FA 1_Cybersecurity Technology and Operational Delivery Support Services_ DRAFT PWS.pdf

U.S. Department of Health and Human Services Office of the Chief Information Officer

Cybersecurity Technology and

Operational Delivery Support Services –

Functional Area 1

DRAFT Performance Work Statement

Sources Sought Notice 75P00120R00010

Cybersecurity Technology and Operational Delivery Support Services Task Scope

The objective of this Task is to consolidate services and activity to eliminate redundancies, streamline processes, and implement cybersecurity requirements into a strategic plan through program and portfolio management standards ensuring continuity across the management of OIS. The OIS objective for cybersecurity operational delivery and its investments is to leverage advances in cybersecurity to more efficiently and effectively accomplish mission objectives with a focus on consolidation, flexibility to adjust and scale to a changing threat environment, and deliver cost effective solutions within available resources.

To achieve the objectives of a more efficient, stable, maturing, and secure environment the supporting organizations must have the necessary expertise, resources, skills, and processes necessary to execute and respond. Therefore, OIS requires an integrated and standardized approach for the various support roles including operational delivery, subject matter experience, tool expertise, cybersecurity and information technology process and project assessment, program and project execution, quality management plans, and compliance reporting and monitoring.

The contractor shall ensure OIS is positioned to leverage advances in cybersecurity and cybersecurity technology and operational delivery support services to securely and efficiently implement, monitor, resource and accomplish OIS mission objectives. The contractor shall provide continuous awareness and expertise on program and project management of cybersecurity services.

The Contractor shall provide cybersecurity technology and operational delivery support services to effectively implement, administer, manage, mature, monitor, identify, protect, detect, respond, and recover cybersecurity operational activities to effectively and efficiently perform the duties and responsibilities as defined in this Task PWS. The scope of work under this work statement includes the following tasks:

1. Task Transition Management

2. Task Management

3. Security Tool Infrastructure Management (STIM) Support Services

4. Cybersecurity Incident Monitoring and Reporting Support Services

5. Enterprise Security Services Support Services

6. Technologies/Systems

7. Surge Support

Regulatory References (not inclusive)

HHS Policy for Information Technology (IT) Enterprise Performance Lifecycle Management

(EPLC): https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf

The Federal Information Technology Acquisition Reform Act (FITARA):

https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D

OMB Memo M-15-14: Management and Oversight of Federal Information Technology:

https://management.cio.gov/implementation/

National Institute of Standards and Technology (NIST) Cybersecurity Framework:

https://www.nist.gov/cyberframework he Federal Risk and Authorization Management Program (FedRAMP): https://www.fedramp.gov/ https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D https://management.cio.gov/implementation/ https://www.nist.gov/cyberframework https://www.fedramp.gov/

Federal Architectures Framework (FAEF 2.0):

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2

OMB Circular A-130:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf

HHS Cybersecurity Overview:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html

Executive Order 13636 and 13691, PPD-21: Privacy and Civil Liberties Assessment Report:

https://www.dhs.gov/sites/default/files/publications/2017%20EO%2013636_13691%20Section%

205%20Report_Signed%20012618_Final.pdf

National Initiative for Cybersecurity Education (NICE) Workforce Framework:

https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework

Security Technical Implementation Guides (STIGs): https://iase.disa.mil/stigs/Pages/index.aspx

Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and

Critical Infrastructure: https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure

NIST 800-37: Risk Management Framework for Information Systems and Organizations: A

System Life Cycle Approach for Security and Privacy: https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2

Special Publication 800-79-2, Guidelines for the Authorization of Personal Identity Verification

Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) has been approved as final:

https://csrc.nist.gov/News/2015/SP-800-79-2,-Guidelines-for-the-Authorization-of-P

OMB Circular A-123: Management’s Responsibility for Enterprise Risk Management and

Internal Control:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf

DHS Binding Operational Directive (BOD) 18-02 - Securing High Value Assets:

https://cyber.dhs.gov/bod/18-02/

Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and

Critical Infrastructure: Executive Order 13800: https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/

Federal Continuity Directives FCD-1: https://www.fema.gov/media-library/assets/documents/86284

Federal Continuity Directives FCD-2: https://www.fema.gov/media-library/assets/documents/132803

