Draft_PWS__CS_Internal_Controls_Services_Contract_11-21-2017.pdf

Cyber Security Internal Controls Support (CSICS) Performance Work Statement (PWS)

November 9, 2017

FOR

Cyber Security Internal Controls Support

Washington Office | Acquisition Management (AQM) | Acquisition Systems Branch

Table of Contents

1.0 Introduction

2.0 Background

3.0 Objectives

4.0 Scope

Task 1 – Project Management (REQUIRED)

Task 2 – Enterprise Program Guidance and Policy Management (REQUIRED)

Task 3 – Oversight and Compliance Verification (REQUIRED)

Task 4 – Survivability and Contingency Program Support(REQUIRED)

Task 5 – Assessment and Authorization Support(REQUIRED)

Task 6 – Centralized Account Management (OPTIONAL)

Task 7 – IT Security Operations Process Improvement (OPTIONAL)

Task 8 – ISSO Support (OPTIONAL)

Task 9 – Framework/Strategy Refresh and Monitoring (OPTIONAL)

5.0 Performance Requirements

6.0 Deliverables

7.0 Key Personnel

8.0 Transition Period

9.0 Period of Performance

10.0 Place of Performance

11.0 Travel

12.0 Government Furnished Facilities/Equipment/Software/Information

13.0 Contract Administration

14.0 Clauses

15.0 Protection of Information

16.0 IT Security

16.1 IT Security Training

16.2 Background Investigations

16.3 Identification of Contractor Employees

16.4 Non-Disclosure Agreement

16.5 Data Rights

16.6 Organizational Conflict of Interest

16.7 Identification of Contractor Employees

16.8 Records Management Policy

17.0 Section 508 Requirement

Appendix A: Current Operational Technology Environment

Appendix B: Non-Disclosure Agreement

Appendix C: TBD

Appendix D: Quality Assurance Surveillance Plan

Appendix E: Acronym Table

Appendix F: List of Suggested Certifications

Appendix G: Estimated Travel Expenses

1.0 Introduction

The U.S. Forest Service (FS) seeks contractor support to provide the expertise, technical knowledge, staff support, and other related resources necessary to perform analysis to ensure security controls are consistently implemented; integrate new technology with Information Technology (IT) security standards; develop and execute plans for monitoring, assessing and verifying security controls across all major information systems; and develop, evaluate, and exercise IT survivability and contingency plans.

2.0 Background

Established in 1905, the U.S. Forest Service has the responsibility for stewardship of more than 193 million acres of the nation’s forests and grasslands; for developing and communicating scientific knowledge through research and development that leads to informed natural resource decision-making; for delivering technical assistance through state and private forestry programs;

and for sharing knowledge and experience with others in the global community through international forestry. Performing this mission requires effective collection, organization, analysis, and delivery of many different types of information. The Forest Service currently has a workforce whose size varies by season with a maximum of approximately 42,000 end users assigned to over 1200 physical locations distributed among:

a) Nine National Forest System (NFS) Regions (“Regions”);

b) Five Research and Development Stations (“Stations”) and the Forest Products Lab;

c) The Northeastern Area State and Private Forestry;

d) The International Institute of Tropical Forestry; and

e) National Headquarters in Washington, D.C. (the Washington Office [WO]); and

f) National Administrative Services Center in Albuquerque, NM.

Over the past ten years, FS has made significant progress meeting the security mandates required by Federal laws, standards, and guidance, and has developed a more advanced conceptual and continuous approach to security to ensure the safeguarding of information entrusted to the FS.

The FS Chief Information Office’s (CIO) Cyber Security Program Management Team has been the principle agency lead in ensuring the safeguarding of information and whose responsibilities include:

• Ensuring consistent application of information security standards across all FS information systems.

• Meeting all Federal regulatory and USDA agency documented policies, procedures, standards, and guidance.

• Integrating these regulations and standards into a fully implementable security program.

• Ensuring preparation for internal and external audits through management of all infrastructure artifacts required to pass audits.

• Ensuring all new IT projects meet or integrate security standards into their development.

• Developing a culture of security-mindful professionals across the FS community.

• Being more flexible and responsive to new regulatory directives.

• Serving as the central authority for all IT security-related activities across the agency.

• Ensuring information system survivability and integrity.

• Optimizing processes to meet IT security-related goals and strategies.

Within the Cyber Security Program Management Team, the Cyber Security Internal Controls Support (CSICS) Branch will be responsible for the government’s program management of the CSICS contract. The FS’s CSICS Branch advances the agency’s security posture: (1) by continuing to implement and update National Institute of Standards and Technology (NIST)-compliant policies, and procedures, (2) by engineering and implementing solutions to new requirements that arise both from advances in technology and from new Federal and Department of Agriculture (USDA) regulations and directives, and (3) by maintaining IT system resiliency with effective contingency planning, evaluation, and testing.

For the past ten years, the CSICS Branch has received contractor support in meeting its objectives.

The FS seeks continued contractor support in meetings these objectives.

3.0 Objectives

As a result of this contract, the CSICS Branch expects to achieve:

• Compliance with all relevant Federal, departmental and agency information system security requirements.

