2021.09.27 draft PWS.pdf

HTC711-22-Q-D001

ATTACHMENT 1

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

CUI

PERFORMANCE WORK STATEMENT

FOR

SENIOR INFORMATION SECURITY OFFICER

In Support of the United States Transportation Command

TASK ORDER HTC711xxxx

21 September 2021

Prepared by

UNITED STATES TRANSPORTATION COMMAND

DIRECTORATE OF COMMAND, CONTROL, COMMUNICATIONS & CYBER

SYSTEMS

1. DESCRIPTION OF SERVICES

1.1. Background

The United States Transportation Command (USTRANSCOM) located at Scott Air Force Base (AFB), IL, is one of eleven (11) Unified Combatant Commands (UCC). USTRANSCOM provides command and control (C2) for the synchronized transportation, distribution, and sustainment of personnel and assets, making possible the projection and maintenance of national power wherever needed with speed and agility, high efficiency, and a high level of trust and accuracy.

USTRANSCOM’s mission is to conduct globally integrated mobility operations, lead the broader Joint Deployment and Distribution Enterprise, and provide enabling capabilities in order to project and sustain the Joint Force in support of national objectives. The Commander exercises responsibilities as prescribed in the Unified Command Plan. These duties include being the Mobility Joint Force Provider, DoD Single Manager for Transportation, Joint Deployment and Distribution Coordinator, DoD Single Manager for Patient Movement, and Joint Enabling Capabilities. An important functional requirement is the integration of the Transportation Component Commands (TCCs): Air Mobility Command (AMC), Surface Deployment and Distribution Command (SDDC), Military Sealift Command (MSC), and the Joint Enabling Capabilities Command (JECC).

USTRANSCOM Command, Control, Communications, and Cyber (C4) Systems (C4S) Directorate (TCJ6) is responsible for long-range planning, policy guidance, direction, technical control and program management for projects involving the development and implementation of major transportation management systems DoD-wide. The Information Security Division (TCJ6-X) led by the Senior Information Security Officer (SISO) establishes, advocates and maintains enterprise cybersecurity vision, standards, and strategy to ensure cyber assets and information technologies are provided. More specifically, SISO’s Security Policy and Compliance branch (TCJ6-XS) manages areas such as system authorizations via the Risk Management Framework (RMF), cyber hygiene scorecards, and Defense Readiness Reporting System (DRRS).

1.2. Scope

The scope of the contract effort is to provide a range of services supporting the RMF for USTRANSCOM, AMC and SDDC missions. Cybersecurity and risk management skills will be required to support the USTRANSCOM C4 environment, which interfaces with numerous on-site and remote commercial, DoD, service, and common-user networks (i.e., Secret Internet Protocol Router Network [SIPRNet], Non-secure Internet Protocol Router Network [NIPRNet], DoD Information Networks [DoDIN], DoD-approved cloud environments and the Scott AFB Local Area Network [LAN], Wide Area Network [WAN], or Metropolitan Area Network

[MAN]).

The contractor shall provide a range of Information Technology (IT) services to include cyber security, RMF Security Controls Assessor Representative (SCAR) evaluations, technical testing and evaluation, analysis and guidance, software assurance management, and all deliverables related to these services.

The contractor shall utilize risk management best practices to perform the tasks and subtasks of this Performance Work Statement (PWS) to provide responsive IT service delivery. The required outcomes are delivering risk management services to USTRANSCOM users within agreed service levels and achieving continual risk management improvements to IT systems and services. The contractor shall be responsible for coordinating, managing, assigning resources, processes, and activities with regard to the successful delivery of the entire IT service delivery process as defined in this PWS. The contractor, in concert coordination with the Government, shall establish, collect, and report metrics to evaluate and improve service delivery performance.

2. TASK AREAS

2.1. Task 1: Contract Management

This task consists of the functional activities relating to the administration and management of this effort. The contractor shall identify a Program Manager (PM) by name who shall provide management, direction, administration, clerical support, documentation, quality assurance, and leadership during the execution of this PWS. The contractor shall designate a principal point of contact for technical issues in addition to the PM. The contractor shall prepare documents such as briefings, point papers, and meeting minutes related to status of the performance of this PWS.

Additionally, the contractor shall be required to present material to senior DoD, non-DoD officials, other senior leaders and customers to clearly present technical approaches and findings.

The contractor shall provide support in the specific areas outlined below in this PWS.

The contractor shall possess at a minimum Capability Maturity Model Integration Maturity Level 3 (or higher) for the CMMI-Development, as well as International Organization for Standardization)/IEC (the International Electro Technical Commission) (e.g., 9001, 20000, 22301, 27001) certifications. The contractor shall integrate one or more CMMI/IOS maturity models and/or standards to meet its continuous improvement and optimization solutions and/or provisioned services for deliverables and processes.

The contractor shall provide all deliverables listed in Section 3, to include referenced documents, and contractor-developed and Government approved plans, schedules, and milestones. The contractor shall meet stated Government requirements and milestones. If the contractor does not meet milestones, the Government must be notified in writing within twenty-four (24) hours of the missed deadline.

