FA 4_Cybersecurity Governance Risk Compliance Support Services_DRAFT PWS.pdf

Cybersecurity Governance, Risk, and Compliance Support Services FA 4 DRAFT PWS

U.S. Department of Health and Human Services Office of the Chief Information Officer

Cybersecurity Governance, Risk, and Compliance Support Services –

Functional Area 4 DRAFT Performance Work Statement

Sources Sought Notice 75P00120R00010

Cybersecurity Governance, Risk, and Compliance Support Services Functional Area Scope

Activities under this performance work statement are carried out within two separate groups.

The OIS Governance, Risk and Compliance Division establishes cybersecurity strategies for the entirety of the HHS enterprise. The Division establishes and maintains strategies for ensuring compliance with guiding cybersecurity laws and mandates; measures and reports compliance with cybersecurity requirements; ensures HHS maintains a risk posture within established risk tolerances; manages cybersecurity risk effectively; develops cybersecurity policies, processes, standards and guidance; and deploys training awareness and engagement strategies and materials to ensure all HHS employees are knowledgeable in the ways to protect against cybersecurity threats and vulnerabilities.

In contrast to the strategy and guidance role of OIS GRC, the Office of the Secretary’s (OS) Cybersecurity Division is more operationally and tactically focused. As OIS establishes cybersecurity strategies to communicate and guide compliance across the HHS enterprise, OS Cybersecurity works in conjunction with OS GRC to support the OIS GRC strategies through the implementation of OS specific programs that serve to drive progress towards meeting overall HHS compliance objectives.

The OS Cybersecurity Program, supports 14 Staff Divisions and is made up of a wide-variety of compliance-related components. These components support the Staff Divisions in the areas of cybersecurity compliance (Ex: Ensures systems within the OS environment are properly documented and are authorized to operate), vulnerability/risk management (Ex: Identifies, tracks and drives progress towards the mitigation of risk consistent with the risk tolerance of the OS environment), OS security incident management (Ex: Captures cyber incidents and manages incidents from inception to closure), and includes various Staff Division forums that establish ongoing communication, innovation and collaboration across the organization (Ex: Staff Division Liaison Program, ISSO Collaboration Forum, Data Guardian Program, etc.) . In addition, OS Cybersecurity also supports OS specific policy (Ex:

Translating Departmental policies into OS-specific requirements), process, standards, and guidance development, as well as, support of all OS specific training and awareness activities (Ex: Tracking OS training compliance and Development and execution of ISSO Role-Based Training).

The Contractor shall provide Cybersecurity Strategy, Policy, Process, Governance, Compliance, and Risk Management Support Services to effectively administer, manage, and perform the duties and responsibilities as defined in this Task PWS.

The scope of work under this PWS includes the following tasks:

1. Task Transition Management

2. Task Management

3. Enterprise and OS Cybersecurity Governance Management and OS Cyber Policy Management

4. Enterprise and OS Cybersecurity Risk Management

5. Enterprise and OS Cybersecurity Compliance and OS Vulnerability Management

6. OS Cybersecurity Data Guardian and Training Management

7. Technologies/Systems

8. Surge Support

Regulatory References (not all inclusive)

• HHS Policy for Information Technology (IT) Enterprise Performance Lifecycle Management (EPLC): https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf

• The Federal Information Technology Acquisition Reform Act (FITARA):

https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D

• OMB Memo M-15-14: Management and Oversight of Federal Information Technology:

https://management.cio.gov/implementation/

• National Institute of Standards and Technology (NIST) Cybersecurity Framework:

https://www.nist.gov/cyberframework

• he Federal Risk and Authorization Management Program (FedRAMP): https://www.fedramp.gov/

• Federal Architectures Framework (FAEF 2.0):

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2

• OMB Circular A-130:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf

• HHS Cybersecurity Overview:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html

• Executive Orders 13636 and 13691, PPD-21:

o EO 13636: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity o EO 13691: https://obamawhitehouse.archives.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari o PPD-21: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil

• National Initiative for Cybersecurity Education (NICE) Workforce Framework:

https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework

• Security Technical Implementation Guides (STIGs): https://iase.disa.mil/stigs/Pages/index.aspx

• Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and

Critical Infrastructure: https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure

• NIST 800-37: Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy: https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2

• Special Publication 800-79-2, Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) has been approved as final:

https://csrc.nist.gov/News/2015/SP-800-79-2,-Guidelines-for-the-Authorization-of-P

• OMB Circular A-123: Management’s Responsibility for Enterprise Risk Management and Internal Control:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf

• DHS Binding Operational Directive (BOD) 18-02 - Securing High Value Assets:

https://cyber.dhs.gov/bod/18-02/

• Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure: Executive Order 13800: https://www.whitehouse.gov/presidential-https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D https://management.cio.gov/implementation/ https://www.nist.gov/cyberframework https://www.fedramp.gov/ https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://iase.disa.mil/stigs/Pages/index.aspx https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://csrc.nist.gov/News/2015/SP-800-79-2,-Guidelines-for-the-Authorization-of-P https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf https://cyber.dhs.gov/bod/18-02/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/

• Federal Continuity Directives FCD-1: https://www.fema.gov/media-library/assets/documents/86284

• Federal Continuity Directives FCD-2: https://www.fema.gov/media-library/assets/documents/132803

• Presidential Continuity Directive 40: https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf

TASK 1: TRANSITION

The Contractor will oversee all Transition-related work streams including, but not limited to:

a. Assume responsibility for the various areas of support from incumbent contractors currently providing the following services:

i. Program Management Support

ii. Project Management Support

b. Complete transition in accordance with the proposed transition plan for all areas of support within 60 days from award.

