Cyber_Range_2024_Re-bid_Draft_SOW_Clean_v2_1.pdf

Version 2 – Dated 05/15/2024

Project Title HHS-OIG Cyber Range Managed Cloud Services

Background The Department of Health and Human Services (HHS), Office of Inspector General (OIG), has a critical mission: to provide objective oversight that promotes the economy, efficiency, effectiveness, and integrity of HHS programs. Additionally, the OIG aims to safeguard the health and welfare of the people these programs serve. Since its establishment in 1976, the OIG has been at the forefront of the nation’s efforts to combat fraud and abuse within Medicare, Medicaid, and over 300 other HHS programs.

As the largest Inspector General office in the federal government, the HHS OIG boasts a dedicated team of approximately 1650 personnel committed to combating fraud, waste, and abuse while enhancing the efficiency of HHS programs. Most of the OIG’s resources are directed toward overseeing Medicare and Medicaid, which constitute a significant portion of the federal budget and directly impact our country’s most vulnerable citizens.

Beyond Medicare and Medicaid, the OIG’s oversight extends to programs under other HHS Operational Divisions, including, but not limited to the Centers for Disease Control and Prevention, the National Institutes of Health, and the Food and Drug Administration. To fulfill its mission, the OIG conducts audits, evaluations, and investigations, provides guidance to industry stakeholders, and, when necessary, imposes civil monetary penalties (CMP), assessments, and administrative sanctions.

As appropriate, OIG works with HHS staff and operating divisions, the Department of Justice (DOJ), other executive branch agencies, Congress, States, and private sector representatives to achieve systemic improvements, improved compliance, successful enforcement actions, and recovery of misspent funds. OIG work is conducted in accordance with the Council of the Inspectors General on Integrity and Efficiency (CIGIE) Quality Standards for Inspection and Evaluation, the U.S. Government Accountability Office (GAO) Government Auditing Standards, and the CIGIE Quality Standards for Investigations.

The Office of Audit Services (OAS), Cybersecurity and Information Technology Audit Division (CITAD) within the HHS-OIG is tasked with auditing the information technology (IT) programs and resources developed and maintained by HHS Operating Divisions (OpDivs) and health care providers. Their work is crucial in detecting and correcting vulnerabilities and weaknesses in computer systems, ensuring an efficient and secure IT environment. To facilitate CITAD’s work, a cloud hosted “Cyber Range” is used for audit support, penetration tests, research, and training.

General System Description The OIG HHS Cyber Range is an isolated public cloud environment, hosted separately from any other HHS-OIG resources or infrastructure, dedicated to supporting IT performance auditing and assessment responsibilities within our organization. Hosted on Amazon Web Services (AWS) in the US East/West cloud region, this environment is maintained by both Federal and contract staff.

The Cyber Range currently consists of several key components: Amazon Elastic Compute Cloud (EC2) General Support Systems (GSS), which form the backbone of the Cyber Range, providing the necessary infrastructure for our auditing activities; endpoints equipped with auditing tools deployed on various EC2 instances, and the use of virtualization technologies to facilitate audit procedures such as penetration tests.

The Cyber Range also serves as a vital resource for our IT audit staff. Within this secure environment, we rigorously assess systems and networks to identify weaknesses and exploitable vulnerabilities all from within a controlled and secure environment. Our penetration testers can simulate a client’s network setup, including their specific software. This allows us to test various attack scenarios and exploits before conducting live penetration tests on the client’s network.

Currently, approximately 15 cyber auditors actively utilize and administer the Cyber Range.

Beyond audits, it serves as a hands-on training ground for ongoing professional development in IT audit tools, understanding vulnerabilities, and implementing effective countermeasures.

Additionally, OIG contractors that provide penetration test services may leverage this lab platform for conducting comprehensive IT audits.

Purpose The objective of this contract action is to procure a Managed Cloud Service Provider (CSP) for proactive and on-demand operations, maintenance, monitoring, cost optimization, and support of the public cloud hosted Cyber Range. Specifically, the CSP will manage an existing Cyber Range hosted within the Amazon Web Services (AWS) Cloud Environment, and if optional task 10 is executed on, expansion into Microsoft Azure.

Period of Performance The anticipated period of Performance of this contract is as follows:

Base: September 20, 2024, to September 19, 2025 OP1: September 20, 2025, to September 19, 2026 OP2: September 20, 2026, to September 19, 2027 OP3: September 20, 2028, to September 19, 2029 OP4: September 20, 2029, to September 19, 2030 OP5: September 20, 2030, to September 19, 2031

OP6: September 20, 2031, to September 19, 2032 OP7: September 20, 2032, to September 19, 2033 OP8: September 20, 2033, to September 19, 2034 OP9: September 20, 2034, to September 19, 2035

Anticipated Award Type The Government anticipates an award of a hybrid type task order with Time & Materials (T&M) for the cloud hosting charges, and Fixed-Price (FP) for labor.