• Reduced or mitigated information system security risks through thorough reviews and recommendations.

• Optimized information system security processes and procedures from best practices and leading expertise.

4.0 Scope

The Contractor shall complete the following tasks in support of the CSICS Branch and the CSICS contract. Required tasks shall be awarded with this contract and are anticipated for each of the option years. Optional tasks may be used at the discretion of the Government.

Required Tasks Optional Task

1. Project Management 7. Centralized Account Management (CAM)

2. Enterprise Security Program Guidance and Policy

8. IT Security Process Improvement

3. Framework/Strategy Refresh and Monitoring

9. Information System Security Officer (ISSO) Support

4. Oversight and Compliance Verification

5. Survivability and Contingency Program Support

6. Assessment and Authorization Testing

4.1 Required Tasks

The Contractor shall:

1.1 Be responsible for project management for this effort including, but not limited to:

a. Meeting:

i. Performance Work Statement (PWS) performance standards.

ii. Deadlines included in the PWS and in the Contractor’s project plan.

b. Managing their contracted personnel and staff.

c. Coordinating and communicating with the FS Contracting Officer’s

Representative (COR) and CSICS Branch Team.

d. Monitoring and reporting on status.

1.2 Prepare a Project Management Plan (PMP). A draft project plan shall be delivered to FS within ten (10) business days of the kickoff meeting. The PMP will be used to manage, track and evaluate the Contractor’s performance. The PMP shall consist of control policies and procedures in accordance with standard industry practices for project administration, execution and tracking.

1.3 Finalize the PMP based on FS feedback.

1.4 Update the PMP as needed or requested throughout the contract period.

Quality Control

1.5 Ensure that all deliverables for all tasks under this contract are complete, accurate and delivered according to established schedules and are provided to the Government for review, comment and acceptance.

Task 1 – Project Management (REQUIRED) Outcome: Efficient and effective project management ensures professional, timely and accurate support.

1.6 Document and apply quality control procedures used throughout the performance of this contract for itself and any Subcontractors, in accordance with its proposed Quality Control Plan (QCP).

1.7 Document and conform to quality standards and best practices.

1.8 Identify and remedy quality issues in a timely manner.

Reporting

1.9 Prepare and submit a Monthly Performance and Progress Report (MPPR) within five (5) business days of the last business day of the preceding month to the COR. The Contractor shall include activities accomplished in the previous month, planned efforts in the month ahead, and any areas of concern. The Contractor shall also include metrics presenting overall health and progress of program areas for use with high level briefings.

1.10 Provide a monthly briefing to the COR on activities accomplished, planned efforts and any areas of concern.

1.11 Collect and document project deliverables and organize them for FS review.

Transition

1.12 Develop a plan for transitioning services and knowledge from the current Contractor.

1.13 Revise the transition plan based upon Government-provided feedback.

1.14 Execute the transition plan to ensure services are efficiently and effectively transitioned.

1.15 At the end of this contract, plan, cooperate and coordinate with the new Contractor to efficiently and effectively transition services and knowledge.

Subtask 2.1 - Security Policy and Procedure Guidance and Management (focus is primarily NIST 800-53 and related security policies)

2.1.1 Provide expert analysis of new Federal guidance and/or changes to the security environment as it impacts security documentation. This shall include, but is not limited to the release of NIST 800-53 Revision (Rev) 5.

Review and analyze NIST 800-53 Rev 5 and identify changes from Rev 4 to Rev 5.

2.1.2 Support and maintain the confidentiality, integrity, and availability of security documentation.

2.1.3 Provide recommendations to optimize the content, usability, and accessibility of policy and procedure related security policy and procedure documentation.

2.1.4 Draft updates to the Forest Service Manual (FSM) 6680, FSM 6685, and the Secure Corrective Action Plan (SecureCAP) procedures (currently numbering approximately 97 procedures) to reflect NIST 800-53 Rev 5. Identify what changes were proposed and how those changes align with Rev 5. Conduct reviews on the draft updates with

Task 2 – Enterprise Program Guidance and Policy Management (REQUIRED) Outcome: Enterprise program guidance and policies are current and assist FS in complying with all known requirements.

government and contractor points of contact (POCs) and subject matter experts (SMEs).

2.1.5 After government review and acceptance of the proposed FSM and SecureCAP changes, provide final versions of the FSM and SecureCAP procedures.

2.1.6 For the years when Rev 5 is not the focus of the FSM and SecureCAP updates, perform an annual review and recommend improvements to FSM and SecureCAP procedures. Reviews will include gathering input and comments from relevant government and contractor POCs and SMEs.

2.1.7 Annually electronically survey FS security personnel to determine the effectiveness of information security policies, procedures, practices, and security controls to be performed (typical response rate of 30-50 personnel). Survey is currently performed via Survey Monkey. Government users of Survey Monkey must comply with the government terms of use as outlined in the agreement with the government.

2.1.8 Analyze survey responses and develop a report of findings, metrics, and recommendations.

2.1.9 Include summary of efforts for the policies, procedures, and guidance analyzed as well as metrics as part of the MPPR.

