ISSO_RFI_Draft-SOO_V2.pdf

Statement of Objectives (SOO) Enterprise Information System Security Officer (ISSO) Program Services

Department of Homeland Security (DHS) Transportation Security Information (TSA)

Version 1

June 5, 2023

Contents

1.0 GENERAL ___________________________________________________________ 2

1.1 Mission _______________________________________________________ 2

1.2 Background____________________________________________________ 2

2.0 REQUIREMENT ______________________________________________________ 3

2.1 ISSO Responsibilities ____________________________________________ 3

2.2 Objectives _____________________________________________________ 3

2.3 Overview of Existing TSA Systems __________________________________ 7

2.4 Increased Services ________________________ Error! Bookmark not defined.

2.5 Applicable Documents ___________________________________________ 7

3.0 OTHER APPLICABLE CONDITIONS______________________________________ 8

3.1 Period of Performance ____________________________________________ 8

3.2 Place of Performance_____________________________________________ 9

3.3 Hours of Work _________________________________________________ 9

3.4 Travel _______________________________________________________ 10

3.5 Government Furnished Equipment (GFE) ____________________________ 10

3.6 GFE Contractor Accountability ____________________________________ 10

4.0 SECURITY __________________________________________________________ 11

4.1 Facility and Personnel Clearance ___________________________________ 11

5.0 PERSONNEL SKILL REQUIREMENTS ___________________________________ 11

5.1 Key Personnel _________________________________________________ 11

5.2 Minimum Qualifications for all other Personnel ________________________ 12

5.3 Key and non-Key Personnel Qualifications ___________________________ 13

6.0 GOVERNMENT INSPECTION AND ACCEPTANCE _________________________ 13

6.1 Government Review/Inspection, Acceptance and Rejection Process _________ 13

7.0 DELIVERABLES _____________________________________________________ 14

8.0 APPLICABLE REGULATIONS, DIRECTIVES, STANDARDS, AND POLICIES ____ 15

8.1 Accessibility Requirements (Section 508) ____________________________ 15

8.2 Cybersecurity Policy for TSA Government Acquisitions _________________ 15

8.3 DHS and TSA Enterprise Architecture _______________________________ 15

8.4 TSA-Requirements; Security Requirements for Handling Personally Identifiable

Information and Privacy Incident Response __________________________ 15

8.5 Supply Chain Risk Management (C-SCRM) SOO Language ______________ 15

9.0 ATTACHMENTS _____________________________________________________ 16

9.1 Attachment A: TSA ISSO Designation Letter__________________________ 16

9.2 Attachment B: Abbreviations and Acronyms __________________________ 20

Enterprise ISSO Program Services

1.0 GENERAL

1.1 Mission

This requirement is for Enterprise Information System Security Officer (ISSO) Program Services, which are necessary in order to meet Presidential mandates and timelines. Department of Homeland Security (DHS) and National Institute of Standards and Technology (NIST) Federal Information Security Modernization Act (FISMA) policy requires that each information system within the Transportation Security Administration (TSA) have an ISSO. ISSOs are responsible for ensuring and maintaining the security compliance for TSA information systems in accordance with (IAW) NIST, Federal and DHS security policies, directives, mandates, and laws.

This requirement is necessary in order to support TSA cybersecurity initiatives and programs, which includes addressing new requirements in support of the following mandates: Presidential (Executive Order (EO) 14028 for Improving the Nation’s Cybersecurity, dated May 12, 2021; the corresponding Office of Management and Budget (OMB) Memorandum M-21-31 “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incident”, dated August 27, 2021; and OMB Memorandum M-22-01 “Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response”, dated October 8, 2021.

1.2 Background

FISMA is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats. FISMA requires each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency.

TSA/Information Technology (IT) provides the administration’s response to meeting the practical and statutory security requirements associated with the use of IT solutions to support TSA data and assets.

The TSA/IT ISSO program provides centralized management and leadership of TSA's ISSOs.

The TSA Chief Information Security Officer (CISO) is responsible for the IT security activities necessary to protect the TSA/IT infrastructure. The TSA/IT Information Assurance and Cybersecurity Division (IAD) is a federally mandated program that provides the direction and guidance necessary to ensure TSA enterprise-wide information security is compliant with federal information security legislation, policies, and mandates. It is the IT security oversight activity for TSA. The TSA/IT/IAD manages and is the central office responsible for delivering information security services to TSA to include risk management and cybersecurity policy management. The IAD Enterprise ISSO Services Branch (EISB) provides TSA ISSO services support and enterprise standardization for ISSO support, standards, policy, and training to implement the CISO’s vision and develop and implement strategy for effectively leveraging ISSO professional services resources for TSA’s information systems, ensuring FISMA system compliance and the implementation of mandatory laws and directives. Maintaining and enhancing ISSO professional services at an enterprise level is needed to address the increase in cybersecurity threats and unknown events that require additional support, while ensuring assessment readiness and compliance with cybersecurity mandates, to ensure that TSA systems are protected from cybersecurity attacks.