Presidential Continuity Directive 40: https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.dhs.gov/sites/default/files/publications/2017%20EO%2013636_13691%20Section%205%20Report_Signed%20012618_Final.pdf https://www.dhs.gov/sites/default/files/publications/2017%20EO%2013636_13691%20Section%205%20Report_Signed%20012618_Final.pdf https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://iase.disa.mil/stigs/Pages/index.aspx https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://csrc.nist.gov/News/2015/SP-800-79-2,-Guidelines-for-the-Authorization-of-P https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf https://cyber.dhs.gov/bod/18-02/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.fema.gov/media-library/assets/documents/86284 https://www.fema.gov/media-library/assets/documents/86284 https://www.fema.gov/media-library/assets/documents/132803 https://www.fema.gov/media-library/assets/documents/132803 https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf

TASK 1: TRANSITION

The Contractor will oversee all Transition-related work streams including, but not limited to:

a. Assume responsibility for the various areas of support from incumbent contractors currently providing services under this Task. Sustain consistent operational delivery. Appropriately capture qualified incumbent workforce.

b. Achieve 90% of agreed staffing capacity and complete transition in accordance with the proposed transition plan for all areas of support within 60 days from award.

TASK 2: TASK MANAGEMENT

The Contractor shall be responsible for the effective management and administration of the resulting

Task, ensuring that all work activities associated with tasks or projects are performed in a timely and cost effective manner while maintaining the highest quality of performance.

2.1 The Contractor Shall:

a. Ensure that the cross-functional areas of support are managed in a manner that achieves the objectives identified in the Objectives Section.

b. Develop and execute a Task Management Plan that reflects the interdependencies of the various staffing areas. Maintain no less than 90% of agreed staffing capacity through the life of the contract.

c. Task Management Plan elements include, but are not limited to:

i. Team organization and management to include a staffing plan, staff training, and management of staffing changes. The staffing plan must address Key

Personnel positions and the process for overseeing, controlling, and delivering required services under the Task;

ii. Management and control of a Work Breakdown Structure (WBS), schedules, cost, and

iii. Task requirements;

iv. Reporting, documenting, and managing problems, changes, risks, mitigation plans, and recommendations;

v. Communication and escalation procedures, general operating procedures, transition plans, and any additional information the contractor deems relevant;

and

vi. Task deliverables and acceptance process, distribution lists, format, and schedules for Government review and acceptance.

d. Work closely with the Agency staff to develop information to be included in the Draft

Task Management Plan.

e. Submit a Draft Task Management Plan within fifteen (15) business days after award and a final Plan is due ten (10) days after receipt of OIS feedback.

f. Conduct a quarterly review for changes must also be performed with revisions due by the 15th day after each quarter ends.

g. Meet with the Government COR within ten (I0) business days after award to establish a review process for the Performance Requirements Summary (PRS) to be implemented by the second month of the contract.

h. Provide a final approved review process incorporated into the Quality Assurance Plan

(QAP) and Task Management Plan with quarterly reporting established.

i. Provide a schedule for development and implementation approved by the COR.

j. Provide a draft QAP within fifteen (15) business days after award and a final QAP is due ten (10) business days after of receipt of OIS feedback. QAP elements include, but are not limited to: addressing how the contractor will ensure the objectives of the

Task will be met as well as methodologies for correction of deviations and the records to be kept for inspections.

k. Conduct a quarterly review for changes that may impact the QAP must also be performed and submitted with the updated Task Management Plan by the fifteenth

(15th) of the month following the end of each quarter.

l. Deliver a monthly Task Performance Report (TOPR) that provides valid and timely program status information to the designated OIS point(s) of contact no later than the

10th business day of each month for the prior month. The TOPR shall include the following:

i. Work performed during the reporting period including: accomplishments, problems/issues, key decisions with impacts, and recommendations for corrections;

ii. Work to be accomplished during the next reporting period;

iii. Ad hoc information on project status on an as-needed basis;

iv. Any issues that may occur during project implementation, to include external dependencies;

v. Performance measurements against PRS; and

vi. Staffing list, organizational chart, and vacancy status.

m. Prepare and maintain a Funds and Expenditure Report (F &E) to include, at a minimum: CLIN, SubCLIN (where applicable), labor category, personnel charging, hours, expenditures, current period and cumulative totals, funding amount, remaining balance, estimate to complete by month and estimate at completion.

n. Prepare and maintain a F&E in a format that is approved by the Government.

o. Develop an F&E report with elements that include, but are not limited to: show total contract value, total expended and variance analysis from the prior month's estimates, utilizing planned value and/or forecasting amounts against actual monthly expenditures for analyses.