The contractor’s PM is the authorized point of contact with the Government Contracting Officer’s Representative (COR). PM responsibilities include interfacing with Government management personnel, staffing all tasks, formulating and enforcing work standards, creating personnel and project schedules, reviewing work discrepancies, and communicating Government policies, purposes, and goals to the contractor team.

All decisions regarding Government requirements or Government actions shall be made by Government personnel. The contractor’s representative shall submit evaluations, recommendations, etc., to the COR and/or Contracting Officer (CO) for action.

2.1.1. Task 1, Subtask 1: Contract Management Plan

The contractor shall submit the Contract Management Plan within fifteen (15) business days of contract award. The Government will review the plan and provide comments to the contractor within five (5) business days from receipt of the updated Contract Management Plan. The contractor shall have five (5) business days from receipt of the Government’s comments to submit the final plan. The contractor shall update the plan each option year within fifteen (15) business days of the option year being exercised and funded.

2.1.2. Task 1, Subtask 2: Personnel Status Report

The contractor shall provide a personnel status report containing names, labor categories task alignment, and Cyberspace Workforce certifications of personnel supporting each major task.

The contractor shall provide the report within twenty (20) business days of the contract start date and update the report within five (5) business days of any changes in personnel. The Contractor shall make every reasonable attempt to fill any labor-hour vacancy of a position described in the Technical and Management Work Plan in a time period no longer than a single billing cycle.

2.1.3. Task 1, Subtask 3: Service Contract Reporting Requirements

The contractor shall report in the System for Award Management (SAM): 1) the total dollar amount invoiced for services performed during the previous Government fiscal year under the contract; 2) the prime contractor direct labor hours expended on the services performed during the previous Government fiscal year; and 3) if applicable Tier 1 subcontract number, including DUNS number/Unique Entity Identifier (UEI) and name, and the number of subcontractor direct labor hours expended under the contract. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30.

2.1.4. Task 1, Subtask 4: Weekly and Monthly Status Report

The contractor shall provide accomplishments, issues, and recommendations to weekly activity reports (WAR) in accordance with (IAW) staffing processes assigned by the Government.

The contractor shall provide a Monthly Status Report (MSR) no later than the 15th of the month following the reporting period. At a minimum, the MSR shall include the following information

A list of the accomplishments of the reporting period by each active task/project area.

A synopsis of the efforts completed; deliverables provided; conferences and meetings attended. The MSR shall include a spending “burn down” financial graph showing funds expended to date and funds remaining against the budgeted amount. The format of the financial chart(s) shall be as agreed between the contractor and the Government.

An overall evaluation of the contract to date, listing per task any issues, problem areas, missed deadlines, problem causes/resolutions and items that require Government action.

Delivery schedule for each project/initiative with breakdown of hours expended.

Ad-hoc Government Requested Metrics.

Staffing status, to include projected vacancies, current vacancies, and efforts towards filling vacant positions.

Cyberspace Workforce certification status of personnel aligned to tasks being supported, to include basic, specialty and computing environment certifications and associated expiration dates.

In conjunction with the contract end date, the contractor shall submit a final MSR no later than the last business day of the final period of performance.

2.1.5. Task 1, Subtask 5: In-Progress Reviews

The contractor shall conduct quarterly In-Progress Reviews (IPRs) as scheduled by the Government. At a minimum, the IPR shall summarize status, progress, recommendations, financial summaries, and concerns in the development of any tasks or documentation described within this PWS. Presentation materials shall be prepared and provided to the COR two (2) business days prior to the IPR.

2.1.6. Task 1, Subtask 6: Meeting Minutes

The contractor shall attend meetings or conferences held at USTRANSCOM or other locations (including virtual attendance) as identified by the Government, and provide minutes detailing the results and the impact of the meetings/conferences within two (2) business days after completion of the meeting/conference. Meetings/conferences will generally take place during normal duty hours.

2.1.7. Task 1, Subtask 7: Subject Matter Expertise

The contractor shall provide Subject Matter Expertise (SME) to respond to taskers, inquiries, Requests for Information (RFIs), and other requests as needed by the Government. The contractor shall consolidate, analyze, and present information/data from one or more sources or systems. The contractor shall function as the USTRANSCOM SME to provide guidance to programs in developing their authorization documentation, to ensure consistency, accuracy, and compliance with DoD policy. In this capacity, the contractor shall assist and collaborate with program offices to acquire required authorization documentation needed for security control validation. The contractor shall document the provided guidance in emails, point papers, reports, or briefings as requested by the Government and IAW suspense assigned by the Government.

2.1.8. Task 1, Subtask 8: Transition-In Plan

For the first thirty (30) calendar days, the incoming contractor personnel will be provided transitional training, i.e. will work side-by-side with or shadow the outgoing contractor on the local processes and procedures for performance of day-to-day duties, specifically deliverables.

This effort is not functional in nature, but is to familiarize the incoming contractor with the USTRANSCOM work environment as it relates to the requirements of the PWS. The overall goal of the transition period is to ensure uninterrupted support and seamless transfer of responsibilities to the incoming contractor team(s). Management of the overlap between contracts is a Government function, and guidance will be issued providing direction and clarification of each contractor's responsibilities within the scope of their respective contracts.

