2025.09.18 SISO PWS (Draft).pdf

PERFORMANCE WORK STATEMENT

FOR

SENIOR INFORMATION SECURITY OFFICER

In Support of the United States Transportation Command

TASK ORDER HTC71122FD026

XX XXX 2025

Prepared by

UNITED STATES TRANSPORTATION COMMAND

DIRECTORATE OF COMMAND, CONTROL, COMMUNICATIONS & CYBER

SYSTEMS

1. DESCRIPTION OF SERVICES

1.1. Background

The United States Transportation Command (USTRANSCOM), located at Scott Air Force Base (AFB), IL, is one of eleven (11) Unified Combatant Commands (UCC). USTRANSCOM provides command and control (C2) for the synchronized transportation, distribution, and sustainment of personnel and assets, making possible the projection and maintenance of national power wherever needed with speed and agility, high efficiency, and a high level of trust and accuracy.

USTRANSCOM’s mission is to conduct globally integrated mobility operations, lead the broader Joint Deployment and Distribution Enterprise, and provide enabling capabilities in order to project and sustain the Joint Force in support of national objectives. The Commander exercises responsibilities as prescribed in the Unified Command Plan. These duties include being the Mobility Joint Force Provider, Department of Defense (DoD) Single Manager for Transportation, Joint Deployment and Distribution Coordinator, DoD Single Manager for Patient Movement, and Joint Enabling Capabilities. An important functional requirement is the integration of the Transportation Component Commands (TCCs): Air Mobility Command (AMC), Surface Deployment and Distribution Command (SDDC), Military Sealift Command (MSC), and the Joint Enabling Capabilities Command (JECC).

USTRANSCOM Command, Control, Communications, and Cyber (C4) Systems (C4S) Directorate (TCJ6) is responsible for long-range planning, policy guidance, direction, technical control, and program management for projects involving the development and implementation of major transportation management systems DoD-wide. The Information Security Division (TCJ6-X) led by the Senior Information Security Officer (SISO) establishes, advocates, and maintains enterprise cybersecurity vision, standards, and strategy to ensure cyber assets and information technologies are provided. More specifically, SISO’s Security Policy and Compliance branch (TCJ6-XS) manages areas such as system authorizations via the Risk Management Framework (RMF), cyber hygiene scorecards, and Defense Readiness Reporting System (DRRS).

1.2. Scope

The scope of the contract effort is to provide a range of services supporting the RMF for USTRANSCOM, AMC and SDDC missions. Cybersecurity and risk management skills will be required to support the USTRANSCOM C4 environment, which interfaces with numerous on-site and remote commercial, DoD, service, and common-user networks (i.e., Secret Internet Protocol Router Network [SIPRNet], Non-secure Internet Protocol Router Network [NIPRNet], DoD Information Networks [DoDIN], DoD-approved cloud environments and the Scott AFB Local Area Network [LAN], Wide Area Network [WAN], or Metropolitan Area Network [MAN]).

The contractor shall provide a range of Information Technology (IT) services to include cyber security, RMF Security Controls Assessor Representative (SCAR) evaluations, technical testing and evaluation, analysis and guidance, software assurance management, and all deliverables related to these services.

The contractor shall utilize risk management best practices to perform the tasks and subtasks of this Performance Work Statement (PWS) to provide responsive IT service delivery. The required outcomes are delivering risk management services to USTRANSCOM users within agreed service levels and achieving continual risk management improvements to IT systems and services. The contractor shall coordinate, manage, and assign resources, processes, and activities regarding the successful delivery of the entire IT service delivery process as defined in this PWS. The contractor, in coordination with the Government, shall establish, collect, and report metrics to evaluate and improve service delivery performance.

2. TASK AREAS

2.1. Task 1: Contract Management

This task consists of the functional activities relating to the administration and management of this effort. The contractor shall identify a Program Manager (PM) by name who shall provide management, direction, administration, clerical support, documentation, quality assurance, and leadership during the execution of this PWS. The contractor shall designate a principal point of contact for technical issues in addition to the PM. The contractor shall prepare documents, such as briefings, point papers, and meeting minutes related to the performance of this PWS. Additionally, the contractor shall be required to present material to senior DoD, non-DoD officials, other senior leaders, and customers to clearly present technical approaches and findings. The contractor shall provide support in the specific areas outlined below in this PWS.

The contractor shall provide all deliverables listed in Section 3, to include referenced documents and contractor-developed, Government-approved plans, schedules, and milestones.

The contractor shall meet stated Government requirements and milestones. If the contractor does not meet milestones, the Government must be notified in writing within twenty-four (24) hours of the missed milestones.

The contractor’s PM is the authorized point of contact with the Government Contracting Officer’s Representative (COR). PM responsibilities include interfacing with Government management personnel, staffing all tasks, formulating, and enforcing work standards, creating personnel and project schedules, reviewing work discrepancies, and communicating Government policies, purposes, and goals to the contractor team.

All decisions regarding Government requirements or Government actions shall be made by Government personnel. The contractor’s PM shall submit evaluations, recommendations, etc., to the COR and/or Contracting Officer (CO) for action.