p. Develop an F&E report structure that ties to a CLIN and SubCLIN and/or WBS elements where applicable for the given Task.

q. Submit an F&E report to the Contracting Officer Representative (COR) electronically by the 10th business day of each month for the prior month.

r. Provide the Government with options at every phase and/or critical milestone in a project and ensure Federal staff make all final project decisions.

s. Forecast decisions required decision making for Federal staff.

t. Determine actions that can be performed by contractor employees to ensure their discretionary decisions remain subject to Government oversight and final approval.

u. Address issues in advance and ensure conclusions are reflected in the contract by the contractor’s administration.

v. Ensure that contractor employees are properly identified in email communications, teleconference calls, and in meetings so that all participants can differentiate between

Federal employees and contractors.

TASK 3: Security Tool Infrastructure Management (STIM) Support Services:

Security Operations provides the Department of Health and Human Services cyber security solution and systems, Trusted Internet Connection (TIC), and HHS-wide security incident response coordination functions that include threat analysis and information sharing efforts. The “Enterprise Security Tool and

Infrastructure Management” branch deploys, operates, and maintains all the systems and infrastructure needed to support Security Operations.

Infrastructure includes networking and security devices, circuits, automated systems, servers, client computers, applications, and databases, voice systems along with helpdesk and field support responsibilities. Enterprise Security Tool Management is responsible for the installation, operations, and maintenance of cyber security systems and applications utilized by various teams across HHS that detect, identify, mitigate, and secure numerous systems.

Contractors are expected to provide ad hoc support as necessary 24/7/365. The Contractor will also provide a deputy program manager who will also provide tasking coordination for STIM support services.

Installation includes (but not limited to):

Implementation plan

Rack Elevation diagram

System diagram

Network diagram

Network cabling

Network configuration

System configuration

Software Installation

Operations and Maintaining includes (but not limited to):

User account administration.

System upgrade and patch management.

Configuration security.

Diagnose and correct system and network errors.

Monitor and mitigate system vulnerabilities.

Performance Tuning.

System inventory.

Backup system configuration.

Update system and network diagrams.

Perform life cycle upgrade.

Federal Information Security Modernization Act (FISMA) of 2014 and National Institute of Standards and Technology (NIST) guidance provide some of framework for the policy, strategic plans, and overall direction for the Department and OpDivs.

Security Tool Infrastructure Management Support Services will provide support for the following government activities:

3.1: Cybersecurity Infrastructure Management

Infrastructure Helpdesk and Desktop Support: The Desktop and Helpdesk support will perform user account administration, client computer imaging, setup, software installation, patch management, and peripheral management to include printers, plotters, and monitors.

The Contractor Shall:

a) Install and maintain client computer systems and peripheral devices.

b) Perform user account administration.

c) Perform client computer imaging, setup, software installation, and patch management.

d) Secure system configuration to appropriate government computer security standard

(i.e. Organization SOP, NIST and/or DISA STIG).

e) Diagnose and correct client connectivity problems.

f) Monitor and mitigate client computer vulnerabilities.

g) Provide effective customer communications.

h) Manage inventory of automated assets.

i) Monitor the helpdesk phone and ticket queue 8x5.

j) While on duty, acknowledged Helpdesk ticket within 30 minutes.

k) Take action on critical tickets within 24 hours.

l) Take action on normal tickets within 72 hours.

Infrastructure Field Systems Support: Provide hands-on support for all OIS systems at remote locations. Support includes, but is not limited to, inventory, installation, replacement, troubleshooting, upgrade, and maintenance. System includes all security tools, supporting infrastructure, and client computer systems. Remote locations include

OpDiv, Health Sector Cybersecurity Coordination Center (HC3), and Trusted Internet

Connection Access Provider (TICAP) locations where Cybersecurity Operations (CSO) assets are located. Locations are within the Atlanta and Metro DC areas.

The Contractor Shall:

a) Provide hands-on support for systems at remote locations. Support includes, but is not limited to, inventory, installation, replacement, troubleshooting, upgrade, and maintenance.

b) Systems include all security tools, supporting infrastructure, and client computer systems.

c) Install, operate, and maintain KVM/Console switch devices and APC rack management devices.

d) While on duty, acknowledge tickets with 30 minutes.

e) While on duty, dispatch to remote site within one hour of notification.

