FA 3_Splunk Operational Delivery_DRAFT PWS.pdf

U.S. Department of Health and Human Services Office of the Chief Information Officer

Splunk Operational Delivery Support Services – Functional Area 3

Performance Work Statement

Sources Sought Notice 75P00120R00010

Splunk Operational Delivery Support Services Task Scope

The objective of this Functional Area is to consolidate services and activity to eliminate redundancies, streamline processes, and implement cybersecurity requirements into a strategic plan through program and portfolio management standards ensuring continuity across the management of OIS. The OIS objective for cybersecurity operational delivery and its investments is to leverage advances in cybersecurity to more efficiently and effectively accomplish mission objectives with a focus on consolidation, flexibility to adjust and scale to a changing threat environment, and deliver cost effective solutions within available resources.

To achieve the objectives of a more efficient, stable, maturing, and secure environment the supporting organizations must have the necessary expertise, resources, skills, and processes necessary to execute and respond. Therefore, OIS requires an integrated and standardized approach for the various support roles including operational delivery, subject matter experience, tool expertise, cybersecurity and information technology process and project assessment, program and project execution, quality management plans, and compliance reporting and monitoring.

The contractor shall ensure OIS is positioned to leverage advances in cybersecurity and cybersecurity technology and operational delivery support services to securely and efficiently implement, monitor, resource and accomplish OIS mission objectives. The contractor shall provide continuous awareness and expertise on program and project management of cybersecurity services.

The Contractor shall provide cybersecurity technology and operational delivery support services to effectively implement, administer, manage, mature, monitor, identify, protect, detect, respond, and recover cybersecurity operational activities to effectively and efficiently perform the duties and responsibilities as defined in this Task PWS. The scope of work under this work statement includes the following tasks:

1. Task Transition Management

2. Task Management

3. Security Tools – Security Information and Event, Log Management Engineering (Currently

Splunk)

4. Security Tools – Security Information and Event, Log Management Engineering Architecture

(Currently Splunk)

5. Splunk SOC Analyst (IR/Content)

6. Technologies/Systems

7. Surge Support

Regulatory References (not all inclusive)

• HHS Policy for Information Technology (IT) Enterprise Performance Lifecycle Management (EPLC): https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf

• The Federal Information Technology Acquisition Reform Act (FITARA):

https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D

• OMB Memo M-15-14: Management and Oversight of Federal Information Technology:

https://management.cio.gov/implementation/

• National Institute of Standards and Technology (NIST) Cybersecurity Framework:

https://www.nist.gov/cyberframework

• he Federal Risk and Authorization Management Program (FedRAMP): https://www.fedramp.gov/ https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D https://management.cio.gov/implementation/ https://www.nist.gov/cyberframework https://www.fedramp.gov/

• Federal Architectures Framework (FAEF 2.0):

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2

• OMB Circular A-130:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf

• HHS Cybersecurity Overview:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html

• Executive Order 13636 and 13691, PPD-21: Privacy and Civil Liberties Assessment Report:

https://www.dhs.gov/sites/default/files/publications/2017%20EO%2013636_13691%20Section% 205%20Report_Signed%20012618_Final.pdf

• National Initiative for Cybersecurity Education (NICE) Workforce Framework:

https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework

• Security Technical Implementation Guides (STIGs): https://iase.disa.mil/stigs/Pages/index.aspx

• Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and

Critical Infrastructure: https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure

• NIST 800-37: Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy: https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2

• Special Publication 800-79-2, Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) has been approved as final:

https://csrc.nist.gov/News/2015/SP-800-79-2,-Guidelines-for-the-Authorization-of-P

• OMB Circular A-123: Management’s Responsibility for Enterprise Risk Management and Internal Control:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf

• DHS Binding Operational Directive (BOD) 18-02 - Securing High Value Assets:

https://cyber.dhs.gov/bod/18-02/

• Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure: Executive Order 13800: https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/

• Federal Continuity Directives FCD-1: https://www.fema.gov/media-library/assets/documents/86284

• Federal Continuity Directives FCD-2: https://www.fema.gov/media-library/assets/documents/132803

