832573449 Recompete FO HC102822F0929_CLEAN.docx

STATEMENT OF WORK (SOW)

1.Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR (ACOR). See DITCO Additional Text G1 - Points of Contact

c. Property Administrator. See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Cybersecurity Management

3. Background. A major component of Defense Information Systems Agency (DISA) is Cyber Services Cybersecurity management. The vast mission of Cyber Services the Cybersecurity Division is to deliver secure enterprise-wide information technology services, enabling and enhancing the warfighters’ ability to execute the mission. These services include, but are not limited to, Assessment and Authorization (A&A), Risk Management Framework (RMF) activities, Vulnerability Management activities, continuous monitoring, and program security posture as it pertains to Enterprise Program Services, Network Program Services, Strategic Partner Engagement, and Internal Program Services.

4. Objectives. The objective of this requirement is to provide Cyber Vulnerability Management Cybersecurity Management support for DISA J-9 Hosting and Compute (J-9 HaC) Cybersecurity Division Cyber Services Line of Business (LOB ) by providing compliance monitoring/reporting, response and mitigation, Cyber Automation and Management services, compliance validation, configuration, change and account management, A&A, RMF, Federal Information Security Management Act compliance, Cyber Risk Management, Cyber Standardization and Strategic Partner Engagement and Implementation for DISA Cyber SecurityJ-9 HaC supported systems.

5. Scope. The contractor shall provide cybersecurity support for DISA J-9 HaC and DISA’s J-9 HaC’s Strategic Partners. These cybersecurity services include access control, A&As, audits, application administration, support for commercial off-the-shelf tools and Government off-the-shelf tools, Cybersecurity documentation, DISA Task Orders Management, metrics, incident response, network defense, public key infrastructure support, risk management, training management, security posture validation, and vulnerability analysis. Work accomplished under this task order shall include cybersecurity support ion isolated network, Non-Secured Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) isolated environments. The contractor shall provide the appropriate skilled personnel to support DISA's sustainment activities under the task areas listed below.

· Task Area 1 - Cyber Automation Database

· Task Area 2 - Endpoint Protection Management

· Task Area 3 - Endpoint Scanning Management

· Task Area 4 - Application Vulnerability Analysis

· Task Area 5 - Database Vulnerability Analysis

· Task Area 6- Web Vulnerability Analysis

· Task Area 7 - OS Vulnerability Analysis

· Task Area 8 - Cyber Security Configuration Validation (Optional)

· Task Area 9 - Cyber Automation Operating System (OS) (Optional)

· Task Area 10 – J-9 HaC Incident Response (Optional)

· Task Area 11 - RMF Database Administration (DBA) (Optional)

· Task Area 12 - Network Vulnerability Analysis (Optional)

· Task Area 13 - UNIX and Linux Vulnerability Analysis (Optional)

· Task Area 14 - Cyber Administration and Support (Orders Management and Standardization, Information Technology Service Management (ITSM), Information Technology Infrastructure Library (ITIL) and Process Improvement, Metrics) (Optional)

· Task Area 15 - Strategic Partner Integration (Optional)

· Task Area 16 – Risk Management Framework (RMF) (Optional)

· Task Area 17 - Cyber Threat Planning (Optional)

· Task Area 18 - Task Order Management

· Task Area 19 - After-Hours Support (Ad-Hoc/On-Call)

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this SOW. Surge support over the life of the contract will not exceed 50% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to Federal Acquisition Regulation (FAR) 52.217-8.

6. Specific Tasks. For all tasks the contractor shall:

· During assigned duty hours, ensure contractor personnel are present and responsive in chat, email, and other collaboration tools (including Cisco Jabber, Global Video Service, Microsoft Teams, and Microsoft Outlook). V Adhere to a 30-minute response window when not in meetings or performing assigned tasks which prohibit NIPRNet workstation access. Provide project schedules and Project Status Report (PSR) representing the current state of major milestones, project schedules, activities, risks, and challenges.

