Draft NCCS SOO v1.0.pdf

DRAFT

i

Draft DHS HQ NOSC Network, Cloud, and Cyber Services Statement of Objectives

March 28, 2023

Version 1.00

1 Introduction The Department of Homeland Security (DHS) Office of the Chief Information Officer (OCIO) has begun consolidation of the DHS Headquarters’ (HQ) previously separate Network Operations Centers (NOCs) and Security Operations Centers (SOCs) into a single, centralized, and unified DHS HQ Network Operations Security Center (NOSC). Over the coming years, DHS HQ intends to continue this consolidation with the integration of numerous additional existing stakeholder / component (e.g., Federal Protective Service [FPS], Office of Biometric and Identity Management [OBIM], etc.), network operational entity (e.g., B-LAN, C-LAN, Hybrid Computing Environment [HCE], etc.), and physical location (e.g., St. Elizabeth’s campus, Data Center 1 [DC1], etc.) NOC and SOC functionalities of the broader Headquarters / Management Directorate information enterprise.

The DHS HQ NOSC is responsible for serving as the central IT service management monitoring and communications hub for network infrastructure, cybersecurity (“cyber”), cloud platform, and system and select application incident and event management and coordination across the broader DHS information enterprise, including coordination with all DHS components. This includes detecting and identifying network service outage events and cybersecurity threats and incidents. In addition, the NOSC is responsible for coordinating a number of additional services and functions, including the provision of rapid deployment fly-away response capability for select priority Wide Area Network (WAN) and HQ and component Local Area Networks and satellite network circuit trunks.

DHS intends to continue to evolve the NOSC and its constituent sub-capability elements— doctrine, policy, and procedure; organization and planning; test, training, and exercise; materiel (including technology and systems); leadership; personnel; facilities; and regulations and standards—in order to ensure, assure, and improve the confidentiality, integrity, availability, privacy, access to, accountability, authentication, authorization, and non-repudiation of the DHS information enterprise. Within those parameters of cyber- and information security, the management and coordination of the identification and detection of threats and risks to, response to, and recovery of network infrastructure, cloud platform, and system and applications that comprise the DHS HQ information enterprise is the central and necessary purpose of the DHS HQ NOSC. The evolution and continuous improvement of these capabilities and capability elements must be performed in concert with an ever-increasing and rapidly evolving set of requirements, including emerging requirements such as zero trust and expanded log management and reporting requirements for cyber events.

1.1 Background

The DHS information technology environment includes data centers; colocation facilities; and commercial, private cloud, and Gov-cloud resources interconnected by the Homeland Security Enterprise Network (HSEN) wide area network (WAN). The HSEN WAN environment is supported by the DHS HSEN Hybrid Computing Environment (HCE), which includes on-premises infrastructure, network, compute, storage, and application support from DHS Data Center

DRAFT

1 (DC1) as well as multiple DHS Cloud Access Points (DCAPs) that leverage public cloud infrastructure for provisioning this support.

DHS is comprised of Headquarters and various Components, Offices, and Directorates. Each Component has unique and separate mission requirements and operates in a specific mission space; all are supported by a common unclassified, general purpose data transport network (A- LAN) that comprises the largest portion of the larger DHS HQ Network (HSEN). Some operational Components and/or mission-specific Offices (e.g., Office of the Inspector General, the St. Elizabeth’s Campus, etc.) also operate component- or location-specific networks or enclaves that are supported by the broader HSEN and A-LAN networks. The data traversing this network is typically considered Sensitive but Unclassified (SBU) or Controlled Unclassified Information (CUI).

Additional networks supporting HQ and comprising HSEN include: “B-LAN” (also known as HSDN) at the secret classification level; “C-LAN” which supports top secret classified data processing via the Joint Worldwide Intelligence Communications System (JWICS); and “D- LAN”, which supports information processing for Special Access Programs (SAP).

In support of the various Headquarters missions, DHS previously had five security and six network operations centers supporting various parts of the DHS enterprise. These network and security operations centers were at various levels of maturity creating duplications of effort, cost inefficiencies, inconsistent incident handling, and inadequate situational awareness for management. To address this, HQ OCIO established the DHS HQ Network Operations Security Center (NOSC) that consolidated these previously separate SOCs and NOCs, streamlined and consolidated functions, and standardized support for Headquarters missions. In addition to HQ-specific NOC and SOC responsibilities, the NOSC has added systems monitoring, alerting, and administration support for physical and virtual infrastructure and systems located in data centers and cloud environments and coordination responsibilities for outages or incidents manifesting in DHS Component networks. In addition, the NOSC serves as the provisioning agent for DHS customers desiring to add HSEN network circuits.

NOSC Tier 1 is the outward facing point of first customer contact. Tier 1 has the responsibility to maintain constant monitoring of network circuits and cloud resources to detect and respond to cybersecurity alerts, to detect networking outage and service degradation events, and to initiate response to detected events and to events reported by Headquarters customers. Tier 1 pursues cybersecurity and networking incident responses and closes incidents that can be resolved within a short time window as defined by NOSC management. Tier 1 escalates incidents that cannot be resolved within that time window to Tier 2.