• Presidential Continuity Directive 40: https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.dhs.gov/sites/default/files/publications/2017%20EO%2013636_13691%20Section%205%20Report_Signed%20012618_Final.pdf https://www.dhs.gov/sites/default/files/publications/2017%20EO%2013636_13691%20Section%205%20Report_Signed%20012618_Final.pdf https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://iase.disa.mil/stigs/Pages/index.aspx https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://csrc.nist.gov/News/2015/SP-800-79-2,-Guidelines-for-the-Authorization-of-P https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf https://cyber.dhs.gov/bod/18-02/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.fema.gov/media-library/assets/documents/86284 https://www.fema.gov/media-library/assets/documents/86284 https://www.fema.gov/media-library/assets/documents/132803 https://www.fema.gov/media-library/assets/documents/132803 https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf

TASK 1: TRANSITION

The Contractor will oversee all Transition-related work streams including, but not limited to:

a. Assume responsibility for the various areas of support from incumbent contractors currently providing services under this Task. Sustain consistent operational delivery. Appropriately capture qualified incumbent workforce.

b. Achieve 90% of agreed staffing capacity and complete transition in accordance with the proposed transition plan for all areas of support within 60 days from award.

TASK 2: TASK MANAGEMENT

The Contractor shall be responsible for the effective management and administration of the resulting Task, ensuring that all work activities associated with tasks or projects are performed in a timely and cost effective manner while maintaining the highest quality of performance.

The Contractor Shall:

a. Ensure that the cross-functional areas of support are managed in a manner that achieves the objectives identified in the Objectives Section.

b. Develop and execute a Task Management Plan that reflects the interdependencies of the various staffing areas. Maintain no less than 90% of agreed staffing capacity through the life of the contract.

c. Task Management Plan elements include, but are not limited to:

i. Team organization and management to include a staffing plan, staff training, and management of staffing changes. The staffing plan must address Key Personnel positions and the process for overseeing, controlling, and delivering required services under the Task;

ii. Management and control of a Work Breakdown Structure (WBS), schedules, cost, and

iii. Task requirements;

iv. Reporting, documenting, and managing problems, changes, risks, mitigation plans, and recommendations;

v. Communication and escalation procedures, general operating procedures, transition plans, and any additional information the contractor deems relevant;

and

vi. Task deliverables and acceptance process, distribution lists, format, and schedules for Government review and acceptance.

d. Work closely with the Agency staff to develop information to be included in the Draft Task Management Plan.

e. Submit a Draft Task Management Plan within fifteen (15) business days after award and a final Plan is due ten (10) days after receipt of OIS feedback.

f. Conduct a quarterly review for changes must also be performed with revisions due by the 15th day after each quarter ends.

g. Meet with the Government COR within ten (I0) business days after award to establish a review process for the Performance Requirements Summary (PRS) to be implemented by the second month of the contract.

h. Provide a final approved review process incorporated into the Quality Assurance Plan (QAP) and Task Management Plan with quarterly reporting established.

i. Provide a schedule for development and implementation approved by the COR.

j. Provide a draft QAP within fifteen (15) business days after award and a final QAP is due ten (10) business days after of receipt of OIS feedback. QAP elements include, but are not limited to: addressing how the contractor will ensure the objectives of the Task will be met as well as methodologies for correction of deviations and the records to be kept for inspections.

k. Conduct a quarterly review for changes that may impact the QAP must also be performed and submitted with the updated Task Management Plan by the fifteenth (15th) of the month following the end of each quarter.

l. Deliver a monthly Task Performance Report (TOPR) that provides valid and timely program status information to the designated OIS point(s) of contact no later than the 10th business day of each month for the prior month. The TOPR shall include the following:

i. Work performed during the reporting period including: accomplishments, problems/issues, key decisions with impacts, and recommendations for corrections;

ii. Work to be accomplished during the next reporting period;

iii. Ad hoc information on project status on an as-needed basis;

iv. Any issues that may occur during project implementation, to include external dependencies;

v. Performance measurements against PRS; and

vi. Staffing list, organizational chart, and vacancy status.

m. Prepare and maintain a Funds and Expenditure Report (F &E) to include, at a minimum: CLIN, SubCLIN (where applicable), labor category, personnel charging, hours, expenditures, current period and cumulative totals, funding amount, remaining balance, estimate to complete by month and estimate at completion.

n. Prepare and maintain a F&E in a format that is approved by the Government.

o. Develop an F&E report with elements that include, but are not limited to: show total contract value, total expended and variance analysis from the prior month's estimates, utilizing planned value and/or forecasting amounts against actual monthly expenditures for analyses.

p. Develop an F&E report structure that ties to a CLIN and SubCLIN and/or WBS elements where applicable for the given Task.

q. Submit an F&E report to the Contracting Officer Representative (COR) electronically by the 10th business day of each month for the prior month.

r. Provide the Government with options at every phase and/or critical milestone in a project and ensure Federal staff make all final project decisions.

s. Forecast decisions required decision making for Federal staff.

t. Determine actions that can be performed by contractor employees to ensure their discretionary decisions remain subject to Government oversight and final approval.

u. Address issues in advance and ensure conclusions are reflected in the contract by the contractor’s administration.

v. Ensure that contractor employees are properly identified in email communications, teleconference calls, and in meetings so that all participants can differentiate between Federal employees and contractors.

