EPA_POC_XACTA_SOW1.docx

Statement of Work (SOW) Software from Contractor Specialized in Enterprise GRC Intergration to Implement and Maintain an Enterprise Governance, Risk and Compliance (eGRC) tool Purpose The purpose of this SOW is for the US Environment Protection Agency (EPA) Office of Information Security and Privacy (OISP) to obtain GRC (Government Risk Compliance). Software from contractors specialized in enterprise GRC integration to implement and maintain an Enterprise Governance, Risk, and Compliance (eGRC) tool to support EPA, its Offices and its Regional Offices.

In managing security policies, controls, risks, assessments, and weaknesses through a single platform. This platform software is already currently installed in our on-premise environment for the EPA. EPA OISP is additionally seeking maintenance support from contractors specialized in providing on premise services to the EPA infrastructure environment for a single repository. Ideally, said capabilities will be delivered by a single contractor.

The goal is to continue a single repository for EPA to aggregate data from existing systems to drive comprehensive, informed security decisions to support operational security and risk management. Document and store security information, allowing EPA OISP to review and assess risk and the security stance of systems.

This approach facilitates real-time approval, monitoring, and reporting for all EPA systems. The eGRC tool allows system owners, information system security officers (ISSOs), privacy officers and security analysts at EPA and its sub-organizations to easily identify system weaknesses and issue resolutions with improved efficiencies. This purchase is to add additional licenses to compliment the on-premise solution of XACTA 360 eGRC software that provides the level of enterprise support required by the EPA user community.

Scoping This SOW is to purchase software, support and maintenance for enterprise environment adding an additional 25 XACTA 360 licenses for EPA OISP.

Solution Outcome The outcome of this solution will be adding to our current deployment a working XACTA 360 (Small) package environment running with additional perpetual licenses for 25 projects/systems. The Federal Assessment & Authorization, Federal Continuous Monitoring, and Federal POA&M modules and security compliance solutions. The environment is currently deployed and developed to meet government security requirements and sized to support 125 concurrent users.

Provider Duties The contractor shall provide GRC software, design, execution, and quality control for the period of performance (POP) stated in this Statement of Work. Specifically, the contractor will provide the following tasks to support OISP:

1. Provide XACTA 360 GRC software on EPA on-premise environment with security controls

2. Provide helpdesk support if needed for installation

3. Manage XACTA 360, security controls, and eGRC software to ensure availability and performance

Scope of Work

The contractor will provision XACTA 360 software within our current deployed EPA’s on-premise environment, which is certified for government workloads. XACTA 360 according to the vendor’s published sizing guidance for a medium deployment capable of supporting up to 150 concurrent users. This environment will include an additional perpetual software licenses for 25 projects and systems.

OISP (Office of Information Security and Privacy) has interest in using:

► Federal Assessment and Authorization ► Federal POA&M Management

The contractor’s services include the implementation, patching, and sustainment of this environment throughout a one-year window. The contractor will work with EPA to provide and implement XACTA 360 software, to align with the goals and objectives intended in this solution. The contractor will also be supporting EPA’s ongoing assessment and continuous monitoring needs and configuring the software for tracking and managing remediation plans.

The contractor will also provide unlimited help desk support. Access to bug fixes, service packs, agency-level content updates, and version functionality upgrades. Following the successful completion of this effort, EPA will be well positioned to provide a solution that augments those capabilities delivered for the Department of Homeland Security’s (DHS) Continuous Diagnostics and Mitigation (CDM) Dashboard.