Cybersecurity Networks and Systems Administration: Operate, maintain, and administer existing network and systems architectures. Networks includes hardware, software, physical cabling, and IP address management. Systems include virtualization environment, servers, authentication services and policies, DNS, DHCP, and certificate services. Provide operation and maintenance to include but not be limited to release management, upgrades, patches, change packages (enhancement / fixes), and problem reports.

Monitor, maintain and report on network and systems performance. Perform performance tuning, troubleshooting and root cause analysis and benchmarking in accordance with established procedures.

Provide Network administration services to include but not limited to VLAN management, load balancer management, firewall management, network optimization management, switch management, circuits, monitoring tool management, VoIP network management, Web Proxy services, and Virtual Private Network (VPN) configuration and maintenance; and system administration to include create and maintain network and systems diagrams and administration documentation (SOPs); perform scheduled preventive maintenance of all hardware and software.

The contractor will support enterprise firewall management, security information event, and log management engineering, incident management/governance risk compliance engineering, and enterprise packet capture management engineering with Sr. level lead engineers. These four (4) specialized lead engineers will be considered Key Personnel.

The contractor will support the following activities:

Infrastructure – Intermediate System Administration (Windows) Logistics: The Contractor shall:

a) Install and maintain client computer systems and peripheral devices.

b) Perform user account administration.

c) Perform client computer imaging, setup, software installation, and patch management.

d) Secure system configuration to appropriate government computer security standard

(i.e. Organization SOP, NIST and/or DISA STIG).

e) Monitor and mitigate client computer vulnerabilities.

f) Maintain the inventory of all automated assets using the Sunflower inventory system.

g) Ensure the automated asset inventory is current to within 5 working days of inventory changes (procurements and turn-ins).

Infrastructure – System Administration (Linux): The Contractor shall:

a) Install, operate, and maintain Red Hat servers, Bind DNS, and Infoblox DNS appliances.

b) Secure system configuration to appropriate government computer security standard

(i.e. Organization SOP, NIST and/or DISA STIG).

Infrastructure – System Administration (Windows): The Contractor shall:

a) Install, operate, and maintain virtual computing environment, Windows servers, MS SQL database, storage, and backup system, active directory (AD), group policies (GPO), file servers, print servers, web servers, SMTP relay servers, .

b) Install, operate, and maintain data networks to include virtual and physical ethernet switches, DNS, DHCP,

c) Secure system configuration to appropriate government computer security standard

(i.e. Organization SOP, NIST and/or DISA STIG).

Infrastructure – Application Developer: The Contractor shall:

a) High-level programming and related technical skills.

b) Create, test, and field applications which improve efficiencies within the CSO.

Security Tools - Automation Developer & Application Engineer: The Contractor shall:

a) Install, operate, and maintain incident reporting, governance, risk, and compliance, and continuous diagnostics and monitoring systems.

b) Improve productivity through effective application and replication of successful automation and control solutions.

c) Recommend new control strategies for processes in operation

d) Deliver, monitor, and support production applications

e) Technical advisory role in implementation and architecture design

f) Assist in threat detection activities across teams

g) Maintain system documentation, tuning system performance etc.

Security Tools – Packet Capture: The Contractor shall:

a) Setup, configure, and maintain Packet Capture devices

b) Inspect traffic and report on traffic patterns, anomalies, malware, and other threats

c) Assist with threat identification and inline threat prevention

d) Knowledge of log formats for syslog, http logs, and DB logs

e) Installing software on servers / Configuring Agents to forward logs to SIEM

f) Use existing APIs to consume, display, filter, search complex security related information

g) Deliver, monitor, and support production applications

h) Technical advisory role in implementation and architecture design

i) Assist in threat detection activities across teams

j) Maintain system documentation, tuning system performance etc.

Security Tools – Enterprise Firewalls (currently Palo Alto Networks): The Contractor shall:

a) Setup, Configure, and Maintain Palo Alto perimeter defense appliances

b) Utilize Panorama with strategic development of policies, rules, NATS, and security profiles

c) Implement Network Security policies

d) Monitor, secure, and communicate network vulnerabilities and attack vectors for diverse stakeholders

e) Provide extensive knowledge of Gigamon, Palo Alto Firewalls, FireEye, Sourcefire, Lancope SteATLhWatch, HP TippingPoint, or RSA NetWitness security tools. Train users on the use of the tool as appropriate.