Place of Performance The location of the work will be performed offsite at the contractor’s location, within the borders of the United States of America (Continental United States (CONUS). HHS-OIG will not provide onsite workspace for this effort.

Government Furnished Property HHS-OIG will not provide the contractor with Government Furnished Equipment (GFE) laptops and/or cellular phones to perform any of the tasks on this contract.

Hours of Operation OAS CITAD’s Cyber Range operates 24 hours per day, 7 days per week, 365 days a year.

Regular business hours are Monday through Friday 6:00am to 7:00pm Eastern Standard Time excluding government holidays. Regular coverage shall be provided during these hours to support the various tasks within this contract.

After hours support will be required for work deemed too risky or disruptive to be performed during regular business hours.

Government Holidays:

(a) Government personnel observe the following days as holidays:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays

(b) It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the contract. No form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than normal compensation for the time worked. This provision does not preclude reimbursement for authorized overtime work if applicable to this contract.

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays

(c) When the Federal, State, Local or other Governmental entity grants excused absence to its employees, the contractor must continue to provide sufficient personnel to perform critical tasks already in operation or scheduled and must be guided by the instructions issued by the Contracting Officer (CO) and Contracting Officer’s Representative (COR).

General Requirements

Hosting Requirements The Government requires a Contractor with AWS and Azure certifications and partnerships to effectively manage and monitor OAS CITAD’s Cyber Range using Cloud Managed Service models as necessary. Offerors for the OAS CITAD’s Cyber Range must strictly adhere to all published AWS Service Level Agreements (SLAs) and provide these SLAs to the OIG as appropriate.

For any cloud service solution (e.g., but not limited to: Infrastructure as a Service, Platform as a Service, Software as a Service) deployed or utilized by the Contractor as part of its proposed solution to support the HHS OIG Cyber Range, it must be Federal Risk and Authorization Management Program (FedRAMP) authorized. The Contractor is obligated to make sure that their proposed solution meets all relevant FedRAMP, Federal Information Security Modernization Act (FISMA), White House, and Cybersecurity and Infrastructure Security Agency (CISA) mandates.

Specifically, the Contractor’s responsibilities encompass comprehensive cloud management services, including provisioning, monitoring, scaling, and maintenance of the HHS OIG Cyber range cloud infrastructure, including but not limited to EC2, S3 Storage, Subnets and network components, Virtual Firewalls, load balancers, etc.; ensuring high availability, security, and compliance.

The environment currently consists of:

2 Virtual Firewall appliances 2 VPC’s 23 subnets 15 EC2 instances (Windows Server 2019, Oracle Linux 9, Ubuntu Server 22.04, Debian 11) 63 S3 buckets

The environment is expected to grow in FY25 by:

7 EC2 instances

1 VPN

2 Subnets

Quality Assurance The COR will meticulously review preliminary or draft documentation submitted by the Contractor to ensure quality and completeness. If necessary, the COR may return the documentation to the Contractor for corrections. It is important to note that the absence of comments from the COR does not absolve the Contractor of their responsibility to comply with the requirements outlined in the work statement.

Final approval and acceptance of the documentation will be conveyed through a formal letter of approval and acceptance issued by the COR. However, the Contractor should not interpret any letter acknowledging receipt of material as a waiver of review or an acknowledgment that the material fully conforms to the work statement. Approval granted during the documentation preparation phase or approval for shipment does not guarantee final acceptance of the completed documentation.

Additionally, the Contractor is tasked with proposing a Quality Assurance Surveillance Plan (QASP). This plan must align with the approach the Contractor has put forth to fulfill the OIG’s requirements. It should also outline how the Contractor will verify and document that the government receives the expected quality of services as specified in the contract. The OIG reserves the right to accept the proposed QASP or make modifications as needed.

The following general quality measures will be applied to each deliverable received from the Contractor under this effort:

1. Accuracy: Deliverables must be precise in presentation, technical content, and adherence to accepted elements of style.

2. Clarity: Deliverables should be clear and concise. All diagrams must be easy to understand and relevant to the supporting narrative.

3. Consistency with Requirements: All deliverables must fully satisfy the requirements outlined in the Statement of Work (SOW).