NOSC Tier 2 takes responsibility for longer duration incident responses and incidents that require technical expertise not resident within Tier 1. Tier 2 utilizes the same NOSC resources as Tier 1 and performs similar functions in the resolution of escalated events. In addition, Tier 2 applies more advanced technical expertise as required in the analysis and resolution of cybersecurity and networking incidents. Tier 2 also engages in cybersecurity threat investigations and intelligence gathering, and in network utilization and capacity analysis. Tier 2 escalates network engineering and architecture issues beyond Tier 2’s capabilities to Tier 3.

Tier 3 network, cybersecurity, cloud platform, and system and application engineering, architecture, design, development, and implementation support are primarily provided by the HQ

OCIO Solutions Development Directorate (SDD) for cloud platform and systems and application services and the IT Operations Enterprise Engineering Division (EED) for network and cybersecurity services. This contract includes the need to provide at least some common Tier 3 network engineering, network and system administration and operations and maintenance, and cloud platform and system and application integration support. Additionally, the coordination and lifecycle ownership of all network, cybersecurity, cloud platform, and select system and application service change, configuration, event, incident, and problem management across all Tiers will be wholly owned by the DHS HQ NOSC and managed by the vendor.

1.2 Purpose and Objectives

The purpose of this Contract is to procure the full range of program management, systems engineering, technical assistance, systems operations and maintenance, and other professional support services for the DHS WAN / HSEN network, cloud platform and critical system and application, and cybersecurity monitoring and analysis, incident management and coordination, and alert and notification functions for the DHS HQ NOSC. This scope includes working with existing DHS component NOCs/SOCs (or NOSCs) and providing a flexible and scalable support model to accommodate potential further alignment and consolidation of additional operations center functionalities in the DHS HQ NOSC.

The primary objective of this Contract is to evolve the DHS HQ NOSC to build a best-in-class service node that meets DHS Cybersecurity Provider (CSP), industrial, and other doctrinal Center of Excellence service maturity standards. The secondary objective is to redefine the DHS HQ NOSC the central hub of IT Service Management for network infrastructure (WAN and select LAN); platform (including cloud), system, and application; and cybersecurity for the DHS Homeland Security Enterprise Network (HSEN) at all classification levels—A-LAN, B- LAN/HSDN, C-LAN, and D-LAN (SAP).

The support model must consist of a multi-tier approach that supports network, cloud platform and system and application, and cybersecurity monitoring and analysis for all DHS HQ Federal Information Security Management Act (FISMA) systems, service subscriber systems, and enterprise functions. In addition to the typical Tier 1 and Tier 2 network infrastructure network service desk and cybersecurity functionalities—and some select Tier 3 functions as industry typically defines them—this scope of work includes select O&M responsibilities for WAN and select HQ LAN network infrastructure, including all patching and change management (coordination and implementation), vulnerability management, and cradle-to-grave event, incident, and problem management across all Tiers for all network, cloud platform and major system and application, and cybersecurity events and incidents.

Cybersecurity services include but are not limited to the following general class of cybersecurity capabilities and functions: monitoring and analysis (M&A) support; log management support;

incident handling and incident response support; asset visibility and monitoring; email security;

cyber threat intelligence (CTI) support; intrusion defense; threat hunting; cyber forensics and malware analysis (CFMA); and evidence management and insider threat support.

This scope of work also includes the establishment of a Program Management Office to baseline, evaluate, and continuously improve all capability elements (doctrine and policy; organization and planning; test, training, and exercise; systems and materiel; leadership; personnel; facilities;

and regulations and standards) of the DHS NOSC over time in accordance with industry

DRAFT

standards and best practices, to include the Information Technology Infrastructure Library (ITIL) v4, the Capability Maturity Model Institute (CMMI) for Services, the Software Engineering Institute’s CERT-Resilience Management Model, the NIST Cybersecurity Framework (CSF), other NIST guidance (including NIST SP 800-53 Rev. 5), ISO/IEC standards, and U.S. law, regulation, Executive Orders, and other relevant U.S. government Federal Civilian Executive Branch (FCEB) regulations and standards, including Office of Management and Budget (OMB), Government Accountability Office (GAO), DHS, and DHS Cybersecurity and Infrastructure Security Agency (CISA) directives and standards (including, e.g. OMB M-21-31; CISA BOD 22-01; and FCEB, OMB, and DHS Zero Trust guidance).

Specifically regarding ITIL and the NIST CSF, the service provider will be responsible for aligning all services and business processes under this contract to the 34 business practices identified in ITIL v4 and managing all of these practices and sub-processes for the NOSC as well as aligning these to the functions, categories, and sub-categories defined by the NIST CSF.

In conjunction with NIST SP 800-53 Rev. 5, DHS 4300A/B, and the ITIL v4 service catalogue and service financial management practices, the service provider will also be responsible for proposing, documenting, baselining, and managing a NOSC service catalogue and common control catalogue that provides tiered service support models to potential subscribers with tailored security control levels for FISMA system owner use at differing service level and cost.

In summary, the service provider will be responsible for identifying, protecting against, detecting, responding to, and recovering from any malicious or disruptive Information Technology events and incidents, ensuring that DHS OCIO is able to rapidly respond to circumstances that threaten DHS’s information enterprise and contributing to the increasing resilience of DHS HSEN and its evolving network infrastructure for an expanding user and subscriber base.

Section 2 defines further operational objectives at a more discrete or granular level.