The contractor shall provide a Kick-off Meeting within ten (10) business days of contract award with presentation materials due no later than two (2) business days prior to the meeting. This meeting supports the SISO team and the Contracting Officer. Topic areas should cover roles and responsibilities, identification of key contract personnel, contract terms and conditions, billing procedures, any questions concerning PWS, and any other topics that may arise.

2.1.1. Task 1, Subtask 1: Contract Management Plan

The contractor shall submit the Contract Management Plan within fifteen (15) business days of contract award. The Government will review the plan and provide comments to the contractor within five (5) business days from receipt of the Contract Management Plan. The contractor shall have five (5) business days from receipt of the Government’s comments to submit the final plan.

The contractor shall update the plan each option year within fifteen (15) business days of the option year being exercised and funded.

2.1.2. Task 1, Subtask 2: Weekly and Monthly Status Report

The contractor shall provide significant accomplishments, issues, and recommendations in the Weekly Activity Report (WAR) in accordance with (IAW) timelines assigned by the Government.

The contractor shall provide the Monthly Status Report (MSR) no later than the 15th of each month. At a minimum, the MSR shall include the following information:

• A list of the accomplishments during the reporting period by each active task/project area.

• A synopsis of the efforts completed, deliverables provided, and conferences and meetings attended.

• The MSR shall include a spending “burn down” financial graph showing funds expended to date and funds remaining against the budgeted amount. The format of the financial chart(s) shall be as agreed between the contractor and the Government.

• An overall evaluation of the contract to date, listing per task any issues, problem areas, missed deadlines, problem causes/resolutions and items that require Government action.

• Delivery schedule for each project/initiative with breakdown of hours expended.

• Ad-hoc Government Requested Metrics.

• Staffing status - include projected vacancies, current vacancies, and efforts towards filling vacant positions. Any personnel changes must be updated within five (5) business days and provided to the Government.

• Cyberspace Workforce certification status of personnel aligned to tasks being supported, to include basic, specialty and computing environment certifications, and associated expiration dates.

In conjunction with the contract end date, the contractor shall submit a final MSR no later than the last business day of the final period of performance.

2.1.3. Task 1, Subtask 3: In-Progress Reviews

The contractor shall conduct quarterly In-Progress Reviews (IPRs) as scheduled by the Government. At a minimum, the IPR shall summarize status, progress, recommendations, financial summaries, and concerns in the development of any tasks or documentation described within this PWS. Presentation materials shall be prepared and provided to the COR two (2) business days prior to the IPR.

2.1.4. Task 1, Subtask 4: Meeting Minutes

The contractor shall attend meetings or conferences held at USTRANSCOM or other locations (including virtual attendance) as identified by the Government. Meetings/conferences will generally take place during normal duty hours. The contractor shall provide minutes detailing the results and the impact of the meetings or conferences within two (2) business days after completion of the meeting or conference in the following cases:

• The contractor is the host.

• The Government has verbally or in writing requested support.

• The contractor is attending on behalf of the Government.

2.1.5. Task 1, Subtask 5: Subject Matter Expert

The contractor shall provide a Subject Matter Expert (SME) to respond to taskers, inquiries, Requests for Information (RFIs), and other requests as needed by the Government. The contractor shall consolidate, analyze, and present information and/or data from one or more sources or systems. The contractor shall function as the USTRANSCOM SME to provide guidance to programs in developing their authorization documentation, to ensure consistency, accuracy, and compliance with DoD policy.

In this capacity, the contractor shall assist and collaborate with program offices to acquire required authorization documentation needed for security control validation. The contractor shall document the provided guidance in emails, point papers, reports, or briefings as requested by the Government and IAW suspense assigned by the Government.

2.1.6. Task 1, Subtask 6: Transition-In Plan

For the first thirty (30) calendar days, the incoming contractor personnel will be provided with transitional training, i.e., will work side-by-side with or shadow the outgoing contractor on the local processes and procedures for performance of day-to-day duties, specifically deliverables.

This effort is not functional in nature but is to familiarize the incoming contractor with the USTRANSCOM work environment as it relates to the requirements of the PWS. The overall goal of the transition period is to ensure uninterrupted support and seamless transfer of responsibilities to the incoming contractor team(s). Management of the overlap between contracts is a Government function, and guidance will be issued providing direction and clarification of each contractor's responsibilities within the scope of their respective contracts.

This is the minimum requirement for the incoming contractor. Starting 30 days after the contract start date, the contractor is fully responsible for executing the contract, regardless of this task’s scope.

The contractor shall ensure minimal service disruption to vital Government business and no service degradation during and after the Transition-In period. All Transition-In activities shall be completed thirty (30) calendar days after the start date of the contract. The contractor shall deliver a finalized Transition- In Plan within five (5) business days of award.

2.1.7. Task 1, Subtask 7: Transition-Out Plan

Regardless of whether this contract is terminated early, runs for its full period of performance, or an option year is not exercised, the Government has the option to give the contractor up to a sixty (60) calendar-day transition period. The contractor must ensure no logistics or contract data is corrupted, changed, or altered in a manner that would cause damage to the Government.

The contractor shall meet performance requirements and cooperate with the successor contractor during the transition period.

