Draft_PWS_CS_Sec_Admin_Opns_Services_Contract_11-21-2017.pdf

Cyber Security Administration and Operations Support (CSAOS) Performance Work Statement (PWS)

November 16, 2017

FOR

Security Administration and Operations Support

Washington Office | Acquisition Management (AQM) | Acquisition Systems Branch

Table of Contents

1.0 Introduction

2.0 Background

3.0 Objectives

4.0 Scope

Task 1 – Project Management (REQUIRED)

Task 2 – Information Security Outreach and Awareness (REQUIRED)

Task 3 – Vulnerability Management (REQUIRED)

Task 4 – Privilege Access Control Management (REQUIRED)

Task 5 – Vulnerability Scanning and Auditing (REQUIRED)

Task 6 – Security Engineer - Critical Security Infrastructure, Risk Mitigation, and Audit Preparation and Reporting (OPTIONAL)

Task 7 – Configuration and Augmentation of Splunk Operational Intelligence Tools Integration and Reporting (OPTIONAL)

Task 8 – Annual Penetration Testing (OPTIONAL)

Task 9 – Continuous Diagnostics and Mitigation (OPTIONAL)

Task 10 – Exception Maintenance Database (Optional)

Task 11 – Customer Help Desk (CHD) Service Requests and Incident Support (Optional)

5.0 Performance Requirements

6.0 Deliverables

7.0 Key Personnel

8.0 Transition Period

9.0 Period of Performance

10.0 Place of Performance

11.0 Travel

12.0 Government Furnished Facilities/Equipment/Software/Information

13.0 Contract Administration

14.0 IT Security

14.1 Information Assurance

14.2 Dissemination of Information/Publishing

14.3 IT Security Training

14.4 Background Investigations

14.5 Identification of Contractor Employees

15.0 Data Rights

16.0 Organizational Conflict of Interest

17.0 Non-Disclosure Agreement

18.0 Records Management Policy

19.0 Section 508 Requirement

Appendix A: Current Operational Technology Environment

Appendix B: Non-Disclosure Agreement Contract

Appendix C: TBD

Appendix D: Quality Assurance Surveillance Plan

Appendix E: Acronym Table

Appendix F: List of Suggested Certifications

Appendix G: Estimated Travel Expenses

1.0 Introduction

The U.S. Forest Service (FS) seeks contractor support to provide the expertise, technical knowledge, staff support, and other related resources necessary to perform various tasks in support of the Chief Information Office’s (CIO) Cyber Security organization, Security Administration and Operations Support Branch.

2.0 Background

Established in 1905, the U.S. Forest Service has the responsibility for stewardship of more than 193 million acres of the nation’s forests and grasslands; for developing and communicating scientific knowledge through research and development that leads to informed natural resource decision-making; for delivering technical assistance through state and private forestry programs;

and for sharing knowledge and experience with others in the global community through international forestry. Performing this mission requires effective collection, organization, analysis, and delivery of many different types of information. The Forest Service currently has a workforce whose size varies by season with a maximum of approximately 42,000 end users assigned to over 1200 physical locations distributed among:

a) Nine National Forest System (NFS) Regions (“Regions”);

b) Five Research and Development Stations (“Stations”) and the Forest Products Lab;

c) The Northeastern Area State and Private Forestry;

d) The International Institute of Tropical Forestry; and

e) National Headquarters in Washington, D.C. (the Washington Office (WO)); and

f) National Administrative Services Center in Albuquerque NM.

Over the past ten years, FS has made significant progress meeting the security mandates required by Federal laws, standards, and guidance, and has developed a more advanced conceptual and continuous approach to security to ensure the safeguarding of information entrusted to the FS. The FS Chief Information Office’s (CIO) Cyber Security Program Management Team has been the principle agency lead in ensuring the safeguarding of information. And within the Cyber Security Program Management Team, the Cyber Security Administration and Operations Support (CSAOS) Branch responsibilities include:

• Maintaining and balancing the core information security and assurance tenets:

confidentiality, integrity and availability (CIA)

• Balancing secure information access for end users and customers, while simultaneously providing oversight, policy, and compliance to protect the vital information and critical information technology (IT) infrastructure of the Forest Service

• Overseeing and ensuring compliance with the Forest Service’s mandated requirements to operate IT investments securely, thus protecting the confidentiality, integrity and availability of the Agency data and systems

• Enabling users to carry out the core business of the Agency, free from malicious events and impacts

• Continuously protecting Agency data and systems

• Providing day-to-day Cyber Security Administration and Operations, including management of boundary protections, endpoint protections, network protections, monitor and reporting capabilities, Computer Incident Response Team (CIRT), Privacy, and partners with security architecture to meet these evolving requirements

The CSAOS Branch will be responsible for the government’s program management of the CSAOS contract. For the past ten years, the CSAOS Branch has received contractor support in meeting its objectives. The FS seeks continued contractor support in meetings these objectives.

3.0 Objectives

As a result of this contract, the CSAOS Branch expects to achieve:

• Compliance with all relevant Federal, departmental and agency information system security requirements.

• Reduced or mitigated information system security risks through thorough use of approved technology and tools.

• Optimized information system security environment throughout the FS.