· Create and maintain Tactics, Techniques and Procedures (TTPs), work instructions/job aids, and user guides for applicable functions.

· Monitor, maintain and submit ticket updates, change requests, and documentation in Ecosystem’s ticketing system.

· Provide in-depth on-the-job training for the DISA Cyber LOB workforce.

· Participate in meetings for applicable functions.

· Research, provide input to, and participate in the Cyber LOB Continuity of Operations Plan (COOP) activities.

· Follow applicable TTPs and work instructions. Support Cyber LOB implementation, sustainment, authorization, and assessment activities.

· Properly use DISA cybersecurity tools as outlined by assigned duties. Tools currently implemented include Endpoint Security System (ESS), Assured Compliance Assessment Solution (ACAS), Enterprise Security Posture System (ESPS), Ecosystem’s ticketing system, Defense Information Technology Portfolio Repository (DITPR), Enterprise Mission Assurance Support Service (eMASS), Continuous Monitoring and Risk Scoring (CMRS), Global Information Grid Interconnection Approval Process (GIAP), Systems Network Approval Process (SNAP), Ports, Protocols and Services Management (PPSM), Security Technical Implementation Guides (STIG) Viewer, Web Application Filter (WAF) F5, IronPort, Splunk, and TrueSight.

· Provide audience targeted and accurate feedback to requests for information.

· Support, review, and submit recommendations for improvements in efficiencies and effectiveness for cybersecurity activities, processes, and documentation.

· Provide on-call support for Cyber LOB assistance (On-call support estimated to occur approximately 33 hours per month).

· Maintain due diligence when handling sensitive data to include Controlled Unclassified Information (CUI), Personally identifiable information (PII), Health Insurance Portability and Accountability Act (HIPAA) information and Payment Card Industry (PCI) information based on applicable federal, departmental, and/or agency policies and guidelines.

· Complete and submit all deliverables in a timely manner.

· Obtain the appropriate Department of Defense (DoD)-approved Information Assurance (IA) certification prior to being engaged, and any additional certifications for the position within six months of start date.

Deliverables (applicable to all Tasks):

· After Action Report per incident

· Audit support documents

· Cybersecurity tool (current version) certification and/or training as published by the DoD Job aids Monthly Status Report (MSR)

· Meeting minutes

· Lessons learned

· Process flowcharts

· Project schedules

· Reports from anomalous events

· RMF support documents

· PSR

· TTPs

· Technical interpretations

· Training support documents

· Updated security procedures

· White papers

6.1 Task 1 - Cyber Automation Database. See Minimum Qualifications Matrix for required minimum qualifications for full-time equivalents (FTEs) performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.1.1 Subtask – DBA.

Key Personnel: Cyber Automation Database Developer (Senior)

The contractor shall:

Deliverables:

· Completed UNIX Database Toolkit

· Database Toolkit Documentation

· Documentation of the peer code review process and findings

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

Reviewed by Government Section Chief Up to 12 per year typically monthly

Provided Template

typically, yearly

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Task 2 – Endpoint Protection Management. See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.2.1 Subtask 1 – Tier II Endpoint Protection Operation. Key Personnel: Endpoint Protection Administrator (Senior) and Endpoint Protection Administrator (Master)

The contractor shall:

Deliverables:

· Compliance reports and trending analysis

· Current registered device documentation

· Security Violation Reports

· Weekly Metrics

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

analysis

Up to 52 per year weekly

Up to 365 per year daily

Up to 730 per year twice per day

Template Schedule release dates provided by the Government Standard Distribution

Up to 104 per year weekly

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.3 Task 3 – Endpoint Scanning Management. See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.3.1 Subtask 1 – Tier III Endpoint Scanning Operation. Key Personnel: Endpoint Scanning Specialist (Master).