Subtask 2.2 - Regulatory and Legislative Analysis

2.2.1 Provide subject matter expertise in tracking and analyzing relevant, newly passed legislative or introduced Office of Management and Budget (OMB), NIST, USDA, and FS requirements.

2.2.2 Based on the analysis and anticipated impacts, develop security recommendations for updating policies, procedures, and guidance with proposed draft update(s) tailored to FS needs.

2.2.3 Include a list of tracked and analyzed legislation, guidance and requirements as part of the

MPPR.

3.1 Provide support for verifying compliance with OMB Circular A-123.

3.2 Develop, update and execute test plans of the OMB Circular A-123 internal control assessments for up to 50 FS information systems and 40 selected controls annually.

3.3 Determine, gather, examine, and analyze artifacts related to OMB Circular A-123 security control assessments and remediation verification.

3.4 Enter test results and artifacts into the USDA CSAM repository.

3.5 Document assessment activities and results in sufficient detail to enable external review of all assessment processes, activities, results, and conclusions.

Task 3 – Oversight and Compliance Verification (REQUIRED) Outcome: Thorough, complete and accurate OMB Circular A-123 reviews are conducted that document strengths and deficiencies in internal controls, and provide practical actionable recommendations to address deficiencies.

3.6 Support USDA A-123 Team review of assessment activities, reports, and conclusions.

3.7 Provide recommendations and guidance for corrective action of all non-compliant security controls.

3.8 Provide security expertise to verify security controls are implemented, resulting documentation and artifacts are current and monthly reporting of artifact and POA&M status and metrics.

3.9 Provide guidance to key stakeholders on the necessary components to demonstrate the achievement of control objectives.

3.10 Include updated information on oversight and compliance verification activities in the MPPR.

Subtask 4.1 – Contingency Planning, Documentation, and Evaluation

4.1.1 Develop an annual Information System Contingency Planning (ISCP) program of work plan and schedule based on age of previous documents, required update cycles, and system updates.

4.1.2 Develop and/or annually revise IT Business Impact Analysis (BIAs) to include business processes and IT dependencies for up to 50 approved or in-progress FS IT systems.

4.1.3 Utilize virtual means to collect BIA data to include, but not limited to survey forms, telephone calls, and electronic mail.

4.1.4 Perform annual review and analysis of CIO Continuity of Operation (COOP) related documentation, ISCPs, and other recovery plans for NIST, USDA, FS, and other Federal policy and standards compliance in order to produce checklists for up to 50 approved or in-progress FS IT systems.

4.1.5 Annually update the nation-wide FS CIO’s COOP plans based on age of previous documents, required update cycles, and organizational changes.

4.1.6 Create and/or annually revise CIO Crisis Management Plans (CMP), Business Resumption Plans (BRP), communications and other contingency related documents or plans based on age of previous documents, required update cycles, and organizational changes.

4.1.7 Utilize USDA and/or FS templates where available for plans, checklists, and reports.

4.1.8 Monitor and track IT system Contingency Plan (CP) program related document postings in the USDA CSAM tool to produce quarterly status reports with relevant metrics.

4.1.9 Include summary of efforts and metrics as part of the MPPR.

Subtask 4.2 – Contingency Plan Exercise and Training

4.2.1 Conduct and document annual notification drills for up to 50 approved FS IT system

ISCPs. One drill to be conducted each fiscal year.

4.2.2 Conduct and document annual table top exercises for all FS IT systems with current

Task 4 – Survivability and Contingency Program Support(REQUIRED) Outcome: Contingency planning produces accurate documentation and results in effective exercises and training that demonstrate FS information system resiliency.

ISCPs during the winter of each calendar year for up to 50 approved or in-progress IT systems.

4.2.3 Conduct and document annual table top CIO COOP exercise for enterprise level leadership and personnel.

4.2.4 Observe and document recommendations from tabletop and/or functional COOP or other CP related exercises at nation-wide FS sites for up to two locations each calendar year.

4.2.5 Produce test plans, draft after action reports, final after action reports, and other documents for government review and comment. Utilize USDA and/or FS templates where available.

4.2.6 Manage FS CIO COOP SharePoint site to include updates of membership, posting relevant COOP related documents, and performing quarterly reviews of content and membership.

4.2.7 Include summary of efforts and metrics as part of the MPPR.

Subtask 5.1 Continuous Monitoring Program Support

5.1.1 Monitor monthly NIST-compliant continuous monitoring process across all FS major information systems to provide monthly reports and metrics to FS senior management on the security protections of FS major information systems.

5.1.2 Support annual assessment of a USDA identified subset of security controls (all key controls plus one third of the remaining controls) across all of the approximately 45- 50 information systems. Support shall include: identifying recommended artifacts for applicable controls; providing guidance to system Information System Security Officers (ISSOs) regarding self-assessments; and conducting re-performance testing on methods, objects and findings as well as artifacts provided by the ISSOs.

5.1.3 Validate and enter test results and artifacts into the USDA Cyber Security Assessment and Management (CSAM) repository.