During the transition period, the incumbent contractor shall provide the support required to ensure the orderly transition of logistics support and enable the follow-on contractor to commence uninterrupted operations at the end of the period. The contractor shall also establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings. The contractor shall ensure follow-on contractor personnel are permitted access to observe all operations, including workflow, priorities, scheduling, equipment handling/processing, parts storage, safety, and security. Familiarization visits shall not interfere with the activities of the incumbent contractor or Government personnel.

The contractor shall provide and implement a Transition-Out Plan within forty-five (45) calendar days prior to expiration or notification of contract termination. To ensure a seamless transition, the contractor shall identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

• Project management processes

• Points of contact

• Location of technical and project management documentation

• Schedules and milestones

• Status of ongoing technical initiatives

• Appropriate contractor-to-contractor coordination

• Transition of key personnel

• Actions required of the Government

• File plan, work related documents, files, policies and processes

• Inventories of hardware and software

• Access permission by individuals to locations in which they support

The contractor shall organize all work-related documents and files, store them on the designated Government collaboration tool and provide a file plan outlining the file structure. Status for each project shall be documented, including recent, current, and pending actions. The contractor shall provide all-inclusive hardware and software inventories, a listing of all COTS utilized in support of this contract, accountability of licenses, and soft copies of all procedures and training materials developed as part of this contract. In addition, the contractor shall provide a complete list of all badges, vehicle passes, and Government software access permissions by individual currently working on the contract. The contractor shall deliver all data, compiled and un-compiled source code, flow charts, and business processes for the system and support applications at the completion of this task order.

2.2. Task 2: Risk Management Support Overview

The contractor shall provide Risk Management support for USTRANSCOM in implementing and conducting operations for all phases of the DoD Risk Management Program (DoDI 8510) and NIST 800- 37 Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, revision 2, either on-site or virtually dispersed across the United States and within USTRANSCOM’s Commercial Cloud environment, during normal duty hours. Risk management activities shall encompass processes, procedures, and technical operations enabling USTRANSCOM to frame risk, i.e., establish the context for risk-based decisions, assess risk, respond to risk once determined, and monitor risk on an ongoing basis using effective organizational communications and a feedback loop for continuous improvement in the risk-related activities of the organization. In support of these objectives, the contractor shall perform cyber security operations, which include:

• Information Systems Security Engineering (ISSE) services

• Risk assessment development and support

• Authorization support

• Security configuration and vulnerability management support

• Software assurance support

• Security testing and auditing of security controls

This contract provides cyber security services to USTRANSCOM. The contractor shall perform all work IAW the below:

• All applicable laws, e.g., Clinger Cohen Act (CCA); regulations, and national standards, e.g., NIST

• DoD Defense Information Systems Agency (DISA)

• Chairman of the Joint Chiefs of Staff (CJCS)

• Committee on National Security Systems (CNSS)

• National Security Agency (NSA)

• Department of Defense Cyber Defense Command (DCDC) [formerly JFHQ-DODIN]

• United States Cyber Command (USCYBERCOM)

• USTRANSCOM standards and instructions

• Best Development Security Operations (DevSecOps) practices as appropriate

The contractor shall maintain continuous situational awareness over the Evaluator’s Scoring Metrics (ESM) applicable to assigned PWS tasks. Reference ESM as specified in DoD O- 8530.1- M, Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Program.

Knowledge

The contractor’s staff performing Risk Management shall possess the following:

Understanding of network and host-based security devices (e.g., Intrusion Prevention Systems [IPS], Intrusion Detection Systems [IDS], firewall, proxy servers, sensors, switches, routers, hubs) and their role in moving packets securely from source to destination.

Understanding of security requirements, testing, assessment and validation procedures, and best practices applicable to physical, virtual, and cloud (Infrastructure as a Service [IaaS], Platform as a Service [PaaS], Software as a Service [SaaS]) based environments.

Knowledge of information security technologies (e.g., cryptography, biometrics, forensic analysis, vulnerability assessment, Security Information and Event Management

[SIEM]).

Understanding of Federal and DoD computer security policies, e.g., Security Technical Implementation Guides (STIGs)/Security Requirements Guides (SRGs), Electronic Communications, Privacy Act, Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management/Modernization Act (FISMA), and Digital Millennium Act.

Thorough understanding of NIST Special Publications (SP), and commercial best practices.

Desired knowledge of applicable DoD, DCDC, USCYBERCOM, and USTRANSCOM security guidelines and best practices.

Thorough understanding of DoD policies applicable to implementation of the DoD RMF.

Working knowledge of ISO 27001, 27002.

2.2.1. Task 2, Subtask 1: Information Systems Security Engineering (ISSE)

As an integral part of the overall organizational implementation of the RMF, the contractor shall provide ISSE life cycle support to the Government in accordance with the principles delineated in NIST SP 800- 160 Vol I, Engineering Trustworthy Secure Systems and Vol II, Developing Cyber Resilient Systems: A Systems Security Engineering Approach, and other applicable directives.

In support of USTRANSCOM risk management processes, the contractor shall assess potential risks, mitigation measures, residual risks, and provide Security Risk Assessment recommendations to the Government for approval or disapproval. The contractor shall research and advise the SISO and other Government staff on recently developed countermeasures designed to protect command systems from new threats. The contractor shall assist in the development, implementation, and administration of effective security programs for approval by the Government and provide guidance, cyber alerts, and best practice information to the appropriate audience(s) (e.g., standard/privileged users, system administrators, Information System Security Mangers [ISSM], PMs, etc.) throughout the command.