2.0 REQUIREMENT

The Enterprise ISSO Program Services requirement is to provide enterprise ISSO program services and ensure diverse technical security expertise to achieve FISMA compliance. Services shall be performed under the guidance of the TSA CISO and the TSA EISB to support TSA IT and other organizations across TSA. The Contractor shall provide effective deployment and management of an adequate number of qualified ISSOs alternative ISSO’s and support staff. The Contractor shall provide ISSO services, technical expertise, program management, quality review teams and training support with the requisite experience to support the scope and complexity of the TSA Enterprise FISMA systems. The Contractor shall leverage appropriate resources to meet the needs of the EISB requirements. The Contractor shall maintain a flexible and supportive response to ISSO and support resources in order to adapt and adjust to both the recurring and fluctuating need for ISSO support and resources. The Contractor shall provide enterprise ISSO and System Owner training, and manage centralized TSA Enterprise oversight, standardization, quality control submissions, report tracking on the Risk Management Framework (RMF) steps, Authority to Operate (ATO) readiness reviews and all data call submissions. The Contractor shall maintain a dashboard to track activity compliance for all ISSOs and activities across

TSA.

2.1 ISSO Responsibilities

ISSOs are responsible for ensuring and maintaining the security compliance for TSA information systems IAW NIST, Federal security policies, DHS and directives, mandates, and laws. The Contractor shall perform work using the RMF processes and methodology.

TSA follows the six steps of the NIST RMF process: 0) Prepare the Organization to Manage Security and Privacy Risks; 1) Categorize Information System; 2) Select Security Controls; 3) Implement Security Controls; 4) Assess Security Controls; 5) Authorize Information System, and 6) Monitor Security Controls. Assigned ISSOs shall support all stages of the ISSOs take primary responsibility of the execution of activities in Steps 2-Categorize, 3-Select, 4-Implement and 7-Monitor of the RMF process. The role of the ISSO in Steps 5-Assess and 6-Authorize of the RMF is to coordinate and facilitate the Assessment and Authorization (A&A) of the assigned information.

The ISSO point of contact for information assurance activities at the IT system level shall report directly to the TSA/IT/IAD for general guidance, process updates and for IT security priorities. All ISSOs shall be designated in writing by the CISO designation letter to serve as the cybersecurity expert for assigned system(s). Alternative ISSOs also need to be assigned and informed on the system to ensure continuous coverage in case the primary ISSO is not available. See Attachment A, TSA ISSO Designation Letter, for performance expectations.

2.2 Objectives

The objectives of this procurement shall be to; obtain expert technical IT security support to provide professional ISSO resources and support personnel, ensure diverse technical security expertise, achieve FISMA compliance, support TSA enterprise-level centralized management strategic approach and oversight, standardization, allocation, reporting, ISSO and System Owner training, and obtain quality documentation reviews of all TSA FISMA compliance and system documentation across the TSA Enterprise, and execute day to day FISMA compliance monitoring, ensuring that all FISMA activities, include Continuous Diagnostic and Mitigation (CDM) program activities. ISSO Support Services shall support the TSA CISO and the TSA/IT IAD EISB.

Specific objectives are as follows:

• Objective 1, ISSO Services for TSA Systems: Provide qualified primary, alternate ISSOs, and diverse technical security expertise to achieve FISMA compliance and deadlines and satisfy FISMA and TSA ISSO responsibilities identified in this Statement of Objectives (SOO) for all assigned TSA systems, for identified contractor ISSO supported systems The Contractor shall provide ISSO resources to support TSA IT/IAD, Operations and Engineering Division (OED), and Applications Development Division (ADD) managed systems and other offices outside of TSA IT. The Contractor shall deliver ISSOs that achieve FISMA compliance and satisfy TSA ISSO responsibilities for assigned systems. The Contractor shall ensure that management, operational, and technical controls for securing either National Security Systems or Sensitive but Unclassified (SBU) level Information Systems are in place and are followed. This includes ensuring that appropriate steps are taken to implement information security requirements for IT systems throughout their life cycle, from the requirements definition phase through disposal.

The Contractor shall develop and maintain in-depth service delivery methods that assign an ISSO and alternate ISSO to each Information System as assigned and provide capability to rapidly scale support on demand to meet emergent mission needs, for contractor identified ISSO supported systems. The Contractor shall maximize the use of existing resources (such as personnel, training, vulnerability detection tools, vendor system support, etc.) and the overall team by flexing to address changing system, mission, and priorities and alternate backup coverage to ensure that each TSA system has the necessary support to achieve FISMA compliance with on time quality submissions.