This is the minimum essential task for the incoming contractor; nothing within this task limits the responsibility of the contractor to fully execute the contract from the date scheduled for full performance beginning thirty (30) days after contract start.

The contractor shall ensure minimal service disruption to vital Government business and no service degradation during and after the Transition-In period. All transition-in activities shall be completed thirty (30) calendar days after the start date of the contract. The contractor shall deliver a finalized Transition-In Plan within five (5) business days of award.

2.1.9. Task 1, Subtask 9: Transition-Out Plan

If the Government terminates this contract for any reason or if an option year is not exercised, at the discretion of the Government, the contractor may be given up to a sixty (60) calendar-day transition period. The contractor must ensure no logistics or contract data is corrupted, changed, or altered in a manner that would cause damage to the Government. The contractor shall meet performance requirements and cooperate with the successor contractor in the transition period.

During the transition period, the incumbent contractor shall provide the assistance and support required to ensure the orderly transition of all logistics support, and provide transitional planning necessary to enable the follow-on contractor to commence uninterrupted operations at the end of the transition period. The contractor shall also establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings. The contractor shall ensure follow-on contractor personnel are permitted access to observe all operations, including workflow, priorities, scheduling, equipment handling/processing, parts storage, safety, and security. Familiarization visits shall not interfere with the activities of the incumbent contractor or Government personnel.

The contractor shall provide and implement a Transition-Out Plan within 45 (forty-five) calendar days prior to expiration or notification of contract termination. To ensure a seamless transition, the contractor shall identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

Project management processes

Points of contact

Location of technical and project management documentation

Schedules and milestones

Status of ongoing technical initiatives

Appropriate contractor-to-contractor coordination

Transition of key personnel

Actions required of the Government

File plan, work related documents, files, policies and processes

Inventories of hardware and software

Access permission by individuals to locations in which they support

The contractor shall organize all work related documents and files, store them on the designated Government collaboration tool and provide a file plan outlining the file structure. Status for each project shall be documented, to include recent, current, and pending actions. The contractor shall provide all-inclusive hardware and software inventories, a listing of all COTS utilized in support of this contract, accountability of licenses, and soft copies of all procedures and training materials developed as part of this contract. In addition, the contractor shall provide a complete list of all badges, vehicle passes, and Government software access permissions by individual currently working on the contract.

The contractor shall deliver all data, compiled and un-compiled source code, flow charts, and business processes for the system and support applications at the completion of this task order.

2.2. Task 2: Risk Management Support Overview

The contractor shall provide Risk Management support for USTRANSCOM in implementing and conducting operations for all phases of the DoD Risk Management Program (DoDI 8510) and NIST 800-37 Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, revision 2, either on-site or virtually dispersed across the United States and within USTRANSCOM’s Commercial Cloud environment, during normal duty hours. Risk management activities shall encompass processes, procedures, and technical operations enabling USTRANSCOM to frame risk, i.e., establish the context for risk-based decisions; assess risk; respond to risk once determined; and monitor risk on an ongoing basis using effective organizational communications and a feedback loop for continuous improvement in the risk-related activities of the organization. In support of these objectives, the contractor shall perform cyber security operations, which include:

Information Systems Security Engineering (ISSE) services

Risk assessment development and support

Authorization support

Security configuration and vulnerability management support

Software assurance support

Security testing and auditing of security controls

This contract provides cyber security services to USTRANSCOM. The contractor shall perform all work IAW the below:

All applicable laws, e.g. Clinger Cohen Act (CCA); regulations, and national standards, e.g., NIST

DoD Defense Information Systems Agency (DISA)

Chairman of the Joint Chiefs of Staff (CJCS)

Committee on National Security Systems (CNSS)

National Security Agency (NSA)

Joint Forces Headquarters DoD Information Network (JFHQ DoDIN)

United States Cyber Command (USCYBERCOM)

USTRANSCOM standards and instructions

Best Development Security Operations (DevSecOps) practices as appropriate

The contractor shall maintain continuous situational awareness over the Evaluator’s Scoring Metrics (ESM) applicable to assigned PWS tasks. Reference ESM as specified in DoD O-8530.1-M, Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Program.

The contractor shall coordinate with the Program Management Government functional to determine if an Authorizing Official (AO) has previously approved the specified system for operation on a DoD or Federal network (reciprocity). If prior test results exist, the contractor shall obtain and analyze the previous results for completeness and applicability to the USTRANSCOM target environments.

Knowledge

The contractor’s staff performing Risk Management shall possess the following:

Understand network and host-based security devices (e.g., Intrusion Prevention Systems [IPS], Intrusion Detection Systems [IDS], firewall, proxy servers, sensors, switches, routers, hubs) and their role in moving packets securely from source to destination.

Understanding of security requirements, testing, assessment and validation procedures, and best practices applicable to physical, virtual, and cloud (Infrastructure as a Service [IaaS], Platform as a Service [PaaS], Software as a Service [SaaS]) based environments.

Knowledge of information security technologies (e.g., cryptography, biometrics, forensic analysis, vulnerability assessment, Security Information and Event Management [SIEM]).

Understanding of Federal and DoD computer security policies, e.g., Security Technical Implementation Guides (STIGs)/Security Requirements Guides (SRGs), Electronic Communications, Privacy Act, Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management/Modernization Act (FISMA), and Digital Millennium Act.