The contractor shall conduct risk assessments to determine the risk posed by the integration of new systems or capabilities into the USTRANSCOM environment. Reports from tests and evaluations performed by other teams supporting USTRANSCOM will be provided to the contractor to support these risk assessments. In some cases, the contractor shall be required to obtain supporting data from other DoD/Federal organizations, vendors, or internet research. Risk assessments shall be conducted in accordance with the principles of NIST SP 800-30, Guide for Conducting Risk Assessments, and the principles of NIST SP 800- 160 Vol I and Vol II, and security best practices.

Security Risk Assessments shall:

• Address risk factors, threats, vulnerabilities, likelihood of exploit, and security control effectiveness of systems

• Consider risk in light of all capabilities and services provided by the DoD and USTRANSCOM layered defense architectures

• Identify potential mitigation measures and specify residual risk after mitigations are applied Security Risk Assessments shall quantify the potential cost to the Government if a threat agent exploits the vulnerabilities identified in the risk assessment and the cost of implementing the recommended mitigations. A cost model will be provided by the Government. Security Risk Assessments shall be accomplished in the format prescribed by the Government and IAW the suspense assigned by the Government.

2.2.1.1 Task 2, Subtask 1.1: ISSE Metrics and Supporting Documentation

The contractor shall collect and provide the Government with monthly metrics on cyber security ISSE activity NLT fifteen (15) business days after the end of the month. The metrics shall include:

• List and status of risk assessments performed The contractor shall maintain current documentation on ISSE processes and procedures and provide the following deliverable documents to the Government NLT ten (10) business days prior to the end of each quarter:

• 10 Talking Papers (Per Fiscal Year). Subject to be determined at time of assignment

• Security Evaluation Process Training Brief (Fiscal Qtr 1)

• Cyberspace Defense Handout (trifold) (Fiscal Qtr 4)

• USTRANSCOM System Security Evaluation Standard Operating Procedure (SOP) & Checklists

(Fiscal Qtr 4)

• FACCSM Training Briefing (Fiscal Qtr 4)

2.2.2. Task 2, Subtask 2: Software Assurance Support

The contractor shall develop and assist USTRANSCOM in implementing required processes, procedures, and capabilities to remediate and mitigate vulnerabilities and weaknesses within software developed for USTRANSCOM in accordance with applicable standards, directives, and best practices, to include the applicable DISA STIGs/SRGs, Information Technology Infrastructure Library (ITIL), ISO/IEC/IEEE 1528,8 Systems and Software Engineering, System life Cycle Processes, NIST SP 800- 160, Vol I, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules, and DoD, NSA, USTRANSCOM, and other applicable policies.

The contractor shall produce an annual summary of the software analysis & evaluation findings that provides insight into the issues/concerns seen across all systems/applications/services that have been reviewed for the year. T h e s u m m a r y s h a l l include a table of all reports conducted for the year and any recommendations for changes to policy, procedures, or resources. The contractor shall also provide a summary of any trends seen in the ISSM/User input to the Fortify findings that may assist developers in providing more accurate responses to the risks and issues noted in the reports so future assessments may be completed in a more efficient manner.

The contractor shall serve as the USTRANSCOM SME for administering and executing processes to ensure compliance with applicable software assurance directives. This includes the following:

• Developing procedures for evaluating the results of software assurance testing.

• Evaluating results of software testing and analysis tools and making recommendations for Government approval regarding the level of risk presented by the software to USTRANSCOM. The contractor shall provide the Government Software Testing Analysis Recommendations IAW suspense assigned by the Government.

• Fine-tuning analysis configurations to remove false positives from results.

• Attending software design reviews and forums The contractor shall collaborate with other DoD and Federal Government agencies such as the DoD Software Assurance Community of Practice and Joint Federated Assurance Center (JFAC) and review current software assurance community best practices to integrate the latest requirements into USTRANSCOM software assurance practices.

Knowledge

The contractor shall demonstrate experience with the following:

Broad understanding of information technology and software engineering principles, concepts, and techniques including software languages, design concepts, test methods, and integration practices.

Secure Software Concepts; security implications and methodologies within centralized and decentralized environments across the enterprise’s computer systems in software development.

Secure Software Requirements: capturing security controls used to integrate security within the process, in order to identify key security objectives, and to maximize software security while minimizing disruption to plans and schedules.

Secure Software Design: translating security requirements into application design elements including documenting the elements of the software attack surfaces, conducting threat modeling, and defining any specific security criteria.

Secure Software Implementation/Coding: application of coding and testing standards, to include applying security testing tools, static-analysis code scanning tools, and conducting code reviews.

Secure Software Testing: integrated testing for security functionality and resiliency to attack.

Software Acceptance: security implications in the software acceptance phase including completion criteria, risk acceptance and documentation, Common Criteria and methods of independent testing.

Supply Chain and Software Acquisition: knowledge and tasks required in managing risk for outsourced development, acquisition, and procurement of software and related services.

