FA 6_Cybersecurity Program and Engagement Support Services_DRAFT PWS.pdf

U.S. Department of Health and Human Services Office of the Chief Information Officer

Cybersecurity Program and Engagement Support Services – Functional Area 6

Performance Work Statement

Sources Sought Notice 75P00120R00010

Cybersecurity Program and Engagement Support Services Functional Area Scope

The objective of this Task is to consolidate services and activity to eliminate redundancies, streamline processes, and implement EPLC, FITARA, 405D, into a strategic plan through program and portfolio management standards ensuring continuity across the management of OIS. The OIS objective for cybersecurity investments is to leverage advances in cybersecurity to more efficiently accomplish mission objectives with a focus on consolidation, flexibility to adjust and scale to a changing threat environment, and deliver cost effective solutions within available resources.

To achieve the objectives of a more efficient, stable, maturing, and secure environment the supporting organizations must also have the necessary tools, resources, workforce, and processes necessary to plan, implement, and manage cybersecurity projects, people, and systems. Therefore, OIS requires and integrated and standardized approach for the various support roles including process and project assessment, project execution, quality management plans, and compliance reporting and monitoring.

The contractor shall ensure OIS is positioned to leverage advances in cybersecurity and cybersecurity program support services to securely and efficiently resource and accomplish OIS mission objectives.

The contractor shall provide continuous awareness and expertise on program and project management of cybersecurity services. Performance Objectives include:

• Maintain OIS Portfolio of Services and Projects

• Maintain OIS Processes and Performance Standards

• Maintain and matrix legislation, directives, and mandates that pertain to the entire OIS Mission and Portfolio

• Promote OIS wide adherence to process and performance standards.

• Optimize performance and delivery of the OIS mission and its infrastructure.

• Identify and realize resource savings through organizational efficiencies and quality project management principals.

• Improve project execution to control and drive achievement of the OIS strategic and tactical plans.

• Communicate and promote cybersecurity and privacy awareness across the department and develop a culture of quality and cybersecurity innovation.

• Maintain an OIS Strategic Plan

• Maintain an OIS Tactical Plan.

• Support efficient and proper acquisition and resource planning for cybersecurity services and technologies.

• Provide consistent management practices across all OIS divisions and major programs

• Provide architecture and project management support for cybersecurity solutions.

The Contractor shall provide Cybersecurity Program Management and Communication support services to effectively administer, manage, and perform the duties and responsibilities as defined in this Task PWS. The scope of work under this PWS includes the following tasks:

The scope of work under this PWS includes the following tasks:

1. Task Transition Management

2. Task Management

3. Program Support; and

4. Communications and Strategy Management Support

5. Surge Support

Regulatory References (not all inclusive)

• HHS Policy for Information Technology (IT) Enterprise Performance Lifecycle Management (EPLC): https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf

• The Federal Information Technology Acquisition Reform Act (FITARA):

https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D

• OMB Memo M-15-14: Management and Oversight of Federal Information Technology:

https://management.cio.gov/implementation/

• National Institute of Standards and Technology (NIST) Cybersecurity Framework:

https://www.nist.gov/cyberframework

• he Federal Risk and Authorization Management Program (FedRAMP): https://www.fedramp.gov/

• Federal Architectures Framework (FAEF 2.0):

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2

• OMB Circular A-130:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf

• HHS Cybersecurity Overview:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html

• Executive Orders 13636 and 13691, PPD-21:

o EO 13636: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity o EO 13691: https://obamawhitehouse.archives.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari o PPD-21: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil

• National Initiative for Cybersecurity Education (NICE) Workforce Framework:

https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework

TASK 1: TRANSITION

The Contractor will oversee all Transition-related work streams including, but not limited to:

The Contractor Shall:

a. Assume responsibility for the various areas of support from incumbent contractors currently providing the following services:

i. Program Management Support

ii. Project Management Support

b. Complete transition in accordance with the proposed transition plan for all areas of support within 60 days from award.

https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D https://management.cio.gov/implementation/ https://www.nist.gov/cyberframework https://www.fedramp.gov/ https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework

TASK 2: TASK MANAGEMENT

The Contractor shall be responsible for the effective management and administration of the resulting Task, ensuring that all work activities associated with tasks or projects are performed in a timely and cost effective manner while maintaining the highest quality of performance.