4.0 Scope

The Contractor shall complete the following tasks in support of the CSAOS Branch and the CSAOS contract. Required tasks shall be awarded with this contract and are anticipated for each of the option years. Optional tasks may be used at the discretion of the Government

Required Tasks Optional Task

1. Project Management 6. Security Engineer - Critical Security

Infrastructure, Risk Mitigation, and Audit Preparation and Reporting

2. Information Security Outreach and

Awareness

7. Configuration and Augmentation of Splunk Operational Intelligence Tools Integration and Reporting

3. Vulnerability Management 8. Annual Penetration Testing

4. Privilege Access Control Management 9. Continuous Diagnostics and Mitigation

5. Vulnerability Scanning and Auditing 10. Exception Maintenance Database

11. Customer Help Desk (CHD) Service Requests and Incident Support

4.1 Required Tasks

The Contractor shall:

1.1 Be responsible for project management for this effort including, but not limited to:

a. Meeting:

i. Performance Work Statement performance standards.

ii. Deadlines included in the PWS and in the Contractor’s project plan.

b. Managing their contracted personnel and staff.

c. Coordinating and communicating with the FS Contracting Officer’s

Representative (COR) and Cyber Security Team.

d. Monitoring and reporting on status.

1.2 Prepare a Project Management Plan (PMP). A draft project plan shall be delivered to FS within ten business days of the kickoff meeting. The PMP will be used to manage, track and evaluate the Contractor’s performance. The PMP shall consist of control policies and procedures in accordance with standard industry practices for project administration, execution and tracking.

1.3 Finalize the PMP based on FS feedback.

1.4 Update the PMP as needed or requested throughout the contract period.

Quality Control

1.5 Ensure that all deliverables for all tasks under this contract are complete, accurate and delivered according to established schedules and are provided to the Government for review, comment and acceptance.

Task 1 – Project Management (REQUIRED) Outcome: Efficient and effective project management ensures professional, timely and accurate support.

1.6 Document and apply quality control procedures used throughout the performance of this contract for itself and any Subcontractors, in accordance with its proposed Quality Control Plan (QCP).

1.7 Document and conform to quality standards and best practices.

1.8 Identify and remedy quality issues in a timely manner.

Reporting

1.9 Prepare and submit a Monthly Performance and Progress Report (MPPR) within five (5) business days of the last business day of the preceding month to the COR. The Contractor shall include activities accomplished in the previous month with relevant metrics from all task areas, planned efforts in the month ahead, and any areas of concern.

1.10 Provide a monthly briefing to the COR on activities accomplished, planned efforts and any areas of concern.

1.11 Collect and document project deliverables and organize them for FS review.

1.12 Prepare and submit a high level activity summary of MPPR within five (5) business days of the last business day of the preceding month to the COR. The Contractor shall include metrics presenting overall health and progress of program areas for use with high level briefings.

Transition

1.13 Develop a plan for transitioning services and knowledge from the current Contractor.

1.14 Revise the transition plan based upon Government-provided feedback.

1.15 Execute the transition plan to ensure services are efficiently and effectively transitioned.

1.16 At the end of this contract, plan, cooperate and coordinate with the new Contractor to efficiently and effectively transition services and knowledge.

2.1 Analyze and evaluate all communities within FS (e.g., Research, Finance, State and Private Forestry) to tailor security-related communication messages.

2.2 Develop and implement an outreach program to ensure continuous awareness of relevant security environmental conditions throughout the FS community. This shall include a monthly newsletter.

2.3 Maintain and execute a comprehensive security communications and training plan.

2.4 Support the cybersecurity stand-down on a periodic basis.

2.5 Conduct cybersecurity virtual “road shows” on a periodic basis.

2.6 Support information security initiatives with communication planning and execution.

2.7 Maintain cybersecurity Web presence and update Web site with articles and information.

2.8 Include summary of efforts and metrics as part of the MPPR.

Task 2 – Information Security Outreach and Awareness (REQUIRED) Outcome: Centralized account management is optimized to ensure security and compliance with guidelines.

3.1 Vulnerability Identification, Preliminary Analysis, and Reporting

3.1.1 Identify vulnerabilities and flaws affecting the FS CIO Enterprise – Desktops, Servers, Networks, and Applications by maintaining and monitoring the vendor alerts mailbox and subscriptions.

3.1.2 Work with Security Engineers and other applicable enterprise Subject Matter Experts (SMEs) to determine applicability.

3.1.3 Create Change Requests (CR)/remediation release requests in system of record and track the change through to completion.

3.1.4 Generate monthly reporting of the agencies vulnerability risk exposure in the form of the Vulnerability Management Situational Awareness Report (VMSAR), VM5Rs and other monthly reports such as Microsoft (MS) critical/important patch report through reports generated from a variety of enterprise systems (including BigFix, Microsoft Configuration Manager, and scan data).

3.1.5 Maintain the vulnerability tracking database/spreadsheet. This is a manual effort at this point.

3.1.6 Define requirements for vulnerability reports and coordinate with USDA Agriculture Security Operations Center (ASOC) regarding requirements for automated reports.

3.1.7 Support transition from manual vulnerability tracking to use of automated tools including Splunk and RSA Archer. As automation is implemented, work to improve automation including migrating from the Vulnerability Management database and incorporating/normalizing data from various sources into Splunk and RSA Archer.