Excellent written and verbal communication skills, demonstrating the ability to present material to senior DoD and non-DoD officials.

Effective communication with senior leaders and customers to clearly present technical approaches and findings.

2.2.2.1. Task 2, Subtask 2.1: Software Assurance Metrics and Process/Procedure Documentation

The contractor shall collect and provide the Government with monthly metrics on software assurance support NLT fifteen (15) business days after the end of the month.

The metrics shall include:

• Results of evaluations performed

• Programs assisted with configuration tuning and false positive identification

• Design reviews and forums attended

The contractor shall maintain current documentation on software assurance policies, processes and procedures and provide the following deliverable documents to the Government quarterly NLT ten

(10) business days prior to the end of each quarter.

• Software Assurance SOP & Checklists (Fiscal Qtr 1)

• USTRANSCOM TCJ6 Code Scanning Policy (Fiscal Qtr 1)

• Software Assurance Standards (Fiscal Qtr 4)

2.2.3. Task 2, Subtask 3: Security Auditing, Continuous Monitoring, and Vulnerability Management Activities Support Overview

The contractor shall conduct an overall enterprise vulnerability management program and perform security audits of designated USTRANSCOM systems as part of the overall organizational Risk Management Program. Responsibilities include analysis of potential vulnerabilities and required mitigations as needed to protect and defend USTRANSCOM systems. The objectives are to assess the effectiveness of the total system security and make mitigation recommendations to the Government based on these reviews, IAW a suspense date assigned by the Government.

2.2.3.1 Task 2, Subtask 3.1: Security Auditing

For assets residing within USTRANSCOM’s physical and virtual enclaves located at Scott AFB, IL; USTRANSCOM Commercial Cloud Environment; JECC—Norfolk, VA; O’Fallon, IL; and Fairview Heights, IL the contractor shall conduct in-depth security audits of systems prior to connection to the USTRANSCOM network, and at the discretion of the Authorizing Official (AO) thereafter, to validate the configuration against guidelines contained in the applicable DoD and USTRANSCOM baseline images, build-guides, checklists, STIG/SRG guidance and security alerts.

The contractor shall:

• Review all security controls and procedures to assess and measure the effectiveness of the total system security.

• Generate reports for the technical point of contacts (POCs)/ System Administrator (SA) of audited systems that detail compliant and non-compliant findings, with remediation recommendations for non-compliant findings.

• Revalidate system compliance after technical POC/SA remediation of non-compliant findings

• Generate final audit report on system compliance status.

The contractor shall provide the audit report to the Government for risk assessment consideration and review of proposed changes to ensure that new systems introduced into USTRANSCOM and the TCCs are IAW DoD and command computer security policies. Reports are due IAW suspense assigned by the Government.

In addition, the contractor shall perform special security audits of systems as requested by the Government. Special security audits are assessments of systems based on specific risk conditions or command interest and typically involve scanning and on-system measurements of the compliance status of the system.

2.2.3.2 Task 2, Subtask 3.2: Continuous Monitoring

For assets residing within USTRANSCOM physical and virtual enclaves located at Scott AFB, IL;

USTRANSCOM Commercial Cloud Environment; and Joint Enabling Capabilities Command (JECC)— Norfolk, VA, the contractor shall:

• Gather and maintain system configuration information, e.g., operating systems/versions, key software/versions, and DISA STIG compliance, to monitor the USTRANSCOM unclassified and classified systems for compliance with command security policies.

• Monitor cybersecurity dashboards and take action as appropriate to address issues that are outside USTRANSCOM’s risk tolerance.

• Perform weekly vulnerability scanning and analysis (i.e., Assurance Compliance Assessment Solution [ACAS], Information Assurance Vulnerability Management

[IAVM]).

• Perform analysis of all USTRANSCOM public facing web server findings.

• Perform on-request validation scans for USTRANSCOM systems.

• Report vulnerability scanning results to the Government within three (3) business days of the completion of the scan.

• Assist system administrators of USTRANSCOM systems with identifying potential remediation actions for all identified vulnerabilities.

• Update information in the Continuous Monitoring and Risk Scoring (CMRS) or other designated system in accordance with USCYBERCOM requirements.

• Compile reports/analysis as requested by the Government.

The contractor shall perform network discovery scans on a weekly basis and compare results of discovery scans against reports of assets as identified by Endpoint Protection Platform (EPP) (or replacement tool as designated by the Government). Any systems identified by HBSS, but not by the network discovery scans, shall be incorporated into weekly scanning activities. Any systems not covered by HBSS shall be provided to the HBSS team for analysis.

Additionally, in support of all assets residing within the USTRANSCOM Mobility Air Forces (MAF) C2/Distributed Enclave (DE) and GATES Development (DEV) located at O’Fallon, IL, Fairview Heights, IL, and Radford, VA, the contractor shall:

• Perform vulnerability scanning on a bi-annual basis utilizing PEO Command, Control, Communication and Battle Management (C3BM) Government furnished network scanners.

• Review ACAS configuration settings and share best practices.

• Analyze results of vulnerability scans performed by PEO C3BM weekly

• Provide feedback and remediation assistance as appropriate.

• Perform patch compliance spot checks for verification.