2 Task 1 – Program Management

2.1 Staffing Objectives

Manage staff and operations to maintain network operations to include the following:

• Maintain operational staffing levels at each NOSC operating location consisting of staff local to each operating location such that staff can, when required, report for duty at the local NOSC operating location.

• Provide staffing for technical positions in accordance with U.S. Department of Defense (DoD) Directive 8140.01 and manual DoD 8570.01-M.

• Maintain staff with the security clearances, compartment accesses, and DHS suitability statuses to perform the work required at each NOSC locations.

• Ensure that NOSC Sensitive Compartmented Information Facilities (SCIFs) are staffed 24x7x365 to conduct cybersecurity monitoring operations of Secret and Top Secret classified networks with a minimum of two (2) staff holding Top Secret clearances present across all locations at all times.

• Ensure that each NOSC location has the mix of staff expertise necessary in the absence of communication with other NOSC locations as may be required in emergency or natural disaster situations.

• Provide deployment teams (Fly-away teams) that are prepared for short notice deployment to locations within the Continental United States to oversee and assist in response and recovery efforts from cybersecurity attacks and coordinate with vendors, external service providers, DHS system owners, system administrators, Information System Security Officers (ISSOs), and other parties as circumstances require.

• Provide deployment kits (aka Fly-away kits) that are kept in a state of constant readiness for deployment. These kits consist of laptop computers pre-loaded with software applications, standard operating procedures (SOPs), emergency response procedures, and other associated resources that may be of use during cyber incident response and recovery efforts.

• Ensure that additional surge staff are made available on a limited-term basis in response to requests to deal with fluctuations in cybersecurity and network management workloads and to support various categories of projects through concept, planning, execution, and completion stages.

The following Key Positions are continuously filled with bid personnel or government-approved replacements. Those KP are:

• Contract Program Manager

• Deputy Program Manager

• Cybersecurity Program Lead

• Network Infrastructure and Cloud Platform, System, and Application Monitoring and

Analysis Lead

• IT Service Manager / Program Management Office Lead

2.2 Transition Planning and Management Objectives

The Contractor shall plan and manage the process of assuming operational responsibility from outgoing incumbent contractor(s) and for the eventual hand-off of operational responsibility to a successor contractor or the Government.

Transitions of operational support services from predecessor contractors to successor contractors occur without disruption of NOSC operations and service delivery and with full cooperation between incoming and outgoing contractors.

2.3 Program Management Office Support Objectives

The Contractor shall design, organize, and staff and support a Program Management Office to oversee all IT service management functions for the NOSC for all 34 ITIL v4 service practices.

2.3.1 NOSC Capability and Process Management Objectives

All NOSC business processes are defined and managed consistent with ITIL v4, CMMI for Services, NIST CSF, DHS CSP, and other DHS regulations and standards.

NOSC doctrine (including policies, processes and procedures) and documentation, including (but not limited to) a NOSC IT Service Management Process Register, NOSC Process Map, NOSC Service Catalog (including financial support models), Common Controls Catalog, and NOSC CSP Implementation Plan, is developed and continuously improved.

The NOSC structure and organization (as laid out in the NOSC Concept of Operations and NOSC Operations Plan) evolves annually to lead to improved IT service management business process outcomes.

A NOSC Capability Test, Training, and Exercise (TT&E) Program (including continuous improvement program) is chartered, designed, staffed, and managed to evaluate and continuously improve the DHS HQ NOSC and partner organization capabilities and coordination. The Program is designed and executed in accordance with Homeland Security Exercise Evaluation Program (HSEEP) principles and standards.

2.3.2 Service Delivery Support Objectives

Requestors receive an acknowledgement or each request, regular status updates on the progress for request fulfillment, and notification of any outages or disruptions in service that could negatively affect resolution time of data acquisition requests. CIO and OIG management also receive notices of negative impacts on request fulfillment. NOSC performance is tracked, evaluated, and reported over time based on trends in performance and investment metrics.

Service performance improvements are continuously identified and implemented in the context of a Continuous Service Improvement Program (CSIP).

NOSC operations continuously increase maturity as assessed by the maturity levels described for individual metrics in the CSP Evaluator Scoring Metrics.

Standard Operating Procedures (SOPs) are developed and maintained that support the maintenance of Center of Excellence (COE) accreditation under the CSP Program. SOPs integrate cybersecurity and network management procedures in combined procedures.

2.3.3 Data Analytics and Performance Metrics Objectives

NOSC network, cybersecurity, cloud platform, and system and application operations are measured and characterized against a combination of performance and investment metrics for assessing staffing, policy, procedure, effectiveness, cost, and infrastructure.

2.3.4 Knowledge Management Objectives

A Knowledge Management repository exists residing on DHS-approved systems and infrastructure assessable by all DHS Components that provides organized storage and access to the most current as well as historical cybersecurity and network operations policies, procedures, processes, and other documentation.

The Knowledge Management repository exists independently of contractor-owned infrastructure and control and contains all contract deliverables, operational reports, analyses, technical diagrams, ad-designed and as-build diagrams, architecture specifications, and other current operational information artifacts.

The Knowledge Management repository contents are complete and current; new content is added to the repository as it is created.

2.3.5 Data Call and Data Acquisition Support Objectives

Data requests (data calls) receive acknowledgement responses and are fulfilled regardless of origin. Sources may include DHS Headquarters Offices and Directorates; DHS Management;

DHS Components; and other non-DHS customers to include Freedom of Information Act (FOIA), Office of Inspector General (OIG), Office of General Counsel (OGC), Congress, and Federal, State, and Local law enforcement agencies.

