Attachment_D_Amendment_0001__ICS_Task_Order_Performance_Work_Statement_(revised_8_7_2023)_0001.pdf

140R8123R0003/0001 Attachment D: ICS Task Order Performance Work Statement 08/07/2023

PERFORMANCE WORK STATEMENT (PWS)

Task Order –Industrial Control System (ICS) Technical Lead Support Services for the Risk Management Services Division

(PROFESSIONAL SERVICES FOR RISK MANAGEMENT

Indefinite Delivery, Indefinite Quantity (IDIQ))

1. SCOPE

The objective of this contract is to acquire contractor services to assist the United States Bureau of Reclamation (USBR) Risk Management Services Division with cybersecurity related projects and tasks related to Industrial Control Systems (ICS). This task order can be supported remotely.

2. BACKGROUND

USBR requires contractor services to support federal staff to include providing technical ICS cybersecurity expertise to information system security managers and officers, system administrators and owners; providing recommendations for implementing technical security controls within ICS networks; managing ICS security operations projects; conducting research on new and existing technologies; providing leadership in incident response activities, providing recommendations regarding cybersecurity tools, solutions, and system architecture; improving USBR’s continuous monitoring capabilities; and creating and reviewing standard operating procedures and technical documentation.

3. REFERENCES - The following list of documents are required in the performance of this contract:

● NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf

● NIST SP 800-30, Guide for Conducting Risk Assessments http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800- 30r1.pdfhttp://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800- 30r1.pdf

● NIST SP 800-34, Contingency Planning Guide for Federal Information Systems http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800- 34r1.pdfhttp://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800- 34r1.pdf

● NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 37r1.pdfhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf

● NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View http://csrc.nist.gov/publications/nistpubs/800-39/SP800- 39-final.pdfhttp://csrc.nist.gov/publications/nistpubs/800-39/SP800-39-final.pdf

● NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf http://csrc.nist.gov/publications/nistpubs/800-39/SP800-39-final.pdf http://csrc.nist.gov/publications/nistpubs/800-39/SP800-39-final.pdf http://csrc.nist.gov/publications/nistpubs/800-39/SP800-39-final.pdf

Systems and Organizations: Building Effective Assessment Plans http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 53Ar4.pdfhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 53Ar4.pdf

● NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 53r4.pdfhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

● NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800- 60_Vol1-Rev1.pdfhttp://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800- 60_Vol1-Rev1.pdf

● NIST FIPS 199, Standards for Security Categorization of Federal Information and Information Systems http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdfhttp://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

4. TASKS - The contractor shall perform the following task order requirements. The work shall be completed during the period of performance. The project will be evaluated for completeness of tasks and objectives weekly. The Contractor will receive direct guidance for work and projects from the COR and TSAL (technical service area leads) federal staff.

4.1. Provide expertise, guidance, and recommendations regarding ICS Security Operations projects, tasks, and initiatives.

4.2. Architect, design and implement technical solutions to solve complex cybersecurity problems for Information Technology (IT) components in ICS.

4.3. Analyze and interpret National Institutes of Science and Technology (NIST) security controls and develop technical implementation guidance.

4.4. Review technical evidence (switch configurations, Group Policy Object settings, firewall Access Control Lists etc.) to verify remediation of security control weaknesses.

4.5. Provide training and assistance to ICS system and security personnel.

4.6. Consult with ICS system and security personnel to identify priorities and best approaches for integrating security focused tasks into daily operations.

4.7. Assist with the development and implementation of ICS Continuous Diagnostics

& Mitigation (CDM) solutions.

4.8. Evaluate the introduction of new products and techniques and advise on their capabilities, supportability, and security posture.

4.9. Assist with the development of additional capabilities for an ICS Security

Operations Center (SOC).

4.10. Develop incident response playbooks, exercises, and procedures.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

4.11. Perform ICS technical assessments to validate compliance with cybersecurity requirements.

4.12. Provide technical writing expertise to help revise and develop relevant processes, procedures, guidance, standards, and instructional materials.

4.13. Conduct technical research on new and existing technologies, conduct alternatives analyses, and make recommendations based on findings.

4.14. Serve as technical lead for large scale ICS projects.

4.15. Provide ad-hoc technical support to Reclamation ICS systems as directed by

TSAL.

4.16. Develop standard processes for cybersecurity reviews throughout design-build contract lifecycle.

4.17. Organize, lead, and support ICS Security Operations daily tasks and objectives.

5. PERFORMANCE REQUIREMENTS SUMMARY

Task No. Task Description Performance Standard

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.1 Provide expertise, guidance, and recommendations regarding ICS Security Operations projects, tasks, and initiatives.

100% on time delivery of high-quality products

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Minimum acceptable quality level= 90%.

Failure to perform within the minimum level could result in contract price reduction or other action per agreed-upon terms by both parties.

No. Task Description Performance Standard

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.2 Architect and

implement technical solutions to solve complex cybersecurity problems for Information Technology (IT) components in ICS.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms by both parties.