2.2.3.3 Task 2, Subtask 3.3: Vulnerability Management

In support of these vulnerability management activities for assets residing within the USTRANSCOM and MAF C2 physical and virtual enclaves located at Scott AFB IL USTRANSCOM Commercial Cloud Environment; JECC—Norfolk, VA and Radford, VA, the contractor shall provide the following IAW suspense assigned by the Government:

• Manage the command IAVM program, to include all actions needed to distribute, track, and report IAVM compliance and trend data.

• Update USCYBERCOM and DCDC on IAVM status.

• Prepare IAVM reports and trend analysis for USTRANSCOM

• Process Plan of Action and Milestones (POA&Ms).

The contractor shall monitor applicable Government and private sector vulnerability databases and sources to identify vulnerabilities not released through the DoD IAVM program that have the potential of impacting USTRANSCOM systems. The contractor shall employ a vulnerability alerting process to notify USTRANSCOM personnel to the presence of such vulnerabilities affecting systems and networks.

Delivering the IAVM reports, trend analysis, and POA&Ms ensures the SISO, Chief Information Officer (CIO), and designated partners are familiar with internal and external vulnerabilities that may impact USTRANSCOM mission assurance, along with recommended actions to mitigate the risks.

2.2.3.4 Task 2, Subtask 3.4: Security Auditing, Continuous Monitoring and Vulnerability Management Metrics and Process/Procedure Documentation

The contractor shall collect and provide the Government with monthly metrics on security auditing and vulnerability management activity NLT fifteen (15) business days after the end of the month. The metrics shall include:

• List and status of system evaluations performed

• Number of DoD IAVMs distributed

• Number of internal vulnerability notices generated and distributed

• Number of scan reports reflecting known un-remediated and unmitigated vulnerabilities provided to system POCs

• Number of systems on the USTRANSCOM network (including PEO C3BM) with Category 1 vulnerabilities

• Number and type of issues adjudicated from USTRANSCOM cybersecurity dashboards

The contractor shall maintain current documentation on security auditing, and vulnerability management processes and procedures and provide the following deliverable documents to the Government NLT ten (10) business days prior to the end of each quarter.

• USTRANSCOM Vulnerability Management SOP & Checklists (Fiscal Qtr2)

• Vulnerability Management Training Briefing (Fiscal Qtr 1)

• USTRANSCOM Enterprise Information Security Continuous Monitoring SOP &

Checklists (Fiscal Qtr 2)

• USTRANSCOM Reviewing Vulnerability Scanner Findings Guide (Fiscal Qtr 3)

2.2.3.5 Task 2, Subtask 3.5: Vulnerability Management Installation Support

The contractor shall perform installation of Vulnerability Management tools IAW USTRANSCOM processes, e.g., change management. This includes requesting/coordinating software procurement (including lifecycle upgrades); performing project management, e.g., using government provided requirements management tools and schedules; building and configuring systems to be secure, STIG-compliant; performing functional testing; developing system authorization documentation, requesting security evaluations and remediation of findings;

and performing operational deployment.

2.2.3.6 Task 2, Subtask 3.6: Vulnerability Management Maintenance

The contractor shall perform operation and maintenance of the associated tool suites IAW USTRANSCOM Configuration and Change management processes. This includes, but is not limited to the following:

• Maintaining the existing configuration and integrity of the Vulnerability Management tool suite IAW applicable policies and instructions

• Requesting authorized service interruptions (ASIs)

• Ensuring Business Continuity Management (BCM) plans are in place, executable and followed for Vulnerability Management (including storage of authentication credentials and backups)

The contractor shall maintain, and enhance where necessary, the security posture of USTRANSCOM’s network environment. This includes, but is not limited to the following:

• Troubleshooting user and program related issues associated with Vulnerability Management infrastructure tools and providing recommendations to the government for resolution

• Providing compliance data as needed to government in response to USCYBERCOM orders and developing POA&Ms for Vulnerability Management applications

Submitting requests for exemption/waiver to policy/direction that cannot be complied with IAW prescribed DoD policy/instruction. The contractor shall document changes to Vulnerability Management tools (e.g. software installs, patching, software configuration changes, etc.) in a maintenance log and provide configuration management data on all of its managed systems according to the schedule and format directed by the Government.

2.3. Task 3: Security Control Assessor (SCA) and Authorizing Official (AO) Support Overview

The contractor shall serve as a Security Control Assessor Representative (SCAR) on behalf of the SCA and AO. These duties require coordination and collaboration across the Joint Deployment and Distribution Enterprise (JDDE). The JDDE community of interest provides expertise through system program managers, system SMEs, and other stakeholders as needed. In support of the USTRANSCOM risk management processes, the contractor shall assist Government with the overall responsibility to conduct independent comprehensive assessments of the RMF controls and enhancements employed within or inherited by an IT enclave, system, application, or microservice to determine the overall effectives of the controls, residual risk of non-compliant controls, and overall risk of system operation to the mission. There are approximately 40 systems supported.

2.3.1. Task 3, Subtask 1: Security Control Assessor Representative (SCAR) Tasks

The contractor shall:

• Based on knowledge of current threats to USTRANSCOM mission and a risk assessment, assess, identify, and provide to the Government, for AO approval, a listing of recommended enterprise security controls/enhancements that provide mission assurance for cyber-key terrain systems supporting USTRANSCOM’s mission.