TASK 2: TASK MANAGEMENT

The Contractor shall be responsible for the effective management and administration of the resulting Task, ensuring that all work activities associated with tasks or projects are performed in a timely and cost effective manner while maintaining the highest quality of performance.

The Contractor Shall:

a. Ensure that the cross-functional areas of support are managed in a manner that achieves the objectives identified in the Objectives Section.

b. Develop and execute a Task Management Plan that reflects the interdependencies of the various staffing areas. Task Management Plan elements include, but are not limited to:

i. Team organization and management to include a staffing plan, staff training, and management of staffing changes. The staffing plan must address Key Personnel positions and the process for overseeing, controlling, and delivering required services under the Task;

ii. Management and control of a Work Breakdown Structure (WBS), schedules, cost, and

iii. Task requirements;

iv. Reporting, documenting, and managing problems, changes, risks, mitigation plans, and recommendations;

v. Communication and escalation procedures, general operating procedures, transition plans, and any additional information the contractor deems relevant;

and

vi. Task deliverables and acceptance process, distribution lists, format, and schedules for Government review and acceptance.

c. Work closely with the Agency staff to develop information to be included in the Draft Task Management Plan.

d. Submit a Draft Task Management Plan within fifteen (15) business days after award https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.fema.gov/media-library/assets/documents/86284 https://www.fema.gov/media-library/assets/documents/86284 https://www.fema.gov/media-library/assets/documents/132803 https://www.fema.gov/media-library/assets/documents/132803 https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf and a final Plan is due ten (10) days after receipt of OIS feedback.

e. Conduct a quarterly review for changes must also be performed with revisions due by the 15th day after each quarter ends.

f. Meet with the Government COR within ten (I0) business days after award to establish a review process for the Performance Requirements Summary (PRS) to be implemented by the second month of the contract.

g. Provide a final approved review process incorporated into the Quality Assurance Plan (QAP) and Task Management Plan with quarterly reporting established.

h. Provide a schedule for development and implementation approved by the COR.

i. Provide a draft QAP within fifteen (15) business days after award and a final QAP is due ten (10) business days after of receipt of OIS feedback. QAP elements include, but are not limited to: addressing how the contractor will ensure the objectives of the Task will be met as well as methodologies for correction of deviations and the records to be kept for inspections.

j. Conduct a quarterly review for changes that may impact the QAP must also be performed and submitted with the updated Task Management Plan by the fifteenth (15th) of the month following the end of each quarter.

k. Deliver a monthly Task Performance Report (TOPR) that provides valid and timely program status information to the designated OIS point(s) of contact no later than the 10th business day of each month for the prior month. The TOPR shall include the following:

i. Work performed during the reporting period including: accomplishments, problems/issues, key decisions with impacts, and recommendations for corrections;

ii. Work to be accomplished during the next reporting period;

iii. Ad hoc information on project status on an as-needed basis;

iv. Any issues that may occur during project implementation, to include external dependencies;

v. Performance measurements against PRS; and

vi. Staffing list, organizational chart, and vacancy status.

l. Prepare and maintain a Funds and Expenditure Report (F &E) to include, at a minimum: CLIN, SubCLIN (where applicable), labor category, personnel charging, hours, expenditures, current period and cumulative totals, funding amount, remaining balance, estimate to complete by month and estimate at completion.

m. Prepare and maintain an F&E in a format that is approved by the Government.

n. Develop an F&E report with elements that include, but are not limited to: show total contract value, total expended and variance analysis from the prior month's estimates, utilizing planned value and/or forecasting amounts against actual monthly expenditures for analyses.

o. Develop an F&E report structure that ties to a CLIN and SubCLIN and/or WBS elements where applicable for the given Task.

p. Submit an F&E report to the Contracting Officer Representative (COR) electronically by the 10th business day of each month for the prior month.

q. Provide the Government with options at every phase and/or critical milestone in a project and ensure Federal staff make all final project decisions.

r. Forecast decisions required decision making for Federal staff.

s. Determine actions that can be performed by contractor employees to ensure their discretionary decisions remain subject to Government oversight and final approval.

t. Address issues in advance and ensure conclusions are reflected in the contract by the contractor’s administration.

u. Ensure that contractor employees are properly identified in email communications, teleconference calls, and in meetings so that all participants can differentiate between Federal employees and contractors.