2.3.6 Relationship and Service Management Practice Support

The Contractor shall manage all relationships with NOSC subscribers and customer organizations, including liaising with the NOSC, subscriber program offices, and the budget offices for all subscribers in accordance with NOSC’s IT Service Catalog and the DHS Cybersecurity Program requirements.

The Contractor shall support and interface with all annual budget, finance, and acquisition processes (including Planning, Programming, Budgeting, and Execution and Capital Program

DRAFT

Investment Committee processes), including by developing and managing a cost model with pricing for all subscribers and by managing all collections processes for the NOSC as the yearly budget spend plan build up progresses.

2.3.7 Communications Support

The NOSC designs, develops, and continuously improves a Communications Strategy, to include strategic, operational, and tactical communications and outreach. Communications Plans are developed and tailored to achieve operational objectives and to improve operational outcomes.

2.3.8 Project Management Support

Projects are managed and executed using agile approaches, methodologies, and best practices to quickly and efficiently implement and enhance key capabilities and services.

2.3.9 Strategic Network Resilience and Security Objectives

2.3.9.1 Cybersecurity Services Provider (CSP) Program Support Objectives

The NOSC maintains continuous Cybersecurity Services Program (CSP) Center of Excellence (COE) accreditation for providing both NOC and SOC services.

Preparatory assessments are conducted for the NOSC and each Subscriber to NOSC services in preparation for Cybersecurity Services Program (CSP) SOC and NOC recertifications.

The NOSC complies with changes to CSP Evaluator Scoring Metrics as those changes are promulgated by Chief Information Security Officer Directorate (CISOD) and is prepared for the next re-accreditation assessment under the changed CSP metrics.

2.3.9.2 Cyber Risk Management and Security Modernization Support

Tactical cybersecurity risks are identified in concert with SOCs, CTI teams, vulnerability assessment teams (VATs), and other applicable teams to create a full picture of risks facing

DHS.

Common gaps in information system security are identified using methods such as the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework to focus recommendations to the Government for funding in support of remediating security gaps for multiple systems.

Strategic risks are identified through working with Security Control Assessors (SCAs), Information System Security Managers (ISSMs), ISSOs, system owners, and other applicable teams to collect data contributing to the full picture of strategic cyber risks facing DHS.

2.3.9.3 Zero Trust Security Modernization Objectives

Zero Trust (ZT) expert support is available to engage and collaborate with IT Operations, systems architecture, and engineering groups in developing and implementing Zero Trust.

2.3.9.4 Network Management and Cybersecurity Tools

Network management and cybersecurity tools and implemented, operated, managed, and maintained providing cybersecurity protection to the DHS Enterprise and to Headquarters and Subscriber systems and ensuring Enterprise-wide network connectivity.

New tools are implemented and integrated into NOSC operations and obsolete tools are decommissioned.

Tool licenses and maintenance agreements are tracked and projections for license expirations are continuously maintained for a minimum of twelve months into the future.

3 Task 2 – Monitoring & Analysis (M&A) and Incident Response

3.1 M&A and Incident Response Objectives

The DHS information enterprise—including all of HSEN and constituent WAN entities and select HQ and component LAN and circuit infrastructures—network, cybersecurity, cloud platform, and system and application monitoring occurs 24x7x365 across NOSC operating locations to pro-actively identify threats, risks, outages, and service degradations.

The DHS NOSC demonstrates seamless continuity across network infrastructure, cybersecurity, cloud platform, and system and application monitoring and analysis and incident coordination and response workloads across multiple NOSC locations and geographically distributed teams.

The NOSC monitoring scope includes Trusted Internet Connections (TICs) to the Internet, HSEN circuits, Points of Presence or Policy Enforcement Points where HQ and Component networks connect to the HSEN, and Subscriber systems and networks.

Immediate, real-time monitoring of DHS systems and networks belonging to DHS, cloud service providers, and contractors occurs 24x7x365. Response initiation to events that represent service delivery anomalies or potential cyber incidents is immediate; events and incidents extended response or advanced technical expertise are escalated.

Responsibility for response to networking and cybersecurity incidents is escalated to Tier 2 from Tier 1 according to established protocols.

Network management, cloud, and cybersecurity issues that cannot be resolved by Tier 1 analysts within the time limit stipulated by NOSC management for Tier 1 action are escalated to Tier 2.

DRAFT

Tier 2 assumes responsibility for escalated incidents and continues and expands response activities initiated by Tier 1. Tier 2 provides levels of effort and technical expertise beyond those available at Tier 1 as required for incident response, resolution, and recovery.

All network component failures and escalations from Tier 1 to Tier 2 are tracked and reported continuously to resolution and restoration of service. Vendor response is measured and compared to established service level agreements.

3.2 Network Operations Objectives

DHS Networks are monitored and managed 24x7x365 including monitoring network availability and troubleshooting and resolving network outage incidents.

Network traffic, utilization, and trends are monitored to characterize network traffic volume, bottlenecks, and points of failure. Analysis findings contribute to ensuring that sufficient bandwidth capacity is planned and implemented to ensure network infrastructure to accommodate current and forecasted customer traffic.