The Contractor shall support Privileged Account Audits and assist with external/internal audits for designated systems, inquiries and data calls. Support continuous monitoring through review of audit logs, using software tools (e.g. Splunk) and also manually. Ensure that new ISSO FISMA system assignments are staffed and that introduction/ system kickoffs happen within 10 business days of funding.

Ensure all FISMA compliance activities with NIST and RMF quality gates document submissions are completed on time, to support scheduled ATO and Ongoing Authorization (OA) scheduled reviews; in compliance with DHS and TSA defined policies and established procedures;

The Contractor shall conduct effective transition activities at the beginning and end of the Enterprise ISSO Program Services BPA to quickly ramp up staff, allow time for TSA’s vetting process, facilitate a smooth transition from the exiting ISSO contractor to the new ISSO contractor and ISSOs, maintain continuity, on time quality submissions, ensure no gaps in coverage, and minimize transition costs. This includes completing and submitting the personnel paperwork to the Contracting Officer’s Representative (COR) within the established and appropriate timeframe.

The Contractor shall conduct analysis, create strategies, and develop the plans, deliverables, and products needed to successfully transition at the end of contract. For planning purposes, the overall transition period shall not exceed 90 calendar days. An incumbent contractor shall continue all current work in progress until the successor contractor assumes full operational responsibility. The Contractor shall not destroy, delete, or otherwise dispose of any files or data upon expiration or termination of the Enterprise ISSO Program Services contract, without prior permission from the

COR. The Contractor shall fully cooperate with the successor contractor and the Government during transition out so as not to interfere with their work or duties. The Contractor shall fully support all TSA requests for information and data required to ensure a seamless transition of services to a new contractor. The Contractor shall identify all Contractor systems used in delivery of services that store or process TSA data and information. The Contractor shall deliver to the TSA electronic copies of all TSA data and information stored in Contractor’s systems in the format requested by TSA within fifteen (15) business days from the TSA request.

• Objective 2, Enterprise ISSO Program Management Support: The Contractor shall provide effective and efficient management information systems and organizational controls that provide insightful, accurate, and timely information on program status and service performance; and support and establish centralized and standardized methodologies, ISSO processes, procedures, enterprise level reporting, RMF readiness, training, templates, and guidance. The Contractor shall at a minimum:

o Coordinate and conduct periodic performance review meetings with the TSA ISSO Branch Manager, or designee, to review the status and performance of the Enterprise ISSO Program Services BPA and all active orders.

o Provide Enterprise ISSO and System Owner Training Services: Coordinate, facilitate, establish, develop, educate and deliver TSA Enterprise Monthly Security/ISSO Trainings, minimum of Quarterly System Owner Trainings, Ad Hoc Lunch and Learn sessions Maintain the ISSO Knowledge Guide and training repository located on the TSA IAD

ISSO SharePoint Site, by updating the site and documents with real time information and creating new content as required. The topics shall include, but not be limited to, subjects that demonstrate or reinforce the standardized ISSO processes, procedures, Security Technical Implementation Guides (STIGs), cybersecurity tools, templates and changes in support of the RMF, NIST, DHS and TSA policies.

Coordinate with TSA/IT/IAD on the development and implementation of a comprehensive training program that serves to educate the entire TSA cybersecurity workforce across TSA, implement a formal feedback rating program and ensure a positive overall rating, provide technical information sharing support in addition to regular communications and outreach to other ISSOs regarding DHS or TSA information security updates as often as necessary; and maintain current and proficient understanding of TSA’s existing and emerging technologies.

The Contractor shall support IAD's initiative to educate the all Enterprise ISSOs on a monthly basis on FISMA related topics, relevant cybersecurity news, and technical trainings. The Contractor shall support TSA/IT/IAD monthly ISSO training, including coordinating all aspects of ISSO monthly training and briefing all OMB, DHS, TSA, and IAD policy updates. Notifications of critical security topics identified by TSA are currently delivered and provided to TSA ISSOs through emails and monthly scheduled ISSO training. Recent sample topics include TSA Public Key Infrastructure (PKI) Process, Risk Assessment Methodology, DHS FISMA Process and Policy Updates, STIG Training, and How to write Implementation Statements and How to utilize them.

o Provide Enterprise Reporting Support Services:

Conduct Bi-weekly briefings ensuring that all Enterprise TSA ISSOs adhere to standardized ISSO processes and procedures through the utilization of methods that accomplish the following; follow up and report on compliance, schedule meetings, establish milestone dates, and validate quality products through established quality assurance assessment teams:

Provide and maintain dashboard to track activity compliance for all ISSOs and activities across TSA; and

All Data Calls and all established delivery milestone dates from DHS Cybersecurity and Infrastructure Security Agency (CISA), DHS, and TSA have quality submissions and are submitted on time.

