OBOISSO Information Systems Security Support Draft SOW.pdf

SBU - CONTRACTING AND ACQUISITIONS

U.S. Department of State

OBO/IRM

OBO/IRM

Information Systems Security Support

Statement of Work

Bureau of Overseas Building Operations

OBO/RM/EX/IRM

1701 N. Ft. Myer Drive, SA-6 Arlington, VA 22209

Prepared by:

OBO ISSO

DRAFT

TABLE OF CONTENTS

1.0 BACKGROUND

2.0 SCOPE

3.0 AUTHORITY / REFERENCES

4.0 OBJECTIVES

5.0 STATEMENT OF WORK

5.1 Task Management

5.2 Communication Security

5.3 Information System Security Office (ISSO) Services

5.3.1 Operation Security

5.3.2 Cyber Security Services

5.4 Governance, Assessment & Authorization (A&A) Support

5.5 Cloud Support Services

6.0 DELIVERABLES

7.0 HOURS

7.1 Core Work Hours

7.2 Overtime

8.0 TYPE OF ORDER

9.0 PERIOD(S) OF PERFORMANCE

10.0 QUALITY ASSURANCE

11.0 PERFORMANCE EVALUATION

12.0 PLACE OF PERFORMACE

12.1 Onsite

12.2 Remote Work (Teleworking)

13.0 GOVERNMENT FURNISHED PROPERTY/INFORMATION

14.0 SECURITY REQUIREMENTS

14.1 Personnel Security

14.2 Information System Security Requirements

U.S. DEPARTMENT OF STATE

BUREAU OF OVERSEAS BUILDING & OPERATIONS

Information Systems Security Services Statement of Work

1.0 BACKGROUND

The Department of State (DoS), Overseas Buildings Operations (OBO) directs the worldwide overseas building program for the Department of State and the U.S. Government community serving abroad under the authority of the chiefs of mission in concert with other State Department bureaus, foreign affairs agencies, and Congress. OBO sets worldwide priorities for the design, construction, acquisition, maintenance, use, and sale of real properties and the use of sales proceeds.

The OBO bureau is a 1,200+ user base of architects, design engineers, security, facilities, and construction managers whose mission is to design, build, maintain, and operate safe and secure buildings overseas.

The user base within these disciplines relies on a myriad of information systems and general support systems to assist in meeting this mission.

Within OBO, the Information Resource Management (IRM) Division, Information System Security Officer (ISSO) is tasked with providing Information System Security services (i.e., Cyber Security, Cloud Platform Security, Assessments & Authorization (A&), Information/Operations Security, Operational Technology Security (OT-Security), and Communication Security (COMSEC)) for the bureau.

2.0 SCOPE

The scope of this effort encompasses technical, data analytics, cyber security, and cloud support for OBO/IRM and specifies the required capabilities but does not direct how those capabilities are to be completed. This flexibility is intended to enable the Contractor to leverage their expert knowledge and propose creative solutions. The Contractor shall provide qualified and appropriately1 cleared defined by the Staffing Plan (Secret at a minimum) personnel and other resources necessary to support OBO/IRM and its function as defined in 1 FAM2 283.1-3. The contractor shall provide personnel that have the necessary knowledge and skills consistent with the NICE3 framework.

The Department’s Enterprise networks span approximately 275 diplomatic facilities in 175 countries, and 150 domestic offices. OBO/IRM applications scales across all the Department facilities. The size of the OBO’s network responsibilities and footprint will change accordingly, and the Contractor shall provide support in securing all of the OBO’s IT equities regardless of the environment (e.g. on-premise, off-premise, cloud, third-party hosted, etc.). The Contractor shall provide expertise in all Cloud aspects to include but not limited to architecture, security, monitoring, and contract analysis to best define cloud security control roles & responsibilities. The Contractor may also be required to travel to both CONUS and OCONUS locations, on a cost reimbursement basis, for temporary duty assignments to conduct/support assessments, systems deployment, and other aspects of the OBO/IRM mission.

1 Refer to Security Clearance Attachment for list of current DOS security clearance requirements by function.

2 Foreign Affairs Manual, https://fam.state.gov/ 3 National Initiative for Cybersecurity Education, reference the Executive Order on America’s Cybersecurity Workforce and the associated NIST special publication 800-181.

https://fam.state.gov/

Lastly, the scope of this acquisition will also include support across four separate environments: DoS OpenNet, DoS ClassNet, Cloud Service Providers (Azure, AWS, ServiceNow, Google, etc.) as well as multiple Cloud Software as a Service (SaaS) Platforms and externally hosted applications. All services will be performed in a hybrid environment with the primary work location being at 1701 Nort Fort Myer Dr Arlington, VA 22209, and periodic visits to 7943-59 Cluny Ct. Springfield, VA 22153.