The NOSC coordinates, manages, and reports on all access, asset and configuration, availability, capacity, change, demand, information security, IT service continuity, release and deployment, request fulfilment, service level, and service validation and testing processes.

3.3 Change and Configuration Management Support Objectives

All proposed network infrastructure modifications are submitted and implemented under the approval of the DHS change control governance process. All change control procedures are followed and supported.

3.4 Service Delivery Implementation Objectives

The vendor establishes a cradle-to-grave process to triage, manage, monitor, analyze, track, and close all HSEN service requests, including for coordination with EIS or other contract vehicles for coordination with Local Exchange Carriers for circuit installation across the United States and territories.

Communications with DHS Stakeholders including OCIO Management, Component NOCs and SOCs, programs, Subscribers, and other entities inside and outside of DHS are maintained to keep all interested parties apprised of the current operational status and the status of progress in restoring disrupted service and recovering from cybersecurity attacks.

3.5 Log Management and Analysis Support Objectives

Incoming log files are received and stored for time periods established for log file analysis.

Stored log files are archived when reaching prescribed age thresholds.

Archived log files are retrieved for analysis within a prescribed retrieval timeframe.

Incoming log files are processed by the NOSC SIEM application upon receipt.

Log file analysis identifies attack vectors used, targets of attacks; incident root causes, impacts to subscriber networks; and trends.

3.6 Incident Assessment and Response Support Objectives

Incidents escalated from Tier 1 are managed by Tier 2 which provides response coordination, maintains communications among stakeholders, provides situational awareness reports to the Government Watch Officer, and further to Tier 3 or other escalation structures.

3.7 Email Security Objectives

Incoming email messages exhibiting characteristics of malicious content, spam, or other undesirable incoming traffic are redirected to designated mailboxes and quarantined.

Suspicious email messages are evaluated and malicious payloads analyzed.

Email addresses responsible for messages exhibiting characteristics of malicious content, spam, or other undesirable incoming traffic are blocked.

The scope of infections resulting from email containing malicious content is identified, affected users are notified, and recovery is coordinated across DHS.

3.8 Cybersecurity Threat Intelligence Support Objectives

Information on emerging cyber threats at different classification levels is collected from Internet security firms, Government organizations, private industry, and foreign Governments and is assessed and evaluated and used to develop cyber defense measures.

The intentions of adversary groups to conduct computer network exploitation (CNE) and computer network attacks (CNA) against U.S. private sector and Government networks and information systems are determined.

Cyber threat information is distributed across DHS to provide situational awareness to DHS SOCs, NOCs, and enterprise level decision makers.

3.9 Attack Sensing & Warning Objectives

Advanced, persistent, and coordinated threats across multiple networks along with distributed, long term, coordinated , low visibility network-based attacks are detected and identified and courses of action to remediate or mitigate those threats and attacks are developed and implemented.

DRAFT

Threat intelligence is correlated with hardware and software assets potentially impacted by those threats. Potential resulting impacts to operations are assessed.

Threats, countermeasures, and courses of action are communicated across DHS to Components and subscribers for implementation.

3.10 Content Development Objectives

Data feeds and event logs are analyzed and the results correlated with known threats, vulnerabilities, and incidents to create new security content and updates to Enterprise NOSC dashboards.

New security content such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Data Loss Prevention (DLP) correlation rules and cyber threat indicators are developed, disseminated, and implemented.

3.11 Threat Hunting Objectives

Manage all aspects of the cyber Threat Hunt lifecycle, including creation and improvement of enterprise-specific Threat Models and threat hypotheses, to plan and scope Threat Hunt campaigns, missions, and activities against a variety of threat types and to identify enterprise defense gaps and to propose potential mitigation activities.

Perform cyber Threat Hunt missions by identifying and investigating: patterns and anomalies in data; suspicious network activities, including access from OCONUS or utilization of non-standard credentials; anomalous or suspicious telemetry; and other Cyber Threat Intelligence.

Networks are proactively searched to detect and isolate advanced cybersecurity threats that evade in-place security solutions. Advanced analysis and adversary hunting activities are regularly performed to proactively uncover evidence of adversary presence on DHS networks.

Incident response procedures are followed for detected insider threat activity.

3.12 Cyber Forensics and Malware Analysis Support Objectives

Digital media devices and media are analyzed to identify, reverse engineer, and de-obfuscate malware and other content causing cybersecurity incidents.

Cyber forensics and malware analysis laboratory facilities where malware can be identified, analyzed, and reverse engineered are operated, accessible, and available. All such facilities are isolated from DHS networks to ensure that malware threats under investigation pose no potential threat to the DHS Enterprise.

3.13 Evidence Management Objectives

Information and data encountered in the course of incident response and recovery efforts or in the course of malware analysis are preserved for law enforcement purposes. Proper chain of custody, storage, handling, and transmission procedures are followed for various evidence categories including but not limited to Sensitive But Unclassified (SBU), For Official Use Only (FOUO), Law Enforcement Sensitive (LES), Confidential, Secret, Top Secret and Top Secret/ Sensitive Compartmented Information (TS/SCI).

Vulnerability scans are conducted for Headquarters and Subscriber systems and networks to identify potential computer security vulnerabilities, risks and threats. Discovered threats are reported to the CISOD Vulnerability Management Branch (VMB).