Thorough understanding of NIST Special Publications (SP), and commercial best practices.

Desired knowledge of applicable DoD, JFHQ DoDIN, USCYBERCOM, and USTRANSCOM security guidelines and best practices.

Thorough understanding of DoD policies applicable to implementation of the DoD RMF.

Working knowledge of ISO 27001, 27002.

2.2.1. Task 2, Subtask 1: Information Systems Security Engineering (ISSE)

As an integral part of the overall organizational implementation of the RMF, the contractor shall provide ISSE life cycle support to the Government in accordance with the principles delineated in NIST SP 800-160 Vol I, System Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems, and Vol II, Developing Cyber Resilient Systems: A Systems Security Engineering Approach, and other applicable directives.

In support of USTRANSCOM risk management processes, the contractor shall assess potential risks, mitigation measures, residual risks, and provide Security Risk Assessment recommendations to the Government for approval or disapproval. The contractor shall research and advise the SISO and other Government staff on recently developed countermeasures designed to protect command systems from new threats. The contractor shall assist in the development, implementation, and administration of effective security programs for approval by the Government and provide guidance, cyber alerts, and best practice information to the appropriate audience(s) (e.g., standard/privileged users, system administrators, Information System Security Mangers [ISSM], PMs, etc.) throughout the command.

The contractor shall conduct risk assessments to determine the risk posed by the integration of new systems or capabilities into the USTRANSCOM environment. Reports from tests and evaluations performed by other teams supporting USTRANSCOM will be provided to the contractor to support these risk assessments. In some cases, the contractor shall be required to obtain supporting data from other DoD/Federal organizations, vendors or Internet research. Risk assessments shall be conducted in accordance with the principles of NIST SP 800-30, Guide for Conducting Risk Assessments, and the principles of NIST SP 800-160 Vol I and Vol II, and security best practices. Risk assessments shall:

address risk factors, threats, vulnerabilities, likelihood of exploit, and security control effectiveness of systems consider risk in light of all capabilities and services provided by the DoD and USTRANSCOM layered defense architectures identify potential mitigation measures; and specify residual risk after mitigations are applied

Risk assessments shall quantify the potential cost to the Government if a threat agent exploits the vulnerabilities identified in the risk assessment and the cost of implementing the recommended mitigations. A cost model will be provided by the Government. Risk assessments shall be accomplished in the format prescribed by the Government and IAW suspense assigned by the Government.

2.2.1.1. Task 2, Subtask 1.1: ISSE Metrics and Supporting Documentation

The contractor shall collect and provide the Government with monthly metrics on cyber security ISSE activity NLT five (5) business days after the end of the month. The metrics shall include:

List and status of risk assessments performed

The contractor shall maintain current documentation on ISSE processes and procedures and provide the following deliverable documents to the Government NLT ten (10) business days prior to the end of each quarter.

Educational Cyber Alert Document (Fiscal Qtr 1,2,3,4)

Host-Based Firewall Technologies for Linux/UNIX Documents (Fiscal Qtr 1)

Secure Shell (SSH) Training Brief (Fiscal Qtr 1)

Stunnel Training Brief (Fiscal Qtr 1)

Talking Papers (Fiscal Qtr 2)

Dangers of Network Consolidation

IDS & IPS

Insecure Protocols

Minimal System Install

Ports and Protocol Blocking

Security 101

User Agent Filtering

USTRANSCOM Best Practices

USTRANSCOM Best Practices - Releasable

Virtual Private Network (VPN)

Weak Authentication

TCP/IP Training Briefing (Fiscal Qtr 2)

Unix Security Training Brief (Fiscal Qtr 2)

USTRANSCOM Enterprise Information Security Continuous Monitoring Standard Operating Procedure (SOP) & Checklists (Fiscal Qtr 2)

USTRANSCOM Reviewing Vulnerability Scanner Findings Guide (Fiscal Qtr 3)

Cyberspace Defense Handout (tri-fold) (Fiscal Qtr 4)

System Administration Cyber Security Training Brief (Fiscal Qtr 4)

2.2.2. Task 2, Subtask 2: Software Assurance Support

The contractor shall develop and assist USTRANSCOM in implementing required processes, procedures, and capabilities to remediate and mitigate vulnerabilities and weaknesses within software developed for USTRANSCOM in accordance with applicable standards, directives, and best practices, to include the applicable DISA STIGs/SRGs, Information Technology Infrastructure Library (ITIL), ISO/IEC/IEEE 1528,8 Systems and Software Engineering, System life Cycle Processes, NIST SP 800-160, Vol I, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules, and DoD, NSA, USTRANSCOM, and other applicable policies. The contractor shall provide an annual review NLT 30 Nov of each year and monthly updates as needed of secure coding standards for Government approval that documents the following:

Best practices, both programming language agnostic and language specific, to prevent introduction of weaknesses into developed software.

Recommendations for manual and automated methods of testing for common weaknesses.

Processes for submitting secure coding analysis results for evaluation.

The contractor shall serve as the USTRANSCOM SME for administering and executing processes to ensure compliance with applicable software assurance directives. This includes the following:

Developing procedures for evaluating the results of software assurance testing.