The contractor shall:

Deliverables:

· Metrics and trending analysis reports

· Scan systems (Government provided list)

· Scan failures report

· Scanning vulnerability reports

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

Reports

the Government

daily

by the Government Standard Distribution

Up to 52 per year typically weekly

by the Government Standard Distribution

Up to 730 per year twice per day

vulnerability reports

by the Government Standard Distribution

Up to 52 per year typically weekly

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.4 Task 4 – Application Vulnerability Analysis. See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.4.1 Subtask 1 – Application Specialist Support.

The contractor shall:

· Serve as an App technical specialist for assets connected to isolated environments, NIPRNet and SIPRNet to support cybersecurity and IT services.

· Review, identify, and report problems with the installation and operations of application instances to include system options, software used and not used, default security controls that are enabled, disabled, or bypassed, and system wide options or parameters that may create security vulnerabilities.

· Determine the impact and risk of submitted change requests prior to implementation and participate in change advisory board meetings (up to daily) to provide cyber oversight for database changes that affect the level of risk.

· Recommend security countermeasures to mitigate identified app risks.

6.4.2 Subtask 2 – Application Vulnerability Analysis.

The contractor shall:

· Identify, monitor, analyze, report, and brief status of vulnerabilities.

· Ensure high risk and high severity vulnerabilities are managed with increased visibility and escalated.

· Analyze, validate, monitor, and report compliance status of DoD and DISA directives and orders.

· Create, maintain, and provide automated and customized vulnerability reports.

· Analyze mission requirements and organizational feedback to improve vulnerability reports and processes.

· Provide recommendations for app vulnerability analysis, guidance, deficiency resolution, and implementation suggestions to DISA customers and Mission Partners.

6.4.3 Subtask 3 – Application Compliance Validation and Support.

The contractor shall:

· Assess, audit, review analyze, validate, and report database Security Requirements Guide (SRG) and STIG vulnerabilities, and ensure security controls are implemented within databases IAW DoD, DISA and cybersecurity policies and procedures.

· Evaluate discrepancies as they relate to policy, orders, and database SRG and/or STIGs, and document recommended additions, deletions, or changes.

· Identify and report the need to add technical guidance for modification of policies and Orders.

· Review and validate the installation and configuration of cyber tools on assets, and report deficiencies.

· Review database SRG and/or STIGs as updates are released, and report changes with the potential to have significant impact.

· Determine the impact and risk of submitted change requests prior to implementation and participate in meetings to provide cyber oversight for web changes that affect the level of risk.

· Recommend security countermeasures to mitigate identified web risks.

· Participate in audits and provide documentation (up to daily).

Deliverables:

· Daily/weekly/monthly/quarterly/annual vulnerability analysis reports

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

and Remarks

the Government

weekly

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.5 Task 5 – Database Vulnerability Analysis. See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.5.1 Subtask 1 – Database Specialist Support.

The contractor shall:

· Serve as a Database technical specialist for assets connected to isolated environments, NIPRNet and SIPRNet to support cybersecurity and IT services.

· Review, identify, and report problems with the installation and operations of Database instances to include system options, software used and not used, default security controls that are enabled, disabled, or bypassed, and system wide options or parameters that may create security vulnerabilities.

· Possess database expertise including Oracle, SQL, MySQL, or DB2 database software.

· Determine the impact and risk of submitted change requests prior to implementation and participate in change advisory board meetings (up to daily) to provide cyber oversight for data- base changes that affect the level of risk.

· Recommend security countermeasures to mitigate identified database risks.

6.5.2 Subtask 2 – Database Vulnerability Analysis.

The contractor shall:

· Identify, monitor, analyze, report, and brief status of vulnerabilities.

· Ensure high risk and high severity vulnerabilities are managed with increased visibility and escalated.

· Analyze, validate, monitor, and report compliance status of DoD and DISA directives and orders.

· Create, maintain, and provide automated and customized vulnerability reports.