• Provide SME support for Risk Management activities within and/or outside Enterprise Mission Assurance Support Service (eMASS) or other tools as designated by the Government. The contractor shall provide technical and operational analyses of supporting artifacts and provide risk analysis recommendations to the SCA. The contractor shall have a thorough understanding of eMASS and execute/perform functions in eMASS using capabilities that would automate and integrate capabilities to review/assess artifacts.

• Perform triage of all RMF-related workflows within seven (7) business days of submission of the checklist from the Program Management Office (PMO) and/or system owner using the USTRANSCOM RMF Triage Checklist. The contractor performing SCAR duties shall identify non-compliant submissions, document deficiencies in the Package Return Report (PRR), submit to the Government SCA for approval and signature, route back to POR, and monitor status of PMO rework

• Perform the Independent Verification and Validation (IV&V) role within the eMASS tool on NIPRNet and SIPRNet, verifying that controls are in-place, supported by artifacts, operating as intended, and producing desired outcomes. Providing feedback to submitters on non-compliant security controls and POA&M items and generate the required PRR as needed.

• Finalize Authorization to Operate (ATO) package to include risk assessment, required artifacts, and required approval documents to support risk recommendations to the AO in accordance with Government guidance. Maintain and execute processes for reviewing and routing of authorization packages.

• Evaluate RMF-related submissions requiring AO approval, to include the system categorization, System Security Plan (SSP), ATO Conditions closure requests, and Plans of Actions and Milestones (POA&M) approvals and extensions IAW the USTRANSCOM RMF Triage Rubric.

• Provide all PRRs to the SCA team for signature, coordinate with submitters for resolution, and Maintain historical copies of all packages in a Government designated repository.

• Meet Government “need-by-dates” IAW the suspense assigned by the Government. The contractor shall provide written notification in an Authorizing Official Non-Delivery Report to the Government within three (3) business days prior to the package “need-by-date” if the contractor team will not meet the date and propose a new date. The notification shall indicate the reason(s) for the delay (e.g., priority of systems in the queue, incomplete/insufficient package submission, short-notice submission, personnel availability, etc.).

• Document in the MSRs the reason for missing the deadline, estimated completion date, and efforts taken to meet the suspense until the completion date is satisfied.

• Manage eMASS user accounts (i.e., add, delete, and assign/update roles) for USTRANSCOM’s instance of eMASS per Government direction.

• Process authorization packages with the government designed workflow tool.

• Track status of checklists and packages from submission through approval or disapproval decision by the AO.

• Coordinate with the Government to determine if an AO has previously approved the specified system for operation on a DoD or Federal network (reciprocity). If prior test results exist, the contractor shall obtain and analyze the previous results for completeness and applicability to the USTRANSCOM target environments.

2.3.1.1 Task 3, Subtask 1.1: Security Control Assessor Representative (SCAR) Metrics and Process/Procedure Documentation

The contractor shall collect and provide the Government with current Package metrics on authorizations. At a minimum, the metrics shall include:

• 7-day triage time, submission date, need-by date, review start & completion date, and type of request.

The contractor shall maintain current documentation on authorization processes and procedures and provide the following deliverable documents:

• USTRANSCOM Security Assessment and Authorization Plan (SAAP) (Fiscal Qtr 4) (Gov’t templates provided)

Note: All A&A Checklists and SOPs included will provide information on how to perform A&A and be distributed to the Command.

• USTRANSCOM RMF Triage Checklists (Monthly, 5 days after end of month) (Gov’t templates provided).

o Due to dynamic nature of changes, Triage Checklist shall be on demand (10 days after request) (Gov’t templates provided)

• SOPs: eMASS Account Request, Risk Acceptance, eMASS Workflow, IATT, Assess Only, and POA&M.

o Due to dynamic nature of changes, SOPs shall be on demand (10 days after request) (Gov’t templates provided)

• Package Triage Metrics (Monthly, 5 days after end of month) (Gov’t templates provided)

• Authority to Operate (ATO) Non-Delivery Report (Event-triggered; report due by COB 1-day after event) (Gov’t templates provided)

• SCAR Production Report (Monthly, 5 days after end of month) (Gov’t templates provided)

• SCA Package Return Report (PRR) Report (Monthly, 5-days after end of month) (Gov’t templates provided)

• USTRANSCOM RMF Rubric (Monthly, 5-days after end of month) (Gov’t templates provided)

• White Papers (3 per year, 30-days after request)

2.3.2. Task 3, Subtask 2: Enterprise DoD Ports, Protocols, and Services Management (PPSM)

The contractor shall assist USTRANSCOM in performing actions required to implement the DoD Ports, Protocols, and Services (PPS) Program as outlined in DoDI 8551.01 and other applicable DoD directives. In support of this task, the contractor shall develop a plan for USTRANSCOM to manage the overall life cycle risk management of ports, protocols, and services IAW DoDI 8551.01. In addition, the contractor shall assist Government personnel, accomplish PPSM technical functions, and provide guidance to the USTRANSCOM staff for PPSM related activities.