5.1.4 Provide recommendations and guidance for corrective action of all non-compliant security controls to conform to USDA Plan of Actions and Milestones (POA&M) guidance. For planning purposes, the number of open POA&Ms may vary between 100 and 300 at any given time across all FS systems.

5.1.5 Provide monthly artifact tracking and metrics information to each ISSO and System Owner (SO).

5.1.6 Characterize applications/tables as a minor application, major application or neither (more like a utility, not an application).

5.1.7 Update categorization of up to 50 major systems in accordance with Federal Information Processing Standards (FIPS) 199, Standard for Security Categorizations of Federal Information and Information Systems annually.

5.1.8 Organize, track, visually display, and facilitate a drill down capability for information for all FS Risk Based Decisions (RBDs). This analysis provides information on what risks have been accepted across the FS enterprise, when the RBDs require annual review and

Task 5 – Assessment and Authorization Support (REQUIRED) Outcome: Thorough, consistent and accurate reviews are completed with detailed findings and recommendations that address best practices in complying with federal and USDA requirements.

re-signature, etc. RBDs are used to allow the system to remain operational even with controls that are not fully in place. RBDs must be reviewed and re-signed annually, and must be tracked to ensure compliance with the annual requirements.

5.1.9 Evaluate inherited controls that are not in place to determine what needs to be done to mitigate the risk and communicate information about those to FS cyber leadership.

5.1.10 Include updated information on continuous monitoring activities in the MPPR.

Subtask 5.2 Assessment and Authorization Support The contractor shall:

5.2.1 Conduct Assessment and Authorization (A&A) package reviews for USDA Six Step

RMF Process to ensure compliance for all FS information systems annually. A&A packages include: the System Security Plan, Privacy Threshold Assessment, Privacy Impact Analysis, Contingency Plan, Configuration Management Plan, and other documents as required. This shall be a high level review for completeness and accuracy prior to submission to USDA.

5.2.2 Prepare and/or revise A&A packages of information systems for USDA review for up to 50 IT systems per calendar year.

5.2.3 Review and/or revise all FS A&A supporting documentation to ensure consistency across interrelated A&A package components including required revisions in CSAM database.

5.2.4 Provide security expertise and guidance to ensure the consistent application of FS A&A processes across all major information systems.

5.2.5 Provide monthly report on the status and metrics for all FS A&A materials and supporting documentation. Include recommendations for A&A processes.

5.2.6 Provide A&A expertise in the application of best practices to standardize and enhance FS A&A processes, ensuring compliance with both Federal and USDA requirements.

5.2.7 Include a summary of efforts and metrics as part of the MPPR.

4.2 Optional Tasks

In addition to the Required Tasks, the Contractor may also be required to complete the following Optional Tasks, should the Government exercise the tasks.

Optional Tasks

6. Centralized Account Management 8. ISSO Support

7. IT Security Process Improvement 9. Framework/Strategy Refresh and Monitoring

6.1 Provide an assessment of the technical requirements and guidelines of FS centralized

Task 6 – Centralized Account Management (OPTIONAL) Outcome: Centralized account management is optimized to ensure security and compliance with guidelines.

account management including review of the consistent management of user, privileged, and system accounts.

6.2 Provide recommendations for the improvement of user, privileged, and system centralized account management.

6.3 Provide database support, maintenance and updates for existing and improved centralized account management system for new end user needs as well as changes in data input.

Database is currently a SQL database and is called the Computer Access Tracking System

(CATS).

6.4 Continue to provide support to implement the Enterprise Entitlement Management Service (EEMS) feed from USDA to be utilized as a primary feed to CAM/CATS.

6.5 Code and support updates and future enhancements to CATS, including specified automation elements.

6.6 Provide support for migration of necessary CAM/CATS component to Virtual Data Center

(VDC).

6.7 Provide plan/design for future web-based frontend for CATS application.

6.8 Include a summary of efforts and metrics as part of the MPPR.

7.1 Identify and analyze existing IT Security processes and procedures within the agency.

7.2 Provide recommendations to meet new IT Security goals and objectives.

7.3 Optimize underlying processes to achieve more efficient results.

7.4 Align agency business processes to realize IT Security goals.

7.5 Identify and develop a methodology to track National Information Technology Center (NITC) waivers that are signed by the Information System Security Program Manager (ISSPM).

Implement the tracking of NITC waivers.

7.6 Include summary of efforts and metrics as part of the MPPR.

8.1 Develop, correlate and document security assessment test plans.

8.2 Support annual assessment of a USDA identified subset of security controls (key plus one third) across all major information systems.

8.3 Conduct validation testing on remediation measure taken against POA&Ms created in response to discovering validated vulnerabilities or deficiencies.

8.4 Evaluate the impact on system security of proposed changes and report on that impact to the

Information System Owner and the agency ISSPM. Conduct a Security Impact Assessment (SIA) change requests per the Configuration Management Plan.

8.5 Identify, in conjunction with the change management board (CMB), pending system or environmental changes that may necessitate recertification and reaccreditation of the system.

Task 7 – IT Security Operations Process Improvement (OPTIONAL) Outcome: The FS IT Security Program processes employ leading practices for efficiency and effectiveness.