TASK 3: SECURITY TOOLS – SECURITY INFORMATION AND EVENT, LOG

MANAGEMENT ENGINEERING (CURRENTLY SPLUNK):

The Contractor shall:

a) Partner with security and infrastructure teams to facilitate data ingestion and analysis.

b) Design and implement a technical infrastructure based on functional requirements for new and existing Splunk instances

c) Participate in requirements gathering, architecting, building and supporting operational needs

d) Designs and implements solutions to provide applications and agents

e) Provides guidance on data analysis and reporting including use of machine learning and complex analysis

f) Maintains, upgrades, and operates Splunk systems. Advises and cross-trains team members

g) Integrates automation, application and systems monitoring.

h) Provide extensive knowledge of Splunk. Train Splunk users on the use of the tool as appropriate.

TASK 4: SECURITY TOOLS – SECURITY INFORMATION AND EVENT, LOG

MANAGEMENT ENGINEERING (CURRENTLY SPLUNK)

ARCHITECTURE:

The Contractor shall:

a) Maintain and mature a complex federated Splunk environment.

b) Lead an engineering team supporting the operations of Splunk and interagency integrations.

c) Build best practices and write Standard Operating Procedures (SOPs) for all standard tasks for entire agency.

d) Mentor and guide teammates to gain knowledge and meet deliverables.

e) Act as a primary point of contact for agency Splunk engineers to assist with troubleshooting, technology rollouts, and upgrade processes.

f) Support an agency SOC’s Splunk usage to improve agency wide security visibility.

g) Provide extensive knowledge of Splunk. Train Splunk users on the tool’s capabilities and innovations as appropriate.

TASK 5: Splunk SOC Analyst (IR/Content) The Contractor shall:

a) Provide a Splunk SOC Analyst that will be responsible for the aforementioned requirements in Incident & Investigation Analysis in Task 1a – CSIRC.

b) Content Developer providing a full range of cyber security services

c) Managing Splunk knowledge objects (e.g., fields, extractions, tags, event types, lookups, workflow actions, aliases).

d) Experience developing content with regular expressions, performing data interpretation classification, and enrichment.

e) Develop reports to meet SOC and leadership requirements.

f) Excellent problem solving, critical thinking, and analytical skills with the ability to de-construct problems.

g) Provide training and support for Splunk Users

h) Extensive knowledge of Splunk.

TASK 6: TECHNOLOGIES/SYSTEMS

The Contractor shall:

a) Utilize, operate, maintain, configure, secure, support, and update the Government-furnished technologies and systems provided in Section 7 and report on utilization of capabilities.

b) Utilize, operate, maintain, configure, secure, support, and update the Government-furnished online Product and Service Catalog and any successor system.

c) Utilize, operate, maintain, and provision all related OIS technologies, and systems with Government approval.

d) Provide full lifecycle support for all technologies, and systems as enumerated in Section 7 in operation and supported by OIS.

e) Provide all labor, management, configuration, supervision, and other resources necessary to support all technologies and systems managed by OIS.

f) Provide proactive and scheduled monitoring of infrastructure, technologies, and systems.

g) Perform the full lifecycle of Government-furnished technologies and systems including management, refresh, patch, update, deploy, provision, setup, test, retrieve, store, and catalog.

TASK 7: Surge Support Mission needs combined with available funding may evolve as the contracted work is executed. At times additional hours and support may be needed within the overall scope of the Task. The Government may exercise increased hours for a specified labor category to provide additional support to meet the government's needs. This additional support will be temporary in nature and would only extend to end of the contract period.

The government has the option to increase the volume of hours under this contract for increased or surges in support. The Government may require increase or decrease of support during the base or any option period. Any increase or surge modifications will be in-scope (no "new" work) to provide increased support for the defined task areas of the performance work statement. Surge support is OPTIONAL and is not a guarantee. If the Government determines that an increased quantity of support is required for the task areas defined in the Performance Work Statement, the Government reserves the right to exercise all or part of the Surge Option. Surge hours are dependent on available funding and mission needs.