Conduct bi-annual System Owner Scorecard reviews and ensure FISMA System Profiles are updated and maintained.

Provide additional Enterprise reporting as needed.

o Provide continuous Enterprise RMF Readiness and Quality Documentation Reviews:

Ensure that all aspects of FISMA documentation (maintained in the TSA system of record Cyber Security Assessments and Management (CSAM) system) meet established quality thresholds for acceptance through the utilization of RMF Review Readiness and Review teams.

All FISMA system documentation must meet established quality standards and be ready to be assessed at all times which includes scheduled: RMF 4 ATO assessments, OA Reviews and other non-TSA audits (e.g. DHS, CISA, Office of Inspector General (OIG) and Chief Financial Officer (CFO) reviews);

Ensure submissions are documented correctly IAW NIST, DHS and TSA Policy;

Ensure results are documented completely and accurately in the mandated DHS

Compliance Tool at the operating system, application and database levels;

Include activities and documentation such as; ensure ISSOs have accurately completed Federal Information Processing Standards (FIPS)-199, Privacy Threshold Analysis (PTA), E-Authorizations, Contingency Plans (CPs), Contingency Plan Tests (CPTs), Security Plans, System control self-assessments and 800.53A test cases; and

Ensure that FISMA systems documentation reflect current system status, technical configurations and process management.

2.3 Overview of Existing TSA Systems

The current TSA Enterprise consists of approximately 115 FISMA information systems with approximately 85 FISMA systems with contractor provided ISSOs. The systems consist of TSA hardware and Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS) cloud solutions. The technologies supported include, but are not limited to; Windows and Linux Operating Systems, Cisco Network Services, and various office automation, database, web development and security tools such as SQL Server, Tenable Security Center, McAfee Endpoint Security and Splunk.

Cloud solutions include Microsoft Office 365, Microsoft Azure, Salesforce, Amazon Web Services (AWS), Service Now, VMware Cloud, McAfee MVISION Cloud, SAP NS2 Cloud and new cloud based services. All cloud solutions are Federal Risk and Authorization Management Program (FedRAMP) authorized. TSA is seeking expertise in these system types and technologies to achieve FISMA compliance for current and future technologies. A defined list of system scenarios which will account for size, scope and complexity will be provided during the solicitation phase.

2.4 Anticipated Program Growth

TSA ISSO support services are dynamic according to the fluctuation of supported TSA systems, based on a level of complexity. The need for ISSO support services and enterprise reporting and training are anticipated to continue to grow an average of 10% per year. . In addition to the ongoing ISSO services, reporting and training support, increased levels of effort for these requirements may be required above and beyond the annual requirement, due to emergencies, national disasters, large-scale projects, cybersecurity threats, TSA Administrator priorities, mandated changes, and generally unexpected circumstances that could require increased services for the overall requirement.

2.5 Applicable Documents

The TSA is an organizational element of DHS and as such relies on the DHS to provide an initial interpretation of federal information security legislation, policies, and mandates through DHS Management Directives (MDs), primarily the 4300 series and other DHS documentation listed below.

While DHS sets baseline policy, TSA policy augments and exceeds DHS requirements to support specific TSA mission needs. Therefore, TSA policy is a conglomerate of the documentation listed below. In cases of conflict, the more stringent policy is the default. The EISB has the authority to de-conflict policy disputes.

The Contractor shall be familiar with and adhere to federal policies, program standards, and guidelines such as, but not limited to, those referenced in the requirements of this SOO. The documents listed below are those which the Contractor shall be expected to utilize during the course of their work for Enterprise ISSO Program Services, and those by which the Contractor’s performance will be assessed.

The Contractor shall use the latest federal policies, program standards, and document versions available.

All NIST Special Publications (SP) and FIPS may be obtained from the NIST website, https://csrc.nist.gov.

