FA 7_Cybersecurity Project Support Services_DRAFT PWS.pdf

U.S. Department of Health and Human Services Office of the Chief Information Officer

Cybersecurity Project Support Services – Functional Area 7

Performance Work Statement

Sources Sought Notice 75P00120R00010

Cybersecurity Project Support Services Task Order Scope

The objective of this functional area is to consolidate services and activity to eliminate redundancies, streamline processes, and implement EPLC, FITARA, 405D, into a strategic plan through project, program, and portfolio management standards ensuring continuity across the management of OIS. The OIS objective for cybersecurity investments is to leverage advances in cybersecurity to more efficiently accomplish mission objectives with a focus on consolidation, flexibility to adjust and scale to a changing threat environment, and deliver cost effective solutions within available resources.

To achieve the objectives of a more efficient, stable, maturing, and secure environment the supporting organizations must also have the necessary tools, resources, workforce, and processes necessary to plan, implement, and manage cybersecurity projects, people, and systems. Therefore, OIS requires and integrated and standardized approach for the various support roles including process and project assessment, project execution, quality management plans, and compliance reporting and monitoring.

The contractor shall ensure OIS is positioned to leverage advances in cybersecurity and cybersecurity project management support services to securely and efficiently resource and accomplish OIS mission objectives. The contractor shall provide continuous awareness and expertise on project management of cybersecurity services. Performance Objectives include:

• Maintain OIS Portfolio of Services and Projects

• Maintain and matrix legislation, directives, and mandates that pertain to the entire OIS Project

Portfolio

• Promote OIS wide adherence to EPLC project process and performance standards.

• Identify and realize resource efficiencies project quality management principals.

• Improve project execution to control and drive achievement of the OIS strategic and tactical plans.

• Communicate and promote cybersecurity and privacy awareness across the department and develop a culture of quality and cybersecurity innovation.

• Support efficient and proper acquisition and resource planning for project execution.

• Provide consistent project management practices across all OIS divisions and major programs.

• Provide architecture and project management support for cybersecurity solutions.

The Contractor shall provide Cybersecurity Project support services to effectively administer, manage, and perform the duties and responsibilities as defined in this Task Order PWS. The scope of work under this PWS includes the following tasks:

The scope of work under this PWS includes the following tasks:

1. Transition

2. Task Order Management

3. Cybersecurity Project Support

4. Surge Support

Regulatory References (not all inclusive)

• HHS Policy for Information Technology (IT) Enterprise Performance Lifecycle Management (EPLC): https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf

• The Federal Information Technology Acquisition Reform Act (FITARA):

https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D

• OMB Memo M-15-14: Management and Oversight of Federal Information Technology:

https://management.cio.gov/implementation/

• National Institute of Standards and Technology (NIST) Cybersecurity Framework:

https://www.nist.gov/cyberframework

• he Federal Risk and Authorization Management Program (FedRAMP): https://www.fedramp.gov/

• Federal Architectures Framework (FAEF 2.0):

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2

• OMB Circular A-130:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf

• HHS Cybersecurity Overview:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html

• Executive Orders 13636 and 13691, PPD-21:

o EO 13636: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity o EO 13691: https://obamawhitehouse.archives.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari o PPD-21: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil

• National Initiative for Cybersecurity Education (NICE) Workforce Framework:

https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework

• Security Technical Implementation Guides (STIGs): https://iase.disa.mil/stigs/Pages/index.aspx

• Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and

Critical Infrastructure: https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure

• NIST 800-37: Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy: https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2

• Special Publication 800-79-2, Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) has been approved as final:

https://csrc.nist.gov/News/2015/SP-800-79-2,-Guidelines-for-the-Authorization-of-P

• OMB Circular A-123: Management’s Responsibility for Enterprise Risk Management and Internal Control:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf

• DHS Binding Operational Directive (BOD) 18-02 - Securing High Value Assets:

https://cyber.dhs.gov/bod/18-02/

• Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure: Executive Order 13800: https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/

