10. FA701424R0026_ Appendix_F_Cybersecurity_Program_Management_(Attachment 9).pdf

Attachment 9: FA701424R0026 Judge Advocate Litigation Support Services Appendix F : Cyber-Security Program Management

1.0 Cybersecurity Program Management

1.1 Cybersecurity Overview. Cybersecurity (CS) protects and defends information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities. The following paragraphs contain United States Public Law as well as Department of Defense (DoD) and Department of the Air Force (DAF) CS requirements. These CS requirements stem from DoD and Secretary of the Air Force (SECAF), policies, directives, and instructions. United States Government herein described as "Government" officials have the authority to review and examine, in conjunction with contractor personnel, the security controls on any contractor operated system containing government information for the purposes of ascertaining proper CS posture and implementation.

1.2 Cybersecurity Practices. The contractor shall adhere to DAF CS Program prescribed methodologies for the protection of information to support DAF missions. The contractor shall utilize existing methods and processes in order to deliver secure, interoperable and integrated information management (IM) and information technology (IT) to the DAF and its contract support IAW DoDI 8500.01, Cybersecurity, AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT), and AFMAN 17-1301, Computer Security

(COMPUSEC).

1.3 Risk Management Framework (RMF). The contractor shall coordinate with the appropriate government Information System Security Manager (ISSM) (formerly IAM) and Program Management Office (PMO) to determine the cybersecurity requirements for authorized use and connection of Information Technology (IT) systems that receive, process, store, display, or transmit DoD information delivered to the government.

1.3.1 Support RMF requirements as outlined in DoDI 8500.01 and AFI 17-101. This includes pre and post Authority to Operate (ATO) certification, Authority to Connect (ATC), software approval, computer audits, security scans, and upload of audit/scan reports to accreditation site.

Implement security controls required by the RMF process/AO and provide documentation and/or testing results to cognizant government agency.

1.3.2 Initiate and support reassessment/reauthorization activities no later than six (6) months prior to the expiration of a system’s ATO. Additionally, the results of annual reviews, system modifications or a major change in cybersecurity posture at any time also indicate the need for reassessment/reauthorization of a system IAW AFI 17-101.

1.3.3 Provide information to comply with Federal Information Security Modernization Act of 2014 (FISMA) and AFI 17-101 requirements as requested by the Government. IT systems shall be tested for cybersecurity requirements in accordance with the policies stated above.

1.3.4 Install the latest vulnerability definitions, signatures, and engine updates on the targeted system prior to each vulnerability scan as approved by the Government Program ISSM prior to using the approved scanning tool.

1.3.5 Provide results of the vulnerability scans to the Government as directed by the Government ISSM or PMO in the Cybersecurity Accreditation Documentation.

1.4 Contractor Cybersecurity Workforce (CSWF) Management

1.4.1 Contractor personnel performing one or more cybersecurity tasks in accordance with contract requirements and associated statement of work or performance work statement will possess and maintain in good standing the DoD approved cybersecurity baseline certification(s) in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program, Paragraph C2.3.7. Contractors will be certified no later than the first day of contract work in accordance with DoD 8570.01-M, Paragraph C2.3.9.

1.5 Contractor CSWF Management Deliverables. The contractor shall maintain and provide PM (CO/COR) designated government access for the following data:

1.5.1 Tracking and management of cybersecurity workforce personnel, ensuring personnel are certified and qualified IAW DoD 8570.01-M and AFMAN 17-1303, Cybersecurity Workforce Improvement Program.

1.5.2 Appropriate clearance or personnel security investigation for cybersecurity workforce positions IAW DoD 8570.01-M, Paragraph C1.4.4.6.4

1.5.3 Completed/signed (electronic) Privileged Access Agreements if privileged access is required, for each Information System (IS)/Platform IT (PIT) system necessary to perform assigned duties IAW DoD 8570.01-M, Paragraph C2.1.4.

1.5.4 Completed/signed statement of acceptance of assigned cybersecurity responsibilities for all personnel who access DAF IT/IS IAW 8570.01-M, C3.2.4.4, C4.2.3.6, and C10.2.3.6. An example statement can be found in AFMAN 17-1303, Attachment 6.

1.5.5 Computing Environment/Operating System training documentation can be stored digitally/electronically or in paper format but must be readily accessible for audits and/or inspections. Examples of acceptable documentation include digital/printed certificates, sanitized (i.e., all personally identifiable information, except for name of individual are redacted) copy of transcript, training records, or a memo for record annotating training completion signed by individual’s supervisor.

1.6 Contractor CSWF On-boarding

1.6.1 Contractor CSWF On-boarding. At contract start and for each new employee, contractor shall provide Contracting Officer (CO) or designated Contracting Officer Representative (COR) the following documentation for all Contractor CSWF positions for approval. Contractor CSWF shall not access DoD IT/IS prior to government approval. Contractors are not eligible for DoD 8570.01-M Baseline Certification waivers IAW DoD 8570.01-M, Paragraph C2.3.9.