Task 8 – ISSO Support (OPTIONAL) Outcome: Assistance to ISSOs within the FS.

8.6 Provide recommendations and guidance for corrective action of all non-compliant security controls to conform to USDA POA&M guidance. Develop POA&Ms, including milestones for inclusion in CSAM.

8.7 Ensure that the status of tasks necessary to remediate identified system vulnerabilities is correctly and timely reported in the CSAM POA&M database.

8.8 Provide monthly artifact tracking and metrics information. This shall be in accordance with the ISSO calendar.

8.9 Document assessment activities and results for the required security controls in sufficient detail to enable external review of all assessment processes, activities, results, and conclusions.

Summarize assessment activities.

8.10 Provide security expertise to verify NIST Special Publication (SP) 800-53 security controls are implemented, resulting documentation and artifacts are current, and monthly reporting of artifact and POA&M status and metrics.

8.11 Provide guidance to key stakeholders on the necessary components to demonstrate the achievement of control objectives.

8.12 Development and maintain system Configuration Management Plans.

8.13 Coordinate with system administrators in developing and implementing backup and recovery plans and procedures.

8.14 Verify that backup media are being properly handled and stored.

8.15 Review system access lists at least quarterly, to ensure that only authorized individuals have access.

8.16 Train incoming and new ISSOs on the job requirements and help transition responsibilities to them.

8.17 Include summary of efforts and metrics as part of the MPPR.

The Contractor shall:9.1 Review updates to the USDA Risk Management Framework (RMF) and Strategy (40-50 pages in length). Provide annual recommendations with proposed draft updates for the FSM and Secure CAP procedures based on updated to the USDA RMF.

The purpose of this is to manage risk to FS organization and assets.

Task 9 – Framework/Strategy Refresh and Monitoring (OPTIONAL)

Outcome: The USDA Risk Management Framework and Strategy promotes understanding, recognition, acceptance and accountability of FS senior leadership in managing risks of information systems.

5.0 Performance Requirements

Perf Stand

Required Services

Performance Standards Acceptable Quality Level

(AQL)

Monitoring Method

PS-1 Provide required PWS services as specified in PWS paragraph 4.0, Tasks 1 through 5 and Optional tasks 6-9

Work must be accomplished in accordance with (IAW) the following, as applicable:

1. Project Plans

2. Performance Standards

3. Applicable Federal, state, local, USDA and FS policies and guidelines.

No deviation without prior approval from the COR.

COR/designee review of Contractor-provided Monthly Performance and Progress Report and through COR/designee periodic random inspection and customer feedback.

PS-2 Provide deliverables/ reports required for each Task as specified in PWS paragraph 6.1, 6.2, 6.3 and 6.4

Work products/deliverables/ reports; as applicable reports’ analysis are accurate; free of content error; recommendations are applicable to FS environment, address compliance issues and deficiencies; and are free of grammatical errors.

No deviation without prior approval from the COR. No more than one rework for any report per submission.

COR/designee review of random sample of deliverables.

Perf Stand

Required Services

Performance Standards Acceptable Quality Level

(AQL)

Monitoring Method

Deliverables are completed IAW the Project Management Plan.

PS-3 Implement a strong and effective oversight/quality control process as specified in PWS paragraph 4.0, Task 1

The oversight/quality control process proactively identifies and addresses issues, as well as continuously improves the services being provided by the Contractor.

No deviation. COR/designee review of monthly activity reports and random inspection of services.

PS-4 Provide timely and effective transition. As specified in PWS paragraph 4.0, Task Statements

1.12 through 1.14, and paragraphs

8.0 and 9.0

Transition from the incumbent contractor is completed during the Transition/Phase In period and implement transition plan for all activities and services to meet contract objectives by the completion of the transition period, or agreed upon timeframes.

No deviation without prior approval from the COR.

COR/designee review of transition services and Transition Plan.

Performance Standards/Disincentives Unless otherwise negotiated between the Contractor and the Government there will be an initial 60 day ramp-up period before full execution of the performance metrics for tasks/deliverables and associated disincentives will be applied.

Performance Standards.

A higher than satisfactory performance review is achieved during the current year of contract performance when:

1. Deliverables are received on time.

2. The total percentage of report reworks equals 10% or less.

Performance Standards/Disincentives

3. Three or less disincentives have been applied during the year

4. Recommendations implemented result in either technical improvements, cost saving measures, or efficiency gains.

Disincentives.

Inspection and Acceptance guidelines in paragraph 7.3 of this PWS will be followed before disincentives are applied. Unless prior approval is obtained from the COR:

1. Disincentives will be applied after a submitted report requires a second rework, or failure to meet service deadlines occur.

2. The fixed price of tasks will be reduced by 1% first deviation, 5% second deviation, and by 10% for three or more deviations for not providing required deliverables (e.g. reports on time), or meeting required performance standards/acceptable quality levels outlined above.

3. Root Cause Analysis (RCA) will be conducted by the Contractor and submitted to the COR upon the second occurrence of a deviation for the same task or report.

4. Corrective Action Plan (CAP) will be developed by the Contractor and submitted to the COR upon the fourth occurrence of a deviation for the same task or report.