3.1.8 Support creation of a dashboard.

3.1.9 Maintain vulnerability management meeting minutes, report configurations, and program documentation.

3.1.10 Provide status information for the MPPR.

3.2 Vulnerability Risk Analysis and Mitigation

The contractor shall:

3.2.1 Work with the applicable enterprise SMEs as well as Architecture and Integrated

Engineering Services (IES) to determine the risk to the enterprise and identify the necessary outcome for remediating the risk.

3.2.2 Work with enterprise security scanning and SME’s to verify the remediation.

3.2.3 Report on changes to the National Institute of Standards and Technology (NIST) frameworks and other USDA vulnerability management requirements.

3.2.4 Partner with key stakeholders to ensure timely remediation, mitigation, generation of

Plans of Action and Milestones (POA&M) actions or acceptance of risk.

3.2.5 Define requirements for vulnerability reports and coordinate with USDA Agriculture

Security Operations Center (ASOC) regarding requirements for automated reports

Task 3 – Vulnerability Management (REQUIRED) Outcome: Identified vulnerabilities are mitigated to ensure rigorous IT security.

3.2.6 Support transition from manual vulnerability tracking to use of automated tools including Splunk and RSA Archer.

3.2.7 Create presentations regarding topics such as: the FS vulnerability management program, risk management of vulnerabilities, changes to the program.

3.2.8 Maintain vulnerability management program documentation.

3.2.9 Develop analysis reports for Management addressing accomplishments, risks, issues and mitigations.

3.2.10 Conduct detailed analysis of vulnerabilities as needed.

3.2.11 Develop weekly status reports for vulnerability management activities.

3.2.12 Provide monthly remediation status report with summary of ongoing issues and metrics in the MPPR.

4.1 Operate, manage and maintain elevated privilege management application and components using available tools, such as BeyondTrust Powerbroker and other tools; to allow users to install approved applications without elevated privileges.

4.2 Log data for applications requiring elevated privileges, and periodically review to ensure compliance or initiate POA&M actions.

4.3 Maintain rule set in base policy Group Policy Object (GPO) and populate exception and special user policy GPOs to ensure compliance with current approved and unapproved software.

4.4 Troubleshoot Powerbroker applications or other tools, and apply any changes required.

4.5 Ensure reporting console events generated through profiling are reviewed for required policies.

4.6 Respond to help desk tickets and customer support issues.

4.7 Include summary of efforts and metrics as part of the MPPR.

5.1 Perform enterprise-wide internal and external vulnerability testing and scanning monthly (both infrastructure and application) to assess the FS security posture using tools approved by the United States Department of Agriculture (USDA) FS. Currently these tools are Foundstone and Nessus utilized to scan all endpoints (approximately 90,000 per month).

5.2 Prepare report on scanning results monthly.

5.3 Perform ad hoc scanning as needed.

Task 4 – Privilege Access Control Management (REQUIRED) Outcome: Privilege access is effectively and efficiently managed and maintained.

Task 5 – Vulnerability Scanning and Auditing (REQUIRED) Outcome: FS is able to proactively address IT security through complete and thorough scans of the IT environment.

5.4 Manage the configuration of Tripwire and perform enterprise-wide detection of server configuration changes using Tripwire.

5.5 Prepare a report monthly of analysis of security configuration management with metrics.

5.6 Prepare a report to Information System Security Officers (ISSO) bi-monthly of any suspicious system changes.

5.7 Include summary of efforts and metrics as part of the MPPR.

4.2 Optional Tasks

The contractor will provide a mid-level Security Engineering SME skills to augment current staffing of an existing Security Team. Projects will be assigned on an as needed basis with expected due dates and deliverables to be provided.

The IT Security Engineer SMEs retained under this contract will be responsible for:

6.1 Evaluates and recommends the purchase of new security technologies and information security software.

6.2 Implements and administers IT security tools implementation to protect information assets (e.g., PowerBroker).

6.3 Customer Help Desk (CHD) incident handling activities.

6.4 Develops, implements, and coordinates activities to ensure, protect, and restore IT systems, services, and capabilities.

6.5 Interprets existing policy and procedural controls covering physical security, application and information security, and system software security.

6.6 Assesses and supports implementation of information technology security for systems processing multiple applications, which require differing security controls, and are typically accessed by a moderate-to-large user community.

6.7 Analyzes operational activities and determines changes needed to procedures.

6.8 Implements new or updated operational procedures to protect information assets and manage information security systems.

6.9 Coordinates implementation of new or updated operational procedures with staff and users

(where appropriate).

6.10 Recommends new or revised security measures and countermeasures based on the results of audit reviews.

6.11 Develops specifications and procedures to ensure compliance with security requirements.

Task 6 – Security Engineer - Critical Security Infrastructure, Risk Mitigation, and Audit Preparation and Reporting (OPTIONAL) Outcome: Security engineering SME support.

The contractor shall:

7.1 Splunk Implementation and Maintenance

7.1.1 Augment Current Splunk Environment. This includes providing the technical and functional activities and planning needed for the currently implemented Splunk environment to insure a beneficial, operational system throughout its life cycle. Provide the administrative and architectural documentation for necessary upgrades and improved functionality.

7.1.2 Implement Upgraded Splunk Environment, including architecting, documenting and maintaining operational support.

7.2 Data Source Integration

7.2.1 Subtask – Continue to Integrate Additional Data sources as necessary

• Include additional data sources through the monthly gap analysis.

• Provide expert analysis of new federal guidance and/or changes to the security environment as it impacts security documentation.

• Support and maintain the confidentiality, integrity, and availability of security documentation.