· Analyze mission requirements and organizational feedback to improve vulnerability reports and processes.

· Provide recommendations for database vulnerability analysis, guidance, deficiency resolution, and implementation suggestions to DISA customers and Mission Partners.

6.5.3 Subtask 3 – Database Compliance Validation and Support.

The contractor shall:

· Assess, audit, review analyze, validate, and report database SRG and STIG vulnerabilities, and ensure security controls are implemented within databases IAW DoD, DISA and cybersecurity policies and procedures.

· Evaluate discrepancies as they relate to policy, orders, and database SRG and/or STIGs, and document recommended additions, deletions, or changes.

· Identify and report the need to add technical guidance for modification of policies and Orders.

· Review and validate the installation and configuration of cyber tools on assets, and report deficiencies.

· Review database SRG and/or STIGs as updates are released, and report changes with the potential to have significant impact.

· Determine the impact and risk of submitted change requests prior to implementation and participate in meetings to provide cyber oversight for web changes that affect the level of risk.

· Recommend security countermeasures to mitigate identified web risks.

· Participate in audits and provide documentation (up to daily).

Deliverables:

· Daily/weekly/monthly/quarterly/annual vulnerability analysis reports A&A Documentation

· SSP Documentation

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

and Remarks

Template Schedule release dates provided by the Government

weekly

Provided Template Schedule release dates provided by the Government

year typically weekly

Documentation Government Provided Template Schedule release dates provided by the Government

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.6 Task 6 –Web Vulnerability Analysis. See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.6.1 Subtask 1 – Web Specialist Support.

The contractor shall:

· Serve as a Web technical specialist for assets connected to isolated environments, NIPRNet and SIPRNet to support cybersecurity and IT services.

· Review, identify, and report problems with the installation and operations of web instances to include system options, software used and not used, default security controls that are enabled, disabled, or bypassed, and system wide options or parameters that may create security vulnerabilities.

· Determine the impact and risk of submitted change requests prior to implementation and participate in change advisory board meetings (up to daily) to provide cyber oversight for data- base changes that affect the level of risk.

· Recommend security countermeasures to mitigate identified web risks.

6.6.2 Subtask 2 – Web Vulnerability Analysis.

The contractor shall:

· Identify, monitor, analyze, report, and brief status of vulnerabilities.

· Ensure high risk and high severity vulnerabilities are managed with increased visibility and escalated.

· Analyze, validate, monitor, and report compliance status of DoD and DISA directives and orders.

· Create, maintain, and provide automated and customized vulnerability reports.

· Analyze mission requirements and organizational feedback to improve vulnerability reports and processes.

· Provide recommendations for web vulnerability analysis, guidance, deficiency resolution, and implementation suggestions to DISA customers and Mission Partners.

6.6.3 Subtask 3 – Web Compliance Validation and Support.

The contractor shall:

· Assess, audit, review analyze, validate, and report database SRG and STIG vulnerabilities, and ensure security controls are implemented within databases IAW DoD, DISA and cybersecurity policies and procedures.

· Evaluate discrepancies as they relate to policy, orders, and database SRG and/or STIGs, and document recommended additions, deletions, or changes.

· Identify and report the need to add technical guidance for modification of policies and Orders.

· Review and validate the installation and configuration of cyber tools on assets, and report deficiencies.

· Review database SRG and/or STIGs as updates are released, and report changes with the potential to have significant impact.

· Determine the impact and risk of submitted change requests prior to implementation and participate in meetings to provide cyber oversight for web changes that affect the level of risk.

· Recommend security countermeasures to mitigate identified web risks.

· Participate in audits and provide documentation (up to daily).

Deliverables:

· Daily/weekly/monthly/quarterly/annual vulnerability analysis reports

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

dates provided by the Government

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.7 Task 7 – OS Vulnerability Analysis. See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.7.1 Subtask 1 – OS Specialist Support.