5. No higher than a satisfactory performance review may be achieved when 4 or more disincentives have been applied during the current year of contract performance.

6.0 Deliverables

6.1 Table of Deliverables Under Required Tasks

PWS Task# Title Due Date Appendix B Non-Disclosure Agreement Signed statements are due, from each employee assigned, prior to performing ANY work on this task.

1.2 Draft Project Management Plan No later than (NLT) 10 business days after delivery of final Transition Plan

1.3 Final Project Management Plan NLT 5 business days of receipt of Government feedback; Annually Thereafter; and as requested by the

COR

1.6 Quality Control Plan NLT 10 calendar days after contract

award (DACA); Annually Thereafter and updates as requested by the COR

1.9 Monthly Performance and Progress

Report (MPPR)

NLT 10th of each month; beginning month two of POP

1.12 Draft Transition Plan NLT ten (10) business after start of POP

1.13 Final Transition Plan NLT five (5) business days of

receipt of Government feedback

2.1.1 Security Documentation System

Recommendation and Analysis of the changes in NIST 800-53 Rev 5

NLT one hundred twenty (120) after the start of the POP; and Annually Thereafter

2.1.4 and 2.1.5 Draft Updates to FSM 6680 and 6685 and Secure

CAP

Within six (6) months of the start of the POP; Within six (6) months of the publication of NIST 800-53 Thereafter

2.1.4 and 2.1.5 Final Updates to FSM 6680 and 6685 as well as SecureCAP procedures

Within forty five (45) days of receipt of the government’s comments

2.1.6 Annual Procedure Currency

Review

Annually NLT January 15th

2.1.7 and 2.1.8 Procedure Effectiveness Measurement

NLT one hundred eighty (180) Days after start of the POP; Annually Thereafter

2.2.2 Recommendations Based on New

OMB, NIST, USDA and FS Regulations

Recommendation within sixty (60) days of issuance of new regulations

3.2 A-123 Test Plans In accordance with the Project

Management Plan

3.4, 3.5 and 3.6

A-123 Test Control Assessment Documentation and Compliance Data Entry in CSAM

Annual Reports are developed, reviewed, completed and reported in CSAM by May 1

3.7 Corrective Action Plan

Recommendations

Recommendations developed Annually by June 15

3.8 Artifact and POA&M Status

Report

Report delivered NLT the last day of each month

4.1.1 Contingency Planning Program

of Work Plan

NLT thirty (30) days after the start of the POP; annually thereafter

4.1.2 Business Impact Assessments In accordance with the Project Management Plan

4.1.4 Checklists based on Annual

Review and Analysis of CIO COOP and IT Contingency Plans

Annually from Date of Last Checklist Review

4.1.5 CIO Continuity of Plan Updates In accordance with the Project Management Plan

4.1.6 CIO Crisis Management Plans, Business Resumption Plans and Related Documents

In accordance with the Project Management Plan

4.1.8 CSAM CP Program Status

Reviews

Quarterly from Date of Last Review

4.2.1 Notification Drills As agreed upon with the COR and

documented in the Project Management Plan

4.2.2 Tabletop/Functional ISCP

Exercises

Annually from Date of Last Exercise

4.2.3 Tabletop CIO COOP Exercises Annually from Date of Last

Exercise

4.2.4 COOP and CP Observation

Recommendations

As agreed upon with the COR and documented in the Project Management Plan

4.2.5 After Action Reports Final report due thirty (30) days

after exercise date

4.2.6 Content Updates and

Membership Reviews of SharePoint site

Quarterly from Date of Last Review

5.1.1 IT System Continuous

Monitoring Report

Report delivered NLT the last day of each month

5.1.2 Report of Recommended

Artifacts for Annual Security Assessment

Annually by December 1

5.1.2 and 5.1.3 Test Results in CSAM Within thirty (30) Days of ISSO Completion of Self Assessment

5.1.4 and 5.1.5 POA&M Recommendations and Artifact Tracking Reports

Report delivered NLT the last day of each month

5.1.6 System Categorizations Annually from date of last update

5.1.7 Monthly Report of RBDs Report Delivered NLT the last

day of each month

5.2.1 Security A&A Package Reviews

for Concurrency Review per USDA’s RMF

In accordance with the Project Management Plan

5.2.2 A&A Revisions Including

Required Revisions in CSAM

In accordance with the Project Management Plan

5.2.3 Comments on Implementation

Statement in CSAM

In accordance with the Project Management Plan

5.2.5 A&A Recommendations and

Status Report

Report delivered NLT the last day of each month

6.2 Table of Deliverables Under Optional Tasks

PWS Task # Title Due Date

6.1 Assessment of FS Centralized

Account Management Process Final Plan developed within sixty

(60) calendar days of optional task order award

6.2 Recommendations for Account

Management Improvement

Final recommendations due within one hundred twenty (120) calendar days of optional task