• Optimize the content and usability of policy- and procedure-related security documentation.

7.2.2 Subtask - Integrate Data Source Types

• UNIX and Linux

• Windows

• CITRIX

• Apache

• Oracle

• Microsoft SQL Servers

• Cisco Secure Access Control System (ACS) remote & network access devices

• Cisco Adaptive Security Appliance (ASA) Virtual Private Network (VPN)

• Cisco and Juniper Firewalls

• Cisco Identity Services Engine (ISE)/Network Admission Control (NAC)

• Microsoft Endpoint Protection

• Fire National Enterprise Support System (NESS) Earth Resources Observation and Science

(EROS)

• Natural Resource Manager (NRM)

• eCollections

• Incident Business System (IBS)

• Law Enforcement Investigations Management and Attainment Reporting System (LEIMARS)

• WebDet

• Virtual Incident Procurement (VIPR)

• LincPass and Active Directory

• Business Applications as they migrate to the VDC

• Additional data sources as identified

7.3 Monitors and Reports

Task 7 – Configuration and Augmentation of Splunk Operational Intelligence Tools Integration and Reporting (OPTIONAL) Outcome: Support for the Splunk environment.

• Create additional dashboards as requested for newly identified analysis environments

• Enhance previously created dashboards based on defined organizational tracking metrics

Create or modify reports necessary for compliance with defined policies and procedures to reflect new data source events.

• Develop and implement an automated process for the compliance officers to receive reports as required.

• Provide technical and logistical support for the implementation of report generation, report review and report management.

7.4 Correlation Rule Set Development

• Create event correlation rules to supplement event analysis according to Forest Service needs.

• Develop and execute plans to correlate security incident information between the multiple IT environments.

• Document method to track intrusion events from network entry to disconnect.

• Document assessment activities and results in sufficient detail to enable external review of all assessment processes, activities, results, and conclusions.

7.5 Develop implementation and operational training packages.

• Develop implementation and operational training packages.

• Train ISO staffs, Enterprise Operations and CIO management in the use of dashboards and reporting capabilities.

7.6 Splunk Syslog Management Tool

• Develop implementation and operational packages.

The Contractor shall design and conduct this task in four phases: planning, external, internal and reporting using industry best practices and tools. The Contractor shall:

8.1 Perform annual black box testing of USDA/FS IT assets, including desktop computers, servers, routers, switches, internally developed applications, web-based scripts, applications on all USDA/FS websites and back doors in accordance with approved test plan. Provide test plan for FS approval ten (10) days prior to test date.

8.2 Test to determine: (1) whether the IT controls are properly designed and operating effectively, (2) what steps the FS should take to better protect its IT Enterprise from malicious and/or unintentional internal and external attacks and (3) if the FS’s security monitoring and incident response capabilities are operating effectively and what steps, if any, should be taken to improve on them.

8.3 Prepare a report and conduct a briefing documenting analysis process, outcomes, metrics, and recommendations.

Task 8 – Annual Penetration Testing (OPTIONAL)

Outcome: Testing confirms FS efforts to protect its IT enterprise or identifies deficiencies and improvements based on best practices.

9.1 Operate ForeScout Counteract (HW Asset Management)

9.1.1 Propose new segments and verify all existing segments are accurate and complete

9.1.2 Propose new classification and clarification policies and maintain existing policies

9.1.3 Accurately classify and clarify all devices on the FS network

9.1.4 Minimize the unclassified devices

9.1.5 Develop additional reports to distribute for review, records and improvement opportunity

9.1.6 Augment ForeScout dashboards to display access-based reporting. An Administrators dashboard, an Operations dashboard, a Cyber Security dashboard, and a Leadership dashboard

9.1.7 Conduct ad hoc reporting as requested

9.2 Operate RES Workspace

9.2.1 Establish, validate and maintain an Agency-wide black and white list

9.2.2 Maintain the user/machine groups and associated software applications for multiple FS staff organizations

9.2.3 Operate and maintain RES Workspace One agents and relays

9.2.4 Develop additional standard reports for distribution to Cyber and ISSOs

9.2.5 Conduct ad hoc reporting as requested

9.3 Support Reporting for the BigFix Environment

9.3.1 Validate that all assets are reporting to BigFix and categorized accurately

9.3.2 Run standard reports for hardware and software asset inventories

9.3.3 Distribute reports to Cyber, ISSOs and Leadership

9.3.4 Create scheduled reports for repetitive requirements

9.3.5 Conduct ad hoc reporting as requested

9.4 Operate BigFix Configuration Systems Management (CSM) Tools

9.4.1 Utilize BigFix as the centralized tool for CSM by operating and maintaining the BigFix

CSM tools

9.4.2 Validate NIST and DISA STIGs are incorporated and accurate into the BigFix schemas

9.4.3 Manage relays where appropriate and coordinate to insure that there are as few impacts as possible

9.4.4 Create and run standard configuration management reports

9.4.5 Distribute reports to key stakeholders

9.4.6 Develop additional scheduled reports for repetitive requirements

9.4.7 Coordinate system issue resolution with USDA

9.4.8 Conduct ad hoc reporting as requested

9.4.9 Implement a GPO to deploy the BigFix/SCCM agents to all Windows systems

Task 9 – Continuous Diagnostics and Mitigation (OPTIONAL)

Outcome: Operate and maintain the CDM Environment.