The Contractor Shall:

a. Ensure that the cross-functional areas of support are managed in a manner that achieves the objectives identified in the Objectives Section.

b. Develop and execute a Task Management Plan that reflects the interdependencies of the various staffing areas. Task Management Plan elements include, but are not limited to:

i. Team organization and management to include a staffing plan, staff training, and management of staffing changes. The staffing plan must address Key Personnel positions and the process for overseeing, controlling, and delivering required services under the Task;

ii. Management and control of a Work Breakdown Structure (WBS), schedules, cost, and

iii. Task requirements;

iv. Reporting, documenting, and managing problems, changes, risks, mitigation plans, and recommendations;

v. Communication and escalation procedures, general operating procedures, transition plans, and any additional information the contractor deems relevant;

and

vi. Task deliverables and acceptance process, distribution lists, format, and schedules for Government review and acceptance.

c. Work closely with the Agency staff to develop information to be included in the Draft Task Management Plan.

d. Submit a Draft Task Management Plan within fifteen (15) business days after award and a final Plan is due ten (10) days after receipt of OIS feedback.

e. Conduct a quarterly review for changes must also be performed with revisions due by the 15th day after each quarter ends.

f. Meet with the Government COR within ten (I0) business days after award to establish a review process for the Performance Requirements Summary (PRS) to be implemented by the second month of the contract.

g. Provide a final approved review process incorporated into the Quality Assurance Plan (QAP) and Task Management Plan with quarterly reporting established.

h. Provide a schedule for development and implementation approved by the COR.

i. Provide a draft QAP within fifteen (15) business days after award and a final QAP is due ten

(10) business days after of receipt of OIS feedback. QAP elements include, but are not limited to: addressing how the contractor will ensure the objectives of the Task will be met as well as methodologies for correction of deviations and the records to be kept for inspections.

j. Conduct a quarterly review for changes that may impact the QAP must also be performed and submitted with the updated Task Management Plan by the fifteenth (15th) of the month following the end of each quarter.

k. Deliver a monthly Task Performance Report (TOPR) that provides valid and timely program status information to the designated OIS point(s) of contact no later than the 10th business day of each month for the prior month. The TOPR shall include the following:

i. Work performed during the reporting period including: accomplishments, problems/issues, key decisions with impacts, and recommendations for corrections;

ii. Work to be accomplished during the next reporting period;

iii. Ad hoc information on project status on an as-needed basis;

iv. Any issues that may occur during project implementation, to include external dependencies;

v. Performance measurements against PRS; and

vi. Staffing list, organizational chart, and vacancy status.

l. Prepare and maintain a Funds and Expenditure Report (F &E) to include, at a minimum:

CLIN, SubCLIN (where applicable), labor category, personnel charging, hours, expenditures, current period and cumulative totals, funding amount, remaining balance, estimate to complete by month and estimate at completion.

m. Prepare and maintain a F&E in a format that is approved by the Government.

n. Develop an F&E report with elements that include, but are not limited to: show total contract value, total expended and variance analysis from the prior month's estimates, utilizing planned value and/or forecasting amounts against actual monthly expenditures for analyses.

o. Develop an F&E report structure that ties to a CLIN and SubCLIN and/or WBS elements where applicable for the given Task.

p. Submit an F&E report to the Contracting Officer Representative (COR) electronically by the 10th business day of each month for the prior month.

q. Provide the Government with options at every phase and/or critical milestone in a project and ensure Federal staff make all final project decisions.

r. Forecast decisions required decision making for Federal staff.

s. Determine actions that can be performed by contractor employees to ensure their discretionary decisions remain subject to Government oversight and final approval.

t. Address issues in advance and ensure conclusions are reflected in the contract by the contractor’s administration.

u. Ensure that contractor employees are properly identified in email communications, teleconference calls, and in meetings so that all participants can differentiate between Federal employees and contractors.