3.0 AUTHORITY / REFERENCES

All services provided under this contract must conform and adhere to the following but not limited to authorities shown below:

• OMB Memorandum M -07-16 - Safeguarding Against and Responding to the Breach of Personally Identifiable Information

• OMB Memorandum M-16-03 - Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy Management Requirements

• OMB Memorandum M-21-31 - Improving the Federal Government’s Investigative and Remediation Capabilities

• Related to Cybersecurity Incidents

• The Cybersecurity National Action Plan (CNAP)

• NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information

Technology Systems

• NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for

Achieving Security)

• NIST SP 800-30 - Guide for Conducting Risk Assessments

• NIST SP 800-35 - Guide to Information Technology Security Services

• NIST SP 800-37 - Guide for Applying the Risk Management Framework to Federal Information

Systems: A Security Life Cycle Approach

• NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information

System View

• NIST SP 800-44 - Guidelines on Securing Public Web Servers

• NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

• NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and

Organizations

• NIST SP 800-61 - Computer Security Incident Handling Guide

• NIST SP 800-64 - Security Considerations in the System Development Life Cycle

• NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

• NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

• NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information

Systems

• NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information

Systems and Organizations

• NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

4.0 OBJECTIVES

The objective of this task order is to obtain the services of an industry partner to strengthen the OBO security posture through the further enhancement of the Bureau’s Information System Security Program which includes but not limited to:

1. Independently assess application information systems and general support systems for authorization.

2. Enhance information security continuous monitoring through adherence of existing annual information system security activities as well as the deployment and operation of security tools.

Furthermore, the contractor shall incorporate best practices from the industry and or Government in all OBO/IRM cyber mission areas., specifically cloud security, network security monitoring, and communication security (COMSEC). In addition, the contractor shall maintain and maximize program and service delivery productivity within established resource constraints, while identifying cost saving measures.

5.0 STATEMENT OF WORK

5.1 Task Management

The Contractor shall perform activities related to but are not limited to the following:

• Advise on the effective implementation of programs within the DOS, including integration of cyber security within the broader OBO context

• Perform security reviews and identify security gaps in security architecture resulting in recommendations for inclusion in the risk mitigation strategy.

• Support security reviews, identify and document gaps in security architecture, and manage a security risk management plan.

• Monitor and track program and task performance to ensure on time service delivery.

• Review and recommend improvements to periodic program reporting quality (substance, format, clarity, frequency, effectiveness)

• Provide a Monthly Status Report (MSR) for each task (to the designated Government Technical

Monitor) by the 15th of each month, presenting, as a minimum:

o Activities and milestones completed and deliverables submitted for each task for the past month o Indication of potential schedule variance, mitigation strategies, and actions taken o Issues encountered and resolution applied o Issues unresolved and current status and actions o Milestones and activities planned for the next reporting period o labor hours expended, by labor category, for each task and sub-task.

• Provide Program Management Plan (PMP) o The contractor must submit a Program Management Plan with the technical and cost proposals for this SOW.

o The PMP will be used to manage, track, and evaluate the Contractor’s performance.

o Shall consist of control policies and procedures in accordance with standard industry practices for project administration, execution, and tracking.

o Shall require Government approval.

• Ensure that goals and scope are clear for the teams.

• Promote continuous communication and monitor and improve team dynamics.

5.2 Communication Security

The contractor shall manage the OBO Communications Security (COMSEC) program in accordance with the procedures and guidelines set forth by the Department of State (DOS) Cryptographic Services Branch (CSB). Additionally provide communication level security services to include but not limited to:

• must obtain and maintain COMSEC level training and designation through the Department of State

• manage all requests for cryptographic services, equipment, and material for all OBO offices both domestically and overseas.

• receive, issue, and control all electronic key, secure telephone equipment and In-Line Encryptors (INE), firmware and software updates centralized around communication security.

• Maintain the handling, operation and troubleshooting of INE KG175; Secure Data Sender (SDS) KIK20 and Really Simple Key Loader (RSKL) KIK30 key loading devices and General Dynamics Viper Secure Telephone.

• Ensure all services comply with the regulations contained in DOS Communications Security publication (5 FAH-6), Diplomatic Security 12 FAM and COMSEC changes as noted in CSB’s ACOM messages.