Security Tools – Incident Management/Governance Risk Compliance Engineering (currently RSA

Archer): The Contractor shall:

a) Support the installation and management of the RSA Archer system.

b) Partner with security and infrastructure teams to maintain system availability.

c) Assist with the implementation of RSA Archer and the eventual migration from

HHS’ current incident management system

d) Support Archer applications to accommodate business requirements and/or design changes

e) Troubleshoot data feed integration, stakeholder notifications, and reporting requirements

f) Provide extensive knowledge of RSA Archer. Train Archer users on the use of the tool as appropriate. Support SGRC/Archer A&A users to understand and navigate the process and terminology

g) Manage SGRC/Archer user accounts. Perform bulk user upload and single user account creation. Provide SGRC/Archer users with technical support

h) Transfer data to other applications for reporting purposes. Export/Import Privacy data into SGRC/Archer ingestible templates. Integrate other software/applications with Archer. Assist OpDivs and system users on how to perform the process of data import into SGRC/Archer and exporting meaningful reports to management stakeholders. Assist in validating data fields for use in the import process

Security Tools – Security & Automation Engineer: The Contractor shall:

a) Partner with security and infrastructure teams to develop, implement, and manage scripts.

b) Coordinate automation efforts and prepare and track requirements, schedules and actions

c) Troubleshoot and maintain established scripts and automation infrastructure in conjunction with other support teams (server and/or networking teams)

d) Designs and implements solutions to support HHS’ Threat Intelligence activities

e) Troubleshooting existing scripts while providing guidance on enhancing functional capabilities

HHS Security Data Warehouse (HSDW): The data in the HHS Data Warehouse (HSDW) is a compilation of data uploaded by the OpDivs on a monthly basis. The OpDivs run reports from their individual tools based on a standardized format so that OCIO collects the same data elements in the same format from every OpDiv.

The Contractor shall:

a) Update HSDW technical plan

b) Provide training, assistance, and technical support to HHS and OpDiv Privacy teams during the process of Privacy Threshold Analysis (PTA), Privacy Impact

Assessment (PIA), and Third Party Web Application (TPWA) creation in the

Privacy web-based tool in HSDW. Provide HSDW user training. Develop and maintain training materials

c) Document and maintain documentation on the HSDW infrastructure, to include but not limited to infrastructure, interfaces, database design

d) End-user communications and issue resolution

e) Analyze, recommend, and build custom solutions for data gathering; build adaptable, fillable PDF forms

f) Build application to perform bulk users upload

g) Build connector to transfer data to the HSDW application for data integration

h) Build application to export Privacy data from HSDW into importable templates for

SGRC/Archer

i) Create custom reports within SGRC/Archer and with other reporting tools to include but not limited to Tableau

j) Provide OpDiv system inventory and weakness SGRC/Archer reports to HHS

Leadership

k) Develop, test, and maintain the HSDW system to include software, code development and scripting, hardware, upgrades, documentation, vulnerability remediation and data

l) Customize the Privacy web-based tool based on requirements from the HHS

Privacy team

m) Build custom dashboards and reports in Jasper Reports

n) Monitor HSDW Support mailbox and address Privacy requests within 24 hours

o) Support and provide ad-hoc HSDW reporting to allow a near real-time understanding of the Department’s security posture

p) Develop, test, and maintain the HSDW system to include software, code development and scripting, hardware, upgrades, documentation, vulnerability remediation and data

q) Ensure the HSDW security authorization documentation and Authority to Operate

(ATO) are current, identifying and correcting potential and actual vulnerabilities

r) Maintain security and operations documentation to include but not limited to

System Security Plans (SSP), Information System Contingency Plans, Plans of

Action and Milestones (POA&Ms), operations manuals, and Standard Operating

Procedures (SOPs)

s) Coordinate with OCIO stakeholders to ensure all user requirements are identified and considered within the system, and that HSDW and other OCIO systems have the ability to share data as needed

t) System Administration; monitor performance of servicers to maintain desired availability. Perform annual updates to the System Security Plans (SSP), System

Contingency Plans (SCP), and Security Controls Assessment (SCA)

u) Perform Table Top exercises

v) Maintain reporting capability while data transitions from legacy application to new application

w) Analyze policies and provide recommendations

Cybersecurity Architect Support: At any given time OIS is responsible for managing multiple cybersecurity initiatives of varying size and complexity. Current major ongoing active enterprise projects include the DHS Continuous Diagnostics and Mitigation (CDM) deployment across the agency, deployment of agency level integrated governance, risk and compliance management systems, dashboards, and processes (Archer Suite); Agency level Security Incident Event

Management systems, dashboards, and processes (Splunk). Additionally, Cybersecurity Operation division’s Security Technology Infrastructure Management branch provides ongoing projects for deployment of systems for the OIS Security Enclave including the Trusted Internet Connection

(TIC) infrastructure. To support these activities, the contractor will provide enterprise cybersecurity architecture support identified as a key personnel.