• DoD approved cybersecurity baseline certification(s) for contract requirement in accordance with DoD 8570.01-M, Paragraphs C2.3.2. (T-0). The list of DoD approved cybersecurity baseline certifications can be found on the DoD Cyber Exchange NIPR portal

• Computing Environment/Operating System training documentation

• Documentation of Appropriate clearance or personnel security investigation for cybersecurity workforce positions IAW DoD 8570.01-M, Paragraph C1.4.4.6.4

• Completed/signed (electronic) Privileged Access Agreements if privileged access is required, for each IS/PIT system necessary to perform assigned duties IAW DoD 8570.01-M, Paragraph C2.1.4.

• Completed/signed statement of acceptance of assigned cybersecurity responsibilities for all personnel who access DAF IT/IS IAW 8570.01-M, C3.2.4.4, C4.2.3.6, and C10.2.3.6.

An example statement can be found in AFMAN 17-1303, Attachment 6.

1.7 Additional Contractor Cybersecurity Workforce Requirements. If a position is performing functions spanning across one or more levels within a category/specialty, then position certification requirements must be those of the highest-level function(s) IAW DoD 8570.01-M, Paragraph C2.2.5.

1.7.1 Information Assurance (IA) Training, Certifications, and Background Investigations:

Contractor employees who have access to controls, monitoring, or administration functions (e.g., system administration, database administration) for DoD systems are required to have IA training, certification(s), and background investigations. The Contractor shall ensure that personnel accessing information systems have the proper and current IA training, certification(s), and background investigations to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program, and other DoD requirements. Upon request, the contractor will furnish proof of compliance with this provision.

1.7.2 All users who require privileged access shall complete Air Force-approved Privileged User Cybersecurity Responsibilities training and maintain certificate of completion on file IAW AFMAN 17-1303. Approved training is available on the Security Training, Education, and Professionalization Portal (STEPP) at https://cdse.usalearning.gov/login/index.php

1.7.3 Contractor shall validate all newly assigned employees have appropriate certification(s) prior to granting privileged access to the network and/or assuming cybersecurity responsibilities IAW DoD 8570.01-M, C2.3.9.

1.7.4 Contractor shall ensure personnel who fail to maintain a required cybersecurity baseline certification IAW AFMAN 17-1303 are immediately removed from task.

1.7.5 Software Developers, Engineers, & Programmers Supporting IS/PIT Systems: Shall possess a DoD approved cybersecurity baseline certification commensurate to category and level of the assigned position.

1.7.6 Complete and provide documentation for government facilitated access to NIPR and Enterprise Mission Assurance Support Service (eMASS) as required to perform RMF duties.

1.8 Off-Site Processing and Storing of Government’s Information / Security and Privacy Compliance: The Contractor shall comply with all the Government’s information security and privacy directives, policies and requirements unless Contractor obtains a written waiver from Air Force and DoD Security Teams. These include, but shall not be limited to, the following provisions and any amendments or replacements of:

• The Privacy Act of 1974 (5 U.S.C. § 552a), as amended;

• Office of Management and Budget (OMB) Circular A-130, Management of Federal

Information Resources (Transmittal Memorandum No. 4), including Appendices;

• E-Government Act of 2002 (P. L. 107-347), including Title II, Section 208 - Privacy

Provisions and Title III - Federal Information Security Management Act of 2002, and related OMB guidance;

• National Institute of Standards and Technology (NIST), including NIST SP 800- 171, Federal Information Processing Standards (FIPS) and Special Publications; and

• Air Force Instructions and Regulations, and DFARs clauses including protection of Controlled Unclassified Information (CUI).

1.8.1 Contractor-owned or operated ISs shall meet all security requirements for connection to the Air Force Information Network (AFIN) IAW CJCSI 6211.02, AFMAN 17-1301 and DoDM5200.01V1_AFMAN16-1404V. Interconnection with the AFIN is accomplished IAW DoDI 8510.01, Risk Management Framework for DoD Systems, and configured IAW the appropriate DISA Network Security Technical Implementation Guides (STIGs).

1.8.2 The Contractor shall, upon request, provide to the government, a system security plan (or extract thereof) and any associated plans of action developed to satisfy the adequate security requirements of DFARS Clause 252.204-7012, and in accordance with NIST Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” in effect at the time the solicitation is issued or as authorized by the contracting officer, to describe the contractor’s unclassified information system(s)/network(s) where covered defense information associated with the execution and performance of this contract is processed, is stored, or transmits. System Security Plan and Associated Plans of Action for a Contractor’s Internal Unclassified Information.