4 Task 3 - HSEN Network Infrastructure Tier 3 Support (Optional)

TBD.

5 Task 4 - Field Engineering Technical Services Objectives Field Engineering personnel are stationed regionally throughout Continental United States (CONUS) to provide IT support requiring hands-on intervention at DHS facilities and sites lacking local IT support.

6 Deliverables Deliverables shall be submitted via email on or before the due date specified in the Statement of Work or submitted in accordance with a later scheduled date mutually agreed upon by the Government and Contractor. A deliverable is considered timely if submitted on or before the date specified in the Statement of Work and if the Government provides any written notifications of deficiencies the Contractor must correct the deficiencies within five (5) business days.

The Contractor shall submit suggestions for improved grouping of deliverables or reduced numbers of deliverables to avoid duplication or unnecessary re-work. The Contractor shall store key information and Work Products in a centrally located, updated, managed, and version – controlled repository.

The below table provides a description of required Deliverables, due dates, and the sections of the SOW where referenced.

Table 1. Deliverables

Section Deliverable Due Date Distribution

Post Award Conference

Post Award Conference (Kick-off)

Within ten (10) calendar days after Contract Award

Contracting Officer’s Representative

(COR),

Contracting

DRAFT

Section Deliverable Due Date Distribution

Officer (CO), IT Operations Directorate (ITO) Management

Program Management Support

Project Management Plan Ten (10) calendar days post award meeting Update: Semi-annually

COR, CO, ITO

Management

Program Management Support

Communications Plan Draft: Thirty (30) calendar Days after Award Final: Fifteen (15) calendar Days after Government comments

COR, CO, ITO

Management

Program Management Support

Disaster Recovery Plan Draft: 30 calendar days after contract award Final: 45 calendar days after contract award Update: annually

COR and Government Leads

Staffing Plan Staffing Plan Within twenty (20) calendar days of Contract Awards

COR, CO, ITO

Management

Transition Support - Incoming

Transition-In Plan Draft: 10 calendar days after contract aware Final: 30 calendar days after contract award

COR, CO, ITO

Management

Transition Support - Outgoing

Transition-Out Plan 90 calendar days from notification by the Government

COR, CO, ITO

Management

Continuity Planning Support

Continuity of Operations Plan (COOP)

Draft: 30 calendar days after contract award Final: 45 calendar days after contract award Update: Annually

COR, CO, ITO

Management

Business Continuity Plan

Business Continuity Plan Draft: 30 calendar days after contract award Final: 60 calendar days after contract award

COR, CO, ITO

Management

Section Deliverable Due Date Distribution

Performance and Investment Metrics

Performance and Investment Metrics Program Pilot Plan

Draft: Thirty (30) calendar days after award Final: Fifteen (15) calendar days after receipt of Government comments on the Draft

NOSC Branch Chief

Performance and Investment Metrics

Performance and Investment Metrics Program Deployment Plan

Draft: Sixty (60) calendar days after Award Final: Fifteen (15) calendar days after Government comments on the Draft

NOSC Branch Chief

Performance and Investment Metrics

Performance and Investment Metrics Monthly Summary Report

Monthly, not later than the 15th

NOSC Branch Chief

Service Delivery Support

Quality Management Plan Draft: At Post Award Conference (Kick-off) Meeting Final: Fifteen (15) calendar Days after Government Comments

COR, CO, ITO

Management

Standard Operating Procedures (SOP) for NOSC processes

Draft: 60 calendar days after contract award Final: 75 calendar days after contract award and as requested by the Government

COR, NOSC

Branch Chief

Continuous Service Improvement Plan (CSIP)

9 months after award, with updates as required by the Government

COR. NOSC

Branch Chief

Service Level Agreement Reviews

90 calendar days after transition Review/update every 180 calendar days as required

COR,

Government Leads

DRAFT

Section Deliverable Due Date Distribution

Network Problem Reports and Documentation

Network Capacity and Availability Health Report of all HSEN WAN devices

Weekly/Monthly (Weekly and Not Later Than (NLT) COB 2nd workday of each month and NLT 3rd workday before Monthly Status Meeting)

COR, NOSC

Branch Chief

Network Problem Reports and Documentation

Vendor Response Tracking Report

60 calendar days after contract award, updated biannually

COR, NOSC

Branch Chief

N/A Meeting Agenda, Meeting Minutes, Presentation Materials, Action Items

Ad hoc, Agenda and Presentation Materials: Two

(2) business days prior to meeting Minutes and Action Items:

Three (3) business days after meetings

COR & Federal Leads

N/A Monthly Status Reports/Meeting

Monthly Status Report (not later than the 15th of each month), Meeting – 3rd Friday of the Month

COR, CO, ITO

Management

N/A Daily and Weekly Operations and Project Status Reporting

As required NOSC Branch Chief

Progress Reports Monthly Financial Report Monthly, not later than the 15th

NOSC Branch Chief

Progress Reports Monthly Program Report Monthly, not later than the 15th

NOSC Branch Chief

6.1 Work Products

This section lists work products that will typically be required on an on-going and repetitive basis. Specific work products that will be required may be specified as products required by Standard Operating Procedures or may be the result of ad-hoc assignments by NOSC Management.

Work Products - Work Products may contain sensitive information and are posted/maintained on various Government Systems/Shared sites or are items that are completed in support of operational activities. Working documents are considered living documents maintained and updated on Government systems. Examples of typical work products are contained in the following tables.