The contractor shall:

• Address the PPSM Evaluations performed in support of the SCA package/condition assessments submitted by USTRANSCOM programs and TCCs

• Review PPS Exceptions, Further Actions, and Component Level Service Assessments provided by the programs

• Provide concurrence/non-concurrence status of the PPS IA/security control to the SCA

• Upon approval by the Government lead, submit PPS Exceptions, Further Actions, and

CLSAs on behalf of USTRANSCOM to the PPSM Secretariat, DoD PPSM Configuration Control Board (CCB) and the DoD PPSM Technical Advisory Group (TAG) IAW suspense assigned by the Government

The contractor shall track registration status of USTRANSCOM and TCC systems to include the authorization termination date (ATD), registered non-compliant PPS, and submitted Exceptions, Further Actions, and CLSAs for compliance with DoD PPSM directives. The contractor shall review and submit exception requests affecting USTRANSCOM systems, as needed, to the PPSM Exception Management Process, available at the DoD Cyber Exchange website.

The contractor shall create and manage PPSM registries user accounts for USTRANSCOM and TCC system A&A personnel, to include access requests, role modifications, and terminations per Government direction. Manage PPSM user accounts (i.e., add, delete, and assign/update roles) for USTRANSCOM’s instance of PPSM per Government direction.

Additionally, the contractor shall assist the Government in accomplishing required actions for USTRANSCOM systems that require submission and approval by the DoD PPSM CCB. The contractor shall support the Government DoD PPSM TAG representative by attending virtual DoD PPSM CCB and TAG events, reviewing information distributed by the DoD PPSM Secretariat.

The contractor shall provide CCB and TAG recommendations to the Government on required actions, as requested by the Government and IAW the suspense assigned by the Government.

The deliverable shall consist of a packaged email containing a summary of the CCB/TAG activities, support provided by the TAG members (contractor and government), and impact to USTRANSCOM systems and programs. The package will contain a GEM, complete with voting spreadsheet as mandated by the DoD PPSM Secretariat, ready for the CCB voting member to send to the Secretariat.

The contractor shall also provide technical review and recommendations for PPS requirements related to areas such as for firewalls, proxies, and whitelists updates.

Requirements under this task will be accomplished IAW the latest implementation of the PPSM Exception Management/Further Action/CLSA process guides published by the DoD PPSM Secretariat.

(https://dod365.sharepoint- mil.us/Sites/DISA-Ports-Protocols-Services-Management)

2.3.2.1 Task 3, Subtask 2.1: Enterprise DoD Ports, Protocols and Services Registration Metrics and Process/Procedure Documentation

The contractor shall collect and provide the Government with monthly metrics on PPS registration activity NLT fifteen (15) business days after the end of the month. The metrics shall include:

• Listing of systems entered into the DoD PPSM Registry, exceptions, banned services/ports, PPS vulnerability assessments, CLSAs, and their status

• Listing of systems operating under expired authorization in the PPSM Registry

• A PPSM declaration of internal and external interfaces in the format designated by the

Government based on allowed firewall rules

The contractor shall create and maintain current documentation on authorization processes and procedures and provide the following deliverable documents to the Government quarterly NLT ten (10) business days prior to the end of each quarter.

• USTRANSCOM PPS Exception Process SOP (due FY23 Qtr 2)

• USTRANSCOM PPSM SOP & Checklist (due FY23 Qtr 4)

2.3.3. Task 3, Subtask 3: Cyber Security Risk Analyst

The contractor shall utilize skills in programming, DoD computing, networking/transmission, cybersecurity policy, and data analytics to:

• Develop and enhance the Cybersecurity Readiness Framework (CRF)

• Develop meaningful and actionable metrics, to include Key Performance Indicators

(KPI) and Key Risk Indicators (KRI), as directed by the Government

• Integrate threat data and metrics with cyber readiness framework

• Analyze and define data requirements and specifications

• Develop data model(s), integrations, and analytics to enhance cyber readiness assessment and to enable decision support

• Conduct queries and develop algorithms to analyze data sets

• Conduct trend analysis to identify systemic security issues by analyzing vulnerability and configuration data

• Perform Extract, Transform, and Load (ETL) Operations

• Accomplish data ingestion, processing, distribution, and visualization

• Develop and maintain analytics code repository (Python and SQL) and data visualization programs

(Qlik)

• Deploy analytics workloads using Databricks

• Analyze future eMASS changes, to include the altering or addition of new data elements and changes to Application Programming Interface (API), assess potential impacts to the CRF, advise product stakeholders, propose solutions, and initiate preventative or corrective action as determined by the stakeholders

• Monitor health of daily ingests, advise stakeholders when ingest operations are degraded, and propose corrective actions during periods of ingest degradation or failure

• Ensure that different instances of the CRF (e.g., NIPR, NIPR/SIPR, SIPR/SIPR) are configured to the same specifications (Exception: SIPR/SIPR CRF will have “Classified” banner marking and a “CPT Mission Findings” link)

2.4. Task 4: Development Security Operations (DevSecOps) RMF and SCA Support (Optional)

The contractor shall serve as a Cyber Security Engineer on behalf of the SCA and AO. These duties require coordination and collaboration across DevSecOps Program’s stakeholders.

In…