TASK 3: Cybersecurity Governance Management Support Services The HHS Office of Information Security (OIS) Governance Branch oversees the functions of both the Cybersecurity Policy Team and Awareness and Training Team. Both teams have specific functional areas and responsibilities for ensuring HHS information and information technology (IT) assets are appropriately secure and compliant with federal regulations and industry-best security practices. The Governance Branch is the focal point of the Department to communicate mandatory cybersecurity policy and training & awareness requirements to HHS and the Operating Divisions (OpDivs) relevant stakeholders via designated policy/training points of contact provided by OpDivs.

3.1 Cybersecurity Governance: Policy Branch Support Services: The Office of Information Security (OIS) Governance Branch Policy Team is tasked with developing and managing all Department cybersecurity policies, standards, memoranda and other guidance. These documents provide the baseline security requirements and mandates for HHS and its Operating Divisions (OpDivs) to secure HHS information and information technology (IT) assets in compliance with federal laws, regulations and guidelines. Most documents go through a formal review process that includes Department and OpDiv stakeholders prior to finalizing the documents. In addition, selected policies require Office of the General Counsel (OGC), Office for Civil Rights (OCR) and/or National Treasures Employees Union (NTEU) clearance. All review comments are adjudicated prior to finalizing the documents. Upon approval, all documents are reviewed for 508 compliance prior to publishing on the HHS Intranet site and dissemination to OpDivs.

3.2 OS Cybersecurity provides support and guidance to the OS Staff Division to ensure proper interpretation, guidance, and implementation of both HHS and OS specific policy. OS supports their Staff Divisions in the practical application within their respective operations and development of

3.2.1 Enterprise Policy Development and Maintenance: The Contractor shall:

a. Develop and maintain cybersecurity policies, standards, guidance and memoranda from initiation to publication and ensure documents are written in accordance with HHS and industry writing standards and guidelines.

b. Identify and analyze existing, new and emerging federal cybersecurity and IT requirements, best practices and emerging technology threats.

c. Coordinate development and review with all required stakeholders

d. Develop and maintain a comprehensive policy development and review process to include but not limited to:

i. Maintain existing Policy Lifecycle;

ii. Develop and maintain Work Breakdown Structure (WBS);

iii. Develop and maintain templates and other supporting documentation;

and

iv. Collaborate with OCIO policy team and ensure templates are compliant with OCIO requirements.

3.2.1.1 Enterprise Policy Metrics and Reporting: The

Contractor shall:

e. Prepare status reports, metrics, policy updates, and ad-hoc reports as requested by federal lead.

f. Maintain a policy tracker to track all policy projects that incorporates milestones and completion dates for each project and milestone(s).

g. Prepare monthly dashboards.

3.2.1.2 Enterprise Policy Customer Service and Meeting

Support: The Contractor shall:

a. Provide prompt and effective customer service to OpDivs and internal HHS customers.

b. Assess HHS and OpDiv inquiries and determine the most effective way to respond and answer question(s) in alignment with HHS policies, standards and guidance.

c. Maintain and socialize standard templates and administer the workflow associated with a collaborative review process.

d. Maintain knowledge of HHS policies, standards and guidelines, and other HHS baseline requirements.

e. Review federal and industry documents to ensure HHS is in compliance;

f. Review HHS policies and other documentation to ensure compliance with cybersecurity policies and reduce duplication of policies.

g. Monitor department-level mailboxes and ensure inquiries are addressed in a timely manner.

h. Assist Policy Lead with meeting management and coordination.

i. Attend relevant meetings and other working groups to ensure the HHS community is aware of upcoming policy related requirements.

3.2.1.3 Enterprise Policy Training: The Contractor shall:

a. Assist the HHS workforce in disseminating and understanding the specific requirements of published, revised, or amended policies, standards, and guidance.

b. Develop and tailor training courses on selected policies and standards to the specific user base and/or topic. These training courses allow for better communication between the policy team, SMEs, and those most impacted by the implementation of these new or amended policy/standard requirements.

c. Review and test cybersecurity awareness training and other materials and provide prompt feedback.

3.2.1.4 Enterprise Governance Tool Management and

Communications: The Contractor shall:

b. Maintain the OMB MAX Policy Collaboration Portal used for fostering collaboration and information sharing among the Department and OpDivs.

c. Assist in the development, testing, implementation and maintenance of the Security Governance Risk and Compliance (SGRC) Policy Module and ensure content and requirements are accurate and current. These include but not limited to:

i. Define requirements, test modules, and assist in the implementation of

Policy Module and other modules as needed.

ii. Populate and maintain current cybersecurity policies, standards, procedures, and guidelines in SGRC tool.

d. In conjunction with the Policy Lead and OCIO, coordinate policy review and approval activities with policy POCs and other relevant stakeholders.

e. Notify OpDivs and internal stakeholders of changes to policies, standards and guidance.

