70T05018Q9NCOM014_RFQ_OPA18_Media_Monitoring_Subscription_Services.pdf

COMBINED SYNOPSIS/SOLICITATION FOR COMMERCIAL ITEMS

General Information

Document Type: Combined Solicitation/Synopsis

Solicitation Number: 70T05018Q9NCOM014

Posted Date: 09/10/2018

Original Response Date: 09/12/2018

Current Response Date:

Product or Service Code: D307

Set Aside: Total Small Business

NAICS Code: 519130 Internet Publishing and Broadcasting and Web Search Portals

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in

Federal Acquisition Regulation (FAR) subpart 12.6 “Streamlined Procedures for Evaluation and Solicitation for

Commercial Items” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; “quotations” are being requested, and a written solicitation will not be issued.

This solicitation is a "Request for Quotations (RFQ)." The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-100.This RFQ has been set-aside for small businesses (100%). The associated North American Industrial Classification System (NAICS) code for this procurement is 519130, with a small business size standard of 500 employees.

The Transportation Security Administration (TSA), Office of Strategic Communications and Public Affairs

(OSCPA) is seeking to purchase procure web-based media monitoring system subscription in accordance with

Section II – Statement of Work.

The Transportation Security Administration intends to award a Firm Fixed Price (FFP) Order to the Quoter who offers the Lowest Price Technically Acceptable (LPTA) Quote. The Quoter (manufacturers or authorized resellers) shall propose all items described in the Pricing Schedule in Section I and Section II – Statement of

Work.

LOWEST PRICE TECHNICALLY ACCEPTABLE (LPTA):

(LPTA) is defined as the lowest price quote that has met all of the technical requirements and is deemed technically acceptable.

BASIS OF AWARD: The award will be made to the lowest price, responsible quoter whose quote meets the technical requirements of the solicitation. The following factors shall be used to evaluate technical acceptability:

Technical Capabilities

Quotes with pricing greater than the lowest price will only be evaluated if the lowest quote fails to meet the technical requirement outlined in this combined synopsis/solicition. If this happens, the next lowest quote will be evaluated for technical acceptability. The Government intends to award without discussions, but reserves the right to enter into discussions.

REQUEST FOR QUOTE: 70T05018Q9NCOM014

All questions related to the RFQ shall be submitted no later than 9/10/2018 by 12:00 pm EST. Please submit all questions to Kia Green, Contract Specialist at kia.green@tsa.dhs.gov and Lisa Hendrick, Contracting Officer at lisa.hendrick@tsa.dhs.gov.

All responses to the RFQ shall be submitted no later than 9/12/2018 by 2:00 pm EST. Please submit all questions to Kia Green, Contract Specialist at kia.green@tsa.dhs.gov and Lisa Hendrick, Contracting Officer at lisa.hendrick@tsa.dhs.gov.

All communication related to the RFQ shall be submitted to the Contract Specialist/Contracting Officer.

Please feel free to contact Kia Green, Contract Specialist via email or by phone @ kia.green@tsa.dhs.gov - 571-

227-2759 or Lisa Hendrick, Contracting Officer via email or by phone @ lisa.hendrick@tsa.dhs.gov-571-227-

4305 if you should have any questions related to the reference correspondence.

Lisa Hendrick

Contracting Officer mailto:kia.green@tsa.dhs.gov mailto:guy.galloway@tsa.dhs.gov mailto:kia.green@tsa.dhs.gov mailto:lisa.hendrick@tsa.dhs.gov mailto:lisa.hendrick@tsa.dhs.gov

SECTION I – PRICING SCHEDULE

CLIN No. Item

Qty Unit Cost Per

Month

Total

00001 Five (5) Subscriptions

Base Period – 12 months

Web-based media monitoring system subscription

12 Month

01001 Five (5) Subscriptions

Option Period 1 – 12 months

Web-based media monitoring system subscription

12 Month

01002 Five (5) Subscriptions

Option Period 2 – 12 months

Web-based media monitoring system subscription

12 Month

Total

Value

All proposed prices shall be firm fixed price (FFP).

THE REMAINDER OF THIS PAGE IS INTENTALLY LEFT BLANK

SECTION II: STATEMENT OF WORK

SECTION II: STATEMENT OF WORK

OPA requires a subscription to a web-based system that will enable OPA to search, monitor, measure and track editorial content across multiple media applications as well as input customized data for each TSA designated media region, and provide metrics based on input by individual region and individual field representatives. This tool will enable OPA to remain strategic, proactive and reactive to media inquiries and issues/stories reported by media outlets.

System Requirements for the web-based media monitoring system shall:

1. Be a fully hosted web-based system.

2. Be accessible via multiple browsers, including, but not limited to, Firefox, Chrome, Safari, and Internet

Explorer.

3. Provide an integrated mobile app for iOS/Android devices, and/or be mobile compliant, which enables users to access their account on their mobile phone and to have any changes made on the app to be reflected on the web system/subscription.

Background

The Transportation Security Administration (TSA) needs to reach a variety of critical audiences with its news and information products to asses and report on the reach, outcomes and return on investment for its news and information dissemination efforts. The Office of Public Affairs (OPA) requires a subscription to a web-based media monitoring services to be able to monitor daily news clippings in online and print formats, as well as have the capability to input and track media relations activities.

The web-based media monitoring system subscription will assist OPA in fulfilling its responsibilities of monitoring communications performances and metrics.

Technical Requirements

The contractor shall provide a subscription for five (5) users to a web-based system that offers the following capabilities:

1. Online News Monitoring and Tracking. The web-based system subscription shall:

a) include access to unlimited news clips from print, television, radio and online sources, including editorial content and news clips that are “hidden” by subscriber-only access. The contractor shall allow full access to users to its online news and social media monitoring system and/or subscription so that users can perform their own searches;

b) include unlimited key word searches, clips and the ability to custom design a distribution template;

c) include the ability to set the timeframe for desired editorial results for each search;

d) include the ability for recipients to subscribe/unsubscribe to receive the news clips report via email;

e) include the option to remove specific coverage reports and erroneous reporting;

f) provide access to an unlimited archived library of selected online and print stories at no additional cost; and

g) provide media coverage for all U.S. media markets and major international media markets (outlets such as BBC World News, CNN, CNBC, etc., that cover news stories outside of the U.S.)

2. Input and Tracking of Media Activities. The web-based system subscription shall:

a) include ability for users to manually enter and track media inquiries based on region, field representative (user) and topic;

b) provide all users the ability to add, edit or delete keywords at any point during the subscription;

c) include the ability to build reports for TSA field representatives, categorized by regions, based on

TSA trends, topics and specific categories; and

d) include the ability to generate metrics reports for media inquiries received and entered in the system by field representative/user and region.

3. Journalist Contact Database. The web-based system subscription shall:

a) Include the capability to maintain an up-to-date list of reporters/correspondents with profiles and contact information; and

b) Include the capability to look up journalist by name, news organization or media outlet.

4. News Clippings:

a) The program must collect TSA related news stories using our designated search terms. The stories must be put into our account by 5:30 a.m. daily so that a TSA employee can search the stories to produce a morning clips report.

b) System must be able to provide radio clips and transcripts from national and local radio and broadcast newscasts.

c) System must have the option to search for Spanish language clips in print, radio and online sources.

5. Distribution:

a) System shall have the option for wire distribution of press releases to national and local media outlets.

6. Other requirements:

a) Must have system support available online as well as telephone support 24/7 (The numerals stand for

"24 hours a day, 7 days a week".)

b) The system and/or subscription must include accessibility to provide training via- in person at no additional cost to the Government online, or by video teleconferencing on new features and services that could improve TSA’s productivity.

a. Training shall include how to use the system(s) and overall functionality. The contractor shall provide links and instructions on how to access online training.

b. If vendor propose the option of in-person training, training will take place at TSA headquarters, 601 12th Street, South, Arlington, VA at no cost to the government.

c) The system must have central login capability for up to five (5) concurrent users.

d) The system must include the ability to transition legacy data (archived library) to a new contractor at the end of the contract period.

Deliverables

# Deliverable Due Date

Deliverable Recipient

(include contact information) Deliverable Format

Reference (specify

Contract Data

Requirements List

(CDRL),

attachments, etc.)

1 Kick-off meeting Within five (5) business days after award

Kia Green, kia.green@tsa.dhs.gov

Karla Rinard

Karla.Rinard@tsa.dhs.gov

In person, or Virtual

Teleconference

(VTC)

2 User Account

Setup

Within five (5) business days after kick-off meeting

Email Confirmation

3 Training Within five (5) business days after user account setup

Computer-Based

Training or In person

4 Technical Support

Within five days after kick-off karla.rinard@tsa.dhs.gov online (e.g. Live

Chat Support) and

Telephone

24/7 mailto:Karla.Rinard@tsa.dhs.gov mailto:Karla.Rinard@tsa.dhs.gov mailto:karla.rinard@tsa.dhs.gov

Performance/ Delivery Period:

The period of performance shall consist of one (1) 12-month base period beginning from the effective date of award with an additional two (2) 12-month option periods, for a total of three years.

Place/ Location of Performance/ Delivery:

TSA headquarters, 601 12th Street, South, Arlington, VA

Travel Requirements:

No travel requirements. If vendor elects to attend the kick-off meeting or conduct in-person training at TSA’s facilities in Arlington, VA it is at its own expense.

Special Requirements: If only applicable:

All services, hardware and/or software provided under this task order must be compliant with DHS Information

Technology Security Policy and TSA IT Security Policy:

DHS Sensitive Systems Policy Directive 4300A

DHS 4300A Sensitive Systems Handbook

DHS 4300A Attachment G – Rules of Behavior

Access to TSA IT security policy documents is available via reading room and/or special request to the

Contracting Officer.

Government Furnished Resources and Information

The TSA will not provide Government Furnished Equipment (GFE) to the contractor.

Section 508- Accessibility Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology

(EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

Section 508 Applicable EIT Accessibility Standards

36 CFR 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and

COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within

36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/publication/4300a-sensitive-systems-policy https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook https://www.dhs.gov/publication/dhs-4300a-handbook-attachment-g-rules-behavior

Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous

JavaScript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method.

All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required 1194.31 Functional Performance

Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet

Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Section 508 Applicable Exceptions

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply: 36 CFR

1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

Section 508 Compliance Requirements

36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

SECTION IX: If applicable: TSA Security IT Requirements

Information Assurance Requirements for TSA Government Acquisitions (April 2016)

General Security Requirements

A.1. The Contractor shall comply with all Federal, Department of Homeland Security (DHS) and

Transportation Security Administration (TSA) security and privacy guidelines in effect at the time of the award of the contract, as well as those requirements that may be discretely added during the contract.

A.2. The Contractor shall perform periodic reviews to ensure compliance with all information security and privacy requirements.

A.3. The Contractor shall comply with all DHS and TSA security controls to ensure that the Government's security requirements are met. These controls are described in DHS PD 4300A and TSA MD 1400 series security policy documents and are based on the current National Institute of Standards and Technology (NIST) Special

Publication (SP) 800-53 standards.

A.4. The Contractor shall include this guidance in all subcontracts at any tier where the subcontractor is performing the work defined in this statement of work (SOW).

A.5. The Contractor shall ensure all staff have the required level of security clearance commensurate with the sensitivity of the information being accessed, stored, processed, transmitted or otherwise handled by the System or required to perform the work stipulated by the contract. At a minimum, all Contractor staff shall be subjected to a Public Trust background check and be granted a Public Trust clearance before access to the System or other

TSA resources is granted.

A.6. The Contractor shall sign a DHS Non-Disclosure Agreement (NDA) within (30) calendar days of the contract start date.

A.7. The Contractor shall not release, publish, or disclose agency information to unauthorized personnel, and shall protect such information in accordance with the provisions of the pertinent laws and regulations governing the confidentiality of sensitive information.

A.8. The Contractor shall ensure that its staff follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract.

Personnel shall be responsible for the physical security of their area and government furnished equipment (GFE) issued to the contractor under the terms of the contract.

A.9. The Contractor shall make all system information and documentation produced in support of the contract available to TSA upon request.

Training Requirements

B.1. All Contractor employees, requiring system access, shall receive initial Organizational Security

Fundamentals Training within 60 days of assignment to the contract via the Online Learning Center (OLC).

Refresher training shall be completed annually thereafter.

B.2. The Contractor shall complete annual online training for Organizational Security Fundamentals and TSA

Privacy training.

https://team.ishare.tsa.dhs.gov/sites/OTWE3/OLC/OLC%20Home%20Page.aspx

B.3. Role Based training is required for contract employees with Significant Security Responsibility (SSR), whose job proficiency is required for overall network security within TSA, and shall be in accordance with DHS and TSA policy. The contractor will be notified if they have a position with significant security responsibility.

B.4. Individuals with SSR shall have a documented individual training and education plan, which shall ensure currency with position skills requirements, with the first course to be accomplished within 90 days of employment or change of position. The individual training plan shall be refreshed annually or immediately after a change in the individual’s position description requirements.

B.5. Information Security and Privacy training supplied by the Contractor shall meet standards established by

NIST and set forth in DHS and TSA security policy.

B.6. The Contractor shall maintain a list of all employees who have completed training and shall submit this list to the contracting officer representative (COR) upon request, or during DHS/TSA onsite validation visits performed on a periodic basis.

B.7. The contractor shall its employees review and sign the TSA Form 1403 Computer and Wireless Mobile

Device Access Agreement (CAA) prior to accessing IT systems.

Configuration Management (hardware/software)

C.1. Hardware or software configuration changes shall be in accordance with the DHS Information Security

Performance Plan (current year and any updates thereafter), the DHS Continuous Diagnostics and Mitigation

(CDM) Program to include dashboard reporting requirements and TSA’s Configuration Management policy. The

TSA Chief Information Security Officer (CISO)/Information Assurance and Cyber Security Division (IAD) shall be informed of and involved in all configuration changes to the TSA IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The TSA IAD POC shall approve any request for change prior to any development activity occurring for that change and shall define the security requirements for the requested change. The COR will provide access to the DHS Information Security

Performance Plan.

C.2. The Contractor shall ensure all application or configuration patches and/or Requests for Change (RFC) have approval by the Technical Discussion Forum (TDF), Systems Configuration Control Board (SCCB) and lab regression testing prior to controlled change release under the security policy document, TSA Management

Directive (MD) 1400.3 Information Technology Security and TSA Information Assurance (IA) Handbook, unless immediate risk requires immediate intervention. Approval for immediate intervention (emergency change) requires approval of the TSA CISO, SCCB co-chairs, and the appropriate Operations Manager, at a minimum.

C.3. The Contractor shall ensure all sites impacted by patching are compliant within 14 days of change approval and release.

C.4. The acquisition of commercial-off-the-shelf (COTS) Information Assurance (IA) and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting “sensitive information”) shall be limited to those products that have been evaluated and validated, as appropriate, in accordance with the following:

The NIST FIPS validation program.

The National Security Agency (NSA)/NIST, National Information Assurance Partnership (NIAP)

Evaluation and Validation Program.

The International Common Criteria for Information Security Technology Evaluation Mutual

Recognition Agreement.

C.5. US Government Configuration Baseline and DHS Configuration Guidance

a) The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the US Government Configuration Baseline (USGCB) and in accordance with DHS and TSA guidance.

1. USGCB Guidelines:

a. http://usgcb.nist.gov/usgcb_content.html

2. DHS Sensitive Systems Configuration Guidance

a. http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Pages/sscg.aspx

b) The standard installation, operation, maintenance, updates and/or patching of software shall not alter the configuration settings from the approved USGCB configuration. The information technology shall also use the Windows Installer Service for installation to the default “program files” directory and shall be able to discretely install and uninstall.

c) Applications designed for general end users shall run in the general user context without elevated system administration privileges.

C.6. The Contractor shall establish processes and procedures for continuous monitoring of Contractor systems that contain TSA data/information by ensuring all such devices are monitored by, and report to, the TSA Security

Operations Center (SOC). The Contractor shall perform monthly security scans on servers that contain TSA data, and shall send monthly scan results to the TSA IAD.

Risk Management Framework

D.1. The Security Authorization and Ongoing Authorization Process in accordance with NIST SP 800-37 and

SP 800-137 (current versions) is a requirement for all TSA IT systems, including General Support Systems (e.g., standard TSA desktop, general network infrastructure, electronic mail), major applications and development systems (if connected to the operational network or processing, storing, or transmitting government data). These processes are documented in the NIST Risk Management Framework (RMF). Ongoing Authorization is part of

Step 6 “Monitoring” of the RMF. All NIST guidance is publicly available; TSA and DHS security policy is disclosed upon contract award with some exceptions, which are public facing (i.e., DHS Security and Training

Requirements for Contractors).

D.2. A written Authorization to Operate (ATO) granted by the TSA Authorizing Official (AO) also known as

TSA Chief Information Security Officer (CISO) is required prior to processing operational data or connecting to any TSA network. The contractor shall provide all necessary system information for the security authorization effort.

D.3. TSA shall assign a security category to each IT system compliant with the requirements of Federal

Information Processing Standards (FIPS) Pub 199 Standards for Security Categorization of Federal Information and Information Systems impact levels and assign security controls to those systems consistent with FIPS Pub

200 Minimum Security Requirements for Federal Information and Information Systems methodology.

D.4. Unless the AO specifically states otherwise for an individual system, the duration of any Accreditation shall be dependent on the FIPS 199 rating and overall residual risk of the system; the length can span up to 36 months.

http://usgcb.nist.gov/usgcb_content.html http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Pages/sscg.aspx https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors

D.5. The Security Authorization (SA)Package contains documentation required for Security Authorizations and Ongoing Authorization. The package shall contain the following security documentation: 1) Security

Assessment Report (SAR), 2) Security Plan (SP) or System Security Authorization Agreement (SSAA), 3)

Contingency Plan, 4) Contingency Plan Test Results, 5) Federal Information Processing Standards (FIPS) 199

Security Categorization, 6) Privacy Threshold Analysis (PTA), 7) E-Authentication, 8) Security Assessment Plan

(SAP), 9) Authorization to Operate (ATO) Letter, 10) Plan of Action and Milestones (POA&M), and 11)

Ongoing Authorization Artifacts as required by the DHS Ongoing Authorization Methodology (current version).

The SA package shall document the specific procedures, training, and accountability measures in place for systems that process personally identifiable information (PII). All security compliance documents shall be reviewed and approved by the CISO and the IAD, and accepted by the CO upon creation and after any subsequent changes, before they go into effect. Ongoing Authorization artifacts include monthly TRigger

Accountability Log (TRAL), monthly operating system scan results, application scans as directed, updated control allocation table (CAT), and associated memos as directed. All steps in the DHS Information Assurance

Compliance Systems (IACS) shall be completed correctly, thoroughly and in a timely manner for all steps of the

RMF.

D.6. The contractor shall support the successful remediation of all identified system weaknesses and vulnerabilities that are identified as a result of the aforementioned security review process.

D.7. The contractor shall submit and analyze monthly operating system vulnerability scans for the DHS

Information Security Performance Plan FISMA Scorecard. Vulnerabilities not remediated are generated into

Plan of Action and Milestone (POA&M)s after 30 days.

Contingency Planning

E.1. The Contractor shall develop and maintain a Contingency Plan (CP), to include a Continuity of Operation

Plan (COOP), to address circumstances whereby normal operations may be disrupted and thus require activation of the CP and/or COOP. are disrupted. The contractor’s CP/COOP responsibility relates only to the system they provide or operate under contract.

E.2. The Contractor shall ensure that contingency plans are consistent with template provided in the DHS

IACS Tool. If access has not been provided initially, the contractor shall use the DHS 4300A Sensitive System

Handbook, Attachment K IT Contingency Plan Template.

E.3. The Contractor shall identify and train all TSA personnel involved with COOP efforts in the procedures and logistics of the disaster recovery and business continuity plans.

E.4. The Contractor shall ensure the availability of critical resources and facilitate the COOP in an emergency situation.

E.5. The Contractor shall test their CP annually and retain records of the annual CP testing for review during periodic audits.

E.6. The Contractor shall record, track, and correct any CP deficiency; any deficiency correction that cannot be accomplished within one month of the annual test shall be elevated to IAD.

E.7. The Contractor shall ensure the CP addresses emergency response, backup operations, and recovery operations.

E.8. The Contractor shall have an Emergency Response Plan that includes procedures appropriate to fire, flood, civil disorder, disaster, bomb threat, or any other incident or activity that may endanger lives, property, or the capability to perform essential functions.

E.9. The Contractor shall have a Backup Operations Plan that includes procedures and responsibilities to ensure that essential operations can be continued if normal processing or data communications are interrupted for any reason.

E.10. The Contractor shall have a Post-disaster Recovery Plan that includes procedures and responsibilities to facilitate rapid restoration of normal operations at the primary site or, if necessary, at a new facility following the destruction, major damage, or other major interruption at the primary site.

E.11. The Contractor shall ensure all TSA data (e.g., mail, data servers, etc.) is incrementally backed up on a daily basis.

E.12. The Contractor shall ensure a full backup of all network data occurs as required by the system’s availability security categorization impact rating per TSA Information Assurance policy.

E.13. The Contractor shall ensure all network application assets (e.g., application servers, domain controllers, Information Assurance (IA) tools, etc.) shall be incrementally backed up as required to eliminate loss of critical audit data and allow for restoration and resumption of normal operations within one hour.

E.14. The Contractor shall ensure sufficient backup data to facilitate a full operational recovery within one business day at either the prime operational site or the designated alternate site shall be stored at a secondary location determined by the local element disaster recovery plan.

E.15. The Contractor shall ensure that data at the secondary location is current as required by the system’s availability security categorization impact rating.

E.16. The Contractor shall ensure the location of the local backup repository and the secondary backup repository is clearly defined, and access controlled as an Information Security Restricted Area (ISRA).

E.17. The Contractor shall adhere to the DHS IT Security Architecture Guidance Volume 1: Network and

System Infrastructure for the layout of the file systems, or partitions, on a system’s hard disk impacting the security of the data on the resultant system. File system design shall:

Separate generalized data from operating system (OS) files

Compartmentalize differing data types

Restrict dynamic, growing log files or audit trails from crowding other data

E.18. The contractor shall adhere to the DHS IT Security Architecture Guidance Volume 1: Network and

System Infrastructure for the management of mixed data for OS files, user accounts, externally-accesses data files and audit logs.

Program Performance

F.1. The Contractor shall comply with requests to be audited and provide responses within three business days to requests for data, information, and analysis from the TSA IAD and management, as directed by the

Contracting Officer (CO).

F.2. The Contractor shall provide support during the IAD audit activities and efforts. These audit activities shall include, but are not limited to the following: requests for system access for penetration testing, vulnerability scanning, incident response and forensic review.

F.3. Upon completion of monthly security scans, findings shall be documented and categorized as High, Moderate, or Low based on their potential impact to the System IT Security posture. The Contractor shall provide

TSA with estimates of the total engineering service hours required to support the remediation of open POA&M items. High security findings shall be remediated first in 45 days or less; Moderate security findings shall be remediated in 60 days or less, and Low security findings shall be remediated in 90 days or less. The Contractor shall work with the TSA System ISSO and the respective CO and/or Contracting Officer’s Representative

(COR), as well as OIT IAD and the System Owner (as required) to prioritize and plan for the remediation of open

POA&Ms. The TSA System ISSO shall maintain all security artifacts and perform Ongoing Authorization (per

NIST 800-137 and DHS-TSA requirements) and Continuous Diagnostics and Mitigation (CDM) (per OMB M-

14-03) activities to ensure active compliance with security requirements. Specific POA&M guidance and information can be found in the SOP 1401 Plan of Action and Milestone (POA&M) Process, as well as the DHS

4300A PD Attachment H Plan of Action and Milestones (POA&M) Process Guide.

Federal Risk and Authorization Management Program (FedRAMP)

If a vendor is to host a system with a Cloud Service Provider, the following shall apply:

G.1. FedRAMP Requirements: Private sector solutions shall be hosted by a Joint Authorization Board

(JAB)-approved Infrastructure as a Service (IaaS) Cloud Service Provider

(CSP) (http://cloud.cio.gov/fedramp/cloud-systems) and shall follow the Federal Risk and Authorization

Management Program (FedRAMP) requirements. The CSP shall adhere to the following in addition to the

FedRAMP requirements:

Identity and entitlement access management shall be done through Federated Identity;

SSI and PII shall be encrypted in storage and in transit as it is dispersed across the cloud;

Sanitization of all TSA data shall be done as necessary at the IaaS, PaaS or SaaS levels;

Cloud bursting shall not occur;

TSA data shall be logically separated from other cloud tenants;

All system administrators shall be properly cleared and vetted U.S. citizens;

TSA data shall not leave the United States; and

The cloud internet connection shall be behind a commercial Trusted Internet Connection (TIC) that has EINSTEIN 3 Accelerated (E3A) capabilities deployed. These include but are not limited to the analysis of network flow records, detecting and alerting to known or suspected cyber threats, intrusion prevention capabilities and under the direction of DHS detecting and blocking known or suspected cyber threats using indicators. The E3A capability shall use the Domain Name Server Sinkholing capability and email filtering capability allowing scans to occur destined for .gov networks for malicious attachments, Uniform Resource Locators and other forms of malware before being delivered to .gov end-users.

G.2. Private Sector System Requirements: TSA shall conduct audits at any time on private sector systems, and the system shall be entered into the TSA FISMA Inventory as a system of record using the Control

Implementation Summary (CIS) provided by the Cloud Service Provider. Security artifacts shall be created and maintained in the DHS IACS. The private sector systems are required to go through the Security Authorization

Process and the RMF in accordance the Federal Information Systems Management Act (FISMA) and NIST SP http://cloud.cio.gov/fedramp/cloud-systems

800-37 Rev. 1. The cloud internet connection shall be behind a commercial Trusted Internet Connection (TIC) that has E3A deployed. Security event logs and application logs shall be sent to the TSA SOC. Incidents as defined in the TSA Management Directive 1400.3 and its Attachment 1 (TSA IA Handbook) shall be reported to the TSA SPOC 1-800-253-8571. DHS Information Security Vulnerability Management Alerts and Bulletins shall be patched within the required time frames as dictated by DHS and communicated by the contracting officer representative (COR) or contract security point of contact (POC).

Information Assurance Policy

H.1. All services, hardware and/or software provided under this task order shall be compliant with applicable

DHS 4300A Sensitive System Policy Directive, DHS 4300A Sensitive Systems Handbook, TSA MD 1400.3

Information Technology Security, TSA IA Handbook, Technical Standards (TSs) and standard operating procedures (SOPs).

H.2. The contractor solution shall follow all current versions of TSA and DHS policies, procedures, guidelines, and standards, which shall be provided by the Contracting Officer.

H.3. Authorized access and use of TSA IT systems and resources shall be in accordance with the TSA IA

Handbook.

H.4. The contractor shall complete TSA Form 251 and TSA Form 251-1 for sensitive or accountable property. The contractor shall email the completed forms to TSA-Property@dhs.gov and include a hard copy with the shipment.

IData Stored/Processed at Contractor Site

I.1. Unless otherwise directed by TSA, any storage of data shall be contained within the resources allocated by the Contractor to support TSA and may not be on systems that are shared with other commercial or government clients.

Remote Access

J.1. The Contractor remote access connection to TSA networks shall be considered a privileged arrangement for both Contractor and the Government to conduct sanctioned TSA business. Therefore, remote access rights shall be expressly granted, in writing, by the TSA IAD.

J.2. The Contractor employee(s) remote access connection to TSA networks shall be terminated immediately for unauthorized use, at the sole discretion of TSA.

J.3. The Contractor shall use his or her federal issued personal identifiable verification (PIV) badge to access

TSA resources to include IT applications and physical facility.

Interconnection Security Agreement

If the service being supplied requires a connection to a non-DHS, Contractor system, or DHS system of different sensitivity, the following shall apply:

K.1. Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented using an interagency agreements; memoranda of understanding/agreement, service level agreements or interconnection mailto:TSA-Property@dhs.gov service agreements.

K.2. ISAs shall be reissued every three (3) years or whenever any significant changes have been made to any of the interconnected systems.

K.3. ISAs shall be reviewed and updated as needed as a part of the annual FISMA self-assessment.

SBU Data Privacy and Protection

L.1. The contractor shall satisfy requirements to work with and safeguard Sensitive Security Information

(SSI), Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (Sensitive PII).

All support personnel shall understand and rigorously follow DHS and TSA requirements, SSI Policies and

Procedures Handbook, and Privacy policies, and procedures for safeguarding SSI, PII and SPII.

L.2. The Contractor shall be responsible for the security of: i) all data that is generated by the contractor on behalf of the TSA, ii) TSA data transmitted by the contractor, and iii) TSA data otherwise stored or processed by the contractor regardless of who owns or controls the underlying systems while that data is under the contractor’s control. All TSA data, including but not limited to PII, SPII, Sensitive Security Information (SSI), Sensitive But

Unclassified (SBU), and Critical Infrastructure Information (CII), shall be protected according to DHS and TSA security policies and mandates.

L.3. TSA shall identify IT systems transmitting unclassified/SSI information that shall require protection based on a risk assessment. If encryption is required, the following methods are acceptable for encrypting sensitive information:

1. FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2 (current version)

2. National Security Agency (NSA) Type 2 or Type 1 encryption (current version)

3. Public Key Infrastructure (PKI) (see paragraph 5.5.2.1 of the DHS 4300A Sensitive Systems

Handbook), current version

L.4. The contractor shall maintain data control according to the TSA security level of the data. Data separation shall include the use of discretionary access control methods, VPN encryption methods, data aggregation controls, data tagging, media marking, backup actions, and data disaster planning and recovery.

Contractors handling PII shall comply with TSA MD 3700.4, Handling Sensitive Personally Identifiable

Information (current version).

L.5. Users of TSA IT assets shall adhere to all system security requirements to ensure the confidentiality, integrity, availability, and non-repudiation of information under their control. All users accessing TSA IT assets are expected to actively apply the practices specified in the TSA IA Handbook, and applicable IT Security

Technical Standards and SOPs.

L.6. The contractor shall comply with Sensitive Personally Identifiable Information (Sensitive PII) disposition requirements stated in the TSA IA Handbook, applicable Technical Standards, SOPs and TSA MD 3700.4, Handling Sensitive Personally Identifiable Information.

L.7. The Contractor shall ensure that source code is protected from unauthorized access or dissemination (see

TSA IA Handbook).

Disposition of Government Resources

M.1 At the expiration of the contract, the contractor shall return all TSA information and IT resources provided to the contractor during the contract, and provide a certification that all assets containing or used to process TSA information have been sanitized in accordance with the TSA MD 1400.3, TSA IA Handbook, Technical Standards and SOPs. The contractor shall certify in writing that sanitization or destruction has been performed. Sanitization and destruction methods are outlined in the NIST Special Publication 800-88 Guidelines for Media Sanitization, TSA Technical Standard 046 IT Media Sanitization and Disposition, and SOP 1400-503

IT Media Sanitization. The contractor shall email a signed, by the contractor’s designated security officer or senior official, proof of sanitization to the COR. In addition, the contractor shall provide the contracting officer a master asset inventory list that reflects all assets, government furnished equipment (GFE) or authorized non-GFE that were used to process TSA information.

Special Considerations and Circumstances (if applicable and when requested)

N.1 For major agency Information Technology (IT) infrastructure support ranging in the total estimated procurement value (TEPV) of about $100 million or above or per TSA management’s request, the contractor shall provide, implement, and maintain a Security Program Plan (SPP) based on the templates provided by the

TSA IAD. This plan shall describe the processes and procedures that shall be followed to ensure the appropriate security of IT resources are developed, processed, or used under this contract. At a minimum, the contractor’s

SPP shall address the contractor’s compliance with the controls described in NIST SP 800-53 (current version).

The security controls contained in the plan shall meet the requirements listed in the TSA IA Handbook, Technical

Standards and the DHS Sensitive Systems Policy Directive and Handbook 4300A (current versions).

N.2 The SPP shall be a living document. It shall be reviewed and updated semi-annually,beginning on the effective date of the contract, to address new processes, procedures, technical or federally mandated security controls and other contract requirement modifications or additions that affect the security of IT resources under contract.

N.3 The SPP shall be submitted within 30 days after contract award. The SPP shall be consistent with and further details the approach contained in the offeror’s proposal or quote that resulted in the award of this contract and in compliance with the system security requirements.

N.4 The SPP, as submitted to the Contracting Officer, and accepted by the Information Systems Security

Officer (ISSO), shall be incorporated into the contract as a compliance document. The Contractor shall comply with the accepted plan.

Trusted Internet Connection 2.0 Requirements for Managed Trusted Internet Protocol Service

Offering (MTIPS)

O.1 MTIPS providers shall comply with the FedRAMP TIC 2.0 Overlay requirements in addition to the basic requirements outlined in the DHS TIC Reference Architecture v2.0.

ISSO Support

P.1 The contractor Program Manager shall ensure that the contractor ISSO duties and responsibilities align with the Information Assurance and Cyber Security Division, Governance, Risk, and Compliance (GRC) Branch mission and security responsibilities. The TSA CISO is the authorizing official for ISSO designation.

Continuous Diagnostics and Mitigation

Q.1 The Government, through a Continuous Monitoring as a Service (CMaaS) vendor, shall provide the contractor with GFE appliances and tools to support the implementation and maintenance of the Continuous

Diagnostics and Mitigation (CDM) Solution. The tools shall be hosted on the DHS’ Infrastructure as a Service

(IaaS) program. The Government, through the CMaaS vendor, shall provide sensor kits and agents that shall be deployed on all contractor Information Systems supporting the TSA.

Q.2 The contractor shall support the installation (including rack and configuration) of the sensor kits and agents on all TSA contract supported devices and environments per TSA engineering, security, and configuration standards.

Q.3 The contractor shall tune their existing endpoint security products to coexist with the identified products to ensure smooth and cohesive functionalities. Credentials (Service accounts) shall be provided, by the TSA

CISO or designee, for vulnerability scans and host interrogation.

Q.4 The Government, through the CMaaS vendor, shall provide the following support for operations and maintenance of the CDM solution sensor kits:

Patching (Controlled through a CMaaS Windows Server Update Service (WSUS))

Hardware troubleshooting & Risk Management (RMA)

Application maintenance (done from the Government/TSA Management Enclave)

Vulnerability scanning

Q.5 The contractor shall install TSA-provided CDM Solution patches within two (2) days of issuance, or as directed by TSA, and provide evidence of implementation to the TSA Information System Security Officer

(ISSO).

Q.6 The TSA Contracting Owner is authorized to provide technical direction to the contractor for the sole purpose of implementing the CDM Solution. If the technical direction results in any cost incurred by the contractor, for which the contractor shall seek reimbursement from the Government, the contractor shall identify the following information in any cost/price proposal to the Government: name of system owner, summary of the technical direction, date of the technical direction, purpose of the technical direction, summary of actions taken by the contractor, any other information the contracting officer may require to further guide the directed change.

The contactor shall receive approval from the Contracting Officer of the directed change prior to incurring costs associated with the technical direction.

Software Guidance

The Contracting Officer shall provide a listing of all TSA approved security software upon contract award. The approved security software listing is maintained by the Information Assurance Division (IAD).

R.1 In support of the CDM objective to protect high value assets (HVAs) and information, the Government has acquired security tools in order to conduct Indicator of Compromise (IOC) scans within the mandated time frame. The Government shall provide the tool license and/or equipment for installation of tool agents on all TSA supported assets.

R.2 The contractor shall support efforts to allow for the IOC scanning mandate. This may include installation of tool servers and/or agents within each system’s environment and on all TSA supported assets. The

Government shall provide the contractor with the tool server(s) that shall not belong to the contractor’s system boundary. The tool server shall be reachable from OneNet/TSANet over the Internet. The tool server(s) shall be properly configured to reach all assets with the tool agent installed on the network. Credentials (service accounts) shall be provided for IOC scans and tool interrogation.

R.3 The contractor shall support or perform the installation of forensic software servlet agents on supported

Operating Systems on all TSA contract supported devices and environments per TSA engineering, security, and configuration standards. The contractor shall test and upgrade the servlet agents as directed by the IAD.

R.4…