• conduct daily inventory inspections of all COMSEC devices as required by the CSB policies and procedures.

• conduct semi-annual COMSEC inventories in March / September and report completion to CSB;

• participate in CSB annual audit and maintain a “Satisfactory” rating.

• provide a bridge for complex cyber issues at all levels of the Department using superlative verbal and written communication and interpersonal skills.

5.3 Information System Security Office (ISSO) Services

The contractor shall assist the OBO ISSO in developing an Information Systems Security Strategy to provide a defense in depth approach to the security architecture of OBO’s on-Prem and in-Cloud IT infrastructure by means of Operation Security and Cyber Security Services.

5.3.1 Operation Security

The Contractor shall perform activities that include, but are not limited to the following:

• assist the OBO ISSO in responding to and remediating classified spillage incidents

• develop and maintain Classified Spillage reporting procedures

• assist manage the distribution, tracking, reporting, and auditing of the OBO Classified hard drive program

• perform secure data transfers for users from removable media to the OpenNet/ClassNet network

• perform end of day security checks in OBO/IRM suites, maintain safe/lock combination changes for safes and computer equipment rooms. conduct new OBO/IRM user security briefings and keep new user security briefing updated with the latest policies from the Department’s Foreign

Affairs Manuals pertaining to Information and Information Systems Security (12 FAM 500 and

12 FAM 600).

5.3.2 Cyber Security Services

The Contractor shall perform activities that include, but are not limited to the following:

• enforce department and industry standards, guidelines, and policies for securing windows servers ensuring they have been appropriately applied and configured across all OBO/IRM IT infrastructure (on-Prem and in-Cloud)

• enforce department and industry standards, guidelines, and policies for securing Active Directory (AD) objects across all OBO/IRM IT infrastructure (on-Prem and in-Cloud)

• Provide support for administering and managing the structure of the bureau’s OU security groups and distribution lists

• utilize Department Security Incident and Event Management tools (NetIQ Sentinel, Tenable Nessus, Splunk, and Change Auditor, McAfee Policy Auditor) or the contractor will be required to deploy SIEM tools to conduct daily monitoring, detection, and event log analysis and alerting looking for unauthorized activities across the IT infrastructure

• coordinate and conduct application, windows server, and database vulnerability and compliance scans across all infrastructures

• conduct audit exercises across all environments

• ensure the Information Security section of OBO’s contract language (specifically Section H) sufficiently addresses Federal and Department Cyber Security regulations, guidelines, and procedures for protecting SBU and/or CUI (Controlled Unclassified Information) information at OBO’s Design and Construction contractor sites.

• ensure updates to the Information Security section of the contract is updated semi-annually or whenever there is a major change or advancement in Cyber Security policy.

• establish a program for the analysis/evaluation of new technologies proposed by these contract firms to ensure their compliance with existing Cyber Security/Information Security policy.

• Assist in the development of sprints and releases; system integration and testing; and program level coordination with other projects and stakeholders across the bureau.

• Coach and guide the team through execution of Agile development practices and remove impediments that hinder project progress.

5.4 Governance, Assessment & Authorization (A&A) Support

The Contractor shall perform activities to ensure compliance with the NIST Risk Management Framework (RMF) which include but are not limited to the following:

• Assist in planning and preparation for security Assessment and Authorization (A&A) as part of the Department’s Information Assurance policy and Federal Information Security Management Act (FISMA) implementation efforts

• Provide support for and where necessary to create security documentation for the required phases of the DOS A&A process in support of obtaining Authority to Operate (ATO) approvals of OBO systems

• Perform Security Impact analysis (SIA) review of clearance requests and provide reporting requirements to system owners

• Update expired security controls in ArchAngel to support security findings and reporting

• Analyze and report on security findings identified during assessment

• Create Plan of Action & Milestones (POAMs) for identified security control findings

• Evaluate security control implementations for all OBO Systems boundaries on a yearly basis

• categorize the information system and the information processed, stored, and/or transmitted by that system based on the impact analysis

• categorize the information system and document the results of the security categorization in the system security plan Systems Security Plan (SSP).