3.2.2 Enterprise Cybersecurity Governance: Awareness and Training Branch Support Services:

The HHS Cybersecurity Governance Branch Training and Awareness Team works to reduce risks from cybersecurity threats to HHS information and Information systems and to reduce the number of HHS cybersecurity incidents by educating and empowering employees and contractors to employ cybersecurity best practices and comply with HHS policy and FISMA. The Cybersecurity Awareness Branch successfully completes its mission by promoting both HHS policy and FISMA compliance through cybersecurity awareness activities across HHS Operating Divisions. Cybersecurity activities conducted to complete our mission include posters and articles on cybersecurity policy and best practices, in-person and computer-based cybersecurity awareness training sessions, and ethical phishing exercises. Training and Awareness increases cybersecurity communications, awareness, response, and education by providing HHS staff with useful information, tips, and strategies to become cybersecurity guardians. This Function also increases interactive computer-based training that addresses cybersecurity threats and privacy concerns specific to HHS’ environment.

3.2.2.1 Instructional Systems Design (Training Courses): The

Contractor shall develop, design, and produce Section 508 compliant training courses in HHS LMS-compatible and HHS Intranet/Internet format; produce two trainings per year to include but not limited to HHS Cybersecurity Awareness, Role Based Training ((Essentials, Managers, Executives and Administrators), and ad-hoc Cybersecurity Awareness trainings.

3.2.2.2 Statistical Reporting: The Contractor shall:

a. Develop and execute communications

b. Tracking metrics

c. Direct outreach to support Cybersecurity Awareness initiatives such as

CyberCARE, Healthy Technology, National Cybersecurity Awareness Month, and Ethical Phishing requirements, goals, and activities

d. Conduct surveys and compile results in reporting format

3.2.2.3 Training Awareness, Policy, and Procedure

Management: The Contractor shall:

a. Provide subject matter expertise to support the updating or development of training and awareness policies, manuals, memoranda, and guidance

b. Support OIS awareness initiatives and events to include but not limited to

Healthy Technology and CyberCARE

c. Provide support to the Ethical Phishing program to include but not limited to:

communications, scenario setup, launch, report analysis, and production.

TASK 4: Enterprise Cybersecurity Risk Management Support Services

4.1 Enterprise Cybersecurity Risk Management, Enterprise Risk Management (ERM), and A-123:

The mission of the Cybersecurity Risk Management Program is to maintain a program that continually provides situational awareness of HHS’ risk posture by effectively identifying, assessing, remediating, and monitoring HHS privacy and security risks and integrate the cybersecurity risk management program into HHS’ enterprise-wide risk management (ERM) framework, which includes managing risks as a Sector-Specific Agency for the Healthcare and Public Health (HPH) sector. HHS cybersecurity risk management activities and partnerships are based on numerous laws and mandates, including but not limited to, Executive Order 13800, Cybersecurity Act of 2015, FISMA, Executive Orders 13636 and 13691, PPD-21; contractor knowledge and expertise on said laws, mandates, legislation preferred.

The Contractor shall:

a. Provide strategic consulting expertise to ensure continued integration of cybersecurity into enterprise planning, budget discussions, and enterprise risk management efforts, including HPH sector critical infrastructure security and resiliency programs.

b. Review new and existing agency policies and strategic plans; identify impacts and needed updates, maintaining consistency with HHS ERM-specific mission, goals, objectives, risk profile and portfolio to cybersecurity risk management policies and Sector-Specific Agency roles and responsibilities.

c. Possess knowledge and expertise of A-123 requirements including establishment of risk profiles and portfolios.

d. Provide expertise to support risk reporting and analytics utilizing the RSA Archer tool

4.1.1 Enterprise High Value Assets (HVA) Program: Project Management, Data Analysis, Policy and Systems Inventory Management: Maintains and refines established agency HVA policy, methodology, processes, procedures, frameworks, incorporating new and emerging federal laws, OMB requirements, and NIST guidance (including DHS BOD 18- 02, Executive Order 13800, NIST Cybersecurity Framework), while also accounting for best practices and emerging threats and technologies, and HHS-specific documents that address a variety of information security and privacy information, from HHS information security and privacy program policies, interim memos, subject-specific guidance and implementation standards. Preferred contractor knowledge and expertise with Mission Essential Functions and National Essential Functions relevant to Federal Continuity Directives (FCD-1, FCD-2) and Presidential Continuity Directive-40.