The work performed under this task order shall be guided by the context of the following references:

1. NIST SP series;

2. NIST SP 800-37;

3. NIST FIPS Publications;

4. DHS National Security Systems Policy Directive (PD) 4300B;

5. DHS Binding Operational Directives (BODs);

6. DHS Sensitive Systems PD 4300A;

7. DHS 4300A Sensitive Systems Handbook and Attachments;

8. DHS IT Security Architecture Guidance Volumes 1, 2 and 3;

9. DHS/TSA Systems Engineering Lifecycle (SELC);

10. DHS Performance Plan (current fiscal year);

11. DHS Ongoing Authorization Methodology (current version);

12. DHS/TSA Privacy Office documents;

13. ISSO Guide (to the DHS Information Security Program) (current version);

14. System Security Authorization Process Guide;

15. Sensitive Systems Configuration Guidance;

16. Sensitive Security Information (SSI) Program Office Documents;

17. OMB M-10-28, M-14-03, M-16-04, et al.;

18. Cybersecurity Cloud Security Handbook (CCSH);

19. Open Source Software (OSS Guide);

20. TSA MD 1400.3 IT Security (provided by TSA upon request after award);

21. TSA Information Assurance Handbook (provided by TSA upon request after award);

22. TSA IAD Technical Standards (provided by TSA upon request after award);

23. TSA IAD Standard Operating Procedures (SOPs) (provided by TSA upon request after award);

24. TSA and DHS Forms (provided by TSA upon request after award); and

25. TSA IT-level SOPs (provided by TSA upon request after award).

3.0 OTHER APPLICABLE CONDITIONS

3.1 Period of Performance

The period of performance (POP) shall be a one (1) year base period from the date of transition start date, with four (4), 12-month option periods. The total POP if all options are exercised is five (5) years.

Entrance on Duty activities may begin prior to contract transition start date.

Orders may be issued with option periods or varying performance periods, depending on the type and term of the requirement. The POP of any Order may not extend beyond the expiration date of the final exercised option period of the base awarded contract.

Period Start Date End Date

Transition (3 months) 4/4/2024 7/3/2024

Base Year (12 months) 4/4/2024 4/3/2025

Option Year 1 4/4/2025 4/3/2026

Option Year 2 4/4/2026 4/3/2027

Option Year 3 4/4/2027 4/3/2028

Option Year 4 4/4/2028 4/3/2029

3.2 Place of Performance

The primary place of performance shall be a remote site approved by the COR. ISSOs supporting mission critical systems may be required to be on-site in the performance of duties, primarily at the TSA Headquarters location, unless otherwise identified. ISSOs may also be required to be on-site at either of the National Capital Region (NCR) locations, to support mission requirements, ISSO meetings and training, conduct security scans, and meet face to face with stakeholders to coordinate and resolve issues. This may vary depending on the specific needs of the system(s) being supported. The Government site will not have assigned seating for contractors. However, a seat reservation system is available to ensure orderly seating for required attendance at TSA Headquarters.

NCR locations:

1. TSA Headquarters (Primary Location) 6595 Springfield Center Drive Springfield, Virginia 22150 (20598 for packages and paper correspondence)

2. TSA Systems Integration Facility

3701 Post Office Road Arlington, Virginia 22202

3. Freedom Center 13555 EDS Drive Herndon, Virginia 20171

4. Annapolis Junction 132 National Business Parkway Annapolis Junction, Maryland 20701

The Contractor may also be requested to support on-site activities at the following location, under optional CLINs, in addition to the primary NCR locations:

5. Colorado Springs 121 South Tejon Street, Suite 1200 Colorado Springs CO 80903

Currently, none of the systems require Contractor staff to be near Colorado Springs, Colorado or Annapolis Junction, Maryland locations.

3.3 Hours of Work

Hours of work will be Monday through Friday, except Federal holidays, during TSA normal business hours. At a minimum, TSA core hours between 8:30 AM and 4:30 PM Eastern Time (ET) shall be covered. Contractor staff must be readily available via phone, email, video conferencing and/or instant messaging (e.g. Teams) to address Government questions. Contractor personnel are not required to provide 24x7 support.

3.4 Travel

Travel, when required, will be reimbursed IAW the Federal Travel Regulations (FTR), for locations that are greater than fifty (50) miles from where the contractor resource regularly performs the services for this contract. On occasion, a contractor resource may be required to travel to a location more than 50 miles from their regular location. In cases like this, the Government will reimburse the contractor IAW the FTR. Reimbursement for travel will be authorized as a separately priced Other Direct Cost ) line item. All travel must be approved in advance by the Contracting Officer (CO) or COR.

TSA/IT/IAD has multiple contracts supporting the office. In the instance where contractors from various contracts need to take travel together, every effort shall be made on behalf of the contractor to maximize cost efficiencies. The Government will not incur additional expenses as a result of the contractor’s travel policy.

A contractor whose facility or individual work station for remote work is located outside of a 50-mile radius of the NCR, will not be reimbursed for travel to required TSA facilities within the NCR for performance under this contract. TSA will not reimburse any travel costs if a contractor telework space resides outside of the 50-mile radius.

3.5 Government Furnished Equipment (GFE)

The Government will provide computer automation equipment to connect to the TSA network in order to accomplish the required tasks. Under no circumstances shall contractor-company or contractor-personally owned equipment be connected to the TSA computing environment. Additionally, use of company email for official TSA business is prohibited.

