Attachment I Draft Statement of Objectives.pdf

Attachment I Draft SOO Page 1 of 4

Attachment I Draft Statement of Objectives

DEPARTMENT OF HOMELAND SECURITY (DHS)

Childcare Subsidy Program (CCSP) Services

PURPOSE. The purpose of this effort is to have a Contractor provide administrative support services to administer and support the DHS Childcare Subsidy Program (CCSP).

SCOPE OR MISSION. The Scope of this effort includes processing new and recertification of all CCSP applications from employees based on DHS determined eligibility guidelines; submit childcare subsidy payments directly to childcare providers independent of DHS; and assisting with issues pertaining to the administration of the CCSP, such as technical assistance with the intake portal, etc.

PERIOD OF PERFORMANCE. The period of performance for this statement of objectives could be comprised of a 12-month base period plus up to four 12-month option periods.

PLACE OF PERFORMANCE. The primary place of performance will be the contractor’s facilities.

BACKGROUND. The Department of Homeland Security employs approximately 250,000 employees.

Most of these employees work in the Continent United States, but there are DHS employees in Alaska, Hawaii, Puerto Rico, the United States Virgin Islands, Guam, and other overseas locations. DHS recognizes that our employees face the same types of personal challenges that all other Americans face and is committed to providing our employees and their families with the right resources, at the right time, to enhance their wellness and increase resilience. Taking care of our workforce and their families is vital to the integrity of operational readiness, reliability, capability, continuity, and mission accomplishment; our success or failure has national security implications. Ensuring the DHS workforce has dependable and affordable childcare, so employees may be onsite and mission-ready, is critical to successful execution of DHS’s various missions.

PERFORMANCE OBJECTIVES.

1. The Contractor shall support DHS to establish and operate its CCSP, including the development of specific agency guidelines and CCSP subsidy schedule(s). Contractor responsibilities may include but are not limited to:

• Providing start-to-finish services;

• Performing all necessary tasks to receive, process, and report subsidy payments in a streamlined and cost-efficient manner;

• Receiving and processing new applications and recertification documents within ten (10) business days;

• Issuing award or denial letters, via email, to applicants or participants.

• Creating and providing on-going promotional materials to enhance awareness of CCSP to DHS employees that encourages utilization

NOTE: It remains to be determined whether this effort will be department-wide, encompassing all DHS Components; or limited to certain DHS Components; or a combination thereof—initially limited to

Attachment I Draft SOO Page 2 of 4 certain DHS Components then possibly expanded to include all DHS Components. Therefore, a scalable program is needed, initially the program may be limited to certain DHS Components, then possibly expanded to include all DHS Components.

2. The Contractor shall develop and maintain an interactive website and database. The Contractor shall ensure the solution is ready and able to achieve a DHS-issued Authority to Operate (ATO). The website must comply with the:

• DHS Enterprise Architecture, to include an acceptable IT System Security Plan

• DHS Application Architecture

• DHS Open-Source

• FedRAMP Certification

• DHS Cyber-Supply Chain Risk Management

OPERATING CONSTRAINTS

Contract Personnel Security. HSAR 3052.204-71, Contractor Employee Access (JUL 2023) -- Alternate II (JUL 2023), applies. Failure to follow these instructions may delay the completion of background investigations, EOD, and fitness determinations. Note that any delays in this process, which are not caused by the Government, do not relieve a contractor from performing under the terms of the contract.

APPLICABLE DOCUMENTS OR REFERENCES.

See Exhibit 1, Reference Documents

Attachment I Draft SOO Page 3 of 4

Exhibit 1

APPLICABLE DOCUMENTS OR REFERENCES

The Government requires the Contractor to adhere to and follow all applicable executive orders, presidential directives, federal laws, and DHS management policies, handbooks, guidelines, processes, and procedures:

1. DHS Policy Directive 4300A: Information Technology System Security Program, Sensitive Systems, v13.3;

2. Department of Defense (DoD) Manual 5200.01 Volumes 1-3, February 24, 2012;

3. Office of Personnel Management - Enterprise Human Resources Integration (EHRI):

4. https://www.opm.gov/policy-data-oversight/data-analysis-documentation/enterprise-human-resources-integration/ ;

5. https://www.opm.gov/policy-data-oversight/data-analysis-documentation/data-policy-guidance/#url=Data-Reporting-Guidance ;