The Contractor shall:

a. Maintain existing HHS HVA policies, memoranda and standards.

b. Identify and analyze new and emerging requirements for policy impacts;

c. Develop new policies, procedures, methodologies, frameworks, memoranda or standards;

d. Regularly review and update existing policies, procedures, methodologies, frameworks, memoranda or standards

e. Support stakeholder engagements, communications, logistics, overall management of HVAs across HHS including development and maintenance of operational reporting and action trackers; and HVA inventory management.

f. Support overall strategic planning to ensure the HHS HVA Program meets its mission, vision, goals, and objectives.

g. Provide expert consulting on cybersecurity strategic and operational matters towards integration with HHS Enterprise Risk Management (ERM) Program and Framework and working towards providing cybersecurity information to make holistic, enterprise-wide risk based decisions.

h. Support management of HHS' HVA inventory including: HVA identification, prioritization, protection; development of or updates to methodologies for evaluating HVAs; and HVA reporting requirements consistent with federal laws, OMB and DHS requirements, NIST guidance, and agency-specific policies, frameworks, methodologies, and processes.

i. Support all HVA data call activities including data collection, consolidation, validation, analysis; OpDiv outreach to ensure completion of data call submissions; DHS liaising and engagement as needed. HVA Data Call analysis includes development of executive reporting, trending, graphs, gap analysis, and recommendations for improving security and resilience of HHS’ HVA landscape based on data collected. Use of automation as appropriate is preferred.

j. Provide HVA Program management and project management to support stakeholder engagements, communications, logistics, overall management including development and maintenance of operational reporting and action trackers; weekly, monthly, quarterly status meetings; monthly or quarterly.

4.1.2 Enterprise High Value Assets (HVA) Program: Evaluations and Security Assessments:

HHS HVA Evaluations are targeted assessments; high-level, strategic overview of the HVA’s risk posture using methods such as interviews with relevant stakeholders; review of SA&A program policies and procedures; and assessment utilizing DHS BOD 18-02 requirements, and the NIST Cybersecurity Framework.

The Contractor shall:

a. Perform HHS HVA evaluations based on established methodology. Adjust evaluation activity based on any relevant new and emerging federal laws, OMB and DHS requirements, and NIST guidance.

b. Produce a final report including observations and recommendations for implementing additional best practices and map these to the NIST Framework, NIST 800-53 current version, NIST RMF, and DHS' Risk and Vulnerability Assessments.

4.1.3 Enterprise Cloud Security & Federal Risk & Authorization Management Program (FedRAMP): The Federal Risk and Authorization Management Program (FedRAMP) is a mandatory government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. The purpose of the Department of Health and Human Services (HHS) Cloud Security Team (CST) is to provide FedRAMP and cloud security guidance to HHS Operating Divisions in support of FedRAMP and overall cloud security requirements, with the goal of managing risk and ensuring the security of HHS data in the cloud. FedRAMP support from the CST includes Cloud Service Provider (CSP) sponsorship and security authorization support, Continuous Monitoring, FedRAMP training, policy documentation, and training, as appropriate.

The Contractor shall:

a. Maintain and refine established agency cloud and FedRAMP policy, methodology, processes, procedures, frameworks, incorporating new and emerging federal laws, OMB requirements, and NIST guidance, while also accounting for best practices and emerging threats and technologies, and HHS-specific documents that address a variety of information security and privacy information, from HHS information security and privacy program policies, interim memos, subject-specific guidance and implementation standards.

b. Maintain existing HHS cloud and FedRAMP policies, SOPs, memoranda and standards.

c. Identify and analyze new and emerging requirements for policy impacts.

d. Develop new policies, procedures, methodologies, frameworks, memoranda or standards.

e. Regularly review and update existing policies, procedures, methodologies, frameworks, templates, memoranda or standards

f. Provide cloud and FedRAMP program and project management to support stakeholder engagements, communications, logistics, overall management including development and maintenance of operational reporting and action trackers; weekly, monthly, quarterly status meetings; monthly or quarterly

g. Create and maintain OpDiv information or training sessions, metrics development and tracking, and overall strategic planning to ensure the HHS Cloud and FedRAMP Program meets its vision, mission, goals, and objectives.

h. Provide expert consulting on cybersecurity strategic and operational matters towards integration with HHS’ Enterprise Risk Management (ERM) Program and Framework and working towards providing information to make holistic, enterprise-wide risk based decisions.

i. Support the HHS Cloud Security Team (CST) which provides FedRAMP and cloud security guidance to HHS Operating Divisions in support of FedRAMP and overall cloud security requirements, with the goal of managing risk and ensuring the security of HHS data in the cloud. FedRAMP support from the CST includes Cloud Service Provider (CSP) sponsorship and security authorization support, Continuous Monitoring, FedRAMP training, and policy documentation, as appropriate.

j. Support all operations related to FedRAMP assessments within HHS including:

1. Developing project plans and milestones for assessment reviews and all

FedRAMP related activities.

2. Managing and facilitation of the HHS Cloud Security Working Group.

3. Facilitating meetings, to include taking notes and providing summaries, with OpDivs, Cloud Service Providers, CSPs, and other external parties or agencies, as appropriate.