• Federal Continuity Directives FCD-1: https://www.fema.gov/media-library/assets/documents/86284 https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D https://management.cio.gov/implementation/ https://www.nist.gov/cyberframework https://www.fedramp.gov/ https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130trans4.pdf https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://iase.disa.mil/stigs/Pages/index.aspx https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://csrc.nist.gov/News/2015/SP-800-79-2,-Guidelines-for-the-Authorization-of-P https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf https://cyber.dhs.gov/bod/18-02/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ https://www.fema.gov/media-library/assets/documents/86284 https://www.fema.gov/media-library/assets/documents/86284

• Federal Continuity Directives FCD-2: https://www.fema.gov/media-library/assets/documents/132803

• Presidential Continuity Directive 40: https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf https://www.fema.gov/media-library/assets/documents/132803 https://www.fema.gov/media-library/assets/documents/132803 https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf https://www.gpo.gov/docs/default-source/accessibility-privacy-coop-files/January2017FCD1-2.pdf

TASK 1: TRANSITION

The Contractor will oversee all Transition-related work streams including, but not limited to:

The Contractor Shall:

a. Assume responsibility for the various areas of support from incumbent contractors currently providing the following services:

i. Program Management Support

ii. Project Management Support

b. Complete transition in accordance with the proposed transition plan for all areas of support within 60 days from award.

TASK 2: TASK ORDER MANAGEMENT

The Contractor shall be responsible for the effective management and administration of the resulting task order, ensuring that all work activities associated with tasks or projects are performed in a timely and cost effective manner while maintaining the highest quality of performance.

The Contractor Shall:

a. Ensure that the cross-functional areas of support are managed in a manner that achieves the objectives identified in the Objectives Section.

b. Develop and execute a Task Order Management Plan that reflects the interdependencies of the various staffing areas. Task Order Management Plan elements include, but are not limited to:

i. Team organization and management to include a staffing plan, staff training, and management of staffing changes. The staffing plan must address Key Personnel positions and the process for overseeing, controlling, and delivering required services under the task order;

ii. Management and control of a Work Breakdown Structure (WBS), schedules, cost, and

iii. task order requirements;

iv. Reporting, documenting, and managing problems, changes, risks, mitigation plans, and recommendations;

v. Communication and escalation procedures, general operating procedures, transition plans, and any additional information the contractor deems relevant;

and

vi. Task order deliverables and acceptance process, distribution lists, format, and schedules for Government review and acceptance.

c. Work closely with the Agency staff to develop information to be included in the Draft Task Order Management Plan.

d. Submit a Draft Task Order Management Plan within fifteen (15) business days after award and a final Plan is due ten (10) days after receipt of OIS feedback.

e. Conduct a quarterly review for changes must also be performed with revisions due by the 15th day after each quarter ends.

f. Meet with the Government COR within ten (I0) business days after award to establish a review process for the Performance Requirements Summary (PRS) to be implemented by the second month of the contract.

g. Provide a final approved review process incorporated into the Quality Assurance Plan

(QAP) and Task Order Management Plan with quarterly reporting established.

h. Provide a schedule for development and implementation approved by the COR.

i. Provide a draft QAP within fifteen (15) business days after award and a final QAP is due ten (10) business days after of receipt of OIS feedback. QAP elements include, but are not limited to: addressing how the contractor will ensure the objectives of the task order will be met as well as methodologies for correction of deviations and the records to be kept for inspections.

j. Conduct a quarterly review for changes that may impact the QAP must also be performed and submitted with the updated Task Order Management Plan by the fifteenth (15th) of the month following the end of each quarter.

k. Deliver a monthly Task Order Performance Report (TOPR) that provides valid and timely program status information to the designated OIS point(s) of contact no later than the 10th business day of each month for the prior month. The TOPR shall include the following:

i. Work performed during the reporting period including: accomplishments, problems/issues, key decisions with impacts, and recommendations for corrections;

ii. Work to be accomplished during the next reporting period;

iii. Ad hoc information on project status on an as-needed basis;

iv. Any issues that may occur during project implementation, to include external dependencies;

v. Performance measurements against PRS; and

vi. Staffing list, organizational chart, and vacancy status.

l. Prepare and maintain a Funds and Expenditure Report (F &E) to include, at a minimum: CLIN, SubCLIN (where applicable), labor category, personnel charging, hours, expenditures, current period and cumulative totals, funding amount, remaining balance, estimate to complete by month and estimate at completion.

m. Prepare and maintain a F&E in a format that is approved by the Government.