Evaluating results of software testing and analysis tools and making recommendations for Government approval regarding the level of risk presented by the software to USTRANSCOM. The contractor shall provide the Government Software Testing Analysis Recommendations IAW suspense assigned by the Government.

Developing and maintaining Common Weakness Risk Analysis Framework (CWRAF) vignettes that define USTRANSCOM operating environments and priorities with respect to software security to be used by software developers to generate analysis tool results supporting the Common Weakness Scoring System (CWSS) and prioritize remediation.

These will be initially developed and updated as needed with quarterly reviews due NLT ten

(10) business days prior to the end of each quarter.

Fine-tuning analysis configurations to remove false positives from results.

The contractor shall collaborate with other DoD and Federal Government agencies such as the DoD Software Assurance Community of Practice and Joint Federated Assurance Center (JFAC) and review current software assurance community best practices to integrate the latest requirements into USTRANSCOM software assurance practices.

Knowledge

The contractor shall demonstrate experience with the following:

Broad understanding of information technology and software engineering principles, concepts, and techniques including software languages, design concepts, test methods, and integration practices.

Secure Software Concepts; security implications and methodologies within centralized and decentralized environments across the enterprise’s computer systems in software development.

Secure Software Requirements; capturing security controls used to integrate security within the process, in order to identify key security objectives, and to maximize software security while minimizing disruption to plans and schedules.

Secure Software Design; translating security requirements into application design elements including documenting the elements of the software attack surfaces, conducting threat modeling, and defining any specific security criteria.

Secure Software Implementation/Coding; application of coding and testing standards, to include applying security testing tools, static-analysis code scanning tools, and conducting code reviews.

Secure Software Testing; integrated testing for security functionality and resiliency to attack.

Software Acceptance; security implications in the software acceptance phase including completion criteria, risk acceptance and documentation, Common Criteria and methods of independent testing.

Supply Chain and Software Acquisition; knowledge and tasks required in managing risk for outsourced development, acquisition, and procurement of software and related services.

Excellent written and verbal communication skills, demonstrating the ability to present material to senior DoD and non-DoD officials.

Able to communicate effectively with senior leaders and customers to clearly present technical approaches and findings.

2.2.2.1. Task 2, Subtask 2.1: Software Assurance Metrics and Process/Procedure Documentation

The contractor shall collect and provide the Government with monthly metrics on software assurance support NLT 5 business days after the end of the month. The metrics shall include:

Results of evaluations performed

Programs assisted with configuration tuning and false positive identification

Design reviews and forums attended

The contractor shall maintain current documentation on software assurance policies, processes and procedures and provide the following deliverable documents to the Government quarterly NLT ten (10) business days prior to the end of each quarter.

Software Assurance SOP & Checklists (Fiscal Qtr 1)

USTRANSCOM TCJ6 Code Scanning Policy (Fiscal Qtr 1)

Software Assurance Standards (Fiscal Qtr 4)

2.2.3. Task 2, Subtask 3: Security Auditing, Continuous Monitoring, and Vulnerability Management Activities Support Overview

The contractor shall conduct an overall enterprise vulnerability management program and perform security audits of designated USTRANSCOM systems as part of the overall organizational Risk Management Program. Responsibilities include analysis of potential vulnerabilities and required mitigations as needed to protect and defend USTRANSCOM systems. The objectives are to assess the effectiveness of the total system security and make mitigation recommendations to Government based on these reviews, IAW a suspense date assigned by the Government.

2.2.3.1. Task 2, Subtask 3.1: Security Auditing

For assets residing within USTRANSCOM physical and virtual enclaves located at Scott AFB, IL; USTRANSCOM Commercial Cloud Environment; and JECC—Norfolk, VA; O’Fallon, IL and Fairview Heights, IL the contractor shall conduct in-depth security audits of systems prior to connection to the USTRANSCOM network, and at the discretion of the AO thereafter, to validate the configuration against guidelines contained in the applicable DoD and USTRANSCOM baseline images, build-guides, checklists, STIG/SRG guidance and security alerts.

The contractor shall:

Review all security controls and procedures to assess and measure the effectiveness of the total system security.

Generate reports for the technical point of contacts (POCs)/ System Administrator (SA) of audited systems that detail compliant and non-compliant findings, with remediation recommendations for non-compliant findings.

Revalidate system compliance after technical POC/SA remediation of non-compliant findings

Generate final audit report on system compliance status.

The contractor shall provide the audit report to the ISSE functional Government lead for risk assessment consideration, and for review of proposed changes to ensure that new systems introduced into USTRANSCOM and the TCCs are IAW DoD and command computer security policies. Reports are due IAW suspense assigned by the Government.

In addition, the contractor shall perform special security audits of systems as requested by the Government. Special security audits are assessments of systems based on specific risk conditions or command interest, and will typically involve scanning and on-system measurements of the compliance status of the system.

2.2.3.2. Task 2, Subtask 3.2: Continuous Monitoring

For assets residing within USTRANSCOM physical and virtual enclaves located at Scott AFB, IL; USTRANSCOM Commercial Cloud Environment; and Joint Enabling Capabilities Command (JECC)—Norfolk, VA, the contractor shall:

Gather and maintain system configuration information, e.g., operating systems/versions, key software/versions, and DISA STIG compliance, to monitor the USTRANSCOM unclassified and classified systems for compliance with command security policies.