4. File Editing: All text and diagrammatic files must be editable by the Government.

5. Format: Deliverables will be submitted in digital format where applicable and in media mutually agreed upon prior to submission. Digital formats will adhere to any specified directives or manuals.

6. Timeliness: Deliverables will be submitted on or before the due date specified herein or submitted in accordance with a later scheduled date determined by the Government.

Contingency Plan The Contractor will be required to evaluate and test existing contingency plans and perform an annual disaster recovery test to validate the plan is effective. The test should include but not be limited to a live failover of the virtual firewalls, testing backup and restore capability of EC2 instances, restoring remote connectivity to the environment and reconstituting the environment in the event of a regional datacenter loss (US East).

Incident Response FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor), shall:

1) Protect with FIPS 140-2 validated encryption all sensitive information, including any Personally Identifiable Information (PII) created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident.

2) NOT notify affected individuals unless so instructed by the Contracting Officer and designated representative. If so, instructed by the Contracting Officer and representative, the Contractor shall send notifications to affected individuals as expeditiously as practicable, without unreasonable delay, and in accordance with applicable law.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the COR, CO and other stakeholders, including incidents involving PII, exploit attempts for zero days that the Cyber Range is not patched for; in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail;

and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, HHS, and OIG incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

Service Level Agreements For tickets, requests, problems, and incident resolution

Severity Level Title Description Initial

Response Incident

Designation Problem

Resolution 1 Emergency Production system is halted and/or data has been corrupted. If there is no reasonable workaround available, a patch may be produced. This could also be when a user no longer has access to the system. When an acceptable workaround is provided the incident shall be downgraded to a lower priority.

05 Min 4

20 Min 5 1 hours 4 hours

2 High A feature or system is inoperable without a workaround; and normal business operations are disrupted.

10 Min 4

30 Min 5 2 hours 12 hours

3 Medium A feature or system is inoperable with acceptable workaround to be used on an interim basis until ticket is addressed with a more effective workaround and/or fix.

20 Min 4

1 Hour 5 6 hours 3 days

4 Low Little impact on the business and application. May involve updates to vendor documentation and documentation errors.

30 Min 4

1 Hour 5 24 hours 5 days

1) Initial phone response from Contractor acknowledging incident and severity level to

Designated OIG Representatives.

2) Contractor shall determine and communicate the type of problem and approach to resolution with the OIG.

3) Contractor shall provide correction or a satisfactory interim workaround to the OIG.

4) Incident, issue, or request reported during Normal Business Hours.

5) Incident, issue, or request reported outside Normal Business Hours.

Examples of additional service levels are:

http://aws.amazon.com/ec2/sla/ (or Equivalent Service Level) Amazon Compute Service Level Agreement

Monthly Uptime Percentage Service Credit Percentage 99.0% <= 99.99% 10% 95.0% <= 99.0% 30%

95.0% < 100% http://aws.amazon.com/s3/sla/ (or Equivalent Service Level) Amazon S3 Service Level Agreement

For all requests not otherwise specified below:

Monthly Uptime Percentage Service Credit Percentage

99.0% <= 99.9% 10% 95.0% <= 99.0% 25%

For requests to S3 Intelligent-Tiering, S3 Standard-Infrequent Access, and S3 One Zone- Infrequent Access:

Monthly Uptime Percentage Service Credit Percentage 98.0% <= 99.0% 10% 95.0% <=98.0% 25%

95.0% 100% http://aws.amazon.com/rds/sla/ (or Equivalent Service Level) Amazon RDS Service Level Agreement

Monthly Uptime Percentage Service Credit Percentage 99.0% <= 99.95% 10% 95.0% <= 99.0% 25%

· http://aws.amazon.com/ec2/sla/ (or Equivalent Service Level)

· http://aws.amazon.com/s3/sla/ (or Equivalent Service Level)

· http://aws.amazon.com/rds/sla/ (or Equivalent Service Level) https://aws.amazon.com/legal/service-level-agreements/?aws-sla-cards.sort-by=item.additionalFields.serviceNameLower&aws-sla-cards.sort-order=asc&awsf.tech-category-filter=*all

The Contractor shall provide a financially backed penalty schedule for not meeting each of the SLA targets.

Contractor shall pay all AWS costs and 3rd party charges on time so as not to risk the shut off or removal of OIG services and data. The Contractor shall provide OIG necessary access to all AWS billing accounts and to all third-party software license agreements purchased under this contract.