The Contractor will be provided access to the following Government resources:

1. The TSA network;

2. Laptop computers;

2.1. New Contractor employees must come to a TSA facility for assigned GFE and they must physically connect their laptop to the TSA network for the first time logon so that it can write their profile locally, and ensure the networked drives are accessible. Many, but not all, airports have TSA support facilities which are off-site from the airport.

3. Flash drives and smart phones, as required.

For on-site contractor personnel if requested under an optional CLIN, the Government will also provide office space and access to copiers, fax machines, office telephones, and supplies appropriate for a standard working environment. First come, first served seating is available, as well as an online reservation system.

All equipment and data provided to the Contractor for the purpose of work performance shall not be used outside of this contract. At the end of the contract, the Contractor and all sub-Contractors shall return all GFE and said data and destroy additional copies of said data files IAW the latest DHS 4300 policy.

3.6 GFE Contractor Accountability

The Contractor shall:

1. Become accountable for GFE when assigned;

2. Perform property administration IAW Federal Acquisition Regulation (FAR) Part 45; and

3. Prepare and submit to the COR an annual Report of Government Property as directed by the COR.

4.0 SECURITY

4.1 Facility and Personnel Clearance

Contractor personnel will be required to obtain a Personal Identity Verification (PIV) badge upon successful adjudication of the background clearance. The PIV badge is a TSA requirement and required for logical and physical access to TSA facilities and network.

All Contractor personnel supporting ISSO Services for TSA Systems and ISSO Enterprise Centralized Management Support must have at least a Secret or Interim Secret security clearance. Contractor personnel that only provide ISSO and System Owner Enterprise Training Services are not required to have a Secret clearance but must hold or obtain a Public Trust clearance. All Contractor on-site personnel must hold a security clearance that is IAW the level specified in this SOO.

The Contractor will access classified material at the following TSA facilities:

1. TSA Headquarters

6595 Springfield Center Drive Springfield, Virginia 22150

2. Freedom Center 13555 EDS Drive Herndon, Virginia 20171

5.0 PERSONNEL SKILL REQUIREMENTS

The Contractor shall maintain an ISSO and support workforce that is technically proficient and capable of rapidly addressing changing system, mission, and priorities and while ensuring that each TSA system has the necessary support to achieve FISMA compliance deadlines. Personnel supporting ISSO Support Services must satisfy the requirements specific to each Task and Sub-Task they are supporting, adhering to the TSA NIST RMF process and the processes specified in the referenced clauses and attachments.

Per the Attachment A, TSA ISSO Designation Letter, each assigned ISSO must provide a resume for Government approval. As the POP continues, new technical certifications may be created by industry and/or cybersecurity standards that can meet or exceed the minimum thresholds of those on the list below. The Contractor may request these new certifications to be added to the list with approval by the government.

5.1 Key Personnel

1. Program Manager: The Contractor shall provide a designated Program Manager to oversee all services provided under the Enterprise ISSO Program Services contract. The Program Manager shall be responsible for the management, administration, technical correctness, timeliness, and quality of services and products provided under this contract. The Program Manager shall be responsible for providing and managing the human resources necessary to perform the required activities.

The minimum qualification requirements for this position are described below:

1.1. A minimum of 15 years of IT cybersecurity management experience including 3 years of direct support for the US Government OR a relevant Master's Degree in IT, computer science, business or engineering and 10+ years' of IT cybersecurity management experience including 3 years of direct support for the US Government;

1.2. At least one of the following security certifications: Certified Authorization Professional (CAP), Certified Information Systems Security Officer (CISSO), Certified Information Security Manager (CISM), or Certified Information Systems Security Professional (CISSP);

1.3. At least one of the following project management certifications is desirable: Project Management certification from Project Management Institute (PMI) Project Management Professional (PMP), Defense Acquisition Workforce Improvement Act (DAWIA) P/PM certification Level III, or Federal Acquisition Certification (FAC) - P/PM certification Level II;

1.4. Experience communicating effectively, both oral and written, with technical, non-technical, and executive-level customers; and

1.5. Understanding and experience with Agile principles, processes and methodologies.

2. Training Lead: The Contractor shall provide a designated Training Lead with the following qualifications:

2.1. A minimum of 10 years of experience in training development and delivery OR a relevant Master's Degree in IT, Computer Science, Instructional Design or Education and 8 years' of experience in training development and delivery;

2.2. Prior experience developing Security related training and instructor-led and online training, videos, and job aids;

2.3. Experience delivering face to face and virtual training to a wide variety of audiences;

2.4. Experience with PowerPoint, visual representation, and instructional design skills and understanding of 508 compliance requirements; and

2.5. Experience communicating effectively, both oral and written, with technical, non-technical, and executive-level customers.