Monitor cybersecurity dashboards and take action as appropriate to address issues that are outside USTRANSCOM’s risk tolerance.

Perform weekly vulnerability scanning and analysis (i.e., Assurance Compliance Assessment Solution [ACAS], Information Assurance Vulnerability Management [IAVM]).

Perform semi-annual external vulnerability scanning and analysis of all USTRANSCOM public facing web servers.

Perform on-request validation scans for USTRANSCOM systems.

Report vulnerability scanning results to the Government within three (3) business days of the completion of the scan.

Assist system administrators of USTRANSCOM systems with identifying potential remediation actions for all identified vulnerabilities.

Update information in the Continuous Monitoring and Risk Scoring (CMRS) or other designated system in accordance with USCYBERCOM requirements.

Compile reports/analysis as requested by the Government.

The contractor shall perform operations and sustainment for Government Furnished Equipment (GFE) scanning systems. The contractor shall be responsible for systems administration of Government furnished scanning systems at Scott AFB, IL;

USTRANSCOM Commercial Cloud Environment; and Joint Enabling Capabilities Command (JECC)—Norfolk, VA.

The contractor shall perform network discovery scans on a weekly basis and compare results of discovery scans against reports of assets as identified by Host Based Security System (HBSS) (or replacement tool as designated by the Government). Any systems identified by HBSS, but not by the network discovery scans, shall be incorporated into weekly scanning activities. Any systems not covered by HBSS shall be provided to the HBSS team for analysis.

Additionally, in support of all assets residing within the USTRANSCOM Mobility Air Forces (MAF) C2/Distributed Enclave (DE) and Surface Deployment and Distribution Command (SDDC) C2/Centralized Enclave (CE) located at Scott AFB, IL; Ramstein AB, GE; McConnell AFB, KS; and GATES Development (DEV) located at O’Fallon, IL and Fairview Heights, IL, the contractor shall:

Perform vulnerability scanning on a bi-annual basis utilizing AMC and SDDC Government furnished network scanners.

Conduct a bi-annual Staff Assisted Visit (SAV) supporting Scott AFB and the GATES DEV in O’Fallon. Submit reports within three (3) business days of completed SAV.

Review ACAS configuration settings and share best practices.

Analyze results of vulnerability scans performed by AMC and SDDC monthly.

Provide feedback and remediation assistance as appropriate.

Perform patch compliance spot checks for verification.

2.2.3.3. Task 2, Subtask 3.3: Vulnerability Management

In support of these vulnerability management activities for assets residing within USTRANSCOM, MAF C2 and SDDC C2 physical and virtual enclaves located at Scott AFB IL USTRANSCOM Commercial Cloud Environment; JECC—Norfolk, VA; Ramstein AB, GE; and McConnell AFB, KS.

The contractor shall provide the following IAW suspense assigned by the Government:

Manage the command IAVM program, to include all actions needed to distribute, track, and report IAVM compliance and trend data.

Update USCYBERCOM and JFHQ DoDIN on IAVM status.

Prepare IAVM reports and trend analysis for USTRANSCOM

Prepare and process Plan of Action and Milestones (POA&Ms).

The contractor shall monitor applicable Government and private sector vulnerability databases and sources to identify vulnerabilities not released through the DoD IAVM program that have the potential of impacting USTRANSCOM systems. The contractor shall employ a vulnerability alerting process to notify USTRANSCOM personnel to the presence of such vulnerabilities affecting systems and networks. The contractor shall ensure that the SISO, Chief Information

Officer (CIO), and designated partners are familiar with internal and external vulnerabilities that may impact USTRANSCOM mission assurance, along with recommended actions to mitigate the risks.

2.2.3.4. Task 2, Subtask 3.4: Security Auditing, Continuous Monitoring and Vulnerability Management Metrics and Process/Procedure Documentation

The contractor shall collect and provide the Government with monthly metrics on security auditing and vulnerability management activity NLT five (5) business days after the end of the month. The metrics shall include:

List and status of system evaluations performed

Number of DoD IAVMs distributed

Number of internal vulnerability alerts generated and distributed

Number of scan reports reflecting known un-remediated and unmitigated vulnerabilities provided to system POCs

Number of systems on the USTRANSCOM network (including AMC and SDDC enclaves) with Category 1 vulnerabilities

Number and type of issues adjudicated from USTRANSCOM cybersecurity dashboards

The contractor shall maintain current documentation on security auditing, and vulnerability management processes and procedures and provide the following deliverable documents to the Government NLT ten (10) business days prior to the end of each quarter.