6. The National Institute of Standards and Technology (NIST) serve as the proponent for cybersecurity guidance and publishes the Cybersecurity Framework for the federal sector. Within this framework, NIST SP 800-53 Rev. 5, September 2020 is the common document used to reconcile security controls. Federal Information Security Modernization Act (FISMA) mandates the following NIST guidance and standards:

6.1 Federal Information Processing Standard (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

6.2 FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

6.3 Special Publication 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

6.4 Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, September 2020

6.5 Special Publication 800-53A Rev.5, Assessing Security and Privacy Controls in Information Systems and Organizations, January 2022

6.6 Special Publication 800-59, Guideline for Identifying an Information System as a National Security System, August 2003

6.7 Special Publication 800-60 Vol.1 Rev.1, Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008

6.8 NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization, December 2014

6.9 NIST SP 800-144, Guidelines of Security and Privacy in Cloud Computing, December

6.10 NIST SP 800-146, Cloud Computing Synopsis and Recommendations, May 2012

6.11 Federal Information Processing Standard (FIPS) 140-3, Security Requirements for Cryptographic Modules, March 2019

7. DHS Directive 140-01 Rev. 2, Information Technology Security Program, May 2017

8. DHS Instruction Guide 040-01-008, Privacy Incident Handling Guidance, December 2017

9. DHS Security Authorization Process Guide

10. DHS Management Directive 11042.1, Safeguarding Sensitive but Unclassified (For Official Use

Only) Information, January 2015

11. DHS Instruction Handbook 121-01-007, Personnel Suitability and Security Program, February https://dhsconnect.dhs.gov/org/comp/mgmt/ocio/ciso/CISO%20ALL%20Documents/DHS%204300A%20ITSSP%20SS%20Policy%20Directive%20v13.3.pdf https://www.esd.whs.mil/directives/issuances/dodm/ https://www.opm.gov/policy-data-oversight/data-analysis-documentation/enterprise-human-resources-integration/ https://www.opm.gov/policy-data-oversight/data-analysis-documentation/enterprise-human-resources-integration/ https://www.opm.gov/policy-data-oversight/data-analysis-documentation/data-policy-guidance/#url=Data-Reporting-Guidance https://www.opm.gov/policy-data-oversight/data-analysis-documentation/data-policy-guidance/#url=Data-Reporting-Guidance https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.199.pdf https://csrc.nist.gov/publications/detail/fips/200/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf https://csrc.nist.gov/publications/detail/sp/800-59/final https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-144/final https://csrc.nist.gov/publications/detail/sp/800-146/final https://csrc.nist.gov/publications/detail/fips/140/3/final https://www.bing.com/ck/a?!&&p=3a04fab47b6800a6JmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTE5Ng&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=DHS+Directive+140-01&u=a1aHR0cHM6Ly93d3cuZGhzLmdvdi9zaXRlcy9kZWZhdWx0L2ZpbGVzL3B1YmxpY2F0aW9ucy9EaXJlY3RpdmUlMjAxNDAtMDElMkMlMjBSZXZpc2lvbiUyMDAyJTJDJTIwSW5mb3JtYXRpb24lMjBUZWNobm9sb2d5JTIwU2VjdXJpdHklMjBQcm9ncmFtJTIwJTI4Li4uLnBkZg&ntb=1 https://www.bing.com/ck/a?!&&p=fa18d83729996a98JmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTIxNw&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=DHS+Instruction+Guide+040-01-008&u=a1aHR0cHM6Ly93d3cuZGhzLmdvdi9zaXRlcy9kZWZhdWx0L2ZpbGVzL3B1YmxpY2F0aW9ucy8wNDctMDEtMDA4JTIwUElIRyUyMEZJTkFMJTIwMTItNC0yMDE3XzAucGRm&ntb=1 https://www.bing.com/ck/a?!&&p=e96c785ef7328eedJmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTIwMQ&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=DHS+Security+Authorization+Process+Guide&u=a1aHR0cHM6Ly93d3cuZGhzLmdvdi9zaXRlcy9kZWZhdWx0L2ZpbGVzL3B1YmxpY2F0aW9ucy9TZWN1cml0eSUyMEF1dGhvcml6YXRpb24lMjBQcm9jZXNzJTIwR3VpZGVfMS5wZGY&ntb=1 https://www.dhs.gov/sites/default/files/publications/Management%20Directive%2011042.1%20Safeguarding%20Sensitive%20But%20Unclassified%20%28For%20Official%20Use%20Only%29%20Information_0.pdf https://www.dhs.gov/sites/default/files/publications/InstructionHandbook121-01-007PersonnelSuitabilityandSecurityProgram.pdf