Project Timeline and Deliverables

In fulfillment of this effort, the Contractor shall be required to provide deliverables after the award date. All deliverables shall be submitted to the Contracting Officer’s Representative (COR), unless otherwise agreed upon. Unless otherwise specified, the Government will have a maximum of ten (10) business days from the day the draft deliverable is received to review the document, provide comments back to the Contractor, approve or disapprove the deliverable(s). The Contractor will also have a maximum of ten (10) business days from the day comments are received to incorporate all changes and submit the final deliverable to the Government. All days identified below are intended to be workdays unless otherwise specified.

Deliverable Method of Delivery Description

Within 90 days of Notice to Proceed (NTP) and updates, as required

Email to CO and COR Quality Assurance Surveillance Plan (QASP)

Upon Award plus 7 days Kickoff Meeting via teleconference

The Contractor shall have an initial Business and Technical meeting within seven (7) business days following the award date, the Contractor shall meet the Contracting Officer, COR, and OIG management team to review goals and objectives of the task order and to discuss technical requirements.

Upon Award plus 14 days Task 2-Contractor Account Transfer/Access to AWS Cyber Range, Resources

The Contractor shall obtain access to the Cyber Range AWS master payer account and Cyber Range resources within 14 days following the reward.

https://aws.amazon.com/legal/service-level-agreements/?aws-sla-cards.sort-by=item.additionalFields.serviceNameLower&aws-sla-cards.sort-order=asc&awsf.tech-category-filter=*all https://aws.amazon.com/legal/service-level-agreements/?aws-sla-cards.sort-by=item.additionalFields.serviceNameLower&aws-sla-cards.sort-order=asc&awsf.tech-category-filter=*all https://aws.amazon.com/legal/service-level-agreements/?aws-sla-cards.sort-by=item.additionalFields.serviceNameLower&aws-sla-cards.sort-order=asc&awsf.tech-category-filter=*all

Upon Award plus 30 days Cyber Range Lab managed service capabilities shall be available

Within 30 business days after award, the Contractor has oversight of the AWS Cyber Range master payer account and is ready to begin providing service.

Weekly status of transition activities

Email to CO and COR Contractor to schedule kickoff conference call with the OIG team.

Weekly Teleconference with CO, COR

Email to CO and COR

Contractor to schedule weekly status calls and provide status report of deliverables, tasks, continuous monitoring results, highlight of scope accomplished, progress on corporate and Contract specific performance metrics, and status of milestones.

Within 2 days after every meeting

Email to CO and COR Contractor to develop Meeting minutes and written description of any substantive issues or concerns, and action items identified at a meeting.

Security The Contractor shall implement robust security measures to safeguard sensitive data, comply with Federal Information Security Management Act (FISMA) requirements, and adhere to Federal and agency-specific security guidelines. In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems to ensure:

a. Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

b. Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

c. Availability, which means ensuring timely and reliable access to and use of information.

b. Enforce Federal security controls on any Contractor workstations, and information contained therein, connected to an HHS network, or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the CO and COR.

c. Adopt and implement HHS and Federal policies, procedures, controls, and standards to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR and emailing fisma@hhs.gov. In addition, obtain HHS OIG technical implementation procedures and standard operating procedures by contacting the CO/COR.

FISMA Rating

The HHS-OIG Cyber Range System, as described in this SOW, has a FISMA Moderate FIPS 199 classification. At all times, the Contractor shall comply with FISMA and OMB Circular A- 130 to the extent applicable. The Contractor shall agree to assist the Government in its compliance with the requirements set forth in FISMA, by successfully completing and maintaining the A&A granted for the HHS OIG Cyber Range. If during the term of this contract there are changes to the data protection and privacy laws and regulations, including FISMA, or if there are new US Federal Government requirements applicable to the Government, the Contractor and the Government will address these changes in a mutually agreed upon Change Management Process.

Risk Identification

The Contractor shall work with the Government to continuously identify and evaluate possible risks and their mitigation across the areas of design, knowledge, resourcing, and technical environments.

Security Assessment & Authorization (A&A)

The Contractor must maintain FedRAMP for tools used to fulfill the technical requirements of this contract. The contractor must maintain FISMA Assessment and Authorization (A&A) compliance. Continuous Monitoring services are to be provided by the Contractor as described in the next section.

The Contractor must follow NIST SP 800-37, 800-34, 800-18, 800-30, 800-60, 800-53, 800- 53A, Federal Information Processing Standards (FIPS) 199 and 200.

The Contractor will work with HHS-OIG to continuously monitor and enforce Federal and HHS security controls on the Cyber Range cloud environment. The Contractor will provide and maintain supporting documentation to HHS-OIG as necessary for the A&A process.

mailto:fisma@hhs.gov

The Contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, to verify compliance with the requirements for an Information Technology security program.