n. Develop an F&E report with elements that include, but are not limited to: show total contract value, total expended and variance analysis from the prior month's estimates, utilizing planned value and/or forecasting amounts against actual monthly expenditures for analyses.

o. Develop an F&E report structure that ties to a CLIN and SubCLIN and/or WBS elements where applicable for the given task order.

p. Submit an F&E report to the Contracting Officer Representative (COR) electronically by the 10th business day of each month for the prior month.

q. Provide the Government with options at every phase and/or critical milestone in a project and ensure Federal staff make all final project decisions.

r. Forecast decisions required decision making for Federal staff.

s. Determine actions that can be performed by contractor employees to ensure their discretionary decisions remain subject to Government oversight and final approval.

t. Address issues in advance and ensure conclusions are reflected in the contract by the contractor’s administration.

u. Ensure that contractor employees are properly identified in email communications, teleconference calls, and in meetings so that all participants can differentiate between Federal employees and contractors.

TASK 3: CYBERSECURITY PROJECT SUPPORT

At any given time OIS is responsible for managing multiple cybersecurity initiatives of varying size and complexity. Current major ongoing active enterprise projects include the DHS Continuous Diagnostics and Mitigation (CDM) deployment across the agency, deployment of agency level integrated governance, risk and compliance management systems, dashboards, and processes (Archer Suite); Agency level Security Incident Event Management systems, dashboards, and processes (Splunk). Additionally, Cybersecurity Operation division’s Security Technology Infrastructure Management branch provides ongoing projects for deployment of systems for the OIS Security Enclave including the Trustred Internet Connection (TIC) infrastructure.

The contractor will provide overall Project Management Office support and direct project management support to specific current and planned initiatives.

3.1 Project Management Office (OIS-ARCH) support: The contractor shall maintain and continuously improve the practices of OIS project delivery through the development, training, implementation of standard practice guides, templates and tools, including direct alignment with the HHS EPLC standards. The contractor will leverage the current OIS Architecture and Design branch and take on the current projects in deployment. The contractor will leverage the existing teams to develop and produce a Concept of Operations (CONOPS) for managing and improving upon current management and execution of projects. The contractor shall update the CONOPS as EPLC practices are implemented that will increase the probability of successful project management practices.

The Contractor Shall:

a. Maintain standardized EPLC project management methodologies. Provide coaching to OIS business owners and project teams on agile best practices.

b. Guide OIS project managers in tailoring EPLC methodology for specific projects and designated project management artifacts deemed necessary through the tailoring process to include internal audits of artifacts for timely submission and quality assessments. Orient new PMs to EPLC methodology. Coordinate communications to the PM community and provide training on topics deemed beneficial to improving OIS project management capabilities by hosting Community of Practice meetings and other methodologies to ensure continual improvements are communicated, adopted and effectively implemented.\

c. Provide decision support through phase gate reviews for project sponsors, decision makers and key stakeholders. Ensure entrance criteria for phase gate reviews are met and remind PMs on requirements for status briefings when schedules slip. Document governance decisions and track action items. Advise project teams on Transition to Operations expectations.

d. Maintain integrated master schedule of project milestones. Support project managers in developing sound schedules. Monitor resource conflicts across the project portfolio.

e. Establish and monitor project artifact and documentation management.

3.2 Project Delivery Support: This support may include project management, business analytics, requirements management, WBS creation, project scheduling, EVM management, business process engineering, organizational impact and change management, and/or user acceptance activity support.

OIS uses the HHS EPLC framework to identify, approve, fund, execute, and transition projects based on submission of individual requirements. The contractor will work closely with the OIS-ARCH team members from project initiation to closeout to ensure the successful conclusion of each project.