TASK 3: CYBERSECURITY PROGRAM SUPPORT:

The Office of Information Security Business Operations division ensures the OCISO delivers quality and maturing cybersecurity services appropriately resourced with people, processes, and products. The division is tasked with providing Program Administration, Program and Project Management, Program Acquisition, and Program Finance support. The Business Operations Division ensures the OCISO has the necessary resources to execute the OCISO mission while providing leadership to drive maturing and quality services in accordance with federal mandates and legislation. The division seeks to drive maturing, streamlined, efficient, and maturing program, project, contract, financial, and administrative management enabling the OCISO to fully execute its cybersecurity mission. The Business Operations Division ensures the OCISO has adequate funding, workforce, and processes in place to ensure the OCISO is able to meet the overall mission objectives while driving forward with solutions and services appropriately developed. The Contractor will ensure a consistent, quality, and maturing support approach to management and reporting on the OIS portfolio of services. The Contractor will support the federal team to ensure activities are properly resourced, tracked, and reported on.

3.1 Program Acquisition: The Program Acquisition Branch support need provides general program procurement and acquisition support and quality assurance to OIS in the development of procurement packages for acquisition processing. These functions provide direct assistance to OIS procurement specialist in requirements gathering, acquisition narratives, business justifications, acquisition tracking and reporting. This support enhances the ability to deliver sound quality procurement packages for executive approvals and acquisition processing.

The Contractor shall:

a. Provide acquisition package development support for OIS systems and services.

b. Advise in the preparation of acquisition strategies, purchase request, packages, and documentation such as Performance Work Statements (PWS), Independent Government Cost Estimates (IGCEs), and Justification and Approvals (J&As).

c. Providing guidance and review of acquisition documentation, as submitted to ensure it meets or exceeds the Federal acquisition compliance level. Develop innovative approaches to review procurement process effectiveness and explore logistics solutions for customers and suppliers.

d. Provide input into the Acquisition strategy development and acquisition management planning. Provide recommendations on all procurement related issues, plans, reports, trainings and metrics.

e. Monitor acquisition benchmarking, initiatives support, and reporting Acquisition policy management and implementation support

f. Develop acquisition process analysis and training documents. Identify and develop standard processes that address company’s acquisition program requirements. Provide education and training to internal staff on procurement policies and best practices.

g. Develop market research reports, pre-solicitation documentation, and contract administration reporting. Analyze industry trends and market competitions to develop business improvement initiatives.

h. Assist Federal CORs in program governance and oversight of multiple award and multiple Task efforts.

i. Plan, prepare, and maintain current acquisition plans and overall program office acquisition administration functions such as program control and tracking.

j. Provide analysis and recommendations to support transition to commercially provide development models for improving acquisition mechanics.

k. Educate and guide stakeholders and pilot programs through the full acquisition lifecycle.

l. Support in the development of operational requirements working closely with operational branch chiefs.

m. Analyze and audit acquisition plans to ensure proper alignment to federal acquisition standards and identify and communicate opportunities to develop efficiencies and / or cost savings.

n. Provide administrative and data management support to track and monitor procurement activity.

o. Develop internal process recommendations for developing acquisition planning, commodity procurement buying, and market research.

p. Provide internal training and coordination with procurement POCs to ensure understanding of Federal commodity acquisitions.

3.2 Program Administration: The Business Operations Program Administration Branch provides general business analytic and resourcing support to OIS. These functions include workforce management

(both Fed and CTRs), internal communications, executive support, travel, training, resourcing, data calls, records management, and general business analytics.

3.2.1 Cybersecurity Workforce (FED and CTR) Support: As the complexity of the IT security-focused threats grows, so too does the need to enhance the skills of the OIS workforce. The contractor shall work with OIS to identify the skills needed to maintain and enhance OIS' security posture, identify gaps between those skills and the existing workforce, and put in place greater opportunities for enhancing those skillsets. Each of these efforts must be conducted in close coordination with OIS and OpDiv stakeholders, such as training developers and human resources personnel. Additionally, these efforts must be informed by best practices from the public and private sectors and align with guiding federal requirements and legislation.

The Contractor shall:

a. Assist in the coordination of workforce management-focused activities.

b. Assist in the collection and aggregation of data necessary to support FED and CTR workforce-focused data calls and activities.

c. Manage and maintain an OIS cybersecurity workforce plan.

d. Provide logistical and administrative support for meetings and monthly workforce management working groups

e. Update the OIS staffing plan tracker tool on an ongoing basis as needed.

f. Provide a monthly workforce status report of all activity.

g. Maintain OIS workforce organizational charts.

h. Assist in the execution of onboarding and off boarding forms and documentation

i. Provide general federal program administrative support for management of the cybersecurity workforce.

j. Provide requirements to all filled and vacant cybersecurity positions. Identify and report critical needs in specialty areas to the customer.

k. Provide strategies and tactical plans to recruit and identify cybersecurity workforce.