Security Evaluation Process Training Brief (Fiscal Qtr 1)

Vulnerability Management Training Briefing (Fiscal Qtr 1)

USTRANSCOM Enterprise Information Security Continuous Monitoring SOP & Checklists (Fiscal Qtr 2)

USTRANSCOM Reviewing Vulnerability Scanner Findings Guide (Fiscal Qtr 3)

USTRANSCOM System Security Evaluation SOP & Checklists (Fiscal Qtr 4)

USTRANSCOM Vulnerability Management SOP & Checklists (Fiscal Qtr 4)

2.3. Task 3: Security Control Assessor (SCA) and Authorizing Official (AO) Support Overview

The contractor shall serve as a Security Control Assessor Representative (SCAR) on behalf of the SCA and AO. These duties require coordination and collaboration across the Joint Deployment and Distribution Enterprise (JDDE). The JDDE community of interest provides expertise through system program managers, system SMEs, and other stakeholders as needed. In support of the USTRANSCOM risk management processes, contractor shall assist Government with the overall responsibility to conduct independent comprehensive assessments of the management, operational, privacy and technical security controls and controls enhancements employed within or inherited by an information technology (IT) system to determine the overall effectives of the controls. There are approximately 68 Programs of Record and systems supported.

2.3.1. Task 3, Subtask 1: Security Control Assessor Representative (SCAR) Tasks

The contractor shall:

Provide SME support for Risk Management activities within and/or outside Enterprise Mission Assurance Support Service (eMASS) or other tool as designated by the Government.

The contractor shall provide technical and operational analyses of supporting artifacts and provide risk analysis recommendations to the SCA. The contractor shall have a thorough understanding of eMASS and execute/perform functions in eMASS using capabilities that would automate and integrate capabilities to review/assess artifacts.

Perform triage of authorization, POA&M, System Security Plan, System Categorization, and risk acceptance requests within seven (7) business days of submission of the checklist from the Program Management Office (PMO) and/or system owner using the USTRANSCOM RMF Artifact Quality Rubric. The contractor performing SCAR duties shall identify non-compliant submissions, document in the Package Return Report (PRR), and submit to the Government SCA for approval and signature.

Review security artifacts provided by program offices or other organizations, and assess both technical and functional adequacy of cyber security/Information Assurance (IA) controls and provide written Risk Assessment recommendations to the SCA IAW suspense assigned by the Government and as defined by the Government. SCA recommendations shall be supported with artifacts of compliance/non-compliance from the ISSM/PMO and may include Bottom Line Up Front, Risk Impact (Technical/Operational/Cost, etc.), mitigations, and estimated completion dates.

Perform the Independent Verification and Validation (IV&V) role within the eMASS tool on NIPRNet and SIPRNet, verifying that controls are in-place, operating as intended, producing desired outcomes, and providing feedback to submitters on non-compliant security controls, adequacy of artifacts, and POA&M items, and provide the required PRR as needed.

Compile Authorization Official package to include risk assessment, required artifacts, and required approval documents to support risk recommendations to the AO in accordance with Government guidance. Maintain and execute processes for reviewing and routing of authorization packages.

Create and coordinate RMF packages such as categorizations, security plans and POA&Ms for signature by approved authorities as designated by the Government and IAW suspense assigned by the Government.

The contractor shall provide all PRRs to the SCA team for signature and coordinate with submitters for resolution. The contractor shall maintain historical copies of all packages in a Government designated repository.

Meet Government validated authorization package “need-by-dates” IAW suspense assigned by the Government as they align with system prioritization determinations and document non-compliance. The contractor shall provide written notification in an Authorizing Official Non-Delivery Report to the Government within three (3) business days prior to the package validated “need-by-date” if the contractor team will not meet the date, and propose a new date. The notification must indicate the reason(s) for the delay (e.g., priority systems in the queue, incomplete/insufficient package submission, short-notice submission, personnel availability, etc.).

Document in the MSRs to include the reason for missing the deadline, estimated completion date, and efforts taken to meet the suspense until the completion date is satisfied.

Manage eMASS user accounts (i.e., add, delete, and assign/update roles) for USTRANSCOM’s instance of eMASS per Government direction.

Create and process authorization packages within the workflow tool, Certification and Accreditation Process Tool (CAPT) or other tool as designated by the Government and as requested by the Government.

Track status of checklists and packages from submission through approval or disapproval decision by the AO.

2.3.1.1. Task 3, Subtask 1.1: Security Control Assessor Representative (SCAR) Metrics and Process/Procedure Documentation

The contractor shall collect and provide the Government with monthly metrics on authorization activity NLT five (5) business days after the end of the month. The metrics shall include:

As a minimum, metrics will support the service delivery objectives such as the 7-day triage time, 30-day Interim Authorization to Test (IATT) processing time, and 60-day Authority to Operate (ATO) and / Authority to Connect (ATC) processing time

Number, type, and status of packages (e.g., POA&M, IATT, ATO, etc.) completed

Status of conditions for conditional ATOs, to include condition due dates

Package processing cycle times, to include at a minimum package submission date, need-by date, review start date, review completion date, authorization decision date, and number of days before or after required authorization date

The contractor shall maintain current documentation on authorization processes and procedures and provide the following deliverable documents to the Government quarterly NLT ten (10) business days prior to the end of each quarter.