• identify the security controls that are provided by the organization as common controls for organizational information systems and document the controls in the control selection worksheet and database

• develop a strategy for the continuous monitoring of security control effectiveness and any proposed or actual changes to the information system and its environment of operation and recommend security controls based on the security categorization of the information system

• describe the information system (including the system boundary, system functions, and system data criticality/sensitivity) and document the description in the System Security Plan (SSP)

• register the information system in the Department's IT Asset Baseline

• conduct a review of system security plan the SSP with OBO ISSO to ensure completeness, accuracy, and readiness for approval by the OBO Information System Owner

• perform Annual Control Assessments, Contingency Plan tests, and SCF updates on an annual basis for all FISMA-reportable information systems;

• assist the OBO ISSO in the creation of a bureau-wide Information Systems Security Policy that will be derived and aligned with existing department of state Foreign Affairs Manuals (FAM’s) and Foreign Affairs Handbooks (FAH’s) as well as be aligned with NIST Special Publications 800-53 rev4 Security and Privacy Controls for Federal Information Systems and Organizations

5.5 Cloud Support Services

The contractor will provide Subject Matter Expertise (SME) to support cloud-based services by ensuring all aspects comply with DOS policies.

The Contractor shall perform activities that include, but are not limited to the following:

• implement, maintain, and monitor the security features available in the Bureau’s Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) cloud platforms

• create dashboards to aggregate security-related data in one SIEM and introduce Security as a Service (SECaaS) program for a holistic security monitoring solution for all cloud environments

• build, optimize and maintain conceptual and logical database models to support meta-data management, data catalog, data dictionary;

• interface with analysts gather requirements to ensure security controls are addressed;

• monitor cloud infrastructure requirements utilizing DevSecOps tooling and practices;

• report on all cloud instances and changes at the host level and their corresponding impacts to

OBO applications.

• perform security reviews, identify gaps in security architecture, and develop a security risk management plan.

• evaluate security architectures and designs to determine the adequacy of security controls are adhered to by policy

• ensure overall security requirements for connectivity, cloud infrastructure, information management within cloud infrastructure, and cloud service management are met for all of OBO cloud platforms

6.0 DELIVERABLES

This section identifies deliverable items that the Contractor shall deliver to the Government. All deliverables shall be provided to the COR or designated Government Task Manager (GTM) via electronic mail, and in hard copy. Deliverables shall be submitted in accordance with dates and timeframes identified in the table below (unless otherwise specified). For specific deliverables identified by the Government, the Contractor shall submit drafts (unless otherwise specified) to meet the dates shown.

After Government review and feedback, the Contractor shall then finalize the product.

Contract Deliverable – A document that is tied to contract performance and MUST be delivered within the specified timeframe to the COR and other identified personnel. All documents will be reviewed for quality assurance and will be accepted or rejected within 5 business days. If rejected, the vendor has 5 business days to submit a revised deliverable.

Work Product – items that pertain to ongoing programmatic tasks that are utilized to manage each section performance, provides updates to intended audiences, etc. This does not raise to the level of a Contract Deliverable as it is internal.

Identifier Product Description Timeframe Deliverable Type OBO-01 Monthly Status

Report Activities and milestones compiled from the Task Status Report monthly by the 15th of each month

Contract Deliverable

OBO-02 Weekly Activity Report

Activities and milestones completed for each task for the current work week

Submitted NLT 12:00 Noon every Friday

Work Product

OBO-03 Transition Plan Task and activities to be performed to efficiently transition the contract from the incumbent

Upon award Contract Deliverable

OBO-04 Standard Operating Procedures (SOP) Updates

Review and update All SOPs to support the new contract award

Within 90 days of contract award and annually

Contract Deliverable

OBO-05 Workforce Retention Plan

Outlines the plan on retaining contract staff

Within 21 days of contract award

Contract Deliverable

OBO-06 COMSEC

Inventory Report

Report on 99.9% accountability of all COMSEC related assets

Quarterly (1st of each quarter month)

Work Product

OBO-07 Assessment Monthly Report

Provide current state on each system and their corresponding milestones (timeline outlined in AA SOP) within the RMF Process

Submitted NLT 12:00 Noon on the first Monday of every month

Work Product

7.0 HOURS

All hours worked must equate to a total of 8 hours of provided services to the Government. Lunch hours are not to be factored into the time services are provided to the government unless it is a mandatory work session. Using this example, if a 30 min lunch break is provided, a contract should work from 8:00 am to 4:30 pm (to accommodate the lunch time)

7.1 Core Work Hours

Core work hours is Monday through Friday, 8AM – 5PM.

7.2 Overtime

Overtime hours can only be approved by the Contracting Officer Representative. Overtime must be approved prior to hours being worked. The COR has the right to deny overtime and to deny invoices with unapproved overtime hours submitted.

8.0 TYPE OF ORDER

The government anticipates award of a Labor hours contract.