9.4.10 Implement automated BigFix discovery/deploy agents to all supported systems

9.4.11 Support interagency group that is tasked with developing and implementing STIG and

Checklists in BigFix/SCCM to measure and report on deviations

9.4.12 Support interagency group that is tasked with developing detailed processes for creating configuration settings of every authorized hardware/software role at USDA

9.4.13 Implement a single Enterprise Reporting process to insure compliance of CSM and provide monthly report

9.5 Monitor the CDM Dashboard for Issues

9.5.1 Monitor agency dashboard and alert Cyber to issues

9.5.2 Develop and run standard reports for FS CDM dashboards

9.5.3 Distribute reports to key stakeholders

9.5.4 Develop additional scheduled reports for repetitive requirements

9.5.5 Develop, distribute, and conduct ad hoc reporting as requested

9.6 Draft Operations Guides

9.6.1 Draft, finalize, and maintain the daily operations guide and a long-term maintenance manual for each tool

9.6.2 Present the Guide to cybersecurity team for approval

9.7 Train Additional Operators in the Tools

9.7.1 Draft a training plan for each tool and present the training plan for approval

9.7.2 Publish the training plan

9.7.3 Implement the training plan

9.8 Develop new Policy and Procedures

9.8.1 Propose new policies and procedures to augment current policies and procedures with respect to all CDM tools.

9.8.2 Communicate recommendations to cybersecurity and ISSOs for improvement

9.8.3 Gain common approval and understanding of policies and procedures

9.8.4 Publish in a commonly accessible repository all new policies and procedures

9.9 Implement and Train on New Policies and Procedures

9.9.1 Create training materials and other aids for successful implementation of new policies and procedures

9.9.2 Communicate and market requirements for new policies and procedures

9.9.3 Coordinate training of new policies and procedures

9.9.4 Develop measures to ensure new policies and procedures are understood and followed

9.10 Upgrade Existing Policy and Procedures

9.10.1 Propose modified policies and procedures to upgrade current policies and procedures with respect to all CDM tools

9.10.2 Communicate recommendations to cybersecurity and ISSOs

9.10.3 Gain a common approval and understanding of policies and procedures

9.10.4 Publish to common repository all upgraded policies and procedures

9.11 Institutionalize Policy and Procedure Upgrades

9.11.1 Create training materials and other aids for successful implementation of upgraded policies and procedures

9.11.2 Communicate and market requirements for upgraded policies and procedures

9.11.3 Coordinate training on upgraded policies and procedures

9.11.4 Develop measures to ensure new policies and procedures are understood and followed

Task 10 – Exception Maintenance Database (Optional) Outcome: FS is able to proactively address IT security through complete and thorough scans of the IT environment.

10.1 Review and update the Exception Maintenance Database to extract data and report findings to the government.

10.2 Determine new settings and configurations that need to be pushed out to the FS enterprise;

make programming changes

10.3 Assist in resolution of POAMs as well as any compliance issues resulting from any Office of the Inspector General (OIG), USDA or other audits

10.4 Assist in ensuring that the FS has effective and dependable processes, procedures, and tool sets to identify information system which machines are out of compliance and provide timely recommendations on next steps to bring systems into compliance.

10.5 Writing applications and scripts to uninstall particular applications and add-ons from user workstations

Task 11 – Customer Help Desk (CHD) Service Requests and Incident Support (Optional) Outcome: Effective customer support management.

11.1 Draft knowledge documents, obtain approval, and support publication of those documents

11.2 Support procedures for access to the CHD and IT Service Management (ITSM) tools

(currently Remedy on Demand, and ServiceNow), assignment, and closing of tickets

11.3 Conduct initial investigation of issues before assignment of the ticket

11.4 Assign and track tickets

11.5 Manage the workflow of the tickets and ensure that they get closed appropriately

11.6 Reassign tickets to proper ques if incorrectly assigned

11.7 Weekly reports on contractor activities

11.8 Bi-weekly reports on tickets, including CHD and ITSM tools ticket health

11.9 Attend CHD conference calls

5.0 Performance Requirements

Perf

Stand

Required Services

Performance Standards Acceptable Quality Level

(AQL)

Monitoring Method

PS-1 Provide required PWS services as specified in PWS paragraph 4.0, Tasks 1 through 5 and Optional Tasks 6 and 11

Work must be accomplished in accordance with (IAW) the following, as applicable:

1. Project Plans

2. Performance Standards

3. Applicable Federal, state, local, USDA and FS policies and guidelines.

No deviation without prior approval from the COR.

COR/designee review of Contractor-provided Monthly Performance and Progress Report and through COR/designee periodic random inspection and customer feedback.

PS-2 Provide deliverables/ reports required for each Task as specified in PWS paragraph 6.1, 6.2, 6.3 and 6.4

Work products/deliverables/ reports; as applicable reports’ analysis are accurate; free of content error; recommendations are applicable to FS environment, address compliance issues and deficiencies; and are free of grammatical errors.

No deviation without prior approval from the COR. No more than one rework for any report per submission.

COR/designee review of random sample of deliverables.

Perf Stand

Required Services

Performance Standards Acceptable Quality Level

(AQL)

Monitoring Method

Deliverables are completed IAW the Project Management Plan.

PS-3 Implement a strong and effective oversight/quality control process as specified in PWS paragraph 4.0, Task 1

The oversight/quality control process proactively identifies and addresses issues, as well as continuously improves the services being provided by the Contractor.