TASK 4: Computer Security Incident Monitoring and Reporting Support Services HHS' Computer Security Incident Response Center (CSIRC) was established under the Federal

Information Security Management Act of 2002 (FISMA) to validate and report cybersecurity incidents to the United States Computer Emergency Readiness Team (US-CERT) on behalf of the Department. To aid in this effort, CSIRC has a consolidated enterprise view of security events and network activity, providing a holistic view in a federated environment.

The Computer Security Incident Response Capability (CSIRC) acts to improve the Department’s cybersecurity posture by identifying, verifying, and understanding cyber events in order to respond effectively, develop mitigation strategies, and deliver timely products that address and incorporate stakeholder needs. The CSIRC identifies trends and activities in a proactive mode for prevention, response and recovery purposes. CSIRC tracks incident notifications originating from multiple sources:

US-CERT, OpDivs, Incident Response Teams (IRT), an HHS computer systems user, and/or a third party.

CSIRC strives to improve the Department’s cybersecurity posture by identifying, verifying, and understanding cyber events and incidents in order to respond, mitigate, and provide 24/7/365 situational awareness to its stakeholders (both internal – OpDivs – and external – DHS).

The Contractor will provide a Key Personnel Task Lead to provide overall management of TASK 4:

Computer Security Incident monitoring and Reporting Support Services and will lead the execution of supporting for the following government activities:

4.1 Incident Analysis & Investigation Cybersecurity Analytics: The CSIRC Security Operations Center

(SOC) serves as the incident analysis and investigation hub for the Department. The Contractor will be responsible for incident logging, tracking, and reporting, outage reporting, and shift change. The

Contractor will be responsible for incident management, triage, investigation, and analysis. The

Contractor will be responsible for problem resolution and subject matter expertise in security investigations best practices.

The Contractor shall:

a) Collect, analyze, and correlate security events and use discovered data to enable recommendation of mitigation of potential incidents within the enterprise as defined by

CSIRC methodology.

b) Identify events that pose a threat to the confidentiality, availability and integrity of information or systems that may be indicative of a violation of federal law or HHS Policy.

c) Provide quality assurance accuracy, consistency and reliability to security event data in tickets and reports.

d) Perform incident triage to include determining accuracy, scope, urgency, and impact.

e) Provide incident coordination and updates to the OpDiv Incident Response Teams (IRTs) and HHS through prescribed CSIRC methodology.

f) Notify CSIRC management and other HHS IRT members of suspected incidents and articulate the event’s history, status and potential impact.

g) Perform agency-wide event and incident tracking using the prescribed federally approved ticket management system.

h) Track and report on-going cyber security incidents to the primary incident handler.

i) Provide the CSIRC and OpDivs with event and incident operational and executive reporting.

j) Respond to verified incidents utilizing a wide array of tools to mitigate active threats.

k) Conduct a minimum of one investigation per week.

l) Contribute to the growth of the Department by producing artifacts for the knowledge base.

m) Provide updates to the CSIRC Standard Operating Procedures (SOP) as needed.

n) Participate in Table Top Exercises and provide summary of findings after the exercises.

o) Provide a minimum of two personnel per shift.

4.2 Cybersecurity SOC Lead: A Cybersecurity Lead (Contractor Provided) will be responsible for the aforementioned requirements in CSIRC - Incident & Investigation Analysis and as follows.

The Contractor Shall:

a) Ensure escalated incidents are followed through on and data is collected/reported well in advance of deadlines set by leadership.

b) Assuring staff are tasked appropriately and supply guidance as needed in accordance with operational policies and procedures.

c) Initiate action to ensure appropriate coverage for the upcoming shift in the event of an oncoming Analyst missing his or her shift for any reason.

d) Assure that staff has access to tools and systems needed to complete CSIRC duties.

e) Ensure onboarding of new personnel is conducted in accordance with policy

f) Ensuring all information in the shift report is complete, accurate, and well understood.

g) Ensuring all conference calls are coordinated as scheduled.

h) Provide weekly status updates of SOC floor tempo.

i) Provide any issues related to SOC personnel and scheduling to federal staff.

4.3 Network Operations Analyst: Network Operations Analyst are expected to provide support in a

7x24x365 staffed Network Operations Center.

The Contractor Shall:

a) Accurately monitor network connections consisting of voice or data network.

b) Alarm monitoring and ticket documentation related to outages while providing technical assistance.

c) Coordinate with vendors and various teams within the Departments to assist with service restoration based on alarm conditions.

d) Work with the Security Operations Center (SOC) on anomalies observed within the network.

e) Participate in available technical and personal development opportunities.

f) Document NOC team processes, oversee NOC projects and assist with monthly reporting for the Department.

TASK 5: Enterprise Security Services Support Services

The Enterprise Security Services (ESS) is designated by the Department of Homeland Security (DHS) as an Information Systems Security Line of Business (ISSLoB) with the responsibility to improve the level of information systems security across government by eliminating duplication of effort, increasing aggregate expertise, and enhancing the overall security posture of the federal government. The ESS LoB performs Security Authorization & Assessment (SA&A), formerly certification and accreditation, services, including Security Controls Assessments (SCA), to federal organizations, both within HHS and

Federal Agencies external to HHS. The ESS approach integrates SA&A into the System Development

Life Cycle (SDLC), which assures our customers that their critical assets are adequately protected.

HHS ESS Line of Business (LoB) provides a wide variety of services related to the following:

Information System Security Officer (ISSO) Services

Security Control Assessment (SCA) Services

Security Consulting (SC) Services

Information System Security Manager (ISSM) Services

The HHS Enterprise Security Services Line of Business (ESS LoB) supports and facilitates the implementation of all mandates and guidance under the federal Risk Management Framework (RMF) solutions as identified by NIST 800-37 to:

Provide subject matter expertise in security accreditation and authorization

Provide evaluation and validation of information system security risks to ensure compliance with

NIST Special Publication (SP) regulations, policies and procedures

Comply with agency-defined frequencies for technical analysis of information system vulnerabilities

The Contractor shall provide a Key Personnel Task Lead to provide management of delivering TASK 7

Information Assurance support services to meet the U.S. Department of Health and Human Services

(HHS) ESS LoB objectives and effectively provide security accreditation and authorization and assessment services for federal organizations. The contractor shall perform the duties and responsibilities as defined in this Task PWS.

The scope of work under this Task includes the following tasks:

ESS LoB - Security Authorization & ISSO Services Support: ESS’s Security Authorization and ISSO services include an assessment of security related documentation and the implementation of security controls based on the overall security classification of the system, to ensure compliance with Federal regulations and standards (e.g., National Institute of Standards and Technology [NIST]) and agency and departmental policy and guidance. Security documentation is developed and revised, and security controls and processes are implemented to maintain the security posture of the system. Services also include support for the risk management framework (RMF), the continuous monitoring process, consulting services, and facilitating mitigation of plan of action and milestones (POA&Ms) to correct weaknesses identified during the assessment of security controls and continuous monitoring activities.

The overall objective is to improve the customer’s overall IT security posture and provide an independent review of systems that have been, or are being prepared for security authorization and assessment

(SA&A). The Contractor will work closely with ESS staff and ESS customers in the execution of this task. Some tasks will be one-time efforts; some may be conducted on a repeated or ongoing basis.

The Contractor shall assist ESS in supporting its customers and conduct tasks, at the direction of

ESS federal program managers, including but not limited to:

a) Support ESS with providing customer support for ESS engagements, using ESS process, guidance, and methods

b) Serve as an ISSO or support the current ISSO

c) Assess, review, update, and develop security authorization and accreditation documentation to ensure consistency with laws, regulations and best practices as it pertains to the system

FIPS impact rating with particular emphasis on FISMA and customer-specific requirements.

d) Work closely with ESS customers to develop and update security-related documentation to reflect the security posture of the IT system, as directed by ESS federal program managers.

e) Prepare or assist in the preparation of other security documentation or reports as required to support customer engagements.

f) Support ISSOs in their responsibilities for systems including Enterprise Performance Life

Cycle (EPLC)/System Development Life Cycle (SDLC) security support and risk management and system weakness management (POA&M maintenance for the Risk

Management Framework Portal (RMFP)).

g) Assist ESS in reviewing or modifying security documentation to ensure ESS maintains quality and accuracy in customer products.

h) Provide administrative support as necessary, to include, but not limited to: Compile, or provide input to, weekly customer status reporting (e.g. deliverables completed) and project plans; Assist with meeting minutes and action items as needed; Attend customer meetings in person, unless otherwise noted.

ESS LoB - Security Control Assessment (SCA) Services Support: The Contractor shall provide support to both ESS HHS and non-HHS federal customers in Security Control Assessment (SCA) services, which could include physical security walkthroughs, control assessments, technical vulnerability analysis, PIV

Card Issuance Facility (PCIF) Assessments. Services will be performed in accordance with federal regulations and standards (e.g., National Institute of Standards and Technology [NIST]) and agency and departmental policy and guidance. Services will also be performed in accordance with direction of ESS federal program management staff. ESS’s approach includes an assessment to determine and evaluate common and system specific controls in order to ensure they are in compliance with Federal regulations.

The output includes a written assessment document, required notes documenting assessment results, and may also include input into external report management systems based on the customer’s request and compliance with applicable directives and requirements. The overall objective is to validate the customer’s IT Security system operation, infrastructure and/or functionality compliance with HHS and federal regulations to satisfy the security evaluation as part of the assessment process and may include an independent review of systems that have been or are being prepared to receive authorization.

The Contractor shall:

a) Attend customer meetings in person, unless otherwise noted.

b) Plan and/or perform security controls assessments for ESS customer systems in accordance with NIST SP 800-53 and NIST SP 800-53A, using ESS process, guidance and methods to support the customer’s authority to operate process, or its annual assessment process.

Activities could include control assessment (Interview & Examination, physical security walkthroughs and/or technical vulnerability testing.

c) Plan and/or perform assessment of PCIF facilities and/or OpDivs in accordance with NIST

800-79 requirements for authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) compliance.

d) Assist with identification and remediation of PCIF Plan of Action & Milestones (PO&MS).

e) Identify existing and/or potential organizational security weaknesses as a result of the assessments, including personnel controls, training, incident and emergency response, logical security controls, physical security controls, operational security and integrity of software applications and data for customer engagements.

f) Prepare and/or assist in the preparation of reports and presentations required for communicating findings of the security control assessments.

g) Conduct vulnerability assessments on networks, servers, websites and databases, as directed by ESS, to assist with other assessment activities.

h) Assess, review, update or develop documentation to support ESS in their security controls assessment activities.

i) Compile, or provide input to, weekly customer status reporting and project plans.

j) Maintenance of tools, laptops and upkeep of testing materials.

k) Conduct on site assessment of PCIF facilities.

l) Demonstrate Prior experience performing assessments to include validating and justifying compliance or non-compliance in accordance with NIST (National Institute of Standards and Technology) guidance, FISMA (Federal Information Security Management Act), FISCAM (Federal Information System Controls Audit Manual), for non-DOD Federal agencies.

m) Possess applicable certifications and credentials such as Certified Ethical Hackers or the equivalent for penetration testing and vulnerability assessment work.

TASK 6: TECHNOLOGIES/SYSTEMS

The Contractor shall:

a) Utilize, operate, maintain, configure, secure, support, and update the Government-furnished technologies and systems provided in Section 7 and report on utilization of capabilities.

b) Utilize, operate, maintain, configure, secure, support, and update the Government-furnished online Product and Service Catalog and any successor system.

c) Utilize, operate, maintain, and provision all related OIS technologies, and systems with

Government approval.

d) Provide full lifecycle support for all technologies, and systems as enumerated in Section

7 in operation and supported by OIS.

e) Provide all labor, management, configuration, supervision, and other resources necessary to support all technologies and systems managed by OIS.

f) Provide proactive and scheduled monitoring of infrastructure, technologies, and systems.

g) Perform the full lifecycle of Government-furnished technologies and systems including management, refresh, patch, update, deploy, provision, setup, test, retrieve, store, and catalog.

TASK 7: Surge Support Mission needs combined with available funding may evolve as the contracted work is executed. At times additional hours and support may be needed within the overall scope of the Task. The Government may exercise increased hours for a specified labor category to provide additional support to meet the government's needs. This additional support will be temporary in nature and would only extend to end of the contract period.