The contractor shall:

· Serve as an OS technical specialist for assets connected to isolated & Cloud environments, NIPRNet and SIPRNet, to support cybersecurity and IT services.

· Serve as technical specialist for assets connected to isolated environments to support cybersecurity and IT services. Review, identify, and report problems with the installation and operations of assets to include system options, software used and not used, default security controls that are enabled, disabled, or bypassed, and system wide options or parameters that may create security vulnerabilities. Determine the impact and risk of submitted change requests prior to implementation and participate in meetings to provide cyber oversight for OS changes that affect the level of risk. Recommend security countermeasures to mitigate identified risks.

· Determine the impact and risk of submitted change requests prior to implementation and participate in meetings to provide cyber oversight for changes that affect the level of risk.

· Recommend security countermeasures to mitigate identified risks.

6.7.2 Subtask 2 – OS Vulnerability Analysis.

The contractor shall:

· Identify, monitor, analyze, report, and brief status of all OS vulnerabilities to include, but not limited to, Windows, Unix, Mainframe, Network Devices, Cloud Technologies and Other.

· Ensure high risk and high severity vulnerabilities are managed with increased visibility and escalated.

· Analyze, validate, monitor, and report compliance status of DoD and DISA directives and orders.

Create, maintain, and provide automated and customized vulnerability reports.

· Analyze mission requirements and organizational feedback to improve vulnerability reports and processes.

· Provide recommendations for OS vulnerability analysis, guidance, deficiency resolution, and implementation suggestions to DISA customers and Mission Partners.

6.7.3 Subtask 3 – OS Compliance Validation and Support.

The contractor shall:

· Assess, audit, review, analyze, validate, and report OS, SRG, and STIG vulnerabilities, and ensure security controls are implemented within OS IAW DoD, DISA and industry cybersecurity policies and procedures.

· Evaluate discrepancies as they relate to policy, orders and OS, SRG, and/or STIGs, and document recommended additions, deletions, or changes.

· Identify and report the need to add technical guidance for modification of policies and orders.

· Review and validate the installation and configuration of cyber tools on assets, and report deficiencies.

· Review OS, SRG, and/or STIGs as updates are released, and report changes with the potential to have significant impact.

· Participate in audits and provide documentation (up to daily).

Deliverables:

· Daily/weekly/monthly/quarterly/annual vulnerability analysis reports

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

and Remarks

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.8 Task 8 - Cyber Security Configuration Validation (Optional). See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.8.1 Subtask 1 – Cybersecurity Configuration Validation Oversight.

The contractor shall:

6.8.2 Subtask 2 – Cybersecurity Configuration Compliance.

The contractor shall:

Deliverables:

· Refer to all task area required deliverables.

6.9 Task 9 - Cyber Automation OS (Optional). See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.9.1 Subtask Task 1 – UNIX and Windows Administration.

The contractor shall:

Deliverables:

· Refer to all task area required deliverables.

6.10 Task 10 – J-9 HaC Incident Response (Optional). See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.10.1 Subtask 1 – Incident Response Analysis.

The contractor shall:

· Ensure DISA approved security tools are monitoring, alerting, and retaining event logs in IAW DoD and DISA policies and procedures

· Facilitate remediation of incident report deficiencies with J-9 HaC Points of Contact (PoC).

· Maintain situational awareness of the network within the J-9 HaC and report suspicious activity to include insider threat events. Process all threat events as critically time sensitive.

· Perform audit log reviews with DISA approved security monitoring and data aggregation tools to detect, analyze, investigate, escalate, monitor, and mitigate suspicious events. Escalate suspicious events to DISA CSSP PoCs and stakeholders.

· Maintain chain of custody and data integrity of incident response system data, files, and evidence of reported incidents.

· Investigates and facilitates the mitigation of Negligent Disclosure of Classified Information or other spillage, and DoD threat tippers.