No deviation. COR/designee review of monthly activity reports and random inspection of services.

PS-4 Provide timely and effective transition. As specified in PWS paragraph 4.0, Task Statements

1.13 through 1.15, and paragraphs 8.0, and 9.0

Transition from the incumbent contractor is completed during the Transition/Phase In period and implement transition plan for all activities and services to meet contract objectives by the completion of the transition period, or agreed upon timeframes.

No deviation without prior approval from the COR.

COR/designee review of transition services and Transition Plan.

Performance Standards/Disincentives Unless otherwise negotiated between the Contractor and the Government there will be an initial 60 day ramp-up period before full execution of the performance metrics for tasks/deliverables and associated disincentives will be applied.

Performance Standards.

A higher than satisfactory performance review is achieved during the current year of contract performance when:

1. Deliverables are received on time.

2. The total percentage of report reworks equals 10% or less.

Performance Standards/Disincentives

3. Three or less disincentives have been applied during the year

4. Recommendations implemented result in either technical improvements, cost saving measures, or efficiency gains.

Disincentives.

Inspection and Acceptance guidelines in paragraph 7.3 of this PWS will be followed before disincentives are applied. Unless prior approval is obtained from the COR:

1. Disincentives will be applied after a submitted report requires a second rework, or failure to meet service deadlines occur.

2. The fixed price of tasks will be reduced by 1% first deviation, 5% second deviation, and by 10% for three or more deviations for not providing required deliverables (e.g. reports on time), or meeting required performance standards/acceptable quality levels outlined above.

3. Root Cause Analysis (RCA) will be conducted by the Contractor and submitted to the COR upon the second occurrence of a deviation for the same task or report.

4. Corrective Action Plan (CAP) will be developed by the Contractor and submitted to the COR upon the fourth occurrence of a deviation for the same task or report.

5. No higher than a satisfactory performance review may be achieved when 4 or more disincentives have been applied during the current year of contract performance.

6.0 Deliverables

6.1 Table of Deliverables

PWS Task# Title Due Date Appendix B Nondisclosure Agreement. Signed statements are due, from each employee assigned, prior to performing ANY work on this task.

1.2 Draft Project Management Plan No Later Than (NLT) 10 business days after contract award (DACA)

1.3 Final Project Management Plan NLT 10 business days of receipt of Government feedback; Annually Thereafter; and as requested by the

COR

1.6 Quality Control Plan NLT 30 business DACA; Annually

Thereafter; and updates as requested by the COR

1.12 Monthly Performance and Progress

Report (MPPR)

Within 5 business days of the last business days of the preceding month;

beginning month two of POP

1.13 Draft Transition Plan NLT 10 business DACA

1.14 Final Transition Plan NLT 5 business days after receipt of

Government feedback

2.3 Security Communications Plan NLT 60 business DACA

2.3 Training Program Plan NLT 90 business DACA

2.4 Information Security Training and

Outreach Sessions In accordance with the Project Management Plan (PMP)

3.1.1, 3.1.5 Vulnerability Management Tracking updates

Daily

3.1.2, 3.1.3 Remediation release request/CR for each vulnerability

Due within 1 business day of vulnerability identification

3.1.4 Monthly VMSAR and VM5R

reports

Last business day of each month

3.1.4 MS Critical and Important Patch

reports

Due within 15 business days of data generation

3.1.6, 3.2.5 Vulnerability Management Report Requirements

In accordance with the Project Management Plan (PMP)

3.1.9, 3.2.8 Maintenance of Program Essential Documentation

Three (3) business days prior to publication and implementation

3.1.9 Vulnerability Management Meeting

Minutes

Due within two (2) business days of weekly meeting

3.2.7 Provide Presentations As Needed

3.2.9 Analysis Reports for Management

Addressing Accomplishing, Risks, Issues, and Mitigations

As Needed

3.2.11 Weekly Status Reports Due one (1) day prior to

scheduled weekly meetings

4.3 Privilege Access Control Rule Set In accordance with the Project Management Plan

4.6 Report on number of help desk

tickets and resolution status

Report delivered NLT the last day of each month

5.2 Vulnerability Testing and Scanning

Report

Report delivered NLT the 19th of each month

5.5 Server Configuration Change

Report

Report delivered NLT the 15th of each month

5.6 Report suspicious system changes Report delivered NLT the 15th and 30th of each month to Information System Security Officers (ISSO)

6.2 Deliverables for Optional Tasks

PWS Task# Title Due Date

6.1 Project Progress Report Weekly

6.1 Accomplishment Summary Bi-Weekly

6.11 Specifications and Procedures One Week After Assignment

7.3 Reports As defined in the Project

Management Plan

7.4 Rule Sets As defined in the Project

Management Plan

7.5 Training Plans and Training

Materials

In accordance with the Project Management Plan

8.1 Penetration Test Plan In accordance with the Project

Management Plan

8.3 Penetration Test Report In accordance with the Project

Management Plan

9.1.1 Propose new segments and new

classifications for ForeScout.

NLT15 business DACA

9.1.6 Provide ForeScout dashboard. NLT 30 business days of 8.1

9.1.7 Provide ForeScout reports. NLT 30 business days of 8.1

9.2.1 Initial Agency-wide black list. Monthly

9.2.1 Initial Agency-wide white list. Monthly

9.3.2 Draft reports for SW asset

inventories.