3. ISSO Team Leads: The Contractor shall provide a designated ISSO and or Quality Review Team

Leads that meet the following qualifications:

3.1. A minimum of 10 years of IT cybersecurity experience including direct support for the US Government and 7 years acting as an ISSO, assessor, or compliance analyst for enterprise IT systems OR a relevant Master's Degree in IT, Computer Science, or Engineering and 7 years' of IT cybersecurity experience including direct support for the US Government and 5 years acting as an ISSO, assessor, or compliance analyst;

3.2. At least two of the following security certifications: CAP, CISSO, CISM, or CISSP;

3.3. Knowledge of NIST Guidelines and FISMA Cybersecurity compliance requirements;

3.4. Technical knowledge of complex enterprise IT systems;

3.5. Knowledge of and experience using relevant cybersecurity and analysis tools such as Archer, Nessus Security Center, Splunk, etc.; and

3.6. Experience communicating effectively, both oral and written, with technical, non-technical, and executive-level customers.

5.2 Minimum Qualifications for all other Personnel

All other contractor personnel supporting task areas 2-5 must meet the following minimum qualifications:

1. A minimum of 7 years of IT cybersecurity experience including direct support for the US Government and 4 years acting as an ISSO, assessor, or compliance analyst OR a relevant Bachelor's Degree in IT, Computer Science or Engineering and 5 years' of IT cybersecurity experience including direct support for the US Government and 4 years acting as an ISSO, assessor, or compliance analyst;

2. At least one of the following security certifications: CAP, CISSO, CISM, or CISSP;

3. Knowledge of NIST Guidelines and FISMA Cybersecurity compliance requirements;

4. Technical knowledge of IT systems;

5. Knowledge of and experience using relevant cybersecurity and analysis tools such as Archer, Nessus

Security Center, Splunk, etc.; and

6. Experience communicating effectively, both oral and written, with technical, non-technical, and executive-level customers.

5.3 Key and non-Key Personnel Qualifications

All Enterprise ISSO Programs Services Contractor support personnel must demonstrate all qualifications and skill requirements in the section below. The Contractor shall ensure the maintenance of personnel skillsets throughout the life of the contract.

1. Qualified IAW Section 5.0 Personnel Skill Requirements and the performance specifications in Attachment A, TSA ISSO Designation Letter;

2. Knowledgeable of the TSA RMF and A&A functions within 21 days of acceptance into the program (receipt of PIV);

3. Maintain proficiency in the security products and technologies used in delivering or supporting security services;

4. Have received, and remain current with, all TSA required security training;

5. Are proficient in the TSA products and technologies on which they are responsible for providing deliverables to the TSA;

6. Are trained in Risk Management process and procedure; and

7. Maintain current and proficient understanding of TSA’s existing and emerging technologies.

6.0 GOVERNMENT INSPECTION AND ACCEPTANCE

The Contractor shall be responsible for implementing and delivering performance that meets contract standards using its Quality Control Plan (QCP). Government acceptance of Contractor performance will be based on meeting or exceeding deliverable requirements, performance measurements, timelines, and conformance to the requirements of this contract. Successful performance must demonstrate understanding and compliance with all mandated Federal policy (ref. Applicable Documents).

6.1 Government Review/Inspection, Acceptance and Rejection Process

1. All time frames shall be in ‘calendar’ days, unless specifically annotated otherwise;

2. The Contractor shall ensure all deliverables are uploaded to the designated electronic depository in addition to notification of delivery being emailed to COR and EISB Branch Manager or designee;

3. All initial deliverable submissions shall be vetted through the stated review cycle until final

Government approval or acceptance, or rejection. The Government reserves the right to discontinue return for correction attempts to produce an acceptable deliverable, if continued review cycles have produced continued deficiencies and it is in the Government’s best interest (mission and personnel impact and schedule):

3.1. TSA will review each initial deliverable within fifteen (15) days from receipt and provide feedback to the Contractor. Feedback is referred to as “Return for Correction”;

3.2. The Contractor shall satisfactorily address the TSA review comments and update the deliverable within seven (7) days from receipt and provide the information to the COR. The Government reserves the right to limit the number of instances per deliverable, that are returned for correction;

3.3. At this point, TSA will either accept and approve the deliverable or reject the deliverable. Non-conforming deliverables and services will be rejected. Unless otherwise agreed by the parties, deficiencies will then be corrected within thirty (30) days of the rejection notice unless a different correction period is agreed to by both parties. If the deficiencies cannot be corrected within the 30 days, the Contractor will immediately notify the CO and COR of the reason for the delay and provide a proposed corrective action plan within ten (10) business days. The rejection notice may indicate an expedited correction timeframe if a standard 30-day response time will harm the overall mission. Reports, documents and narrative type deliverables will be accepted when all discrepancies, errors or other deficiencies identified in writing by the Government have been corrected.