Table 2. Program Management Work Products

Work Product Due Date Distribution

Performance and Investment Metrics Program Roadmap

Draft: Monthly NOSC Branch Chief

Performance and Investment Metrics Weekly Status Briefing

Update: Weekly, by Wednesday

NOSC Branch Chief

Lessons Learned Reports Ad hoc: within three (3) business days of request

Directors, Branch Chiefs, and Service Area Leads

Technology Recommendations

Quarterly Directors, Branch Chiefs, and Service Area Leads

Computing Support Recommendations

Quarterly Directors, Branch Chiefs, and Service Area

Table 3. Typical Tier 1 Work Products

Work Product Due Date Distribution

Retrievable Customized On-Line Reports

Ad hoc: within 1 business day of request

NOSC Branch Chief

Incident Tracking Workflow and Reporting

Ad hoc: within 1 business day of request

NOSC Branch Chief

Incident Investigation and Case Analysis

Ad hoc: in accordance with

SOP

NOSC Branch Chief

External Entities Points of Contact list

Bi-annually NOSC Branch Chief

DRAFT

Work Product Due Date Distribution

M&A Comprehensive Reports on Findings and Recommendations

Ad hoc: within one (1) business day of discovery

NOSC Branch Chief, NOSC Federal Leads

Incident Assessment and Response Daily Status Reports

Not later than 2pm ET daily NOSC Branch Chief, Cyber Intelligence & Analysis Branch Chief

Post Incident Analysis Report Within three (3) business days of close of incident

NOSC Branch Chief, Cyber Intelligence & Analysis Branch Chief, ITO Executive Director

Incident Assessment Recommendations

Within three (3) business days of incident

NOSC Branch Chief, Cyber Intelligence & Analysis Branch Chief, ITO Executive Director

Security Event Notifications

Ad hoc: in accordance with

SEN SOP

NOSC Branch Chief, Component SOC Managers

NOSC SOPs Ad hoc: within fifteen (15) business days of assignment

NOSC Branch Chief, NOSC Federal Leads

NOSC Operational Daily Status Report and Conference Call

Not later than 0900 ET daily NOSC Branch Chief, NOSC Federal Leads

NOSC Operational Weekly Activity Report

Wednesdays, not later than

1600 ET

NOSC Branch Chief, NOSC Federal Leads

NOSC Operational Ad Hoc Reports

Ad hoc: within one (1) business day of request

NOSC Branch Chief, NOSC Federal

Table 4. Typical Tier 2 Work Products

Work Product Due Date Distribution

M&A Comprehensive Reports on Findings and Recommendations

Ad hoc: within one (1) business day of discovery

NOSC Branch Chief, NOSC Federal Leads

Tool Tuning Activities Report

Monthly, not later than the 15th day

NOSC Branch Chief, NOSC Federal Leads

Retrievable Customized On-Line Reports

Ad hoc: within 1 business day of request

NOSC Branch Chief

Incident Tracking Workflow and Reporting

Ad hoc: within 1 business day of request

NOSC Branch Chief

Incident Investigation and Case Analysis

Ad hoc: in accordance with

SOP

NOSC Branch Chief

Support Incident Assessment and Response Daily Status Reports

Not later than 2pm ET daily NOSC Branch Chief, Cyber Intelligence & Analysis Branch Chief

Post Incident Analysis Report

Within three (3) business days of close of incident

NOSC Branch Chief, Cyber Intelligence & Analysis Branch Chief, ITO Executive Director

Incident Assessment Recommendations

Within three (3) business days of incident

NOSC Branch Chief, Cyber Intelligence & Analysis Branch Chief, ITO Executive Director

NOSC SOPs Ad hoc: within fifteen (15) business days of assignment

NOSC Branch Chief, NOSC Federal Leads

Threat Intelligence Beacon Ad hoc: within 3 business days of request

Cyber Intelligence & Analysis Branch Chief

Threat Assessment/Threat Card

Quarterly, not later than the 15th of the month beginning the quarter

Cyber Intelligence & Analysis Branch Chief

DRAFT

Work Product Due Date Distribution

Daily Digest Daily (Monday-Friday) Cyber Intelligence & Analysis Branch Chief, Component SOC Managers

Threat Briefings Monthly or ad hoc: 3 days within ad hoc request

Cyber Intelligence & Analysis Branch Chief, ITO Executive Director

Content Development of New Security Content

Ad hoc: within three (3) business day of request

NOSC Branch Chief, NOSC Federal Leads

CFMA Remedial Recommendations

Ad hoc: within three (3) business days of request

Cyber Intelligence & Analysis Branch Chief

CFMA Comprehensive Reporting on Findings

Ad hoc: within three (3) business days of request

Cyber Intelligence & Analysis Branch Chief

Network Operations Briefings/Problem Reports

Daily (NLT 9:00 AM) NOSC Branch Chief

7 Government Furnished Items Government Furnished Items the Government will provide the workspace, equipment and supplies necessary to perform the on-site portion of Contractor services required in this contract, unless specifically stated otherwise in this work statement.

The Contractor shall use Government furnished facilities, property, equipment and supplies only for the performance of work under this contract and shall be responsible for returning all Government furnished facilities, property, and equipment in good working condition, subject to normal wear and tear.