The Government reserves the right to conduct inspections. The Contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

The Contractor will take appropriate and timely action per HHS and Federal requirements to correct or mitigate any weaknesses discovered during security control testing, generally at no additional cost.

Privacy

Use of Personally Identifiable Information (PII)

The Contractor shall always comply and agree to protect the Government's information and data in accordance with the terms of this task order. The Contractor shall not use any Personally Identifiable Information, E-mail Groups, Lists, or contract information for any purpose other than those activities necessary for the performance of this task order.

Transfer of Personally Identifiable Information (PII)

Personal information collected or otherwise processed by the Contractor in the performance of this task order should be transferred to, stored, and processed in the United States. The primary locations shall be the primary and backup data centers located in the United States. In addition, other locations include the location of the Contractor support teams who provide support to the Government support teams in resolving issues involving the task order solution or locations where backup or archiving facilities may be agreed to with the Government or where the antivirus and other security scans are performed.

Confidentiality and Nondisclosure of Information.

Any information provided to the Contractor (and/or any subcontractor) by HHS OIG or collected by the Contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS policies. Unauthorized disclosure of information will be subject to the HHS-OIG sanction policies and/or governed by the following laws and regulations:

a. a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-3 validated solution.

Specific Tasks

Task 1 – Contract and Project Management

The Contractor shall:

1) Be responsible for taking over the AWS master payer billing account from the incumbent Contractor, if necessary.

2) Demonstrate an overall understanding of Cyber Range enterprise environment and its interconnections, the OIG’s mission, and adequacy and feasibility of plans to address all tasks in the SOW.

3) Develop a Management Plan that describes the methodology for managing the overall Project resources and management of cloud services and resources used within this task order.

4) Provide the invoice price reflecting both the AWS cloud service providers (CSP) catalog price cutoff at 11:59 PM , Eastern Standard Time (EST) and Contractor proposed volume discount allowing the audit trails for the Government Contracting Officer's Representatives (COR) to validate and approve Contractor submitted invoices.

5) Identify any performance measures or SLAs within the Management Plan they will use to monitor performance to ensure quality products and billing and invoicing procedures are delivered.

6) Contractor will ensure the government has access to all reporting and visibility tools available in AWS.

7) Enforce task order continuous monitoring processes and procedures that will facilitate the early identification and resolution of any invoicing problems and provide a recommended solution for prompt response to invoicing problems.

8) Assign a technical point of contact, Program Manager (PM), who will work closely with the OIG OAS COR and CITAD staff.

9) Prepare and deliver the following documents as part of operations and contract management such as:

i) Requirements documentation

ii) Action Items/Issue tracking

iii) Project Plans

iv) Change Management documentation

v) Technical Implementation Plans

vi) User manual/Standard Operating Procedures (SOP’s)

vii) Lessons Learned reviews/Documents.

10) Provide management oversight of contract staff on the call order.

11) Ensure all operational services under this contract are supported during the regular business hours.

12) Identify problem trends within the services delivered and work to resolve those issues.

13) Perform the applicable steps on the onboarding checklist when new staff arrive to ensure they are fully onboarded with the appropriate rights within their first two days of work.

14) Notify the COR via email within one (1) business days of determining Contractor staff who will no longer work on the project. Within five (5) business days after each such notification, the Contractor shall return the related government issued PIV cards.

15) Perform off-boarding procedure for departed Contractor staff to remove access to all systems and VPN.

16) Provide Invoicing and status reports of deliverables and ongoing tasking efforts.

17) Continuously Monitor Cloud Expenses as the OIG OAS’s Cloud services consumption grows, maintaining cost efficiency, tracking, and managing temporary assets, is a continuous challenge.

18) Provide continued cost visibility, reporting, budgeting, and chargeback services, along with being proactive in providing recommendations on idle, under or overprovisioned cloud resources.

19) Be proactive in providing the best solution that meets the OIG’s cost saving objectives, along with monitoring and providing timely action plans when applicable to optimize future cloud costs and avoid budget surprises.

20) Leverage billing solutions to continuous monitor CSP charges (e.g., CloudHealth, CloudCheckr). Provide access to the OIG, be proactive in configuring alerts, providing metrics and forecasting, and provide reporting as requested.

21) Communicate and collaborate the status of ongoing tickets, procurement and invoicing status, and the vulnerability management status of the Cyber Range on at least a weekly basis with Contracting Officer’s Representative (COR).

22) Work with OIG to determine the appropriate method to identify and track OIG Program services and charges so that all services consumed can be tracked and billed to the appropriate accounting code (i.e., “tags”).