3.3.1. Deliverables shall be at a level of accuracy that does not require “return for correction” for typographical and grammatical errors. Reports, documents and narrative type deliverables will be accepted when all discrepancies, errors or other deficiencies identified have been corrected by the Contractor. Repetitive requests for correction by the Government may result in a determination of failing to meet the basic standards for professional writing, reporting, accuracy, quality and completeness of the contractual requirements for deliverables.

3.4. The COR or EISB Branch Manager will review, for completeness, preliminary or draft products that the Contractor submits, and may return them to the Contractor for correction. Absence of comments by the COR or EISB Branch Manager will not relieve the Contractor of the responsibility for complying with the requirements of the Enterprise ISSO Program Services contract. Final approval and acceptance of deliverable products required herein shall be by letter of approval and acceptance by the COR. The Contractor shall not construe any letter of acknowledgment of receipt of deliverable products as a waiver of review, or as an acknowledgment that a deliverable product is in conformance with the requirements. Any approval given during preparation of a deliverable shall not guarantee the final acceptance of the completed deliverable.

7.0 DELIVERABLES

The Contractor shall establish key deliverables and schedules as part of the initial Program/Project Implementation and Management Plan, according to TSA policy, the requirements in this SOO and all technical references and attachments. The Contractor shall prepare and submit each deliverable in a format mutually agreed upon with the COR and EISB Branch Manager or designee. Deliverables shall be uploaded to an electronic depository (i.e. SharePoint), with Contractor notification of delivery emailed to the COR and EISB Branch Manager or designee. Specific instructions for this process will be provided after award. This table is the anticipated schedule developed by the Government.

8.0 APPLICABLE REGULATIONS, DIRECTIVES, STANDARDS, AND POLICIES

8.1 Accessibility Requirements (Section 508)

TBD

8.2 Cybersecurity Policy for TSA Government Acquisitions

TBD

8.3 DHS and TSA Enterprise Architecture

TBD

8.4 TSA-Requirements; Security Requirements for Handling Personally Identifiable Information and Privacy Incident Response

TBD

8.5 Supply Chain Risk Management (C-SCRM) SOO Language

TBD

9.0 ATTACHMENTS

9.1 Attachment A: TSA ISSO Designation Letter

9.2 Attachment B: Abbreviations and Acronyms

Abbreviations and Acronyms A&A Assessment and Authorization ADD Applications Development Division ATO Authority to Operate AWS Amazon Web Services BOD Binding Operational Directives CAP Certified Authorization Professional CCSH Cybersecurity Cloud Security Handbook CDM Continuous Diagnostic and Mitigation CFO Chief Financial Officer CISA Cybersecurity and Infrastructure Security Agency CISM Certified Information Security Manager CISO Chief Information Security Officer CISSO Certified Information Systems Security Officer CISSP Certified Information Systems Security Professional CLIN Contract Line Item Number CO Contracting Officer COR Contracting Officer’s Representative CP Contingency Plan CPT Contingency Plan Tests DAWIA Defense Acquisition Workforce Improvement Act DHS Department of Homeland Security EISB Enterprise ISSO Services Branch EO Executive Order ET Eastern Time FAC Federal Acquisition Certification FAR Federal Acquisition Regulation FedRAMP Federal Risk and Authorization Management Program FIPS Federal Information Processing Standards FISMA Federal Information Security Modernization Act FTR Federal Travel Regulations GFE Government Furnished Equipment IaaS Infrastructure as a Service

Abbreviations and Acronyms IAD Information Assurance and Cybersecurity Division IAW in accordance with ISSO Information System Security Officer IT Information Technology MD Management Directive NCR National Capital Region NIST National Institute of Standards and Technology OA Ongoing Authorization ODC Other Direct Cost OED Operations and Engineering Division OIG Office of Inspector General OMB Office of Management and Budget OSS Open Source Software PaaS Platform as a Service PD Policy Directive PIV Personal Identity Verification PKI Public Key Infrastructure PMI Project Management Institute PMP Project Management Professional POP period of performance PTA Privacy Threshold Analysis QCP Quality Control Plan RMF Risk Management Framework SaaS Software as a Service SBU Sensitive But Unclassified SELC Systems Engineering Lifecycle SOO Statement of Objectives SOP Standard Operating Procedure SP Special Publications SSI Sensitive Security Information STIGs Security Technical Implementation Guides TSA Transportation Security Administration

End of Statement of Objectives