6.3

CATS Phase 1 Application and Database

Deployment package for phase 1 of CATS application and database

6.4 CATS Phase 1 Documentation Documentation to include Design, User guide

6.5

CATS Plan for future enhancements

Plan or Design for future web-based application front-end

7.2 Process Improvement

Recommendations In accordance with the Project Management Plan

7.5 NITC Waiver Tracking NLT the Last Day of Each Month

8.1 Security Assessment Plan Annually from date of last plan.

8.2 Security Control Assessment

Results

Annually per Forest Service System Leveling Plan

8.3 POA&M Closure Request As needed

8.4 and 8.5 Security Impact Assessment As needed

8.6 Draft POA&M Request As needed

8.8 ISSO Calendar Updates Monthly

8.9 Assessment Spreadsheet Annually

8.12 System Configuration Management

Plan

Annually

8.15 System Access Review Quarterly

9.1 Recommendations for

updates to FSM and SecureCAP based on the

RMF

In accordance with the Project Management Plan

6.3 Delivery Method

Electronic copies shall be delivered using Microsoft (MS) Office suite (e.g., MS WORD, MS EXCEL, MS POWERPOINT, MS PROJECT, or MS ACCESS format), unless otherwise specified by the COR. These MS Office Suite, and other deliverables/artifacts shall be 508 compliant. In addition, any media and websites the contractor will be responsible for developing, managing, or maintain for the FS in support of this contract shall be 508 compliant.

Electronic submission shall be made via email, unless otherwise agreed to by the COR. Should the size of a deliverable require that it be placed upon a compact disk (CD) or digital versatile disc (DVD), the Contractor shall prepare and deliver to the COR an individual envelope containing the CD/DVD. As appropriate, this envelope shall contain one or more CD/DVDs.

CDs and DVDs must include proper labeling (e.g., classification markings, Personally Identifying Information [PII]).

6.4 Inspection and Acceptance

The Government will perform Inspection and Quality Assurance in accordance with the contract Quality Assurance Surveillance Plan (QASP). The Government has the right to perform periodic surveillance of the Contractor to ensure that the Contractor’s work products and Quality Control processes are in compliance with the contract requirements. The Government and the Contractor will coordinate Government surveillance in a manner that will not unduly delay or disrupt the Contractor’s performance of the contract.

The COR will have ten (10) business days by close of business (COB) to review draft deliverables and make comments. The Contractor will have ten (10) business days by COB to make corrections (known as rework #1). Upon receipt of the final deliverables, the COR/designee will have five (5) business days by COB for final review prior to acceptance or providing documented reasons for non-acceptance. Should the Government fail to complete the review within the review period the deliverable will become acceptable by default.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR/designee of the specific reasons for rejection. The Contractor shall have five (5) workdays by COB to correct the rejected deliverable and return it per delivery instructions.

COB will be considered Mountain Standard Time unless otherwise specified by the COR.

7.0 Key Personnel

The Contractor shall employ and maintain personnel in the management and key staff positions who meet the minimum qualifications for each of the skill levels to which they are assigned, and shall be capable of performing the functions described in the Contractor’s staffing plan submitted with their proposal. The following positions are considered key personnel under this task order: the role of Project Manager (PM) and the Task Managers.

Qualifications and resumes for all key personnel positions listed above include a minimum of five (5) years relevant experience and industry best practice professional certifications/training commensurate with the position title.

Project Manager: The Contractor shall designate a PM as the single POC with FS for communications issues, concerns, or problems that arise on this task order. The PM shall have the authority to commit the Contractor and make decisions for the Contractor, and shall be the single Contractor representative responsible for all issues, concerns, or problems. The PM shall readily respond to FS questions, concerns, and comments. The PM shall proactively alert FS to potential contractual issues. The PM must be available during normal duty hours, as specified herein to meet (either in person or by phone) with Government personnel within 24 hours to discuss problems.

Task Managers: Each task shall have a designated manager who will be responsible for day to day management of the task, in collaboration with the Project Manager. The Task Managers shall be ready to respond to government SMEs and other personnel regarding their task area(s), including status of work, information upcoming activities, and completed activities.

During the first ninety (90) days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer (CO) within fifteen (15) calendar days after the occurrence of any of these events and provide information to the Contracting Officer at least fifteen (15) days prior to making any permanent substitutions.

Resumes and commitment letters for key personnel to be substituted or added, will be sent to the CO for file.

8.0 Transition Period

To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the contractor shall have sufficient personnel on board thirty (30) days prior to the start of the performance period to begin transition phase in. During the phase in period, the contractor shall become familiar with performance requirements in order to commence full performance of services on the contract start date.

To provide for continuity of service the successor contractor shall be furnished phase-in training by the incumbent. Incumbent and successor contractors shall develop the transition plan determining the nature and extent of phase-in/phase-out services required. The plan shall identify training to be performed, a list of the documentation, and contract related artifacts to be transferred from the incumbent to the successor, and a date when responsibilities are transferred from the incumbent to the successor contractor. The successor contractor shall receive all documentation necessary to provide uninterrupted contract services.

