Forward_Deployed_Analyst_SOW.docx

Global Engagement Center Technical Engagement Team

STATEMENT OF WORK:

FORWARD DEPLOYED ANALYST

DESCRIPTION OF SERVICE:

The Technology Engagement Team (TET) has an immediate need to hire one (1) Forward Deployed Analyst (FDA) as a subject matter expert to serve on as short term basis (365 days) to complete recommendations coming from the Global Engagement Center (GEC).

CONTRACTING OFFICER REPRESENTATIVE:

Office Symbol: Global Engagement Center Location Address: 2201 C St NW, Washington, DC 20520 Telephone Number: 202-736-7950 E-Mail Address: GECIncubator@state.gov

TASK ORDER PURPOSE:

The purpose of this task order is to add one (1) full-time consultant, who is a FireEye employee (“Forward Deployed Analyst” or “FDA”) to perform and complete recommendations coming from the State Department’s Global Engagement Team.

TASK REQUIREMENT(S):

FireEye agrees to provide one (1) full-time consultant, who is a FireEye employee (the “Forward Deployed Analyst” or “FDA”) to perform the following Services on-site at Customer’s premises:

The following are the duties and responsibilities of these positions:

DUTIES AND RESPONSIBILITIES for the Forward Deployed Analyst

· Accessing and applying FireEye’s knowledgebase to improve and enhance the Customer’s threat intelligence.

· Providing alert-driven threat reports describing FireEye’s knowledge of threat actors’ identities, motives, capabilities, and targets

· Preparing predictive analysis describing threat groups that are likely to target Customer, and the types of data theft or network attacks these groups would likely exploit

· Collecting industry-specific analysis, such as case studies describing recent incidents at similar organizations, targeting trends across the industry, and new or expanded descriptions of threat actors specifically targeting the particular industry

· Creating threat analysis reports describing new or evolving threats tied to the Customer’s business areas, partners, products, and services

· Conducting threat landscape briefings providing situational awareness of current advanced persistent threat, financial, and hacktivists groups

· If FireEye appliances are purchased and deployed to conduct the detection component of network security, the FDA will review and research the alerts from these appliances and monitor FireEye data and expertise to identify changes in the broader threat landscape that affect Customer’s risks.

Customer acknowledges and agrees that FireEye cannot guarantee the amount of time it will take to engage an appropriate FDA. Customer will have an opportunity to interview the FDA prior to engagement, and Customer may reasonably reject any candidate. The FDA will work from Customer’s offices, be a citizen of the country in which the activities are to take place, and will possess any necessary security clearances.

During the period between the SOW Effective Date and the date the FDA begins performing the Services described above at Customer’s premises (the “FDA Start Date”), Customer will have full-time access to a designated analyst on the FireEye Intelligence Team, and this analyst will provide basic intelligence reporting and query functions.

The Services described above are “Services” as defined in the Agreement.

The following are examples of the types of services that are not included in the Services described herein:

• Routine IT work such as troubleshooting and help desk functions

• Provision of bulk, raw intelligence from FireEye’s intelligence libraries

• Incident response activities

• SOC analyst work

• Penetration testing, vulnerability testing, or other proactive assessments

DELIVERABLES

FireEye may provide the Customer with any or all the following items (each, “FireEye Reports”), as requested through the FDA and as available:

• Alert-driven threat reports describing FireEye’s knowledge of threat actors’ identities, motives, capabilities, and targets.

• Predictive analysis describing threat groups that are likely to target Customer, and the types of data theft or network attacks these groups would likely exploit.

• Industry-specific analysis, such as case studies describing recent incidents at similar organizations, targeting trends across the industry, and new or expanded descriptions of threat actors specifically targeting the particular industry.

• Threat analysis reports describing new or evolving risks tied to the Customer’s business areas, partners, products, and services.

• Threat landscape briefings providing situational awareness of current advanced persistent threat, financial, and hacktivists groups.

FireEye Reports are “Deliverables” as defined in the Agreement. Customer shall have a perpetual, non-exclusive, nontransferable, right and license to use, display and reproduce the FireEye Reports. FireEye Reports may be shared with or otherwise provided to third parties at the discretion of the FDA after consultation with FireEye.

FEES AND EXPENSES

FireEye will invoice Customer the fees set forth above for the Initial Term. Customer will pay all invoices as set forth in the agreement. Pricing does not include direct expenses, and Customer will reimburse FireEye for direct, pre-approved expenses incurred through the course of the engagement. Upon request, FireEye will provide electronic copies of expense receipts for all expense related items greater than $25. Invoices for expenses will be issued monthly.

ASSUMPTIONS

Fees do not include any hardware, software, licensing, maintenance or support costs of any FireEye or other third-party product or service suggested by FireEye as we conduct the activities outlined above.

FireEye will provide Deliverables to Customer throughout this engagement. Draft deliverables are considered final upon confirmation from Customer (written or oral) or fifteen days after their submission date from FireEye to Customer via email, whichever is earlier.

When FireEye’s personnel are performing Services on site at Customer’s premises, Customer will allocate appropriate working space and physical access for all FireEye assigned personnel.

FireEye uses a (40) hour billable workweek as its standard, with approximately 30% of the FDA’s time spent coordinating with FireEye’s Intelligence Team. On-site services are generally delivered over a four day, (10) hours/day work week, Monday through Thursday, unless otherwise mutually agreed. In consultation with the customer FireEye may be allowed to incur greater than 40 billable hours in a workweek.

Customer may make available, at its discretion, key individuals within the security program that can best help plan operations and activities.

PLACE OF PERFORMANCE:

The work under this task will take place in the following Department of State locations:

Harry S. Truman Building (Main State) 2201 C St., N.W.

Washington, DC 20037

PERIOD OF PERFORMANCE:

The period of performance will be a One (1) Year (12 months), commencing in September 2019 or upon date of award.

SECURITY REQUIREMENT:

Each of the professional service employees under this Task Order requires a TOP SECRET Security Clearance with SCI.

STANDARDS:

The contractor shall insure all work is completed in accordance with U.S. Government and DOS standards, policy, procedures and guidelines as provided. All products and services under these tasks, and as part of the agreement, are the sole property of the U.S. Government.

GOVERNMENT FURNISHED PROPERTY:

0. The Department of State will provide the professional service employee with a computer workstation and access to existing applications (e.g., e-mail, MS Office Suite, etc.), adequate office space, and telephone service. The Department will also provide printers, faxes, and copiers. Telephones may only be used in accordance with Federal Guidelines and Standards to conduct DoS related business. Government furnished computer equipment and use of office equipment (such as faxes, copiers) will be provided.

0. The Department will provide computer storage space on the Department’s unclassified network to host the professional service employee deliverables. All deliverables (e.g., documented procedures, customized software, applications and enhancements) are the property of the Department of State and will be returned to the Department of State upon completion of the support services.

Unclassified