The Government will provide all necessary information, data, and documents to the Contractor for work required under this contract.

The Contractor shall use Government furnished information, data, and documents only for the performance of work under this contract and shall be responsible for returning all Government furnished information, data, and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data, and documents to outside parties without the prior and explicit consent of the Contracting Officer.

8 Travel Local travel and travel time, located within 50 miles of the standard operating locations, will not be reimbursed. Non-local travel shall be approved in advance by the COR and the travel shall be funded on the contract via modification of the contract by the Contracting Officer.

No travel may be accomplished until such time as the travel is approved by the COR and funded via modification. All travel will be reimbursed in accordance with the Federal Travel regulations.

9 Place of Performance The primary place of performance will be a combination of Government, Contractor and remote work locations. Government locations include NOSC facilities located in the Washington, DC metropolitan area; Stennis, Mississippi; Chandler, Arizona; and other potential locations.

Telework may be authorized at the discretion of the Government. However, staff assigned to a NOSC facility must be present at that duty location a minimum of one day each week. Mission requirements may require full time presence. Classified resource monitoring can occur only from SCIF facilities. Staff performing classified resource monitoring must be physically present inside the SCIF while performing those duties. Specific functions may be performed entirely from Contractor or remote locations.

Performance may be required at alternate Government facilities as directed under the terms of this contract. Other work locations include, but are not limited to, the Contractor’s facility, telework/telecommute location, and other sites as identified in the Contractor’s Continuity of Operations Plan (COOP) and at the direction of the NOSC Branch Chief or the NOSC DHS Leads, COR, or service area leads.

The primary place of performance for Task 3, Field Engineering Technical Services, will be various locations throughout the Continental United States (CONUS) from which personnel will be dispatched to provide hands-on IT support and troubleshooting where needed.

10 Period of Performance The period of performance will consist of one (1) Base Year and nine (9) Optional Years.

11 Key Personnel The Contractor shall provide qualified personnel to fill the following Key Personnel roles:

Program Manager Deputy Program Manager IT Service Management Lead Infrastructure and Platform Tier 2 Technical Team Lead Cybersecurity Services Program Lead

Contractor Key personnel shall not be assigned by the Contractor to more than one key position for this requirement.

DRAFT

12 Personnel Qualifications The following describe characteristics of personnel required for the various roles under this Contract:

Table 5. Key Personnel Qualifications

Title Area of Responsibility

Minimum Qualifications

Other Desired Qualifications

Program Manager

All SOW Areas • Project Management Professional (PMP) certification

• 10 years overall network engineering management and wide area network experience, with technical and management teams

• ITIL certification

• CMMI experience

Tier 1 Technical Team Lead

NOSC Tier 1 Support Services

• 5+ years of IT technical experience in WAN routing and switching in a large, geographically dispersed enterprise environment

• CCNA certification

• Network Plus certification

• Security Plus certification

• ITIL certification

Tier 2 Technical Team Lead

NOSC Tier 2 Support Services

• Cisco Network Associate certification

• 5+ years routing/switching experience in an engineering support capacity in WAN networks

• CCNP Certification

• ITIL certification

Cybersecurity Services Program(CSP) Lead

All SOW areas

• 10+ years of cybersecurity technical experience

• 2+ years IT operational experience

• Project management certification desired

• ITIL Foundations desired

13 Hours of Operation The NOSC will operate two (2) shifts each day:

1. 07:00 AM – 19:30 PM

2. 19:00 PM – 07:30 AM

All NOSC operations will operate on Eastern time.

The 30-minute overlap between the incoming and outgoing shifts will allow for current activity handoff to the incoming shift.

The Contractor shall provide staffing for DHS NOSC Support Services core tasks as shown in Table 6.*:

Table 6. Hours of Operation

Task Coverage/ Core Hours On-Call Support 24x7x365

Task 1 Program Management 12x5, 0800-2000 Eastern Time (Core Hours) Monday-Friday

Yes

Task 2: Tier 1 and Tier 2 Operations Sub-Task 1: Monitoring and Analysis

24x7x365 – Sub-Task 1 Monitoring and Analysis

N/A

Task 2: Tier 1 and Tier 2 Operations Sub-Task 2: Log Management Sub-Task 3 Asset Visit and Monitoring Sub-Task 4 Tier 2 Expert Services Sub-Task 5 Tier 2 Network Operations Sub-Task 6 General NOSC Support

24x7x365, as assigned during scheduled shifts

N/A

Task 3: Field Engineering Technical Services

0800-2000 Local Standard Time

Yes

Task 4: Surge Support 24x7x365, as assigned during scheduled shifts

N/A

Task 5: Project and Project Management Support

24x7x365, as assigned during scheduled shifts

N/A

*Hours may vary to accommodate incident response, problem management and planned maintenance support.

The Government may change these times and requirements as necessary.

DRAFT

The contractor shall ensure that adequate personnel in all positions are available by phone/telework or to respond in person, for all business needs.

14 Plans Reports and Meetings

14.1 Recurring Reports

The Contractor’s Program Manager shall provide regular reporting to the Government on a recurring basis.

14.1.1 Progress Reports

The Program Manager shall provide a monthly Program Report and a monthly Financial Report to the Contracting Officer and COR via electronic mail. These reports shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category for time and material and labor hour tasks, all direct costs by line item at the individual service or resource level, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.