· Coordinate incident response support through Ecosystem PoCs.

· Maintain copies of the latest incident response tool kits per CSSP and Incident Response and Recovery Team IAW DoD and DISA policies and procedures.

· Document, train, and provide awareness of mitigated threats to reduce risk of repeat incidents to Government personnel.

Deliverables:

· Weekly metrics

· MSR

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements

SOW

Task#

Standard Distribution Up to 104

per year provided weekly by the

Government

of the reporting period.

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.11 Task 11 –RMF DBA (Optional). See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.11.1 Subtask 1 – DBA.

The contractor shall:

Add and/or update data within the RMF database to include information from RMF supporting documents, links to documents stored on the web, control correlation identifier ownerships, and RMF overlay relationships.

Sustain and maintain RMF database for optimum performance.

Research and innovate database improvements for evolving Cybersecurity Division requirements and assignments.

Deliverables:

· Comprehensive Audit Controls Database

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

and Remarks

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.12 Task 12 – Network Vulnerability Analysis (Optional). See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.12.1 Subtask 1 – Network Specialist Support.

The contractor shall:

6.12.2 Subtask 2 – Network Vulnerability Analysis.

The contractor shall:

Identify, monitor, analyze, report, and brief status of J-9 HaC vulnerabilities.

Ensure high risk and high severity vulnerabilities are managed with increased visibility and escalated.

Analyze, validate, monitor, and report compliance status of DoD and DISA directives and orders.

Create, maintain, and provide automated and customized vulnerability reports.

Analyze mission requirements and organizational feedback to improve vulnerability reports and processes.

Provide recommendations for Network vulnerability analysis, guidance, deficiency resolution, and implementation suggestions to DISA customers and Strategic Partners.

6.12.3 Subtask 3 – Network Compliance Validation and Support.

The contractor shall:

Review and validate the installation and configuration of cyber tools on assets, and report deficiencies.

Review network SRG and/or STIGs as updates are released, and report changes with the potential to have significant impact.

Deliverables:

· Daily/weekly/monthly/quarterly/annual vulnerability analysis reports

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

Template Schedule release dates provided by the Government

weekly

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; One copy of the transmittal letter with the deliverable to the Primary COR.

6.13 Task 13 – UNIX and Linux Vulnerability Analysis (Optional). See Minimum Qualifications Matrix for required minimum qualifications for FTEs performing this task. Personnel will have access to Secret Classified Information through SIPRNet.

6.13.1 Subtask 1 – UNIX and Linux Specialist Support.

The contractor shall:

6.13.2 Subtask 2 – UNIX and Linux Vulnerability Analysis.

The contractor shall:

6.13.3 Subtask 3 – UNIX and Linux Compliance Validation and Support.

The contractor shall:

6.13.4 Subtask 4 – UNIX and Linux Network Monitoring Software Oversight.

The contractor shall:

Review, coordinate, approve temporary use, and verify removal of network monitoring software for troubleshooting on UNIX and Linux assets IAW DISA policy.

Deliverables:

· Daily/weekly/monthly/quarterly/annual vulnerability analysis reports

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task#

and Remarks

dates provided by the Government

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.14 Task 14 – Cyber Administration and Support (Orders Management and Standardization, ITSM, ITIL and Process Improvement, Metrics) (Optional).

6.14.1 Subtask 1 – Cyber Orders.

The contractor shall analyze, assign, facilitate, track and report Cybersecurity Division compliance for approximately 200 DISA Orders annually. The contractor shall serve as Cybersecurity Division’s orders liaison for process stakeholders, to include Data Center LOB, Command and Control (C2), DISA Joint Operations Center (DJOC), Risk Management Executive, and Joint Forces Headquarters (DCDC). The contractor shall receive and acknowledge cyber orders from C2 and distribute clarifying guidance. Further, the contractor shall brief draft and active cyber orders to Cybersecurity Division and J-9 HaC.

