contractor the following fixed price.

F. Statement of Work

See Task Order No. 2 SOW, attached.

G. Contracting Officer’s Representative (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this task order:

TBD

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes

Line Deliverable Price 0001 Security Assessment Report $TBD 0002 Plan of Action and Milestones $TBD

Contract No. 75N95020##### Task Order No. 75N95020F00001 in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this task order; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this task order. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this task order; (5) otherwise change any terms and conditions of this task order; or

(6) sign written licensing agreements.

The Government may unilaterally change its COR designation.

H. Invoice Submission/Contract Financing

The Contractor shall submit invoices in accordance with the instructions contained in the NIH Invoice and Payment Provisions (2/2014), attached to this task order.

I. Attachments

Attachment 1 – SOW Attachment 2 – Invoice Instructions

Project Initiation Form

Cybersecurity

Concept Proposal and Business Case

Conduct a Security Controls Assessment (SCA) for NCATS’ General Support System (GSS).

High Level Goals

Task 1 – Perform Security Controls Assessment:

The contractor will conduct an SCA of the NIH NCATS GSS. The assessment will be based on the guidance associated with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4 – Security and Privacy Controls for Federal Information Systems and Organizations and the system’s security classification category based on the Federal Information Processing Standards (FIPS) Publication 199 – Standards for Security Categorization of Federal Information and Information Systems, as defined by NCATS. The SCA will include a technical security assessment of the servers, networking components, and databases as well as a review of the security management and operational processes currently in place. This technical scope for testing, defined as the NCATS SCA boundary, shall be limited to a subset of the following components that form the ‘Production’ environment boundary:

1. 100 physical servers and 180 virtual servers that support the operational function(s) of NCATS will be considered in scope for the SCA;

2. Approximately 300 scientific devices, many of which are networked – Only networked scientific devices that are accessible via the available scanning tools will be considered in scope for the SCA;

3. Approximately 500 client devices – Only those devices that are supported by and accessible via available security scanning tools will be considered in scope for the SCA;

4. Over 1100 nodes on the network, including printers, laptops, workstations, servers, scientific devices, etc. – Only those servers, scientific devices and laptops/workstations assigned to users performing administrative tasks on the IT infrastructure will be considered in scope for the SCA. All other devices shall be reviewed/assessed by the NIH technology support team; and

5. One 20-node High Performance Computing cluster – Networked components that are accessible by the available security scanning tools will be considered in scope for the SCA.

The contractor will develop a plan to assess the security controls (based on NIST 800-53A Rev4), assess the security controls based on the assessment plan, and prepare a security assessment report to include findings and recommendations from the SCA.

Project Title Cybersecurity Services Division Support Division ITRB POC Chief, Cybersecurity Services Division Project Type Program Support Scope of Impact NCATS Project Size Medium (12 - 26 weeks)

In the execution of this task, the contractor will perform interviews and request documentation in order to assess security controls selected and implemented through the NIST SP 800-37 – Guide for Applying the Risk Management Framework to Federal Information Systems, as implemented by NCATS.

Deliverable(s):

1. Security Assessment Report

Task 2 – Generate Plan of Action and Milestones (POA&Ms)

As a result of the SCA, based on the findings and recommendations in the Security Assessment Report, the contractor will support the Information System Owner (ISO) in the development of the POA&Ms. POA&Ms will be documented as grouping of findings (with references to details within vulnerability scan reports in a documented addendum).

POA&Ms shall include the tasks planned to correct any weaknesses identified in the SCA, milestones in the completion of tasks identified, and scheduled completion dates for the milestones. The contractor will coordinate with the ISO to define the resources required to accomplish the tasks.

Deliverable(s):

1. Plan of Action and Milestones

Assumptions:

1. NCATs possesses or has access to all relevant security scanning tools; further, the contractor will be allowed either (a) direct access to security tools or (b) have on demand access to an NCATs resource to facilitate running of security scans. The scanning tools that will be needed minimally include the Tenable stack and IBM AppScan.

2. In the instances additional information of end-points are required, NCATS may be required to gain access to additional security scanning tools. The types of additional tools NCATs may be required to procure are:

a. Vulnerability Scanning Tool: i.e. Tenable Security Center, IBM AppScan, Netsparker Enterprise

b. Compliance Tool: i.e. BigFix Compliance, Tenable Security Center

c. Database Scanning Tool: i.e. DBProtect

3. Key stakeholders required for interviews, clarifications, etc. are present and available when requested.

4. Both the technical phase (Security Scanning, etc.) and Functional phase (Controls assessment) will run concurrently.

5. The contractor will have access to all reference control documentation of inherited controls.

6. The contractor will not be responsible for documentation creation and / or updates other than the deliverables as defined above within Tasks 1 and 2.

7. The NCATS GSS is classified as a “Moderate” system in accordance with the Federal Information Processing Standards (FIPS) Publication 199 – Standards for Security Categorization of Federal Information and Information Systems. NCATS is responsible for the classification of the GSS.

8. The contractor will utilize NIST SP 800-53 Revision 4 security and privacy controls for testing; however, NCATS is responsible for implementation of these controls for the NCATS GSS.

9. It is ultimately the responsibility of NCATS leadership to determine NCATS alignment and adherence to the applicable Federal and NIST Regulations, the way it will proceed with designing and implementing remediation steps for any identified findings, and determining the ATO recommendation / status for the NCATS GSS.

10. The contractor will rely on information and data provided by NCATS personnel and is not requested to validate the accuracy of the data provided.

11. SCA findings should not be used to be representative of the operation of control procedures at any time other than the time of observation of these control practices in relation to the SCA. The SCA reflects control testing results at a point in time and does not take into consideration the sustainment of the control in place.

12. The contractor will rely upon the vulnerability scans performed by NCATS to perform testing of controls when applicable to the SCA.

13. For the SCA, the contractor will not perform any NCATS management functions, make NCATS management decisions, or perform in a capacity equivalent to that of an employee of NCATS.

14. The contractor will rely on NCATS Personnel (technical and operational) to validate the recommended remediation steps, the Level of Effort to remediate each POA&M, and the associated dates/milestones.

15. NCATS will ensure that the contractor team has the appropriate logical and physical access to NCATS documentation and solution components to be able to initiate SCA activities in a timely manner.

16. The contractor will not formally engage in the implementation of the mitigating controls / remediation actions in any form, or manner under this work order. The contractor will not remediate vulnerabilities identified while conducting the SCA.

17. The matters identified through the SCA will be limited to those which came to our attention during the course of this SCA and are not necessarily inclusive of every weakness that may exist or improvement that might be required in conjunction with and/or post the performance of the SCA. Recommendations for improvements should be assessed by NCATS for their full impact before they are implemented. Effective implementation of effective remediation steps by management is important for the maintenance of an effective internal control system.