Attachment I Draft SOO Page 4 of 4

12. Coast Guard Cybersecurity Manual, Commandant Instruction (COMDTINST) M5500.13 (series)

– FOUO

13. DoD Instruction (DODI) 8500.01, Cybersecurity, October 2019

14. DODI 8510.01, Risk Management Framework for DoD Systems, July 2022

15. DODI 8520.03, Identity Authentication for Information Systems, May 2023

16. DODI 8530.01,Cybersecurity Activities Support to DoD Information Network Operations, July

17. DoD Cloud Computing Security Requirements Guide (SRG), Version 1, Release 3, March 6,

18. Defense Information Systems Agency (DISA) Cloud Connection Process Guide, Version 2, March 2017

19. CJCSM 6510.01B, Cyber Incident Handling Program, Chairman of the Joint Chiefs of Staff

Manual (CJCSM), December 2014

20. Information Assurance Vulnerability Management - DOD CJCSI Policy 6510-01F, Assurance

(IA) and Computer Network Defense (CND), and CJCSM 6510-01B Cyber Incident Handling Program. National Security systems guidance can be found at https://www.cnss.gov/CNSS/issuances/Policies.cfm.

21. Executive Order 13231, Critical Infrastructure Protection in the Information Age, October 2001

22. PDD 63, Critical Infrastructure Protection, May 1998

23. DoD Memorandum for Cybersecurity Activities Performed for Cloud Service Offerings, November 15, 2017

24. DHS Policy Directive 142-04, DHS Reusable and Open Source Software Rev. 01, August

25. Federal Employees' Health, Counseling, and Work/Life Programs // Agency Use of Appropriated

Funds for Child Care Costs for Lower Income Employees, 5 CFR Part 792, Subpart B;

26. Appropriated Amounts for Affordable Child Care, 40 USC 590(g)

27. Federal Cloud Computing Strategy, February 2011;

28. Security Authorization of Information Systems in Cloud Computing Environments, December 2011;

29. 25 Point Implementation Plan to Reform Federal Information Technology, December 2010;