4.3 Analyze and

interpret National Institutes of Science and Technology (NIST) security controls, develop technical implementation guidance, and provide training and assistance to ICS system and security personnel

100% on time delivery of high-quality products

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.4 Review technical

evidence (switch configurations, Group Policy Object settings, firewall Access Control Lists etc.)

to verify remediation of security control weaknesses.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms by both parties.

4.5 Provide training

and assistance to ICS system and security personnel.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.6 Consult with ICS

system and security personnel to identify priorities and best approaches for integrating security focused tasks into daily operations.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms by both parties.

4.7 Assist with the

development and implementation of ICS Continuous Diagnostics & Mitigation (CDM) solutions.

100% on time delivery of high-quality products

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.8 Evaluate the

introduction of new products and techniques and advise on their capabilities, supportability, and security posture.

100% on time delivery of high-quality products

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms by both parties.

4.9 Assist with the

development of additional capabilities for an ICS Security Operations Center

(SOC).

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.10 Develop incident

response playbooks, exercises, and procedures.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms by both parties.

4.11 Perform ICS

technical assessments to validate compliance with cybersecurity requirements.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.12 Provide technical

writing expertise to help revise and develop relevant processes, procedures, guidance, standards, and instructional materials.

100% on time delivery of high-quality products

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms by both parties.

4.13 Conduct technical

research on new and existing technologies, conduct alternatives analyses, and make recommendations based on findings.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.14 Serve as technical

lead for large scale ICS projects

100% on time delivery of high-quality products

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms by both parties.

4.15 Provide ad-hoc

technical support to Reclamation ICS systems.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms

Minimum Acceptable

Quality Level

Methods of Surveillance Incentive

4.16 Develop standard

processes for cybersecurity reviews throughout design-build contract lifecycle.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms by both parties.

4.17 Organize, lead, and

support ICS Security Operations daily tasks and objectives.

Product delivery compliant with agreed upon delivery schedules and product requirements.

Product reviews and periodic inspections

Services may be delivered late no more than 10% of the time.

Failure to perform within the 10% could result in contract price reduction or other action per agreed upon terms

5.0 DATA AND REPORTS - The contractor shall provide the following data and reports as follows:

Item No.

(associated with Task)

Description Content Format Medium Delivery

All The COR or TSAL will define the requirements for assigned products upon task assignment

Content requirements will be directed by the COR or TSAL upon task assignment

Format to be agreed upon by COR or TSAL and contractor upon task assignment

Electronic format

Deliver to COR and

TSAL

All Weekly status reports

Content requirements will be agreed upon by Contractor, COR and TSAL

Contractor’s choice

Electronic format for all reports and any presentation materials – MS Word document for reports, Presentation material format can be determined by Contractor

Deliver to COR and

TSAL

6. PERSONNEL QUALIFICATIONS

Resumes of all individuals referenced on the contract must be submitted and all individuals will be required to undergo a Moderate Risk Public Trust investigation. Individuals must have knowledge of and experience with:

• Experience applying technical security controls in ICS or isolated environments.

• Experience configuring and securing ICS technologies such as HMIs, PLCs, RTUs, and specialized software.

• Experience designing secure system and network architectures.

• Experience implementing cybersecurity tools in isolated environments.

• Experience leading long-term projects with interdisciplinary project teams.

• Experience creating guidance and recommendations in a clear, readable format appropriate for technical and non-technical personnel.

• Knowledge of ICS to include Electronic Access Control and Surveillance System

(EACSS) and Supervisory Control and Data Acquisition (SCADA).

7. DELIVERABLES - The contractor shall submit the following reports in accordance with paragraph 5.0, “DATA AND REPORTS”:

7.1. Electronic copies of document deliverables shall be delivered to the Contracting Officer Representative (COR) using Microsoft Office (e.g., Microsoft (MS) Word, MS Excel, MS PowerPoint, MS Project, or MS Visio), or pdf for graphics unless otherwise specified at the task level by the COR. A shared environment or SharePoint site will be used to store documentation per the government instructions. Electronic submissions shall be made via email, unless otherwise agreed by the COR. Reclamation shall have fifteen (15) business days to review each document and provide feedback and comments if necessary. The Contractor shall have five (5) business days to incorporate any comments. A final review shall be conducted with the COR. The COR's concurrence and approval of the draft and final documents shall constitute acceptance by Reclamation.

7.2. Contractor shall furnish electronic weekly status reports to the COR that includes the results and/or progress of tasks for government review and performance metric review.

7.3. Knowledge Transfer

● Contractor shall provide a strategy to the government on method to ensure that contract staff has sufficient knowledge to perform all development and operation and maintenance activities identified by the Government in a backup role or become the primary leader in the event of staff transitioning out of company.

● A quarterly updated report shall be provided to the government containing at a minimum the following information:

o Task or Application o From Name / Contractor o To Name / Contractor o Date o Percent transition progress

7.4. Staff Replacement Plan

Contractor staff replacement must meet the experience level of individuals originally selected for the original IDIQ.