USTRANSCOM Reference list of core artifacts and inheritable controls (Fiscal Qtr 1,2,3,4)

USTRANSCOM RMF ATO Triage Checklist (Fiscal Qtr 1)

USTRANSCOM IATT Triage Checklist (Fiscal Qtr 1)

Security Control Selection Response and Inheritance Guide (Fiscal Qtr 2)

USTRANSCOM Assessing an RMF ATO Checklist (Fiscal Qtr 2)

USTRANSCOM POA&M Extension Triage Checklist (Fiscal Qtr 2)

Authorizations Example Artifacts/Documentation (if requested) (Fiscal Qtr 3)

USTRANSCOM Assessing an IATT Checklist (Fiscal Qtr 3)

USTRANSCOM Assessment and Authorization (A&A) SOP & Checklists (Fiscal Qtr 4)

USTRANSCOM Security Assessment Report SOP & Checklist (Fiscal Qtr 4)

2.3.2. Task 3, Subtask 2: Enterprise DoD Ports, Protocols, and Services Management

(PPSM)

The contractor shall assist USTRANSCOM in performing actions required to implement the

DoD Ports, Protocols, and Services (PPS) Program as outlined in DoDI 8551.01 and other applicable DoD directives. In support of this task, the contractor shall develop a plan for USTRANSCOM to manage the overall life cycle risk management of ports, protocols, and services in accordance with DoDI 8551.01. In addition, the contractor shall assist Government personnel, accomplish PPSM technical functions, and provide guidance to the USTRANSCOM staff for PPSM related activities.

The contractor shall:

review new/updated PPS worksheets submitted by USTRANSCOM programs and TCCs review PPS Vulnerability Assessments (VA) and Component Level Service Assessments (CLSA) provided by the programs provide concurrence/non-concurrence status of the PPS IA/security control to the SCA upon approval by the Government lead, submit PPS vulnerability assessments and CLSAs on behalf of USTRANSCOM to the PPSM Secretariat, DoD PPSM Configuration Control Board (CCB) and the DoD PPSM Technical Advisory Group (TAG) in accordance with Government IAW suspense assigned by the Government

The contractor shall track registration status of USTRANSCOM and TCC systems to include the authorization termination date (ATD), registered non-compliant PPS, and submitted exceptions/VAs and CLSAs for compliance with DoD PPSM directives. The contractor shall review and submit exception requests affecting USTRANSCOM systems, as needed, to the PPSM Exception Management Process, available at the DoD Cyber Exchange website.

The contractor shall create and manage PPSM registries user accounts for USTRANSCOM and TCC system A&A personnel, to include access requests, role modifications, and terminations per Government direction. Manage PPSM user accounts (i.e., add, delete, and assign/update roles) for USTRANSCOM’s instance of PPSM per Government direction.

Additionally, the contractor shall assist the Government in accomplishing required actions for USTRANSCOM systems that require submission and approval by the DoD PPSM CCB. The contractor shall support the Government DoD PPSM TAG representative by attending virtual DoD PPSM CCB and TAG events, reviewing information distributed by the DoD PPSM Secretariat. The contractor shall provide CCB and TAG recommendations to the Government on required actions, as requested by the Government and IAW suspense assigned by the Government.

The contractor shall provide technical review and recommendations for PPS requirements related to areas such as for firewalls, proxies, and white lists updates.

2.3.2.1. Task 3, Subtask 2.1: Enterprise DoD Ports, Protocols and Services Registration Metrics and Process/Procedure Documentation

The contractor shall collect and provide the Government with monthly metrics on PPS registration activity NLT five (5) business days after the end of the month. The metrics shall include:

Listing of systems entered into the DoD PPSM Registry, exceptions, banned services/ports, PPS vulnerability assessments, CLSAs, and their status

Listing of systems operating under expired authorization in the PPSM Registry

The contractor shall create and maintain current documentation on authorization processes and procedures and provide the following deliverable documents to the Government quarterly NLT ten (10) business days prior to the end of each quarter.

USTRANSCOM PPS Exception Process SOP (Fiscal Qtr 2)

USTRANSCOM PPSM SOP & Checklist (Fiscal Qtr 4)

2.4. Task 4: Development Security Operations (DevSecOps) RMF and SCA Support (Optional)

The contractor shall serve as a Cyber Security Engineer on behalf of the SCA and AO. These duties require coordination and collaboration across DevSecOps Program’s stakeholders.

2.4.1. Task 4, Subtask 1: RMF-DevSecOps – Cyber Security Engineering (CSE)

In facilitating the overall implementation of DevSecOps in supporting RMF activities, the contractor shall:

Be integrated in the DevSecOps platform and application processes to assess potential risks, mitigation measures, residual risks, support the development of assessment plans, and provide Security and Privacy Risk Assessment recommendations to the Government for approval or disapproval in support of USTRANSCOM DevSecOps risk management processes.

Conduct research for and advise the SCA, AO, DevSecOps Program Manager, and other Government staff on recently developed countermeasures designed to protect command platforms and applications from new threats.

Use Continuous Integration/Continuous Delivery tool chain automation and reporting features for conducting risk assessments.

Determine the risk posed by the integration of a minimum viable product (e.g., modular-based component for the platform or application), as well as ATO’s into the USTRANSCOM environment.

Automate the tailoring of security controls and adjust baselines commensurate to mitigate risks and protect system from cyber-attacks.

Leverage CI/CD tool chain automation and reporting to inform and provide continuous feedback to support risk management activities.

Leverage CI/CD automation to codify security policies and checklists in tool chains to validate and identify gaps in security compliance.

Conduct…