Support development of a recruiting branding strategy by conducting external research, identifying best practices, and recommending methods/approaches. Support efforts to target recruiting events (career fairs, conferences) by developing a calendar of events, overseeing logistics, and support participants.

l. Establish a cybersecurity workforce mitigation plan. Support federal staff in developing and communicating retention strategies for the IT/Cybersecurity workforce.

Support federal staff in updating all career paths and competency models to include non-technical competencies.

m. Support Federal Cybersecurity Workforce Assessment Act (FCWAA) requirements by providing data call support, report analysis, and generating reports or responses.

i. Support legislative reporting requirements for Work Roles of Critical Need (WRCN) by developing report templates and data collection methods

ii. Understand Federal Cybersecurity workforce legislations and mandates and capable of identifying, categorizing, coding, resourcing, and tracking cybersecurity positions.

iii. Establish procedures to identify, categorize, and code cybersecurity positions.

Identify all positions with cybersecurity functions and determine work category and specialty areas of each position. Review coding reports for thoroughness, validity, and reliability to provide meaningful analytics for HHS' overall IT/cybersecurity workforce. Relate coding reports to workforce findings to determine the overall effectiveness

iv. Identify and develop resources to enable cybersecurity workforce tracking, performance, and resourcing.

v. Manage and maintain NICE Framework GAP and Status Report. Review federal best practices to support development of a project plan/implementation strategy to close professional certification gaps for HHS cybersecurity workforce

3.2.2 General Program Administration and Business Analytical Support: OIS is one of only seven Federal agencies that have been designated as a Center of Excellence represented by the Department of Homeland Security (DHS), and endorsed by the Office of Management and Budget (OMB), to support any federal agency that requires assistance in developing certification & accreditation packages in accordance with federal requirements. Specifically, The OIS Enterprise Security Systems (ESS) Branch is a fee-for-service program that provides shared services to assist system owners throughout the system lifecycle. The contractor will provide the Enterprise Security Systems (ESS) Branch with Program and Business Operations management support in a wide range of program analysis and management support functions.

The Contractor shall:

a. Assist in the development and update of project/program status and metrics reports

b. Assist in the development and update of ESS Program Branch process and procedures documents

c. Assist in the development and update of ESS Program Branch Operational documents

(i.e. Questionnaires, cost planning documents, quote documents, and Operational project status reports)

3.3 Program Finance: The Contractor will ensure OIS has funding to execute the cybersecurity mission.

Provide support to identify requirements, development of funding requests, management of funding execution, and supporting strategic and tactical resourcing for OIS. Seeks to mature financial processes and develop efficiencies in financial reporting and communications. The Contractor will provide general financial and business analytics, SharePoint, and Excel expertise.

The Contractor shall:

a. Provide client support in the areas of budget, spend tracking, financial reporting, and financial analytics for Cyber and IT initiatives.

b. Provides data management support the enables finance performance and capabilities analysis

c. Works with division directors to define, track, and report on spend requirements.

d. Assists in applying sound accounting and data processing principles.

e. Identifies potential problems and solutions through analysis and recommends solutions.

f. Enables data connections between SharePoint list tools and Excel.

g. Develops and provides a monthly business operation reports on funding, spend activity, workforce, and contract execution. This report template will be provided by the government and should be delivered monthly by the 20th day.

h. Provide Microsoft Excel expertise and support to the development of custom business analytic reporting as needed.

3.3.1 Program Performance and Executive Support: The Cybersecurity Performance Management Reporting Contractor support provides EPLC coordination, Project Management, and Program Improvement services to OIS. The Contractor will manage an OIS Service Catalog and deliver/ align Services, Projects, Finances, and contracts to Investment Management.

3.3.1.1 CISO Executive Cybersecurity Strategy Support: The Contractor is responsible for both recommending a strategic cybersecurity direction to promote a culture of information security and privacy, and directly supports documenting the overall strategic plan enabling the HHS OIS cybersecurity mission and its resources.