6.14.2 Subtask 2 – Cyber Standardization.

The contractor shall collaborate with stakeholders, including DJOC, DCDC, United States (U.S.) Cyber Command, Cybersecurity Division and other DoD components, to review and coordinate on draft or needed cyber orders. Collaborate with DJOC to improve quality of orders. Escalate and communicate Requests for Information (RFI) or necessary order alterations. Provide input and create Orders reports for DoD Chief Information Officer Scorecard compliance.

6.14.3 Subtask 3 – ITSM.

The contractor shall provide System Matter Expertise (SME) with regards to ITSM, tools, and processes used in implementing a successful ITSM program in support of Cybersecurity Division initiatives. Develop, implement, and maintain Cybersecurity Division ITIL Process, Operating Level Agreements, and project plans and schedules. Collaborate with service delivery organizations and stakeholders to document Cybersecurity Division supporting processes. Conduct Cybersecurity Division briefings, technical meetings (internal and external representatives) and serve as a consultant to management on major matters pertaining to its policies, plans, and objectives. Provide strategic definitions, implementations and recommendations in support of Cybersecurity Division processes and work instructions. Communicate with all levels of management within the Cybersecurity Division and function at the strategic level with upper management and across various divisions within the Cybersecurity Division. Create and maintain Cybersecurity Division communication plans, processes, work instructions supporting the execution of change, manage feedback loops within and across program teams. Manage the Cybersecurity Division document approval process until the document is published for use. Provide gap analyses between cyber services current vs. future state conditions. Conduct Cybersecurity Division reviews, ensuring process gaps are remediated.

6.14.4 Subtask 4 - Process Improvement.

The contractor shall evaluate existing Cybersecurity Division processes and procedures and recommend changes to improve or enhance performance and maintainability. Implement a Cybersecurity Division Quality Assurance Program with quality controls to ensure all aspects of the Cybersecurity Division ITSM Program is continuously monitored for process improvement. Identify, refine, report and monitor Cybersecurity Division performance measurements to include Key Performance Indicators and Critical Success Factors.

6.14.5 Subtask 5 - Metrics Management Analysis.

The contractor shall provide compliance metrics and trend analysis, coordinate with stakeholders for feedback on outstanding issues, track status and prepare reports and briefings. Collect, analyze, report and archive cybersecurity metrics in support of Cybersecurity Division initiatives and requirements. Provide metrics analysis and insight into Cybersecurity Division resource performance to include people, processes, and technology to improve Cybersecurity Division efficiency and effectiveness goals and/or objectives.

6.14.6 Subtask 6 - Metrics Management Improvement.

The contractor shall provide existing and/or recommend new processes for developing and documenting metrics, ensuring relevance and efficacy to include identification of data sources, baseline measurements, fiscal year targets, performance thresholds, metric measurement methods and analytic tools.

Deliverables:

· Daily/weekly/monthly/quarterly/annually Orders reports Process Gap analysis

· Updated Security Metric Analysis Procedures Weekly/monthly/quarterly/annually metrics and trending analysis reports

· Also includes Deliverables that apply to all tasks listed in section 6, Performance Requirements.

SOW

Task# Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

analysis reports

*Standard Distribution: One copy of the transmittal letter without the deliverable to the Contracting Officer; one copy of the transmittal letter with the deliverable to the Primary COR.

6.15 Task 15 -Strategic Partner Integration (Optional).

The contractor shall have access to Secret Classified Information through SIPRNet.

6.15.1 Subtask 1 – Planning.

The contractor shall, analyze, and solicit Cybersecurity Division feedback for current and planned programs and/or projects to determine security risks and technical feasibility, to include implementation and sustainment resource requirements.

Provide security engineering and integration services to include Service Request Form (SRF) and Letter Estimate evaluations for Strategic Partner programs. Ensure information system programs are registered in DoD’s mandated program registration system during SRF review process.