23) Provide invoices to the OIG Program and must provide detailed charges and cost information for each item consumed during the billing period. (Only for T&M CLIN)

24) Provide the Government with a web-based “dashboard” that enables 24x7x365 near real-time monitoring and visibility of Cloud services performance, service status, and key performance indicators of the system against the established SLAs and other operational parameters; Reporting and analytics that provide Government with up-to-date and comprehensive information regarding technical and management performance (summarizing projected vs. actual measures), pricing and other related issues.

25) On a weekly basis, provide a Weekly Status Report that shall include a written summary of all activities assigned, status, risks and risk mitigation, ticket metrics, and other situational awareness.

Task 2 - Identity and Access Management

The Contractor Shall:

1) Provide OIG OAS with a master or root cloud account that has full access to all AWS services and management consoles and tools including full multifactor tokens and services.

2) As AWS releases new and/or updated services, consoles and tools, the Contractor shall notify OIG OAS, provide recommendations, and ensure they are available immediately and transparently through the AWS console to OIG OAS.

3) Not create or modify any AWS accounts beyond the single master account described above except at the specific direction of the COR.

4) Have no access to certain systems within AWS or any OIG data processed, stored, or transmitted, except at the specific direction of the COR.

5) Be responsible for support and management of Microsoft Active Directory and AWS Identity Access Management (IAM) accounts, sub accounts and roles as appropriate to utilize AWS CSP components.

Task 3 – Change Management

The Contractor Shall:

1) Provide change management services to manage changes to the Cyber Range that alter the existing state of the System.

2) Provide a well-documented in a technical implementation plan, outlining the purpose of the change, its scope, the business benefit, the anticipated impact, backout plan, testing, the intended result, and any related risks.

3) Ensure a formal request process is established for proposing changes. Ensure implementation of request process before implementing any changes.

4) Establish and/or participate in a Change Advisory Board (CAB) comprised of contract and Federal staff responsible for reviewing and approving or rejecting proposed changes. Changes will be evaluated for potential risks they might introduce into the IT environment. These risks include system downtime, data loss, security vulnerabilities and business benefit.

5) Test in controlled environments before being applied to the production environment if possible.

6) Schedule the changes during times of minimal impact on the organization's operations. This might involve weekends, evenings, or other periods of reduced activity.

7) Monitor the effect of the changes to detect anomalies or problems and perform a lessons learned review to improve standards, process, and procedures.

8) Provide recommendations for improvements to address any deficiencies in standards, process, and procedures.

9) Use a standard process such as a monthly maintenance calendar to communicate and implement changes, in accordance with OIG’s change management process, as reflected in table below:

Contractor Change Management Business Impact

OIG notification and confirmation Example

Planned

Standard

Minor or repetitive changes considered part of the normal workflow with no effect on OIG’s business

Contractor shall advise OIG 48 hours in advance

Monthly operating system patching.

Minor

Small changes have a documented SOP, with little impact to the OIG’s business.

Contractor shall advise OIG 48 hours in advance.

Unconfirmed notification to OIG is acceptable.

Application-level patches or configuration changes.

Moderate

Changes that may affect multiple applications and have a broad business impact.

Contractor shall advise OIG five working days in advance. OIG must confirm notification.

New OS or version Update. EC2 update or change. Update in network infrastructure.

Major

Changes that may affect multiple applications across multiple departments, with a significant impact to OIG business.

Contractor shall advise OIG ten working days in advance. OIG must confirm notification.

Replacing old information system with a new system.

Critical (After-hours_

Changes that must be performed in order to correct a faulty IT service having some impact on OIG’s business. Impact to

Contractor shall advise OIG as soon as possible using the escalation call tree after knowing such a

Emergency Patching.

Unplanned business does not warrant immediate correction.

change is required.

Confirmed notification is preferred.

Emergency (Immediate)

Changes that must be performed in order to correct a faulty IT service having a major impact on OIG’s business. Impact to business requires immediate resolution.

Contractor shall advise OIG using the escalation call tree after change implementation.

Confirmed notification is preferred.

Active security threat or emergency patching.