NLT 30 business days of POP;

monthly thereafter on the last business day of the month

9.4.1 Provide BigFix inventory &

schemas.

NLT 30 business days of POP; weekly thereafter on the last business day of the week

9.4.11 Provide Report on Enterprise

Reporting processes

Monthly

9.5.2 Initial Agency-wide configuration

report.

NLT 30 business DACA; monthly thereafter on the last business day of the month

9.5.2 Initial Agency-wide CDM reports. NLT 30 business DACA; monthly thereafter on the last business day of the month

9.6.1 Provide Draft Daily Operations

Guide.

NLT 60 business days of task exercise

9.6.2 Provide Final Daily Operations

Guide.

NLT 20 business days of comments received on 9.6.1

9.7.1 Provide Draft Training Plan. NLT 90 business days of task exercise

9.7.2 Provide the final Training Plan. NLT 20 business days of comments received on 9.7.1

9.8.1 Propose new policies and

procedures to augment existing Cybersecurity and CIO Operations policies and procedures

NLT 45 business days of task exercise;

annually there after

9.8.2 Present proposals to Cybersecurity

and ISSOs

NLT 15 business days of 9.8.1

9.8.4 Provide final new policies and

procedures to Cybersecurity and CIO Operations

NLT 15 business days of 9.8.2

9.8.5 Provide weekly FS Cybersecurity

progress report

COB the last business day of each week.

9.9.1, 9.12.1 Propose training/marketing plan with measures of success for new & upgraded policies and procedures

NLT 60 business days of POP; annually thereafter

9.9.2, 9.12.2 Coordinate training/marketing As needed

9.9.3, 9.12.3 Evaluate success of training As requested NLT 2 business days of training

9.10.1 Propose updated policies and

procedures to improve existing Cybersecurity and CIO Operations policies and procedures

NLT 60 business days of POP; annually thereafter

9.10.2 Present proposals to Cybersecurity

and ISSOs

NLT 15 business days of 9.10.1

9.10.4 Publish final upgraded policies and

procedures

NLT 15 business days of 9.10.1

10.1 Updated Exceptions Database NLT the 15th of each month

11.1 Knowledge documents published NLT 60 business days of POP; annually thereafter

11.4 Ticket assignments are complete As defined in the Project Management Plan

11.7 Weekly reports COB the last business day of each week

11.8 Bi-weekly reports COB the last business day of every other week.

6.3 Delivery Method

Electronic copies shall be delivered using Microsoft (MS) Office suite (e.g., MS WORD, MS EXCEL, MS POWERPOINT, MS PROJECT, or MS ACCESS format), unless otherwise specified by the COR. These MS Office Suite, and other deliverables/artifacts shall be 508 compliant. In addition, any media and websites the contractor will be responsible for developing, managing, or maintain for the FS in support of this contract shall be 508 compliant. Electronic submission shall be made via email, unless otherwise agreed to by the COR. Should the size of a deliverable require that it be placed upon a compact disk (CD) or digital versatile disc (DVD), the Contractor shall prepare and deliver to the COR an individual envelope containing the CD/DVD. As appropriate, this envelope shall contain one or more CD/DVDs. CDs and DVDs must include proper labeling (e.g., classification markings, Personally Identifying Information [PII]).

6.4 Inspection and Acceptance

The Government will perform Inspection and Quality Assurance in accordance with the contract Quality Assurance Surveillance Plan (QASP). The Government has the right to perform periodic surveillance of the Contractor to ensure that the Contractor’s work products and Quality Control processes are in compliance with the contract requirements. The Government and the Contractor will coordinate Government surveillance in a manner that will not unduly delay or disrupt the Contractor’s performance of the contract.

The COR will have ten (10) business days by close of business (COB) to review draft deliverables and make comments. The Contractor will have ten (10) business days by COB to make corrections (known as rework #1). Upon receipt of the final deliverables, the COR/designee will have five (5) business days by COB for final review prior to acceptance or providing documented reasons for non-acceptance. Should the Government fail to complete the review within the review period the deliverable will become acceptable by default.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal.

In the event of a rejected deliverable, the Contractor will be notified in writing by the COR/designee of the specific reasons for rejection. The Contractor shall have five (5) workdays by COB to correct the rejected deliverable and return it per delivery instructions. COB will be considered Mountain Standard Time unless otherwise specified by the COR.

7.0 Key Personnel

The Contractor shall employ and maintain personnel in the management and key staff positions who meet the minimum qualifications for each of the skill levels to which they are assigned, and shall be capable of performing the functions described in the Contractor’s staffing plan submitted with their proposal. The following positions are considered key personnel under this task order: the role of Project Manager (PM) and the Task Managers.

Qualifications and resumes for all key personnel positions listed above include a minimum of five (5) years relevant experience and industry best practice professional certifications/training commensurate with the position title.

Project Manager: The Contractor shall designate a PM as the single Point of Contact (POC) with FS for communications issues, concerns, or problems that arise on this task order. The PM shall have the authority to commit the Contractor and make decisions for the Contractor, and shall be the single Contractor representative responsible for all issues, concerns, or problems.

The PM shall readily respond to FS questions, concerns, and comments. The PM shall proactively alert FS to potential contractual issues. The PM must be available during normal duty hours, as specified herein to meet (either in person or by phone) with Government personnel within 24 hours to discuss problems.