1.8.3 The Contractor shall, upon request, provide the government with access to the system security plan(s) (or extracts thereof) and any associated plans of action for each of the Contractor’s tier one level subcontractor(s), vendor(s), and/or supplier(s), and the subcontractor’s tier one level subcontractor(s), vendor(s), and/or supplier(s), who process, store, or transmit covered defense information associated with the execution and performance of this contract.

System Security Plan and Associated Plans of Action for a Contractor’s Internal Unclassified Information System.

1.8.4 The Contractor shall identify all covered defense information associated with the execution and performance of this contract. At the post-award conference, the Contractor and the Government/Program Office shall identify and affirm marking requirements for all covered defense information, as prescribed by DoDM 5200.01, Controlled Unclassified Information, and DoDI 5230.24, Distribution Statements on Technical Documents, to be provided to the Contractor, and/or to be developed by the contractor, associated with the execution and performance of this contract.

1.8.5 Track all covered defense information associated with the execution and performance of this contract. The Contractor shall document, maintain, and provide to the Government, a record of tier 1 level subcontractors, vendors, and/or suppliers who will receive or develop covered defense information – as defined in DFARS Clause 252.204-7012 and associated with the execution and performance of this contract. Contractor’s Record of Tier 1 Level Suppliers Receiving/Developing Covered Defense Information.

1.8.5.1 Restrict unnecessary sharing and/or flow down of covered defense information associated with the execution and performance of this contract. The Contractor shall restrict unnecessary sharing and/or flow down of covered defense information – as defined in DFARS Clause 252.204-7012 and associated with the execution and performance of this contract – in accordance with marking and dissemination requirements specified in the contract and based on a ‘need-to-know’ to execute and perform the requirements of this contract. This shall be addressed and documented at the post-award conference.

1.8.6 The Contractor shall flow down the requirements in 1.8.4 and 1.8.5 to their tier 1 level subcontractors, vendors, and/or suppliers.

1.8.7 The Contractor (including sub-contractors) must implement the 110 security requirements in NIST SP 800-171 on covered contractor information systems that process controlled unclassified information (CUI), including but not limited to Federal Contract Information (FCI) and Controlled Technical Information (CTI) pursuant to DFARS clause 252.204-7012. If the contractor cannot implement a requirement, they must document in their system security plan and plans of action the requirements that are not implemented, when they will be implemented, and make available for government review. At a minimum, the contractor will be required to complete a basic assessment, upload the resulting score to the Supplier Risk Management System (SPRS) and recertify every 3 years. If required by the government post award, contractor will have to complete a medium or high assessment as determined by the contracting officer, granting the government access to facilities, systems, and personnel as necessary for the government to conduct applicable assessments.

1.9 Cloud Security. Contractor shall comply with the Department of Defense Cloud Computing Security Requirements Guide. Contractor shall utilize FedRAMP+ approved Cloud Service Providers (CSP) based on appropriate DoD Impact Level (DoD ILs).

1.9.1 DoD IL 4 / FedRAMP+ Approval: The Contractor shall meet Department of Defense Impact Level (DoD IL) 4 / Federal Risk and Authorization Management Program Plus (FedRAMP+) authorization requirements in accordance with NIST Special Publication 800-

53 (Security and Privacy Controls for Federal Information Systems) and Federal Information Processing Standards (FIPS) PUB 199 (Standards for Security Categorization of Federal Information Systems) for the impact level 4. In addition, the Contractor shall meet the Federal Information Security Management Act (FISMA) requirements in regard to protecting DoD Information Systems (IS).

Specifically, the Contractor shall adhere to the following NIST, DoD IL 4 / FedRAMP+ and FISMA guidelines:

a. Risk Categorization: The Contractor must categorize the information system in accordance with FIPS 199 to ensure that sensitive information is given the highest levels of security.

b. Risk Assessment: The Contractor must conduct a security or risk assessment of the information system in accordance with NIST SP 800-30 to identity vulnerabilities and implement mitigation actions.

c. System Security Plan (SSP): The Contractor must develop and maintain a SSP to identify security controls implemented within the Risk Management Framework (RMF). The SSP must be kept up to date and document the security posture of the organization.

d. Third-party Assessments: The Contractor must establish a program to ensure third-party assessments of implemented security controls in accordance with NIST and RMF guidance.

e. Plan of Action and Milestones (POA&M): The Contractor must establish POA&Ms for all non-compliant security controls to track identified vulnerabilities and set milestone dates for compliance.

f. Continuous Monitoring: In accordance with FISMA and NIST guidelines, the Contractor must establish of a program of continuous monitoring of the security posture of the information system through self-assessment of appropriate security controls. In addition, the Contractor must perform monthly security scans of the system to identify and mitigate critical and high vulnerabilities within 30 days of discovery.

g. Authority to Operate (ATO): The Contractor must ensure the information system obtains and maintains an approved ATO in accordance with DoD IL 4 / FedRAMP+ and NIST guidelines.