Task 4 – Network Operations

a) Support and provision the ability to remotely connect to the Cyber Range using a client VPN with multi-factor authentication.

b) Provide for Multi-Factor authentication to the Cyber Range environment and AWS console using Government issued Personal Identity Verification (PIV) credentials, RSA tokens and alternative multi-factor authentication methods.

c) Manage and monitor a next generation virtual network firewall capable of at least 3 different zones with Intrusion Detection and Prevention Systems (IDS/IPS) that can inspect all traffic between internal subnets as well as the internet. The firewall must keep its alerts for at least two weeks. The alerts and logs must be sent to a Security Information and Event Management (SIEM) tool and be searchable and reportable.

d) Configure sandboxed networks for OIG to conduct penetration testing, research, testing and vulnerability assessments internally or against HHS OpDivs and business partners systems and networks using commercial and open-source tools (e.g., HP Web Inspect).

e) Provide network architecture services upon request, such as design or reconfiguring of routing, subnets, and traffic flow.

f) Develop and maintain user, system operations, Concept of Operations (CONOPS), infrastructure diagrams, Standard Operating Procedures (SOP’s), testing procedures, implementation plans and other documents as necessary.

g) Use Established Standard Operating Procedures (SOPs) and take ownership of developing and modifying SOPs to improve process or address gaps.

h) Create, manage, and deliver reports to show trends, or problems and develop remediation plans to address issues.

i) Provide recommendations for enhancements to technical representative and COR.

For approved remediation, develop and execute plans to address these problems.

j) Maintain an updated and accurate System Security Plan, provide adequate evidence of control implementation to support ongoing assessments.

k) Provide and maintain an asset inventory and detection mechanism for all cloud-based resources and instances, even if they have an IP address or not.

l) Design solutions that provide high availability and resilience, implementing disaster recovery plans and backup strategies.

m) Ensure that their AWS environment is secure, scalable, and optimized for performance and cost-efficiency.

n) Provision new resources and services upon request, including services that are in “preview mode”.

o) Ensure all IP addressable systems are configured for dual stack IPv4 and IPv6 and can fully communicate on the network using either, per OMB Memorandum M-05-22.

p) Ensure IP networks are configured for least privilege communication.

Task 5 – System Operations, Backups and Recovery

1) Create, assign, and manage backup policies. Configure all systems to be backed up by the platform to meet the CITAD recovery point objective of 24 hours (or other documented recovery point objectives) for data protection while ensuring backups successfully occur.

2) Demonstrate that backups are successful through reports that the Contractor develops/provides. Log exceptions, recover from failure and work with vendor support to identify root cause resolution or develop fallback automation for reoccurring problems.

3) Test end-to-end system recovery process and remediate flaws at least every 30 days.

This test must be reportable or demonstrated to federal staff.

4) Establish and maintain a disaster recovery plan to ensure data integrity and availability in the event of data loss or system failures.

5) Configure, monitor, manage and repair the platforms/infrastructure used to support the compute infrastructure and components while ensuring security, efficiency, and interoperability.

6) Provision and deliver secure virtual servers. This includes Windows/Linux Operating Systems, Cloud virtual appliances, Containers. Virtual servers shall be delivered, with all vulnerabilities remediated, within three (3) days of service request.

7) Allow for instances to automatically spin down during off hours to reserve costs.

8) Provide proactive support by making recommendations for change to improve operations, efficiency, and service.

9) Identify problem trends from break/fix tickets and provide solution to Federal management.

10) Report all misconfigurations and deviations from standards to the Government. Propose a course of action to solve the problem and execute the plan.

11) Perform Active Directory and AWS IAM operations and maintenance, including upgrades, provisioning, configuration, administration, and repair.

12) Configure, troubleshoot, and manage Microsoft Group Policies.

13) Configure, monitor, securely harden, and manage all Active Directory Domain

Controllers, member servers and standalone systems.

14) Develop and maintain automation to perform routine account management tasks and enforce account policies and security controls.

15) Configure, manage, and troubleshoot Public Key Infrastructure services which includes

PIV authentication, Microsoft Certificate services, Certificates for Domain controllers, and computer account certificates.

16) Manage all DNS records such as A, AAAA, CNAME, MX, DKIM, DMARC, TXT, and SPF records.

17) Perform DNS architecture changes such as forwarding, delegation, and zone management.

18) Ensure system event logs, IAM logs and other security logs are being collected and monitored for incidents or indicators of compromise.

19) Monitor the status, performance and health of endpoints and devices and resolve issues as they come up.

20) Respond and take action on system down alerts within 15 minutes during established business hours.

21) Maintain the systems and network architecture diagrams of the Cyber Range. These diagrams should be updated within seven (7) days of any change to the cloud environment.

Task 6 – Vulnerability and Patch Management

1) Ensure all critical severity security vulnerabilities and CISA Known Exploited Vulnerabilities (KEVs) are remediated (or mitigated if they cannot be remediated) fully within fifteen (15) days from first discovered date of security reports. Provide evidence of remediation to Government.