30. HSPD-12 – Policies for a Common Identification Standard for Federal Employees and Contractors;

31. OMB M-11-11 "Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors”;

32. OMB M-06-16 – Acquisition of Products and Services for Implementation of HSPD-12; and

33. NIST Special Publication 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations https://www.bing.com/ck/a?!&&p=77b77d23d9c84ed8JmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTIwMA&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=DoD+Instruction+(DODI)+8500.01&u=a1aHR0cHM6Ly93d3cuZXNkLndocy5taWwvUG9ydGFscy81NC9Eb2N1bWVudHMvREQvaXNzdWFuY2VzL2RvZGkvODUwMDAxXzIwMTQucGRm&ntb=1 https://www.bing.com/ck/a?!&&p=bc5f2a7f844f5477JmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTE5MQ&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=DODI+8510.01&u=a1aHR0cHM6Ly93d3cuZXNkLndocy5taWwvUG9ydGFscy81NC9Eb2N1bWVudHMvREQvaXNzdWFuY2VzL2RvZGkvODUxMDAxcC5wZGY_dmVyPTIwMTktMDItMjYtMTAxNTIwLTMwMA&ntb=1 https://www.bing.com/ck/a?!&&p=c94977c1567d188cJmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTIwMg&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=DODI+8520.03&u=a1aHR0cHM6Ly93d3cuZXNkLndocy5taWwvUG9ydGFscy81NC9Eb2N1bWVudHMvREQvaXNzdWFuY2VzL2RvZGkvODUyMDAzcC5wZGY&ntb=1 https://www.bing.com/ck/a?!&&p=93eccf1bfa7754f4JmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTE5Nw&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=dodi+8530.01+&u=a1aHR0cHM6Ly93d3cuZXNkLndocy5taWwvUG9ydGFscy81NC9Eb2N1bWVudHMvREQvaXNzdWFuY2VzL2RvZGkvODUzMDAxcC5wZGY&ntb=1 https://www.bing.com/ck/a?!&&p=e554e892080b0d5fJmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTE4OQ&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=DoD+Cloud+Computing+Security+Requirements+Guide+(SRG)%2c+version+1%2c+revision+3&u=a1aHR0cHM6Ly9ybWYub3JnL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDE4LzA1L0Nsb3VkX0NvbXB1dGluZ19TUkdfdjFyMy5wZGY&ntb=1 https://www.bing.com/ck/a?!&&p=718294eaff843f53JmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTE5NQ&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=Defense+Information+Systems+Agency+(DISA)+Cloud+Connection+Process+Guide&u=a1aHR0cHM6Ly93d3cuZGlzYS5taWwvfi9tZWRpYS9GaWxlcy9ESVNBL1NlcnZpY2VzL0RJU04tQ29ubmVjdC9SZWZlcmVuY2VzL0NDUEcucGRm&ntb=1 https://www.cnss.gov/CNSS/issuances/Policies.cfm https://www.bing.com/ck/a?!&&p=8522c85bd339ce7dJmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTIwOA&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=EXECUTIVE+ORDER+13231&u=a1aHR0cHM6Ly93d3cuZGhzLmdvdi94bGlicmFyeS9hc3NldHMvZXhlY3V0aXZlLW9yZGVyLTEzMjMxLWRhdGVkLTIwMDEtMTAtMTYtaW5pdGlhbC5wZGY&ntb=1 https://irp.fas.org/offdocs/pdd/pdd-63.pdf https://www.bing.com/ck/a?!&&p=40c1d08f1ba0a600JmltdHM9MTY4ODk0NzIwMCZpZ3VpZD0xZTEyY2E4OC1jZTZmLTY5YTktM2JlMy1kOWMyY2Y3ZDY4ZjEmaW5zaWQ9NTE5NQ&ptn=3&hsh=3&fclid=1e12ca88-ce6f-69a9-3be3-d9c2cf7d68f1&psq=DoD+Memorandum+for+Cybersecurity+Activities+Performed+for+Cloud+Service+Offerings&u=a1aHR0cHM6Ly9kb2RjaW8uZGVmZW5zZS5nb3YvUG9ydGFscy8wL0RvY3VtZW50cy9DeWJlci9Eb0QlMjBDSU8lMjBTaWduZWQlMjBNZW1vJTIwLSUyMERvRCUyMEN5YmVyc2VjdXJpdHklMjBBY3Rpdml0aWVzJTIwUGVyZm9ybWVkJTIwZm9yJTIwQ2xvdWQlMjBTLi5fLnBkZg&ntb=1 https://www.dhs.gov/scip#PolicyOverview https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-792/subpart-B https://cloud.cio.gov/ https://www.fismacenter.com/fedrampmemo.pdf https://www.dhs.gov/sites/default/files/publications/digital-strategy/25-point-implementation-plan-to-reform-federal-it.pdf https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/m11-11.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2011/m11-11.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2006/m06-16.pdf https://www.bing.com/ck/a?!&&p=8b5e28167ee3e733JmltdHM9MTY4OTEyMDAwMCZpZ3VpZD0wMjkyMTI5YS04ZTI5LTZhYWQtMDZjNy0wMWQ2OGYyYjZiNjcmaW5zaWQ9NTIwMw&ptn=3&hsh=3&fclid=0292129a-8e29-6aad-06c7-01d68f2b6b67&psq=NIST+Special+Publication+800-171&u=a1aHR0cHM6Ly9jc3JjLm5pc3QuZ292L3B1YmxpY2F0aW9ucy9kZXRhaWwvc3AvODAwLTE3MS9yZXYtMi9maW5hbA&ntb=1 https://www.bing.com/ck/a?!&&p=8b5e28167ee3e733JmltdHM9MTY4OTEyMDAwMCZpZ3VpZD0wMjkyMTI5YS04ZTI5LTZhYWQtMDZjNy0wMWQ2OGYyYjZiNjcmaW5zaWQ9NTIwMw&ptn=3&hsh=3&fclid=0292129a-8e29-6aad-06c7-01d68f2b6b67&psq=NIST+Special+Publication+800-171&u=a1aHR0cHM6Ly9jc3JjLm5pc3QuZ292L3B1YmxpY2F0aW9ucy9kZXRhaWwvc3AvODAwLTE3MS9yZXYtMi9maW5hbA&ntb=1