4. Developing policy, guidance, documents, templates, and procedures to support FedRAMP

5. Performing assessments and Continuous Monitoring reviews and providing issues lists, reports on findings, and ATO recommendations

6. Meeting the CSPs on a monthly basis as part of the continuous monitoring process

7. Working with OpDivs to assist their FedRAMP assessment efforts;

monitoring and responding to cloud security and FedRAMP related inquiries sent to the HHS FedRAMP Mailbox

8. Providing status reporting to OIS leadership as part of the Project Management Reviews, in addition to weekly status reporting and a monthly CSP risk dashboard

9. Supporting cloud security research efforts within HHS

10. Providing cloud security data in response to data calls from the Office of

Inspector General (OIG), Government Accounting Office (GAO), the FedRAMP PMO and OMB

11. Providing training and giving presentations on cloud security and the FedRAMP process

12. Ongoing Stakeholder Engagements internal and external to HHS

k. Support assessments and Continuous Monitoring reviews and provide issues lists, reports on findings, and ATO recommendations.

l. Support the HHS CST with FedRAMP compliant assessments, including annual assessments of cloud computing systems at the Department level.

CSPs authorized by the CST are authorized for use by all HHS OpDivs.

Contractor support includes assessment of cloud systems using HHS’ multi-phased process and any subsequent updates to the process.

m. Provide support for Cloud Access Security Broker (CASB) activities including use of a CASB tool/solution to conduct analytics and develop reports for cloud usage, cloud risk, cloud inventory; develop metrics and tracking.

TASK 5: Enterprise Cybersecurity Compliance and OS Vulnerability Management Support Services

Compliance and Vulnerability Enterprise Services: HHS is charged with ensuring that all HHS OpDivs under its purview comply with the mandates outlined by FISMA. In compliance with such mandates, the Department leads several initiatives to ensure that the OpDivs report their organization’s security and privacy posture in an accurate, timely, and consistent manner. The HHS OIS Enterprise Compliance Team has ongoing activities that are required to be performed on a daily, monthly, quarterly and annual basis as mandated by OMB through FISMA. The Contractor shall provide OIS Cybersecurity Compliance Management and OS Cybersecurity Vulnerability Management support services to effectively administer, manage, and perform the duties and responsibilities as defined in this Task.

Enterprise FISMA - Data Collection and Analysis Support Services: The Contractor shall:

a. Analyze the Department of Homeland Security (DHS) Chief Information Officer (CIO) FISMA metrics

b. Facilitate the monthly HHS FISMA working group meetings with OpDivs

c. Collect and analyze the FISMA data submitted by OpDivs and HHS

Department Point of Contacts (POCs)

d. Coordinate with the HHS Federal Information Technology Acquisition

Reform Act (FITARA) team, Enterprise Architecture (EA), Policy, Enterprise Performance Lifecycle (EPLC), and Capital Planning and Investment Control (CPIC) teams to ensure all FISMA requirements are in alignment

e. Analyze and interpret DHS/Office of Management and Budget (OMB) Fiscal Year (FY) CIO FISMA metrics

f. Review and analyze OpDiv submitted FISMA metrics

g. Analyze and consolidate the OpDivs’ reporting templates

h. Support the creation of the annual FISMA report which includes the CIO, Senior Agency Official for Privacy (SAOP), and Inspector General (IG) reports

i. Coordinate the development of the SAOP report with the HHS Privacy Team

ii. Review and provide feedback on the draft OIG report to the HHS OIG

iii. Manage the approval of the annual FISMA report by the HHS OCIO, Assistant Secretary of Administration (ASA), and Secretary and submit the HHS Annual FISMA package to DHS/OMB

i. Provide policy support for both the HHS enterprise and OS levels; analyze existing policies and provide recommendations

j. Communicate OMB and National Institute for Standards and Technology (NIST) guidance to all HHS stakeholders in a timely manner

k. Monitor the Cybersecurity mailbox and provide timely responses to all inquiries

l. Support OS Vulnerability Management providing OS stakeholders/StaffDivs with policy, OMB and NIST guidance and recommendations

m. Monitor the FISMA mailbox and provide timely responses to all inquiries;

examples include but are not limited to OMB/DHS reporting requirements and ad-hoc inquiries, copies of HHS Department policies, and HHS guidance on FISMA metrics

n. Provide FISMA support to OS Cybersecurity in the areas of:

i. FISMA related data calls and reporting

ii. Assistance with the aggregation, consolidation and analysis of all OS FISMA data

Enterprise FISMA - Support and Analysis Support Services: The OIS Cybersecurity Compliance team is the Department’s FISMA audit liaison. Primary function is to manage the annual FISMA Office of Inspector General (OIG) audit at the Department and OpDivs. The Contractor shall:

a. Prepare and educate Department and OpDiv stakeholders for audits (i.e.

FISMA)

b. Coordinate all audit activities to ensure prompt and accurate communication and submission of evidence

c. Maintain accurate records on the status of all audit reports, recommendations, and remediation

d. Provided analysis of audit recommendations, resolution, and corrective action

e. Provided department-wide audit trends and recommend solutions

f. Support and justify reasoning for not concurring with audit findings or recommendations (as applicable)

g. Coordinate resolution and corrective action on recommendations involving the Department and OpDivs

h. Attend all audit meetings

i. Review all OpDiv and Department audit Maturity Models

j. Collect all the Department audit artifacts and fulfill the Client Assistance List

(CAL) requests

k. Facilitate al Department audit walkthroughs (meetings) with OIG and the

Department POCs

l. Review all OpDiv and Department Objective Attributes Recap Sheet (OARS)

m. Develop management responses for the Department OARS

n. Review draft and final annual FISMA OIG audit reports

o. Review and respond to Department OIG Clearance Document (OCD) requests

p. Provide analysis of all OpDiv and Department FISMA audit findings

q. Monitor remediation throughout the year for tracking

HHS Security Data Warehouse (HSDW) - Security Governance Risk and Compliance (SGRC) Support Services:

a. Provide training, assistance, and technical support to HHS and OpDiv Privacy teams during the process of Privacy Threshold Analysis (PTA), Privacy Impact Assessment (PIA), and Third Party Web Application (TPWA) creation in the Privacy web-based tool in HSDW

b. Customize the Privacy web-based tool based on requirements from the HHS Privacy team

c. Monitor HSDW_Support mailbox and address Privacy requests within 24 hours

d. Support and provide ad-hoc HSDW reporting to allow a near real-time understanding of the Department’s security posture. Ensure the HSDW security authorization documentation and Authority to Operate (ATO) are current, identifying and correcting potential and actual vulnerabilities

e. Maintain security and operations documentation to include but not limited to System Security Plans (SSP), Information System Contingency Plans, Plans of Action and Milestones (POA&Ms), operations manuals, and Standard Operating Procedures (SOPs)

f. Provide user support, training, and outreach to the HSDW user community on an ongoing and ad-hoc basis as needed

g. Coordinate with OCIO stakeholders to ensure all user requirements are identified and considered within the system, and that HSDW and other OCIO systems have the ability to share data as needed

h. Perform annual updates to the System Security Plans (SSP), System Contingency Plans (SCP), and Security Controls Assessment (SCA)

i. Perform Table Top exercises.

j. Analyze policies and provide recommendations

Enterprise Security Governance Risk and Compliance (SGRC) / Archer: The Contractor shall:

a. Support the development of Department level documentation to include but not limited to users guides, policy guides, change management plans, lexicons, process maps, training plans, system administration documents, templates, reports, dashboards, policies, procedures, and strategic planning documents

b. Facilitate discussions among SGRC/Archer stakeholders throughout HHS to identify business requirements, document the requirements and submit those requirements to the responsible parties for implementation into the application

c. Recommend change requests when gaps, areas of improvement, or new requirements are identified for the betterment of the application.

d. Participate in management’s oversight and evaluation of application change requests and advice on the impacts of doing such changes

e. Manage the process of data collection/imports from the OpDivs and disseminate summary reports from SGRC/Archer to HHS leadership and other agency stakeholders

5.1.1 OS Security Compliance and OS Vulnerability and Risk Management services to the Office of the Secretary: The Contractor will provide support for OS Cybersecurity contributing to the oversight of all OS Cybersecurity-related work streams including, but not limited to OS Security Compliance, OS Policy, OS Vulnerability Management, OS Incident Management and OS Staff Division collaboration, coalition building, and awareness programs that support all OS Cybersecurity initiatives that drive progress towards a strong security posture and overall compliance. Support includes assistance in the development, facilitation, and management and OS Cybersecurity programs that protect the confidentiality, integrity, availability, authenticity and non-repudiation of OS information and information systems, through the implementation of the risk management framework.

The contractor will support the following services:

OS Security Compliance Management & Vulnerability Management: Authority to Operate (ATO) for OS Systems. The Contractor shall:

f. Review document life cycle and ensure all Information System Security Officers (ISSOs) and System Owners (SOs) are managing the documents the same

g. Assist in the implementation of any ATO process changes or innovations

h. Proactively assist in the early engagement of stakeholders to initiate the ATO process and drive progress throughout the process to assist stakeholders in meeting their ATO deadlines

i. Assist in the Comprehensive Risk Review/Technical Review of ATO package

1. Conduct IV&V of package

j. Provide ongoing customer support and feedback throughout each stage of the OS ATO process

k. Assist ISSOs/SOs with documentation as needed

l. Prepare Authorizing Official (AO) memos

m. Process ATO and Interim Authorization to Test (IATT) packages

n. Review ATO packages and engage with relevant stakeholders and ISSOs/SOs as needed

o. Assist in updating tracking tools, and managing “real time” updates to reflect current state of ATO status.

p. Assist in the final preparation of packages for management review and approval

OS Compliance Management: Interconnection Security Agreement (ISA) and Memorandum of Understanding (MOU) for OS Systems. The Contractor shall:

a. Conduct ISA/MOU Processing

b. Review overall ISA/MOU requests and follow-up with ISSOs/SOs as needed

1. When necessary, conduct comprehensive risk review of ISA/MOU

c. Route ISA/MOU requests for management review and approval

OS Compliance and Vulnerability Management Support: Security Governance Risk and Compliance (sGRC) for OS Systems: The Contractor shall:

a. Ensure timely updates and management of systems and users within the authorized FISMA data repository.

b. Provide real-time updates and manage systems and users once RMFP is transitioned to RSA Archer

c. Add/remove users and troubleshoot user issues with RMFP/RSA Archer

d. Facilitate system training for RMFP/RSA Archer

e. Other RMFP/RSA Archer tasks as assigned, including but not limited to managing permissions and uploading Plan of Action and Milestones (POA&Ms)

f. Using RMFP/ or / RSA Archer, develop, and manage requested reports, dashboards and metrics of OS systems for all OS Cybersecurity Managers

g. Assist OS Vulnerability Management in providing mitigation consultations as well as visibility into, and the tracking of mitigation activities.

h. Assist OS Vulnerability Management in the implementation and support of the OS Temporary Exception/Risk Acceptance process as for all OS systems

i. Support OS Vulnerability Management in all data calls and other OS-wide requests for information and reporting

j. Monitor OS VRMT Mailbox, and OS Cybersecurity and support the goal of responding to inquiries within 48 hours

k. Assist OS Security Compliance and Vulnerability Management in activities related to FISMA quarterly and annual quarterly reporting

5.5.2.4. OS Cybersecurity Policy: The OS Cybersecurity Division includes a Policy component that has functional areas of responsibility to ensure that IT systems are appropriately secure and compliant with federal regulations, and cybersecurity industry best practices. OS Cybersecurity utilizes each of its branches to disseminate information and to communicate and ensure proper HHS and OS specific policy is being implemented. The Contractor shall:

a. Support the OS Cybersecurity Policy component to develop and manage all OS Cybersecurity polices, standards, memoranda and other guidance documents.

These documents provide clarification to support HHS/OS security requirements and mandates applicable to the OS Staff Divisions to secure all OS information and information systems.

i. Develop and maintain cybersecurity policies, standards, guidance and memoranda and initiation and ensure that documents are written in accordance with HHS standards.

ii. Identify and analyze existing new and emerging federal cybersecurity and IT requirements best practices and emerging federal cybersecurity and IT requirements, best practices and emerging technology threats.

iii. Develop and maintain cybersecurity policies, standards, guidance and memoranda from initiation to publication and ensure documents are written in accordance with HHS and industry writing standards and guidelines.

iv. Identify and analyze existing, new and emerging federal cybersecurity and IT requirements, best practices and emerging technology threats.

v. Coordinate development and review with all required stakeholders

vi. Develop and maintain a comprehensive OS policy development and review process to include but not limited to:

a. Maintain existing Policy Lifecycle;

b. Develop and maintain Work Breakdown Structure (WBS);

c. Develop and maintain templates and other supporting documentation; and

vii. Collaborate with the HHS GRC policy team and ensure templates are compliant with HHS requirements.

b. OS Policy Metrics and Reporting: The Contractor shall:

h. Prepare status reports, metrics, policy updates, and ad-hoc reports as requested by federal lead.

i. Maintain a policy tracker to track all policy projects that incorporates milestones and completion dates for each project and milestone(s).

j. Assess OS cyber policy inquiries and determine the most effective way to respond and answer question(s) in alignment with HHS and/or OS policies, standards and guidance.

k. Review HHS, federal and industry documents to ensure OS StaffDivs is in compliance;

l. Review HHS policies and other documentation to identify OS policy gaps and ensure compliance with cybersecurity policies and reduce duplication of policies.

m. Assist Policy Lead with meeting management and coordination.

n. Attend relevant meetings and other working groups to ensure the HHS /OS

StaffDiv community is aware of upcoming policy related requirements.

1. OS Policy Training: The Contractor shall:

d. Assist OS Cybersecurity in disseminating and understanding the specific requirements of published, revised, or amended policies, standards, and guidance.

e. Develop and tailor training courses on selected policies and standards to the specific user base and/or topic. These training courses allow for better communication between the policy team, SMEs, and those most impacted by the implementation of these new or amended policy/standard requirements.

f. Review all HHS and OS cybersecurity awareness training and other materials and provide prompt feedback from an OS Cybersecurity perspective.

1. OS Cybersecurity Policy tool management and communications: The

Contractor shall:

a. Access the OMB MAX Policy collaboration portal to participate in information sharing with the Department and other HHS OpDivs.

g. Assist the OS Policy Lead to coordinate policy review and approval activities with policy HHS POCs and other relevant stakeholders.

h. Notify all OS StaffDivs and internal stakeholders of changes to policies, standards and guidance.

TASK 6: OS Cybersecurity Data Guardian and Training Management Support Services

5.1.2 OS Data Guardian: In 2019, OS Cybersecurity implemented the OS Data Guardian

Program. This program was established to provide a transparent, collaborative, innovative forum in which all OS StaffDivs can work together to solve problems and share ideas, to improve the overall security posture of the organization. Although the OS Cybersecurity Data Guardian Program is modeled after the Data Guardian Program at the Centers for Medicare & Medicaid Services (CMS), it has been specifically tailored to meet the needs of the OS Staff Divisions.

The Contractor shall:

a. Assist in the ongoing coordination of all Data…