The Contractor shall:

a. Work as a facilitator and conduit of building relationships with stakeholders and partners; private and public.

b. Serves as SME, possessing in-depth knowledge on subjects relating to the conduct, activities, governance, business practices, or operation of large federal cyber organizations.

c. Provides extensive cybersecurity technical knowledge and analysis as requested and directed by the Federal POC.

d. Provides recommendations and guidance to cybersecurity technical solutions to a wide range of complex cybersecurity problems.

e. Shares and communicates cybersecurity understanding and experiences in the application of cybersecurity principles, theories, and concepts in the required technical field, and has full knowledge of other related disciplines.

f. Ensures direct connection with the public and private cybersecurity sector.

g. Provides direct support in the maintenance and content of the OIS strategic plan.

Facilitate the development and execution.

h. Continual monitoring and updates on progress of the cybersecurity related legislations as they work their way through the Congressional process and provide a synopsis on impacts on cybersecurity. Continual monitoring and updates on the Concurrent Budget Resolution and other Congressional actions that potentially impact federal cybersecurity and the healthcare sector.

3.3.1.2 Program Performance Management and Reporting: OIS requires executive management support to ensure we maintain the strategic and tactical direction.

The Contractor shall:

a. Facilitate the development of HHS’ OIS Annual Tactical Plan and a set of OIS Annual Objectives and Goals.

b. Develop and recommend mechanisms to facilitate prioritization and measurements for program performance at the Division and Branch levels.

c. Develop Program Milestones charts, one for each the Strategic Plan and Tactical Plan, to visually show all program milestones.

d. Facilitate requirements gathering sessions/ off sites with 01S leadership and stakeholders to determine / validate critical elements of the Strategic and Tactical Plans.

e. Support the identification of baseline program performance measures that align to the Strategic and Tactical Plans

f. 2.3.4.2.6: Develop and Facilitate performance management meetings to inform the OIS Executive Leadership team of program status, project status, risks, objectives, goals, performance measurements demonstrating impact and results

g. 2.3.4.2.7: Initiate cross-organizational strategy to measure performance on a continued basis.

h. 2.3.4.2.8: Institute performance management baselines and targets for the life of the contract in support of the OIS Strategic Plan and HHS IT Strategic Plan.

TASK 4: CYBERSECURITY COMMUNICATIONS AND STAKEHOLDER

MANAGEMENT SUPPORT:

4.1 Program Communications and Stakeholder Engagements: The mission of the OIS cybersecurity communications capability is to ensure OIS initiatives and related messaging are accurately and consistently conveyed to appropriate stakeholders. OIS has multiple stakeholders, from the overall HHS cybersecurity community, external agencies and groups, and the individual users within HHS who play key roles in protecting the data with which HHS is entrusted. To support OIS’ mission and stakeholders, the Contractor will be responsible for:

The Contractor shall provide a Healthcare and Public Health Sector (HPH) Strategist to provide strategic subject matter expertise, recommendations, and awareness of the overall HPH sector to the CISO.

4.1.1 Strategic Communications Plan: Implementing and maintaining the OIS Strategic Communications Plan and ensuring that all communications – internal to OIS and with external stakeholders - are consistent with this plan. The Strategic Communications Plan was developed, in part, in 2019 and identifies the strategy by which OIS will communicate with its stakeholders.

The Contractor shall:

a. Continue the development and implementation of the plan to ensure it is reflective of stakeholder feedback and that of OIS personnel while reinforcing the overall OIS Strategic Plan, its mission, vision and goals.

Facilitate the development and execution.

b. Review the OIS Strategic Communications plan once annually, making changes as needed or as directed by the government.

c. Deliver the OIS Strategic Communications plan updated with the most current data after a major version change and or annually. The plan will be reviewed updated within the first 6 months of award and delivered to the Deputy CISO.

d. Maintain the OIS Communications Charter.

4.1.1.1 Stakeholder Engagements: Maintaining and refining a comprehensive inventory of all cybersecurity communications mechanisms and stakeholders, conducting all necessary stakeholder engagement, communications and marketing tasks specific to certain OIS capabilities and initiatives (i.e., HC3, 405d) or in support of the overall cybersecurity program. OIS supports HHS’ responsibilities as a Sector-Specific Agency (Executive Order 13636 and 13691, PPD-21) to improve the security and resiliency of the Health and Public Health (HPH) sector. As a part of this responsibility, OIS leads and coordinates several efforts to improve the cybersecurity of the sector with public and private industry partners. Stakeholder engagement and communications extend to all stakeholders, however, and cover multiple OIS initiatives. Communications activities must extend to each of these areas. In support of these initiatives, the contractor shall support HHS, OpDiv and public and private sector engagements to develop and distribute cybersecurity resources for use across the Department to include:

5405d Healthcare and Public Health Sector: Cyber threats to healthcare entities put patient health, business continuity, and IT systems at risk. Under the auspices of the Cybersecurity Act of 2015 (CSA), Section 405(d), HHS convened the CSA 405(d) Task Group to enhance cybersecurity and align industry approaches by developing a common set of voluntary, consensus-based, and industry-led guidelines, practices, methodologies, procedures, and processes that healthcare organizations can use to enhance cybersecurity.

Contractor will provide OIS direct support to 405d engagements across the agency to include:

a. Facilitation of public-private sector collaborations through Working Groups and Task Groups.

b. Support Working Group and Task Group management and logistics including: strategic stakeholder identification and engagement; agenda development; meeting facilitation; stakeholder tracking; resource mailbox maintenance; meeting location identification; day-of-meeting support; and note-taking during the sessions.

c. Assist with monitoring and tracking external HHS speaking engagements including identification of relevant conferences and events, creating a single repository and updating as needed.

d. Support the implementation of the Cybersecurity Act of 2015 requirements, including Section 405 provisions. Activities and efforts include:

i. Conducting quantitative and qualitative research and stakeholder mapping to gain a baseline understanding of the HPH sector stakeholders as a whole. Stakeholders include risk managers, Chief Information Security Officers, Chief Information Officers, medical professionals, and other senior security and healthcare officials from organizations across the sector. Stakeholder research and analysis allows HHS to understand sector stakeholders, establish trusted partnerships, develop relevant resources, and provide the necessary cybersecurity services.

ii. Section 405(d) Publication: Develop and track metrics to measure use and adoption of this resource and continue working with government and industry to regularly update this resource.

iii. Logistics and management of webinars, information/education sessions, meetings, etc.

iv. Update activities and implementation tracking for all other related reports within this legislation, as needed.

Healthcare Cybersecurity Coordination Center (HC3): Provide support to operational data calls and communications through the HC3 informing the HPH of cybersecurity vulnerabilities that may impact public environments.

The Contractor shall respond to routine taskings regarding the cyber threat landscape and develop routine products for HHS leadership. The Contractor may be responsible for the communication and dissemination of products to national level working groups at the direction of HHS leadership. Working groups and national level threat centers will work together in an information/intelligence sharing fashion whereby threat data will flow from HHS to the community and vice versa. The Contractor shall design and implement reports that highlight trends, patterns, and threats for HC3’s stakeholder community. The Contractor shall discern trends and patterns from daily threat feed data collected in open-source and proprietary contractor collection platforms.

Additional Tasks include:

a. Provide as necessary written products, communications, executive reporting, presentations, and emails as requested. These products should be suitable for communication to both the public and private sectors. Maintain and socialize standard templates and administer workflows for the team

b. Track metrics, policy updates, tasking’s, deliverables, associated due dates and provide updates on critical information.

c. Provide key insights and recommendations to the Federal POC for communications and policy engagements with core stakeholders.

d. Develop, author, and revise policy documents, MOU/MOAs, agreements, and other supporting documentation to facilitate the collaboration, sharing and communications mission.

e. Ensure appropriate monitoring of resource mailboxes, resource phone lines, and other tip sources to ensure that inquiries are addressed and routed appropriately in a timely manner. Assess HHS and OpDiv inquiries and determine the most effective way to respond and answer question(s) in alignment with HHS policies, standards and guidance.

f. Maintain knowledge of HHS policies, standards and guidelines, and other HHS baseline requirements, and review federal and industry documents for intelligence and awareness.

g. Develop and facilitate SOP’s and supporting documentation to support cybersecurity collaboration and knowledge sharing.

Cybersecurity Operations Communications and Reporting Service for the Computer Security Incident Response Center (CSIRC): Provide support to operational data calls and communications through the Communications and Reporting Functions of the Computer Security Incident Response Center. The Communications and Reporting Service (CRS) centralizes and streamlines communications from CSIRC, and to provide a cohesive hub for the tracking and reporting of data calls.

The Contractor shall:

a. Support the development of CRS enterprise communications, data call tracking and reporting, vulnerability tracking and reporting, and process and procedure documentation on behalf of the CSO organization.

b. Support the development of CRS enterprise communications designed to keep stakeholders informed of important news, threats, pertinent metrics, and initiatives.

c. Support the ongoing CRS distribution of enterprise notifications to stakeholders based on the severity of a threat or potentially threatening activity that is being observed.

d. Support CRS provision of enterprise data call tracking and metrics reporting on behalf of the Department. Maintain data tracking tool(s) to ensure proper dissemination of information.

e. Provide support documenting standard operating procedures (SOPs) and processes that support cyber operations. Provide audit documentation, as directed, along with necessary updates and recommendations.

f. For all activity contract will demonstrate professional writing and presentation skills, and to provide quality control and assurance for all CRS products. Provide quality assurance accuracy, consistency and reliability to security event data in tickets and reports. Contractors are expected to understand cybersecurity principles to aid them in the development of informed cybersecurity enterprise communications.

OIS Conference and Engagement Planning: Identifying and supporting OIS conference planning to include the development of presentation materials. OIS takes part in many conferences, roundtable and panel discussions, and speaking engagements.

The Contractor shall:

a. Research and maintain awareness of relevant conferences, roundtable and panel discussions, and other opportunities to create a current inventory of potential engagements.

b. At the government’s direction, prepare necessary speakers notes, talking points, summaries and speeches for OIS attended events.

c. Maintain the existing speaker’s bureau library of talking points in a centralized document repository (i.e., SharePoint) and ensure materials remain current.

d. Assist in logistical planning for event attendance.

4.1.1.2 Executive Reporting and Communications: Performing executive reporting and communications responsibilities. OIS is responsible for reporting activities and status to senior executives within OCIO, the Assistant Secretary for Administration (ASA) and higher. Each stakeholder group may define reporting frequency and templates.

a. Support OIS personnel in identifying executive reporting requirements, frequency and templates.

b. Developing inputs to reporting templates according to the required frequency, and drafting the executive communications for the government’s review and approval.

4.1.1.3 Data Call Management: Managing data call distribution, aggregation and response processes consistent with HHS, OCIO and OIS requirements. OIS is the subject of numerous data calls both externally, to satisfy planned and ad-hoc reporting requirements such as those associated with quarterly and annual FISMA reports and DHS Binding Operational Directives - and internally. In order to address these needs, the contractor shall:

a. Maintain a comprehensive inventory of planned, scheduled data calls and collaborate with the government to develop appropriate templates, schedules and processes.

b. Develop guidance and other communications to accompany the data calls.

c. Coordinate data call responses with necessary stakeholders.

d. Aggregate the results of those data calls and craft draft data call responses for governmental review and approval.

e. Create and maintain a centralized data call process and repository for the collection, aggregation and storage of data call responses.

4.1.1.4 OIS Communications Training and Messaging Management: Training OIS staff on effective communications mechanisms and the OIS Strategic Communication Plan.

While the communications team plays a role in ensuring effective and consistent communications, so to do OIS employees. It is imperative that all OIS employees are made and remain aware of their responsibilities with respect to effective communications and the OIS Strategic Communications Plan.

a. Develop methodologies, materials and schedules for periodic communications awareness training to reinforce key points of the Strategic Communications Plan, the OIS Style Guide and other relevant documents, processes and mechanisms.

b. Train OIS employees according to the defined methodologies.

c. Adjust training processes to account for new and emerging requirements and feedback from OIS employees.

TASK 5: Surge Support Mission needs combined with available funding may evolve as the contracted work is executed. At times additional hours and support may be needed within the overall scope of the Task. The Government may exercise increased hours for a specified labor category to provide additional support to meet the government's needs. This additional support will be temporary in nature and would only extend to end of the contract period.