2) Ensure all high and moderate severity security vulnerabilities are remediated (or mitigated if they cannot be remediated) fully within fifteen (30) days from first discovered date of security reports. Provide evidence of remediation to Government.

3) Ensure all low severity security vulnerabilities are remediated (or mitigated if they cannot be remediated) fully within fifteen (90) days from first discovered date of security reports. Provide evidence of remediation to Government.

4) Monitor for, create a plan of action, and execute to remove all End of Life (EOL) or approaching EOL software and operating systems from the network.

5) Monitor for and remediate cloud security weaknesses.

6) Develop and implement security baselines for cloud configurations, devices, and endpoints, based on sources such as Centers for Information Security. Provide continuous monitoring for compliance.

7) Keep software and infrastructure systems up to date. Create a regular patch cadence and a plan on how and when to address emergency patching with a risk-based approach, considering the compensating controls and likelihood of exploit.

Task 7 – Security and Incident Reporting

1) Be responsible for the continuous monitoring of all OAS CITAD Cyber Range instances.

2) Comply with audit logging standards per M-23-01. The audit records must contain sufficient information to, at a minimum, establish what type of event occurred, when (date and time) the event occurred, where the event occurred, the source of the event, the outcome (success or failure) of the event, and the identity of any user/subject associated with the event.

3) Upon becoming aware of any unlawful access to any Government Data stored on Contractor equipment or in Contractor facilities, or unauthorized access to such facilities or equipment resulting in loss, disclosure or alteration of any Government Data (each, a "Security Incident"), Contractor as applicable will: (i) notify the CO and COR's via email with details of the Security Incident (Security Incident Report) within 1 hour of initial detection; (ii) investigate the Security Incident and provide the Government with detailed information about the Security Incident; and (iii) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident.

4) Comply with existing and new Executive orders such as:

a) M-22-09 “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”

b) M-22-01 “Improving Detection of Cybersecurity Vulnerabilities and Incidents on

Federal Government Systems through Endpoint Detection and Response”

c) M-21-31 “Improving the Federal Government’s Investigative and Remediation

Capabilities Related to Cybersecurity Incidents”

5) Be required to evaluate the applicability, respond to, and remediate risk as directed by

CISA Emergency Directives.

6) Ensure compliance with the security control requirements of the current version of NIST

SP 800-53 and Federal Information Processing Standard (FIPS) 200 that are appropriate to the sensitivity and criticality of the data or system. FIPS 199 is used to determine sensitivity and criticality.

7) Ensure compliance with NIST SP 800-161 “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.”

8) Be required to ensure compliance of Department of Homeland Security’s Binding Operational Directives including:

a) 18-01, “Enhance Email and Web Security”, and provides technical guidance and best practices to assist in its implementation where applicable.

b) 19-02 “Vulnerability Remediation Requirements for Internet-Accessible Systems”

c) 22-01 “Reducing the Significant Risk of Known Exploited Vulnerabilities”

d) 23-01 “Implementation Guidance for Improving Asset Visibility and Vulnerability

Detection on Federal Networks”

Task 8 – Helpdesk and Incident Management

1) Provide Enterprise Service/Help Desk Support for recording, triaging, troubleshooting, resolving and/or redirecting all incidents, problems, and service requests, by voice, email, and web interfaces.

2) Leverage a ticketing system that is FedRAMP authorized.

3) Provide helpdesk, break/fix, administration, and engineering support via Level 3 helpdesk during prescribed business hours in the Hours of Operation section.

4) Support operations outside Normal Business Hours, Severity Level 1 and Level 2 requests must be initiated through phone and/or online support as described in the table on the next page.

5) The Initial response time requirement begins when the OIG OAS reports the issue to Contractor’s Level 3 support. OIG OAS, within its reasonable discretion, shall determine the appropriate severity level based on the above definitions and shall convey its designation to Contractor when the issue is reported. If the Contractor does not agree with the OIG’s designation of the severity level for any issue, the Contractor shall indicate the severity level it attributes to the issue as soon as possible, but in any event by the end of the Initial Response time for the severity level originally designated by the OIG. The parties shall work in good faith to agree upon the appropriate severity level provided that such determination shall not unreasonably delay the resolution of the issue or service request.

6) The Contractor, being the owner of the Cloud environment master and billing account(s), is solely responsible for this requirement. If issues arise requiring cloud service provider (CSP) support, the Contractor is responsible for contacting the CSP and troubleshooting with the CSP to assure there is a resolution to the issue. OIG requires the Contractor to provide the following Service Level Requirements as presented in the table below. The Contractor will provide OIG a weekly update on any outstanding requests or incidents reported to the OIG.

Task 9…