Examples of roles requiring support include:

Project Management: The level of project management support varies by scope, size, and other factors. As needed, the Contractor may be called upon to manage and or provide direct management support for a specific project. While each project has unique requirements, the general Project Management activities that the Contractor shall perform may include the following:

a. Manage and/or coordinate all project activities and facilitate vendor activities to ensure that work is being completed on time and within budget in accordance with established quality standards.

b. Assist in the development and maintenance of business cases, narratives, and justifications for project activity.

c. Develop and maintain project specific artifacts per EPLC tailoring plans such as project management plans, charters, scope documents, etc. using standardized EPLC designated templates.

d. Develop and maintain project Work Breakdown Structures (WBS) and project master schedules for individual projects. Incorporate project teams' schedules into the master schedule and ensure one integrated schedule with dependencies, level of effort for all project staff, cost, duration, and assigned resources where appropriate.

e. Ensure project or program plans and schedules are baselined in accordance with EPLC guidelines and monitor actual costs against baseline. Maintain project cost and schedule status in an OIS current portfolio tracking tool. Ensure costs are reconciled with the OIS Acquisition Planning tool and communicated to the OIS Business Operations division.

f. Coordinate and facilitate project meetings and as required. Prepare agendas, document and publish meeting minutes, and track action items. Facilitate and/or present briefings for project reviews and phase gates as determined per the project tailoring process. Document and manage any resulting actions.

g. Collect project teams' status information for input into OIS monthly project review reports. Develop and/or present briefings on project status, including executive briefings, when necessary.

h. Review engineering and development project documentation and approaches and assist the Government in assuring project outcomes comply with statutory, federal, and Agency guidance and policies.

i. Review and monitor project deliverables and project activities to ensure they are accurate and within the project scope.

j. Maintain a Risk Register and manage project risks by proactively identifying, tracking, mitigating and communicating in a manner that prevents problems from impacting project and organizational objectives.

k. Manage project documentation using approved agency document repositories.

l. Ensure that Stakeholder Management is considered in all phases of the project following EPLC guidelines.

Project Business Analysis: The Contractor shall provide support to project teams and system owners by identifying and documenting business needs, supporting research and analysis of business options, ensuring solutions meet business needs, and assisting owners with acceptance testing. The activities that the Contractor shall perform may include the following:

a. Develop and maintain project concept definition and analysis artifacts to include business needs statements, market research, non-technical alternative analysis, cost benefit analysis, feasibility analyses, and Concepts of Operations (CONOPS).

b. Coordinate closely with system owners and stakeholders to determine business requirements and high level system requirements. Requirements shall be stated in definitive terms and identify specific, measureable, achievable, realistic and testable deliverables and be documented.

c. Facilitate requirements management and track changes to requirements. Work with the project change control team, IPTs, and other contractors to present requirement and functionality changes that impact schedule, cost, functionality, and quality.

d. Assist project managers in assessing project status and readiness for project transition into each new phase including coordination for transition to O&M.

e. Develop product roadmap and assess issues in integration of projects.

f. Participate in project meetings to ensure projects are on track to meet business, technical, and security requirements. Ensure the solution design and development are traceable to requirements and defined test cases adequately prove each requirement was acceptably implemented.

g. Review and assess interface control documents during project design phase, in IPTs, or during project meetings to assure interface requirements are met.

h. Assist the government in assessing data cleansing and quality issues and coordinating data cleanup activities to resolve data issues associated with development projects.

i. Determine User Acceptance Testing (UAT) and training environment requirements and arrange for test facilities, hosting the environment (project hardware/software in a "near operational" environment) required to accomplish UAT activities.

j. Coordinate with system owners and others to identify and develop testing approaches, test plans, and schedules for User Acceptance Testing and system acceptance, and arrange for Agency users to participate in testing. Collect and provide test result documentation to the government.

k. Review and assess developer test approaches and plans and provide assessment to the project's PM.

l. Document and manage external communication plans, memos, and tools. Assist the agency in communicating and coordinating changes and project status to end users.

TASK 4: Surge Support Mission needs combined with available funding may evolve as the contracted work is executed. At times additional hours and support may be needed within the overall scope of the task order. The Government may exercise increased hours for a specified labor category to provide additional support to meet the government's needs. This additional support will be temporary in nature and would only extend to end of the contract period.

The government has the option to increase the volume of hours under this contract for increased or surges in support. The Government may require increase or decrease of support during the base or any option period. Any increase or surge modifications will be in-scope (no "new" work) to provide increased support for the defined task areas of the performance work statement. Surge support is OPTIONAL and is not a guarantee. If the Government determines that an increased quantity of support is required for the task areas defined in the Performance Work Statement, the Government reserves the right to exercise all or part of the Surge Option. Surge hours are dependent on available funding and mission needs.

TASK 4: Surge Support