9.0 PERIOD(S) OF PERFORMANCE

The period of performance shall include a one (1) year Base Period and four (4) one (1) year option periods.

10.0 QUALITY ASSURANCE

The Government will perform those quality assurance procedures that may be necessary to verify that performance is in accordance with the terms of the task order. Government quality assurance will be performed routinely by the Contracting Officer's Representative; however other activities may be called upon to support this effort as required.

11.0 PERFORMANCE EVALUATION

The Contractor Officer's Representative or designated quality assurance evaluators will record all surveillance observations and will maintain a file of all inspection results. Successive reports of unsatisfactory performance for any critical performance area may result in other appropriate action(s) by the Contracting Officer in accordance with the applicable Inspection of Services clause(s), including Termination for Cause. Any action taken by the Contracting Officer as a result of surveillance will be in accordance with the terms of this task order. The Government will base the award of option years on the results of its performance evaluations.

12.0 PLACE OF PERFORMACE

12.1 Onsite

The primary place(s) of performance for this contract will be Department of State, Overseas Buildings Operations (OBO), 1701 N. Ft. Myer Dr. Arlington, VA 22209

12.2 Remote Work (Teleworking)

Teleworking is a privilege and is not required for successful performance of this contract. All positions on this contract are available for at least 60% telework. However, the COR has the discretion to call contractors on site when necessary and shall be the approving authority for all telework requests.

13.0 GOVERNMENT FURNISHED PROPERTY/INFORMATION

The Government will provide space and equipment necessary for all onsite contract personnel, and whatever equipment deemed necessary for offsite contract personnel to conduct business on behalf of the government using the government’s approved remote access program.

Any/all information developed as a result of this project is solely the property of the government and any information created on non-Department owned devices must be turned over to the government at the conclusion of this contract.

The contractor will be held accountable for the loss, theft, or damage of any GFE equipment issued.

14.0 SECURITY REQUIREMENTS

14.1 Personnel Security

All Contractor personnel assigned to this contract shall possess at minimum a Secret personnel security clearance issued by the Defense Security Service commensurate with the level of access required, prior to contract performance.

However, Top-Secret security clearances are required to access and provide support for vulnerability and threat information as well as those contract personnel or positions required to have system administrator responsibility on the Bureau’s Classified network must possess a Top-Secret clearance.

Security clearance requirements for contractors accessing DOS information systems shall be in accordance with Volume 12, Foreign Affairs Manual, Section 600. Furthermore, while at DOS locations, the Contractor shall comply with applicable DOS regulations relative to the protection of classified and/or sensitive information.

The Office of Information Security (DS/IS/IND) is responsible for inspecting the Contractor's activities at DOS locations. Visit requests are to be sent to DS/IS/IND, SA-20, 13th floor, Rosslyn, Virginia 22209.

JPAS Summary sheets issued by the Defense Security Service must be attached to all Visit Authorization Requests (VARs). All DD Form 254 for subcontracts shall be forwarded to DS/IS/IND for certification prior to issuance to the subcontractor.

14.2 Information System Security Requirements

The Contractor will be required to participate in activities throughout the Systems Development Life Cycle of a Federal Government Information System that will ensure appropriate measures are being taken to address the basic information security objectives of Confidentiality, Integrity, and Availability. These activities include working with information systems security personnel on developing System Security Plans, Information System Contingency Plans and Contingency Plan Testing, as well as Annual Control testing. The contractor will be required to design and develop secure application information systems and general support systems by incorporating the National Institute of Standards and Technology guidance listed in section 1.2 of this SOW.

The Contractor will be required to abide by the Department of State Diplomatic Security's Security Configuration guidelines and standards for installation, configuration, and implementation of information system components (i.e Database, IIS, .Net, switches, routers, firewalls, Active Directory, etc…). In situations where a guide does not already exist for a component, the contractor is required to research and document the industry best practices for the installation, configuration, and implementation of the component to provide the best security possible to protect Department of State information.

The Contractor shall apply information system security engineering principles in the specification, design, development, implementation, and modification of the information system to include developing layered protections, establishing sound security policy, architecture, and controls as the foundation for design and incorporating security requirements into the system development life cycle.

The Contractor (if providing external information system services) shall ensure that providers of external information system services comply with organizational information security requirements and employ controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance (reference section 1.2). Defines and documents government oversight and user roles and responsibilities regarding external information system services, employs techniques to monitor security control compliance by external service providers on an ongoing basis, and external information system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements.