PWS - 31Aug22.docx

PERFORMANCE WORK STATEMENT (PWS)

FOR

M21-31 Logging, Reporting and SSP Development Services

1.0 General:

The Indian Health Service (IHS) must comply with Office of Management and Budget (OMB) M-21-31 and meet and demonstrate adherence to newly established federal mandates. In an effort to address growing concerns about the maturity of cybersecurity practices within the Federal Government, in May of 2021 the White House released Executive Order (EO) 14028, improving the Nation’s Cybersecurity. This EO outlines a set of measures designed to improve the security of Federal networks, assets, and supply chains, to better identify and respond to cybersecurity incidents, and to set easily measurable compliance and effectiveness standards for agency risk management programs. In response to the EO, OMB has developed Memorandum M-21-31, which addresses the EO’s requirements and guides the implementation of logging, log retention, log management, and centralized access and visibility provisions of EO Section 8.

In addition to internal enterprise log management objectives, both EO 14028 and OMB M-21-31 seek to promote accelerated external sharing of threat and incident response information across the Federal Government to facilitate more effective defense of federal information and federal enterprise environments.

OMB 21-31, issued on August 27, 2021, assigns criticality levels to monitoring activities within various categories and sets deadlines for log management compliance in response of recent events, including the SolarWinds incident, to all federal agencies.

This memo underscores the importance of increased government visibility before, during, and after a cybersecurity incident. Information from logs on federal information systems (for both on-premises systems and connections hosted by third parties, such as cloud services providers) is invaluable in detecting, investigating, and remediating cyber threats.

OMB has directed government agencies to prioritize on-premises applications, including in areas like container environments, when implementing security measures to protect critical software. The memo assigns the highest criticality level to logging activities in the following categories:

•System configuration and performance •Email filtering, spam, and phishing •Mainframes •Container events The EO devotes an entire section to security logging, which became a priority issue after the SolarWinds attack, when some in the cybersecurity policy space noted a lack of uniformity in the logging services offered by Microsoft.

OMB M-21-31 mandates a maturity model for event log management. At a high level, the memo prescribes an enterprise logging maturity model with four levels (EL0-EL3) and sets deadlines for achieving each level. Levels become increasingly sophisticated, requiring more data sources, longer retention, and eventually implementing user behavior analytics and security orchestration, automation, and response capabilities.

The IHS will comply with OMB M21-31 by performing the following tasks:

•Developing System Security Plans •Capturing all artifacts •Managing and assisting in maintaining the inventory •Implementing identification and asset tagging •Pushing cybersecurity compliance information to a federally mandated Enterprise Governance, Risk Management and Compliance tool (Archer) needed for logging

This task will complement the current Splunk tool and allow it to use and formalize captured data to provide IHS management the information they need to make risk-based decisions to meet M21-31 objectives. EO 14028 and OMB M-21-31 set forth an aggressive timeline for organizations to achieve and demonstrate compliance with newly established provisions, setting August 2022 as the target for federal agencies. Should these mandates evolve over time, any organization that fails to implement data-driven compliance automation as the foundation of a mature compliance and risk-management program will face additional provisions and reporting obligations that will increase their compliance burden.

This program facilitates automated enterprise-wide compliance with the National Institute of Standards and Technology (NIST) Risk Management Framework’s six-step maturity model, and the recently released NIST Ransomware Framework (as defined in Interagency or Internal Report 8374).

The IHS Division of Information Security is in the process of acquiring a Splunk System-as-a-Service (SaaS) solution. Phase I builds IHS capabilities to meet M21-31 requirements, which will make IHS ready to ingest Agency data into the Splunk SaaS M21-31 package and define converging data points, providing full visibility of IHS Cybersecurity compliance architecture and furnishing IHS management the information it needs to make intelligent timely decisions.

This task consists of the phases below. Phase I is provided for awareness with this requirement consisting of Phase II.

Phase I: (Previous Project separate Project Funding) Migrate Splunk Enterprise to Splunk Acquire and implement Splunk SaaS and implement M21-31 package to meet OMB M21-31 compliance requirements.

Phase II: (This Project) Assemble a work force that uses newly implemented technology to collect information by building System Security Plans and uploading system cybersecurity-compliant information into the Federal Government-provided tool (Archer) and to support the project, which facilitates automated enterprise-wide compliance with the NIST Risk Management Framework’s six-step maturity model and Ransomware Framework.

Implementing IHS security event and incident management will provide IHS with the following benefits:

•Better visibility into data to support intelligent, risk-based decisions.

•Cost savings for the OIT portfolio.

•NIST-compliant maturity levels.

•Centralized access and visibility for the highest-level Agency security operations center.

•Improved log retention and log management

NOTE: All IHS log sources, log retention, and log management policies must support investigation goals and support log information sharing as specified by OMB Memorandum M-21-31

1.1 Scope: The contractor shall provide all personnel, supervision, deliverables, and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to perform SSP development tasks, configuring and maintaining M21-31 Splunk SaaS Package and provide the Splunk User Behavior Analysis dashboard, alerts and reports, and help managing Splunk SaaS operations and enhancements support Services, as defined in this PWS.

1.1.1 The scope of this work falls into two major areas: Splunk and Risk Management Framework. The objectives of the work are meet M21-31 mandates and enhance security posture assisting Health Care Modernization efforts.

1.2 Background: In order to respond to the growing Health Care Services workload; created by Covid-19 pandemic and facilitating the Health Modernization Project while maintaining the security documentation and increased the demand to collect the information of security logs meeting the OMB mandates IHS require the resources to help facilitating the Division Directors and Program Managers to implement the solutions and meet the security guidelines and department and EO mandates. IHS requires number of skilled resources to assist System Owner, Area ISSOs, Audit Response Coordination, Architecture and Engineering, Risk and Compliance, and Cybersecurity Incident Response Teams to orderly respond to growing workload and enhancing security posture.

1.3 Period of Performance (PoP): The Period of Performance shall be one (1) Base Year of 12 months and four (4) 12-month option periods.

1.4 General Information:

1.4.1 Place and Performance of Services: The contractor shall provide services between the hours of 0830 hours to 1700 hours (EST) on Monday through Friday, except on recognized US holidays or when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings. All on-site services performance shall be at 5600 Fishers Lane, Rockville, MD 20850. The contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility/installation is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential. The on-site day to day services include Splunk Security Enterprise Engineering, Information Security Compliance Assurance, and System Security Administration (Active Directory/Linux).

1.4.1.1 Remote Work: Other than the services provided on-site at the location under PWS paragraph 1.4.1, all other services will be at the vendor location.

1.4.1.2 Unscheduled gate closures by the facility security may occur at any time causing all personnel entering or exiting a closed facility to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays.

1.4.1.3 The contractor’s employees shall become familiar with and obey the regulations of Government facilities; including fire, traffic, safety and security regulations while on the facility. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times, and shall be subject to such checks as may be deemed necessary. The contractor shall ensure compliance with all regulations and orders of the facility, which may affect performance. The Government reserves the right to revoke the access to Government systems for any misconduct, security reasons, or violation of agency policies. Removal of contractor employees for reasons stated above does not relieve the Contractor from responsibility for total performance of this contract.

1.4.2 Recognized Holidays: The following are recognized United States (US) holidays. The contractor shall not perform services on these days:

1.4.3.1 New Year’s Day: January 1st

1.4.3.2 Martin Luther King, Jr.’s Birthday

1.4.3.3 President’s Day

1.4.3.4 Memorial Day

1.4.3.5 Independence Day: July 4th

1.4.3.6 Labor Day

1.4.3.7 Juneteenth: June 19th

1.4.3.8 Columbus Day

1.4.3.9 Veteran’s Day: November 11th

1.4.3.10 Thanksgiving Day

1.4.3.11 Christmas Day: December 25th

1.4.3 Quality Control (QC): The contractor shall develop and maintain an effective QC Plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract.

1.4.4 Quality Assurance (QA): The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) or defect rate(s).

1.4.5 Physical Security. The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, equipment and materials shall be secured.

1.4.5.1 Key Control. NOTE: All references to keys include HSPD-12 cards. The contractor shall establish and implement methods of ensuring that no HSPD-12 cards issued by the Government are lost or misplaced or are used by unauthorized persons. No HSPD-12 or any Keys issued by the Government shall be duplicated. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall include procedures covering key control in the QCP.

1.4.5.1.1 The contractor shall immediately report any occurrences of lost or duplicated keys/key cards to the COR.

1.4.5.1.2 In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction by the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the Government replaces or re-keys the locks, the Government will deduct the total cost of lock replacement or re-keying from the monthly payment due the contractor. In the event a master key is lost or duplicated, the Government will replace all locks and keys for that system, and will deduct the total cost from the monthly payment due the contractor.

1.4.5.1.3 The contactor shall prohibit the use of the Government issued keys/HSPD-12 cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contactor employees engaged in the performance of services in those areas, or personnel authorized entrance by the CO.

1.4.6 Contract Manager (CM): The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the CO. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the COR to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the CO. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

1.4.7 The contractor shall retrieve all identification media (including vehicle passes) from its employees who depart employment for any reason. The contractor shall return all identification media (i.e., badges and vehicles passes) to the CO within 14 days of an employee’s departure.

1.4.8. Combating Trafficking in Persons: The United States Government has adopted a zero tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy, the actions that will be taken against employees for violations of this policy. The contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at FAR 22.17.

1.4.9 Contractor Travel

Travel is not currently projected for this requirement. Should travel be needed during the performance of the contract a not-to-exceed (NTE) travel contract line will be added to the contract and funding applied.

1.4.10 Data Rights: The Government has unlimited rights to all documents/materials produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the CO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.4.11 Organizational Conflicts of Interest (OCI): The contractor shall notify the CO immediately should it becomes aware that their work on this requirement may lead to an actual or potential OCI as defined in FAR Subpart 9.5.

1.4.12 Phase Out Periods: To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the contractor shall have personnel on board, during the 30 days phase out periods. During the phase in period, the contractor shall become familiar with performance requirements in order to commence full performance of services on the contract start date. The Contractor recognizes that the services under this contract are vital to the Government and must be continued without interruption and that, upon contract expiration, a successor, either the Government or another contractor, may continue them. The Contractor agrees to (1) furnish phase-in training for the successor to this contract and (2) exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

1.4.13 Post-Award Conference: The contractor shall attend a post-award conference with the Government (virtual) within 15 calendar days of contract award as outlined under FAR Section 42.503.

2.0 Definitions and Acronyms:

2.1 Definitions:

2.1.1 Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2 Defective Service: A service output that does not meet the standard of performance associated with the PWS.

2.1.3 Deliverable: Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

2.1.4 Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.5 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.6 Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.7 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.8 Quality Control: All necessary measures taken by the Contractor to ensure that the quality of an end product or service shall meet contract requirements.

2.1.9 Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2 Acronyms:

3.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S): The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

3.1 Materials: Government will provide all required templates and infrastructure plus related documentation and tools.

3.2 Equipment: Government will provide equipment i.e. (Laptop, Keyboard and mouse) to perform the task.

3.3 Utilities: All utilities in the facility will be available for the contactor’s use in the performance of this contract. The contractor shall instruct employees in utilities conservation practices. The contractor shall operate under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount.

4.0 Corporate Experience and Certifications:

4.1 The contractor shall have demonstrated experience with Splunk Enterprise, Splunk Security Enterprise and Splunk User Behavior Analysis with a preference of at least five years.

4.2 The contractor shall have demonstrated experience on NIST 800-53 with a preference that the vendor possess 8 – 10 years’ experience on the framework.

4.3 The contractor employees providing services related to Risk Management Framework PWS tasks shall possess CISSP or CISM certification. The vendor is responsible for ensuring certification prior to the start of any work.

5.0 Requirements

The contractor shall provide services in accordance with the below PWS tasks and the associated tables.

5.1 Splunk SAAS

5.1.1 The contractor shall develop, execute and track the performance of security measures to protect information and network infrastructure and computer systems.

5.1.2 The contractor shall design computer security strategies and engineer comprehensive cybersecurity architecture.

5.1.3 The contractor shall identify, define and document system security requirements and collaborate with System Owners in identifying areas of risk.

5.1.4 The contractor shall recommend solutions that utilize the Splunk SaaS, Splunk SaaS User Behavior Analysis and Splunk SaaS Security Enterprise capabilities to enhance IHS Cybersecurity posture and capture the maximum logs necessary to meet EO and OMB M21-31 mandates.

5.1.5 The contractor shall configure, troubleshoot and maintain security infrastructure of Splunk SaaS, Splunk SaaS User Behavior Analysis and Splunk SaaS Security Enterprise and M21-31 Splunk SaaS package.

5.1.6 The contractor shall install software that monitors systems and networks for security breaches and intrusions.

5.1.7 The contractor shall monitor systems for irregular behavior and set up preventive measures.

5.1.8 The contractor shall plan and develop an information security strategy within 180 days of award. The contractor shall present developed strategy to the Government for review and approval prior to implementation.

5.1.9 Training and Facilitation

5.1.9.1 The contractor shall provide an initial evaluation of existing technological training and provide written analysis of recommended improvements and efficiencies.

5.1.9.2 The contractor shall provide training to information security personnel during onboarding and educate and train staff on information system security best practices.

5.1.9.3 The contractor shall provide 1-day training sessions through the life of the contract on various topics. The vendor will provide topic/content recommendations to the Government based upon system findings, best practices and Government feedback. The Government will review and approval final training topics and materials.

5.1.9.4 Within 180 days of award the contractor shall develop information security awareness training for Risk governance, specifically for System owners. The contractor shall obtain Government review and approval of proposed training materials leading up to the 180-day deadline

5.1.9.5 On a quarterly basis the contractor shall conduct the below Splunk SaaS training. The duration is anticipated to be 2-day sessions.

Splunk SaaS Administration operational training

5.1.9.6 The contractor shall coordinate and facilitate meetings with Privacy Officer and System Owner to develop a PTA/PIA and capture all relative information required for the PTA/PIA

5.1.9.7 The contractor shall coordinate and facilitate meetings with CSIRT and System Owner to develop an Incident Response Plan (IRP)

5.1.9.8 The contractor shall coordinate and facilitate meetings with DRCP team and System Owner to develop a Contingency Plan (CP)

5.1.9.9 The contractor shall attend ATO assessment meetings. Meetings will be on-site at the location under PWS paragraph 1.4.1 or via videoconference.

5.1.9.10 The contractor shall develop security related content for the annual Partnership Conference (topics TBD). Draft content for the conference shall be submitted to the Government NLT 30 days from the conference date for review and approval.

5.1.10 System Security Plans

5.1.10.1 The contractor shall develop the SSP within 180 days of contract award and maintain through the life of the contract. The contractor shall maintain all documentation supporting the SSP and update when necessary.

5.1.10.2 Validate all the information from 50 System Security Plan (SSP) and make sure it follows the NIST 800-53 R5 guidelines

5.1.10.3 Provide subject matter expertise to System owners and assist them with NIST 800-53-R5 control objectives and implementation

5.1.10.4 The contractor shall provide Information Security Subject Matter Expert (SME) analysis and feedback to System Owners to develop and update the SSP, provide governance of Information Sensitivity and Criticality Assessment, and review/update POA&M(s) as required.

5.1.10.5 Provide justification and recommendations required to finalize the System Security Plans with the HQ Lead ISSO and Chief Information Security Officer

5.1.10.6 The contractor shall weekly input all System Security Plan information, input documentation and artifacts in the Government provided Risk Compliance tool (Archer).

5.1.11 The contractor shall gather artifacts from System Owners on a monthly basis and provide to the HQ ISSO Lead Federal Supervisor, and COR.

5.1.12 The contractor shall identify issues and gaps of control implementation and provide expertise to System Owners to resolve.

5.1.13 The contractor shall facilitate security related internal and external data calls , throughout the life of the contract.

5.1.14 The contractor shall provide analysis and recommendations to the Government in the development of security lifecycle planning.

5.2 System ISSO Operations

5.2.1 The contractor shall provide analysis, feedback, and support services to System Owners in documenting all control implementation as well as the documentation and updating of the CP, PIA, PTA, SAP, SSP, and Incident Response Capability.

5.2.2 The contractor shall utilize applicable tools (Crowdstrike, Tenable, etc.) to maintain security posture.

5.2.3 The contractor shall provide technical and security analysis, feedback, and implementation support services to stakeholders throughout the agency.

5.2.4 The contractor shall track FISMA and Interagency metrics and include within the monthly status report.

5.2.5 Provide support services to SOs in the development of Privacy Impact Analysis documentation

5.2.6 Provide data and analysis for the Government development of Risk Decision Memos

5.2.7 Respond to Area ISSO inquiries and be a primary point of contact for troubleshooting technical issues.

5.2.8 Reviewing Standard waiver forms (F06-11i) and advising CISO on recommended course of action.

5.2.9 Review and verify information on Interconnection Security Agreement (ISA) and make recommendation to Government personnel for approval/disapproval.

5.2.10 Provide continuous monitoring for all Security Controls implemented.

5.2.11 Provide Technical Controls implementation support.

5.2.12 The contractor shall provide analysis and supporting information for the SO development of Rules of Behavior.

5.2.13 The contractor shall respond to inquiries regarding systems in EANow.

5.2.14 The contractor shall respond to CSIRT alerts and requests.

5.3 The contractor shall provide analysis and feedback to SOs in the development and updating of System Descriptions. The contractor shall provide SSP development and Assessment Categorization tasks outlined below, either as a lead or as a subject matter expert with a team of ISSOs working with system owners. The minimum response SLAs, if applicable, are listed for all tasks.

Management and Strategies

5.3.1 The contractor shall provide oversight, analysis and recommendations during information security audits, whether by performed by organization or third-party personnel 2 days

Assessment

5.3.2 The contractor shall provide assistance services during system assessments and provide security risk assessment and remediation analysis and recommendations.

1 day

5.3.3 The contractor shall assess current technology architecture for vulnerabilities and weaknesses. The contractor shall provide analysis and recommendations for possible upgrades or improvement 2 days

System Owner Support

5.3.4 As the focal point for the information security team and the customer, the contractor shall implement and oversee technological upgrades, improvements and major changes to the information security environment 5 days

5.3.5 The contractor shall communicate information security goals and new programs effectively with other department managers within the organization 1 day

5.3.6 The contractor shall analyze system capabilities and provide recommended courses of action and solutions to System Owners on how to enhance service 2 hrs

5.3.7 The contractor shall assist System Owners to develop the Categorization Worksheet 1 day

5.3.8 The contractor capture information about the system controls that need to be implemented and provide guidance for security control implementations for selected controls (All SSP(s) and relative documentation must be reviewed by ISSO reviewer, ISSO Lead and Federal HQ ISSO prior to submitting to R&C team). The contractor shall analyze security control implementations to ensure compliance to all applicable laws and regulations and data integrity/Validation of all controls.

1 day

5.3.9 The contractor shall review new solutions and provide recommendations to ISSO Lead and Federal HQ ISSO for presenting a risk-based assessment and impact analysis for leadership review and approval 2 days

5.3.11 The contractor shall review system vulnerability reports for the assigned systems and provide analysis and recommendations to System Owners and CSIRT to meet IHS risk acceptance level and planned remediation 1 day

EL1

5.3.10 The contractor shall configure Splunk M-21-31 package and Splunk SEIM with Basic EL1 level logging

5.3.11 The contractor shall maintain and manage Splunk M-21-31 package and Splunk SEIM with Basic EL1 level logging 2 days

5.3.12 The contractor shall provide reporting for El 1 logging 5 days

EL2

5.3.13 The contractor shall configure Splunk M-21-31 package and Splunk SEIM with Basic EL2 level logging

5.3.14 The contractor shall maintain and manage Splunk M-21-31 package and Splunk SEIM with Basic EL2 level logging 2 days

5.3.15 The contractor shall provide reporting for El 2 logging 5 days

EL3

5.3.16 The contractor shall configure Splunk M-21-31 package and Splunk SEIM with Basic EL3 level logging

5.3.17 The contractor shall maintain and manage Splunk M-21-31 package and Splunk SEIM with Basic EL3 level logging 2 days

5.3.18 The contractor shall provide reporting for El 3 logging 5 days

5.4 Splunk and Systems

The below areas outlined EL1 Intermediate Requirements, EL2 Intermediate Requirements and EL3 Advance Log Management Requirements.

EL1 Intermediate Requirements

5.4.1 The contractor shall configure all the M-21-31 Required Logs categorized as Criticality Level 0 are retained in acceptable formats for specified timeframes, per technical details described in M-21-31 Appendix C.

One time, within 90 days after Award

5.4.2 The contractor shall ensure that each event log contains the following data to meet the Federal requirements:

• Properly formatted and accurate timestamp (see below for Time Standard Requirements)

• Status code for the event type

• Device identifier (MAC address5 or other unique identifier)

• Session / Transaction ID

• Autonomous System Number

• Source IP (IPv4)

• Source IP (IPv6)

• Destination IP (IPv4)

• Destination IP (IPv6)

• Status Code

• Response Time

• Additional headers (i.e., HTTP headers)

• Where appropriate, the username and/or userID shall be included

• Where appropriate, the command executed shall be included

• Where possible, all data shall be formatted as key-value-pairs allowing for easy extraction

• Where possible, a unique event identifier shall be included for event correlation; a unique event identifier shall be defined per event 6 type One time, 15 days after project start date

5.4.3 The contractor shall work with Division of Information Technology Office (DITO) engineers to configure and provide the consistent timestamp formats across all event logs are necessary for accurate and efficient event correlation and log analysis. Timestamps must be applied consistently to logs from all computing devices, routers, switches, and servers. Contract shall maintain log timestamps in a format that meets the following requirements, based on both ISO 7 8601 and RFC 3339: Date and Time on the Internet:

Timestamps.

• YYYY-MM-DDThh:mm:ss.mmmZ (Zulu time, UTC+0) and

• YYYY-MM-DDThh:mm:ss.mmm+04:00 (UTC+4)

• YYYY = four-digit year • MM = two-digit month

• DD = two-digit day of the month

• T = a set character indicating the start of the time element

• hh = two digits of an hour (00 through 23)

• mm = two digits of a minute

• ss = two digits of a second

• mmm = three digits of a millisecond (000 through 999)

• +|-= time zone designator (Z or +hh:mm or -hh:mm), the + or – values indicate how far ahead or behind a time zone is from the UTC (Coordinated Universal Time) zone.

Contractor shall work with System Administrative Group the time zone by using a GPS master station clock as a baseline reference for timestamps used for logs and systems producing logs. If GPS reference is not possible, agencies shall use NIST’s authenticated time service. 8 Public, unauthenticated, and unencrypted NTP pools shall only be used as an option of last resort, and only for as long as needed to begin leveraging other options.

One time, 25 days after project start date

5.4.4 Event Forwarding allows administrators to obtain events from remote computers, also called source computers or forwarding computers, and store them on a central server known as the collector computer. The contractor shall work with DITO system engineers to forward all required logging data, in near real-time and on an automated basis, to centralized systems responsible for security, information, and event monitoring (SIEM); bulk storage; and other analytical workflows or services. Data must be encrypted in transit between its source and destination. Contractor must ensure that the original log can be replayed for future use. To ensure data integrity, logging facilities and log information must be protected by cryptographic methods from tampering and unauthorized access. Agencies shall protect and monitor the integrity of their logs and systems producing logs by:

• Verifying that event logging is enabled and active for system components.

o Traps shall be put in place to monitor these data streams for disruption.

o These traps shall be monitored.

• Ensuring that only individuals who have a job-related need can view, access, or modify log files.

• Documenting views and usage of log files and regularly reviewing/auditing the resulting records.

• Confirming that current log files are protected from unauthorized modifications via access control mechanisms, such as virtual or physical segregation.

• Ensuring that current log files are promptly backed up to an authorized source, such as a centralized log server or write-once media.

• Using integrity-verification mechanisms to detect unauthorized changes to event logging configuration and log files that are no longer being written to or are considered closed.

• Conducting integrity checks periodically and upon access against the log hashes throughout their retention period.

• When logging stops unexpectedly, audit alerts shall be sent in near real-time to any parties responsible for monitoring. The responsible party must promptly investigate the cause of the disruption and take appropriate corrective actions.

• Monitoring across the enterprise for unexpected changes to files or configuration items, including changes to:

o Credentials o Privileges and security settings o Content o Core attributes and size o Hash values o Configuration values o Credentials o Privileges and security settings o Content o Core attributes and size o Hash values o Configuration values One time, 30 days after project start date

5.4.5 Federal agencies shall implement a Domain Name System (DNS) logging system that meets the requirements identified in Appendix C, including DNS requests made over encrypted DNS connections. Agencies shall implement accompanying analytics that allow for rapid identification of the host that sourced each DNS query. This capability shall be monitored and triaged. Federal agencies shall automate the production of a list of hostnames that are frequently accessed or looked up by legitimate users within their agency, but are not included in general top domain lists identified by CISA or available publicly or via subscription. Agencies should make that list automatically accessible to CISA or submit it to CISA daily via an acceptable automated mechanism.

Once, 30 days after project start date

5.4.6 The contractor shall work with DITO and DIS to provide logs and other relevant data to CISA and the FBI upon request, to the extent consistent with applicable law, including 44 U.S.C. § 3553(l). Contractor shall provide such data in a format and by means agreed upon by the agency, CISA, or the FBI, and shall do so pursuant to timelines specified by CISA or the FBI. Those timelines may require near real-time access to data.

Once, 45 days after project start date

5.4.7 Contractor shall maintain and manage logs by leveraging the additional logging to develop automated hunt and incident response playbooks. Such playbooks shall take advantage of Security, Orchestration, Automation, and Response (SOAR) capabilities. Agencies at EL1 stage shall start planning on how to best implement SOAR capabilities in their environment. For additional implementation requirements, please see Table 4, EL3 Advanced Requirements, Logging Orchestration, Automation, and Response – Finalizing Implementation.

Once, 45 days after project start date

5.4.8 User behavioral analytics allow for early detection of malicious Monitoring behavior. This technology leverages machine learning and artificial Planning intelligence techniques to detect anomalous user actions and help combat advanced threats. The contractor shall plan how to best implement a user behavior analytics capability in their environment, leveraging the logging requirements, in order identify potentially malicious or malicious activity. The contractor shall finalize the implementation of this capability to achieve EL3 maturity level. For additional implementation requirements, please see Table 4, EL3 Advanced Requirements of M-21-31, User Behavior Monitoring – Finalizing Implementation.

Once, 60 days after project start date

5.4.9 The contractor shall configure all the logs on centrally aggregated by an agency component-level Enterprise Log Manager (ELM). Traps for detecting data-stream disruption should be monitored by the component-level SOC. The DNS logging system and accompanying analytics shall be monitored and triaged by the component-level SOC.

Once, 90 days after award

EL2 Intermediate Requirements

5.4.10 The contractor shall provide a full report for a successful delivery of Level 0 Log management implementation and ensure the IHS that all required M-21-31 Log categorized at Criticality Level 0 are retained in acceptable formats for specified timeframes, per technical details described in M-21-31 Memo Appendix C Once, 130 days after award

5.4.11 The contractor shall initiate EL2 Level Log management implementation and ensure the IHS that all required M-21-31 Log categorized at Criticality Level 1 and 2 are retained in acceptable formats for specified timeframes, per technical details described in M-21-31 Memo Appendix C 135 days after project start date

5.4.12 The contractor shall work with DIS, DITO and DIT to capture the logs. The contractor shall provide a document detailing the structure (schema) for those logs to CISA. Contractor shall refer to guidance from CISA in developing this documented scheme along with all the updates to the schema to CISA no later than one business day after they are finalized. The schema and associated documentation shall be published to Data.gov.

160 days after project start date

5.4.13 Contractor shall provide all the details for encrypted data inspection and make the metadata available to follow zero-trust principles concerning least privilege and reduced attack surface, and relevant guidance from OMB and CISA relating to zero-trust architecture.

200 days after project start date

5.4.14 Required Logs categorized as Criticality Levels 0 and 1 are accessible and visible for the highest-level security operations at the head of each agency. Required Logs categorized as Criticality Levels 2 are retained, at a minimum, at component level.

• Build Traps for detecting data-stream disruption should be monitored by the component-level and top-level enterprise SOCs.

The DNS logging system and accompanying analytics shall be monitored and triaged by the component-level and top-level enterprise SOCs.

The enterprise SOC shall ensure that cross-organizational analytics are established for use across agency components.

220 days after project start date

EL3 Advance Log Management

5.4.15 The contractor shall provide a full report for a successful delivery of Level 1 and Level 2 Log management implementation and ensure the IHS that all required M-21-31 Log categorized at Criticality Level 1 and 2 are retained in acceptable formats for specified timeframes, per technical details described in M-21-31 Memo Appendix C

5.4.16 Contractor shall initiate EL3 Level Log management implementation and ensure the IHS that all required M-21-31 Log categorized at Criticality Level 3 are retained in acceptable formats for specified timeframes, per technical details described in M-21-31 Memo Appendix C

5.4.17 Contractor shall finalize and implement automated hunt and incident response playbooks. Federal agencies shall also provide any updates to the playbooks and automation integrations to CISA no later than one business day after they are finalized.

5.4.18 Contractor shall proceed with User behavioral analytics implementation in order to allow for early detection of malicious behavior. Leverage machine learning and artificial intelligence techniques to detect anomalous user actions and help combat advanced threats. Contractor shall assist IHS to implement a user behavior analytics capability using Splunk SaaS, leveraging the logging requirements, in order identify potentially malicious or malicious activity. Contractor shall configure the Splunk SaaS Enterprise Security that provides UBA capabilities and automate the triggering process to monitor all user and non-user accounts. Contractor shall provide analysis and recommendations for the new alerts monitored and triaged by component-and top-level IHS Cybersecurity Security Operations Centers (CSOC). At a minimum, user Behavior Monitoring should be configured to detect and alert on following components but not limited:

• Compromised user credentials

• Privileged-user compromise

• Improper asset access

• Compromised system/host/device

• Lateral movement of threat actor

5.4.19 Contractor shall configure and implement the security log container in Splunk SaaS M-21-31 package to contain all security and monitoring logs, which will be integrated with security information and event management (SIEM) Splunk SaaS to ensure container-related events are captured at the enterprise. Alternatively, in cases where the uses and privileges of containers are appropriately constrained by the orchestration layer, contractor shall configure Splunk SaaS and Splunk m-21-31 package to present at that layer. In general, contractor shall ensure that their cyber hunt and incident response teams have appropriate access to identify incidents within a containerized environment.

5.4.20 Contractor shall provide the successful completion reports and periodic reports and all artifact related to the Splunk SaaS and Splunk SaaS M-21-31 implementation and all log management requirement metrics to show that all EL1, El2 and EL3 implementations are completed successfully and other staff of DIS and DITO are trained to support the continuous operation as backup to provide continuous services if the contractor is not available.

Weekly

Ad-Hoc

5.5 System Administration

The contractor shall provide system administration in accordance with the PWS and associated tasks. The contractor shall as a minimum, on a daily basis, complete the following SSP development and Assessment Categorization tasks. The minimum response SLA times are listed for each. These reflect the minimum SA tasks and the vendor will apply subject matter expertise in addressing all system administration issues.

Specific tasks related to system administration include the below items.

5.5.1 Create System Boundaries

5.5.2 Collecting and Managing Asset Inventories

5.5.3 Creating, Updating and Managing System Interconnection/Information Sharing

5.5.4 Update the Information Contacts

5.5.5 Review and provide governance to make sure no System Name duplication and Help System Owners for System Categorization

5.5.6 Provide technical analysis and remediation support services to SOs and Tech leads to address vulnerabilities discovered on public facing websites.

5.5.7 Approve access requests for VPN, Admin accounts, email accounts, user accounts, and PIV exempt accounts in accordance with agency guidelines.

5.5.8 Initiate IDEAS tickets, when appropriate, ensuring content and format meet agency guidelines.

5.5.9 The contractor shall track agency ISSA training compliance and include statistics in monthly report.

5.5.10 The contractor shall ensure patch management is communicated and completed.

5.6 System Health Monitoring

5.6.1 The contractor shall manage and configure physical security, disaster recovery and data backup systems. The contractor shall on a weekly basis perform backup and, as needed, disaster recovery services. The contractor shall maintain existing plans for both backup and recovery services. The minimum response SLA is 2hrs

5.6.2 Monthly Status Report

The contractor shall provide a monthly status report summarizing the status of all work. The format will be provided following award and be updated, as needed, throughout the life of the contract.

6.0 Service Contract Reporting:

6.1 The contractor shall completely fill in all required data fields using the following web address: https://sam.gov. Log in and select Entity Registrations and then select Service Contract Reporting.

The Contractor shall report the required information annually by October 31, for services performed under this contract during the preceding Government fiscal year (October 1-September 30).

7.0 Applicable Publications:

Publications applicable to this PWS and the tasks outlined are listed below:

Publication (Chapter/Page)

Federal Acquisition Regulation (Through FAC 2022-07)