Task Managers: Each task shall have a designated manager who will be responsible for day to day management of the task, in collaboration with the Project Manager. The Task Managers shall be ready to respond to government SMEs and other personnel regarding their task area(s), including status of work, information upcoming activities, and completed activities.

During the first ninety (90) days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment.

The Contractor shall notify the Contracting Officer (CO) within fifteen (15) calendar days after the occurrence of any of these events and provide information to the Contracting Officer at least fifteen (15) days prior to making any permanent substitutions. Resumes and commitment letters for key personnel to be substituted or added, will be sent to the CO for file.

8.0 Transition Period

To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the contractor shall have sufficient personnel on board 30 days prior to the start of the performance period to begin transition phase in. During the phase in period, the contractor shall become familiar with performance requirements in order to commence full performance of services on the contract start date.

To provide for continuity of service the successor contractor shall be furnished phase-in training by the incumbent. Incumbent and successor contractors shall develop the transition plan determining the nature and extent of phase-in/phase-out services required. The plan shall identify training to be performed, a list of the documentation, and contract related artifacts to be transferred from the incumbent to the successor, and a date when responsibilities are transferred from the incumbent to the successor contractor. The successor contractor shall receive all documentation necessary to provide uninterrupted contract services.

9.0 Period of Performance

Contract Start Date: April 1, 2018 Period of Performance: 1 year (04/01/2018 to 03/31/2019) with three Option years Option Schedules:

• Option 1: subsequent 1 year from date of base (04/01/2019 to 03/31/2020)

• Option 2: subsequent 1 year from date of Option 1 (04/01/2020 to 03/31/2021)

• Option 3: subsequent 1 year from date of Option 2 (04/01/2021 to 03/31/2022)

10.0 Place of Performance

The Contractor shall perform the requirements at its facilities.

11.0 Travel

The Government anticipates that performance of this order may require travel. The exact locations and times of these trips will be identified on a case by case basis. Potential travel can be expected to the Albuquerque Service Center in New Mexico and the Washington Office in DC. Typically travel will not exceed 5 business days.

Prior approval of contractor travel is required. Travel requests shall include an estimate of expenses and must be approved by the COR a minimum of one week before requested travel dates. Request will be submitted electronically by email.

Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. Travel costs shall be incurred and billed in accordance with Federal Acquisition Regulations (FAR) Part 31. Approval, and costs for these expenses will be reviewed and certified by the COR and approved by the Contracting Officer. All travel and transportation shall utilize commercial sources and carriers provided the method used for the appropriate geographical area results in reasonable charges to the government. The Government will not pay for business class or first-class travel. Travel expenses shall be reimbursed in accordance with the standard General Services Administration (GSA) per diem rates and the Federal Travel Regulation. No overhead or general and administrative expenses shall be added to travel costs.

The Contractor shall request travel using the form in Appendix G. The travel form shall be submitted to the designated FS ISSO for review and endorsement prior to submission to the

COR.

12.0 Government Furnished Facilities/Equipment/Software/Information

The Contractor shall maintain an inventory accounting system for Government Furnished Equipment (GFE), Government Furnished Software (GFS), and other Government Furnished

Tools. The Contractor shall provide the COR with the information necessary to manage GFE.

All Government Property should be maintained per FAR 52.245-1.

12.1 Government Furnished Facilities

It is anticipated that all work will take place at the contractor facilities.

If work requires on-site work at the Government’s location, the Government will provide:

• Personal Computers (PCs) with the FS image and access to FS systems.

• Licensed copies of project required software that is the Forest Service’s standard image as well as access to necessary tools (e.g., vulnerability reporting tools), reports, and data.

12.2 Government Furnished Information

The Government shall provide FS IT systems security documentation, policies, procedures, correspondence, inventories, and applicable background material.

12.3 Government Furnished Information

The Government shall provide FS IT systems security documentation, policies, procedures, correspondence, inventories, and applicable background material.

13.0 Contract Administration

The COR is responsible for the technical direction of the contract work. In no event, however, will any understanding, agreements, modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the Government unless formalized by proper contractual document executed by the CO prior to completion of the contract.

The CO shall be informed as soon as possible of any actions or inactions by the contractor or the Government which may affect the price, required delivery or completion times stated in the contract, so that identified desired changes and outside influences on the contract may be modified as necessary. Whenever, in the opinion of the contractor, the COR requests efforts outside the scope of the contract, the contractor shall advise the COR. If the COR persists and there still exists a disagreement as to proper contractual coverage, the CO should be notified immediately, preferable in writing if time permits. Proceeding with work without proper contractual coverage could result in non-payment.

A copy of the COR delegation letter shall be provided to the Contractor five days after award.

The CO is the only person authorized to approve changes. This authority remains solely with the CO. In the event that the Contractor affects any changes at the direction of any person other than the CO, the changes will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase incurred as a result thereof.

14.0 IT Security

14.1 Information Assurance

By accepting this contract/agreement, the Contractor/Cooperator and other external organizations (hereafter called Contractor) providing Information Technology (IT) resources or services to the US Forest Service (FS) agrees to comply with the applicable IT security policy as outlined in this document. The Contractor and other external organizations will be responsible for IT security for all systems connected to the FS network or operated by the Contractor and other external organizations for the FS, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or electronic access to FS sensitive information that directly support the mission of the FS.