9.0 Period of Performance

Contract Start Date: April 1, 2018 Period of Performance: 1 year (04/01/2018 to 03/31/2019) with three Option years

Option Schedules:

Option 1: subsequent 1 year from date of base (04/01/2019 to 03/31/2020) Option 2: subsequent 1 year from date of Option 1 (04/01/2020 to 03/31/2021) Option 3: subsequent 1 year from date of Option 2 (04/01/2021 to 03/31/2022)

10.0 Place of Performance

The Contractor shall perform the requirements at its facilities.

11.0 Travel

The Government anticipates that performance of this order may require travel. The exact locations and times of these trips will be identified on a case by case basis. Potential travel can be expected to the Albuquerque Service Center in New Mexico and the WO in Washington, District of Columbia (DC). Typically travel will not exceed five (5) business days.

Prior approval of contractor travel is required. Travel requests shall include an estimate of expenses and must be approved by the COR a minimum of one week before requested travel dates. Request will be submitted electronically by email.

Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. Travel costs shall be incurred and billed in accordance with Federal Acquisition Regulations (FAR) Part 31. Approval, and costs for these expenses will be reviewed and certified by the COR and approved by the Contracting Officer. All travel and transportation shall utilize commercial sources and carriers provided the method used for the appropriate geographical area results in reasonable charges to the government.

The Government will not pay for business class or first-class travel. Travel expenses shall be reimbursed in accordance with the standard General Services Administration (GSA) per diem rates and the Federal Travel Regulation. No overhead or general and administrative expenses shall be added to travel costs.

The Contractor shall request travel using the form in Appendix G. The travel form shall be submitted to the designated FS ISSO for review and endorsement prior to submission to the

COR.

12.0 Government Furnished Facilities/Equipment/Software/Information

The Contractor shall maintain an inventory accounting system for Government Furnished Equipment (GFE), Government Furnished Software (GFS), and other Government Furnished Tools. The Contractor shall provide the COR with the information necessary to manage GFE.

All Government Property should be maintained per FAR 52.245-1.

12.1 Government Furnished Facilities

It is anticipated that all work will take place at the contractor facilities. If work requires on-site work at the Government’s location, the Government will provide:

• Utilities such as adequate power, air conditioning, Internet access and phones with commercial long distance access (only to be used for Government tasks) and speaker capability for conference calls and hands free sets,

• Access to commercial long distance facsimile (only to be used for Government tasks),

• Laser printer access, either as individual units with supplies, or an office network printer with local area network (LAN) card, and

• Access to local copiers, supplies, shredder to control the disposal of Privacy Act

Materials.

12.2 Government Furnished Equipment / Software

The Government shall provide: Personal Computers (PCs) with the FS image and access to FS systems.

12.3 Government Furnished Information

The Government shall provide FS IT systems security documentation, policies, procedures, correspondence, inventories, and applicable background material.

13.0 Contract Administration

The COR is responsible for the technical direction of the contract work. In no event, however, will any understanding, agreements, modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the Government unless formalized by proper contractual document executed by the CO prior to completion of the contract.

The CO shall be informed as soon as possible of any actions or inactions by the contractor or the Government which may affect the price, required delivery or completion times stated in the contract, so that identified desired changes and outside influences on the contract may be modified as necessary. Whenever, in the opinion of the contractor, the COR requests efforts outside the scope of the contract, the contractor shall advise the COR. If the COR persists and there still exists a disagreement as to proper contractual coverage, the CO should be notified immediately, preferable in writing if time permits. Proceeding with work without proper contractual coverage could result in non-payment.

A copy of the COR delegation letter shall be provided to the Contractor five (5) days after award.

The CO is the only person authorized to approve changes. This authority remains solely with the CO. In the event that the Contractor affects any changes at the direction of any person other than the CO, the changes will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase incurred as a result thereof.

14.0 Clauses

14.1 Information Assurance

By accepting this contract, the Contractor providing IT services to the US FS agrees to comply with the applicable IT security policy as outlined in this document. The Contractor and other external organizations will be responsible for IT security for all systems connected to the FS network or operated by the Contractor and other external organizations for the FS, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or electronic access to FS sensitive information that directly support the mission of the FS. The term 'information technology', as used in this clause, means any equipment or interconnected system or subsystem of equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by OMB Circular A-130.

15.0 Protection of Information

15.1 Dissemination of Information/Publishing

The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

The Contractor or other external organization will not publish or disclose in any manner, without the FS Contracting Officer's written consent, the details of any programs, documentation, data, or safeguards either designed or developed by the Contractor or other external organization under this Contract or otherwise provided by the Government.

Contractor may be required to sign non- disclosure or other appropriate security agreements.

A written agreement between the FS and any contractors and other external organizations will be entered into before FS data and information otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The contractor and other external organizations will agree to establish and follow security precautions considered by the FS to be necessary to ensure proper handling of data and information. As may be identified elsewhere in this contract, the Contractor agrees that:

• The draft and final deliverables and all associated working papers and other materials deemed relevant by the COR that have been generated by the Contractor in the performance of this contract are the property of the U.S. Government and must be submitted to the COR at the conclusion of the tasks.

• All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor's or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of FS information.

Cooperation may include providing relevant documentation showing proof of compliance with Federal and agency requirements, and rendering other assistance as deemed necessary.

If new or unanticipated threats or hazards are discovered…